Safety
Use Maximum-Credible Accident
Scenarios for Realistic and
Reliable Risk Assessment
Faisal I. Khan,
Memorial Univ.
of Newfoundland
Posing various possible incidents — rather than just
the worst-case one — illuminates those that are really
important and are most likely. Such knowledge can
enhance safety and planning for emergencies.
T
here have been many methodologies proposed
for the risk assessment in the chemical process
industries (CPI). Among them, the most notable
ones are quantitative risk analysis, probabilistic
safety analysis, worst-case methodology for
risk assessment and optimal risk analysis. A critical review of these methodologies is available (1). The key
points of these methods are:
Quantitative risk analysis (QRA) — This method
is comprised of four steps: hazard identification, frequency estimation, consequence analysis and measure of risk.
The first step answers the question: What can go
wrong? This is the most important step because hazards
that are not identified will not be quantified, leading to
an underestimated risk (2, 3). The techniques used for
hazard identification include hazard indices, hazard and
operability (HAZOP) studies, failure mode and effect
analysis (FMEA), what-if analysis and checklists. After
the hazards are identified, the scope of a QRA is defined. The second step asks: How likely is the occurrence of each accident? Answering this question means
quantifying of the probability of each accident scenario.
The third step aims to quantify the negative impacts
of the envisaged accident scenario. The consequences
56
www.cepmagazine.org
November 2001
CEP
are normally measured in terms of the number of fatalities, although they can also be determined by the
number of injuries or value of the property lost. The
last step of a QRA is to calculate the actual risk.
Probabilistic safety analysis (PSA) — Different techniques can be combined to carry out PSA (4, 5, 6). PSA
provides a framework for a systematic analysis of hazards and quantification of the corresponding risks. It
also establishes a basis for supporting safety-related decision-making. The methodology and the procedures
followed for the PSA of a typical chemical installation
handling a hazardous substance can be outlined in seven
major steps: (1) hazard identification; (2) accident-sequence modeling; (3) data acquisition and parameter estimation; (4) accident-sequence quantification; (5) hazardous substance-release-categories assessment; (6)
consequence assessment; and (7) integration of results.
Worst-case methodology for risk assessment — An
excellent work on hazard and risk screening based on
worst-case methodology is presented by Hirst and
Carter (7). The method does not discuss use of worstcase scenarios in detailed risk assessment, but rather
outlines the development of ready-made and easy-touse risk indices, such as the risk integral, scaled risk integral and approximate risk integral, for early planning
Modularization of Complete
Plant into Manageable Units
and decision-making. It is recommended that
Hazard Identification
if the values of computed risk indices are
• HIRA Technique
above acceptance criteria, then a detailed
Aid to Develop
risk assessment be made. Although this
Accident Scenario
methodology computes these indices based
on the worst-case of an accident in a unit, it
Qualitative Hazard Assessment
makes the computation more realistic by
• optHAZOP procedure
Aid to Develop
• TOPHAZOP tool
considering many parameters, such as condiAccident Scenario
tional plume probability, the population distribution factor, and weather and directional
probabilities. This method does not actually
Quantitative Hazard Assessment/Consequence Assessment
assess the hazard/risk in a unit, since the
• MOSEC for fire and explosions
worst-case scenario remains almost constant
• HAZDIG for toxic release and dispersion
• DOMIFFECT for cascading effects
for different units; it just depends upon the
type/quantity of the chemical in the unit (8).
Optimal risk analysis (ORA) — This is a
fairly new means for risk analysis (1, 9).
ORA involves four steps: (1) hazard identifiProbabilistic Hazard Assessment
• PROFAT tool
cation and screening; (2) hazard assessment
(both qualitative and probabilistic); (3) quantification of hazards or consequence analysis;
and (4) risk estimation (Figure 1). This pro■ Figure 1.
cedure is named ORA as it is swifter, less exRisk Estimation
Steps and methods used
pensive to implement, less time-consuming
to conduct an optimal risk
and more-precise than alternative analyses
analysis (ORA).
(1, 10). Central to all of these methods is
predicting accident scenarios; a set of scenarStop
ios is developed and subsequently analyzed
for detailed consequences.
