Accident Analysis and Prevention 41 (2009) 1206–1215
Contents lists available at ScienceDirect
Accident Analysis and Prevention
journa l homepage: www.e lsev ier .com/ locate /aap
The assessment of the damage probability of storage tanks in domino eventstriggered by fire
Gabriele Landucci a, Gianfilippo Gubinelli a, Giacomo Antonioni b, Valerio Cozzani b,∗
a Dipartimento di Ingegneria Chimica, Chimica Industriale e Scienza dei Materiali, Universita di Pisa, via Diotisalvi 2, 56126 Pisa, Italyb Dipartimento di Ingegneria Chimica, Mineraria e delle Tecnologie Ambientali, Alma Mater Studiorum - Universita di Bologna, via Terracini 28, 40131 Bologna, Italy
a r t i c l e i n f o
Article history:Received 9 November 2007Received in revised form 29 February 2008Accepted 19 May 2008
Keywords:Major accident hazard
a b s t r a c t
An approach aimed to the quantitative assessment of the risk caused by escalation scenarios triggered byfire was developed. Simplified models for the estimation of the vessel time to failure (ttf) with respect tothe radiation intensity on the vessel shell were obtained using a multi-level approach to the analysis ofvessel wall failure under different fire conditions. Each vessel “time to failure” calculated by this approachfor the specific fire scenario of concern was compared to a reference time required for effective mitigationactions and related to the escalation probability. The failure probability of each vessel was correlated to theprobability of scenarios involving multiple vessel failure as a consequence of the primary fire, thus allowing
EscalationDomino effectFireD
a comprehensive assessment of domino scenarios triggered by fire. The application of the methodology tothe analysis of several case-studies allowed the estimation of the quantitative contribution of escalation
the o
1
i1catDIiopeitvottisf
iatmfippwismfceacmmw
0d
amage probability models events triggered by fire to
. Introduction
Domino effect is responsible of severe accidents that took placen the chemical and process industry (CCPS, 2000; Khan and Abbasi,999; Lees, 1996). Several studies pointed out that the more criti-al step in the quantitative assessment of domino hazards is thevailability of reliable models to estimate the effects caused byhe escalation of primary accidents (Cozzani and Zanelli, 2001;elvosalle, 1998; Gledhill and Lines, 1998; Khan and Abbasi, 1998).
n particular, the damage probability of process and storage vesselsnvolved in fires is often calculated by the use of arbitrary thresh-ld values that do not take into account site-specific factors, as theossible mitigation due to effective emergency response (Cozzanit al., 2005a). On the other hand, very complex and time consum-ng approaches are available for the detailed calculation of the timeo failure (ttf) of storage vessels, requiring a detailed description ofessel geometry and other design data. The present study is focusedn the development of a simplified approach to the calculation ofhe damage probability of storage and process vessels, aimed to
he quantitative assessment of domino effect. The methodologys based on simplified correlations for the time to failure of ves-els as a function of the radiation intensity. These were obtainedrom an integrated approach, based on the use of available exper-
mental data, of finite elements modelling for complete thermalnd mechanical simulations of the behaviour of vessels exposedo fires, and of a simplified model for vessel failure based on ther-
al nodes. The available experimental data set was integrated bynite elements simulations of the behaviour of atmospheric andressurized vessels under different fire conditions: full engulfment,artial impingement and distant radiation. An extended data setas obtained from the simulations that were integrated with exper-
mental data. The data set was used for the development of theimplified correlations for time to failure as a function of radiationode and of radiation intensities. The correlations were obtained
or atmospheric as well as for pressurized storage vessels. Specificorrection factors were introduced in order to take into account theffect of thermal protections. Damage probability was estimated bysite-specific probabilistic function that takes into account the cal-ulated time to failure with respect to the time required for effectiveitigation. The damage model obtained was used for the assess-ent of the damage probability of equipment. Several case-studiesere defined to analyze model performance and to quantify theossibility of escalation in actual lay-outs.
. Lumped model for the estimation of vessel time to
ailure
Fire may affect a process or storage vessel by one or more thanne of the following modes: (i) distant source radiation; (ii) full orartial fire engulfment; and (iii) jet fire flame impingement.
