Risk-based domino effect analysis for fire and explosion accidents considering uncertainty in processing facilities Jie Ji* 1 , Qi Tong 1 , Faisal Khan 2 *, Mohammed Dadaszadeh 2,3 , Rouzbeh Abbassi 4 1. State Key Laboratory of Fire Science, University of Science and Technology of China, Hefei 230026, China 2. Centre for Risk, Integrity and Safety Engineering (C-RISE), Faculty of Engineering & Applied Science, Memorial University of Newfoundland, St. John’s, NL, Canada, A1B3X5 3. Hydrogen Safety Engineering and Research Centre (HySAFER), Ulster University, Newtownabbey, BT37 0QB, Northern Ireland, UK 4. National Centre for Maritime Engineering and Hydrodynamics, Australian Maritime College, University of Tasmania, Launceston 7250, Tasmania, Australia * Correspondence author - Email: (Jie Ji) [email protected]; (Faisal Khan) fi[email protected]1
Transcript
Risk-based domino effect analysis for fire and explosion accidents considering uncertainty in processing facilities
Jie Ji*1, Qi Tong1, Faisal Khan2*, Mohammed Dadaszadeh2,3, Rouzbeh Abbassi4
1. State Key Laboratory of Fire Science, University of Science and Technology of China, Hefei 230026, China
2. Centre for Risk, Integrity and Safety Engineering (C-RISE), Faculty of Engineering & Applied Science, Memorial University of Newfoundland, St. John’s, NL, Canada, A1B3X5
3. Hydrogen Safety Engineering and Research Centre (HySAFER), Ulster University, Newtownabbey, BT37 0QB, Northern Ireland, UK
4. National Centre for Maritime Engineering and Hydrodynamics, Australian Maritime College, University of Tasmania, Launceston 7250, Tasmania, Australia
Abstract: Process facilities are vulnerable to catastrophic accidents due to the storage, transportation and processing of large amounts of flammable/explosive materials. Among a variety of accident scenarios, fire and explosion are the most frequent ones. Fire and explosion are interactive events and may cause a ‘chain of accidents’ (also known as the ‘domino effect’). Especially in processing facilities where units are located within a limited distance, fire or explosion occurring in one unit is likely to spread to other units. Currently, there is a lack of proper methodology that considers the effect of fire and explosion interaction. Ignoring this interaction provides uncertainty in the domino effect risk analysis. High complexity and uncertainty, due to the interaction of fire and explosion, thus make it challenging to analyze the domino effect propagation. Fuzzy Inference System (FIS) is known to be an efficient tool for handling uncertainty and imprecision. The current study has developed a new methodology by adopting FIS method to handle the data uncertainties in the dynamic Bayesian network (DBN) to conduct a robust domino effect analysis considering interactions of fire and explosion. Application of the proposed methodology demonstrates that the FIS acts as a quick semi-quantitative method involved in the domino effect analysis. Results obtained from FIS are consistent with those obtained using the DBN. Moreover, it illustrates that DBN is an effective technique to analyze the combination of a fire and explosion accident.
Key words: Risk analysis; domino effect; fire and explosion; Fuzzy Inference System; dynamic Bayesian network
1. IntroductionProcess facilities deal with the storage, transportation and processing of chemicals
which are potentially flammable, explosive and/or toxic. Their complex geometry and the interaction between various units during an accident are one of the major issues that should be properly considered in risk analysis. Interaction between different events such as fire and explosion is also a concern. Ignoring any of the mentioned issues within the risk analysis of process plants may lead to high uncertainties followed by wrong judgment in providing the appropriate safety measures. This makes the processing plant more vulnerable to catastrophic accidents and more severe consequences involving human and financial loss.
An example can be the Piper Alpha accident which occurred in 1988 and which led to the total destruction of the plant and the loss of 165 lives.1 The chain of events started with the accidental release and ignition of hydrocarbons in one module of the plant which led to an explosion. The resulting overpressure opened its way to the adjacent module and caused the rupture of a crude oil transportation line with a consequent fire. The fire spread to the fuel storage units leading to the second explosion. Another accident at the Houston chemical complex of Philips Company, Texas in 1989 in which an initiating explosion wave spread to two neighbor gasoline storage, led to a second explosion. The heat due to the flame then reached a polyethylene reactor and caused the third explosion.2 In 2004, Skikda LNG plant in Algeria experienced a series of explosions, causing 27 deaths and a loss of 900 million dollars.3 Released LNG entered the boiler and caused an explosion. The heat radiation of the explosion reached the vapor cloud, evaporated from the released LNG, and caused a second explosion. Another example was the accident which occurred at BP’s Texas city in 2005 which caused 15 deaths and 180 injuries.4 In this accident, the released flammable liquid became a liquid pool and evaporated, forming a vapor cloud mixing with air under the effect of wind. The vapor cloud was then ignited by a neighboring truck, resulting in a VCE (Vapor Cloud Explosion). The heat radiation of the initiating explosion reached the liquid pool, resulting in a pool fire and several explosions. In 2005, an accident occurred in Buncefield oil tank farm causing 43 injuries and a financial loss of 1.5 billion dollars. The primary accident was a VCE caused by ignition of evaporated gasoline due to tank overfilling. Flame front of the VCE ignited the overfilled gasoline, causing consequent pool fires and damage to storage tanks. In October 2009, multiple explosion and fire accidents occurred at the petroleum terminal of Caribbean Petroleum Corporation in Bayamón, Puerto Rico.5 In this accident, the overfilled gasoline formed a liquid pool followed by the formation of vapor cloud due to evaporation and dispersion. The vapor cloud was ignited by an unknown ignition source and caused a flash fire. Afterwards, the flash fire forced back towards the tank farm and caused a massive explosion. Flame engulfment and heat radiation from the VCE destroyed the nearby tanks and caused a pool fire that continued for 60 hours. The consequence of the accident was destructive damage including ruptures of 17 out of 48 petroleum storage tanks and nearby equipment. In October 2009, an accident occurred at the Indian Oil Corporation
2
refinery, Sitapura.5 The accident chain started with the overflow of fuel from a storage tank forming a liquid pool followed by the evaporation of fuel. The liquid pool was then ignited by a generator station, causing a pool fire. Flame front of the pool fire ignited the evaporated vapor cloud and caused a subsequent explosion and multiple pool fires. Multiple fires could influence each other and make the fire more destructive and uncontrollable6,7. Finally, the pool fires spread over the entire tank farm and continued for a week.
An overview of the past accidents may lead to two main conclusions. First, the interaction between the fire and explosion is more likely to occur in processing plant accidents rather than each event individually evolving. Second, the complex geometry and huge amount of flammable material makes such plants more vulnerable to the spread of events from one unit to another. Previous published studies of fire and explosion analysis in process industries include Dow fire and explosion index, Mond index, IFAL( Instantaneous Fractional Annual Loss) index, MACC( Maximum Credible Accident Analysis), HIRA (Hazard Identification and Ranking Analysis), MOSEC (Modeling and Simulation of Fire and Explosion in Chemical process industries), computer automated DOMIFFECT analysis and ORA(Optimal Risk Analysis). Most of the risk analysis methodologies overlooked the interactions of fire and explosion and effects of events propagation.8,9 Terminology for a ‘chain of accidents’ is the ‘domino effect’ in which a primary accident, initiated in one unit, spreads to the adjacent unit through different effects, i.e. heat radiation, overpressure or blast fragments. This leads to the secondary or even higher order of accidents that increase the failure probability of the units and causes the severity of the consequences. Domino effects have low probability but have more severe consequences due to complex industrial settings. The risk analysis associated with domino effect considering fire and explosion individually has made great progress in recent years. However, there has been less attention devoted to the quantitative risk analysis (QRA) studies of domino events considering the integration of the fire and explosion accidents. Early research assessing domino effect are limited to qualitative analysis and description of chain of events in historical accidents.10,11 A comprehensive framework of domino effect analysis was developed by Khan and Abbasi for chemical processing industries, in which models in cases where different primary accidents for analyzing domino effect and corresponding escalation probabilities, are presented.12 More recently, a series of works conducted by Cozzani and coworkers demonstrated a QRA of domino effect with discussion on appropriate safety measures.13-16 There were also studies on the escalation threshold values conducted by Cozzani et al. to analyze domino effects within various installations, aiming at correcting the general applied threshold values in a probit model, which is widely applied to the calculation of spreading probabilities, probabilities for heat and overpressure effects and units vulnerabilities.17 A series of studies conducted by Landucci and coworkers present various preventive safety measures whenever facing domino effects and the interaction between safety measures.18-20 Analyses of domino effects’ probabilities and evaluating the performance of safety measures in industrial
3
plants were also conducted through the application of the Bayesian Network (BN),21-23
Dynamic Bayesian Network (DBN) 24,25 and graph theory 26,27. These later studies proved BN to be an effective and precise tool for domino effect analysis.