Significant advancement has been made
in developing newer means for hazard and risk assessment,
There is a wide variation in the risk-assessment studies
consequence modeling, and user-friendly computer-aided
conducted by different groups. Foremost in this is the diftools. However, while foreseeing worst-case scenarios is
ference in the envisaged accident scenarios. For the same
common, little attention is paid in envisioning credible sceunit, one group foresees a small leak from the joints and
narios. Moreover, the scenarios developed by safety engiestimates risk based on that, while another group imagines
neers often describe just one type of release, without giving
an explosive release of all vessel contents. Moreover, it has
much detail about its mode and further escalation. This point
also been observed that only one or two scenarios are deis cited in the magnum opus on loss prevention by Lees (11):
veloped for a possible accident in a unit, and these may not
“For a potential release, it is necessary not
reflect the true important possible incidents. This is due to
only to identify a source but also to decide on the
the absence of any homogeneous system for accident-scenature of the release which could occur … The
nario envisaging and credibility assessment.
identification process should not stop at the point
A credible accident is one within the realm of possibiliwhere a release occurs, but in principle should be
ty and is likely to be severe enough to cause significant
continued to embrace the consequences of the redamage. However, what constitutes reasonable probability
lease and the failures and other events, which may
and significance of credibility are mostly qualitative, based
allow these consequences to escalate. In practice,
on the subjective judgment of the analyst. A small error or
this aspect is usually treated as part of the hazard
a bit of ignorance in these subjective judgments (in particuassessment. Whilst this is a reasonable approach,
lar, the development of accident scenarios) can yield errothere is a danger that, unless the identification of
neous results or make the study meaningless. The more rethe escalation modes is treated with a thoroughalistic the accident scenario, the more accurate the foreness matching that applied to the identification of
casting will be for this type of accident, its consequences
the release modes, features which permit escalaand associated risks. This would help in developing more
tion and against which measure might be taken
appropriate and effective strategies for crisis prevention
will be missed. The identification of the modes of
and management (12).
escalation appears to be a rather neglected topic.”
Thus, it is necessary to have some systematic procedure
CEP
November 2001
www.cepmagazine.org
57
Safety
Accidental Release of Chemical
Operational Data
Temperature
Pressure
Capacity of the unit
Chemical characteristics, etc.
Release under high pressure
Normal continuous release
Normal instantaneous release
Non-operational Parameters
Chemical properties
Toxicity
Atmospheric conditions
Quantity released
Site characteristics
Safe
No
Yes
No
Is the chemical
flammable/reactive?
Is the chemical
toxic?
Yes
Yes
Fire
Fireball
Flash fire
Pool fire
Jet fire
Explosion
CVCE
BLEVE
VCE
Vented explosion
Dispersion of
Toxic Chemical
Toxic load
■ Figure 2.
Non-operational Parameters
Chemical characteristics
Ignition source
Quantity of chemical released
Atmospheric conditions
Degree of confinement
Site characteristics
The logistics of
generating an
accident scenario.
Accident Scenario:
Sequence of events
or guidelines to envisage all probable accident scenarios,
and, further, to decide which are the most credible. Also, a
scenario should describe the complete situation (right from
release mode to the subsequent events).
Accident scenario
This is a description of an expected situation. It may
contain a single event or a combination of them. In most
of the past risk-assessment reports, accident scenarios
have been proposed as single events, which is not a valid
way of imagining an incident. Past case studies show that
an accident occurs as a sequence or combination of
events. Creating a scenario does not mean that it will
occur, only that there is a reasonable probability that it
could. A scenario is neither a specific situation nor a specific event, but a description of a typical situation that
covers a set of possible events or situations (Figure 2). It
is the basis of the risk study; it tells us what may happen
so that we can devise ways and means of preventing or
minimizing the possibility.
An accident scenario forms a focal point of a heuristic
process. It enables use of the wisdom of hindsight and
state-of-the-art knowledge to evaluate its impact in forecasting accident situations. The scenario is a reference
58
www.cepmagazine.org
November 2001
CEP
point, as well as a link between the past, present and future. Such scenarios are generated based on the properties
of chemicals handled by industry, physical conditions
under which reactions occur or reactants/products are
stored, as well as geometries/material strengths of vessels
and conduits, in-built valves and safety arrangements, etc.
External factors, such as site characteristics (topography,
presence of trees, ponds, rivers in the vicinity, proximity to
other industries or neighborhoods, etc.) and meteorological
conditions, need also be considered.