Modelling vessel time to failure in these three situations isxtremely difficult given the high complexity of the flame geome-ries. The wall temperature behaviour in a vessel exposed to anxternal fire would require a detailed 3D analysis of the thermal fluxver the vessels shell, of the thermal gradients in the fluid contained
n the vessel and of the effects due to the mixing of the content dueo the natural convection. However, running a model based on thispproach for each vessel present in a process plant would requireprohibitive run time, not justified in a QRA framework due to
he uncertainties that usually affect the characterization of the firecenarios. In this specific context, a simplified model able to yield aonservative estimation of the time to failure by a straightforwardpproach is more useful. The model developed in the present studyas based on a lumped approach for the modelling of the time and
emperature profile, but was improved by an extended validationork, based on the use of an experimental data set for the vessel
ime to failure, extended by the use of a 3D finite element modelmplemented for this purpose.
The development of the lumped model was based on the def-nition of a limited number of “thermal nodes” where the actualroperties of the vessel were lumped. As shown in Fig. 1, thispproach attempted to divide the equipment in different zones (orodes), each of which was described by a simple set of parameters.he parameters represent physical quantities (e.g. temperature,ressure, thermal conductivity, etc.) averaged over each node. Con-
ervation conditions at the boundaries between different regions,ogether with global conservation laws, lead to a system of equa-ions which determines the parameters of interest and in particularhe temperature at each node (Gubinelli, 2005). This allows the cal-ulation of temperature-time profiles as a function of the radiation
aoatf
Fig. 1. “Thermal nodes” definition for the lumped model f
Prevention 41 (2009) 1206–1215 1207
ode and intensity on the vessel. The estimation of these parame-ers allows the evaluation of the mechanical stresses at which eachone of the vessels shell is subjected and to compare it with thedmissible tensile strength of the vessels material that depends onemperature. Specific simplified failure criteria were introduced tossess the time to failure and the failure conditions.
. Validation of the lumped model
.1. Approach to the validation of the lumped model
Although a significant number of case-studies resulted avail-ble, in particular for pressurized vessels, the number of availablexperiments was not sufficient to carry out an extended validationf the lumped model covering the entire field of vessel geometriesnd of radiation modes and intensities of practical interest. Thus,finite element model (FEM) was developed and validated on theasis of the available experimental data. The FEM was used to gen-rate a second data set used for the extension of the validation dataet of the lumped model.
.2. Features of the FEM used to extend the validation field
The FEM was developed using a commercial code with which
detailed simulation of the thermal and mechanical conditions
n vessel shells under fire radiation was possible. The model alsollowed a detailed simulation of the radiation mode, of the wallemperature and of the stress over the vessel shell. In the following,ew details on the model are reported.
or atmospheric tanks (a) and pressured vessels (b).
1208 G. Landucci et al. / Accident Analysis and Prevention 41 (2009) 1206–1215
F 3
sDu
ordtd
d
-
-
srJwFs
Fig. 3. (a) Detailed simulation of the stresses on the shell of the 17,480 m3 atmo-ssi
taiitf
mtttsad1t
ig. 2. (a) Detailed simulation of the temperature on the shell of 17,480 m atmo-pheric vessel under distant source radiation due to fire (20 kW/m2, 1200 s); (b)etailed simulation of the temperature on the shell of 100 m3 pressurized vesselnder radiation due to flame engulfment (120 kW/m2, 600 s).
The first step in the FEM simulations was the detailed calculationf the temperatures on the vessel shell as a function of time andadiation mode. The tanks were modelled as a cylindrical body withifferent types of ends (conic roof and a flat base for atmosphericanks, hemispherical heads for pressurized vessels). A proper meshefined for each geometry was considered.
Thermal loads were applied to simulate the shell temperatureistribution. Two different types of thermal loads were applied:
Constant heat loads: radiation from external fire, convection andfor the surface emission.Time-dependent heat loads: heat flux from the inner steel wall tothe fluid (gas or liquid phase).
The heat flux due to fire impingement was considered con-tant and a thermal load value was obtained from literature valueseferred to medium- and large-scale experiments (Cowley and
ohnson, 1992; Roberts et al., 2004). The heat transfer coefficients
ere derived from a literature data analysis (Knudsen et al., 1999).ig. 2 shows two examples of the results of the detailed temperatureimulations.
perm
pheric vessel under the conditions shown in Fig. 2(a); (b) detailed simulation of thetresses on the shell of the 100 m3 pressurized vessel under the conditions shownn Fig. 2(b).
