Loss Prevention and Safety Promotion in the Process Industries

Loss Prevention and Safety Promotion in the Process industries Proceedings of the 10th International Symposium, 19-21 June 2001, Stockholm, Sweden

Cover photo: R. Ryan

This Page Intentionally Left Blank

Loss Prevention and Safety Promotion in the Process Industries Proceedings of the 10th International Symposium, 19-21 June 2001, Stockholm, Sweden

Edited by H.J. Pasman TNO Delft, The Netherlands 0. Fredholm Association of Swedish Chemical Industries Stockholm, Sweden A. J acobsson AJ Risk Engineering A6 Stenungsund, Sweden

200 1

E LSEVlER

Amsterdam - London - New York - Oxford - Paris - Shannon - Tokyo

ELSEVIER SCIENCE B.V. Sara Burgerhartstraat25 PO.Box 2 11, lo00 AE Amsterdam, The Netherlands 0 2001 Elsevier Science B.V. All rights reserved.

This work is protected under copyright by Elsevier Science, and the following terms and conditions apply to its use: Photocopying Single photocopies of single chapten may be made for personal use as allowed by national copyright laws. Permission of the Publisher and payment of a fee is required for all otber photocopying, including multiple or systematic copying, copying for udvenising or promotional purposes, resale, and all forms of document delivery. Special rates arc available for educational institution5 that wish to inake photocopiesfor non-profit educationalclassroom use. Permissions may be sought directly from Elsevier Science Global Rights Department, PO Box SOO. Oxford OX5 IDX.U K phone: (44)1865 843830. fax: (44)1865 853333. c-mail: [email protected] may also conIact Global Rights directly through Elsevier's home page (ht!p://www.elsevier.nl). by selecting 'Obtaining Permissions'.

In the USA. usen may clear permissions and make payments through the Copyright ClearanceCenter, Inc.. 222 Rowwood Drive. Danven. M A 01923. U S A phone: (+I) (978) 7508400, fax: (+I) (978) 7504744. and in the UK through the Copyright LicensingAgency Rapid ClearanceService (CLARCS), 90Tottenham Court Road, Landon WIP OtP. U K phone: (44)207 63 I 5555; fax: (+44) 207 631 5500. Other countries may have a local reprographic rights agency for payments. Derivative Works Tables of contenb may be reproduced for internal circulation. but permirsion of Elsevier Science is required for external resale or distribution of such material Permission of the Publisher i s required for all other derivative works, including compilations and translations. Electronic Storage or Usage Permission of the Publisher is required to store or use electronically any material contained in this work. including any chapter or pan of a chapter. Except as outlined above, no part of this work may be repmduced, stored in a retrieval system or transmitted in any form or by any means, electronic. mechanical, photocopying. recording or otherwise, without prior written permission of the Publisher. Address permissions requests to: Elsevier Global Rights Department, at the mail. fax and e-mail addresses noted above. Notice No responsibility is assumed by the Publisher for any injury andlor damage to persons or properly as a matter of praducta liahility. negligence or otherwise, or from any use or operation of any methods. products. instructions or ideas contained in the material herein. Because of rapid advance.; in the medical sciences, in particular. independent verification of diagnows and drug dosages should be made.

First edition 2001 Library of Congress Cataloging in Publication Data A catalog record from the Library of Congress has been applied for,

ISBN 0 444 50699 3 @The paper used in this publication meets the requirements of ANSINIS0 239.48-1992 (Permanence of Paper). Printed in The Netherlands.

V

Loss Prevention and Safety Promotion in the Process Industries Proceedings of the 10th InternationalSymposium Stockholm, Sweden, 19-21 June, 2001 Preface Human fate is one of continuous struggle, falling and scrambling up. This is also that of the chemical engineer and Loss Prevention officer and the previous nine symposia are witness to that tragedy. In fact, we had not nine, but ten symposia because the first true international symposium on the subject in the United Kingdom in 1971 was the starting point for the series. An accident is difficult to foresee if the knowledge of its possibility is not available. The previous Secretary of the EFCE Working party organising the symposia, John Bond, expressed that years ago in the Laws of Loss Prevention, which are a kind of “Don’t be so stupid as not to look backwards and not to use past experience for future projects”. A person’s ability to think ahead is very limited, especially when it comes to predicting what can go wrong. An accident can happen easily or as the rhyme says:

Here lies the body of Henry Bank Who struck a match to look in a tank They buried him quickly before he stank (John Bond, 1996, ‘The Hazards of Life and All thar)

On the other hand we can say that the symposia have been very instrumental in generating and sharing knowledge in the Loss Prevention community, although it still can further improve. We have no index of previous proceedings and as yet no undertaking underway to make the information in previous proceedings more easily accessible. In the era of information technology I trust this is just a matter of time. Also on this occasion I am glad to report that the Scientific Committee did much work and put much effort into selecting good and interesting papers and helping to optimise the programme (and at this time of commercial approaches even without any compensation!). The process industries and authorities are facing new challenges. Competition is a factor world-wide. Fewer people have to do more in the present plants. Safety requirements still go up. However overspending in equipment is wasteful. So where is the optimum? To determine this condition we need more facts. We need better models to describe the complex processes, which can make something go wrong. We need to know more about the properties of hazardous materials. We need more systematic approaches and concepts to get a grip on the safety situation and to be able to make the decisions for balancing safety requirements and economy in true risk control. In the present proceedings you will find examples. The future will be quite interesting. The rapid growth of computational capabilities that we have seen over the past thirty years will continue as far as can be seen. This will enable a change in the science of chemistry and engineering from an empirical to a more systematic “ab initio” or “from first principles” approach. The number of rate equations of transport processes and chemical kinetics that can be solved simultaneously is increasing to such an extent that massive and detailed simulation becomes possible. Not only will this enable breakthroughs in process engineering, but also it will give our community the tools to make Loss prevention more predictive indeed. It means that we will be able to do a risk analysis and carry out successfully identification of the unwanted events, even if no accident or near miss has occurred already. So, are we working to make these symposia redundant? To a certain extent this may be true, but it will take a long time before such a dream becomes reality. Safety and certainty are highly valued in society and every piece of human work has its limitations. I hope you gain much from the contents of these proceedings. Hans J. Pasman Chairman Scientific Committee

This Page Intentionally Left Blank

vii

CONTENTS

Volume 2

Topic 5 - 10

Explanation of the paper numbering: E.g. T5-1 T5 Topic5 -1 Number of presentation

Number of presentation: One digit (1-9)

Full oral presentation

Two digits (11-xx) Brief oral / visual poster presentation

Topic 5 Hazardous substance/materials properties T5-1

T5-2

T5-3

T5-4

T5-5

A study into the explosive boiling potential of thermally stratified liquidliquid systems that result from runaway reactions Ronald I. A. Kersten, NL, G. Opschoor, B. Fabiano, R. Pastorino

771

Auto-ignition hazard of mixtures of ammonia, hydrogen, methane and air in a urea plant Luc Vandebroek, BE, J. Berghmans, F. Verplaetsen, A. van den Aarssen, H. Winter, G. Vliegen, E. van 't Oost

785

Review of recent results, trends and regulations affecting the assessment of electrostaticignition hazards in industry

Martin Glor, CH

799

Identification of autocatalyticdecompositionsby differential scanning calorimetry Leila Bou-Diab, CH, Hans Fierz

809

Flame arrester testing and qualification in Europe

Hans Fiirster, DE

823

...

Vlll

T5-11 Thermal hazard evaluation of vilsmeier reaction Atsumi Miyuke, JP,M. Suzuki, Y. Iizuka, Y. Oka, T. Ogawa

T5-12 The corrosion monitoring: Loss prevention and safety of complex systems in acid media Vladirnir Polyanchukov,RU

835

843

T5-13 Study on the explosion of run-away reaction triggered by a faint heat generation

Jinhua Sun, JF’,X. Li, W. Tang, K. Hasegawa

853

T5-14 Assessment of the thermal and toxic effects of chemical and pesticide pool fires based on experimental data obtained using the Tewarson apparatus Christian Costa, FR, G. Treand, F. Moineault, J. L. Gustin

867

T5-15 Hazards of surface explosions Hartmut Hieronymus, DE, Ph. Henschen, M. Hofmann, J. Bender, R. Wendler, J. Steinbach, B. Plewinsky

897

T5-16 Relation between ignition energy and limiting oxygen concentration for powders Andreas Gitzi, CH, Klaus Schwenzfeuer, Martin Glor

909

T5-17 Process safety at elevated temperatures and pressures: Cool flames and auto-ignition phenomena Andrzej A. Pekalski, NL, J. F. Zevenbergen, H. J. Pasman, S. M. Lemkowitz, A. E. Dahoe, B. Scarlett 917

Topic 6 Storage and transport of dangerous goods by road, rail, water and pipeline T6-1

Fracture statistics and offshore gas transport black sea and the Indian ocean Vadim Polyakov, RU, I. Kurakin

935

T6-2

Appropriate labelling of FIBCs for their use in explosion endangered areas Carsten Blurn, DE, W. Fath, M. Glor, G. Luttgens, C.-D. Walther 947

T6-3

Risk assessment and decision-making strategies in dangerous good transport. From an Italian case-study to a general framework Bruno Fubiano, IT, E. Palazzi, F. Currb, R. Pastorino

955

IX

T6-4

T6-5

T6-6 T6-7

Assessment of storage life of energetic substances close to safety critical conditions A. Eberz, DE, G. Goldmann

967

A new concept when designing parking areas for lorries carrying dangerous goods: The dynamic segregation J. Antonio Vilchez, ES, X. P6rez-Alavedra, J. Arnaldos, C. Amieiro, J. Casal

983

Gas-pipelines in tunnels or galleries: A sound solution?

Marc0 Montanurini, CH, C. Pliiss, G. Niederbaumer Fire test for the safety in transport and storage of dangerous goods Christian Bake, DE, W. Heller, R. Konersmann, J. Ludwig

993 1005

T6-11 Risk analysis of the transportation of hazardous materials: An application of the TRAT2 software to Messina M. F. Lisi, IT, M. F. Milazzo, G. Maschio, P. Leonelli, S. Bonvicini, G. Spadoni 1017 T6-12 Best routing criteria for hazardous substances transportation Barbara Mazzarotta, IT, R. Bubbico, S. Di Cave, A. Guerrieri

1029

Topic 7 The prevention, protection and mitigation and modelling of accidental releases T7-1 T7-2

T7-3

T7-4

Loss of containment: Experimental aerosol rain-out assessment J,-P. Bigot, FR, J-C. Adrian, R. Lerible, V. Marchand, J. Hocquet

1043

Effective applications of fluid curtains to mitigate incidental gas releases

Menso Molug, NL, H. Schoten, M. Powell-Price

1051

Assessment of design explosion load for control room at petrochemical plant Stiun H~iset,NO, 0.Szter

1059

Heat-up and failure of liquefied petroleum gas storage vessels exposed to a jet fire Michael A. Persuud, GB, C. J. Butler, T. A. Roberts, L. C. Shirvill, S. Wright 1069

X

T7-5

Developments in the congestion assessment method for the prediction of vapour-cloud explosions

Jonathan S. Puttock, GB T7-6

1107

Explosion vent sizing in flammable liquid spill scenarios

Fruncesco Tumnini, US

1135

T7-11 Analysis of risk of transportation of the liquefied petroleum gases on pipelines Edward Telyukov, RU, F. Guimranov

1145

T7-12 Investigation OR the mitigation dunfig accidental release of heavy gas by technical devices E. Puls, DE, F. Engelhardt, S. Hartwig

1149

T7-13 Gas explosion in cement kiln: Causes and lessons learned Sjir VZiegen, NL, E. van 't Oost, A. van den Aarssen, B. Smit-Rijnhart, F. Michel

1153

T7-14 An innovative unified model for the rate of air mixing with releases from high velocity sources E. Pulazzi, lT,R. Pastorino, B. Fabian0 T7-15

Instantaneous velocity fields and vorticity distribution of the movement of coherent structures at the surface of large-scaleJP4-pool fires .