Worst-case accident scenario
The Emergency Planning and Community Right to
Know Act (EPCRA) was passed in 1986, in the wake of
the tragic chemical accident in Bhopal, India. EPCRA established some systems to cope with chemical emergencies
including Local Emergency Planning Committees
(LEPCs). LEPCs must prepare comprehensive emergency
plans outlining local chemical hazards and emergency response procedures. For these plans, the U.S. Environmental Protection Agency (EPA) recommends that LEPCs either prepare themselves or request facilities to prepare
emergency plans based on worst-case scenarios (8, 13).
Worst-case accident scenarios indicate the geographic
area (the vulnerable zone) affected by the worst-possible
accident at a facility in which people would be at risk of
life and health. These scenarios typically consider the nearinstantaneous release of the entire amount of a chemical
stored at a facility and assume the failure of mitigation and
safety systems. EPA and other regulatory agencies have
been canvassing the worst-case scenarios for emergency
planning; these scenarios are also critical for pollution prevention. The Clean Air Act Amendments (CAAA) of 1990
require companies to prepare risk management programs,
including worst-case accident scenarios, and make them
available to the public. Many companies are questioning
the significance of the worst-case accident scenario concept and opposing the national and public data systems that
include the risk management plan (RMP) on the Internet
(8). Although, the author agrees with CAAA and Right to
Know Act, the worst-case accident scenario may not be the
best approach. This author feels that RMPs and other
emergency plans should be based on the maximum-credible accident scenarios. Maximum credibility should be set
by regulatory agencies, depending upon the vulnerability
of a site. This would overcome the following major limitations of the worst-case-accident-scenario approach:
• In the worst-case method, emergency or risk-management planning is done mostly based on the release and dispersion of toxics as they cover maximum distances and
may cause a large number of fatalities by a short exposure,
as in Bhopal. However, it is not always true that a release
of toxic chemical would be the most disastrous one, particularly if the domino effect were considered (12, 14, 15).
The 1984 incident in Mexico and one in Vishakhapatnam,
India (1997) are clear evidence of this (15, 16).
• In using the worst-case scenario, only one-parameter
damage potential is considered, and the probability of its
occurrence is generally ignored. However, the probability
of an accident is also equally important. Past accident analysis reveals that frequent, but less-damage-causing accidents can create large financial losses and, often, can escalate to catastrophic proportions due to negligence. A detailed description of the maximum-credible-accident-scenario approach is now presented.
Maximum-credible accident scenarios
In using maximum-credible accident scenarios
(MCAS), the central criterion is what constitutes a credible
accident. A credible accident is defined as: an accident that
is within the realm of possibility (i.e., probability higher
than 1 × 10–6/yr) and has a propensity to cause significant
damage (at least one fatality). This concept (11, 17, 18, 19)
comprises both parameters — probable damage caused by
an accident and its probability of occurrence. There may be
types of accidents that may occur frequently, but would
cause very little damage. And there may be others that may
cause great damage, but would have a very low probability
of occurrence. Both would be considered accidents.
A credible accident scenario should contain two sets of
information: a description of the situation and its probability of occurrence. The description must not reduce the freedom of finding solutions and must not restrict the means
available for solution. A good accident scenario should describe the most prime cause of an event. An example: Define a leak rate instead of an explosion pressure, because
here, one could go further and describe the cause of the
leak as well.
There may be number of accidents that occur quite frequently, but due to proper control measures or lesser quantities of chemicals released, they are controlled effectively.
A few examples are a leak from a gasket, pump or valve,
release of a chemical from a vent or relief valve, and fire in
a pump due to overheating. These accidents generally are
controlled before they escalate by using control systems
and monitoring devices — used because such piping and
equipment are known to sometimes fail or malfunction,
leading to problems. On the other hand, there are less problematic areas/units that are generally ignored or not given
due attention. This is because few or even no accidents
have been reported. In such situations, even a small leak
may lead to a disastrous accident. Past accident analysis reveals that most of the catastrophic accidents occurred in ignorance (the accident was not foreseen) and either in areas
marked yellow (not highly hazardous) or where the control
arrangements were inadequate (control measures based on
less credible scenarios). The disaster at Vishakhapatnam
proves that most of the risk and hazard studies are lacking
in envisaging the credible accident scenarios, therefore, the
control measures or emergency plans are not so effective.