The current work is aimed at developing a comprehensive methodology to analyze both the fire and explosion propagation in a domino effect accident. Applying the Bayesian network to model the domino effect has been extensively published in the previous studies.21-26 However, those works only presented a methodology of how to use Bayesian network to analyze the domino effect propagation. Additionally, those works only analyze fire and explosion separately, which is not the truth in most cases. From the summary of typical domino effect accidents in the past, we know that fire and explosion always interact with each other and aggravate the accident. Considering the aforementioned research, there are limited studies on interaction of fire and explosion and their consequences on human lives and financial risk. Therefore, this work tries to develop a combination of two sources of accidents, i.e. fire and explosion. Another problem of the domino effect analysis in the previous work is the data uncertainty. Domino effects in processing facilities are considered to be very complicated scenarios with high uncertainties. There are various sources of uncertainties, i.e. lack of information about potential targets to determine the propagation of domino effect; atmospheric conditions to determine the heat radiation and overpressure distribution; and personnel and property distributions which affect the consequence in domino effect. This information is hard to confirm or is uncertain. This unknown and uncertain information is a huge issue to be solved in a domino effect analysis. Previous studies analyze the fire or explosion based on several assumptions. Obviously, those assumptions bring the uncertainties to the work and thus make the results imprecise.
Under this circumstance, we have adopted the fuzzy logic, which is proven to be an effective tool for handling uncertainty and imprecision.28 It handles the uncertainties and considers the interactions of fire and explosion accidents in the complex domino effect chains. This work goes beyond the use of fuzzy theory to BN. It is a development of methodology to handle data uncertainty in the dynamic Bayesian network to conduct robust domino effect analysis. A fuzzy risk analysis is proposed to evaluate uncertainties and help to develop a robust domino effect analysis. The basic procedure proceeds as follows. The fuzzy inference system is not only used to provide the probability but also to help identify the most critical unit with highest risk. The most critical unit is defined as highest risk consisting of high probability of occurrence and severe consequence with respect to human injuries, deaths, and financial loss. DBN is employed to analyze the time-dependent probability of fire and explosion in each unit and to confirm the validity of fuzzy risk analysis. Moreover, probit models for assessing the heat radiation and overpressure effect on humans and properties are devoted to assess the human and financial loss. Integrating the human and financial loss into the probability provided by DBN, identifies the most critical units with highest risk. Furthermore, DBN is applied to determine the most vulnerable unit with the highest probability of accident. Units with the highest increase ratio of accident probability are considered as contributing most to the propagation of domino
4
effect. Finally, the appropriate safety measure allocation to reduce the risk associated with domino effect is presented.
This paper is organized as follows. The fundamentals and terminologies of domino effect are discussed in Section 2. Background information about FIS and DBN are introduced in Section 3. Section 4 proposes the methodology for quantitative risk analysis of domino effect. Section 5 presents a case study to validate the proposed methodology. The allocations of safety measures based on the modeling results are given in Section 6. Conclusions are summarized in Section 7.
2. Domino effect propagation2.1. Domino effect
In quantitative analysis of processing facilities, a domino effect, which is also known as a ‘chain of accidents’, is described as a phenomenon where a primary accident such as fire and explosion in a unit triggers a secondary or higher order accidents in other units. This results in more severe overall consequences than the primary accident itself. In fact, domino effect is often identified as of low frequency and with severe consequence scenarios.
There are several key elements during the domino effect of an accident as follows: A primary accident which is initiated in the first unit and is able to spread to
other units through physical effects with sufficient intensity; Escalation vectors of a physical effect such as heat radiation and fire
engulfment in fire accident, overpressure and blast projectiles in case of explosion. In fact, escalation vectors are essentially released energy from the primary accident;
A target unit, which receives the escalation vector, originating from the lower order accident and which may generate a higher order accident.
Primary accident, particularly in processing facilities, mainly includes fire and explosion. Escalation vector is determined by the type of accident occurring in the primary unit. Furthermore, whether the accident can spread to a higher order of accidents depends on a variety of factors, including the type of primary accident and associated escalation vector; overall energy released from the primary accident which is mainly determined by the inventory, the intensity of escalation vector which can be calculated through empirical models12,16,17,29,30 or elaborate CFD models, distance between primary and secondary units; escalation thresholds for different installations, and vulnerability of the target unit which may be quite different due to different operating conditions and materials of the equipment. Various escalation thresholds with regards to different equipment have been studied by Cozzani et al.15-17 and Landucci et al..31
2.2 Domino-induced failure rateThe domino-induced failure rate, which is the escalation probability caused by
domino effects, is determined by several factors. A widely-used model for calculation of the escalation probability is a probit model introduced in the work conducted by Eisenberg et al.32 and used by Khan et al.12,30 as follows:
5
Y=k1+k2 ln ( D ) ,(1)
where Y represents the probit function for the target equipment, k1and k 2 are probit coefficients for different types of equipment. D represents the dose of escalation vector, i.e. peak static overpressure in case of explosion or time to failure (ttf) in case of fire. Literatures extensively demonstrated the probit coefficient, i.e. k1and k 2, for various equipment and verified the model with the previous accidents and experiments.13,15 In current work, we only consider the atmospheric and pressurized tank as targets to be studied. Table 1 lists the values of k1, k 2 and D, specified for atmospheric and pressurized equipment.Table 1. Parameter details for probit model as showed in Equation 1
Escalation vector
Equipment condition
k1 k 2 D
Heat radiation13
Atmospheric 12.54 -1.847Q(kW/m2) and stands for the heat radiation received by the target
equipment, V(m3)is the volume for target equipment.
The value of Y, obtained from Equation 1, is used to calculate the escalation probability as Equation 2.33
, (2)
In this study, instead of integration of Equation 2, error function (erf ) presented in Equation 3 is used.34
EP=0.5 ×[1+erf (Y −5√2
)], (3)
Probability of the secondary accident (Psecondary), given the probability of the primary accident (Pprimary), is then calculated by using Equation 4.
(4)
where is the escalation probability as illustrated above. Probability of
occurrence of tertiary accident or even higher order of accidents can also be calculated following the same procedures discussed above.The critical issue relating to domino effect propagation is synergistic effect,
generally known as the joint effect (joint escalation vector intensity), of units in the
6
same or different order. Synergistic effect may increase the failure probability of other units and thus trigger further accidents. Methods for calculating the synergistic effect are extensively studied in the work conducted by Khakzad and coworkers.21,22,25,26 In order to provide a more accurate analysis of failure rate caused by the joint effects of escalation vector, synergistic effect is considered in this work.
3. Background3.1. Fuzzy risk analysis
In domino effect risk analysis, the uncertainties arise due to the lack of two sources of information. First, the uncertainties presented by the complexity and randomness of domino effect and accuracy of analysis procedures, and secondly the uncertainties due to the experts’ subjective perspectives about the risk analysis. These perspectives are subject to the experts’ standpoint and professional knowledge and might differ from one individual to another which may initiate another source of uncertainty. These sources of uncertainties are the main reasons that information about different variables in an accident scenario is not generally crisp and precise. To avoid such uncertainties, the fuzzy logic and fuzzy sets were introduced to deal with the situations in which the boundaries and values of a problem are not specified precisely.35 The framework of fuzzy set theory was developed later in the work by Bellman and Zadeh.36 The current study considers a methodology for quick ranking risk associated with domino effect propagation and the precise value of the risk is not the main concern. To this end, employing fuzzy logic as a semi-quantitative assessment method identifies the most critical units. The fuzzy logic simplicity and uncertainty-handling ability makes it easy to analyze the risk associated with each unit.28,37,38
The FIS, also known as fuzzy expert system, is a mathematical system, which transforms human perspectives to fuzzy sets based on fuzzy logic. It analyses analog inputs according to the knowledge-based fuzzy if-then rules which are generated from engineering knowledge by the collection of if-then statements.37 The basic structure of FIS is presented in Figure 1.39
Figure 1. Basic structure and elements of FIS.As demonstrated in Figure 1, the main elements of FIS are as follows: Fuzzification which means transforming the crisp numbers into fuzzy sets
based on the membership functions which are knowledge based. Fuzzy if-then rules are then applied to map fuzzy input numbers to the output
numbers based on the collected database for fuzzy rules.