The second step of the FEM modelling was the calculation ofhe transient stress field as a function of the local temperaturesnd of the other loads present on the equipment shell. Weight,nternal vapour pressure and hydraulic gradient were consideredn the analysis. Fig. 3 shows an example of the maps representinghe stress intensity field acting on the equipment shell obtainedrom the temperature simulations in Fig. 2.
The calculation of the detailed temperature and stress intensityaps allowed the application of the correct failure conditions and
hus an accurate calculation of the equipment time to failure. Inhe present study, vessel failure was assumed to take place whenhe equivalent intensity of combined stress, in the following thetress intensity (ASME, 1989), becomes greater than the maximumllowable stress, which is strictly dependent on temperature, andirectly derived from Section VIII, Division 2 of ASME codes (ASME,989). The comparison of the results of the FEM simulations withhe available set of experimental validation data showed that the
redicted times to failure were always conservative, with relativerrors always lower than 10%. Thus, the finite element code may beeasonably used to extend the validation of the simplified lumped
odel.
G. Landucci et al. / Accident Analysis and Prevention 41 (2009) 1206–1215 1209
Fmav
3
rgtbutfoaolf
4p
4
abSrmabSaawb
aFtcfsbvTr
Table 1Thresholds for escalation caused by fire radiation
Maximum time requiredfor effective mitigation(min)
Radiation thresholdatmospheric equipment(kW/m2)
Radiation thresholdpressurized equipment(kW/m2)
3
ftlitrimc
4
vstttTacmortst
P
wabIpmtp
m(gIioietta
ig. 4. Example of comparison between time to failure obtained with the lumpedodel runs, with finite elements simulations and literature data (Birk et al. (2006)
The results of the validation of the lumped model are summa-ized in Fig. 4. The figure evidences that the lumped model alwaysives credible and conservative values for the time to failure ofhe vessels. A 15% average relative error on the safe side is presentetween the ttf calculated by the lumped model and the data setsed for the validation. Therefore, the lumped model developed inhe present approach may be used in the assessment of the time toailure of the equipment exposed to fire, at least in the frameworkf quantitative risk analysis, due to the uncertainties that affects well the characterization of the fire scenarios. Thus, the resultsbtained by the lumped model were a starting point in the calcu-
ation of threshold values for escalation triggered by fire, as well asor the escalation probability.
. Estimation of escalation thresholds and of escalationrobability
.1. Escalation thresholds
The modelling approach carried out in the present study allowedn extended revision of the escalation thresholds for fire scenariosased on the time to failures estimated for different fire conditions.ince vessel failure is caused by the vessel wall heat-up and this is aelatively slow process (time to failure is, in general, of the order of
inutes or higher), a time lapse exists between the primary eventnd the secondary events caused by escalation. Thus, the ttf maye compared to an estimated time for an effective mitigation (tte).tandard values from the experience may be used to estimate tte. Asn alternative, site- or vessel-specific tte may be estimated from thenalysis of protection systems (dumping aimed to depressurization,ater curtains by automatic systems, additional water protection
y emergency teams).Fig. 5 reports an example of the times to failure calculated for
ll the vessels and radiation conditions considered in the analysis.ig. 5(a) is referred to atmospheric vessels, while Fig. 5(b) is relatedo pressurized tanks having 2.5 MPa design pressure. The envelopeorrelations shown in Fig. 6 define the minimum credible times toailure for vessels exposed to fire in the reference scenarios con-
idered. The envelope correlations showed in the figures shoulde intended as conservative correlations that should always pro-ide the minimum time to failure values for any credible scenario.hus, they were obtained considering the lowest ttf values for eachadiation value.
md
ug
10 15 6015 13 50
0 10 40
If the time to failure is compared to the maximum time requiredor effective mitigation, the threshold values of the stationary radia-ion intensity required for credible escalation may be identified. Theowest value of radiation intensity that may cause a vessel failuren the time lapse corresponding to the maximum time for effec-ive mitigation may be assumed as the reference threshold. Table 1eports the threshold values estimated by this approach. As shownn the table, the threshold values are strongly dependent on the
aximum time required for effective mitigation and on the vesselategory.
