Final report Annex 4: Accident scenarios, conditions and ... · Final report Annex 4: Accident...

Final report Annex 4: Accident scenarios, conditions and parameters (Task 4)

Development of an assessment methodology under Article 4 of Directive 2012/18/EU on the control of major-accident hazards involving dangerous substances (070307/2013/655473/ENV.C3)

Report for the European Commission (DG Environment)

AMEC Environment & Infrastructure UK Limited

in association with INERIS and EU-VRi

December 2014

© AMEC Environment & Infrastructure UK Limited December 2014 Doc Reg No. 34075CA014i6b

Copyright and Non-Disclosure Notice

The contents and layout of this report are subject to copyright owned by AMEC

(©AMEC Environment & Infrastructure UK Limited 2014). save to the extent that

copyright has been legally assigned by us to another party or is used by AMEC under

licence. To the extent that we own the copyright in this report, it may not be copied or

used without our prior written agreement for any purpose other than the purpose

indicated in this report.

The methodology (if any) contained in this report is provided to you in confidence and

must not be disclosed or copied to third parties without the prior written agreement of

AMEC. Disclosure of that information may constitute an actionable breach of

confidence or may otherwise prejudice our commercial interests. Any third party who

obtains access to this report by any means will, in any event, be subject to the Third

Party Disclaimer set out below.

Third-Party Disclaimer

Any disclosure of this report to a third party is subject to this disclaimer. The report

was prepared by AMEC at the instruction of, and for use by, our client named on the

front of the report. It does not in any way constitute advice to any third party who is

able to access it by any means. AMEC excludes to the fullest extent lawfully permitted

all liability whatsoever for any loss or damage howsoever arising from reliance on the

contents of this report. We do not however exclude our liability (if any) for personal

injury or death resulting from our negligence, for fraud or any other matter in relation

to which we cannot legally exclude liability.

Document Revisions

No. Details Date

1 Preliminary version of intermediate report chapter for DG ENV comment

27 March 2014

2 Intermediate report 12 May 2014

3 Intermediate report (revised) 21 July 2014

4 Intermediate report (revised) 11 Sept 2014

5 Draft final report 18 Nov 2014

6 Final report 12 Dec 2014

6b Final report (reissued with minor amendments)

17 Dec 2014

iv

December 2014 Doc Reg No. 34075CA014i6b

List of abbreviations

ADAM Accident Damage Assessment Module

ADR European Agreement Concerning The International Carriage Of Dangerous

Goods By Road

ALARP As Low As Reasonably Practicable

ARIA Analysis, Research and Information about Accidents

BLEVE Boiling Liquid Expanding Vapour Explosion

BOD – COD Biochemical Oxygen Demand – Chemical Oxygen Demand

CE Critical Event

CFD Computational Fluid Dynamics

CLP Classification Labelling Packaging

COMAH Control Of Major Accident Hazards

DA Deterministic Approach

ECHA European Chemicals Agency

e-MARS Major Accident Reporting System

EU European Union

EWGLUP European Working Group on Land Use Planning

F&EI Fire & Explosion Index

GHS Globally Harmonised System

JRC Joint Research Centre

LPG Liquefied Petroleum Gas

LUP Land-Use Planning

MAHB Major Accident Hazard Bureau

MATTE Major Accident To The Environment

MF Material Factor of the Dow’s Fire & Explosion Index

MIMAH Methodology for Identification of Major Accident Hazards

NFPA National Fire Protection Agency

NOEC No Observable Adverse Effects Concentration

PA Probabilistic Approach

PLG Pressurised Liquefied Gas

v


RID European Agreement Concerning the International Carriage of Dangerous

Goods by Rail

RMP Risk Management Plan

STOT-SE Specific Target Organ Toxicity (Single Exposure)

USEPA United States Environmental Protection Agency

UVCE Unconfined Vapour Cloud Explosion

Physicochemical parameters

BCF Bioconcentration Factor

EC50 Median Effective Concentration

ΔHr Standard enthalpy of reaction

Kst / Kg Maximum rate of explosion pressure rise for dust clouds/gas

LD50 / LC50 Median Lethal Dose / Median Lethal Concentration

LFL / LEL Lower Flammability Limit / Lower Explosion Limit

LOC Limiting Oxygen Concentration

MIE Minimum Ignition Energy

MTSR Maximum Temperature of the Reaction Synthesis

NOEC No Observed Effect Concentration

Pmax Maximum explosion pressure

Pvap Vapour pressure

ΔTad Adiabatic temperature rise

Teb Boiling point

TMRad Time to maximum rate in adiabatic condition

UFL / UEL Upper Flammability Limit / Upper Explosion Limit

vi


Contents

List of abbreviations iv

1. Introduction 1

1.1 Purpose of this report 1

1.2 Scope of Task 4 1

1.3 Structure of this report 2

2. Generalities about accident scenarios 4

2.1 Bow-tie approach 4

2.2 Worst case approach 6

2.2.1 The term “worst case” 6

2.2.2 Justification of a worst case approach for the assessment methodology 6

3. Historical analysis of accidents 9

3.1 Background 9

3.2 General presentation of the databases 9

3.3 Exploiting the databases 10

4. Worst case scenario identification 12

4.1 Scope and definitions 12

4.1.1 Overview 12

4.1.2 Literature review 12

4.1.3 Feedback from the survey 13

4.2 Examples from the literature review 14

4.2.1 EU Member States 14

4.2.2 USA 16

4.3 Summary 16

5. Methodology for defining and modelling a worst case scenario 18

5.1 Generalities 18

5.2 Guidelines on defining the worst case scenario 19

5.2.1 Background 19

5.2.2 Generalities about the MIMAH approach 19

5.2.3 Equipment typology 21

5.2.4 Substance typology 22

vii


5.2.5 Critical events 23

5.2.6 ARAMIS historical analysis 23

5.3 Guidelines on assessing the worst case scenario 24

5.3.1 Source term 26

5.3.2 Environmental conditions 30

5.3.3 Important parameters according to the type of dangerous phenomenon 33

5.3.4 Synthesis 39

6. General conclusion 40

7. References 43

Table 2.1 Main differences between deterministic and probabilistic approaches 7 Table 3.1 Some examples of atypical scenarios (extracted from eMars and ARIA) 10 Table 4.1 Whisky Maturation Warehouse Major Accident Scenarios 14 Table 5.1 Equipment typology 22 Table 5.2 Impact of atmosphere stability and wind speed on plume dispersion 31 Table 5.3 Roughness classes 32 Table 5.4 Important parameters affecting atmospheric dispersion of a toxic cloud under a worst case scenario 34 Table 5.5 Important parameters influencing a UVCE under a worst case scenario 35 Table 5.6 Important parameters influencing a BLEVE under a worst case scenario 36 Table 5.7 Important parameters influencing a classic boil-over under a worst case scenario 37 Table 5.8 Important parameters influencing a jet fire under a worst case scenario 37 Table 5.9 Important parameters influencing a fire/pool fire under a worst case scenario 38

Figure 2.1 Representation of the bow-tie approach 5 Figure 4.1 Steps and issues in the choice of a worst case scenario 17 Figure 5.1 Summary of the steps followed in the MIMAH 21 Figure 5.2 Source term characterisation for atmospheric dispersion 26 Figure 5.3 Release and process temperatures linked to event type 27 Figure 5.4 Continuous discharge of a product 29 Figure 5.5 Synthesis of important parameters 39 Figure 6.1 Synthesis of the worst case scenario definition and modelling approach 41

Appendix A Substance hazard categories and dangerous phenomena Appendix B Example of application of the MIMAH

1


1. Introduction

1.1 Purpose of this report

This report forms part of the outputs of a contract for the European Commission on ‘development of an assessment

methodology under Article 4 of Directive 2012/18/EU on the control of major-accident hazards involving

dangerous substances’. The work has been undertaken by AMEC, INERIS and EU-VRi.

The present report concerns one of a number of specific tasks under the project. It should not be read in isolation,

but in conjunction with the main report and in conjunction with the reports concerning the other project tasks.

1.2 Scope of Task 4

The focus of the assessment methodology is on assessing the potential consequences of an accident with a view to

concluding whether the accident could be considered as “major” in the sense of the Seveso III Directive. The

assessment of the potential for major accident hazard of a certain substance should be “substance related” (e.g.

physical form under normal processing or handling conditions or in an unplanned loss of containment and inherent

properties), and should take into account external factors which could impact on the consequences of an accident.

These conditions are referenced in Article 4 as “normal and abnormal conditions which can reasonably be

foreseen”.

This part of the report concerns Task 4 on identifying accident scenarios and a set of minimum conditions and

parameters to be taken into account which should allow an assessment with EU-wide applicability to be

undertaken. Part of this task aims at identifying the “normal and abnormal operating conditions which can

reasonably be foreseen” and which could impact on the consequences of an accident. Furthermore, the aim is to

identify a series of conditions which are normally considered in assessment models and to draw conclusions on the

“worst case” parameters to be considered, taking into account an EU wide implementation. The characteristics,

properties and operating conditions listed in Article 4 belong to the set of conditions studied in Task 4.

In terms of how this report is to be used, the identification of relevant accident scenarios is key to determining

whether a major accident is possible and whether further modelling is appropriate (covered by the Task 2 and 3

reports). It may be the case that no major accident scenarios can be identified, perhaps because of the

physicochemical or hazard properties of the substance in question1, where the assessor would then make a

justification for exclusion based on there being no credible accident scenarios. However, in other cases, it may not

be so clear-cut and accident scenarios may need to be developed to allow subsequent more detailed analysis and

1 For example, where a mixture has classification under the CLP regulation which leads to inclusion under Seveso, but the

concentration in use is lower than that at which relevant toxic effects occur (e.g. in the case of certain acids, below the

concentration of fuming acid).

2


modelling. In such cases, these will need to take into account the range of situations likely to be encountered

across the EU, both now and related to possible future uses2.

This report provides information on the potential accidents that could be created by a substance under the

assessment methodology. It gives details of:

The choice of one or more “reference accident scenarios”. The choice depends on the type of

substance concerned and the type of equipment used. These reference scenarios would be the

“worst case scenarios” for the substance at stake for example the full release of matter or energy

due to catastrophic rupture of a tank.

The choice of certain conditions that need to be fed into the accident scenarios in order to assess the

consequences of the scenarios, as well as their intensities. For example meteorological conditions,

quantities of substance involved and operating conditions are susceptible of variations. It also

reflects on the range of conditions that might occur within the EU.

The objective of this task is to describe the steps that may be followed in defining worst case scenarios in the

context of the development of the assessment methodology under Article 4 of the Directive. Guidelines and

examples are provided for each step of the process.

It should be noted that the present task does not aim at defining a full set of worst case scenarios that would be

suitable for all potentially relevant substances under Article 4, under all present and future operating and

environmental conditions in Europe. The suggested approach is generic enough to be applied to the different types

of equipment likely to be encountered in different types of hazardous plants, since the assessment methodology is

meant to be delivered at European scale. Furthermore, it is flexible and relevant for most of the expected situations

at present and in the future.

It is important to note that all of the material presented in this report is considered only in the context of the

Seveso Article 4 assessment method and is not prescriptive. The conclusions drawn do not necessarily apply

in any other context. The approaches to definition of (worst case) scenarios considered in this report are not

the only approaches available, and different approaches are considered more appropriate in other contexts

(e.g. site specific assessments under Seveso). Those persons undertaking an assessment under Article 4 could

decide to adopt alternative approaches where they are better suited to the particular case or substance

under consideration.

1.3 Structure of this report

This report is structured as follows:

Section 2 presents generalities on accident scenarios. One of the steps in defining worst case

scenarios consists of identifying relevant accident scenarios which may occur in relation to the

substance under consideration and the type of equipment involved. As a result, an overview of

2 This includes for example the quantities present, the source-term conditions (e.g. temperature, pressure), as well as the

characteristics of the environment and its effects on the dispersion/propagation of the relevant effects.

3


accident scenarios is included in order to clarify this concept within the context of this assessment

methodology.

