IChemE SYMPOSIUM SERIES NO. 153 # 2007 IChemE

QRA’S FOR DUTCH INSTALLATIONS. I. NEW DUTCH RISK REGULATIONS AND RISKMETHODOLOGY BY THE NEW PURPLE BOOK

Paul Uijt de Haag

Centre for External Safety, RIVM, P.O. Box 1, 3720 BA Bilthoven, the Netherlands;

e-mail: paul.uijt.de.haag@rivm.nl

In the Netherlands, quantified risk criteria are used in the land use planning around sites with hazar-

dous substances. Recently the risk criteria were translated into environmental quality requirements

which now have force of law. The legal status of the risk criteria demands the risk calculations to be

robust and transparent. It is therefore decided in the Netherlands to enforce the use of one specific

risk computer model for all QRA studies related to these risk criteria. The computer program

SAFETI-NL is selected. Also the Guideline for QRA calculations is rewritten and made more

robust. This paper describes the changes in the QRA calculations in the Netherlands including

the new guideline for quantitative risk assessment. An accompanying paper (Witlox, 2007) pro-

vides an overview of the associated software tool SAFETI-NL.

KEYWORDS: QRA, risk regulation, risk analysis, guideline, purple book, legislation

INTRODUCTIONThe EU’s Seveso II Directive demands that the preventionof major accidents involving dangerous substances and thelimiting of the consequences should be taken into accountin the siting of new establishments, modifications to existingestablishments or new developments in the vicinity of exist-ing establishments. In the Netherlands, Quantitative RiskAssessment (QRA) is already used for over twenty yearsin decisions on land use planning around sites with danger-ous substances. The quantified criteria needed in thedecision process were presented in various policy docu-ments. Following the Seveso II Directive, the status ofthese criteria is now increased into environmental qualityrequirements which have force of law. The criteria areimplemented in the External Safety Decree for Establish-ments under the Environmental Management Act, whichapplies to Seveso II establishments as well as to a largenumber of other establishments presenting a threat to theirsurroundings. Examples are LPG filling stations, storagedepots of dangerous substances and marshalling yards.The Decree defines two quantities for external safety,namely the location-based risk and the societal risk.

– The location-based risk is the risk to an (unprotected)individual at a specific location, expressed as theprobability in one year of dying as a direct result ofan on-site accident involving dangerous substances.The location-based risk is visualized by risk contourson a map.

– The societal risk gives the relation between the prob-ability and the number of people dying from specifiedhazards, i.e. the probability in one year of a largenumber of deaths. The societal risk is visualized by aFN curve, where F denotes the probability in one yearof an accident with N or more deaths.

The Decree sets the risk criteria for the location-basedrisk. The limit value for the siting of ‘vulnerable’ objects,

1

i.e. objects like dwellings, schools and hospitals, is equalto 1026 per year. This limit value is a minimum value thatshould be achieved by a given date (1 January 2010) andshould be maintained thereafter. For the so-called ‘less vul-nerable’ objects, e.g. objects like offices with fewer than 50people, not a limit value, but a target value of 1026 per yearis defined. A target value should be achieved as far as poss-ible and may only be exceeded when there are compellingreasons to do so. For the societal risk, no risk criteria aredefined, but only values for orientation (a probability ofless than 1025 per year for an accident with 10 or moredeaths, less than 1027 per year for an accident with 100 ormore deaths and less than 1029 per year for an accidentwith 1000 or more deaths). However, the societal riskshould be taken into account in the decision process onenvironmental licenses and land use planning. The compe-tent authorities must account for the effect of an increasedsocietal risk, and can e.g. include the ability of the popu-lation to protect itself or emergency response plans.

Having a long history of the use of QRA calculationsin land use planning, the method to do a QRA calculation inthe Netherlands is standardized to a large extent in the so-called ‘coloured books’. Especially noteworthy are theYellow Book (Committee for the Prevention of Disasters,2005) describing the models to calculate the outflow anddispersion of substances and physical effects of fires andexplosions, and the Purple Book (Committee for the Preven-tion of Disasters, 1999), establishing the starting points andbasic assumptions like the scenarios and the failure frequen-cies. Consultants have developed their models along thelines of the Yellow Book and risk calculations are done fol-lowing the principles of the Purple Book. Although herebystandardization of the QRA method was reached to someextent, deviations do occur for several reasons. For instance,the Yellow Book describes separate models for outflow ofmaterial and the atmospheric dispersion, whereas the inter-face between these models is not extensively detailed