.2. Escalation probability
In Section 4.1 it was remarked that the time to failure of theessels exposed to fire is a fundamental parameter in the analy-is of domino accidents triggered by fire. The vessel ttf expresseshe resistance of the target equipment to an external fire. Morehe equipment is resistant to the fire, less credible is the escala-ion, since more time is available for effective mitigation actions.he vessel ttf expresses the resistance of the target equipment ton external fire. More the equipment is resistant to the fire, lessredible is the escalation, since more time is available for effectiveitigation actions by active safety systems or by emergency team
perations. Thus, the probability of damage and escalation may beelated to the time to failure of the equipment, comparing the ttfo the characteristic times required for successful mitigation. In aimplified approach, a specific probit function may be built to relatehe time to failure to the probability of escalation:
r = a + b ln(ttf) (1)
here Pr is the probit variable, ttf is the time to failure in thebsence of any mitigation action and the coefficients of the pro-it function a and b may be derived comparing the ttf to the tte.
n eq. (1) the ttf value takes into account the influence of the mainarameters that affect the severity of the fire scenario (radiationode, radiation intensity) and the vessel resistance to fire condi-
ions (vessel geometry, vessel failure conditions), while the a and barameters are derived from the tte.
The tte determination can only be based on a site-specific assess-ent of the emergency plans and of the mitigation actions available
e.g. number and position of emergency teams, availability of emer-ency water supply, availability of emergency water deluges, etc.).n the present study, two key times for emergency response weredentified: the maximum time required to start the emergencyperations (tte1) and the maximum time required to start the mit-
gation actions (tte2). The maximum time required to start themergency operations was defined as the time needed for the fireo be detected, the alarm to be given and the emergency procedureso be started. The maximum time required to start the mitigationction was defined as the time needed to pose in act the mitigation
easures in the emergency plan (e.g. start of the emergency water
eluges, water cooling by emergency teams, etc.).Thus, if ttf is lower than tte1, the escalation may not be avoided
nless particular events take place (anticipated alarm, etc.). In aeneral approach, credit should be given to the possibility that
1210 G. Landucci et al. / Accident Analysis and Prevention 41 (2009) 1206–1215
F er disl PRV u
ttwotiacrstaticteo
tatogwscowute
ig. 5. Times to failure obtained for vertical cylindrical atmospheric vessels undength/diameter ratio equal to 6 and 2.5 MPa design pressure (b). Failure with open
he automatic mitigations that may be present (water deluge sys-ems, blowdown systems, etc.) fail to stop the escalation chain. Thisas shown to be reasonable in several past accidents (due to lack
f emergency water, damage of emergency water piping due tohe primary scenario, bad maintenance of sprinklers, etc.). Hence,n order to effectively prevent the escalation, it is supposed thatdditional measures are required: in particular, fire mitigation andooling action of the tank by external emergency teams. These willequire a maximum time tte2 to be started. The tte2 should con-ider the “driving time”, which is needed for the displacement ofhe emergency teams (depending on lay-out, wind direction, etc.),nd the “deployment time”, which comprehends the set up andhe actual providing of the required amount of water for the cool-
ng action. If the ttf is higher than tte2, the escalation should beonsidered unlikely. Thus, on the basis of site-specific data for tte1,te2 and reliability of emergency systems, the a and b constants inq. (1) may be derived. At this stage of the work, for the analysisf the case-studies, the generic values of the a and b constants in
st
a
tant source radiation (a) and for horizontal cylindrical pressurized vessels withnder radiation due to flame engulfment.
he probit equation were derived from expert judgment based onsurvey of the times needed for the arrival of internal emergency
eams in different locations of extended storage farms of existingil refineries. A rough distribution of the time needed for emer-ency team arrival and starting of emergency cooling water supplyas obtained, showing that only in 10% of cases the cooling could
tart in less than 5 min and in 90% cases in less than 20 min. In 10%ases, it was estimated that particular scenarios may delay the startf water cooling (particular atmospheric conditions, problems inater supply, etc.). Thus, assuming a log-normal distribution of fail-re probability, an escalation probability equal to 0.1 (probit equalo 3.71) for ttf is equal to tte1 value, and an escalation probabilityqual to 0.9 (probit equal to 6.27) for ttf equal to tte2, the probit con-
tants in eq. (1) may be calculated. The following equations may behus derived for the calculation of the probit coefficients:
G. Landucci et al. / Accident Analysis and Prevention 41 (2009) 1206–1215 1211
F sels u(
b
2i
P
flSpe
4
niftempe
ig. 6. Envelope of times to failure obtained for vertical cylindrical atmospheric ves1.5–2.5 MPa design pressure) under radiation due to flame engulfment (b).