Section 3 includes an historical analysis of past accidents from 2005 to 2013. Its aim is to

identify relevant abnormal conditions and specific configurations of accidents that should be

considered in the assessment methodology. The accident databases ARIA and eMars have been

used as the basis for the analysis. The results of the database analysis have been supplemented by

a literature review concerning worldwide definitions that exist for worst case scenarios.

Section 4 presents a methodology that can be used in the context of the assessment methodology.

Guidelines to identify relevant accident scenarios and to characterise these accident scenarios

under the worst case conditions are provided.

4


2. Generalities about accident scenarios

2.1 Bow-tie approach

The identification of the possible accident scenarios is an essential part of a risk assessment. An accident scenario

may be described by the following elements:

A dangerous substance or mixture managed and controlled through process containment (i.e.

storage) or process (i.e. transformation, production). This substance could, under specific

circumstances, create a danger for human health, the environment or surrounding structures and

equipment;

A series of initiating events (or combinations of initiating events) that leads to the loss of control

over the dangerous substance or mixture. These initiating events may be internal (e.g. failures of

equipment or failures in procedures) or external (e.g. aggressions or natural events);

A critical event that describes the loss of containment or loss of physical integrity;

Dangerous phenomena expected further to the loss of control. These depend on the inherent

characteristics of the substances involved, the conditions of release, the atmospheric conditions and

the environment where the release occurs;

Consequences to be expected if the dangerous phenomena reach people, the environment or

structures with sufficient intensity;

Safety barriers implemented for preventing or protecting human health, the environment and

structures from the effects of a loss of control.

These elements may be represented in a bow-tie diagram, which is a well-known risk assessment method. It can be

described as a combination of a fault tree (i.e. series of causes) and an event tree (i.e. series of consequences)

connected by a critical event. The bow-tie diagram also shows the safety barriers which can be implemented in

order to prevent the occurrence of the critical event or mitigate the major event or consequences. The bow-tie

approach is illustrated in the figure below (Figure 2.1).

5


Figure 2.1 Representation of the bow-tie approach

Source: ARAMIS, 2001

The bow-tie is centred on "CE" (i.e. the Critical Event), generally defined as a Loss of Containment (LOC). This

definition is quite accurate for fluids, as they are usually able to behave dangerously in their release state. For

solids and especially for mass solid storage, Loss of Physical Integrity (LPI) is considered, taking into account a

change of physical state of the substances.

The left part of the bow tie – the fault tree – identifies the possible causes of a critical event. The basic events in a

fault tree are:

Undesirable Events (UE), which are supposed to occur exceptionally under normal conditions of

operation;

Current Events (Cu E), which occur more or less frequently under normal conditions of operation

and which are, in a certain way, foreseeable.

The combination of Undesirable and Current Events may lead, taking into account the possible prevention barriers,

to an Initiating Event (IE). An Initiating Event is defined as the step that precedes the occurrence of the Critical

Event.

The right part of the bow tie – the event tree – identifies the possible consequences of a critical event. The Critical

Event, such as a pipe failure, leads to Secondary Critical Events (SCE) , for example a pool formation, a jet, or a

cloud, which in turn leads to the Dangerous Phenomena (DP) such as fire, explosion or the dispersion of a toxic

cloud. Major Events (ME) are defined as the exposure of targets (e.g. human beings, structure, and environment)

to a significant effect created by the identified Dangerous Phenomena.

In the context of the Article 4 assessment methodology, a worst case scenario approach, based on the assessment of

consequences of conceivable accidents occurring in the worst conditions, without quantifying the likelihood of

6


these accidents, has been chosen. The assumption made for the worst case scenario is that the worst release of

matter or energy, whatever the causes are, cannot be prevented by any prevention barriers. As a result, only the

construction of the right part of the bow-tie (i.e. the event tree) and its assessment is considered in this task. The

following section further justifies the choice of a worst case approach, which by definition is based on a

“deterministic approach”.

2.2 Worst case approach

2.2.1 The term “worst case”

At the workshop for this project, some participants highlighted that the term “worst case” might be confusing as

there is no common interpretation of the term. It is, therefore, necessary to explain further how this term is to be

understood in this report.

In line with the wording of Article 4, within this report, worst case includes all “normal and abnormal conditions

which can reasonably be foreseen” and all reasonably foreseeable dispersal, fate and behaviour parameters across

the EU. Since Article 4 refers to “conditions which can reasonably be foreseen” a strictly deterministic approach

cannot be used (see also the discussion below). All of the physically possible accident scenarios that could lead to

the release of the greatest matter or energy potential would need to be identified.

Therefore, it is necessary for the definition of the worst case to consider all possible conditions that may occur

across the EU relating to the use of a given substance. This not only includes the current uses but also reasonably

foreseeable future uses (e.g. larger quantities, obligatory storage or packaging conditions). Furthermore the variety

of meteorological and geographical conditions as well as other relevant parameters influencing an assessment will

need to be considered.

2.2.2 Justification of a worst case approach for the assessment methodology

Two main approaches may be used in the context of risk assessment:

Deterministic approach (DA), also called “consequence-based approach”

This consists of the assessment of the consequences of a pre-determined bounding subset of accident sequences.

This approach assumes that the accident scenarios will happen, whatever the safety measures implemented in

prevention. Hence, a DA aims at being conservative without taking into account site specificities.

When it is said that the scenarios determined in the DA are worst case, it shall be understood in the sense that the

critical event behind the scenario (e.g. loss of containment) is maximum. Therefore, the release of the highest

amount of energy is studied, theoretically leading to the highest effect distances;

Probabilistic approach (PA), also called “risk-based approach”

7


In this approach, all physically possible scenarios are identified and analysed along with their prevention and

mitigation barriers [which are generally site-specific]. They are graded regarding their probability of occurrence,

either from the central event to the dangerous phenomena or from the initiating events to the dangerous

phenomena.

The Joint Research Centre (JRC) has provided guidance on the preparation of a safety report where the main

differences between the two approaches are listed (see the table below).

Table 2.1 Main differences between deterministic and probabilistic approaches

Source: JRC, 2005

The PA is the approach followed in countries such as France, the UK and the Netherlands. France used to follow a

DA, until the Toulouse accident in 2001. Since then, the law of July 2003 explicitly introduces probability in the

scope of risk prevention. This change may be explained by two main reasons (Lenoble, 2011), which are common

drawbacks associated with the DA:

A DA does not enable site specificities and safety measures implemented in prevention to be taken into

account. Thus it is very conservative, leading to stringent land-use planning policies. In practice, when

this approach was used in France, some "very low probability" scenarios were excluded. A PA enables

greater transparency.

Only a limited number of accident scenarios are studied (based on expert judgement), which may lead to

other risks being overlooked i.e. not all physically possible scenarios are studied. A PA enables greater

completeness.

However, the boundary between DA and PA is not so clear cut. There are probabilities in a DA and determinism in

a PA. For instance:

In France, before 2001, the list of scenarios to study was derived taking into account some probabilistic

considerations: "the list comes from experience from SEVESO establishments and statistical analysis of

past industrial accidents" (French Ministry of Environment, 1990). This observation is also valid for

Germany (JRC, 2008).

8


In the Netherlands, the quantitative risk assessment is realised using a pre-determined list of scenarios for

certain containment systems. This list is not defined on the basis of a systematic and specific risk analysis.

C. Kirchsteiger, from JRC-MAHB, stated in 1999 that “there is neither a strictly deterministic nor a strictly

probabilistic approach to risk analysis. Each probabilistic approach to risk analysis involves deterministic

arguments; each deterministic approach includes quantitative arguments which decide how the likelihood of events

is going to be addressed.” (Kirchsteiger, 1999).

Therefore, these two approaches do not completely exclude each other. In the context of Article 4, it is not

appropriate to consider a truly deterministic approach. The approach suggested in the present task is to identify

"reasonably foreseeable worst case scenarios" (see section 2.2.1), according to the substance under assessment.

The Methodology for Identification of Major Accident Hazards detailed in this report enables all the physically

possible accident scenarios that can lead to the release of the highest energy potential to be identified in a

systematic way. Consequently, the risk of overlooking accident scenarios is much lower than if a pre-determined

list of scenarios is studied. It is relevant to note that some scenarios may inadvertently be overlooked in any risk

analysis method.

On the other hand, the assessment methodology should not completely exclude the possibility for a Member State

to complete the analysis with a probabilistic assessment.

The decision on whether to apply a DA or PA is usually considered when risk assessments of specific

establishments are to be made. A robust probabilistic assessment requires data such as initial event frequencies

(taking into account specific design and materials at a site) and/or central event frequencies, ignition probabilities,

etc. It is clear that a probabilistic assessment is based on the site under consideration. Hence, a high quality

probabilistic assessment requires important inputs in terms of time, money, and data availability and is suitable

when applied to a specific site.

In the context of Article 4, the approach is oriented towards the substance under assessment and not towards a

specific site: the approach needs to apply to all possible establishments where the substance will be held. The

assessment methodology under Article 4 must consider at EU scale all the accident scenarios which can be

reasonably foreseen and demonstrate that whatever the site, a major accident is impossible in practice. Therefore, it

does not seem conceivable to undertake a generalised probabilistic assessment at EU scale, either in terms of

quality of the assessment or difficulty of judging such an assessment.

As a result, a robust probabilistic assessment seems inappropriate (and impractical) in the context of the Article 4

assessment methodology, where a more generic assessment is needed. At a site-specific level, both DA and PA

approaches can be appropriate, so this is not a recommendation that a DA (or a PA) should be applied by member

states at a site-level.

9


3. Historical analysis of accidents

3.1 Background

The objectives of this section are to:

Identify the relevant abnormal conditions and specific configurations of accidents that should be

considered; and

Provide a first view of how accidents may be distinguished from major accidents (however, this

aspect is further explored under Task 6).

The accidents reported in the eMARS and ARIA databases have been reviewed for the period 2005-2013. The

ARIA database records accidents that occurred around the world whilst eMARS focuses on major accidents that

occurred in Europe. The purpose of these databases is to facilitate the exchange of lessons learned from accidents

and near misses involving dangerous substances and to improve accident prevention and the mitigation of potential

consequences.

Furthermore, scenarios identified through past accidents enable the links to be identified between the hazard

categories of a substance and the dangerous phenomena that may be generated following an accident involving that

substance. A qualitative study of the accident scenarios reported in the accident databases conducted to achieve

this goal is detailed in Appendix A. This is further explained in Section 5.2.2, where a methodology for the

identification of the worst case scenario is presented.

3.2 General presentation of the databases

The Major Accident Reporting System (MARS and later renamed eMARS) was first established by the EU’s

Seveso Directive 82/501/EEC in 1982 and has remained active, following the subsequent revisions of the Directive.

eMARS contains reports of chemical accidents and near misses that are reported to the Major Accident and

Hazards Bureau (MAHB) of the European Commission’s Joint Research Centre. EU Member States, but also

countries part of the OECD and the UNECE are part of the reporting members, as defined by the TEIA

Convention. Currently, eMARS holds data on nearly 800 major accident events. The historical analysis of

eMARS data covering the period between 2005 and 2012 focused on 158 accidents.

The ARIA database (Analysis, Research and Information about Accidents) has been set up by the French Ministry

of Sustainable Development and is an inventory of worldwide industrial accidents and incidents since 1992.

However, the database is primarily comprised of accidents and incidents that occurred in France. Since 2010, other

areas are covered in ARIA, such as the transport by road, rail or fluvial/maritime way of hazardous substances

transport, the distribution and use of domestic gas, hydraulic facilities, mines and quarries. The ARIA Database is

operated by the BARPI (Analysis Office of the Risks and Industrial Pollutions). At the end of December 2012,

ARIA contained 42,530 events, 85% of which were located in France.

10


3.3 Exploiting the databases

Events recorded in eMars are classified as “major accident”, “near miss” or “other event”. The near misses, which

mainly generate only material damages, are reported because they provide interesting learning opportunities.

Events classified as major accidents are reported because they fulfil at least one of the criteria for the notification

defined in Annex VI of the Seveso III Directive. However, some “major accidents” are reported because they

provide an opportunity to learn, albeit not fulfilling any of the criteria of Annex VI. In other words, conditions for

reporting defined in Annex VI are sufficient but not exhaustive. As a result, the analysis of these past accidents

may put forward some elements in relation to the definition of a major accident, which are not encompassed by the

criteria for notification.