0

500

1000

1500

1.0E-08 1.0E-07 1.0E-06 1.0E-05

location-based risk (per annum)

dis

tan

ce (

m)

0

1000

2000

3000

4000

5000

1.0E-08 1.0E-07 1.0E-06 1.0E-05

location-based risk (per annum)

dis

tan

ce (

m)

Figure 1. Results of the benchmark of five QRA models, showing the distance to the location-based risk for the whole hypothetical

site (left) and the storage of acrylonitrile only (right). The limit value for the location-based risk is set to 1.0E-06 per annum

IChemE SYMPOSIUM SERIES NO. 153 # 2007 IChemE

leaving the possibility of different implementations in com-puter programs. Furthermore, the use of equivalent or bettermodels than the models described in the Yellow Book isaccepted.

In order to gain insight into the use of different QRAcalculations in relation to land use planning, a benchmarkstudy was set up (Ale, 2001). In this study, different consult-ants used their computer models to do a QRA calculation fora hypothetical site following the method described in thePurple Book. The hypothetical site included a number ofdifferent installations covering all modelling aspects.

It appeared that large differences exist between thedifferent QRA calculations. Figure 1 shows that for a storagesite of acrylonitrile, the limit value for location-based riskmay vary between 50 metres and 700 metres, depending onthe consultant and the computer model used. As the limitvalue for the location-based risk has now force of law,there is an urgent need for the QRA calculation to be robust.

Analysis of the benchmark study revealed that thedifferences observed can be attributed partly to differencesin interpretation of the site description and of the Purplebook, partly to differences in the computer models used.Therefore, the Dutch government decided to select onespecific computer model for all QRA calculations for estab-lishments that fall within the scope of the External SafetyDecree for Establishments. This model, SAFETI-NL, wasselected following a European tender procedure and isdescribed in the accompanying paper. Furthermore, thePurple Book is rewritten to remove any ambiguities and toprovide specific guidelines in the use of the computermodel SAFETI-NL.

NEW GUIDELINE FOR QUANTITATIVE RISK

ASSESSMENTThe new guideline for quantitative risk assessment, the so-called ‘Guideline Risk Calculation BEVI’, describes thestandard method to do a QRA calculation in the

2

Netherlands. It is largely based on the Purple Book. Theguideline is organised in the way a QRA calculationshould be performed. First, the installations that contributesignificantly to the risk of the establishment are selected.Next, for each installation the loss of containment eventsare defined and the associated failure frequencies. The fol-lowing chapters describe the modelling of mitigatingmeasures, the input data like population and ignitionsources, and finally the input parameters. The guideline iscompleted with a chapter on the documentation needed fora review of the QRA calculations. In this section an over-view of the new guideline is presented, highlighting thechanges with respect to the Purple Book.

SELECTION METHODSince the total number of installations in an establishmentcan be very large, and since not all installations contributesignificantly to the risk, it is not worthwhile to include allinstallations in the QRA. Therefore a selection method isused to indicate the installations that contribute most tothe risk and will have to be considered in the QRA. Theselection method is outlined in Figure 2.

The selection method in the Purple Book was based ona comparison of the relative contributions of installations tothe external risk of the site and was intended only for estab-lishments having large numbers of separate installations (the‘selection route’). Since the guideline now applies to bothsmall and large establishments, two paths are distinguishedin the selection process, the effect route and the selectionroute. One starts with the effect route, possibly followed bythe selection route. The different steps are:

1. The establishment is divided into a number of separateinstallations. Installations are considered separate if lossof containment of one installation does not lead to therelease of significant amounts of substances fromother installations, i.e. if they can be isolated in a veryshort time following an accident.

start

Divide site into separate installations

Determine effect distance E

E > T ?

Selection > 5

Selectedinstallations

for QRA

Calculate intrinsic hazard of installation, A

A > 1? Not in QRA

Select a point on site boundary

Calculate hazard onsite boundary point, S

S > 1?

Select installationswith highest valuesof S

NOT in QRA

yes

yes

yes

yes

yes

no

no

no

no

Effect route Selection route

Determine distance tosite boundary, T

Selection of installationswith external risk

Figure 2. Selection of installations with hazardous substances for the QRA calculation

IChemE SYMPOSIUM SERIES NO. 153 # 2007 IChemE

2. For all installations the largest effect distance is calcu-lated, i.e. the largest distance to 1% lethality given arelease of the complete inventory of the installation.