= 2.565log(tte1) − log(tte2)
(3)
In the present case, with tte1 equal to 5 min, and tte2 equal to0 min, the following expression is obtained for the ttf (expressed
n minutes):
r = 9.25 − 1.85 ln(ttf) (4)
It must be remarked that the above assumptions are derived
rom a generic analysis, useful for a preliminary assessment of esca-ation probabilities in the analysis of the case-studies considered.ite-specific values of the probit constants calculated by the aboverocedure should be used to obtain more reliable values of thescalation probability.
cdtT
nder distant source radiation (a) and for horizontal cylindrical pressurized vessels
.3. Assessment of vessel ttf by simplified correlations
Since in the risk assessment of complex industrial areas a hugeumber of possible targets of escalation triggered by fire may be
dentified, a very high number of simulations may be required toully investigate the problem. Even if the lumped model is charac-erized by a low computational time, its use may require a relevantffort in the analysis of extended areas, also considering that theodel, although simplified, requires to define and input several
arameters for each simulation (e.g. vessel geometrical data, prop-rties of vessel content, radiation mode, etc.).
Thus, a further simplification was introduced in the following toarry out a preliminary assessment of the time to failure of credibleomino targets in a complex lay-out. A specific approach was usedo define simple analytical functions for the evaluation of vessel ttf.he more important categories of secondary equipment involved in
1 is and Prevention 41 (2009) 1206–1215
daetsfvfaofivRib
rsicaict
lttctr
l
weFstvputTaCcbbg
5
dtie
Eci(tr
dsoS
ftGooit((gcioicast
iehchrsntsee
212 G. Landucci et al. / Accident Analys
omino accidents were identified, and reference geometrical char-cteristics were defined on the basis of typical design data used byngineering companies in the oil and gas sector. The design data ofhe reference atmospheric tanks considered were based on API 650tandards, while the volumes and diameters were based on datarom several oil refineries. In the case of pressurized vessels, theolumes and diameters were derived from vessels typically usedor LPG, vinyl chloride, chlorine and ammonia pressurized stor-ges. Cylindrical vessels with horizontal axis and design pressuresf 1.5, 2.0 and 2.5 MPa were considered. The design data were veri-ed with respect to ASME design code (ASME, 1989), and the reliefalves were considered to provide the vent area required by APIP 520 standards. In order to obtain conservative data, no thermal
nsulation and no active mitigation systems were considered foroth sets of vessels.
The more credible primary events were selected on the basis ofeports on past BLEVE accidents. Three radiation modes were con-idered: full engulfment in pool fires, partial or full impingementn jet fires, and distant radiation from pool and jet fires. Maximumredible radiation intensities were derived from theoretical modelsnd full-scale experimental data reported in the literature concern-ng radiation intensities for different types of fire. Further detailsoncerning the reference vessels and the scenarios considered inhe analysis are reported elsewhere (Cozzani et al., 2005a, 2006a).
An extended matrix of case-studies was thus defined. Theumped model was used to analyze each case-study, estimating theime to failure of the selected equipment exposed to the selectedype of fire attack and to different radiation values. A fitting pro-edure was implemented to obtain specific analytical functionso relate the time to failure of the equipment to the value of theadiating heat flow (I):
og10(ttf) = c log10(I) + d (5)
here the c and d constants (see Table 2) were calculated fittingq. (5) to the results of lumped model simulations, reported inig. 6. Fig. 6a shows the data matrix obtained for atmospheric ves-els under distant source radiation conditions. Fig. 6b shows part ofhe data matrix obtained for pressurized vessels. Table 2 reports thealues of the c and d parameters calculated by the above describedrocedure. As shown in the table, a dependency from vessel vol-me was introduced to improve data fit and to take into accounthe dependency of the ttf on the vessel geometry. Correlations inable 2 yield conservative data for the ttf of vessels having volumesnd operating pressures within the range specified in the table.learly enough, the data obtained by the correlations should beonsidered only a conservative estimate of the actual ttf, but maye useful at least for a preliminary assessment of escalation credi-ility, and may be used also in the absence of detailed data on vesseleometry.