Methodology for MCAS
The first step of the MCAS methodology develops all
plausible accident scenarios in the unit (Figure 3). In the
second step, damage radii are calculated for each scenario.
This can be done using quantitative hazard indices. There
are two options available — one is to use Dow’s Fire and
Explosion Index (for fire and explosion scenarios) and the
Mond Toxic Index (for toxic and corrosive releases and
dispersions) (9, 11, 20). The other is to employ the indices
proposed by Khan and Abbasi (1, 21); a fire and explosion
damage index (FEDI), and toxic damage index (TDI) for
flammable and toxic chemicals, respectively.
In the next step, the probability of each accident scenario is estimated. This can be done using either industryspecific data (failure rates of various components used in a
process unit) or the data available in the literature (frequencies of occurrence of the same event under similar conditions). The later process of probability estimation is easy,
but a little crude, and has been subject to criticism. However, this author feels that this procedure is adequate, as the
objective is to get a rough estimate of probability. If the accident is found to be credible, more accurate estimation of
its probability would be done in the subsequent step of de-
CEP
November 2001 www.cepmagazine.org
59
Safety
Take One Unit
Develop All Plausible Accident Scenarios
Consider One Accident Scenario
Flammable
Toxic
Is the Chemical
Flammable or Toxic?
Both Flammable
and Toxic
Calculate Factor A
Calculate Factor B
Calculate Factor AA
Calculate Factor C
Calculate Factor BB
Calculate Credibility Factor L1
Calculate Credibility Factor L2
of formulating the accident scenario.
According to the characteristics of
the chemical, accident scenarios can be
divided into three main groups: fire
and explosion; release and dispersion
of a toxic or corrosive fluid; and both
fire and explosion, and toxic events. In
real life, many times the third type of
accident occurs. Once damage radii
and probabilities are known for each
damaging event, three factors — A, B
and C — are computed using site-specific information, such as population
density, asset density of the site, etc.,
to define credibility. The estimating
procedures follow for each of the three
incident groups.
Scenarios involving fires
and explosions
Financial loss: Factor A accounts for
the damage to property or assets and may
be estimated for each scenario using:
Ai = (AR)i × (PR)i × (AD)i /UFL (1)
Calculate Total Credibility Factor L
A = minimum (1, ΣAi)
Classify Credibility of the Scenario
Is it Credible?
No
Yes
List the Scenario
Are all Units Over?
Yes
Short-list the Most Credible
Accident Scenarios
■ Figure 3. Steps in the most-credible-accident scenarios (MCAS) method.
tailed risk assessment. The use of more reliable methods of
probability estimation (e.g., fault-tree analysis) not only requires large sets of data, but also large amounts of computational time. These costs are not justifiable at this stage
60
www.cepmagazine.org
where i is the number of events (from i
= 1 to n), i.e., fire, explosion. UFL is the
unacceptable financial loss. For example, a loss of $1 million/100 yr may be
just tolerable to an organization, so a
loss higher than this unacceptable. We
suggest a value of $10,000/yr for UFL.
Fatalities: Similar to the factor for financial loss, the fatality factor, B, is estimated for each accident scenario:
PD1 = PD1 × PDF1
No
November 2001
CEP
(2)
(3)
Bi = (AR)i × (PR)i × (PD1)i/UFR (4)
B = minimum (1, ΣBi)
(5)
UFR, the unacceptable fatality rate,
has a suggested value = 10–2. PDF1, the
population distribution factor, reflects
the heterogeneity of the population distribution. If the population is uniformly
distributed in the region of study
(~2,000-m radius), the factor is assigned a value of 1; if the
population is localized and away from the point of accident, the lowest value of 0.2 is assigned. Values for this parameter has been adapted from Ref. 9.
Importance Factor
1
0.8
0.6
Nomenclature
0.4
0.2
0
0
1
5
10
50
Distance of Vulnerable Ecosystem from the Accident Site, km
■ Figure 4. Importance factor, IM, is a measure of the spread of potential
damage.