3. If the largest effect distance exceeds the distance to thesite boundary, the installation may present an externalsafety risk and is relevant for the QRA calculation.

4. If the number of installations relevant for the QRA cal-culation is five or less, all relevant installations areincluded in the QRA and no comparison of the relativerisk contributions is done.

5. Only if the number of installations relevant for the QRAcalculation is larger than five, a further selection basedon a relative comparison can be done. In that case theselection is based on the amount of substance presentin an installation, the dangerous properties of the sub-stance, the process conditions and the location of theinstallation relative to the boundary of the establish-ment. The selection route is to a large extent similarto the selection method of the Purple Book. However,the minimum number of installations included in theQRA should be five.

LOSS OF CONTAINMENT EVENTSThe Guideline describes the default set of Loss of Contain-ment events (LoCs) that need to be included in the QRA and

3

their frequencies. The LoCs are described for a number ofinstallations like stationary tanks and vessels, pipes,pumps and loading/unloading of road tankers, tankwagons and ships. With respect to the Purple Book, theset of scenarios and failure frequencies is not changed dueto a lack of well established data. Only the failure frequen-cies for the loading/unloading of ships were corrected, sincethe old data appeared to be erroneously. There is, however,one important difference with the Purple Book. The PurpleBook was intended to calculate the actual risk imposed tothe environment by Seveso II sites. The scope of the Exter-nal Safety Decree for Establishments is related to theenvironmental license of an establishment, thus requiringthe calculation of the licensed risk. The risk calculated fol-lowing the guideline may increase considerably with respectto the ‘Purple Book risk’ in situations where the (old) licensepermits the storage of large quantities of dangerous sub-stances, whereas practically only limited amounts arepresent.

MITIGATING MEASURESThe guideline gives advice on the modelling of a number ofmitigating measures, like a bund, detection in combinationwith blocking valves and the action of operators. Special

Figure 3. Lethality as a function of distance for a hole in a

large storage tank of carbon monoxide at slight overpressure.

Modelling the release in SAFETI-NL with the initial outflow

rate leads to significant higher lethality than modelling the

release with a time-varying outflow rate

IChemE SYMPOSIUM SERIES NO. 153 # 2007 IChemE

attention is given to the mitigating effect of a bund. Variousaccidents, but also experiments (Thyer, 2003), show that abund is not always effective in limiting the spread of theliquid released. It is therefore decided that for an instan-taneous release, the bund area should be multiplied with afactor 1.5 to take account of overtopping of the bund,unless the operator demonstrates that the bund is effective.The increase in bund area is also intended as a trigger to theoperator. In situations where the bund area is a sensitive par-ameter for the risk, measures may be necessary to ascertainthat the bund is effective in containing all liquid released.

INPUT DATAInput data can be distinguished in parameters that are fixedfor all QRA calculations in the scope of the Decree and inputdata that are site specific. Fixed parameters are recorded inthe guideline and preset in the computer model. Examplesare toxicity data for toxic substances and ignition probabil-ities and event tree probabilities for flammable substances.Other parameters depend on the location of the establish-ment, like the population data needed for the calculationof the Societal Risk. The guideline gives directions in theuse of these data in the QRA. For site specific parameters,like the height of the release and the direction of the jetoutflow, default values are given.

The Guideline finally describes the documentationneeded for a good review of the QRA calculation by thecompetent authorities.

MODEL MANAGEMENT AND MODEL

DEVELOPMENTSFollowing the selection of the computer model SAFETI as thebasis of the Dutch model for QRA calculations, the degrees offreedom in the use of SAFETI had to be decided. In principle,the SAFETI computer model allows the user to set all par-ameters and to choose between different effect models.However, when the program is to be used as a robust tool inland use planning decisions, a number of choices had to bemade and preset before providing the model to the user. Inthis process of creating the Dutch version of SAFETI,SAFETI-NL, it had to be decided to what extent choices inthe use of the model were still allowed. There is a trade-offbetween robustness and flexibility.

– A robust calculation can be achieved by presetting allparameter values and using only fixed scenarios. Inthis case, for example, a rupture of a pipeline connectedto a tank would always be modeled as a hole in thebottom of the tank, using the initial outflow rate irrespec-tive of the conditions in the tank. The influence of themodel user is thus minimized, guaranteeing that theQRA results are robust. However, fixing all parameterswould disallow the user to model the specific character-istics of an installation. This may lead to an unwanteddeviation between the actual installation and therepresentation of the installation in the QRA.