. Case-studies
The escalation thresholds and damage probability modelseveloped in the present study are mainly aimed to allow the quan-itative assessment of the risk due to domino accidents. Thus, it ismportant to analyze the results obtained by the application of thescalation criteria discussed above to significant case-studies.
Two case-studies were defined and analyzed in the following.quipment, primary and secondary scenarios, and plant lay-outs
onsidered in the case-studies were derived from those of exist-ng plants. A specific methodology developed in a previous studyCozzani et al., 2005b) was applied for the calculation of the con-ribution of domino scenarios triggered by radiation to individualisk and societal was thus calculated.
reeta
Fig. 7. Case-study 1: lay-out considered.
The case-studies were analyzed by a specifically developedomino software package that was added to the Aripar-GISoftware (Cozzani et al., 2006b). The Aripar-GIS software was devel-ped in the framework of the ARIPAR project (Egidi et al., 1995;padoni et al., 2000, 2003).
The software requires the input of consequences and of expectedrequencies of all the primary events that should be considered inhe analysis. A simplified lay-out should be also implemented in aIS environment. Using the data on lay-out and on consequencesf primary events considered, the software allows the calculationf the radiation intensity due to any primary scenario considered
n correspondence of the possible target equipment. The softwarehen calculates the escalation probability combining eqs. (1) and5). The values of the a and b constants is a required user inputvalues in eq. (4) were used). The input of simplified data on targeteometry (type of vessel and vessel volume) allows the software toalculate the c and d constants in eq. (5) by the relations reportedn Table 2. On the basis of the equipment damage probability andf a reference secondary scenario associated to each equipment
tem, the software thus calculates the expected frequencies andonsequences of the escalation scenarios. The software also appliesspecific methodology in order to take into account the multiple
cenarios that may derive from the simultaneous failure of morehan one unit caused by the primary fire (Cozzani et al., 2005b).
In case-study 1, the possible escalation of a jet fire due to a leakn a LPG pump was considered. As shown in the lay-out consid-red, reported in Fig. 7, the G3 LPG pump is near to six 500 m3 LPGorizontal pressurized storage tanks. Three vessels (PVA4 to PVA6)an be directly impinged by the jet fire, while the others may beeated from jet fire radiation. A fireball was assumed as the likelyeference scenario following tank failure due to the G3 jet fire. As aimplifying hypothesis, in order to have only a single primary sce-ario that may cause escalation events, a flash fire was assumed ashe only possible primary event for the LPG storage tanks. Thus, aingle primary event, the G3 jet fire, was considered as a possiblescalation trigger. Table 3 summarizes the primary and secondaryvents considered in the analysis of the case-study. The table also
eports the frequencies assumed for the primary events and thescalation probabilities calculated by the Aripar-GIS software forach of the six LPG storage tanks by the approach discussed in Sec-ion 4. Fig. 8 reports the results obtained for the individual risk withnd without scenarios due to escalation triggered by fire.
G. Landucci et al. / Accident Analysis and Prevention 41 (2009) 1206–1215 1213
Table 2Envelope correlations for distant source radiation. Time to failure expressed in s, volume (V) in m3, radiation (I) in kW/m2
Equipment Atmospheric equipment Pressurized
Volume range (m3) 25–17,500 5–250Design pressure range (MPa) 0.1 1.5–2.5Envelope correlation ln(ttf) = −1.13 ln(I) − 2.67 × 10−5 V + 9.9 ln(ttf) = −0.95 ln(I) + 8.845 V0.032
Fig. 8. Case-study 1: increase in the individual risk due to escalation events evi-dnl1
Table 5Case-study 2: probability of escalation scenarios involving single or multiple units
Primary event Secondary simultaneous events (combinations) Probability
P33 P34 only 21%P34 P33 only 19%
P35 P34 only ∼15%P33 only <10−4
P34 AND P33 <10−4
P
wcsejt(taEtbt
tdls
enced by the change in the individual risk contours. Thin lines: individual riskot considering escalation; thick lines: individual risk considering escalation. Solid
ines: 10−6 events/year (not reached in the absence of domino effect); dashed lines:0−7 events/year; dotted lines: 10−8 events/year.