The examples of accidents related below are examples of typical and “atypical” accidents, extracted from ARIA

and eMars. The word “atypical” is to be understood as defined by the European project iNTeg-Risk (Early

Recognition, Monitoring and Integrated Management of Emerging, New Technology Related, Risks). Paltrinieri

(2013) defines atypical accident scenarios as “scenarios deviating from normal expectations of unwanted events

captured by common hazard identification techniques”. The occurrence of this type of accidents, despite the low

probability, reinforces the relevance of the worst case scenario approach in the context of the assessment

methodology. Since the aim of the assessment methodology is to demonstrate that it is “impossible in practice”

that the substance or mixture could be at the origin of a major accident (i.e. no uncertainty tolerated under Article

4), a deterministic risk assessment is best suited in the context of the assessment methodology.

A series of example of different scenarios of major accidents have been extracted from the historical analysis and

are presented below.

Table 3.1 Some examples of atypical scenarios (extracted from eMars and ARIA)

Major accident Description of the circumstances and consequences

Explosions and fire in a lubricant

production facility – July 2012

(France)

A series of explosions, followed by a fire, happened in a 2,000 m² facility producing lubricants, oils and

greases in the form of aerosols and pulp. More than 1,000 people working in some 60 surrounding

facilities were evacuated. A great black plume could be seen from 30 km away. With the exception of

outside storage tanks, the entire facility was destroyed and 12 people were injured. A fire in the aerosol

storage area had happened 5 years before this incident, leading to the boiling liquid expanding vapour

explosion of several bottles.

11


Major accident Description of the circumstances and consequences

Full rupture of a sulphuric acid

cistern – February 2005 (Sweden)

A cistern containing 16,300 tons of 96 % sulphuric acid was ruptured. The entire content of the cistern

was spilled out into the tank bund and then out into the company’s dock. When the sulphuric acid came

into contact with the water there was an exothermic reaction, which produced a vapour cloud that,

pushed by the wind, drifted northwards along the coastline. After the spill there was approximately 2,000

tons of contaminated sulphuric acid by water in the bund. About 100,000 m² of the ground surrounding

the spill has been affected by the acid. An acid cloud was produced when the sulphuric acid came into

contact with the salt water in the bund. The salt water consisted of approx. 0.7 w-% chloride ions. The

Swedish Defence Research Agency has estimated that the sulphuric acid together with the salt water

produced a cloud (gas and aerosol) consisting of hydrogen chloride (HCl). During the first few minutes

the maximum concentration of HCl was estimated at 6,000 mg/m3 at some spots near the scene of the

accident. After 10 minutes, the highest concentration recorded was 600 mg/m3 and the concentration

declined to 60 mg/m3 after 60 minutes. The cloud moved along the coast line and mostly over the sea.

No one outside the plant was affected. The cistern stands in a tank farm and the bund can hold a third of

a cistern's volume in the event of a leak. The bund was filled with salt water when the rupture occurred.

There was also another cistern containing 19,500 tons of 96 % sulphuric acid in the bund. To reduce the

risk of damage to this other cistern the incident commander ordered the emptying of the bund, resulting

in 1,000 to 2,000 tons of water contaminated by sulphuric acid being pumped out into the company's

dock area. The acid cloud (gas and aerosol) moved along the coastline but mostly over the sea. After

approximately one hour and 10 km away from the plant the acid concentration in the cloud was

harmless.

Vapour Cloud Explosions in an oil

storage depot – December 2005

(UK)

A number of Vapour Cloud Explosions (VCE) occurred at Buncefield Oil Storage Depot following an

overflow of a tank. At least one of the initial explosions was of massive proportions and there was a

large fire, which engulfed a high proportion of the site. Over 40 people were injured. Significant damage

occurred to both commercial and residential properties in the vicinity and a large area around the site

was evacuated on emergency service advice. The fire burned for several days, destroying most of the

site and emitting large clouds of black smoke into the atmosphere.

Release of highly flammable

liquids in a synthetic resin

processing plant – August 2008

(location not specified)

The production of DCPD (Dicyclopentadiene) modified soya-oil by means of a pressure reaction process

was started. The precursor DCPD was charged into a reactor and the sealed reactor was heated up

forming an overpressure. At a temperature of 237°C and an overpressure of 4.5 bar, the bursting disk

(i.e. the overpressure safety system) ruptured. The reactor content was released under pressure into the

catch-tank, causing the release of an aerosol cloud through the pressure relief flap of the catch-tank.

The operative conditions of the reaction process were by all means normal until the bursting disk broke.

The bursting disk and the catch tank are designed to act as overpressure safety system for a pressure

higher than 8.8 bar (with respect to the normal operating temperature of 237°C) in case of abnormal

operating conditions. The bursting disk ruptured at 4.6 bar instead of 8.8 due to structural weakening

caused by corrosion.

Fire in a plant of solidification and

storage of solidified naphthalene –

March 2009 (location not

specified)

The accident occurred in a naphthalene solidification plant (substance dangerous for the environment

and flammable) when inside the shrink film packaging machine a pallet caught fire, spreading the fire to

the entire plant. Meteorological conditions were stable with light north-west wind. There is no further

information available on damages to persons or the environment caused by the accident. The

preliminary accident investigation indicates a probable dysfunction in the shrink film packaging system.

These examples provide an overview of what could be considered as a worst case accident (i.e. full release of the

largest hazard potential in the worst conditions). Further elements to take into consideration when addressing this

concept are presented in the following section.

12


4. Worst case scenario identification

4.1 Scope and definitions

4.1.1 Overview

The concept of “worst case scenarios” is used in the field of risk assessment and is often used in the context of land

use planning in the vicinity of Seveso establishments. Since many definitions of this concept exist according to the

country where it is used, it is relevant to gather the current existing definitions and study their similarities and

differences. Examples of scenarios retained for land-use planning and examples from safety reports of different

countries are provided in the next sections.

The interpretation of the term “worst case” in the context of the current report was described in Section 2.2 of this

document.

4.1.2 Literature review

Liovin (2007) puts forward a definition of worst case scenario given by Dr Peter M. Sandman, an expert in the field

of risk communication, which reflects the general sense of the term: “worst case scenarios are high magnitude

risks; they are the worst things that can happen. They are almost always low-probability – the worst that can

happen does not happen very often. So they are mathematically equivalent but not ‘humanly’ equivalent to

alternative scenarios that are not so bad but a good deal more likely”.

However, there is no agreed definition of worst case scenario. Some countries may use other terminologies to

describe what a worst case scenario is. For example, the concept of “worst case release”, which is a specific type

of worst case scenario, can be encountered.

A worst case release has been defined by the U.S. Environmental Protection Agency (USEPA) as a “release of the

largest quantity of a regulated substance from a vessel or process line failure, determined taking into account only

“administrative” measures3, which results in the greatest distance to a specified endpoint”. This definition assumes

the failure of all safety and mitigation systems, with the exception of passive measures, such as dikes and basins.

The USEPA also states that for the worst case analysis, the possible causes of the worst case release or the

probability that such a release might occur do not need to be considered; the release is simply assumed to take

place. As a result, only the right part of the bow-tie (see Figure 2.1) is studied i.e. central event and possible

consequences.

3 Administrative controls are written procedures that limit the quantity of a substance that can be stored or processed in a

vessel or pipe at any one time or, alternatively, procedures that allow the vessel or pipe to occasionally store larger than

usual quantities (e.g., during shutdown or turnaround).

13


The European project ARAMIS, further described in Section 5 below, uses the term “Major Accident Hazards”,

which is to be understood as the worst accidents likely to occur on an installation, assuming that no safety systems

(including safety management systems) are installed or that they are ineffective. These “Major Accident Hazards”

reflect the maximum hazardous potential for a specific installation.

The reference manual BEVI risk assessment (which replaced the so-called “Purple Book”), provided by The

Netherlands National Institute for Public Health and the Environment (RIVM in Dutch), defines the worst case

scenario as “the instantaneous release of the entire contents within 10 minutes” (RIVM, 2009). No information

about the effectiveness of the safety system is provided.

Ham et al (2006) summarize the previous definitions by stating that the worst case scenario should be both:

A representative accident scenario. (See Section 5.2 on defining the scenario);

An accident with the highest hazard potential. (See Section 5.3 on guidelines for choosing the relevant

parameters and conditions).

4.1.3 Feedback from the survey

In the context of the development of the assessment methodology under Article 4, a survey has been submitted to

Member State authorities and other relevant bodies, in order to collect inputs from various stakeholders. This

survey addressed in particular the identification of accident scenarios and the definition of worst case scenarios.

Various answers have been provided, including precise definitions and reference to national and international

guidelines.

Respondents to the survey defined a worst case scenario as:

A scenario with the highest consequences (e.g. highest release of material with unfavourable weather

conditions);

A combination of the worst accident conditions with worst environmental conditions (wind/water/geology):

- Worst accident conditions can be understood as conditions involving whole of the inventory of the

hazardous material, being released in the shortest possible time or maximum production of a

chemical substance, only limited by physical constraints (such as minimum temperature and

minimum oxygen level to sustain a fire). The shortest possible time can be an instantaneous loss of

containment. However some release mechanisms produce larger impacts when release is not

instantaneous but very fast (e.g. a jet fire generates larger effect distances than a pool fire, with

equal amount of substance involved);

- Worst environmental conditions: those conditions that cause the largest impact. Often conditions

of low wind speed (but not necessarily so), low water tables (i.e. low flow and dilution).

A release of the largest single inventory.

Moreover, the available guidelines mentioned in the survey answers have been used as inputs for a methodology to

identify and assess worst case scenarios (Section 5).

14


4.2 Examples from the literature review

4.2.1 EU Member States

In the context of the European working group “Land-Use Planning” led by the JRC, reference scenarios (generic

event trees) are under construction for land-use planning purposes. The group is focusing on specific substances

such as liquefied petroleum gas (LPG), ammonia, chlorine, liquefied natural gas (LNG), liquid oxygen (LOX), and

flammable liquids (FL). The types of loss of containment considered are for example full bore rupture of the pipe

or instantaneous release of the entire contents of the tank.

UK

The HSE has provided a number of Safety Report Assessment Guides (SRAGs) to help the operators meet their

duties under the Control of Major Accident Hazards (COMAH) regulations. These SRAGs define a range of

scenarios to be considered for a number of substances (e.g. chlorine, explosives, liquefied petroleum gases, etc.).

For example, the major accident scenarios identified for whisky maturation warehouse are summarised in the table

below.

Table 4.1 Whisky Maturation Warehouse Major Accident Scenarios

Plant Item Failure Plant Item Failure Accident Scenarios

Storage Tank Cold catastrophic failure

Pool fire

Flash fire

Hot catastrophic failure

BLEVE

Fireball

Explosion

Hole in vessel wall

Spigot flow

Pool fire

Flash fire

Tank fire

Boil over

Flammable head space

Internal explosion

Missile formation

Transfer Pipework / Road Tanker

Loading and Unloading Maturation Warehouse

Rupture

Pool fire

Flash fire

VCE

Leaking casks

Puncture

Pool fire

Flash fire

VCE

Small hole

Flash fire

Casks/ Cask

Storage Area

Flammable head space

Internal explosion

Source: HSE, 2010

Moreover, the HSE uses a number of “exemplar” substances to define the worst case releases for identifying

consultation zones in the context of land use planning. Worst combinations of generic toxicity categories

15


(according to the former Dangerous Substances Directive) and physical forms for the purpose of dispersion have

been identified.

France

Before the Toulouse accident in September 2001, French safety regulation was based on a deterministic approach

(i.e. worst case scenario approach) where six reference scenarios were modelled, without taking into account the

likelihood of occurrence. These reference scenarios can be assimilated to worst case scenarios in the sense that

they consider the release of the maximum energy potential. They are linked to different types of installations

described as follows:

Liquefied combustible gases installations:

- Scenario A: BLEVE (Boiling Liquid Expanding Vapour Explosion);

- Scenario B: UVCE (Unconfined Vapour Cloud Explosion) following the rupture of the most

penalising pipeline i.e. highest mass flow or highest leaked mass at the breach.

Vessels containing liquefied/non-liquefied toxic gases:

- Scenario C: Total instantaneous loss of containment.