7
Defuzzification that processes all if-then rules in each fuzzy set and transforms the fuzzy numbers into single crisp numbers. In this study, defuzzification type is centroid.
There are two approaches for FIS calculation: Mamdani method in which output member functions are fuzzy sets and Sugeno method using the linear member functions of inputs to generate outputs.40 In the current study, Mamdani method is employed as there is no linear relation between the inputs and outputs.
FIS has been applied in various research areas such as prioritization of environmental issues,38 piping risk assessment,41 process safety analysis,28 risk assessment of occupational accidents,42 process hazard uncertainties analysis,43 fuzzy risk matrix,39 fuzzy risk analysis for explosion risk assessment,37 and risk assessment of liquefied natural gas terminals.44 In this work, variables of domino effects are studied in FIS in order to analyze the risk associated with domino effect. The fuzzy risk analysis for domino effect is illustrated in the following section.3.2. The fuzzy risk matrix
Combination of fire and explosion risk matrix consists of several independent variables, namely, probability of accident, severity of the consequence for personnel loss and financial loss, environmental pollution and company reputation considering an overall risk assessment perspective. However, for illustration purposes, only probability of fire or explosion and consequences with respect to human and financial loss are included in this work.
The data flow of risk associated with human and financial loss is shown in Figure 2 presenting the main three steps employed. The proposed FIS is aimed at the risk assessment of domino effect instead of risk analysis of general accidents. It is based on the basic idea of the fuzzy logic, however, in order to apply the fuzzy logic to specifically study the risk of domino effect, modifications based on the traditional FIS are made due to different characteristics between a domino effect accident and a general accident. For instance, the input parameter “closeness” is added because it is a critical parameter determining which initiating unit would affect more units in the domino effect propagation.26,27 Additionally, the “inventory” is another parameter which determines the “ttb”, i.e. time to burn out.22,25 In other words, the “inventory” determines whether there is a failure in the target unit and whether there is an overlapping of heat radiation emitting from units in different orders of the accident.22,25 Therefore, the “inventory” can influence the escalation probability and synergetic effect of domino effect propagation and consequently determines how many units would get involved in the domino effect accident.
8
Figure 2. The data flow for risk analysis of processing tanks.The fuzzy logic is applied to the calculation of probability of fire and explosion
occurrence depending on three factors. The first factor is the frequency of leakage (LE) due to corrosion or overfilling. Another influential factor is the probability of presence of ignition (IG) source with enough energy to ignite the flammable materials. The last factor is the flammable property of the fuels which determines the ease of ignition, i.e. flash point (FP) in case of fire and explosion range(ER) in case of explosion. For instance, highly reactive materials such as acetylene and ethylene are more likely to be ignited than materials with medium reactivity such as methane.29
The severity of consequence for each accident scenario also consists of three elements: Inventory (IN) of each unit which is a fundamental data for measuring the released total energy; Closeness (CL) of each unit which is a typical variable for determining how many units are likely to get involved in the domino effect. Physical interpretation of closeness is that units with higher closeness score are able to affect more nearby units. The definition of closeness can be found in the studies by Khakzad et al..26,27 Exposure duration (ED) reflects the presence of personnel in the hazard area with respect to the human loss. In this study, exposure duration to personnel is replaced by the value of present properties (PV) with respect to property loss.
Finally, after obtaining the probability of occurrence (PO) and severity of consequence (SC) for each unit, the risk assessment of each unit is carried out through FIS following the rules shown in Table 2. The probability of accident occurrence and associated consequences are identified as input variables of this stage. Table 2. Rules used in fuzzy logic application of risk analysis
R SCPO Insignificant Minor Moderate Major Catastrophic
Almost certain
Medium High Critical Critical Critical
Likely Medium High High Critical Critical
9
Possible Low Medium High Critical CriticalUnlikely Low Low Medium High Critical
Rare Low Low Medium High High3.3 Fundamentals of the dynamic Bayesian network analysis3.3.1 Bayesian network
BN is a probabilistic directed acyclic graphical model which represents the random variables and their conditional dependency by nodes and arcs respectively.45 The type and strength of dependency among nodes are represented by the conditional probability tables (CPT). Nodes are connected by the directed arcs which direct from the causes (i.e. parent nodes) to its consequences (i.e. child nodes). As an extension of joint probability distribution, BN is superior to traditional risk analysis methodology such as fault tree and event tree for the advantage of posterior analysis based on the available observations.
Furthermore, critical factors contributing most to an accident can be obtained by the comparison of prior and posterior probabilities when BN takes in new observations as evidence. In this study particularly, comparison of prior and posterior probability of accident occurring at each unit can be implemented to identify the units which contribute most to the domino effect.
Another advantage of BN is the incorporation of multiple states of each node, common cause failure and conditional probability. These qualities make BN more flexible and applicable over traditional risk assessment methods. BN has been widely applied in various fields such as risk analysis, reliability analysis and safety analysis.46-49
3.3.2 Dynamic Bayesian networkDynamic Bayesian network is an extension of Bayesian network with an additional
feature of time-dependent probabilities. The DBN relates nodes over a discretized time line. In order to model the temporal evolution of nodes, the continuous time line is divided into a series of discretized time slices, which makes the node at time step t
dependent not only on its parental nodes , which at contemporary time step t, but
also on its states and parental nodes at previous time steps.
The joint probability distribution P(X) of a series of variables X=(X1, X2, X3,…,Xn) is expanded as illustrated in Equation 5. In this study, only two time steps are considered and Equation 5 is modified as Equation 6. More details about application of DBN to risk analysis can be found in studies.25,50-52
, (5)
(6)
10
4. The proposed Methodology4.1. Risk analysis framework of domino effect
In the risk analysis of domino effect in a processing facility, three tasks are of great importance. This includes:
Which unit in the tank farm must be assigned as having the highest risk in terms of human loss and financial loss?
Which unit in the tank farm is the most vulnerable when considering its failure probability and domino-induced failure rate? In other words, which units are more likely to catch fire or explode?
After assigning the most vulnerable unit in a tank farm, which unit would contribute the most to the domino propagation effect given to be the most vulnerable at an accident?
The mentioned issues are considered in the risk analysis methodology developed in the current study and illustrated in Figure 3.
Figure 3. Proposed methodology to assess the risk of a domino effect.4.2. Analysis process of the methodology 4.2.1. Risk analysis through FIS
In the first step, FIS is implemented to semi-quantitatively analyze the risk index of a unit given the unit involved in an accident (fire or explosion). For each unit, average of input variables in case of fire and explosion is used as the inputs of the FIS. In other words, fire and explosion are employed with equal weight of 50%. Risk ranking is employed to identify the most critical units with highest risk with respect to different consequence categories. In order to develop a fuzzy risk assessment, input variables and if-then rules are provided. Details of fuzzy sets applied in the fuzzification step are summarized in Tables 3, 5 and 7. For instance, Tables 3, 5, 7 provide the input variables which are divided into different linguist descriptions with relevant range. We adopted a “Triangular” membership function for its effectiveness and simplicity with relevant parameters which are employed in the Matlab.38 Further, total number of 27 (3*3*3) if-then rules applied in each FIS is presented in Tables 4 and 6. If-then rules are established based on the published data with the modification required to fulfill the requirement of the proposed methodology.37,39 For instance, as shown in Table 4, if the probability of leakage (LE) is low, probability of ignition
11
(LG) is low, and flash point/explosion range (FP/ER) is combustible/narrow, then the corresponding probability of occurrence (PO) is rare. The Matlab software was employed to realize FIS type of Mamdani. For illustration purpose, a layout of the storage tank farm is demonstrated in Figure 4. Four tanks (units) are considered. For instance, given tank 1 in Figure 4 to be in a fire or an explosion accident, variables associated with this tank are imported in FIS to calculate the corresponding risk index illustrated in section 3.1. The similar assessment procedure is applied to all other tanks and risk index associated with each tank in the tank farm is then obtained.