Christian Kuhr, DE, D. Opitz, R. H. G. Miiller, A. Schonbucher

T7-16

Experience with the What If analysis applied to specific operations or chemicals

Christel Perret, FR, J. C. Adrian

1167

1179

1189

T7-17 Explosion safety in gas transferring systems without using external control 1197 Alexundr Tyulpinov, UA, M. A. Glikin

Topic 8 Safety and environment in specific process industries T8-1

Sources and solutions of fire and explosion in semiconductor fabrication processes

Jenq-Renn Chen, TWD

1203

xi

T8-11 Radioactive contamination of city temtory due to work of uraniumprocessing plant and the ways of its solution Vadim Korovin, UA, G Shmatkov, Yu.Koshik, S. Ryaboshapka, Yu. Shestak

1215

Topic 9 The impact of legislation and industry initiatives T9-1

Strategies for industrial risk prevention and management in the European union: The major accident hazards bureau and the Seveso I1 directive

I. Stuart DufieZd, IT T9-2

Land use planning and chemical sites (LUPACS)

T9-3

Modeling the formation and release of hazardous substances in the loss of control of chemical systems containing brominated flame retardants

Tommy Rosenberg, SE

Federica Barontini, IT, V. Cozzani, L. Petarca, S. Zanelli T9-4

T9-6

T9-7

1239

1251

An approach to the assessment of domino accidents hazard in quantitative

area risk analysis

VaZerio Cozzani, IT, S. Zanelli

T9-5

1223

1263

-

Chemical accident risks in U.S.industry A preliminary analysis of accident risk data from U.S. hazardous chemical facilities

James C. BeZke, US

1275

Seveso I1 as an instrument for the introduction of formalised safety management systems in small and medium enterprises StyZianos Loupasis, NL, G. A. Papadakis, J. S. Duffield

1315

Finding a consensus on plant safety - the German way

Christian Jochum, DE

1329

Cost effective compliance with the risk assessment aspects of Seveso I1 Graeme Richard Ellis, GB

1335

T9-11 A consequence analysis for accidental explosions involving flammable gases Sergio Carol, ES, J. A. Vilchez, J. Casal

1349

T9-12 Risk management in land use planning Fredrik Nystedt, SE

1355

T9-8

xii

T9-13 Management support for SEVESO I1 safety demonstration Louis Goossens, NL, B. H. J. Heming, L. J. Bellamy

1361

T9-14 Impact of the Czech SEVESO I1 directive on industry Frantisek Babinec, CZ, A. Bernatii

1373

T9-15 Safety management systems in application of the Seveso I1 directive Lessons learnt from implementation in SMEs Oliver SaZvi, FR, I. Vuidart, M. Caumont, F. Prats

1381

-

T9-16 Seveso I1 directive How to comply to the safety management system requirements in small and medium size enterprises? Eric van der Schans, NL, M. A. M. Heijne

1393

T9-17 A combined approach to improve safety performance on existing process plants. Practical application according to Seveso I1 Renato Pustorino, IT, F. Currb, M. Del Borghi, B. Fabian0

1407

T9-18 Assessment of health effects Patrice Cadet, FR, T. Gallot

1419

Topic 10 Development of methodology, e.g. of risk assessment T10-1 The 'purple book': Guideline for quantitative risk assessment in the Netherlands PuuZA. M. Uijt deHaug, NL,B. J. M. Ale, J. G. Post

1429

T10-2 RACKETman, pro-active risk identification and assessment methodology for organisational change Stefan Svensson, SE

1439

T10-3 A comparison of deterministic and probabilistic risk assessment methodologies for land use planning J. Robert Taylor, DK, Y. Weber

1447

T10-11 Four explosions: Four times static electricity was the most probable ignition source M. Th. Logtenberg, NL

1459

T10-12 Risk analysis for soil protection and industrial safety Lex Stux, NL, P. Korvers, R. Klein Entink

1465

xiii

T10-13 Risk analysis on a closed landfill with chemical waste Lex Stux, NL,, T. Logtenberg, N. Klaver

Author Index

1475

This Page Intentionally Left Blank

Topic 5

Hazardous substance/materials properties

This Page Intentionally Left Blank

771

A study into the explosive boiling potential of thermally stratified liquid-liquid systems that result from runaway reactions R.J.A. Kersten",G. Opschoora,B. Fabianob,R. Pastorinob "TNO Prins Maurits Laboratory, P.O. Box 45,2280 AA Rijswijk. The Netherlands bDICheP-Chemicaland Process Engineering Department "G.B . Bonino", University of Genoa, Via Opera Pia 15, 16145 Genova, Italy

ABSTRACT The occurrence of a rapid phase transition, or so-called explosive boiling, when a cold volatile liquid comes into contact with a hot liquid or hot surface is a potential hazard in industry. This study was focussed on the explosive boiling potential of thermally stratified liquid-liquid systems that result from a runaway reaction. The study comprised experimental work on a reactive and a non-reactive system. The experimental results showed that under the given conditions, the cold phase was superheated but did not evaporate explosively as the limits of superheat of the phase were not achieved. The response of the cold phase appeared to be completely controlled by the interface temperature between the hot and the cold phase. In general, based on the order of magnitude of temperature differences that result from a runaway reaction in a multi-phasic system and the fact that the system is pressurised by its own vapour pressure, the occurrence of explosive boiling under runaway conditions appears unlikely for these type of systems.

1 INTRODUCTION In the chemical industry, there are a number of reactions performed in mixed multi-phasic systems. Examples of these type of reactions are suspension and emulsion polymerisations or reaction systems in which the reactant and the product are present in an aqueous and an organic phase, respectively (or vice versa). In these systems, accidental loss of agitation might lead to a segregation of the phases and the occurrence of a runaway reaction in one of the phases. The complexity of hazard assessment for these kind of systems in terms of

712

temperature and pressure excursions is illustrated with an example on a polymerisation reaction as given below. The scenario that leads to the occurrence of explosive boiling in this example is often considered as the worst case for these kind of systems. In the case of a suspension polymerisation, the reaction is performed under wellstirred conditions to obtain the desired product specifications. A malfunctioning of the stirrer will lead to a segregation between the aqueous phase and the organic phase in which the exothermic polymerisation reaction proceeds. As a result of reduced heat transfer over the wall of the reactor and a concentration of reactive mass, a runaway might occur that leads to a system of a cold water layer with a hot polymer layer (possibly well above 400 "C)' on the top of it. A disturbance of the two-layer system (by venting, re-starting the stirrer or a rollover) leads to a flash evaporation of the cold liquid. Subsequently, a fast and unexpected pressure rise occurs as the flashing liquid enhances the mixing of the phases. If significant vaporisation occurs in a short period of time, the process resembles an explosion. Although studies on subjects related to the problematic nature of the process discussed above are described in literature, little information is available on the potential explosive boiling phenomena related to separation, runaway and vent behaviour of multi-phasic systems. Therefore, in the present study, the prediction of pressure-temperature relations at a sudden mixing of the phases and a characterisation of the effect of flash evaporation on vent requirements and outflow properties were addressed. Apart from the explosive boiling potential that results from a runaway reaction, the study is also relevant for related phenomena like accidental filling of a high temperature reactor with a volatile liquid, application of coolant injection for runaway prevention and equipment failure leading to a sudden contact between phases (heat exchanger or reactor jacket).

2 THEORETICAL BACKGROUND Explosive boiling, or better, a rapid phase transition, results from superheating the cold phase to its superheat limit where homogeneous nucleation occurs in a short period of time. The superheat limit or homogenous nucleation limit, represents the deepest possible penetration of a liquid into the domain of metastable states. At constant pressure it is the highest temperature below the critical point that a liquid can sustain without undergoing a phase transition; at constant temperature, it is the lowest pressure.

773

In general, with respect to the type of systems considered in this study, there are two ways of reaching the superheat limit. Firstly, at constant pressure, the superheat limit is reached as the temperature exceeds a threshold value. This value depends on the physical properties of the system as viscosity, density and surface tension and equals the homogeneous nucleation temperature of the liquid. Explosive boiling is more difficult to achieve as the temperature of the hot phase in contact with the liquid increases well beyond the threshold temperature. Under this conditions, a rapid establishment of film boiling takes place. As a result, a vapour layer is produced that protects the bulk cold liquid from direct contact with the hot phase. The contact of two phases at different temperatures leads to the heating of a thin film of the cold phase well above its expected boiling temperature. According to [ 11 the following expression can be used to predict the interface temperature;

in which Th is the temperature of the hot liquid and T, of the cold liquid. The terms a h and q express the thermal diffusion of the hot liquid and of the cold liquid, respectively. The thermal diffusion is given by the following expression;

in which C, is the specific heat, p the density and A the thermal conductivity. Note that according to Eq. (l), the interface temperature follows the temperature of the liquid that has the highest thermal diffusion. Explosive boiling occurs if, at the given pressure, the interface temperature exceeds the homogeneous nucleation temperature of the cold phase. The second way to reach the superheat limit is, at constant temperature, a fast depressurisation that leads to a pressure far below the saturation pressure of the liquid. In general, due to the effect of pressure on bubble growth rates, explosive boiling is difficult to achieve at high system pressures. At high pressures, vapour bubble growth rates are relatively low and dominated by the rate of heat transfer into the growing bubble. Under these conditions, vapour explosions are difficult to initiate and only rapid (non-explosive) boiling occurs. At low pressures, the bubble growth rates are high and inertially controlled. An additional complicating factor in the experimental assessment of the phenomenon is the effect of scale. For large-scale events, the liquid must be prefragmented at the inception of explosive boiling. Whether or not this conditions

114

is met on the large scale (by the initial flash evaporation) is hard to predict from small-scale experiments. In general, with respect to the boundary condition on pre-fragmentation, small-scale experiments appear to be conservative.