Toxic gas installations where the containment is designed to resist external damage or internal

reactions of products:

- Scenario D: Instantaneous rupture of the largest pipeline leading to the highest mass flow.

Large vessels containing flammable liquids:

- Scenario E: Fire in the largest tank, explosion of the gas phase for fixed roof tanks, fireball and

projection of burning product due to boilover.

Storage or use of explosives:

- Scenario F: Explosion of the largest mass of explosives present or explosion due to a reaction.

The following examples illustrate how the above scenarios can be implemented and applied to real life situation

and in the context of real safety studies that would have been conducted before the change of the French safety

regulation:

Fire of the entire raw materials storage building (considering the maximum capacity of the building;

Fire in the retention tank of the oil storage area;

Explosion in the extractor room;

Full bore rupture of the largest gas pipeline with duration of release between 60 and 1200 seconds

according to site-specificities (due to different intervention times); and

16


Boilover on an oil tank.

Toxic and flammable gas cloud dispersions are modelled considering a wind speed of 2 metres/second.

4.2.2 USA

An amendment made by the U.S. Congress during the negotiations of the Clean Air Act adopted in 1990 translated

into an obligation for manufacturing facilities to develop a Risk Management Plans (RMP) and to submit it to the

USEPA by July 1999. These RMP require the identification of “worst case scenarios” for accidental release of

toxic or flammable gas to neighbouring inhabited areas.

In this context, an American company, manufacturing fertiliser from liquid butadiene stored in tanks under

pressure, has developed a worst case scenario. It is described as “one where a number of things go wrong all at

once (everything held in a tank is released, safety controls do not work, chemicals are released very quickly, and

the wind is not strong enough to quickly dilute the vapours)” (Johnson et al, 2003). The establishment estimated

that the accident that could affect people the farthest away from their factory would result from the release of about

17,000 gallons of butadiene held in the largest storage tank. Such a release would create a cloud of toxic vapour

that would travel away from the plant in the direction of the wind. In a light wind, the cloud would stay highly

concentrated over a two mile zone. If people are exposed to the cloud within this distance, they could experience

serious problems, including extreme eye, throat and breathing irritation, or convulsive coughing. Exposure to this

cloud could cause death if it does not pass quickly or people cannot escape to fresh air. As the cloud travels away

from the plant it would spread out, becoming less concentrated and less harmful. Less serious effects would occur

between two and seven miles from the factory.

Other examples of worst case scenarios provided by the USEPA are (WEC, 2012):

A transfer hose with no shutoffs fails, resulting in the release of the contents of the vessel or tank it is

attached to;

Tank piping with no shutoffs fails, resulting in the total release of the tank contents;

A flame impingement on a vessel which results in the vessel’s failing; and

A severe vessel over-pressurisation caused by contamination, a runaway reaction, or overheating

which causes a venting to the atmosphere or a vessel failure.

4.3 Summary

In the light of the previous definitions, and with a view to applying them to the assessment methodology, the use of

a worst case scenario approach requires two main steps, presented in the figure below (Figure 4.1).

Define the accident scenario by deciding on the elements constituting the event tree, defined in Section

2 and illustrated in the right part of Figure 2.1. Guidelines on this element are presented in Section

5.2;

17


Assess the release scenario by deciding on the relevant parameters and conditions e.g. process

conditions, size and duration of release, atmospheric conditions and environmental characteristics.

The characteristics, properties and operating conditions listed in Article 4 form the framework for this

step. Guidelines on this element are presented in Section 5.3.

Figure 4.1 Steps and issues in the choice of a worst case scenario

18


5. Methodology for defining and modelling a worst case scenario

5.1 Generalities

The aim of this section is to describe the process that could be chosen for defining relevant worst case scenarios for

the assessment methodology under Article 4. Examples and default values (when relevant) are provided on the

basis of conservative assumptions.

An assessment of worldwide practices on defining worst case scenarios found that the regulations in the United

States of America (USA), Finland and Belgium, inter alia, follow a worst case scenario approach in the context of

risk assessment. The USA follows this approach for emergency planning and communication to the public.

According to the accidental release provisions of the Clean Air Act, operators of regulated sources are required to

conduct a hazard assessment, including offsite consequence analysis, and report the results in a Risk Management

Plan (RMP). This consequence analysis is based on a worst case scenario and a number (at least one) of alternative

release scenarios. Finland includes scenarios for both typical and worst case accidents when conducting a risk

assessment. An interesting feature of worst case scenarios used in Belgium is that its main purpose is to analyse

the efficiency of safety measures, rather than predicting the scale of consequences.

Despite this use of worst case scenario approach by several countries, few guidelines are provided as regards the

methodology followed to define them. Major contributions to the development of a methodology for worst case

scenario definition have been provided through:

The European ARAMIS project, which ran from 2001 to 2004. This source of information is

presented in Section 5.2.

The USEPA: in the context of the RMP mentioned in Section 4.2.2, the USEPA has provided

guidelines regarding offsite consequence analysis, where assumptions for modelling worst case

scenarios (in the case of toxic or flammable substances) are formulated. This source of information is

presented in Section 5.3.

As set out earlier in this report, all reasonably foreseeable conditions should be taken into account when identifying

worst case scenarios, including current and possible uses of the substance. It is also important to look beyond past

accidents and previously-considered accident scenarios, and to consider accident scenarios which have not occurred

in the past, but which might in the future taking into account the range of possible uses of a substance4.

4 In this context, it is important to consider so-called “black swan” events, which are events that are unpredictable but which

have a very large impact. In the context of Article 4, all of the foreseeable conditions (across Europe, both now and in the

future) that could lead to a major accident should be considered.

19


As mentioned in Section 4.3, setting up setup a worst case scenario implies firstly deciding on the event tree to

build and secondly fixing the relevant parameters. Guidelines for these two steps are provided in the following

sections.

As set out in the introduction to this report, the approaches to definition of (worst case) scenarios considered in this

report are not the only approaches available, and different approaches are considered more appropriate in other

contexts (e.g. site specific assessments under Seveso), and furthermore alternative approaches may be better suited

to the particular case or substance under consideration

5.2 Guidelines on defining the worst case scenario

5.2.1 Background

The first step in the building of a worst case scenario is to set up an event tree based on a credible series of events.

For this purpose, it is suggested to adopt an approach similar to the one developed in the Methodology for

Identification of Major Accident Hazards (MIMAH) created in the context of the European project ARAMIS.

The ARAMIS project provided methodological guidelines to support the implementation of the Seveso II Directive

in the Member States. The whole risk analysis process is covered, from hazard identification to severity mapping.

The project was divided into several work packages, the first aiming at helping operators to identify the relevant

accident scenarios using the bow-tie approach presented in Section 2. The first part of this work package was about

the definition of a Methodology for the Identification of Major Accident Hazards, without considering safety

systems, which will be of interest in this report. It should be noted that the scope of the ARAMIS project was

limited to chemical plants.

It seems important to highlight that even though the MIMAH represents a major contribution to worst case scenario

definition, it may not be the sole existing approach5. The ARAMIS project and its MIMAH was selected to support

this task since it has been funded by the European Commission, is validated at European scale and was

recommended by the United Nations Economic Commission for Europe Convention on the Transboundary Effects

of Industrial Accidents (UNECE, 2012). Moreover it is generic enough to be used in the context of the assessment

methodology. Thus, albeit not obligatory, there are strong arguments speaking in favour of using the MIMAH in

the context of Article 4.

5.2.2 Generalities about the MIMAH approach

The objective of the Methodology for Identification of Major Accident Hazards is to define the maximum

hazardous potential of an installation by predicting which major accidents are likely to occur on given equipment,

5 The DyPASI Methodology (Dynamic Procedure of Atypical Scenarios Identification) is an example of alternative approach developed

in the context of the European project iNTeg-Risk. It is a method for the systematisation of information from past accidents and inherent

studies, in order to bring to light uncommon potential incident scenarios related to the substances, the equipment and the industrial

process considered. See Paltrieni (2013) and http://www.aidic.it/icheap10/webpapers/401Paltrinieri.pdf for an example of

application in Liquefied Natural Gas regasification terminals.

http://www.aidic.it/icheap10/webpapers/401Paltrinieri.pdf

20


without preconceptions on occurrence probability. The term “Major Accident Hazards” should be understood as

the worst accidents that could occur at an installation, assuming that no safety systems (including safety

management systems) are installed or that they are ineffective. The Major Accident Hazards depend only on the

equipment characteristics and the hazardous properties of the chemical handled in the equipment, which therefore

seems suitable for the EU wide implementation of Article 4.

As the MIMAH had to remain generic, the approach adopted was to define a method allowing an accident scenario

to be built on the basis of only three data points: the equipment type, the hazardous properties of the substance and

its physical form. For this purpose, the MIMAH has been divided in four steps:

1. An equipment typology (see Section 5.2.3) and a hazardous substance typology (see Section 5.2.4) have

been defined, allowing the classification of equipment and substances encountered on chemical plants.

2. A list of critical events (centre of the bow-tie) likely to occur for each type of equipment has been drawn

up.

3. A systematic method to build an event tree has been developed. The approach chosen consists of

defining logical links between critical events and secondary events, and then between secondary critical

events and dangerous phenomena. This is done by the way of matrices, and the result obtained is a tree

giving the possible accident scenarios for each critical event studied.

4. A selection of the scenarios obtained is then identified according to the hazardous properties of the

substance being handled. This selection will lead to the deletion of some branches of the event tree. For

example, for flammable gases, typical accidents include jet fire, pool fire, vapour cloud explosion, boiling

liquid expanding vapour explosion, etc. More examples are provided in Appendix A. The links between

the hazard category of the substance and the dangerous phenomena that may be generated are supported by

qualitative study of past accident scenarios based on the eMars database. This is presented in Appendix A.

The MIMAH is illustrated in the figure below.

21


Figure 5.1 Summary of the steps followed in the MIMAH

Source: Delvosalle, 2005

Matrices are used in order to define which critical events must be associated with given equipment containing a

given substance. For example, in the matrix “Equipment type” – “Critical event” (EQ-CE), a sign “X” in a cell

indicates that the association CE–EQ is possible. On the contrary, an empty cell indicates that the top-column

critical event cannot be associated with the top-line equipment type.

An example illustrating the use of the methodology is provided in Appendix B. The sections below aim at giving a

general overview of the equipment and hazardous substance typologies used in the MIMAH. Details on

definitions, matrices built in the context of ARAMIS and additional rules are not provided in this report. For these

considerations, the reader is referred to Delvosalle (2002)6.

5.2.3 Equipment typology

Equipment is classified in generic categories, according to function and operating conditions. A first way to group

equipment is the ‘unit’, in which several types of equipment are described and defined. Four units and 16

equipment types are defined. The list of selected equipment is presented in the table below.

6 This report can be found at http://web-archive-it.com/it/j/jrc.it/2012-10-12_419743_9/ARAMIS_Consortium_composition/

22


Table 5.1 Equipment typology

Unit Equipment

Storage units

1. Mass solid storage

2. Storage of solid in small packages

3. Storage of fluid in small packages

4. Pressure storage

5. Padded storage

6. Atmospheric storage

7. Cryogenic storage (with cooling system)

Transport equipment 8. Pressure transport equipment

9. Atmospheric transport equipment

Pipes networks 10. Pipe

Process units

11. Intermediate storage equipment integrated into the process

12. Equipment devoted to the physical or chemical separation of substances

13. Equipment involving chemical reactions

14. Equipment designed for energy production and supply

15. Packaging equipment

16. Other facilities

5.2.4 Substance typology

The ARAMIS project fitted into the scheme of the Seveso II Directive. As a result, the substance typology is based

on the hazard categories of the Seveso II Directive, coupled with a specific selection of risk phrases defined in

Directive 67/548/EEC (Council Directive of 27 June 1967 on the approximation of laws, regulations and

administrative provisions relating to the classification, packaging and labelling of dangerous substances) and in

Directive 1999/45/EC (Council Directive of 31 May 1999 concerning the approximation of the laws, regulations

and administrative provisions of the Member States relating to the classification, packaging and labelling of

dangerous preparations).