A
AD
AR
B
BB
C
CC
IM
L
L1
L2
PD1
=
=
=
=
=
=
=
=
=
=
=
=
PD2 =
Ecosystem damage: Factor C signifies ecosystem damage, which can be estimated as:
Ci = (AR)i × (PR)i × (IM)i/UDA
(6)
C = minimum (1, ΣCi)
(7)
UDA, the unacceptable damage area, has a suggested
value of 1,000 m2/yr. IM, the importance factor, is 1 if the
damage radius is higher than the distance between accident
and location of a sensitive ecosystem, i.e., lake, forest, bird
sanctuary, etc. IM is quantified using Figure 4, developed
with the help of Ref. 22. In this reference, the authors use a
parameter ecosystem damage-penalty for the quantification
of an accident hazard index, AHI. This parameter was
quantified based on a comprehensive Delphi (22). (Delphi
is a technique to quantify subjective parameters through an
opinion survey of a team of experts. Delphi was used to
quantify some parameters of the AHI.)
These three factors are combined together to yield L1 by:
L1 = [1 – (1 – A)(1 – B)(1 – C)]
(8)
Scenarios involving toxic
release and dispersion
Unlike for fire and explosion, two factors are estimated
here, BB and CC, for fatality and ecosystem damage, respectively. These are computed using the following equations:
PD2 = PD2 × PDF2
PDF1 =
PDF2=
PR =
UDA =
UFL =
UFR =
WPF =
factor for damage to property or assets
asset density in the vicinity of the event, up to ~500-m radius), $/m2
area inside the damage radius, m2
factor for fatalities
factor for toxic release and dispersion for fatalities
factor for ecosystem damage
factor for toxic release and dispersion for ecosystem damage
importance factor, from Figure 4, dimensionless
total credibility factor, dimensionless
credibility factor for fire and explosion hazard, dimensionless
credibility factor toxic hazard, dimensionless
population density in the vicinity of the event (fire and explosion) up to ~2,000-m radius, persons/m2
population density in the vicinity of the event (toxic release) up
to ~2,000-m radius, persons/m2
population distribution factor for fire and explosion,
dimensionless
population distribution factor for toxic release and dispersion,
dimensionless
probability of occurrence of an event, /yr
unacceptable damage area, m2/yr
unacceptable financial loss, $/yr
unacceptable fatality rate, persons/yr
weather probability factor, dimensionless
study (an area of ~2,000-m radius). The method of quantification is same as for PDF1. WPF represents the likelihood of the weather condition used in the dispersion estimation. Generally, the maximum possible damage area is
estimated considering a slightly stable or stable condition.
However, this condition may not prevail at all times, so
0.0
Uncertainty Zone
0.2
■ Figure 5.
Credibility Zone
Classification of
credibility.
(9)
0.5
BBi = (AR)i × (PR) × (PD2) × (WPF)/UFR
(10)
BB = minimum (1, maximum of BBi)
(11)
Maximum Credibility Zone
where i denotes the particular chemical released. In case of
an accident scenario involving more than one chemical, BB
is computed for each and the highest value is used. PDF2
defines the population distribution factor, which reflects the
heterogeneity of the population distribution in the region of
1.0
CEP
November 2001 www.cepmagazine.org
61
Safety
Table 1. Data setting for the ammonia study.
Parameters
Value
Chemical involved
Delineation of MCAS
The credibility ranking is shown Figure
500 m.t.
5. Region 0–0.2 signifies the zone of uncerLiquefied
tainty, which means that the envisaged sceStorage
narios do not pose much threat either due to
15˚C
very low probability of occurrence or damage potential. This zone signifies the tolera6.5 atm
ble risk zone. Region 0.2–0.5 signifies the
0.40
credible scenarios, meaning they are likely
250 persons/km2
to occur and may cause enough damage.
$300/m2
Region 0.5 onwards signifies MCAS,
which means the developed scenarios are
0.3
highly vulnerable to cause catastrophes.
0.3
Once all of the credible and MCAS
1.0
have been identified, they are further studied to decide the most credible ones as per
the analyst criterion. The quantitative value of this credibility criterion is defined considering: the objective of study,
available time and resources, and the operational constraints. Therefore, the significance of the term “most credible” varies widely, depending upon the analyst or team of
analysts conducting the study.
This would further short-list important accident scenarios. The short-listed scenarios may be further processed for
damage potential estimation, risk estimation, and finally, to
develop hazard mitigation/minimization or disaster management strategies. The proposed approach is now used to
study the storage of liquefied ammonia.