3 PRELIMINARY EXPERIMENTS Before experiments with a multi-phasic reactive system were performed, preliminary experiments were carried out to study the temperature development and to visually observe phenomena that might take place at the interface between two thermally stratified liquids. The experiments were performed in the so-called Constant Pressure Autoclave (CPA) on a non-real-time system. The two selected liquids are water, dyed by chrome-nitrate, and 2,2,4,6,6pentamethylheptane (isododecane).

3.1 Experimental set-up The heart of the CPA installation is a glass tube reactor with a diameter of 3.5 cm and a height of 15 cm. The tube is positioned in a containment section of the installation. The gas space of the tube and the containment section are connected via a condenser so that no pressure difference over the tube is build-up during operation. The headspace of the tube is connected to two large containment vessels, so a nearly constant pressure can be maintained during operations. The installation can be pressurised up to a pressure of 200 bars. A schematic drawing of the installation is presented in Figure 1.

Figure 1

Constant Pressure Autoclave

775

Three thermocouples are placed in the tube to measure the water, interface and isododecane temperature. The height of the location of thermocouples from the bottom were 2.8, 6 and 10.8 cm. In the given set-up, the temperature of the water and isododecane phase can be modified by adjusting the power to the heater at the bottom of the CPA or the power to a heating spiral around and within the top half of the test tube. Upon filling the test tube with a pre-defined amount of water and isododecane, the tube is placed in the constant pressure autoclave (see Figures 2a en 2b) which is closed and pressurised. A video camera is put in front of the autoclave to record the events that occur at the interface (Figure 2c). The pressure and the temperatures are controlled from the control tower (Figure 2d). The recorded film is displayed on a screen. The measured temperatures and pressure are recorded by a computer for later evaluation.

Figure 2

Pictures of the Constant Pressure Autoclave (CPA)

776

3.2 Experimental results Four experiments were performed at a pressure of 4.5, 9, 24 and 40 bars. For each experiment the theoretical interface temperature was calculated on basis of heat transport between the hot and cold layer according to Eq.(l). The temperature curves measured in the experiment at a pressure of 4.5 bars are presented in Figure 3. During this experiment, a few minutes after the start of the experiment, boiling took place at the interface between the liquids. The boiling occurred as follows: first, a large bubble is produced at the interface. When the bubble was expelled from the interface, an another bubble was formed. At the beginning, this phenomenon took place at a low speed, but after a while, it occurred at a higher speed producing tiny bubbles at the interface. At a temperature difference between the liquids of about 90 "C (2500 seconds), a fast boiling process was observed at the interface between the liquids. Note that the irregularities in the temperature curve prior to this boiling effect were caused by adjustments in the power supply to the heating spiral. The fast boiling occurred together with a fast decrease of the isododecane temperature. This decrease of the isododecane phase was caused by evaporation of water. The evaporation of water, as well as heat transport by water vapour, extracted heat from the isododecane phase. The measured temperature curve in the water phase clearly shows that the volatile boiling was in fact restricted to the very top of this phase. 250 200

I , Boiling at interface

a2 50 -1

L

! n E 100

+al

50

0

Figure 3

500

1000

1500

2000

Time [s]

2500

Experimental result CPA experiment at 4.5bars

3000

3500

4000

The occurrence of the fast boiling process at the given conditions can be explained by a consideration of the vapour pressure at the top of the water phase and the total pressure of the system. The vapour pressure at the top of the water phase can be calculated from the temperature at the liquid interface, which, in turn, is calculated from the measured water and isododecane temperatures. The calculated interface temperature at the fast boiling process is approximately equal to 142°C which corresponds to a vapour pressure at the top of the water phase that exceeds the initially imposed pressure on the system. Hence, boiling occurs. The experiment carried out at 9 bars only showed boiling at the top of the aqueous phase. The experiments carried out at 24 and 40 bars showed no boiling, even upon pressure relief. The absence of boiling was caused by the fact that water temperature was still below its atmospheric boiling temperature. The results of the experiment at 40 bar are presented in Figure 4. Figure 4 shows the good agreement between the calculated and measured interface temperature between the liquids. Furthermore, the figure clearly shows that the interface temperature follows the temperature of the liquid that has the highest thermal diffusion. Based on the experimental findings, it is concluded that Eq. (1) provides a good estimation of the interface temperature. Apart from an experimental verification of this equation, the preliminary experiments contributed considerably to the understanding of the interfacial boiling phenomena and the effect of pressure on these phenomena. 200 180 -

F

160

~

F 1140 40 I

f

9

I

120 -

g 100 El00 E

$ 8800 60 60

~

40 L "

Figure 4

,

0

500

1000

Time [s]

1500

Experimental result CPA experiment at 40 bars

2000

2500

778

4

ONE-LITRE SCALE EXPERIMENTS

Upon the preliminary experiments in the CPA with a non-reactive system, a two-phasic reactive system was selected for experiments on a one-litre scale. The selected system comprised the decomposition reaction of an organic peroxide (dilauroyl peroxide) in a water-isododecane mixture. Apart from the studied phenomena in the preliminary experiments, the experiments on the onelitre scale were also performed to study the effect of flash evaporation on vent requirements and outflow properties. The study on the reactive system included the study of the system's behaviour upon pressure release.

4.1 Experimental set-up The experiments were performed in the so-called Controlled Runaway and Vent Monitor (CRVM). The CRVM is an in-house developed instrument for the characterisation of thermal properties and vent behaviour of, especially high energetic, chemicals. The CRVM consists of a 1.1 litre reactor (height over diameter equals 1.4), capable of operating up to a pressure of 250 bars at 350 "C, in combination with a process control and data acquisition system. The reactor is equipped with a flat-blade turbine impeller stirrer, a piezo resistive pressure transducer, multiple thermocouples (four internal and two mounted in the vessel wall), a 0.5" bursting disk, electrodes for ignition of the head space or for the use of an internal heater, two fillhelief lines (diameters of 3.7 and 9 mm) and a bottom drain. The bottom drain can be used for either emptying the reactor or for operating the reactor as a continuously stirred tank reactor. The reactor vessel is heated by two helical heaters (top and bottom section). Both heaters are independently controlled by programmable Process Controllers, which, in turn, are operated on basis of a selected temperature programme on the process control and data acquisition system. As a result, the reactor can be operated with an imposed temperature programme (constant power, constant wall temperature, constant temperature increase) or pseudo-adiabatically. In the pseudo-adiabatic mode, the wall temperature, measured by thermocouples positioned within the vessel wall, is kept equal to the temperature of a selected internal thermocouple (within 0.5 "C) by controlling the amount of heat supplied to the vessel. The maximum temperature rise rate of the tested substance that can be compensated in the pseudo-adiabatic mode equals approximately 10 "Chin. A schematic drawing and a picture of the reactor are presented in Figure 5a and 5b, respectively.

779

Figure 5

(a) Controlled Runaway and Vent Monitor (CRVM)

4.2 Experimental procedure Six experiments were carried out with three different concentrations of peroxide in the organic phase (weight fractions of 50, 75 and 100%). Each concentration was tested with and without backpressure. In the experiments performed with back-pressure, the reactor is connected via the 3.65 mm diameter relief line to the gas containment section of the Constant Pressure Autoclave. The experiments were performed according to the following procedure. Firstly, the reactor was filled with the pre-defined amount of water (400 g). Subsequently, the reactor was heated to a temperature of approximately 60 "C. At the same time, the mixture of isododecane and peroxide was prepared. To easily dissolve the peroxide in isododecane, the dilauroyl peroxide was melted first and then added to the solvent (the melting point of the peroxide equals 56°C). To prevent an early decomposition of the peroxide, the temperature was carefully controlled below 60-65°C. The prepared peroxide mixture (with a total mass of 320 g) was introduced in the reactor and mixed with the water (speed of the stirrer = 900 rpm). The top heater of the reactor was switched to a 100%power. The relatively fast heat-up of the top of the reactor was done to reduce heat loss during the later stage of the runaway. The bottom heater of the reactor was switched off or lower than 40% of power at the beginning. At a liquid temperature of approximately 9OoC,the stirrer was switched off, upon which a separation of the phases occurs. After the separation, the temperature of the gas phase was measured by thermocouple T I ,the organic liquid temperature by T2 and T3 (with T3 close to

780

the interface between the organic and the water phase) and the water temperature by thermocouple T4. Due to the high temperature of the organic phase, and the ongoing heat-up of the reactor, a runaway occurs in the organic phase upon the phase separation. Pressure and temperature of the organic liquid increase rapidly due to the runaway. When pressure reaches its maximum, the 9.5 mm with a restriction with a diameter of 1.8 mm is opened. In the experiments with back-pressure, the pressure is relieved via the 3.65 mm valve in the pressurised gas containment section of the CPA.

4.3 Experimental results The key values of the experiments are summarised in Table 1. Table 1 Overview of experimental results Peroxide concentration in organic phase [wt.%] Onset temperature runaway ["C] Maximum pressure [bars] Maximum temperature organic phase ["C] Temperature difference at pressure relief ["C]

50 70

40 205 100

75 70 62 240 140

100 81 94 280 200

In general, a comparison between the experiments with different peroxide concentrations shows the same features. The experiments with a peroxide concentration of 75% are discussed in more detail below. In principle, each experiment consists of two parts. The first part is the part in which the phase separation and runaway reaction takes place. The second part is the actual pressure relief, either to the back pressure of the gas containment system of the CPA or to the ambient pressure. Figure 6 shows the results of the experiment with a peroxide concentration of 75 %. In the initial stage of the experiment, when the phases are still thoroughly mixed, a decomposition reaction of the peroxide occurs. The temperatures within the system are equal up to the moment at which the stirrer is switched off (at about 90 "C). Without mixing, a fast separation of the two-phase mixture to an aqueous phase with an organic phase on top of it. The runaway reaction in the organic phase clearly accelerates upon the phase separation due to the concentration of the reactive mass. Figure 6 shows that due to stratification within the organic phase, and the fact that T3 is measured close to the water phase, the runaway starts at the top of the organic liquid. Upon reaching its maximum temperature, the temperature rise in the top layer of the organic phase stops due to reactant depletion. At this stage, the runaway in the layer directly below the top layer of the liquid is still going. As a result, the temperature of this layer approaches the temperature of the top layer. This

78 1

process continues in time and explains the correlation between T2 , T3 and the pressure increase. The temperature measured in the water phase (T4) does not respond to the runaway. After reaching its maximum, pressure begins to decrease slowly by heat loss from the gas phase to the top of the vessel. At the moment that the valve is opened, a steep drop in pressure to the back-pressure in the CPA system is observed. During the depressurisation, TI increases rapidly whereas the temperature measured with T2 and T3 reduces. This reduction in temperature is caused by evaporation that takes place at the interface of the liquids. The produced vapour mixes the organic phase and contributes to the heat removal by its heat capacity. Note that an initial temperature drop of T2 is measured due to the evaporation of light (volatile) reaction products from the organic phase. The vent process of the experiment is presented in more detail in Figure 7. Note that this figure shows the results of the experiment with an imposed back-pressure. The results of the vent process to ambient pressure are shown in Figure 8. Figure 8 shows that the part of the experiment prior to the pressure relief is equivalent to the part shown in Figure 8. In contrast with the experiment with back pressure, a flash evaporation of water is observed at the end of the relief period. The severity of the process of flash evaporation and the pressure at which it starts increases with the peroxide concentration. This shows a clear correlation between the evaporation process and the temperature at the interface T2. 60 55 50 45 40