Figure 4. The layout of storage tank farm.Table 3. Details of FIS input variables and membership functions for estimating the likelihood probabilities
Critical 2.5<=R<3 Triangular [2 3 3]For illustration purposes, assumptions were made with regard to the consequences
in the case of financial loss. Units with escalation vector intensities greater than threshold values are considered as the target units totally destroyed. For instance, Figure 4 shows a graph composed of tanks and edges: edges indicate escalation vectors larger than threshold values. Tanks 1, 2, 3 and 4 are considered totally destroyed in the domino effect given tank 4 to be the cause of the primary accident. Tanks 1 and 2 are totally destroyed when considering tank 2 to be the cause of the primary accident. However, only tank 1 is destroyed in the case of tank 1 being the cause of the primary accident. Values associated with each tank are assumed to be in accordance with their volumes, i.e. higher value is assigned to a tank with larger volume.4.2.2. Risk analysis through DBN
In the second step, DBN is applied to assess risk of each unit and to identify the most vulnerable unit for its integration of multi-states and consideration of time. Accident probability obtained from DBN is then combined with the consequence analysis outputs to verify the risk ranking obtained from FIS. Consequence analysis of the domino effect is a very complex task to accomplish, even with the help of CFD modeling as very few models are able to consider the overall escalation vector intensity emitted from several units simultaneously. Synergetic effect is also another complex issue to deal with while it may increase the probability of human and financial loss. Different propagation modes and duration of each accident make the consequence analysis difficult. Therefore, simplification with assumptions is required for consequence modeling.
In the present study, the method proposed by Cozzani et al. is employed.13
Synergistic effects caused by contemporary exposure to different types of physical effects are not within the scope of this study. Probability of injuries and deaths are calculated merging the effects of simultaneous accidents of the same order and the overall fatalities are calculated superimposing the fatalities of accidents of different orders as demonstrated by Equation 7. Obviously, oversimplification of the problem only estimates a rough number of fatalities and causes an overestimation of the fatalities due to the overlapping fatalities caused by the events in different orders in a domino effect.
(7)
where V (Cn) represents the overall fatalities of the domino effect and is the
fatalities caused by the accidents of the i-th order.Probit models and methods provided by previous studies are applied to calculate
the effects of heat radiation and overpressure on human health.29,53 Probabilities of
15
injuries or death are calculated considering the Equation 2. Probit function Y is given by Equation 8.
Y=c1+c2 ln ( D ) , (8)
in which D represents the dose of heat radiation and overpressure. D equals the peak static overpressure in case of an explosion, while calculation of D is given as follows in the case of a fire accident.
D=teff (q¿¿ ' )43 ¿ , (9)
in which q 'represents the heat radiation, t eff stands for the exposure time. Parameters of the probit models, i.e. c1and c2, are summarized in Table 8. In case of
financial loss, assumptions are made to simplify the problem, i.e. only tanks were considered to be financial loss; units considered in domino effects analysis were assumed to be totally destroyed. Table 8. Parameters in probit models for calculation of injuries and deaths
In the third step, after identifying the unit which is most likely to fail, DBN is applied to identify the units contributing most to the failure probability of the most vulnerable unit.
In the fourth step, risk mitigation based on the optimal allocation of safety measures is presented. The optimal allocation is based combinations of safety measures aiming to optimize the risk-profit at a given expenditure.
5. Case study5.1. Scenario description
The application of the proposed methodology, established in section 4, is presented with a similar storage tank farm which is located in a petroleum company in Guangzhou, China as shown in Figure 5(a). All 4 units are considered to be atmospheric storage tanks. As demonstrated in Figure 5(b), wind flows from southeast with the speed of 5 meters at 10 meters above the ground. Stability class is E and the ambient temperature is 20℃. Materials leak from a circular hole with a diameter of 20 centimeters at the bottom of the tank. Table 9 presents the design parameters of the units in the tank farm. Only pool fire and VCE are assumed to be the likely accident scenarios. Heat radiation of the fire and overpressure of the VCE are therefore considered as escalation vector in the case study.
16
(a) (b)
Figure 5. Layout of storage tanks: (a) storage tanks located in a petroleum company. (b) tank farm layout and atmospheric condition.Table 9. Design parameters of the units in the tank farm
Tank No.
Type Volume(m3) Inventory(ton) Material
Flash point(℃)
Explosion rang
e（%）1
Atmospheric
200 50 Benzene -111.2-7.8
2Atmospheri
c200 50 Acetone -20
2.6-12.8
3Atmospheri
c400 100 Acetone -20
2.6-12.8
4Atmospheri
c400 100 2-Pentene -45
1.6-8.7
As Table 9 shows, all the tanks are atmospheric tanks which means parameters for atmospheric tank in Table 1 is adopted in this case. Tank 1 and tank 2 (or tank 3 and tank 4) are filled with the same inventory of different materials using the same size of tank. Flammability (flash point) and explosibility (explosion range) are presented as well. Material characteristics, environmental conditions and geometric layout of the tank farm are critical factors in determining the probability and consequence of an accident and thus affect the domino effect propagation. For instance, materials which are flammable or explosive are more likely to initiate a fire or explosion accident than less flammable or explosive materials. If a tank is filled with more flammable materials (e.g. tank 4 is loaded with 100 tons of 2-pentene), a primary accident occurring at the tank might cause stronger heat radiation and overpressure and thus trigger more secondary accidents than an accident occurring at tanks with less flammable materials (e.g. tank 1 is filled with only 50 tons of benzene).54 Further, geometric layout also influences the heat radiation and overpressure distribution. Tanks located in the unwind direction are likely to emit stronger heat radiation and overpressure and thus ignite more tanks in the downwind direction due to the flame
17
tilt and gas dispersion caused by wind than those located in the downwind direction. 55
Tank spacing is another parameter affecting the domino effect propagation. If the tanks are located closer to each other, heat radiation or overpressure of an initiating accident might involve more tanks in the domino effect chain compared with the scattered distributed tanks.5.2. Analysis of the case study
The steps considered in the proposed methodology (Figure 3) are applied to the described case study. 5.2.1. Step 1 is a quick risk analysis with FIS aiming to identify the most critical
unit with the highest risk.Input parameters, to be used in FIS, and the outputs are presented in Tables 10, 11
and 12, respectively. Considering vehicles driving on the roads near the tank farm as a source of ignition, the highest ignition probability is assigned to Tank 1 which is indeed exposed to the roads on two sides. Tanks 2 and 3 are in second place for the ignition probability as each of them neighbors with one road. The lowest ignition probability belongs to Tank 4 where there is no exposure to the roads (ignition source). Input data are gathered either from published literature or calculated through the methods described in previous sections. Probability of occurrence (PO) is defined as the average between fire probability and explosion probability (assumption explained in section 3.1).18,56 The same averaging principle was also applied for calculation of inventory (IN), closeness (CL), exposure duration (ED) and property value (PV). In order to calculate the closeness in either cases of fire and explosion, the Areal Locations of Hazardous Atmospheres (ALOHA) is used to calculate the heat radiation and overpressure spread from each tank as shown in Tables 13 and 14.57
Threshold values for heat radiation and explosion are 15 kW/m2 and 7 kPa, respectively (Tables 13 and 14).17 Escalation vectors intensity (heat radiation and overpressure) which are greater than the corresponding threshold values are indicated by directed lines as showed in Figure 6. For instance, as Figure 6(a) shows, heat radiation emitted from tank 1 and received by tank 2 is 17 kW/m2 (Table 13) which is greater than 15 kW/m2. Therefore, there is a directed line pointing from tank 1 to tank 2. To calculate the closeness of fire and explosion, R software was employed.58
18
Figure 6. Graph of units and directed line representing escalation vector larger than the threshold values: (a) Heat radiation greater than 15 kW/m2. (b) Overpressure greater than 7kPa.Table 10. Inputs for probability of occurrence
Considering the SC and R values (Table 12), tank 1 is defined to be the unit that most likely initiates an accident and tank 2, tank 3 and tank 4 are the next ones in the order, respectively. The rank of risk index from high to low is then as tank 4, tank 3, tank 2 and tank 1. This later result is concluded in a way that if tank 4 initiates the primary accident (pool fire or VCE), the entire tank farm may be at the highest risk.