The G3 jet fire was considered only as a primary event, but itsontribution to the overall individual risk is negligible due to theimited damage radius and to the short time of exposure assumed.evertheless, the secondary scenarios that may be triggered by this
ow severity-initiating event cause a relevant increase of the indi-idual risk, as shown in Fig. 8. The figure evidences that maximumalue of the individual risk increases of two orders of magnitudehen considering domino scenarios triggered by fire, and the areahere the individual risk is higher than 10−8 events/year is 200 mider in radius (from 170 to 370 m), due to the severity of the sec-
ndary fireballs that may follow LPG tank BLEVE due to the jetre.
Another significant example of the changes in individual risk
ue to escalation events triggered by fire was obtained in case-tudy 2, where the escalation events triggered by several primaryet fires were considered. Fig. 9 shows the lay-out defined for thease-study. In the lay-out, a pipeline connects the unloading zone,
able 3ase-study 1: frequencies of primary events and escalation probabilities
vent Primary event and frequency,including ignition probability(events/year)
here rail tankers stop, to four mounded pressurized storage unitsontaining liquid butane. A further pipe connects the storage ves-els to evaporator E101 and to the process facility. The escalationvents triggered by four different jet fire events were analyzed. Theet fires were assumed to take place in four different locations: onhe pipeline from the storage tanks (P33), on the evaporator E101P34) and following two different failure modes of loading arms inhe butane unloading zone (P35 and P36). Secondary events weressumed to be likely to take place mainly due to the failure of the101 evaporator (P34) and of the pipeline connected to the storageanks. In order to simplify the analysis and to obtain results that maye more easily interpreted, no secondary target was considered inhe unloading area.
Table 4 reports the damage probabilities and radiation intensi-ies calculated by the Aripar-GIS software using the damage modeliscussed in Section 4. These range between 3 and 21%. The most
ikely escalation event involves the damage of pressurized ves-el P34 (the evaporator E101) caused by a release from the inletipeline (P33). However, also the pipeline failure caused by a jetre due to a leak from the evaporator has almost the same proba-ility, due to the very low separation distance between P33 and P34.failure in the evaporator drum may also be caused by jet fires from
he unloading zone, although probabilities are lower. In the lay-outonsidered, the probabilities of simultaneous failure of more thanne unit are limited, thus the more likely escalation events resultedhose involving only one secondary unit. Thus, each credible escala-ion scenario only involves one secondary event and its probabilitys almost equal to the escalation probability for the unit concerned,s shown in Table 5.
Fig. 10 shows the changes in the individual risk due to the con-
ribution of the domino scenarios. The figure evidences that theigh severity of the flash fires that may take place as secondaryvents causes an important increase in the individual risk val-es. The diameter of the area were individual risk is higher than0−6events/year is clearly enlarged, and that where risk is higher
1214 G. Landucci et al. / Accident Analysis and Prevention 41 (2009) 1206–1215
Fig. 9. Case-study 2: lay-out considered and sources of LOC events.
F lines:e t); da
ot
6
es
ffisa
ig. 10. Case-study 2: increase in the individual risk due to escalation events. Thinscalation. Solid lines: 10−6 events/year (not reached in the absence of domino effec
f 10−7 events/year extends to a distance higher than 100 m fromhe units concerned.
. Conclusions
A simplified approach was developed for the estimation ofscalation thresholds and escalation probabilities triggered by firecenarios. The approach was based on the development of tools
or the straightforward assessment of vessel time to failure due tore radiation in different radiation modes. The comparison of ves-el time to failure with the time required for effective mitigationctions allowed the estimation of reliable thresholds for escalation.
implified models for escalation probability were also obtained byhis approach. The application of these tools to case-studies provedheir effectiveness in the estimation of escalation probability in
QRA framework, thus allowing the assessment of the increasen the individual risk due to domino scenarios. The case-studies
is and
etts
R
A
B
C
C
C
C
C
C
C
D
E
G
G
K
K
K
L
P
R
G. Landucci et al. / Accident Analys
videnced that the increase in the individual risk due to escala-ion events triggered by fire may give an important contributiono industrial risk, since high severity scenarios may result from theimultaneous damage of several process units.