Ammonia
Quantity of the chemical involved
Phase of the chemical
Unit operation
Operating temperature, T
Operating pressure
Degree of conjunction at the site
Site population density (within region of 2,000-m radius)
Asset density (within region of 500-m radius)
Population distribution factor
Weather probability factor
Importance factor
this factor estimates the probability of this atmospheric
condition occurrence. This is quantified using the statistical
weather data of the local area. For example, if a slightly
stable condition exists 30% of the time during a year, then
the WPF is considered to be 0.30.
Similarly, CC is computed as:
CCi = (AR)i × (PR) × (IM)/UDA
(12)
CC =minimum (1, maximum of CCi)
(13)
Finally, these two factors are combined to give a credibility factor L2 for toxic release and dispersion:
L2 = [1– (1 – BB)(1 – CC)]
(14)
Scenarios involving combination of
fire, explosion and toxic release
To estimate the credibility of accident scenarios involving both type of events, L1 and L2 are combined as follows:
L = (L12 + L22)1/2
(15)
Case study: Ammonia
A vessel stores 500 metric tons of liquefied ammonia at
of 15°C and 6.5 atm. The vessel is connected with one
input line, one outflow line, a pressure-relief valve and
other conventional safety devices. The vessel is in one corner of a fertilizer plant where the population density is 250
persons/km2, and asset density around the unit is $300/m2
(Table 1). There is bird sanctuary about 1,000 m away
from the site. A total of five different accident scenarios are
envisaged in the unit:
Table 2. Credibility factors for the scenarios in the ammonia study.
Accident
Scenario
Damage
Radius, m
Frequency of
Occurrence, (/yr)
Fire and Explosion
A
C
L1
Credibility
BB
CC
L2
L
Scenario 1
2,500
5.0E–05
1.00
0.98
1.00
1.00
Scenario 2
1,100
4.0E–04
1.00
1.00
1.00
1.00
Scenario 3
250*
1,270
7.0E–5
0.79
0.35
0.86
350†
1,200
1.0E–06
0.01
0.00
0.01
950
8.0E–05
0.51
0.22
0.61
Scenario 4
Scenario 5
* Damage radius for BLEVE (boiling liquid/expanding vapor explosion).
† Damage radius for CVCE (confined vapor cloud explosion).
62
B
Toxic Load
www.cepmagazine.org
November 2001
CEP
0.41
0.00
0.10
0.00
0.01
0.00
0.47
0.00
0.98
0.01
0.61
Table 3. Result of consequence analysis for Scenarios 1, 2, 3 and 5 for ammonia study.
Parameters
Scenarios and Their Likely Impacts
Scenario 1:
Continuous
Release
Explosion:
Total energy released, kJ
Peak overpressure developed, kPa
Variation of overpressure in air, kPa/s
Shock wave velocity, m/s
Duration of shock wave, ms
Scenario 2:
Continuous Release
near Ground
Scenario 3:
BLEVE with
Dispersion
BLEVE
1.11E+07
1,556.7
575.7
865.5
14
Scenario 5:
Evaporation
with Dispersion
NA
NA
NA
NA
745.6
6.5E+06
NA
NA
NA
0.17
0.30
0.02
NA
NA
NA
NA
NA
Toxic release and dispersion:
Instantaneous (I)/continuous (C)
Puff/plume characteristics:
Concentration at center of puff/plume, kg/m3
Concentration at the edge of puff/plume, kg/m3
Dia. of puff/plume at end of lethal zone, m
Radius of the lethal zone (based on LD50), m
C
Plume
3.14E–02
3.14E–03
210
2,500
C
Plume
4.15E–03
4.15E–04
170
1,100
I
Puff
3.78E–04
3.78E–05
375
1,270
C
Puff
1.15E–04
1.15E–05
115
950
Domino checking:
Location of the unit from primary event, m
60 m
60 m
60 m
60 m
NA
NA
NA
NA
NA
NA
3.15E+05
310
1.0
NA
NA
NA
3.15E+05
145.4
NA
Missile Characteristics:
Initial velocity of fragment, m/s
Kinetic energy of fragment, kJ
Penetration ability at 50 m:
Concrete structure, m
Brick structure, m
Steel structure, m
Fire:
Radius of fireball, m
Duration of fireball, s
Energy released by fire ball, kJ
Radius of pool fire, m
Burning area, m2
Burning rate, kg/s
Radiation heat flux, kJ/m2
Domino effect due to heat load:
Total heat received, kJ
Heat intensity, kJ/m2
Probability of domino effect due to fire
Domino effect due to overpressure:
Explosion energy, kJ
Peak overpressure, kPa
Probability of domino effect due to overpressure
Domino effect due to missile:
Explosion energy, kJ
Missile velocity, m/s
Probability of domino effect due to missile
after meeting target
NA
0.95
NA = Not applicable.