19
5.2.2. Step 2 is to identify the most vulnerable unit and to verify the most critical unit in terms of human and financial loss.
Primary failure rate of each tank is assumed to be based on the work conducted by Landucci et al. and Haag and Ale as listed in Table 15.18,56 Domino-induced failure rates are calculated by employing Equations 1 and 4, considering synergistic effect.Table 15. Primary probability of each tank
Primary probability
Tank 1 Tank 2 Tank 3 Tank 4
PprimaryPool fire 2.40E-05 1.90E-05 1.90E-05 1.40E-05
Explosion 1.032E-05 8.17E-06 8.17E-06 6.02E-06In order to apply DBN in analysis of combination of fire and explosion, the
following assumptions are made: For each domino-induced probability, the probability of the target tank to be
either on fire or explode is 50%. For instance, fire accident occurring in tank 2 results in the fire or explosion accident in tank 1 with equal probabilities of 3.47E-05.
Compared to the duration of pool fire which may last tens of minutes or even several hours determined by the burning rate and inventory of the leaked materials, duration of the explosion only lasts several seconds. In order to consider the synergistic effect caused by the overpressure, explosion is considered as occurring simultaneously.
To simplify the problem, synergistic effects caused by different physical effects, i.e. heat radiation or overpressure is not considered in this case study. Instead, domino-induced probability is calculated considering the synergistic effects caused by the same physical effects.
For each tank, there are four states: “safe”, “pool fire”, “vapor cloud explosion”, “accident finished”. The state of each unit can only switch from “safe” to either “pool fire” or “vapor cloud explosion”, and from the later state to “accident finished”. The backward transition of states is not considered in this study. Once the tank is on fire at time step t, the probability of the state “accident finished” at next time step equals the reciprocal of time to burn out. Details of calculation of time to burn out can be found in the literature.25The probability of the state “fire” equals 1 minus the probability of the state “accident finished”. On the other hand, if the tank is at the state “vapor cloud explosion” at time t, probability of the state “accident finished” at t+1 is 1 due to the short duration of explosion. In case of tank at the state “accident finished” at time t, probability of state “accident finished” at next time step is always assumed to be 1.
The entire analysis procedure is performed with GeNie for 100 time steps, each equals 1 min.59 DBN for temporal and spatial domino effect in the case of fire and explosion of the storage tank plant is demonstrated in Figure 7.
Directed lines in Figure 7 represent the interactive escalation effects between each node, e.g. arc from tank 1 to tank 2 indicates the domino-induced effect from tank 1 to
20
tank 2. To consider the synergistic effect, arcs are drawn from tank 1 to tank 4. This means that even though tank 1 (heat radiation=8.68 kW/m2, overpressure=4.41kPa) is not able to trigger an accident in tank 4 (either due to the heat radiation or overpressure), the combination of effects of tank 1 with other tanks, i.e. either tank 2 or tank 3, or both tank 2 and 3) is enough to cause the failure of tank 4. The domino-induced failure rate considering synergistic effect is calculated based on the sum of physical effects caused by tank 1 and other tanks. The same principles also apply to arcs between tank 2 and tank 3. The domino-induced failure rates associated with each tank are calculated based on the geometric layout, environmental conditions and material properties as shown in Figure 5(b) in Table 9. All the directed arcs between each nodes are one time step arcs. In addition, to consider the influence from the node’s state of the previous time step to the state of the current time, one time step arcs are drawn from each node to itself.
Figure 7. Dynamic Bayesian network of the four tanks.The time-dependent probability of fire or explosion occurrence for tanks 1 to 4 is
presented in Figures 8 and 9 (The time step adopted in the software Genie is 1 min, to avoid confusion and add clarity to the results, we have now plotted results for every 5 min and have drawn a solid line to represent the removed solid points.). It is demonstrated that the highest probability of fire or explosion occurrence belongs to tank 1 and tanks 2, 3 and 4 are next in this order, respectively.
21
Figure 8. Time-dependent probability of being on fire.
Figure 9. Time-dependent probability of explosion.Tank 1 is the most vulnerable unit during the domino effect propagation. The
reason is the highest primary failure rate of tank 1 among all 4 units (Table 15) and its higher domino-induced failure rate than the other tanks (due to higher heat radiation received by tank 1 than that received by the other three units). Although tanks 2 and 3 are filled with the same material (acetone), the probability of tank 3 catching fire is higher than that of tank 2. A larger amount of fuel in tank 3 makes it have shorter ttf (Table 1) and as a consequent its probability of catching fire is higher (Equations 1 and 4). In the case of tank 4, the effect of lower heat radiation is more dominant resulting in longer ttf which leads to lower probability of fire accident. Overall, in this specific processing facility, probability of fire accident is higher than that of explosion accident for each tank (probability of fire accident is almost twice the magnitude higher than that of explosion). The order of probability of tanks catching fire or exploding, is from the highest to the lowest: tank 1, tank 2, tank 3 and tank 4, respectively.
Degree of importance of the key factors, which determine the probability of accident in the domino effect propagation, must be mentioned at this step and are as follows:
Most important factor, physical effects (escalation vector intensity) received by the target tank which helps to increase the probability of accident as demonstrated in tank 1;
Second important factor: inventories of materials, which can be interpreted by the probability of accident in tank 2 and tank 3.
Third important factor is the volume of each tank that receives the dose of physical effects (e.g., the total heat radiation or overpressure received by a vessel with larger volume is greater than one with a small volume), thus determining the failure probability of the vessels.
5.2.3. Step 3 is to verify the most critical units of highest risk. Since the failure probability of each tank during the domino effect has been
obtained (Figures 8 and 9), some modifications need to be considered in order to
22
estimate the failure probability of other tanks given a tank at the state of fire or explosion. For example, in order to calculate the risk of tank 4 being on fire or exploding, state of tank 4 (t=0) is set as fire or explosion with probability of 0.699301 (data are presented in Table 15.) and 0.300699 respectively. Failure probability of other tanks is updated considering the evidence of tank 4 at the state of “accident (fire or explosion)” at t=0. For example, given tank 4 at fire or explosion at time t=0, probability of fire or explosion for tank 1, tank 2 and tank 3 are demonstrated in Figures 10 and 11.
(a)
(b)Figure 10. Probability of fire or explosion given tank 4 being on fire at t=0: (a) probability of being on fire. (b) probability of explosion.
Figure 10 demonstrates the probability of each tank at the state “fire” or “explosion” versus time. As shown in Figure 10(a), given tank 4 at the state “fire” at t=0, probabilities of each tank catching on fire increases with time. In addition, compared to Figure 8 (without defining a primary accident at t=0), the probabilities of tanks 1-3 at the state “fire” in Figure 10(a) have been increased, which means tank 4 at the state of “fire” contributes to the failure probabilities of the other three tanks. Tank 3 is the most likely one to be affected by the fire occurring in tank 4 and then
23
tank 2 and tank 1. As demonstrated in Figure 10(b), there is an increase in probabilities of explosion, compared to those in Figure 9, which means that the fire accident of tank 4 contributes to the explosion probabilities of other tanks as well. Explosion probabilities increase for a duration of 2 min and then start to drop due to the fuel having burned out. Thus, the contribution of this tank to the explosion of others and their explosion probability decreases.
(a)
(b)Figure 11. Probability of fire or explosion given that explosion occurs at tank 4 at t=0: (a) probability of being on fire. (b) probability of explosion.
Figure 11 presents probabilities of other tanks catching fire or explosion, given that tank 4 exploded at t = 0. As demonstrated in Figure 11(a), the probabilities of catching fire increase for only 2 min and then drop for the rest of the time. This is due to the assumption that explosion lasts for only 1 min with the probabilities of fire reaching its peak at the second minute. As a trend, one may observe that the explosion becomes less influential over time due to the short duration and this causes the reduction in the probability of fire. As shown in Figure 11, if the explosion occurs at tank 4, the probability of tank 3 at the state of “fire” or “explosion” is the highest and then tank 1 and tank 2, respectively. Explosion probabilities reach the peak point after
24
2 min, followed by a sharp decrease and then remaining stable to the end (Figure 11(b)).