250

230

21 0

-E

a 170 lgo

2

35 30 $

2

$ 150

130

110

90

70

50 500

Figure 6

600

700

800

900 1000 Time [s]

1100

1200

1300

25 20 15 10 5 0 1400

g

Results CRVM experiment with a 75% peroxide mixture and water (2.3 bars back pressure during relief)

782 250 230

60 55

50 45 40

21 0

a-170 lgo a,

150 130

2

2

z 110

15 10 5

90 70

50

930

950

970

990

1010

1030

Time [s]

1050

0

1070

Results relief period with a backpressure of 2.3 bars backpressure

Figure 7

70

300

60

Re"e'

pressure-

250

50

a- 200

40

a,

I

F

2

150 100

-

T4

50 800

820

840

860 Time [s]

880

-2 2

a, 30 2 a a, 20 10

0 900

Results CRVM experiment with a 75% peroxide mixture and water (no back pressure during relief)

Figure 8

300

10

9

250

8

a 200

7

$

5;

F

a,

I

150

v)

4 8

L1

E

I-"

-

6 2

I

100

3

2

50 800

Figure 9

-

2 35 30 $ 25 20 t

1

820

840

Time

[s]

860

Results relief period (no backpressure)

880

900

a

783

4.4 Discussion

Based on Eq.(l) and the measured temperature of the water phase and the and the vapour organic phase, the theoretical interface temperature Tinterface pressure of water at the interface was calculated for each experiment. The calculated curves are also depicted in Figure 7 and Figure 9. A comparison between the curves with and without back-pressure, combined with the information obtained from the calculated vapour pressure curves, reveals that the back-pressure prevents the flash evaporation of water from the interface. The process of flash evaporation does only occur when the vapour pressure of water at the interface exceeds the overall pressure of the system. None of the experiments showed explosive boiling as the criteria for a rapid phase transition or explosive boiling were not met. This was especially true for the criterion on the limit of superheat of the cold liquid at the given temperature differences between the two liquids. Note that in general, for vapour systems, high levels of superheat are not easily reached as the system pressurises itself. Furthermore, the pressure drop upon initiation of a vent process remains small. 5

CONCLUSIONS

Experiments with a non-reactive system have shown that water was superheated but did not evaporate explosively, as the limits of superheat of water were not achieved. There was only heat transfer by nucleate boiling. Further it appeared that the temperature at the interface between the hot and the cold phase can be calculated on basis of the bulk temperatures of these phases. The experimental results learned that the interface temperature, and in turn, the vapour pressure that results from the interface temperature, controls the response of the cold phase. The maximum vapour pressure exerted by the cold phase can be estimated on basis of the interface temperature. A vapour pressure higher than the ambient pressure results in a flash evaporation of liquid from the top of the cold phase (at relatively low levels of superheat) during venting. A vapour pressure lower than the ambient pressure results in evaporation of the cold liquid up to the level at which thermodynamic equilibrium with the gas phase is attained. The vapour production rate from the cold phase during a relief process is controlled by the given vapour pressure and the volumetric relief rate. The occurrence of a vapour explosion on a large scale can only take place when the level of superheat approaches the level at which homogeneous nucleation takes place and when fragmentation of the cold liquid takes place. Based on the order of magnitude of temperature differences that result from a runaway

784

reaction in a multi-phasic system and the fact that the system is pressurised by its own vapour pressure, it appears to be unlikely that high levels of superheat are reached. Hence, it can be stated that the occurrence of a vapour explosion under runaway conditions is, in general, unlikely. Due to its dependence upon many factors, evaluation of the conditions under which explosive boiling can take place is a complex problem that should be approached with care.

ACKNOWLEDGEMENTS An important part of the work on which this article is based was performed during the performance of a training period at the TNO Prins Maurits Laboratory of Mr. L. Accame of the University of Genoa and Ms. V. Vaussier of the University of Orleans. The authors would like to thank Mr. Accame and Ms. Vaussier for their investigations.

REFERENCES 1. Milton Blander and Joseph L. Katz, “Bubble nucleation in liquids” AIChe Journal, (3,September 1975, pages 833-848 2. L. Accame, Tisa di Laurea “Rilasci in condizioni di emergenza: studio teorico sperimentale dei sistemi ibridi“, Universia’ deli Studi di Genova, Facoltisi di Ingegneria, Ottobre 1999. 3. V. Vaussier, “A study into the explosive boiling potential of thermally stratified liquid-liquid systems that result from runaway reactions”, TNOPML report nr 1999-SV 14, August 1999, Rijswijk, The Netherlands.

785

Auto-ignitionhazard of mixtures of ammonia, hydrogen, methane and air in a urea plant L. Vandebroek'* ,J. Berghmans a ,F. Verplaetsena A. van den Aarssen ,H. Winter ,G. Vliegen ,E. van 't Oost a K.U.Leuven, Dept. Of Mechanical Engineering Celestijnenlaan 300A, B-3000 Leuven, Belgium

DSM Engineering-Stamicarbon, P.O. Box 10,6160 MC Geleen, The Netherlands

ABSTRACT The auto-ignition of ammonidmethanelhydrogedair mixtures constitutes a hazard that is of much concern in urea plants. In the present study, the autoignition behaviour of ammonidmethanelhydrogedair mixtures has been investigated experimentally for pressures up to 7500 P a . The experiments were carried out in a closed spherical vessel with a volume of 8 dm3. The concentration and the pressure dependence of the auto-ignition temperature (AIT) were determined for three types of mixtures: ammonidair, ammonidmethanehir and ammoniahydrogedair mixtures. It is found that the most ignitable mixture compositions were situated between stoichiometry and the upper flammability limit. Small amounts of methane and hydrogen decrease the AIT of ammonidair mixtures to a large extent. The pressure dependence of the AIT could be correlated by a Semenov relationship. For the multi-fuel mixtures a distinct deviation from the Semenov correlation was observed at the lowest temperatures. With respect to the explosion hazard in urea plants, the experimental results were used to assess realistic AIT values in the pool reactor and the ammonia scrubber, operating at a pressure of 15 MPa.

1. INTRODUCTION In many chemical processes combustible gases and vapours at high pressures and high temperatures are present. In order to evaluate the auto-ignition hazard involved and to ensure the safe and optimal operation of these processes, it is * Corresponding author.

786

important to know the auto-ignition temperature (AIT) of the gas mixtures. The AIT values found in literature are usually determined according to standard test methods in small vessels and at atmospheric pressure (e.g. DIN 51795, ASTM-E 659-75, or BS 4056) [1,2]. However, since the AIT is not a constant but decreases with increasing pressures and increasing volumes, these AIT values are often not applicable to industrial environments [3-61. Futhermore, most available AIT data refer to single-component fuels, while information on multicomponent fuels is scarce [7-91. In the present study, attention is focused on the auto-ignition hazard inside a urea plant. In the ammonia scrubber and the pool reactor of the plant, mixtures of ammonia, methane, hydrogen and air are exposed to a temperature of 150°C and a pressure of 15 MPa. The maximum methane and hydrogen concentrations were calculated to be 10 and 20 mol% respectively. In order to evaluate these mixtures for their auto-ignition characteristics, the AIT of ammonidair mixtures is determined experimentally for pressures up to 7500 kPa and for concentrations ranging from 20 to 80 mol%. The effect of limited methane and hydrogen additions was also investigated. Simple scaling rules were used to estimate AIT values for the existing mixtures inside the urea plant.

2. EXPERIMENTAL APPARATUS AND PROCEDURE The experimental apparatus, illustrated in Fig. 1, consists of four major parts. The first part is the mixture preparation system, which is used to produce homogeneous mixtures of a desired composition. To do this, two different filling methods have been used, i.e. the constant flow method and the partial filling method. Homogeneous mixtures of only two components, e.g. ammonidair mixtures, are produced with the constant flow method. The flow rates of air and ammonia are controlled by a thermal mass flow controller and by a volumetric membrane pump respectively. In the evaporator, the seperate flows are mixed to obtain a homogeneous gas mixture. Downstream the evaporator, the total system is kept at a constant temperature of 150°C to avoid condensation of ammonia. Homogeneous gas mixtures of more than two components are produced with the partial filling method. The partial pressures for the different components are calculated for each desired composition and pressure. Successively, the different components are led through the evaporator and flow into the buffer vessel, which is the second part of the apparatus. The buffer vessel is used to maintain the premixed reactants at a high pressure (up to 15000 kPa) and at a temperature of 150°C. It has a volume of 8 dm3and can withstand pressures up to 350 MPa. When the partial filling method is applied, it is provided with a special filling lance to ensure the homogeneity of the mixture.

787

Fig. 1. Experimental apparatus.

The explosion vessel is the third and most important part of the apparatus. The spherical explosion vessel has a volume of 8 dm3 and is designed to withstand explosion pressures up to 25 MPa at temperatures up to 550°C. The vessel is kept at the desired temperature by three electric heating units equipped with automatic temperature control. The explosion vessel is connected to the buffer vessel by means of a valved supply line. The last part of the apparatus consists of a data-acquisition system. The pressures in both vessels are measured with Baldwin 5000 psi strain gauges, while the temperature rises during the tests are measured with Cr/Al thermocouples placed in the centre of the vessel. All signals are analysed and recorded on a computer. To determine the auto-ignition limits, the following test procedure has been used. At the beginning of a test series, the temperature of the explosion vessel is set at the desired value. A homogeneous mixture of a desired composition and pressure is produced in the buffer vessel. After the explosion vessel has been evacuated, the gas mixture is transferred from the buffer vessel to the explosion vessel till the required pressure is reached. The pressure and temperature variations in the explosion vessel are monitored during maximum fifteen minutes. Finally, the explosion vessel is evacuated and another test is conducted at a different pressure. For each test series, a gas sample is taken from the buffer vessel and is analysed in a gas chromatograph (relative error 1 %). The occurrence of an auto-ignition is judged from the pressure and temperature histories, e.g. Fig. 2. When the temperature rise is smaller than 50°C and no

788

5000

-

loo0

4000 3000

2

z2

a

2000

1000 0

0

20

40

Tim [s]

60

400

i--

0

20

40

60

Time [s]

Fig. 2. Recorded pressure and temperature histories in the explosion vessel.

pressure increase is observed, the attempt is considered unsuccesfull. A temperature rise larger than 50°C accompanied with a pressure increase is classified as an auto-ignition.