– A flexible calculation would allow the user to use thecharacteristics of an installation into the QRA calcu-

4

lation. In this case default values are given, but, ifnecessary, the user may deviate. For the example ofthe rupture of a pipeline connected to a tank, thedefault modeling would be as described above.However, the user may model the release as time-depen-dent with the outflow decreasing in time as the backingpressure decreases – if relevant, well-founded and docu-mented. As shown in Figure 3, the difference in model-ing is significant in case of a large volume storage tankof toxic gas with a low gas pressure.

In the trade-off between robustness and flexibility, itis decided to fix all effect models used, but to allow flexi-bility in a limited set of parameters. Hence, default par-ameter values are recommended, but deviation of thesevalues is possible. It is, however, required that all deviationsare well-founded and documented. To assist the QRAanalyst in the use of the guideline and the computermodel, a help desk with a website is established and usergroup meetings are organized.

Model management requires decisions on incorporat-ing new insights and research results into the model. On onehand, the use of the computer model for land-use planningrequires a ‘frozen’ model that is stable over a long timeperiod. On the other hand, on-going research may lead toan increasing discrepancy between the model and knowl-edge of processes and effects. At some time, discussionwill emerge on the quality of the models used in relationto other models available. Therefore, a model managementprocedure is developed as shown in .

Changes in the computer model or in the guidelinemay be initiated by either the group of model users or a

Model expertsModel users

Modelmanagement

group

Decision group

Accepted changes in guideline and computer model

Figure 4. Structure of the model management

IChemE SYMPOSIUM SERIES NO. 153 # 2007 IChemE

designated group of model experts. The technical modelmanagement group collects and evaluates the ideas formodel improvement. Following a technical investigation, aproposal for model improvement is presented to the decisiongroup. This decision group is formed by the ministriesinvolved. Up to this point, proposals for changes are putforward on a scientific basis. However, apart from the scien-tific merits of the proposal, a decision on the implementationinvolves also a consideration of the consequences in termsof changes in the calculated risk contours and the develop-ment of new land use problems with respect to the risk cri-teria. Consequently, the decision group may prefer not toimplement the change immediately, but to develop animplementation plan with a time frame that will allowland use problems to be taken care of in due time.

This aspect is also eminent for the implementation ofthe guideline and the computer model. At this moment, hun-dreds of establishments have a license to operate, sometimesclose to residential areas. The license is based on a QRAdone previously with one of the models accepted. Asshown in Figure 1, the use of a new model may lead to a sig-nificant increase in the location-based risk. Situations pre-viously considered acceptable by the competent authoritymay after recalculation appear to be unacceptable, althoughno developments on site or in the surroundings have takenplace. Before the obligation to use SAFETI-NL for allQRAs within the scope of the Decree becomes effective,insight in the consequences is therefore needed. Hence fora limited number of establishments, where it is anticipatedthat a small change in risk contours may lead to a need forredevelopment, a comparison is made between the risk con-tours as accepted by the competent authorities and the riskcontour as calculated with SAFETI-NL using the same scen-arios and frequencies. The results show that, especially in

5

cases of toxic liquids, for a number of establishments a sig-nificant increase in risk contours can be expected.

CONCLUSIONSThe legal status of the risk criteria demands the risk calcu-lations to be robust and transparent. The obligation to usethe specific computer model SAFETI-NL for all QRAswithin the scope of the Decree in combination with a newguideline should guarantee this. However, this requiresalso a strict procedure for model management.

REFERENCESAle, B.J.M., Golbach G.A.M., Goos D., Ham K., Janssen

L.A.M., Shield S.R. Benchmark risk analysis models.

RIVM report number 610066015, Bilthoven, 2001.

Committee for the Prevention of Disasters. Methods for the

calculation of physical effects (the ‘Yellow Book’). Third

edition, revised print. The Hague: VROM, 2005. Available

as document number PGS 2 from the website

http:\www.vrom.nl.

Committee for the Prevention of Disasters. Guidelines for

Quantitative Risk Assessment (the ‘Purple Book’). The

Hague: Sdu, 1999. Available as document number PGS 3

from the website http:\www.vrom.nl.

Thyer, A.M., Hirst, I.L., Jagger, S.F. Bund overtopping – the

consequences of catastrophic tank failure. Journal of Loss

Prevention in the Process Industries 15 (2002) 357–363.

Witlox, H.W.M. and Worthington, D.R.W. “QRA’s for Dutch

Installations – II. Overview of risk tool SAFETI-NL

selected by the Dutch Government”. Loss Prevention

symposium, 2007.