Comparing Figure 11 with Figure 10, it is observed that that the fire and explosion probabilities are higher. This later argument confirms that, as a primary accident in tank 4, the contribution of explosion in the failure of other tanks is more than that of fire. The results presented in Figures 10 and 11 in combination with the data in Tables 13-15 reveal that the explosion in tank 4 is more likely to cause a domino effect. Although the probability of explosion is less than that of fire, its overpressure is very destructive and is dominant over the heat radiation effect of fire.
The consequence of accident occurring in each tank with respect to heat radiation and overpressure are calculated based on the probit models as illustrated in section 4.1. In order to integrate the overall consequence of fire and explosion, the method proposed by Dadashzadeh is employed.60 The severity index for various effects of fire heat radiation and explosion overpressure is defined as presented in Table 16. Property values for each tank and total number of people affected by heat radiation and overpressure are presented in Table 17, considering a population density of 0.1 person/m2. Property values are assumed based on the hypothesis that a higher value is assigned to a tank with larger volume. Death caused by overpressure such as lung damage, head impact and whole body displacement are not considered in this study as their values are negligible. Table 16. Severity index for different types of injuries and deaths51
Hazard effects
Fire Explosion1st degree
burn2nd degree
burnDeath
Ear-Drum rupture
Scores(S) 2 5 10 5Table 17. Overall consequences with respect to human loss and financial loss
Injuries and deaths(person) Tank 1 Tank 2 Tank 3 Tank 4
where Riski− f represents the risk of tank i catching fire and Riski−e represents the risk
caused by explosion. and are calculated as follows.
25
(i, j=1,2,3,4 and i≠j) (11)
where is the consequence of tank i catching fire. represents the
probability of tank i catching fire, represents the consequence of tank j catching
fire, represents the probability of tank j catching fire given
an accident (fire or explosion with corresponding probability) occurring in tank i. The risk of explosion can be estimated by Equation 12.
(i, j=1,2,3,4 and
i≠j) (12)For instance, risk of tank 1 is obtained following:
Considering fire and explosion as primary accident, Figures 12 and 13 present the time-dependent risk associated to four tanks, respectively. Figure 12 confirms that the risk increases over time when the primary accident is fire. As illustrated in Figure 13, in the case of explosion as the primary accident, risks values reach a peak after 2 min before starting to decrease for the remaining duration. This is due to the same trend for the explosion influence which reaches a peak at 2 min and starts to decrease after that (Figure 11). Figures 12 and 13 share the common feature that risk rank (highest to lower) among the four tanks is in the order of tank 4, tank 3, tank 2 and tank 1 which confirms the conclusion drawn from FIS. As indicated in Table 17, overall effects caused by tank 1 are the most severe (combined effects of fire and explosion with regards to injuries and death) and tanks 4, 2 or 3 are next in the order of severity. The escalation vector intensity received by other tanks, given that tank 1 is the accident, is the smallest among all units. This results in the lowest value of risk for tank 1. Since tank 3 has larger inventory than tank 2, the probability of tank 3 at the state of “fire” is greater than that of tank 2. Therefore, tank 3 has a greater influence on the target tanks than tank 2, causing the probability of target tanks at the state of fire and explosion higher than tank 2. Further, risk of tank 3 is slightly higher than that of tank 2. Tank 4 is ranked as having the highest risk of all because as a target its escalation vector intensity, received from other tanks, is the highest. It is demonstrated that risks caused by explosion as primary accident are higher than that caused by the fire accident. This is to confirm that, as primary accident, explosion is more likely to trigger the domino effect accident than the fire.
26
(a)
(b)Figure 12. Risks of four tanks assuming fire as the primary accident: (a) risks with respect to human loss. (b) risks with respect to financial loss.
(a)
27
(b)Figure 13. Risks of four tanks assuming explosion as the primary accident: (a) risk with respect to human loss. (b) risk with respect to financial loss.
Considering step 3 in the developed methodology, the units contributing the most to the occurrence of most vulnerable unit should be identified. It has been concluded that tank 1 is the most vulnerable unit according to step 2. Posterior analysis of failure probability of each tank is employed, given that tank 1 is observed to be on fire or explosion at 100 min. Difference between posterior and prior probability of each tank is depicted in Figures 14 and 15.
Figure 14. Contribution of each tank to the failure probability of tank 1 given that tank 1 is at the state “fire” at t=100 min.
28
Figure 15. Contribution of each tank to the failure probability of tank 1 given that tank 1 is at the state “explosion” at t=100 min.
It is observed that all of the posterior probabilities are higher than the prior probabilities. As demonstrated in Figure 14, tank 3 has the highest increased ratio in the case of tank 1 catching on fire after 100 min with tank 2 next, followed by tank 4. It should be noted that tank 3 contributes the most to fire occurrence of tank 1. Otherwise, in case of explosion occurring in tank 1 after 100 min, the difference between posterior and prior failure probability (sum of probability of state “fire” and “explosion”) is stable in the range of 1-99 min, when there is a sharp increase. This is because the explosion is assumed to last for only 1 min, hence fire or explosion at 99 min is likely to cause explosion of tank 1. Therefore, the prior and posterior probabilities are similar within the time range of 0-98 min. However, at 99 min, tank 4 contributes the most to the accident occurrence of tank 1, and tank 3 and tank 2 are next in order, respectively. The escalation vector intensities, presented in Tables 13 and 14, indicate that tank 3 is the highest contributor in terms of heat radiation to tank 1 and tank 4 is the highest contributor in term of overpressure to tank 1. This results in tank 3 having the highest contribution to the fire accident of tank 1 and tank 4 having the highest contribution to the explosion accident of tank 1.
It should be noted that the probabilities of fire and explosion accidents in current study are calculated dependent on the geometric layout, environmental factors and materials. Therefore, a change of those factors would cause a different domino-induced probabilities and thus affects the probabilities and thus corresponding risks. For instance, if the wind direction of the tank farm in Figure 5(b) is changed from the southeast to south, and the materials of all the tanks are replaced by acetone. The resulting escalation vectors are summarized in Tables 18 and 19. It is observed that the escalation vectors is totally different from those in Tables 13 and 14. The escalation vectors intensity greater than the threshold values are presented in Figure 16. It can be seen that graph representation of escalation vectors greater than threshold values is changed compared with that in Figure 6, which means the events sequence could be changed correspondingly. Additionally, the escalation vectors are critical factors for calculating escalation probabilities as shown in Equation 1-3.
29
Consequently, the change of wind direction and materials results in different events sequence and affects the escalation probabilities of domino effect compared with those shown in Figures 8-11. Table 18. Heat radiation: tank in j column received from i row
Figure 16. Graph of units and directed line representing escalation vector larger than the threshold values: (a) Heat radiation greater than 15 kW/m2. (b) Overpressure greater than 7kPa.
6. Allocation of safety measuresIn the domino effect risk analysis, there are three major tasks to be identified. These
tasks include: which are the most critical units with the highest risk, the most vulnerable unit, and units with the most contribution to the accident of the most vulnerable unit. These three tasks are significantly important in guiding the allocation of safety measures. Since each unit plays a different role in a domino effect propagation, their importance is distinct in the tank farm. A reasonable allocation of safety measures based on the role of different units is beneficial to optimize the risk-profit for the process facilities.