3. EXPERIMENTAL RESULTS

3.1. Ammonidair mixtures A first series of experiments aimed at identifying the mixture composition which is most sensitive to auto-ignition. To do this the auto-ignition limit of ammonidair mixtures was measured at a constant temperature of 550°C, being the maximum temperature of the apparatus. The results are summarised in Fig. 3. The solid line in Fig. 3 represents the pressure limit beyond which autoignition occurs. The most ignitable mixture composition is found to be about 50 mol% ammonia in air. This observation is in good agreement with the results of previous studies, which show that the AIT for many compounds is found at concentrations 2-3 times the stoichiometric value [3,10]. As a next step, the pressure dependence of the AIT was determined for the mixture composition most sensitive to auto-ignition. Due to pressure limitations of the apparatus, the auto-ignition limit could only be measured at 525°C and 550°C (798K and 823K). Fig. 4 shows the measured auto-ignition limit at these two temperatures together with the AIT value at atmospheric pressure [ 111. As can be seen from Fig. 4, the pressure limit for auto-ignition increases with decreasing initial temperatures. This also implies that high pressures lead to lower AIT values. However, the effect of the pressure on the AIT is rather small, e.g. the AIT decreases with only 25°C when the pressure is raised from 3400 to 7200 kPa.

789

0

7000

0

0

-

.-

.-e

0

0

X X

2000 - x x

X X

lo00 -

x

0 20

30

no reaction

I

I

40 50 60 a m n i a concentration [ml%]

70

80

Fig. 3. The auto-ignition region for ammonidair mixtures at 550°C. 10000

l

t-

AITat 100kF'a

6000

4000

'.'...

2000

750

I o auto-ignition x no reaction

8000

800

900

850

initial tempera-

950

K]

Fig.4. The auto-ignition limit as function of the initial temperature, determined for 50 mol% ammonia in air.

3.2. Ammonidmethandairmixtures The influence of methane on the auto-ignition limit of ammonidair mixtures was studied for methane concentrations up to 10 mol%. Preliminary experiments already indicated that small fractions of methane in ammonia lower the AIT with more than 100°C. First the auto-ignition limit of ammonidair mixtures with 5 mol% methane was measured at an initial temperature of 450°C.

790

4000

~

5I 2000 -

0

0

20

30

0

0 0

0

10

40

ammonia concentration [ml%]

Fig. 5. The auto-ignitionregion of ammonidair mixtures with 5 mol%methane at an initial temperature of 450°C.

In contrast with the results of pure ammonidair mixtures, the auto-ignition limit exhibits a minimum in the lean fuel range, as shown in Fig. 5. A mixture with an ammonia concentration of 5 mol% is the most ignitable. It has a mimimum ignition pressure of 250 Wa. In a second set of experiments, the dependence of the auto-ignition limit on the methane concentration was investigated. The auto-ignition limits of ammonidair mixtures with 2,5 ,5 and 10 mol% methane are compared in Fig. 6.

-*-5 0

10

20

m0l%CH4

30

40

m n i a concentration [ml%]

Fig. 6. The auto-ignition limit of ammonidair mixtures with various concentrations of methane additions, determined at an initial temperature of 450°C.

79 1

6ooo

i o auto-imon x no reaction

660

680

700

720

initial temperature [K]

Fig. 7. The auto-ignition limit as function of the initial temperature, determined for 5 mol% ammonia and 10 mol% methane in air.

It is found that the auto-ignition limit decreases with increasing methane concentrations. In the range investigated, the mixture composition most sensitive to auto-ignition was found to be 5 mol% ammonia and 10 mol% methane in air. The effect of the initial pressure on the AIT of ammonidmethanehir mixtures was determined for the most ignitable mixture composition. Fig. 8 shows the auto-ignition limit measured at various initial temperatures between 395OC and 450°C (668K and 723K). Again, the AIT decreases with increasing pressure, but tends to level off at about 1000 kPa. This could suggest that for these mixtures, auto-ignition is governed by the high temperature branch at pressures below 1000 kPa, whereas at pressures above 1000 kPa it is governed by the low temperature branch [4,5,12].

3.3. Ammoniahydrogedair mixtures

The influence of hydrogen on the auto-ignition limit of ammonidair mixtures was investigated for hydrogen concentrations up to 20 mol%. Also here preliminary experiments indicated that small fractions of hydrogen in ammonia lower the AIT with more than 100°C. First the auto-ignition limit of ammonidair mixtures with 5 mol% hydrogen was measured at a initial temperature of 450°C. The results are presented in Fig. 8. They are similar to those of ammonidmethanehir mixtures, i.e. the auto-ignition limit exhibits a minimum in the lean fuel range. A mixture with an ammonia concentration of only 1 mol% is the most ignitable.

792

0

0

0

0

0 0

5 10 15 a m n i a concentration [mol%]

0

20

Fig. 8. The auto-ignition limit of ammonidair mixtures with 5 mol% hydrogen, determined at 450°C.

15000

10000

5000

0 0

10

20

30

,

0

1

2

3

4

5

ammonia concentration [ml%]

Fig. 9. The auto-ignition limits of ammonidhydrogedair mixtures, determined at 450°C (a) and 425°C (b).

A second set of experiments was conducted to determine the dependence of the auto-ignition limit on the hydrogen concentration. The auto-ignition limit of ammonidair mixtures with 2,5 , 5, 10 and 20 mol% hydrogen are compared in Fig. 9(a) and 9(b). The exact auto-ignition limit for mixtures with 20 mol% hydrogen could not be measured at 450°C and was therefore determined at 425°C. It can be seen from Fig. 9 that the auto-ignition limit decreases with

793

6000 5000 4000

3000

x no reaction X' \\

!

2000 1000

0

660

670

680

690

700

710

initial temperam [K]

Fig. 10. The auto-ignition limit as function of the initial temperature, determined for 5 mol% ammonia and 20 mol% hydrogen in air.

increasing hydrogen concentrations. In the range investigated, the most ignitable mixture consists of 20 mol% hydrogen and 1 mol% ammonia in air. The effect of the initial pressure on the AIT of ammonia/hydrogen/air mixtures was determined for a mixture of 5 mol% ammonia and 20 mol% hydrogen in air. This is a mixture composition with a slightly higher ammonia concentration than the most ignitable one. The auto-ignition limit is measured for various initial temperatures between 395°C and 435°C (668K and 708K), as shown in fig. 10. The AIT decreases with increasing pressure, but tends to level off again at about 1000 Wa.

4. EXTRAPOLATION TO PLANT CONDITIONS Due to pratical considerations the AIT values could only be obtained for limited pressures in a vessel with a volume of 8 dm3. In order to apply the measured AIT data to full-scale urea plants, extrapolation is needed.

4.1. Extrapolation to plant pressures

The pressure dependence of the AIT could only be established for pressures up to 7500 Wa. The experimental results can be extrapolated to plant pressures by means of the so-called Semenov correlation [13]. Based on the thermal ignition theory, Semenov derived the following relationship between the AIT and the initial pressure:

794

(;)- ;

In-

-A-+B

with p = initial pressure [Pa] T = AIT [K] Eq. 1 can be plotted as a straight line in a ln(p/T) versus 1/T diagram. The Semenov plots of the investigated mixtures are presented in Fig. 11. The linearity of the plots confirm the validity of the Semenov correlation. The plots of the multi-fuel mixtures show a distinct deviation from the linear behaviour at the low temperature end of the experimental range. A possible explanation can be found in the transition from high temperature branch to low temperature branch at these specific conditions. The constants A and B in Eq. 1 were determined by the method of the least squares for the linear sections of the plots and are listed in Table 1. Eq. 1 was used to estimate AIT values at pressures above 7500 Wa. The operating pressure in a urea plant is 15 MPa and can reach a maximum of 16,3 MPa during abnormal operation. Calculated AIT values for pressures up to 20 MPa are listed in Table 2. Table 1

Values of the constants of Eq. 1. Ammonidair Ammonia/methane/air Ammoniah ydrogedair

1.1

30950 13850 21900

1.2

-29,5 -13,6 -25,O

1.3

1.4

1.5

1.6

in- [ ~ O - ~ K ] Fig. 11. Semenov plots for 50% ammonia in air,; 5% ammonia and 10%methane in air,---- ; 5% ammonia and 20%hydrogen in air,---..

795

Table 2

Calculated AIT values ("C)at different initial pressures. Ammonidair Ammonidmethane/air Ammoniah ydrogedair

10 MPa 522 321 359

15 MFa 513 310 351

20 MPa 508 303 346

4.2. Extrapolation to plant volumes Unfortunaly, the effect of the vessel volume on the AIT could not be determined experimentally. Instead, calculations were made based on two existing correlations, i.e. the Beerbower correlation [ 141 and the Semenov correlation [131. The Beerbower correlation is a simple empirical correlation, which gives reasonably good AIT values which are on the safe side. Beerbower noticed that for a large number of fuels plots of the AIT versus the logarithm of the vessel volume tended to be straight lines, which converge to an AIT value of 75°C in a volume of 10" dm3. So the AIT values for different volumes can be calculated from a known AIT value according to Eq. 2. Table 3 gives the estimated AIT's for different volumes of interest in a urea plant, i.e. 120 dm3 (volume of the exhaust pipe of the scrubber), 1,42 m3 (volume of 1 compartment of the pool reactor) and 7,lm3 (total volume of 5 compartments of the pool reactor). Tz = (TI -75) (logv, - 12)

(l0gV1- 12)

with Ti = initial temperature ["C] Vi = vessel volume [ b 3 1 Table 3

Calculated AIT values ("C) at 20 MPa for different vessel volumes. Ammonidair Amonidmethandair Ammoniah ydrogedair

8 dm3

508 303 346

120 dm3 462 279 317

1,42m3 420 257 291

7,l m3 393 242 274

A second Correlation for the volume dependence of the AIT is based on the theory of thermal ignition. Semenov derived that the AIT is a function of the surface to volume ratio of the vessel. For spherical vessels, it is a function of the vessel diameter only. The relation between the AIT and the vessel diameter is given by the following expression:

196

In

(:)- f -

-A-++'+In

(:)

(3)

-

with p = initial pressure [Pa] T = initial temperature [K] d = vessel diameter [m] De constants A en B' can be calculated from the constants of Eq. 1 and are listed in Table 4. Eq. 3 was used to estimate AIT values for different volumes of interest in a urea plant. The calculated values are summarised in Table 5. Table 4

Values of the constants of Eq. 4. Ammonidair Ammonidmethane/air AmmoniaJh ydrogedair

A 30950 13850 2 1900

B' -30,9 -15,O -26,4

Table 5

Calculated AIT values ("C) at 20 MPa for different vessel volumes. Ammonidair ammonia/methane/air ammonidh ydrogedair

8 dm" 508 303 346

120 dm3 490 28 1 330

1,42 m3 474 264 316

7,l m3 464 25 1 308

4.3. Discussion

As the AIT decreases when the pressure and the volume of the gas increases , the lowest and thereby most critical AIT value is found for a volume of 7,l m3 and a pressure of 20 MPa. These values are summarised in Table 3 and 5 . Comparing these data shows that the estimated AIT values obtained from the Beerbower correlation (Table 3) are lower than these obtained from the Semenov correlation (Table 5). Therefore, the lowest value in Table 3 (242°C) corresponds with the most critical AIT value in a urea plant. This is even a conservative value, because of the following reasons:

-

the AIT's are calculated for a pressure of 20 MPa, whereas the maximum pressure in the plant is 16,3 MPa. the AIT's are determined in air, whereas the oxygen concentration in the plant is lower. the AIT's are determined in a spherical vessel, which gives the lowest AIT values. In vessels with a higher surface to volume ratio, e.g. the cylindrical pool reactor, the AIT values will be higher.