Note: Directives 67/548/EC and 1999/45/EC have been replaced by Regulation (EC) No 1272/2008 of the

European Parliament and of the Council of 16 December 2008 on classification, labelling and packaging of

substances and mixtures, which implements within the Union the Globally Harmonised System of Classification

and Labelling of Chemicals that has been adopted at international level, under the auspices of the United Nations

(UN). That Regulation introduces new hazard classes and categories. As a result, the thinking described in

23


Delvosalle (2002)7 to select dangerous phenomena according to the substance hazard categories should be adapted

to the new Regulation (this can be readily done as illustrated in Section 2.5 of Appendix B).

5.2.5 Critical events

The critical event, at the centre of the bow-tie, can be defined as a loss of containment or a loss of physical

integrity. The ARAMIS project defined a concise list of 12 critical events likely to occur on equipment. They are

as follows:

Decomposition (CE1);

Explosion (CE2);

Materials set in motion (entrainment by air) (CE3);

Materials set in motion (entrainment by a liquid) (CE4);

Start of fire (LPI) (CE5);

Breach on the shell in vapour phase (CE6);

Breach on the shell in liquid phase (CE7);

Leak from liquid pipe (CE8);

Leak from gas pipe (CE9);

Catastrophic rupture (CE10);

Vessel collapse (CE11);

Collapse of the roof (CE12).

A table linking equipment types and critical events was built. This table provides an overview of the critical events

that could be observed based on the different types of equipment used. The process illustrated in Figure 5.1 above,

would be followed.

5.2.6 ARAMIS historical analysis

The typology used in the MIMAH has been compared, within the scope of the ARAMIS project, with an historical

review of the known major accidents that occurred between 1980 and 2001 in order to validate the theoretical

approach. For this purpose, various databases such as MARS (Major Accident reporting System from the

European Commission), MHIDAS (Major Hazard Incidents Data Service) and HADES (HAzards Database and

Effects Study) have been consulted to determine the Most Often Observed Accidents (MOOA) as a function of the

typology of accident scenarios. Other objectives of the historical analysis were to verify the relevance of the event


24


trees, verify the lists of equipment types, critical events, and dangerous phenomena, and to obtain statistics to

define the MOOA.

The present report does not aim at providing a detailed presentation of this historical review. However, it seems

interesting to highlight that the historical analysis confirmed the results obtained with the approach developed in

the MIMAH. Nevertheless, the following modifications were suggested:

In the MIMAH, pressure transport equipment and atmospheric transport equipment are considered.

According to the historical analysis, it would be interesting to add the transport equipment of solid

substances.

The critical event "Decomposition" of solids could be associated with the following equipment if they

handle a solid substance:

- Equipment devoted to physical and chemical separation;

- Packaging equipment;

- Transport equipment.

In some conditions (e.g. if the liquid is volatile), the critical event "Breach on shell in vapour phase"

could be associated with the equipment "Atmospheric storage".

In the case of a "Mass solid storage", the critical event "Start of fire" can lead to the dangerous

phenomenon "Dust explosion" if the substance is explosive.

In some conditions (e.g. small packages of propane), the critical event "Start of fire" in a storage of

small packages can lead to dangerous phenomena "Overpressure generation" and "Missiles ejection".

The historical analysis is detailed in Delvosalle (2003)8.

5.3 Guidelines on assessing the worst case scenario

The step following the identification of the accident scenarios consists of assessing the consequences that may arise

from the realisation of the identified scenarios, in the worst conditions. The three major hazards (i.e. fire, explosion

and atmospheric dispersion) usually involve the emission of material from containment followed by vaporisation

and dispersion of the material. The elements listed below are of particular relevance:

Escape of flammable material, mixing of the material with air, formation of a flammable cloud,

drifting of the cloud and finding a source of ignition, leading to a fire and/or a vapour cloud explosion,

affecting the site and possibly populated areas.

Escape of toxic material, formation of a toxic gas cloud and drifting of the cloud, affecting the site and

possibly populated areas.


25


Explosions of solids and tanks for example.

Fires of solids, liquids, boil-over.

To model these situations, a number of tools may be used (see the report on Task 2), each of them requiring

specific parameters. Factors that influence the extent of the consequences of an accidental release may be

categorised as follows:

Parameters concerning the conditions of the release i.e. the characterisation of the source term.

- This includes for example the quantity of hazardous substance released, the release temperature and

pressure, the size of the leak, the release height, the duration of the discharge and the geometry of

the dike/bund (if any).

Parameters about the conditions at the site at the time of the release i.e. the characterisation of the

environment.

- This includes for example the terrain roughness, the meteorological conditions, obstacles and

topography.

It should be highlighted that the parameters important to characterise the source term and the environmental

conditions differ according to the type of dangerous phenomenon under assessment. For example, meteorological

conditions greatly impact the extent of atmospheric dispersion but have no influence on the behaviour of a boil-

over. Sections 5.3.1 and 5.3.2 below aim at presenting the key parameters (source term and environmental

conditions) in general terms, without consideration of the dangerous phenomena under a worst case scenario.

Section 5.3.3 presents the important parameters according to the type of dangerous phenomenon.

In the context of Article 4, the choice has been made to follow a worst case approach (see section 2.2). As a result,

in order to assess the worst consequences that could arise, the previously defined scenarios have to be assessed

assuming the worst case conditions would occur. This means that the parameters should be set at levels allowing

the worst case scenario to be identified, both regarding the source term and the environmental conditions, taking

into account EU-wide implementation. It is acknowledged that these conditions, especially those related to the

environment, can vary hugely from one European country to another and one establishment to another. For

example, meteorological conditions are significantly different in a Nordic country compared to those in a

Mediterranean country. As a result, recommendations such as that of the USEPA, which consists of using a 15°C

temperature and a 50% humidity rate as the worst case conditions, should be considered in the light of the diversity

of environmental conditions that can be encountered across the EU. Terrain roughness, related to the topography

and the presence of obstacles, is also a site-specific parameter that needs to be screened throughout the EU.

Section 5.3.2 provides further guidance about the choice of worst case environmental parameters.

The USEPA has provided guidelines regarding offsite consequence analysis, where assumptions for modelling

worst case scenarios (in the case of toxic or flammable substances) are formulated. Also the BEVI formulates some

guidance. This is explored in the sections below.

26


5.3.1 Source term

The “Yellow Book” (RIVM, 1996) defines the source term as the “physical phenomena that take place at a release

of a chemical from its containment before entering the environment of the failing containment, determining:

The amount of chemical entering the surroundings in the vicinity of the containment, and/or release

rate and duration of the release;

The dimensions of the area or space in which this process takes place, including height of the source;

The thermodynamic state of the released chemical, such as concentration, temperature, and pressure;

Velocities of the chemical at the boundaries of the source region.”

For example, in the case of atmospheric dispersion, characterisation of the source term is a prerequisite to assessing

the consequences in terms of flammable or toxic cloud creation. The figure below illustrates the parameters that

are used to characterise the source term in the case of an atmospheric dispersion.

Figure 5.2 Source term characterisation for atmospheric dispersion

Source: INERIS

Other parameters are of interest when other dangerous phenomena are to be assessed. For example, in the case of a

fire, the flame emittance and the flame height, as well as the pool surface, are of importance. Regarding a jet fire,

the ejection angle and the ejection speed need to be considered for the source term characterisation.

Substance involved

Pressure and temperature at the time of the loss of containment

Pressure in the containment at the time of the release is an important parameter since the driving force for outflow

of a substance from the containment is the pressure difference between the containment and the ambient. Where

appropriate, the pressure considered for the accident scenarios in the worst conditions may be:

27


The maximum allowable working pressure for pipes; or

The burst pressure for tanks, which depends on the scenario considered. In the case of a slow pressure

increase, the burst pressure can be purely mechanical (e.g. from 2 to 2.5 higher than the design

pressure). When the tank is heated (by an external fire for example), the outer layer becomes more

brittle and the burst pressure decreases. In this case, the burst pressure can be assimilated to the design

pressure. This hypothesis is conservative since the burst pressure would certainly be lower than the

design pressure in the case of a fire.

These pressures should not be site-specific but should reflect the (current and possible future) European practices

regarding the substance under assessment.

Pressure at the time of the release will also depend on the temperature of the substance at the time of the release.

USEPA (2009) suggests that setting the temperature of released toxic gases liquefied by refrigeration at

atmospheric pressure at their boiling point reflects one of the worst case conditions of release. Regarding release

temperature of toxic liquids, the USEPA suggests considering the highest daily maximum temperature occurring in

the past three years or the temperature of the substance in the vessel (i.e. for the EU in the context of the assessment

methodology), whichever is higher.

The figure below may enable a check to be made on whether the release temperature chosen is relevant to process

conditions and type of dangerous phenomenon that may occur.

Figure 5.3 Release and process temperatures linked to event type

Source: Mizuta, 2013

Quantity of hazardous substance

The quantity of hazardous substance released is one of the key parameters affecting the scale of an accident. In the

case of toxic gas cloud dispersion, if the mass released increases, toxic effect distances will increase. In the case of

an Unconfined Vapour Cloud Explosion (UVCE), if the mass released increases, the distance to Lower Flammable

Limit (LFL)9 and overpressure effect distances increase. In the case of a Boiling Liquid Expanding Vapour

9 Distance to Lower Flammable Limit (LFL) is the maximum distance at which the LFL of the gas cloud is reached (the LFL is

the minimum concentration at which the gas cloud can ignite in the presence of a source of ignition).

28


Explosion (BLEVE) and a classic boil over, if the stored quantity increases, the thermal effect distances increase.

However, it is considered that the overpressure effects generated by a BLEVE are produced by the vapour phase

expansion. As a result, the lower the liquid filling ratio the higher the volume of the vapour phase and the higher

the overpressure effect distances (mostly).

In the context of Article 4 of the Seveso III Directive, the assessment methodology is to be applied at European

level. Site-specific conditions cannot be used when determining the quantity of substance involved. As a result, it

is suggested that it is the Member State's duty to demonstrate that the substance cannot be used in larger quantities

than the one chosen for the assessment. For instance, an EU survey aiming at determining the maximum volume of

the substance under assessment may be conducted by the Member State to support the choice made in the

modelling. However, possible future use of the substance in greater quantities than at the largest-using current

facility should also be taken into account (i.e. reasonably foreseeable quantities in the future).

Type of emission and release rate

Two types of emission in the atmosphere can be distinguished: instantaneous or continuous discharge.

Instantaneous discharge

The damage consists of the complete rupture of the containment vessel, resulting in an immediate and

instantaneous release of the whole contents. During an instantaneous discharge of gas, and in the absence of a

significant obstacle in the nearby environment, the initial expansion of the cloud is relatively isotropic10. The result

is a spherical gaseous volume, or hemispherical if the emission occurs at ground level.

Instantaneous discharges are mainly characterised by the quantity emitted into the atmosphere and the pressure in

the vessel at the moment of rupture (bursting).

Continuous emission

A continuous emission could arise from pipework or a storage vessel or could be emitted from an extraction

chimney. The emission will depend mainly on the storage conditions at the moment of the confinement loss but

also on the size, geometry and height of the leakage orifice. From these data, it is possible to estimate a source

term (e.g. flow rate, speed, temperature of the discharge and liquid fraction).

For a gaseous discharge from a vessel, the flow rate usually varies over time, since as the vessel empties and the

quantity of stored product reduces, the leak pressure reduces over time.

In most cases the plume has an elongated shape (see the figure below).

10 With physical properties that are identical in all directions in space.

29


Figure 5.4 Continuous discharge of a product

Worst case conditions

In the case of toxic gas cloud dispersion, if the mass flow rate and duration of the release increases, toxic effect

distances will increase. In the case of a UVCE, if the mass rate increases, flammable mass, distance to LFL and

overpressure effect distances increase. If the UVCE is generated by a continuous release, the duration of the

release has a negligible impact in terms of intensity, since in a short period of time, the cloud is stable (few or no

evolution in time). In the case of a jet fire, the higher the mass rate of the release, the higher the thermal effect

distances are.