In general, there are four categories of safety measures.19
30
Inherent safety measures such as inherent safety design for equipment; Passive measures such as fireproof wall, blast wall and pressure safety valve; Active safety measure such as emergency shutdown device (ESD), emergency
drainage (ED),water deluge system (WDS), etc.; Procedural and emergency measures which support the safety management
and control of accidents. Among the four types of safety measures, inherent safety measure has the highest
priority as it aims at eliminating the hazards caused by the domino effect. In other words, inherent safety measures prevent the domino effect through decreasing the possibility of the triggering of the domino propagation. Passive safety measures are more robust than active safety measures because the availability of passive safety measures is achieved constantly while active safety measures require external stimulation (e.g., temperature, smoke, etc.) to be activated.19
In this study, since tank 4 is the most critical unit, accidents occurring in tank 4 cause the highest risk in the processing facilities. Thus, prevention of accident in tank 4 is of priority. Safety measures such as safety training, regular inspection, timely maintenance (procedural safety measures), anti-corrosion measures (inherent safety measures) are supposed to apply to tank 4 aiming at preventing accidents by decreasing the primary failure rate. In addition, fireproof wall or blast wall (passive measures) is advised to be applied to tank 4 in order to protect it from physical effects.34 As for tank 1, identified as the most vulnerable unit, fireproof wall or other passive measures should be employed aiming at protecting it from escalation vectors propagated from other units. In the case of tank 3 which contributes the most to the failure rate of tank 1, combination of passive and active measures is proposed to be implemented in order to block the ‘chain of accidents’. Another conclusion drawn from this study is that as explosion as the primary accident is more destructive than fire (for the specific tank farm in this study), it should be carefully investigated. Since active measures have a time lag of response (usually longer than the duration of explosion) due to the external activation source, emergency measures are usually applied to a fire accident instead of a fast-evolving accident.18 In case of fast-evolving accident, e.g. VCE, passive measures are supposed to be applied. Besides, lessons learned from the Caribbean petroleum terminal explosion and tank fires provides practical suggestions, e.g. additional safety measures such as automatic tank gauging system with reliable computer monitoring system, combustible gas detectors, maintenance and inspection should be applied to prevent the overfill and leakage of the fuels.61 Maintenance and inspection priorities for critical units should be established. For example, tank 4 in our case study section has the highest priority of periodic maintenance and inspection, followed by tank 3, tank 2 and tank 1. From a practical perspective, identification of the role of each tank in the propagation of a domino effect and allocation of safety measures aiming at optimizing the safety benefits with limited financial support are challenging but meaningful. Optimal allocation of safety measures becomes more complex in the case of domino effect analysis due to the uncertainties of the domino propagation.
31
7. ConclusionsThe domino effect is an evolving condition with a complex interaction of
parameters. This has been widely studied using traditional approaches such as analytical and logical modeling supported with traditional probability theory. 4,12,13,15,16,18,22,25,26 Literature reviews of the past accidents indicate that fire and explosion are highly correlated and interact with each other in a domino effect accident.1-5 High uncertainties and complicated interactions of units pose a huge challenge for a quick and precise risk analysis of domino effect accidents.
This work proposes a novel integration of FIS and DBN to analyze fire and explosion as a source of domino effect analysis in processing facilities. This integration provides a novel mechanism to study the evaluation of potential chain of accidents. Compared with other techniques, 4,12,13,15,16,18,22,25,26 the unique characteristics of this methodology includes: i) better understanding and assessment of potential pathways of domino effects; ii) estimation of probability of domino effects; and iii) uncertainty analysis of domino effects. Additionally, fire and explosion are considered as independent accidents and sources of domino effect in the previous studies, and interactions of fire and explosion are ignored in the domino effect analysis.18,19,25,26,27,34
The present work takes one step forward to consider the interactions of fire and explosion in the FIS and DBN analysis. Finally, events sequence, trigger mechanism of the accidents and environmental factors are critical in determining the risk calculation of domino effect accidents. However, these information is uncertain and hard to get precisely. Thus, data and model uncertainty are major limitations of past studies.21,22,25,26 The present work addresses these limitations by adopting the FIS. Therefore, integration of the FIS with DBN in current work provides a robust domino effect analysis methodology.
In this paper, we introduced an application of a semi-quantitative FIS to quickly identify the most critical unit with the highest risk in domino effect propagation. Problems related to domino effect uncertainties are dealt with the fuzzy logic. We also apply the DBN to effectively analyze the combination of fire and explosion and identify the most vulnerable units. Besides, DBN is also employed to verify the risk ranking obtained from FIS. Finally, posterior probabilities in the developed DBN are implemented to identify the units contributing most to the accidents of the most vulnerable unit. The main points in the conclusion are as follows:
Developing a methodology by applying FIS to risk analysis of domino effect demonstrates that FIS can be used as an efficient and semi-quantitative method for risk analysis of different propagation scenarios. Risks ranking of unlike units as primary unit are obtained using the fuzzy logic.
DBN has proven to be an effective technique for risk analysis of fire and explosion integrated accident scenarios. The most vulnerable unit is identified considering the time-dependent failure probabilities.
Risk calculation based on the combination of consequence analysis of domino effect and time-dependent failure probability provided by DBN helps to verify the validity of the FIS risk analysis.
32
It should be noted that the proposed methodology, FIS, relies on the specific codes developed for the specific hypothetical process facilities. However, minor modifications of input and output variables and fuzzy rules need to be made to tailor the FIS codes to model similar domino effects of interest in other processing facilities. With regard to DBN, it is a general method in risk analysis that can be applied to other scenarios once the conditional probabilities between each node is provided.
AcknowledgementsThis work was supported by the National Key R&D program of China under Grant No. 2016YFC0800100, National Science and Engineering Council of Canada (NSERC) and Canada Research Chair Tier I Program. Jie Ji was supported by the National Program for Support of Top-Notch Young Professionals.
References(1) Paté‐Cornell, M. E. Learning from the piper alpha accident: A postmortem analysis of technical and organizational factors. Risk Anal. 1993, 13, 215-232.(2) Dole, E.; Scannell, G. Phillips 66 company Houston chemical complex explosion and fire. A report to the President. Occupational Safety and Health Administration, US Department of Labor, 1990.(3) Ouddai, R.; Chabane, H.; Boughaba, A.; Frah, M. The Skikda LNG accident: losses, lessons learned and safety climate assessment. Int. J. Global Energ. Issues 2012, 35, 518-533.(4) Kalantarnia, M.; Khan, F.; Hawboldt, K. Modelling of BP Texas City refinery accident using dynamic risk assessment approach. Process Saf. Environ. Prot. 2010, 88, 191-199.(5) Mishra, K. B.; Wehrstedt, K.-D.; Krebs, H. Lessons learned from recent fuel storage fires. Fuel Process. Technol. 2013, 107, 166-172.(6) Wan, H.; Ji, J.; Li, K.; Huang, X.; Sun, J.; Zhang, Y. Effect of air entrainment on the height of buoyant turbulent diffusion flames for two fires in open space. Proc. Combust. Inst. 2017, 36, 3003-3010.(7) Wan, H.; Gao, Z.; Ji, J.; Sun, J.; Zhang, Y.; Li, K. Predicting heat fluxes received by horizontal targets from two buoyant turbulent diffusion flames of propane burning in still air. Combust. Flame 2018, 190, 260-269.(8) Khan, F. I.; Abbasi, S. Techniques and methodologies for risk analysis in chemical process industries. J. Loss Prev. Process Ind. 1998, 11, 261-277.(9) Tixier, J.; Dusserre, G.; Salvi, O.; Gaston, D. Review of 62 risk analysis methodologies of industrial plants. J. Loss Prev. Process Ind. 2002, 15, 291-303.(10) Pietersen, C. Analysis of the LPG-disaster in Mexico City. J. Hazard. Mater. 1988, 20, 85-107.(11) Pritchard, D. A review of methods for predicting blast damage from vapour cloud explosions. J. Loss Prev. Process Ind. 1989, 2, 187-193.(12) Khan, F. I.; Abbasi, S. Models for domino effect analysis in chemical process industries. Process Saf. Prog. 1998, 17, 107-123.