797

- the AIT's of the multi-fuel mixtures tend to level of at a pressure above 1000 kPa, e.g. Fig. 7 and Fig. 10. The Semenov correlations based on low pressure measurements will therefore give underestimated AIT values. Finally, as the maximum temperature in a urea plant is 185"C, which is lower than the calculated AIT, direct auto-ignition will most probably not occur in a urea plant.

5. CONCLUSION In order to evaluate the auto-ignition hazard in urea plants, experiments were conducted to define the auto-ignition limits of amrnonidmethanehydrogedair mixtures. The auto-ignition limits were measured for pressures up to 7500 kPa and temperatures up to 550"C, using a 8 dm3 spherical vessel. The experimental results were used to estimate AIT values in the pool reactor and the ammonia scrubber of a urea plant. The estimated values were achieved by extrapolation using the Semenov correlation and the Beerbower relationship. The lowest AIT for the existing mixtures inside the urea plant is calculated to be 242"C, which is higher than the maximum temperature in the plant. Based on these calculations, direct auto-ignition can be excluded as a possible ignition hazard in the urea plants.

REFERENCES B. P. Mullins, Spontaneous ignition of liquid fuels, Butterworths Scientific Publications, London, 1955. BS 4056: Method of test for ignition temperature of gases and vapours, British Standard Institution, 1966. M. Caron, M. Goethals, G. De Smedt, J. Berghmans, S . Vliegen, E. Van ' t Oost, A. van den Aarssen, J. Hazard. Mater. 65 (1999) 233. M. R. Chandraratna and J. F. Griffiths, Combust. Flame 99 (1994) 626. J. U. Steinle, E. U. Franck, Ber. Bunsenges. Phys. Chem. 99 (1995) 66. T. J. Snee, Loss Prevention Bulletin 081 (1988) 25. D. Kong, R. K. Eckhoff, F. Alfert, J. Hazard. Mater. 40 (1995) 69. J. F. Griffiths, D. Coppersthwaite, C. H. Phillips, C. K. Westbrook and W. J. Pitz, Twenty-Third Symposium (International) on Combustion, The Combustion Institute, Pittsburgh, 1990, pp. 1745. C.F. Cullis and C. D. Foster, Combust. Flame 23 (1974) 347. N. P. Setchkin, J. Res. Natl. Bur. Stand., Res. Pap. 2516,53 (1954) 49. J. Bond, Sources of Ignition, Flammability Characteristics of chemicals and products, Butterworth Heinemann, Oxford, 1991. G. M. Panchenkov, V. V. Malyshev, V. V. Makarenkov et al., Russian Journal of Physical Chemistry 46 (1972) 1303. I. Glassman, Combustion, Academic Press Inc., Orlando, 1987. R. D. Coffee, Chem. Eng. Prog. Loss Prev. 13 (1980) 74.

This Page Intentionally Left Blank

799

Review of recent results, trends and regulations affecting the assessment of electrostatic ignition hazards in industry M. Glor Institute of Safety & Security, WKL-32.3.0 1, CH-4002 Basel, Switzerland Summary Although nowadays those electrostatic phenomena that give rise to ignition hazards in industrial practice are generally well known, fires and explosions continue to be triggered by the accumulation of electrostatic charge. This paper presents various reasons why this should be so, and draws attention to the conflicts of interest which arise when other requirements need to be met. Current trends and new results are examined, especially in the field of bulk materials handling and packaging systems. In addition, the consequences of the Directives issued at European level are appraised. 1.

Introduction

In the present-day process industries fires and explosions continue to be triggered by ignition hazards due to the accumulation of electrostatic charge. There are a variety of reasons why this is the case: 1. The accumulation of electrostatic charge by products and equipment is in many cases directly associated with the processes and operations involved in industrial production. It represents a source of ignition that can be hazardous even under normal circumstances, i.e. without any kind of plant upset occurring, but also under abnormal conditions. 2. Often the measures taken to prevent electrostatic charge accumulation are of an organizational nature, such as ensuring that transportable equipment or containers are grounded. The reliability of these measures is therefore highly susceptible to possible human error. 3. The phenomena of electrostatics, for example electrostatic induction, are not always easy to understand and therefore predict. An assessment of the dangers due to the accumulation of electrostatic charge requires a fundamental knowledge of physics plus experience in a process industry. 4. These two requirements mean that all personnel, from the operators in the plant to the engineers and chemists, must be highly qualified. It is often

800

difficult to ensure that such qualification levels are maintained, especially in times of rapid change in both human resources and corporate structures. 5 . The measures taken to prevent ignition hazards due to electrostatic charge accumulation often come into conflict with other requirements and objectives, such as compliance with GMP (Good Mamfacturing Practice), environmental protection, accident prevention, productivity, profitability, etc. 6. Changes are often made to the process and equipment or hnovations introduced without taking into account the consequences in terms of electrostatic charge accumulation and the ignition hazards posed by electrostatic phenomena. 7. Nowadays it is only in very rare cases that an incident must be attributed to some previously unknown electrostatic phenomenon. The most recently identified new phenomenon with a broad impact on the process industries is the occurrence of so-called cone discharges when silos and containers are filled with bulk materials. Investigations into this phenomenon date from the 1990s [l]. 8. In incident investigations, the source of ignition is still frequently attributed to electrostatics purely because no evidence of any other plausible source of ignition can be found. This type of approach is very dangerous, since any measures taken on the basis of these findings may prove to be neither appropriate nor far-reaching enough. The following sections examine the factors outlined above, citing practical examples, and review the impact of European Standards and Directives on the assessment of electrostatics as an ignition hazard. 2.

Trends and new results

2.1. Handling of bulk materials To assess the ignition hazards due to the accumulation of electrostatic charge in the industrial-scale handling of bulk materials it is necessary to know the minimum ignition energy of the dust cloud and the resistivity of the stored bulk materials. This applies particularly when assessing the ignition hazards due to cone discharges [l]. The CENELEC report [2] also pays due regard to minimum ignition energy and resistivity of bulk materials. Modem measurement methods have resulted in an increasing number of dusts being identified as having high ignition sensitivities [3]. A review of incidents occurring in the last 20 years shows that when bulk materials with a minimum ignition energy of less than 10 mJ are handled and processed on an industrial scale, it is as a rule not sufficient to preclude all effective sources of ignition as the sole protective measure. The subject of the incendivity of brush discharges for pure dusts has to date not yet been clarified definitively. This question arose in the past after it was found that the equivalent energy of brush discharges determined with gases was of the

801

same order as the minimum ignition energy of some dusts [4]. Despite this, even the latest experimental results [5] and incident reports concerning this subject indicate that an ignition hazard is not to be expected. An explanation for this is offered by the differing temporal and spatial distributions of energy in brush discharges and spark discharges. These findings no longer hold true, however, if small amounts of flammable gases or vapors are present in the dust cloud, thus forming so-called hybrid mixtures. It is known that such low proportions of gas or vapor even at only fractions of the lower explosion limit can have a significant effect on the minimum ignition energy of the pure dust [6].Ignition due to a brush discharge can then no longer be excluded with certainty.

2.2 Packaging materials In many situations the wrong use of packaging materials and their incorrect handling have resulted in fires and explosions. Apart from the problems associated with grounding, the use of plastics that accumulate electrostatic charge for packaging materials continues to cause controversy. Brush discharges, which are incendive for gases and vapors, can originate from packaging materials of this type. To date no one has succeeded in developing an antistatic additive for commonly used polymers, such as polyethylene and polypropylene, that permanently and independently of environmental humidity reduces the surface resistance to a value of 18to 10" ohms and the resistivity to about 10' ohmm, and in addition has the following properties: the transparency and weldability of the polymer remain unaffected, there is no contamination of the container contents, manufacturing and incorporation in the polymer are simple and inexpensive. The techniques that are available at present, such as mixing in antistatic additives before the polymer is extruded or adding carbon particles, do not comply with the requirements stated above. 2.2.1 FIBCs The use of FIBCs (flexible intermediate bulk containers) in industry for bulk materials continues to increase. In the past, they have been the cause of several fires and explosions [7]. The required specifications for FIBCs differ according to the duty involved, and they are usually classified into Types A, B and C [2,8], the properties assessed being the breakdown voltage through the wall of the container and the leakage resistance fiom the surface of the FIBC to the grounding point. Recently a new type of FIBC has been developed which is often referred to as Type D FIBC. It is manufactured in such a way that it should release its charges without being earthed by the mechanism of corona discharges. More details on the electrostatic ignition hazards associated with FIBCs are described in a special paper on FIBCs presented at this conference.

802

2.2.2. IBC Another increasingly popular means of shipping liquids, including flammable ones, is the IBC (intermediate bulk container). This has an inner plastic container which is surrounded by a metal outer enclosure or cage for protection and mechanical support. The potential ignition hazards remaining after grounding the metal components originate firstly in the plastic inner container and secondly in the electrostatically charged liquid. The following critical parameters in terms of the electrostatic ignition hazards are: ' Surface resistance of the plastic container Size of the charge-accumulating surface within the cage mesh Distance of the plastic surface from the metal enclosure or cage mesh (also taking into account any changes in pressure within the IBC) Wall thickness of the plastic container Leakage resistance of the liquid to the grounded metal enclosure or cage From existing guidance and recommendations [2] it can be concluded that for substances requiring apparatus groups IIA and IIB, assuming Zone 0 conditions inside the container and Zone 1 outside it, either the surface resistance of the plastic inner container must be limited to ld ohms at 23°C and 50 % relative humidity, or all the following conditions must be complied with: Maximum 2 mm wall thickness of the plastic container Maximum allowable surface area within the cage mesh 25 c d Metal cage or enclosure in close contact with the surface of the inner container. In addition it must be ensured, preferably by means of a grounded conductive bottom outlet valve, that the leakage resistance at at least one point inside the container does not exceed 1d ohms.

.

..

. .