Scenario 1: High pressure in the vessel causes the pressure-relief valve (at the top of the vessel) to open, which
leads to a continuous release of ammonia to the atmosphere until 80% of the chemical is released.
Scenario 2: Due to improper maintenance or other
problems, a leak develops in the vessel’s input or output
pipeline. The leaking area is believed to be 40% of the
pipeline’s cross-sectional area. This scenario is modeled
as continuous release of liquid ammonia near ground
level causing subsequent evaporation and dispersion.
Scenario 3: High pressure develops in the vessel either
due to overfilling or to a runaway reaction. The instantaneous release of high pressure causes the vessel to fail as a
boiling-liquid, expanding-vapor explosion (BLEVE), and
the released chemical disperses into the atmosphere.
Scenario 4: Excessively high pressure develops in the
vessel beyond the design capacity of the pressure relief
valve. This causes vessel to burst as a confined vapor cloud
CEP
November 2001 www.cepmagazine.org
63
Safety
explosion (CVCE). The instantaneously released chemical
disperses into the atmosphere.
Scenario 5: Ammonia is released from the joints, causing a pool of liquid to form. The released chemical subsequently evaporates into the atmosphere and disperses.
Discussion
These five scenarios were assessed for the credibility estimations and results are presented in Table 2. It is evident
from the table that Scenarios 1, 2, 3 and 5 come in the range
of maximum credible range. Scenario 4 falls into the uncertainty range, and although it poses a considerably high
damage potential, credibility is nullified due to its very low
probability. However, since Scenario 2 has a high frequency
of occurrence, but does not pose much threat, still, it does
fall in maximum credibility range. The other scenarios have
adequate damage potentials and probabilities of occurrence.
Among MCAS, Scenario 1 engulfs largest damage area.
The short-listed scenarios were processed for detailed consequences and the summary of the results is presented in
Table 3. As per the study, Scenario 1 poses a severe threat
due to a toxic load over an area of more than a 2,500-m radius. The damage potentials of Scenarios 2 and 5 are limited to areas of ~1,000-m radius. Note that Scenario 3 is not
only vulnerable for toxic load (over an area of ~1,270-m ra-
Literature Cited
1. Khan, F. I., and S. A. Abbasi, “Techniques for Risk Analysis of
Chemical Process Industries,” J. of Loss Prevention in Proc. Ind., 11
(2), p. 91 (1998).
2. Van Sciver, G. R., “Quantitative Risk Analysis in the Chemical Process Industries,” Reliability Eng. & System Safety, 29, p. 55 (1990).
3. “Guidelines for Chemical Process Quantitative Risk Analysis,” Center for Chemical Process Safety, AIChE, New York, p. 125 (1989).
4. Popazoglou, I. A., et al., “Probabilistic Safety Analysis in Chemical
Installations,” J. of Loss Prevention Proc. Ind., 5 (3), p. 181 (1992).
5. Kafka, P., “Probabilistic Safety Assessment: Quantitative Process to
Balance Design, Manufacturing and Operation for Safety of Plant
Structures and Systems,” Principal Division Lecture, Trans. SmiRT,
11, p. 23 (1991).
6. Kafka, P., “Important Issues Using PSA Technology for Design of
New Systems and Plants,” GRS mbH, Garchirg, Germany (1993).
7. Hirst, I. L., and D. A. Carter, “A ‘Worst Case’ Methodology for
Risk Assessment of Major Accident Installations,” Proc. Safety
Progress, 19 (2), p. 78 (2000).
8. Laplante, A., “Too Close to Home: A Report on Chemical Accident
Risks in the United States,” U.S. Public Interest Research Group,
Washington, DC (1998).