33
(13) Cozzani, V.; Gubinelli, G.; Antonioni, G.; Spadoni, G.; Zanelli, S. The assessment of risk caused by domino effect in quantitative area risk analysis. J. Hazard. Mater. 2005, 127, 14-30.(14) Cozzani, V.; Tugnoli, A.; Salzano, E. Prevention of domino effect: from active and passive strategies to inherently safer design. J. Hazard. Mater. 2007, 139, 209-219.(15) Cozzani, V.; Salzano, E. The quantitative assessment of domino effects caused by overpressure: Part I. Probit models. J. Hazard. Mater. 2004, 107, 67-80.(16) Cozzani, V.; Salzano, E. The quantitative assessment of domino effect caused by overpressure: Part II. Case studies. J. Hazard. Mater. 2004, 107, 81-94.(17) Cozzani, V.; Gubinelli, G.; Salzano, E. Escalation thresholds in the assessment of domino accidental events. J. Hazard. Mater. 2006, 129, 1-21.(18) Landucci, G.; Necci, A.; Antonioni, G.; Argenti, F.; Cozzani, V. Risk assessment of mitigated domino scenarios in process facilities. Reliab Eng. Syst. Saf. 2017, 160, 37-53.(19) Landucci, G.; Argenti, F.; Spadoni, G.; Cozzani, V. Domino effect frequency assessment: The role of safety barriers. J. Loss Prev. Process Ind. 2016, 44, 706-717.(20) Landucci, G.; Argenti, F.; Tugnoli, A.; Cozzani, V. Quantitative assessment of safety barrier performance in the prevention of domino scenarios triggered by fire. Reliab Eng. Syst. Saf. 2015, 143, 30-43.(21) Khakzad, N.; Khan, F.; Amyotte, P.; Cozzani, V. Domino effect analysis using Bayesian networks. Risk Anal. 2013, 33, 292-306.(22) Khakzad, N.; Khan, F.; Amyotte, P.; Cozzani, V. Risk management of domino effects considering dynamic consequence analysis. Risk Anal. 2014, 34, 1128-1138.(23) Khakzad, N.; Landucci, G.; Cozzani, V.; Reniers, G.; Pasman, H. Cost-effective fire protection of chemical plants against domino effects. Reliab Eng. Syst. Saf. 2018, 169, 412-421.(24) Khakzad, N. Which Fire to Extinguish First? A Risk‐Informed Approach to Emergency Response in Oil Terminals. Risk Anal. 2017.(25) Khakzad, N. Application of dynamic Bayesian network to risk analysis of domino effects in chemical infrastructures. Reliab Eng. Syst. Saf. 2015, 138, 263-272.(26) Khakzad, N.; Reniers, G. Using graph theory to analyze the vulnerability of process plants in the context of cascading effects. Reliab Eng. Syst. Saf. 2015, 143, 63-73.(27) Khakzad, N.; Landucci, G.; Reniers, G. Application of Graph Theory to Cost‐Effective Fire Protection of Chemical Plants During Domino Effects. Risk Anal. 2017, 37, 1652-1667.(28) Markowski, A. S.; Mannan, M. S.; Bigoszewska, A. Fuzzy logic for process safety analysis. J. Loss Prev. Process Ind. 2009, 22, 695-702.(29) Assael, M. J.; Kakosimos, K. E. Fires, explosions, and toxic gas dispersions: effects calculation and risk analysis; CRC Press, 2010.(30) Khan, F. I.; Abbasi, S. Risk analysis of a typical chemical industry using ORA procedure. J. Loss Prev. Process Ind. 2001, 14, 43-59.
34
(31) Landucci, G.; Gubinelli, G.; Antonioni, G.; Cozzani, V. The assessment of the damage probability of storage tanks in domino events triggered by fire. Accid. Anal. Prev. 2009, 41, 1206-1215.(32) Eisenberg, N. A.; Lynch, C. J.; Breeding, R. J. Vulnerability model. A simulation system for assessing damage resulting from marine spills; Enviro control inc rockville md,1975.(33) Finney, D. J.; Tattersfield, F. Probit analysis; Cambridge University Press, Cambridge, 1952.(34) Khakzad, N.; Landucci, G.; Reniers, G. Application of dynamic Bayesian network to performance assessment of fire protection systems during domino effects. Reliab Eng. Syst. Saf. 2017.(35) Zadeh, L. A. Fuzzy sets. Inf. Control 1965, 8, 338-353.(36) Bellman, R. E.; Zadeh, L. A. Decision-making in a fuzzy environment. Manage. Sci. 1970, 17, B-141-B-164.(37) Markowski, A. S.; Mannan, M. S.; Kotynia, A.; Pawlak, H. Application of fuzzy logic to explosion risk assessment. J. Loss Prev. Process Ind. 2011, 24, 780-790.(38) Yang, M.; Khan, F. I.; Sadiq, R. Prioritization of environmental issues in offshore oil and gas operations: A hybrid approach using fuzzy inference system and fuzzy analytic hierarchy process. Process Saf. Environ. Prot. 2011, 89, 22-34.(39) Markowski, A. S.; Mannan, M. S. Fuzzy risk matrix. J. Hazard. Mater. 2008, 159, 152-157.(40) Sivanandam, S.; Sumathi, S.; Deepa, S. Introduction to fuzzy logic using MATLAB; Springer, 2007; Vol. 1.(41) Markowski, A. S.; Mannan, M. S. Fuzzy logic for piping risk assessment (pfLOPA). J. Loss Prev. Process Ind. 2009, 22, 921-927.(42) Murè, S.; Demichela, M. Fuzzy Application Procedure (FAP) for the risk assessment of occupational accidents. J. Loss Prev. Process Ind. 2009, 22, 593-599.(43) Markowski, A. S.; Mannan, M. S.; Kotynia, A.; Siuta, D. Uncertainty aspects in process safety analysis. J. Loss Prev. Process Ind. 2010, 23, 446-454.(44) Elsayed, T. Fuzzy inference system for the risk assessment of liquefied natural gas carriers during loading/offloading at terminals. Appl. Ocean Res. 2009, 31, 179-185.(45) Khakzad, N.; Khan, F.; Amyotte, P. Safety analysis in process facilities: Comparison of fault tree and Bayesian network approaches. Reliab Eng. Syst. Saf. 2011, 96, 925-932.(46) Yuan, Z.; Khakzad, N.; Khan, F.; Amyotte, P. Risk analysis of dust explosion scenarios using Bayesian networks. Risk Anal. 2015, 35, 278-291.(47) Yuan, Z.; Khakzad, N.; Khan, F.; Amyotte, P. Domino effect analysis of dust explosions using Bayesian networks. Process Saf. Environ. Prot. 2016, 100, 108-116.(48) Yang, Y.; Khan, F.; Thodi, P.; Abbassi, R. Corrosion induced failure analysis of subsea pipelines. Reliab Eng. Syst. Saf. 2017, 159, 214-222.(49) Khakzad, N.; Khan, F.; Amyotte, P. Dynamic safety analysis of process systems by mapping bow-tie into Bayesian network. Process Saf. Environ. Prot. 2013, 91, 46-53.
35
(50) Kohda, T.; Cui, W. Risk-based reconfiguration of safety monitoring system using dynamic Bayesian network. Reliab Eng. Syst. Saf. 2007, 92, 1716-1723.(51) Codetta-Raiteri, D.; Bobbio, A.; Montani, S.; Portinale, L. A dynamic Bayesian network based framework to evaluate cascading effects in a power grid. Eng. Appl. Artif. Intel. 2012, 25, 683-697.(52) Khakzad, N.; Khan, F.; Amyotte, P. Risk-based design of process systems using discrete-time Bayesian networks. Reliab Eng. Syst. Saf. 2013, 109, 5-17.(53) Van Den Bosh, C.; Weterings, R. Methods for the calculation of physical effects (Yellow Book); Committee for the Prevention of Disasters, The Hague (NL) 1997.(54) Woodward, J. L.; Pitbaldo, R. LNG Risk Based Safety: modeling and consequence analysis; John Wiley & Sons, 2010.(55) Jujuly, M. M.; Rahman, A.; Ahmed, S.; Khan, F. LNG pool fire simulation for domino effect analysis. Reliab Eng. Syst. Saf. 2015, 143, 19-29.(56) De Haag, P. U.; Ale, B. Guidelines for Quantitative Risk Assessment: Purple Book; Ministerie van Volkshuisvesting en Ruimtelijke Ordening (VROM), 2005.(57) US Environmental Protection Agency, National Oceanic and Atmospheric Administration. ALOHA user manual. http://www.epa.gov/OEM/cameo/aloha.htm; 2014 (accessed on 21 June 2014).(58) R Development Core Team. R: a language and environment for statistical computing, R Foundation for Statistical Computing, Vienna, Austria. http://www.R-project.org; 2009.(59) GeNie. Decision Systems Laboratory, University of Pittsburg. http://www.genie.sis.pitt.edu.(60) Dadashzadeh, M.; Khan, F.; Hawboldt, K.; Amyotte, P. An integrated approach for fire and explosion consequence modelling. Fire Saf. J. 2013, 61, 324-337.(61) CSB, 2009, Caribbean Petroleum Tank Terminal Explosion and Multiple Tank Fires; Final Investigation Report. http://www.csb.gov/assets/1/19/CAPECO_Final_Report__10.21.2015.pdf.