2.2.3. Aluminum-laminated PE bags Aluminum-laminated PE bags offer a very good vapor barrier, the reason why these bags are used for bulk materials that are susceptible to moisture. The layer of aluminum is extremely thin, and as a rule is protected on each side by a layer of polyethylene. As a result of this, the aluminum layer cannot be reliably grounded without destroying the integrity of the polyethylene layer and hence the imperviousness of the bag. The author is aware of several cases where spark discharges were observed while bulk materials were being filled into alumhumlaminated PE bags. In one incident this resulted in the ignition of an explosive atmosphere. Even simple calculations show that when filling small quantities of electrostatically charged product into an ungrounded aluminum-laminated bag spark discharges can occur, which can ignite not only gases and vapors but also ignition-sensitive dusts. From Fig. 1 it can be seen that the accumulated energy is largely determined by the electrostatic charge of the product and the capacitance of the bag. The bag capacitance does not depend so much on its volume as on the way it is supported and its distance away from grounded

803

Fig. 1

The energy accumulated by an ungrounded aluminum-laminated plastic bag after being filled with a product which has been electrostatically charged by the filling process. Electrostatic charges of to C k g as shown in the charts are typical for filling processes taking place under gravity [2].

804

conductive plant surfaces. For example, the capacitance of a bag with a volume of some 25 liters is about lOpF if it is held at a distance of approximately l m from grounded conductive surfaces on all sides, but this rises to about 1O@F if it is in close contact with a grounded metal filling spout over a length of several centimeters. To ground aluminum-laminated plastic bags it is necessary to attach a grounding clamp with tight-gripping, sharply pointed jaws to the bag wall. A plastic layer of adequate bulk conductivity would also be a practical proposition in this application, since it would then no longer be necessary to perforate the bag, the aluminum layer being grounded with a normal grounding clamp or by providing a grounded metal surface to support the bag wall. 2.3 Conflicting objectives Measures are often taken for reasons of environmental protection, occupational safety, quality assurance, productivity, etc. which are instrumental in achieving objectives in these areas, but result in increased ignition hazards due to the accumulation of electrostatic charge. Typical examples of these are: 1. Solvent-laden exhaust air, which in the past was discharged to atmosphere as diluted as possible, is today collected in as concentrated a form as possible. This potentially explosive mixture is then led, often through plastic piping, to a central off-gas treatment system. 2. For reasons of occupational hygiene and environmental protection there is a growing trend to collect dust in local filters, in which clouds of fine dust particles can form a potentially explosive atmosphere, especially during filter shaking. If there is inadequate grounding of components such as the filter support elements, the dust cloud can be ignited by the electrostatic charge accumulated in the shaking operation. 3. The concrete surfaces of filling station forecourts, which actually conduct electricity quite well, are often provided with an insulating layer to protect the ground water against contamination in the case of a fuel spillage. Although car wheels are usually conductive, this insulating layer in the concrete means that grounding of the vehicles is not assured. When the pump nozzle is moved towards the car's filler pipe, a spark discharge can take place in exactly that location where a potentially expbsive mixture may be present. 4. Plastic hard hats are worn for head protection in the chemical industry, even in hazardous zones, where in principle they can cause incendive discharges. 5. The cleanroom garments required when working in GMP-compliant areas, in particular the boot covers, prevent the wearer fiom being reliably grounded, even though the flooring may be adequately conductive. 6. Corrosion protection measures such as painting, other surface coatings and the glass linings of piping prevent reliable potential equalization and grounding of flanges and pipe spools. In extreme cases the accumulation of electrostatic charge and the resultant breakdowns can even negate the

805

original purpose of the coating. Examples of this are the damaged glass linings in reactor vessels [9] and the breakdown of PTFE linings in process piping. 7. The use of aluminum-laminated plastic bags as described in Section 2.2.3 is another example of two conflicting objectives, i.e. product qmlity requirements and the prevention of ignition hazards. It must be decided on a case-by-case basis which of the objectives or protective goals takes precedence, and what additional measures if any are necessary. There are also situations in which conflicting objectives regarding the measures taken to prevent ignition hazards due to the accumulation of electrostatic charge arise, and through which several explosions have occurred in the last two years, some of them severe. In operations such as taking a sample from a reactor vessel containing a flammable solvent, discharging solids still moist with solvent from a centrifuge or removing product heel from a centrifuge, the question arises as to which material is the most suitable for the sampling device, scoops or spatulas to be used. The conflicting objectives arise because if a grounded conductive sampling device or scoop is used, when this approaches the product, brush discharges can emanate from the electrostatically charged product. If on the other hand an insulating material is used, brush discharges can originate from the surface of the implement concerned. The selection of the most suitable material depends ultimately on the probability of an explosive atmosphere and an incendive electrostatic discharge occurring simultaneously. An assessment of this probability depends in turn on numerous individual factors such as the conductivity of the liquid or the bulk material still moist with solvent, the effectiveness of the inert gas blanketing during the manual intervention, the vapor pressure (over-rich mixture) of the solvent at the working tmperature, etc. Fig. 2 illustrates two possible locations where ignition could occur, depending on which components are electrostatically charged. In the case of a conductive, not electrostatically charged liquid (or bulk solid moist with solvent), a grounded conductive sampling device or scoop is preferable. In the situation with a highly charged insulating product the question arises as to how reliably the inert gas blanketing or over-rich mixture - in the case of a solvent with a very low flash point - can be ensured above the surface of the product. If this can be achieved, a grounded conductive sampling device or scoop should also be used in this case. A plastic sampling device or scoop is preferable, however, if the product is highly charged from the operation and a potentially explosive atmosphere directly above the surface of the liquid must be expected. In this case the surfaces that can accumulate charge must be kept as small as possible, and the implements must not be charged before they are used (for example by wiping them).

806

3.

Directives and standards

The European Directive 1994/9/EC, also known as ATEX 1OOa [ 101, applies to equipment and protective systems intended for use in potentially explosive atmospheres. It states that not only must electrical expbsion protection be taken into account, but all other possible sources of ignition must also be prevented. In this context the ignition hazards due to electrostatic charge accumulation are also given explicitly. In addition to the important requirements for potential equalization for all conductive components, special attention must also be paid to limiting the surfaces than can accumulate charge. This limitation depends on the equipment category, and hence in which area (zone, expbsion group of the substances present) the equipment or protective system is used (see Tablel).

Fig. 2

a) Ignition by a brush discharge from the highly charged liquid to the grounded conductive sampling beaker. b) Ignition by a brush discharge from the electrostatically charged insulating sampling device to the rim of the filling nozzle.

The European Directive 1999/92/EC, also known as ATEX 137[14], describes the minimum requirements for improving the occupational health and safety of workers at risk from potentially explosive atmospheres. It sets out the obligations of employers to provide secondary expbsion protection (preventing the ignition of potentially explosive atmospheres), great importance being attached to electrostatics as a possible source of ignition. In their stipulations concerning the prevention of sources of ignition in hazardous areas both the 1994/9/EC and the 1999/92/EC Directives refer to the probabilities of a potentially explosive atmosphere and a source of ignition being present at the same time and place. This conceptual approach ultimately leads to hazardous areas being classified into zones, and equipment and protective systems into equipment groups. This makes sense provided that the

807

simultaneous occurrence of an explosive atmosphere and a source of ignition is purely coincidental and not causally linked. In the case of ignition hazards caused by the accumulation of electrostatic charge this assumption does not always hold true. Taking the many product transfer operations that are carried out open to the atmosphere as example, the formation of an explosive atmosphere and the accumulation of high levels of electrostatic charge necessarily occur at the same time and place. Special attention must be given to this fact when planning preventive measures. Table 1

Limitations on surface area and coating thickness to prevent incendive brush discharges emanating from charge-accumulating surfaces [ l l - 131 (surface resistance > 1 G R measured at 23 +2 “C and 50 +S % relative humidity) Surface area limitations for charge-accumulating solid surfaces (4

Permissible surface area in cm2(The figures in parentheses apply when the surface is surrounded by a grounded conductive frame.)

Hazardous zone

50

1 I

100 (400)

I

GroupIIA

Category 1 (ZoneO)

I

Category 3 (Zone 2:’ )

I

Group IIB

I

GroupIIC

25

1

4

100 (400)

1

20 (100)

Permissible diameter

Hazardous zone

in mm

Category 1 (Zone 0)

Group IIA 3

Group IIB 3

Group IIC 1

Category 2 (Zone 1)

30*’

30%’

20:’

Category 3 (Zone 2)

no limit*’

no limit*’

no limit*’

CENELEC Report RO44-001 [2] was published in 1999 as a Technical Report, thus having the status of a recommendation and orientation aid. It is based on various national and industry-specific codes of practice [lS- 171. Major new considerations not covered by these standards impact on the handling of bulk

808

materials by taking into account the phenomenon of cone discharges. Information on this subject is summarized in Section 2.1, which covers the problems associated with bulk materials.

References [l] [2] [3] [4] [5] [6] [7] [8] [9]

[ 101 [ 111 [12] [13] [ 141

[ 151 [ 161 [ 171

M. Glor and B. Maurer, Journal of Electrostatics, 40 (1993) 123 CENELEC Report R044-001 “Safety of machinery - Guidance and recommendations for the avoidance ofhazards due to static electricity” 1999 R. Siwek and C. Cesana, Process Safety Progress, 14 (1995) 107 M. Glor, Journal ofElectrostatics, 10 (1981) 327 M. Glor and K. Schwenzfeuer, Journal of Electrostatics, 40 & 41 (1997) 383 W. Bartknecht, Explosionsschutz - Grundlagen and Anwendung, Springer-Verlag, Berlin Heidelberg New York 1993 L.G. Britton, Process Safety Progress, 12,4 (1993) 241 - 250 M. Glor, B. Maurer and R. Rogers, Proceedings of the Conference on Loss Prevention and Safety Promotion in the Process Industries, published by Elsevier Science B.V., Volume 1 (1995) 2 19 B. Maurer, Journal of Electrostatics, 40 & 41 (1997) 517 Directive 1994/9/EC of the European Parliament and the Council of 23 March 1994 on the approximation of the laws of the Member States concerning equipment and protective systems intended for use in potentially explosive atmospheres EN 50014:1992 Section 7.3 prEN 50284:1997 Section 4.4 EN50021 Directive 1999/92/ECof the European Parliament and of the Council of 16 December 1999 on minimum requirements for improving the safety and health protection of workers potentially at risk from explosive atmospheres Richtlinien fiir die Vermeidung von Zundgefahren infolge elektrostatischer Aufladungen (Static Electricity Guideline), Institution for Statutory Accident Insurance and Prevention in the Chemical Industry, Heidelberg, Guideline No. 4, 1989 Code of Practice for Control of Undesirable Static Electricity. B.S. 5958, Parts 1 and 2, British Standards Institution, London, 1991 Static Electricity - Technical and safety aspects: a document published by Shell International Petroleum in 1988