USEPA (2009) and the reference manual BEVI suggest that for toxic gases, an unmitigated gaseous release of the

total quantity occurs in 10 minutes. USEPA (2009) provides detailed guidelines to estimate worst case toxic gas

release rates in the following situations:

Unmitigated releases (releases directly to the air) of toxic gas;

Release of toxic gas in enclosures (passive mitigation); and

Release of liquefied refrigerated toxic gases in diked areas, including consideration of the duration of

the release.

Regarding toxic liquids, the pool evaporation rate needs to be calculated, taking into account the dike characteristics

if a dike is considered. USEPA (2009) provides detailed guidelines on estimating worst case toxic liquid release

rates in the following situations:

Release of toxic liquid from a broken pipe;

Release of a toxic liquid evaporating from a pool with no mitigation (no dikes or enclosures),

including:

- Releases at ambient temperature (25°C);

- Releases at elevated temperature;

- Estimation of the duration of the release.

Release of a toxic liquid evaporating from a pool with passive mitigation, including:

- Releases in diked areas;

- Releases into other types of containment;

30


- Releases into buildings.

Release of mixtures containing toxic liquids;

Method to correct the estimated release rate for liquids released at temperatures between 25°C and

50°C.

Height of release and hole characteristics

The elevation of the source is another parameter influencing the consequences of a release of a hazardous

substance. Sources are classed as ground level or elevated. Most hazardous escapes are treated as ground level

sources. Stacks are the principal elevated sources.

USEPA (2009) suggests a ground level release to model the dangerous phenomena in the worst conditions.

Finally, since the worst case scenario generally considers the complete rupture of the largest tank or pipe, the

characteristics of the hole are out of scope in the context of the Article 4 assessment methodology.

Other parameters

In the case of a jet fire, a horizontal ejection angle is usually the most penalising. Moreover, if the ejection speed

increases, so do the length of the jet fire and the thermal effect distances. In the case of a fire, the higher the

emittance of the flame, the higher the thermal effect distances are. The correlation is also valid for the flame

height, except for very high flames for which there is no more influence. Also, a pool size increase leads to an

increase in the thermal effect distances.

5.3.2 Environmental conditions

Meteorological conditions

In the case of dangerous phenomena such as toxic gas cloud or flammable gas cloud dispersion, the impact of

meteorological conditions is significant. These types of phenomena only occur in the lower layer of the

atmosphere, known as the atmospheric boundary layer, which is several hundred metres thick (1 to 2 km at the

most). Weather parameters include the following:

Wind speed / atmospheric stability: the atmospheric stability measures the potential turbulence due to

thermal variations (mainly depending on the vertical distributions of temperatures in the atmosphere);

and

Ambient temperature/humidity.

The table below illustrates the impact of the atmosphere stability (left) and wind speed (right) on plume dispersion.

31


Table 5.2 Impact of atmosphere stability and wind speed on plume dispersion

Plume dispersion (profile view) according to atmosphere stability conditions

Plume dispersion according to wind speed

Unstable

Wind speed: 3 m/s

Neutral

Wind speed: 5 m/s

Stable

Wind speed: 10 m/s

Source: Lees, 1996


For ground dispersion, stable atmospheric condition associated with low wind speed slows the cloud dilution (the

distance to LFL is increased for a UVCE), and increases the effect distances. In the case of a jet fire, the wind can

incline the flame and then generate higher thermal effect distances.

USEPA (2009) assumes that class F for atmospheric stability (stable atmosphere) and 1.5 m/s for wind speed result

in the largest effect distances for toxic substances. The classification of meteorological conditions is done from the

Pasquill classes, which identify 6 atmospheric stabilities (A to F, from the most unstable atmosphere to the most

stable) and 5 wind speeds (< 2, 2-3, 3-5, 5-6, > 6 m/s). The reference manual BEVI (RIVM, 2009) also suggests

32


the meteorological conditions “F1.5” as the worst conditions. France identifies the conditions “F3” as being

conservative during night and “D5” as being conservative during day.

USEPA (2009) assumes ambient air temperature of 25°C and humidity and 50% as the worst case conditions.

France combines the conditions F3 with an ambient temperature of 15°C and a humidity of 70%.

Topography and obstacles: terrain roughness

Obstacles and topographical features disturb the wind trajectory and modify the characteristics of the air flow. The

size of these modifications is a function of the size and shape of the topographical obstacles encountered by the

wind. When irregularities on the ground are small in relation to the size of the cloud, the disturbances which they

cause do not affect the overall dispersion of the cloud.

The table below gives roughness length values for several surface types. As can be seen, this value is a function of

the size, shape and density of the obstacles covering the ground.

Table 5.3 Roughness classes

Typical sites Length of roughness z0 (m)

Large expanses of water (sea, ocean, lake) from 0.001 to 0.01

Flat countryside, airports (rural1) from 0.01 to 0.10

Slightly developed area, countryside divided into fields from 0.01 to 0.5

Urban2, industrial or forested areas from 0.5 to 1.5

Town centres from 1.5 to 2.5

Source: Couillet, 2002

1: USEPA (2009) has defined rural as no buildings in the immediate area, and the terrain is generally flat and unobstructed.

2: USEPA (2009) has defined urban as many obstacles in the immediate area, where obstacles include buildings or trees.

When a site presents obstacles of the same size as the cloud, a non-uniform ground cover or an irregular

topography, the dispersion mechanisms are more complex and are very specific to the characteristics of the site.

The disturbances caused by the terrain roughness in the wind field are illustrated below, where a 10 inch diameter

hole in a pipe feeding a propane tank of 50 tonnes has been modelled under the meteorological conditions F3, with

different terrain roughness.

33


z0 = 0.18 m

dLFL1 = 370 m & Mfl

2 = 4,900 kg

z0 = 0.95 m

dLFL

1 = 400 m & Mfl2 = 22,300 kg

1: dLFL is the maximum distance at which the Lower Flammability Limit (LFL) of the gas cloud is reached (minimum

concentration at which the gas cloud can ignite in the presence of a source of ignition). 2: Mfl is the mass of flammable substance in the gas cloud that may ignite in the presence of a source of ignition. The higher

the mass, the more severe the consequences are for people and the environment.

As can be seen from the example above, a roughness length multiplied by 5 leads to a flammable mass multiplied

by 4.5 (in this specific situation).


The dilution effect is increased by the obstacles and the toxic effect distances increase in the case of toxic gas cloud

dispersion. In the case of an UVCE, the presence of obstacles increases the cloud turbulence, speeds up the flame

and increases the severity of explosion. Overpressure effect distances are increased.

Higher roughness length increases the friction, thus facilitating dilution, but it slows the wind speed near the

ground (antagonistic effects). Mostly, higher roughness length decreases toxic effect distances. In the case of a

UVCE, higher roughness length decreases the distance to LFL but increases the flammable mass.

The hypothesis of an ideally flat terrain of uniform roughness, with a non-absorbing surface, is generally

representative of the worst conditions when a spill of liquid is under consideration (USEPA, 2009). When air

dispersion of toxic gases or explosions or fires caused by flammable substances are of concern, the dangerous

phenomena should be modelled considering various surface roughness values and the one leading to the highest

effect distances should be selected.

5.3.3 Important parameters according to the type of dangerous phenomenon

Explanations about the dangerous phenomena mentioned in this section are provided in Task 2. The purpose of

this section is to highlight, for each dangerous phenomenon, the important parameters to consider. These

parameters have been presented in Sections 5.3.1 and 5.3.2 and guidance regarding their use in the worst case

conditions has been provided.

Atmospheric dispersion of a toxic cloud

The table below summarises the source term conditions and the environmental conditions that influence an

atmospheric dispersion of a toxic cloud.

34


Table 5.4 Important parameters affecting atmospheric dispersion of a toxic cloud under a worst case scenario

Physical parameter Note

Source term

Substance

Acute toxicity All other things remaining equal, the lower the concentrations the higher the effect distances are.

Density

Light gases (density < air density) will tend to rise and have a negligible impact on a ground level target. Heavy gases (density > air density) will collapse on the ground (remaining highly concentrated) and will then dilute and behave as passive gases (density close to air density). Most of the toxic gases used in industry are heavy gases.

Release

Instantaneous release [kg] Only the mass released is to be considered.

Continuous release

Mass rate [kg/s] Mass rate is an important parameter.

Duration [s] Duration of the release is very important since it influences the residence time of the cloud at a specific location (as a first approximation, the residence time of the cloud is assimilated to the duration of the release).

Environmental conditions


For simple tools, 2 parameters :

Wind speed [m/s]

Atmospheric stability

High wind speeds are incompatible with stable atmospheric conditions.

Unfavourable conditions: F3

Topography and terrain roughness

Topography The assumption is that the spill takes place on a flat surface.

Terrain roughness The roughness length [m] of a surface reflects the nature of the surface: values comprised between 0.1m and 1m are currently used.

35


Unconfined Vapour Cloud Explosion (UVCE)

The table below summarises the source term conditions and the environmental conditions that influence the impact

of a UVCE.

Table 5.5 Important parameters influencing a UVCE under a worst case scenario


Source term

Substance

Lower Flammability Limit The LFL is the minimum concentration below which no explosion can occur (i.e. not enough gas). The lower the LFL, the higher the flammable mass is and the higher the effect distances are.

Upper Flammability Limit The UFL is the maximum concentration above which no explosion can occur (i.e. not enough air). The higher the UFL, the higher the flammable mass. Impact on effect distances is negligible since in an unconfined area the UFL is not reached.

Heat of combustion [J/kg] The heat of combustion is the energy liberated in case of gas ignition. The higher the heat of combustion, the higher the effect distances are.

Density Light gases (density < air density) will tend to rise not to form flammable drifting clouds. Heavy gases (density > air density) will collapse on the ground (remaining highly concentrated) and will then dilute and behave as passive gases (density close to air density). Most of the toxic gases used in industry are heavy gases.

Quantity released

Instantaneous release [kg] Only the mass released is to be considered.

Continuous release [kg/s] Mass rate is an important parameter.



For simple tools, 2 parameters :

Wind speed [m/s]

Atmospheric stability

High wind speeds are incompatible with stable atmospheric conditions.

Unfavourable conditions: F3 for horizontal releases close to the ground. Other meteorological conditions may be more penalizing in the case of elevated releases.

Topography and terrain roughness

Topography The assumption is that the spill takes place on a flat surface.

Terrain roughness The roughness length [m] of a surface reflects the nature of the surface: values comprised between 0.1m and 1m are currently used.

Obstacles The presence of obstacles increases the violence of the explosion.

36


Boiling Liquid Expanding Vapour Explosion (BLEVE)

The table below summarises the source term conditions that influence the impact of a BLEVE.

Table 5.6 Important parameters influencing a BLEVE under a worst case scenario


Source term

Substance Most of the time: liquefied petroleum gases (e.g. propane and butane)

Quantity (mass of stored substance)

The most important parameters :

Containment volume

Filling ratio

Density of the substance

Burst pressure of containment Burst pressure depends on numerous parameters (e.g. material, thickness, etc.).

Some orders of magnitude for burst pressures:

Container Butane Propane

Truck 25 bar 25 bar

Wagon 27 bar 27 bar

Fix installation 7.5 bar 17 bar

The higher the bursting pressure the higher thermal effect distances are (the impact of a difference of 1 or 2 bar is negligible).

37


Classic boil-over

The table below summarises the source term conditions that influence the impact of a classic boil over.

Table 5.7 Important parameters influencing a classic boil-over under a worst case scenario


Source term

Substance Viscous liquid hydrocarbon (e.g. fuel oil)

Quantity (mass of stored substance)

The most important parameters :

Containment volume

Density of the substance

Height of liquid in the tank If the height of the liquid in the tank increases, the time of occurrence of the boil-over increases.

Maximising the height of the liquid in the tank is restrictive in terms of thermal effect distances but can mislead the emergency services (i.e. if the occurrence time is over-estimated, then there may not be enough time for the evacuation of people.

Jet fire

The table below summarises the source term conditions and the environmental conditions that influence the impact

of a jet fire.

Table 5.8 Important parameters influencing a jet fire under a worst case scenario


Source term

Substance Heat of combustion [J/kg]

The heat of combustion is the energy liberated in case of gas ignition. The higher the heat of combustion, the higher the effect distances are.

Release

Mass rate [kg/s] Mass rate is an important and sensitive parameter.