eferences
merican Society of Mechanical Engineers (ASME), Boiler and Pressure Vessel Com-mittee, 1989. Boiler and Pressure Vessel code, Section VIII, Div.2, 1989 ed.American Society of Mechanical Engineers, New York.
irk, A.M., Poirier, D., Davison, C., 2006. On the response of 500 gal propane tanks toa 25% engulfing fire. J. Hazard. Mater. 19, 527–541.
enter for Chemical Process Safety (CCPS), 2000. Guidelines for chemical processquantitative risk analysis, II Edition. American Institute of Chemical Engineers,New York.
owley, L.T., Johnson, A.D., 1992. Oil and Gas Fires—Characteristics and Impact. OTI92 596, Health and Safety Executive, London.
ozzani, V., Zanelli, S., 2001. An approach to the assessment of domino accidentshazard in quantitative area risk analysis. In: Proceedings of the 10th InternationalSymposium on Loss Prevention and Safety Promotion in the Process Industries,Amsterdam, p. 1263.
ozzani, V., Gubinelli, G., Salzano, E., 2005a. Criteria for the escalation of fires andexplosions. In: Proceedings of the 7th Process Plant Safety Symposium, A.I.Ch.E.,New York, p. 225.
ozzani, V., Gubinelli, G., Antonioni, G., Spadoni, G., Zanelli, S., 2005b. The assessmentof risk caused by domino effect in quantitative area risk analysis. J. Hazard. Mater.
A127, 14–30.
ozzani, V., Gubinelli, G., Salzano, E., 2006a. Escalation thresholds in the assessmentof domino accidental events. J. Hazard. Mater. 129 (1–3), 1–21.
ozzani, V., Antonioni, G., Spadoni, G., 2006b. Quantitative assessment of dominoscenarios by a GIS-based software tool. J. Loss Prev. Process Industries 19,463–477.
S
S
Prevention 41 (2009) 1206–1215 1215
elvosalle, C., 1998. A methodology for the identification and evaluation of dominoeffects, Rep. CRC/MT/003. Belgian Ministry of Employment and Labour, Brux-elles.
gidi, D., Foraboschi, F.P., Spadoni, G., Amendola, A., 1995. The ARIPAR project:an analysis of the major accident risks connected with industrial and trans-portation activities in the Ravenna area. Reliability Engineering System Safety,49–75.
ledhill, J., Lines, I., 1998. Development of methods to assess the significance ofdomino effects from major hazard sites. CR Report 183. Health and Safety Exec-utive, London.
ubinelli, G., 2005. Domino effect in the process industries: quantitative method-ologies for the evaluation of consequences, 2005. Ph.D. thesis in ChemicalEngineering. University of Pisa, Pisa.
han, F.I., Abbasi, S.A., 1998. Models for domino effect analysis in chemical processindustries. Process Safety Progress 17 (2), 107–123.
han, F.I., Abbasi, S.A., 1999. The worlds worst industrial accident of the 1990s—whathappened and what might have been: a quantitative study. Process safetyprogress 18 (3), 135–145.
nudsen J. G., Hottel H. C., Sarofim S.M., Wankat D., 1999. Perry’s Chemical Engineers’Handbook, ed.7 section5, pp. 12–20.
ees, F.P., 1996. Loss Prevention in the Process Industries, II ed.Butterworth–Heinemann, Oxford.
ersaud, M.A., Butler, C.J., Roberts, T.A., Shirvill, L.C., Wright, S., 2001. Heat-up andfailure of liquefied petroleum gas storage vessel exposed to a jet-fire. In: Pro-ceedings of the 10th International Symposium on Loss Prevention in the ProcessIndustries, Stockholm, pp. 1069–1106.
oberts, T.A., Buckland, I., Shirvill, L.C., Lowesmith, B.J., Salater, P., 2004. Design andprotection of pressure systems to withstand severe fires. Process Safety Environ.
Protection 82 (B2), 89–96.
padoni, G., Egidi, D., Contini, S., 2000. Through ARIPAR-GIS the quantified area riskanalysis supports land-use planning activities. J. Hazard. Mater., 71–423.
padoni, G., Contini, S., Uguccioni, G., 2003. A GIS based software tool for risk assess-ment and management in industrial areas. Process Safety Environ. Protection,81–19.