9. Khan, F. I., and S. A. Abbasi, “Risk Assessment in the Chemical
Process Industries: Advanced Techniques,” Discovery Publishing
House, New Delhi, India, p. 393 (1998).
10. Khan, F. I., and S. A. Abbasi, “Risk Analysis of a Typical Chemical Industry Using ORA,” J. of Loss Prevention Proc. Ind., 14 (1), p.
59 (2001).
11. Lees, F. P., “Loss Prevention in the CPI,” Butterworths, London, pp.
26–28 (1996).
64
www.cepmagazine.org
November 2001
CEP
dius), but also for the shock wave developed due to the
BLEVE. The damage-causing shock wave would be operative over an area of ~250-m radius.
It was concluded that current safety measures were not
adequate and needed review in order to reduce the
risk/hazard potential to a tolerable level. It was advised
that safety-related decision-making (planning for disaster
management or emergency planning) should be done, conCEP
sidering Scenarios 1 and 3.
FAISAL I. KHAN is currently a visiting research professor at the Memorial Univ.
of Newfoundland (MUN) (Faculty of Engineering & Applied Science, MUN,
St John’s, NF, A1B 3X5, Canada; Phone: (709) 737-7652 or 8963; Fax: (709)
737-4042; E-mail: fkhan@engr.mun.ca). Before moving to MUN, he had
served about two years at the Birla Institute of Science and Technology
(BITS) in Pilani, India. He also headed the Computer Aided Environmental
Management unit at the Centre for Pollution Control and Energy
Technology for four years. Khan has over 70 research publications, along
with four books to his credit. He is the coauthor of “Risk Assessment in the
Chemical Process Industries: Advanced Techniques.” He is a cowinner of
the S. K. Mitra Award of 1998. Khan holds BS and ME degrees from Aligarh
Muslim Univ. and the Univ. of Roorkee in chemical engineering and
computer-aided process plant design, and he has secured II and I rank,
respectively, with first-class honors. He has a PhD from Pondicherry Univ.
in environmental systems engineering with special reference to risk
assessment and environmental impact assessment.
12. Khan, F. I., and S. A. Abbasi, “Studies on the Probabilities and
Likely Impacts of Chains of Accidents (Domino Effect) in the Fertilizer Industry,” Proc. Safety Progress, 19 (1), p. 45 (Spring 2000).
13. Skelton, B., “Process Safety Analysis: An Introduction,” Gulf Publishing, Houston, p. 201 (1997).
14. Khan, F. I., and S. A. Abbasi, “Models for Domino Effect Analysis
in the Chemical Process Industries,” Proc. Safety Progress, 17 (1), p.
121 (1998).
15. Khan, F. I., and S. A. Abbasi, “Major Accidents in the Process Industries and Analysis of Their Causes and Consequences,” J. of Loss
Prevention Proc. Industries, 12, p. 361 (1999).
16. Khan, F. I., and S. A. Abbasi, “The Worst Chemical Industry Accident of the 1990s — What Happened and What Might Have Been: A
Quantitative Study,” Proc. Safety Progress, 18 (1), p. 135 (1999).
17. Hagon, D. O., “Use of Frequency-Consequence Curves to Examine
the Conclusion of Published Risk Analysis and to Define Broad Criteria for Major Hazard Installations,” Chem. Eng. Res. Dev., 62, p.
381 (1984).
18. “The Tolerability of Risk Formation from Nuclear Power Stations,”
Health and Safety Executive, HM Stationary Office, London (1998).
19. Ale, B. J. M., “Risk Analysis and Risk Policy in the Netherlands
and EEC,” J. Loss Prevention Proc. Ind., 4 (1), p. 58 (1991).
20. Scheffler, N. E., “Improved Fire and Explosion Index Hazard Classification,” Proc. Safety Progress, 13 (4), p. 214 (1994).
21. Khan, F. I., and S. A. Abbasi, “Hazard Identification and Ranking
(HIRA): A Multi-Attribute Technique for Hazard Identification,”
Proc. Safety Progress, 17 (3), p. 16 (1998).
22. Khan, F. I., and S. A. Abbasi, “Accident Hazard Index: A Multi-Attribute Scheme for Process Industry Hazard Rating,” Trans. IChemE
(Environmental Protection and Safety), 75B, p. 217 (1997).