Ejection angle There is no specific ejection angle, apart from the light gases which tend to generate a vertical jet fire.

Ejection speed [m/s]

The ejection speed influences the length of the jet fire.



Wind The wind may influence the ejection angle of the jet fire.

38


Fire/ pool fire

The table below summarises the source term conditions that influence the impact of a fire/pool fire.

Table 5.9 Important parameters influencing a fire/pool fire under a worst case scenario


Source term

Substance

Surface combustion rate [kg.s/m²]

The surface combustion rate is the combustion rate per unit of surface of combustible. It influences the height of the flames and their emittance. If the combustion rate increases, the thermal effect distances increase.

Heat of combustion [J/kg]

The heat of combustion is the energy liberated in case of gas ignition. The higher the heat of combustion, the higher the effect distances are.

Pool Surface [m²] This parameter is determinant since it will linearly impact the intensity of the fire.

Flame Emittance [W/m²] The emittance of a flame characterises the radiation intensity. It depends on numerous parameters (e.g. pool size, flame height).

Geometry Usually, flames are likened to a simple geometric form (e.g. cylindrical or wall of flame type).

Height [m] The flame height is a very important parameter but tough to estimate. The most well-known correlation that enables to estimate the flame height is the THOMAS correlation.

39


5.3.4 Synthesis

As highlighted in the previous sections, some important parameters are needed in order to assess an accident scenario.

These parameters are about:

The conditions of the release: characterisation of the source term;

The conditions at the site at the time of the release: characterisation of the environment.

The elements previously put forward are reminded in the figure below.

Figure 5.5 Synthesis of important parameters

Source term

•Released substance: temperature, pressure , amount entering environment;

•Type of release (instantaneous, continuous), and/or release rate and duration of the release;

•Height of the source.

Environment

•Meteorological conditions;

•Topography and obstacles.

Endpoints

•Toxicity level

•Thermal radiation

•Overpressure level

• Task 6 summarises values

40


6. General conclusion

This report presents steps for identifying accident scenarios and a set of minimum conditions and parameters to be

taken into account which should allow an EU wide implementation of an assessment under Article 4. It provides

information on the potential accidents that could be created by a substance under the assessment methodology. It

also provides guidance on:

The choice of one or more “reference accident scenarios”. The choice depends on the type of

substance concerned and the type of equipment used. These reference scenarios should be the

“worst case scenarios” for the substance under assessment, for example the full release of matter or

energy due to catastrophic rupture of a tank.

The choice of certain conditions that need to be fed into the accident scenarios in order to assess the

consequences of the scenarios, as well as their intensities. For example meteorological conditions,

quantities of substance involved and operating conditions are all susceptible to significant

variations across the EU.

However, the present report does not aim to define a full set of worst case scenarios that would be suitable for all

potentially relevant substances under Article 4, under all present and future operating and environmental conditions

in Europe. Nevertheless, the suggested approach is generic enough to be applied to the different types of

equipment likely to be encountered in different types of hazardous plants, since the assessment methodology is

meant to be delivered at European scale. Furthermore, it is flexible and relevant for most of the expected situations

at present and in the future.

Guidance provided in the present task is not prescriptive and mainly consists of suggestions on how to define and

characterise accident scenarios in the context of Article 4. Those persons undertaking an assessment under Article 4

could decide to adopt alternative approaches where they are better suited to the particular case or substance under

consideration. In the end, a third-party review should be undertaken to support the accident scenarios identified and

the modelling parameters chosen.

The figure below provides a global synthesis of the worst case scenario approach considered here in the context of

the assessment methodology under Article 4 of the Seveso III Directive.

41


Figure 6.1 Synthesis of the worst case scenario definition and modelling approach

The outcome of the identification of relevant worst case scenarios for an Article 4 candidate substance (taking into

account considerations in Task 5) could lead to the conclusion that modelling or other more detailed assessment is

required. This is covered in the reports on Tasks 2 and 3.

However, it may also become evident that there are no credible accident scenarios that could foreseeably lead to a

major accident, for example on the basis of the substance properties or the full range of foreseeable operating

conditions (e.g. negligible potential for dispersion). In such cases, there may be no need to undertake more detailed

modelling and assessment of the consequences of potential accidents. The assessor would therefore need to compile

42


the evidence and detail the scenarios considered (and discarded) in putting forward their notification for proposed

exclusion.

43


7. References

ARIA: Analysis, research and information on accidents database, operated by the French Ministry of Ecology,

Sustainable Development and Energy.

Christou M.D and Porter S, 1999, Guidance on land use planning as required by Council Directive 96/82/EC (Seveso

II), Institute for systems informatics and safety.

Couillet JC, 2002, Méthodes pour l’évaluation et la prévention des risques accidentels – Dispersion atmosphérique :

mécanismes et outils de calcul, INERIS report, OMEGA 12.

Delvosalle C, Fiévez C and Pipart A, 2002, MIMAH methodology for the identification of major accident hazards,

WP 1, Draft report version 1, ARAMIS

(Available at http://web-archive-it.com/it/j/jrc.it/2012-10-12_419743_9/ARAMIS_Consortium_composition/)

Delvosalle C, Fiévez C and Pipart A, 2003, Part 2 of Deliverable D.1.A. MOOA - Most Often Observed Accidents

WP 1/A, ARAMIS

(Available at http://web-archive-it.com/it/j/jrc.it/2012-10-12_419743_9/ARAMIS_Consortium_composition/)

Delvosalle C, Fiévez C, Pipart A, Casal Fabrega J, Planas E, Christou M, Mushtaq F, 2005, Identification of reference

accident scenarios in Seveso establishments, Reliability Engineering and System Safety 90 p. 238–246.

DEPPR, 1990, Guide Maîtrise de l’urbanisation autour des sites industriels à haut risque. Secrétariat d’Etat auprès

du Premier Ministre chargé de l’Environnement et de la Prévention des risques technologiques et naturels majeurs.

Service de l’Environnement Industriel.

French Ministry of Environment, October 1990, Guide « Maîtrise de l’urbanisation autour des sites industriels à haut

risque ».

eMars: European Major Accident Reporting System, operated by the Major Accident Hazards Bureau.

Ham J.M, Meulenbrugge J.J, Versloot N.H.A, Dechy N, Lecoze J.C, Salvi O, 2006, A comparison between the

implementations of risk regulations in the Netherlands and France under the framework of the EC Seveso II Directive.

Gyenes S, 2013, Reference scenarios provided by the EU Member States, Power Point, updated version, JRC.

HSE, 2010, HID - Safety Report Assessment Guide: Whisky Maturation Warehouses.

Hubin S, Rasooly E, Hebrard J, Bolvin C, Lenoble C, 2012, Mise à jour de l’outil « risque industriel » de la société

AON France prise en sa branche AON Benfield, INERIS study report, N° DRA-12-123651-05332B.

Johnson B.B, Chess C, 2003, Communicating worst-case scenarios: neighbors’ views of industrial accident

management, Risk Analysis, Vol. 23, No. 4.

44


JRC, 2005, Guidance on the preparation of a safety report to meet the requirements of Directive 96/82/EC as amended

by Directive 2003/105/EC (Seveso II). Institute for the Protection and Security of the Citizen – Major Accident

Hazards Bureau. Report EUR 22113 EN.

JRC, 2008, Overview of Roadmaps For Land-Use Planning In Selected Member States.

Kirchsteiger C, 1999, On the use of probabilistic and deterministic methods in risk analysis. In Journal of Loss

Prevention in the Process Industries, vol. 12 pp. 399-419.

Lees FP, 1996, Loss Prevention in the Process Industries – Hazard Identification, Assessment and Control, Second

Edition, Volume 1.

Lenoble C, Durand C, 2011, Introduction of frequency in France following the AZF accident. In Journal of Loss

Prevention in the Process Industries, vol. 24 pp. 227-236.

Liovin A, 2007, Systematization of international knowledge concerning “worst case scenario” approach. General

guidelines for application of the approach in purposes of industrial safety, Master of Science Thesis, Royal Institute

of Technology, Stockholm.

Mizuta Y, Nakagawa M, 2013, Development of Quantitative Hazard Analysis Method for Inherently Safer Chemical

Processes, Chemical Engineering Transactions, Vol.31

Paltrinieri N, Tugnoli A, Buston J, Wardman M, Cozzani V, 2013, DyPASI Methodology: from Information

Retrieval to Integration of HAZID Process, Chemical Engineering Transactions, Vol. 32.

Paltrinieri N, Tugnoli A, Bonvicini S, Cozzani V, Atypical Scenarios Identification by the DyPASI Procedure:

Application to LNG. Available at [http://www.aidic.it/icheap10/webpapers/401Paltrinieri.pdf]

RIVM, 1996, Methods for the calculation of physical effects due to releases of hazardous materials (liquids and

gases) – Yellow Book, CPR 14E.

RIVM, 2009, Reference Manual Bevi Risk Assessments. Version 3.2.

UNECE Convention on the Transboundary Effects of Industrial Accidents, 2012, Follow-up to the training session

on evaluation of safety reports and joint inspection for Croatia, Serbia and the former Yugoslav Republic of

Macedonia. Final Report.

USEPA, 2009, Risk Management Program Guidance for Offsite Consequence Analysis, Office of Solid Waste and

Emergency Response.

WEC, 2012, Preventing Chemical Accidents - Introduction to Process Hazard Analysis, Process Safety Management

Training from the NJ Work Environment Council, 1st Edition.


Appendices

Appendix A Substance hazard categories and dangerous phenomena

Appendix B Example of application of the MIMAH

A1

December 2014

Appendix A: Substance hazard categories and

dangerous phenomena

A2

December 2014

1. Introduction

The objective of the Methodology for Identification of Major Accident Hazards (MIMAH) developed by the

European project ARAMIS is to define a method allowing an accident scenario to be built on the basis of three data

points: the equipment type, the hazardous properties of the substance and its physical form. A systematic method to

build an event tree has been developed. The approach chosen consists of defining logical links, on the one hand

between critical events and secondary events, and on the other hand between secondary critical events and dangerous

phenomena. This is done by the way of matrices, and the result obtained is a tree giving the possible accident

scenarios for each critical event studied.

The last step of the methodology consists of a selection of the dangerous phenomena that may be generated

depending on the hazardous categories of the substance. This selection will lead to the deletion of some branches of

the event tree. For example, for flammable gases, typical accidents include jet fire, pool fire, vapour cloud explosion,

boiling liquid expanding vapour explosion, etc. Other types of dangerous phenomena that may have been identified

can then be deleted.

These links between the hazard categories of the substance and the dangerous phenomena that can be generated are

supported by a qualitative study of accident scenarios that have occurred in past events by help of the eMars

database. The presentation of this study, which does not aim at being of any statistical value, is the topic of this

Appendix.

A3

December 2014

2. Qualitative study

MIMAH identified, for each hazard category, the dangerous phenomena likely to be encountered. Examples listed in

the table below highlight relevant dangerous phenomena (non-exhaustive) that can be generated further to an accident

involving a substance according to the hazard category of that substance. The list is not exhaustive and comes from

the European Commission’s service request to introduce the need for the development of the assessment

methodology.

Table 2.1 Hazard category and relevant dangerous phenomena

Hazard categories in Annex I of the Seveso III Directive Typical accidents

Section ‘H’ – HEALTH HAZARDS (H1, H2, H3) Toxic release in the air, soils, water (including underwater) – (liquid, gas, powder)

Section ‘P’ - PHYSICAL HAZARDS: P1a, P1b (explosives) Explosions, fire

Section ‘P’ - PHYSICAL HAZARDS: P2 (flammable gases) BLEVE, jet fire, VCE, flash fire, pool fire

Section ‘P’ - PHYSICAL HAZARDS: P3a, P3b (flammable aerosols) Explosions, BLEVE, fire

Section ‘P’ - PHYSICAL HAZARDS: P5a, P5b, P5c (flammable liquids)

Pool fire, VCE, flash fire, boil-over

Section ‘P’ - PHYSICAL HAZARDS: P4, P8 (oxidizing gases, liquids and solids)

Pneumatic rupture, fire and possible domino effects

Section ‘P’ - PHYSICAL HAZARDS: P6a, P6b (Self-reactive substances and mixtures and organic peroxides)

Explosion, fire and toxic releases

Section ‘P’ - PHYSICAL HAZARDS: P7 (Pyrophoric liquids and solids)

Fire

Section ‘E’ – ENVIRONMENTAL HAZARDS: E1 and E2 Toxic release in the air, soils, water (including underwater) – (liquid, gas)

Section ‘O’ – OTHER HAZARDS - O1 Substances or mixtures with hazard statement EUH014

Explosions

Section ‘O’ – OTHER HAZARDS - O2 Substances and mixtures which in contact with water emit flammable gases, Category 1

VCE, Flash fire pool fire

Section ‘O’ – OTHER HAZARDS -O3 Substances or mixtures with hazard statement EUH029

Toxic release in the air (gas)

The qualitative study of the past accident scenarios considered in this Appendix supports the elements present in

the above table. It relies on the analysis of some accident scenarios reported in the eMARS database.

It should be underlined that the types of dangerous phenomena involved do not only depend on the substance

properties but also on the conditions of use. For example, the release potential of a toxic substance is particularly

influenced (but not solely) by vapour pressure, although some gases with low vapour pressure may also have this

release potential as they are stored under pressure (e.g., ammonia). In order to keep in mind that not only the

substance inherent properties are of importance but also the context in which the accident occurred, the qualitative

study conducted in this Appendix gives some contextual elements. Providing contextual pieces of information are

A4

December 2014

one of the strengths of accident databases.

While the table below highlights dangerous phenomena produced in relation to specific substances, the database can

similarly be a resource for risk analysis ensuring that credible contextual elements have been considered in scenario

selection. In particular, accident databases give evidence of typical failure scenarios associated with specific industry

sectors (e.g. warehouses), processes (e.g. loading and unloading) and equipment (e.g. heat exchangers), and

potentially other scenario elements (e.g. weather). In this way, accident databases can help to verify and improve

scenario selection, by identifying circumstances, events and technical parameters of specific relevance in a particular

use context. Also, accident databases highlight the fact that similar substances (e.g. under the same physical form

and having similar inherent properties) may have different behaviours in case of an accident. For instance, two toxic

substances involved in an accident can behave very differently and generate different types of dangerous phenomena.

The conditions of the release are again of great importance.

With these limitations in mind, a list of accidents has been drawn (date and descriptive title), together with the

dangerous phenomena generated, the key substances involved and their hazard categories. As mentioned previously,

the aim is to highlight the different types of dangerous phenomena generated, according to the type of hazard

categories of the substances involved, taking into account some contextual elements. The list of cases does not include

those accidents where many substances are involved.

A5

December 2014

Date Descriptive title Dangerous Phenomena generated Key substances involved Hazard categories (from CLP)

08/05/1991 Release of ammonia in a food additives plant

gas/vapour/mist/etc. release to air Ammonia (CAS No: 7664-41-7)

Flammable gas Acute toxic Skin corrosive Acute toxic for aquatic life

11/07/2009 Release of substances and fire in an electroplating plant

gas/vapour/mist/etc. release to air fire

Chromium trioxide Oxidising CMR Acute toxic Skin corrosive Acute/chronic toxic for aquatic life

28/09/2005 Explosion in a general chemicals manufacture

gas/vapour/mist/etc. release to air fluid release to ground pool fire pressure burst

Ethylene chlorohydrin Acute toxic

13/06/2010 Explosion of an oxygen pipe gas/vapour/mist/etc. release to air Oxygen Oxidising

08/09/1998 Release of hydrogen peroxide in a general chemicals manufacture

fluid release to ground Hydrogen peroxide (CAS No: 7722-84-1)

Oxidising Acute toxic Skin corrosive

05/12/1991 Explosion in a nitrocellulose centrifugal machine

VCE Nitrocellulose (CAS No: 9004-70-0)

Flammable Explosive

26/02/1991 Burning of naphtha vapours Pool fire Naphtha (CAS No: 8030-30-6)

Carcinogen Toxic if swallowed or aspired

29/03/1988 Explosion of a dryer in a production and storage facility of pesticides, biocides, fungicides

Flash fire Dust explosion

Acetone (CAS No: 67-64-1)

Flammable Specific Target Organ Toxic (Single Exposure)

25/05/1994 Explosion in a wholesale and retail storage and distribution facility (excluding LPG)

Fireball (burning mass rising in air, often after BLEVE)

Propane (CAS No: 74-98-6)

Flammable

22/03/2002 Explosion in a high pressure (3000 bar) production line for low density polyethylene during the start-up of the line

gas/vapour/mist/etc. release to air jet flame (burning jet of fluid from orifice) runaway reaction explosion explosive decomposition

Ethylene (CAS No: 74-85-1)

Flammable Specific Target Organ Toxic (Single Exposure)

12/05/2009 Leak of sodium hypochlorite Fluid release to ground and water Sodium hypochlorite Skin corrosive Acute toxic for aquatic life

A6

December 2014

Date Descriptive title Dangerous Phenomena generated Key substances involved Hazard categories (from CLP)

15/07/1980 Explosion during the start-up of a general chemicals facility

gas/vapour/mist/etc. release to air VCE

Hexane (CAS No: 110-54-3)

Flammable Reprotoxic Toxic if swallowed or aspired Skin irritant Specific Target Organ Toxic (Single and Repeated Exposure) Chronic toxic for aquatic life

24/05/2011 Loss of containment of 100 kg of piperidine

Fluid release to ground Piperidine (CAS No: 110-89-4)

Flammable Acute toxic Skin corrosive

16/01/2002 Hydrogen sulphide leak from pipe at paper mill

gas/vapour/mist/etc. release to air Hydrogen sulphide (CAS No: 7783-06-4)

Flammable Acute toxic Acute toxic for aquatic life

04/03/2010 Explosion of a container during pumping of waste water

Pressure burst Explosive decomposition

Methylethylketone peroxide Explosive Oxidising Acute toxic

A7

December 2014

3. References

eMars Database – Consulted in November 2014

Informal discussions with Maureen Wood (JRC) in November 2014

B1

December 2014

Appendix B: Example of application of MIMAH

B2

December 2014

1. Introduction

The Methodology for Identification of Major Accident Hazards (MIMAH) has been developed in the context of the

European project ARAMIS. As a reminder, the objective of MIMAH is to define the maximum hazardous potential

of an installation by predicting which major accidents could potentially occur on given equipment, without

preconceptions on occurrence probability.

The methodology enables generic event trees to be built based on the equipment type, the hazardous properties of

the substance and its physical form. Links are made between these three data points and critical events that may

occur. These critical events are linked to secondary and tertiary events, leading to dangerous phenomena that may be

generated. This process is done through matrices developed in the context of the ARAMIS project. The approach is

illustrated in Figure 1-1.

Figure 1-1: Steps followed by MIMAH (part “event tree”)

Source: (Delevosalle, 2005)

This appendix provides an example of the application of MIMAH for a storage vessel containing methyl alcohol.

This example is extracted from (Delevosalle, 2005).

B3

December 2014

2. Building the event tree

2.1 Step 1: Link between physical form of substance and equipment typology

Table 2.1 enables relevant equipment to be chosen for a given substance which is handled under a specific physical

form.

Table 2.1 Link between substance state and equipment type

In this example, the equipment type considered is “atmospheric storage” and the physical form of the substance is

“liquid”. Table 2.1 indicates that this association is compatible.

2.2 Step 2: Link between 1) equipment typology and critical event, 2) physical form of substance and critical event

Table 2.2 indicates, for each equipment typology, which critical events may be expected and Table 2.3 indicates the

critical events compatible with each physical form of a substance that may be encountered. These tables enable one

to choose relevant critical events based on the equipment type and physical form of the substance.

B4

December 2014

Table 2.2 Link between equipment type and critical event

Table 2.3 Link between substance physical form and critical event

Based on these two tables, critical events that could occur on atmospheric storage and those likely to occur with a

substance in liquid form are summarized in Table 2.4.

B5

December 2014

Table 2.4 Critical events retained

An event tree must be built for each critical event retained. For example, the event tree related to the critical event

“leak from liquid pipe” will be explained.

2.3 Step 3: Link between critical event – physical form of substance - secondary critical event

The combination of the physical form of the substance and the critical event studied is used to choose relevant

secondary critical events, according to the matrix presented in Table 2.5.

B6

December 2014

Table 2.5 Link between critical event and secondary critical event

For the example under consideration, it can be seen that the secondary critical event “pool formation” is relevant.

B7

December 2014

2.4 Step 4: Link between secondary critical event – tertiary critical event – dangerous phenomenon

Finally, Table 2.6and Table 2.7respectively link secondary critical events with tertiary critical events and tertiary

critical events with dangerous phenomenon, in order to choose relevant dangerous phenomena that may be

generated.

Table 2.6 Link between secondary critical event and tertiary critical event

Table 2.7 Link between tertiary critical event and dangerous phenomenon

For the example under consideration, the tertiary critical events “pool ignited”, “gas dispersion”, and “pool not

ignited/pool dispersion” are to be considered. Dangerous phenomena that may result from these events are:

B8

December 2014

For “pool ignited”: “poolfire”, “toxic cloud”, and “environmental damage”;

For “gas dispersion”: “vapour cloud explosion”, “flashfire”, “toxic cloud”, and “environmental damage”;

For “pool not ignited/pool dispersion”: “environmental damage”.

The event tree presented in Figure 2.1is finally obtained. With the same analysis, event trees can be built for every

critical event selected.

Figure 2.1 Event tree for the CE "leak from liquid pipe"

2.5 Step 5: Link between dangerous phenomenon and hazardous properties of the substance

The final step suggested by ARAMIS consists of using the inherent properties of the substance to select the most

appropriate dangerous phenomena. The links existing between the hazard categories of a substance and the dangerous

phenomena that may be generated further to an accident involving the substance are clarified in Appendix A and

justified through an historical analysis of accidents. Moreover, some additional conditions regarding tertiary critical

events may influence the dangerous phenomena created. An example of these conditions is given in Table 2.8.

B9

December 2014

Table 2.8 Selection of dangerous phenomena based on additional conditions

As a result, some branches of the event tree may be deleted using the links between the substance inherent properties

and the dangerous phenomena as well as these additional conditions.

Note that the substance typology used in the MIMAH approach is based on the hazard categories of the Seveso II

Directive, coupled with a specific selection of risk phrases defined in Directive 67/548/EEC (Council Directive of

27 June 1967 on the approximation of laws, regulations and administrative provisions relating to the classification,

packaging and labelling of dangerous substances) and in Directive 1999/45/EC (Council Directive of 31 May 1999

concerning the approximation of the laws, regulations and administrative provisions of the Member States relating

to the classification, packaging and labelling of dangerous preparations). These two Directives have been replaced

by Regulation (EC) No 1272/2008 of the European Parliament and of the Council of 16 December 2008 on

classification, labelling and packaging of substances and mixtures, which implements within the Union the Globally

Harmonised System of Classification and Labelling of Chemicals that has been adopted at international level, under

the auspices of the United Nations (UN). That Regulation introduces new hazard classes and categories. As a result,

the approach suggested in the MIMAH should be adapted to the new Regulation (as illustrated in the example below).

Hazard categories of methyl alcohol are the following: Acute Tox. 3 (Inhalation:vapour) H331, Acute Tox. 3

(Dermal) H311, Acute Tox. 3 (Oral) H301, STOT SE 1 H370, and Flam. Liq. 2. Mehtanol is then classified according

to its high flammability and toxicity. These hazard categories combined with additional conditions (see example in

Table 2.8) lead to the revised event tree in Figure 2.2.

Figure 2.2 Event tree for the CE "leak from liquid pipe" taking into account inherent properties of the substance

B10

December 2014

3. References

Delvosalle C, Fiévez C, Pipart A, Casal Fabrega J, Planas E, Christou M, Mushtaq F, 2005, Identification of

reference accident scenarios in SEVESO establishments, Reliability Engineering and System Safety 90 p. 238–246.

Final report Annex 4: Accident scenarios, conditions and ... · Final report Annex 4: Accident...

Documents

Transcript of Final report Annex 4: Accident scenarios, conditions and ... · Final report Annex 4: Accident...