809

IDENTIFICATION OF AUTOCATALYTIC DECOMPOSITIONS BY DIFFERENTIAL SCANNING CALORIMETRY Leila Bou-Diab and Hans Fierz Swiss Institute for the Promotion of Safety and Security, Klybeckstrasse 141, CH-4002 Basel, Switzerland A screening method based on dynamic DSC measurements for the identification of autocatalytic decompositions is presented in this work. The method consists of fitting a first order kinetic model to the measured heat release rate curve (dynamic DSC measurement) and determining the apparent activation energy. If the apparent activation energy is higher than 220 kJ/mol, the decomposition is autocatalytic. The proposed method has been applied to 100 autocatalytic and non autocatalytic reactions. The reliability of the method was tested by performing isothermal DSC measurements. The new method can not be applied in cases where the decomposition under investigation is directly preceded by an endothermal signal, and has to be used very carefully in case of consecutive reactions. 1 INTRODUCTION

Traditionally, risk is defined by the product of the severity of a potential incident and its probability of occurrence. Hence, risk assessment results in the evaluation of both, the severity and the probability. The thermal risk linked to a chemical reaction is the risk of loss of the control of the reaction and of triggering a runaway reaction [I]. In the chemical industry, estimation methods based on dynamic DSC measurements have been developed for a preliminary screening of such a risk at an early stage of the chemical process. The energy of reaction or decomposition is directly correlated to the severity i.e. the potential of destruction of a runaway reaction. The energies can be measured using Differential Scanning Calorimetry

810

(DSC), in which the temperature of the oven is increased linearly over time. From the obtained energies of reaction and decomposition, it is possible to calculate the corresponding adiabatic temperature rise used to assess the severity of a potential incident. The probability of occurrence of an incident can be estimated using the time to maximum rate under adiabatic conditions (TMR,d). Keller et al. [2] developed a method for the estimation of the TMRd, relying also on dynamic DSC measurements. This model will be described later.

Another important point for the assessment of thermal risk is the identification of autocatalytic reactions. This type of reactions requires our special attention and should be clearly distinguished from nthorder reactions. A screening method for the identification of autocatalytic decompositions is presented. The reliability of this method was tested on 100 autocatalytic and non autocatalytic reactions. 2

CHARACTERISTICS OF AUTOCATALYTIC REACTIONS

In autocatalytic reactions the observed rate of reaction is found to increase with conversion. An autocatalytic reaction is by definition a reaction in which a product catalyses its own formation. Thus, the term "autocatalytic" refers to a molecular reaction mechanism. The exact mechanism is usually not known for decompositions. The term "autocatalytic" used in this paper stands for the formal description of autocatalysis and is therefore not used in its proper sense. Such a reaction can often be formally represented by a Prout-Tompkins mechanism [3] involving two parallel steps. A first step (a), in which the autocatalyst B (B is assumed to be identical to the final product) is formed from the reactant A (first order reaction), and second (b), an autocatalytic reaction of A and B (second order reaction) which produces the final product:

A+Bk"_\2B At constant temperature the heat release rate of an nth order reaction decreases uniformly with time, whereas autocatalytic reactions show an acceleration of reaction rate with time and conversion (Fig. 1). The corresponding heat release rate passes through a maximum and then decreases again. The maximum can be characterised by its so called isothermal induction time.

811

reaction

Time Fig. 1. Heat release rate curve as a f i c t i o n of time for autocatalytic and nth order reaction under isothermal conditions.

In case of runaway, where it is assumed that there is no heat exchange with the environment (adiabatic conditions), and the heat released will cause a temperature increase, these two types of reactions will lead to totally different temperature versus time curves (Fig. 2): for nth order reactions the temperature increase starts immediately after the cooling failure, while in the case of autocatalytic decompositions, the temperature remains stable during the induction period and then suddenly increases very sharply [4]. This difference in behaviour has some important consequences for the design of emergency measures for runaway reactions. For example, a technical measure to prevent a runaway could be a temperature alarm. This works well for decomposition reactions following a n* order kinetic law. However, autocatalytic reactions are not only accelerated by temperature, but also by conversion. Therefore a temperature alarm is not effective in this case, since the temperature increase can only be detected very late, at a time, where the temperature increase is so sharp that no measure can be taken anymore (Fig. 2).

812

T

Temperature

Temperature level fo

Fig. 2. Temperature versus time curves for autocatalytic and n* order reaction under adiabatic conditions.

Autocatalytic reactions are also catalysed by impurities such as peroxides, rust, heavy metals or acids [5]. The amount and the type of impurity depends on the supplier, the quality level of the product and in some cases also on the production batch. Inconstant quality of products can dramatically change the decomposition characteristics. For example a nitro compound, which has been investigated over 20 years by our laboratory because of its tendency to decompose by an autocatalytic mechanism has shown considerable variation in its isothermal induction time (Table 1). Table 1

Consequences of inconstant quality of a nitro compound (decomposing with an autocatalytic mechanism) as measured in our laboratory over 20 years. The isothermal induction time has been measured by isothermal DSC measurement at 160 "C.

Isothermal induction time [min]

Year 1976

Year 1983

Year 1996

205

126

120

813

2.

METHODS FOR IDENTIFICATION OF AUTOCATALYTIC REACTIONS

Autocatalytic decompositions occur with many sorts of substances, organic as well as inorganic ones. Certain classes of compounds as for example aromatic nitro compounds, chlorinated aromatic amines or cyanuric chloride are known to decompose by an autocatalytic mechanism. A list of compounds decomposing with an autocatalytic mechanism can be found in the literature [6]. Experimentally, the most reliable way to detect and characterise autocatalytic decompositions is to record the decomposition rate as hnction of time, while the temperature is kept constant. An isothermal DSC measurement for example immediately identifies autocatalytic decomposition behaviour. Wheras isothermal DSC measurements are not common and can be very time consuming, dynamic, i.e. temperature programmed DSC measurements are widely used as a screening tool in industry. Therefore, an identification tool for autocatalytic reactions based on dynamic DSC would be of great advantage. Keller et al. [2] presented a model based on a zero order Arrhenius model for the estimation of the time to maximum rate from non-isothermal DSC measurements. Recently, PastrC et al. [7] have shown on the basis of Dewar experiments that the method presented by Keller indeed gives results on the conservative side, no matter whether the reactions involved are autocatalytic or not. The development presented above is part of the work of Keller. Assuming an Arrhenius model, the heat release rate q(T) for a zero order reaction can be calculated at a given temperature T according to the following equation:

Where E, is the activation energy, To is the onset temperature and is defined as the temperature at which the heat rate signal can first be differentiated from the baseline temperature reading and q,, the heat release rate at the onset temperature which depends on the sensitivity of the instrument and is usually between 1-20 Wkg. By taking a value of 50 kJ/mol for the activation energy, the heat release at lower temperatures can be determined. For a zero order reaction, the following expression for the TMRd at a given temperature may be derived:

814

Where cp is the heat capacity and R the gas constant. Using equations (1) and (2) a TMRd value can be extrapolated to lower temperatures. As the extrapolation is based on a low value for the activation energy E, (never encountered for decomposition reactions), the calculated heat release rate is too high and the resulting TMR,d too short and therefore on the conservative side. This estimation method is based on the assumption that conversion which influences the reaction rate can be neglected. In the case of autocatalytic reactions the reaction rate is strongly influenced by the concentration of the formed product. Extrapolation to lower temperature needs therefore not only an estimation of the heat release rate, but also of conversion at a given temperature. Furthermore, this approach assumes that a DSC measurement is representative for the thermal behaviour of a substance, since the kinetics of decomposition is a physicochemical property of a given compound. Therefore it is not supposed to vary. This is theoretically correct. However in case of an autocatalytic decomposition, it can be difficult to find a representative sample of the compound, since these decompositions are often catalysed by impurities, which are not a property of a given compound, and often vary significantly depending on the origin and prehistory of a given sample. If the decomposition of a batch happens to start at lower temperatures than the analysed sample, the method of Keller is not conservative anymore. Therefore it was thought necessary to develop a reliable method for the identification of autocatalytic decompositions.

3 NEW SCREENING METHOD FOR AUTOCATALYTIC DECOMPOSITIONS

IDENTIFICATION

OF

As mentioned above, industrial screening methods are based on dynamic DSC measurements. In case of autocatalytic decompositions, these measurements usually show narrow signals with high heat release rate maxima and high potentials. It was found that an experienced person could identify such decompositions by their characteristic signal shape. Therefore, it seemed possible to develop an reliable autocatalytic screening tool recognising signals of the described size and shape. A quantitative method would be to characterise dynamic DSC curves of autocatalytic decompositions by their peak height and width. Another possibility

815

would consist of fitting the measured curve to a simulated one and find a characteristic parameter to identify autocatalytic reactions. This method was chosen in this work. In the past, DSC software was developed to determine the kinetic data of a reaction on the basis of dynamic measurement by using a first order kinetic model. This fitting procedure gave in many cases unreasonable kinetic parameters. Autocatalytic decompositions will give very high activation energies [2]. As with this type of reaction the heat release rate increases not only with temperature, but also with conversion, high apparent values of activation energies are no surprise. Based on these considerations a new method for identification of autocatalytic decompositions was developed, where a simulated DSC curve based on first order kinetics was fitted to the measured heat release rate curve from a dynamic DSC. The signal-baseline must either be known or be based on a reasonable assumption. The heat release rate q(T) for a first order mechanism assuming an Arrhenius model is given by Eq. (3) where Eq. (1) has to be multiplied by a conversion term.

Where

M(t)

is the partial reaction enthalpy at a given time t, mRthe global the conversion.

reaction enthalpy and the ratio M

R

For a temperature-programmed measurement, the temperature is defined by the following equation:

Where Tstmis the start temperature of the measurement and a a constant heating rate in Ws. Eq. (3) using the tempearture function Eq. (4) can only be integrated numerically (see Appendix). Using this simulation, the apparent activation energy of the measured curve can be deduced. The apparent activation energy served as criterion to determine whether a decomposition was autocatalytic or not. The validity of this criterion was verified by measuring isothermal DSC’s of the same substances, because using these the autocatalytic behaviour can be corroborated. The following figures illustrate the influence of the different parameters on the simulation results.

816

$ 2500 u

g 1500

I

4

8 1000

c

8

500 100

150

200

250

Temperature [“C]

Fig. 3. Representation of an ideal fitting with the corresponding onset temperature and apparent activation energy.

100

150

200

250

Temperature [“C]

Fig. 4.Influence of the apparent activation energy on the simulated curve.

-$

3000

3

2000

-

2500

-88

1500

3

$

u

8

1000 500

0 100

150

200

Temperature [“C]

Fig. 5. Influence of the onset temperature on the simulated curve.

250

817

4

EXPERIMENTAL

The kinetic model was written as spreadsheet (MS-Excel@). For the general applicability of the method, the following approach was chosen: The dynamic DSC-measurements were not required to exist as ASCII-files, but they usually existed as graphs (from e.g. a scanner) and were imported in bitmap form where they formed a background picture to the Excel graphics showing the simulated curve. By varying the parameters of the simulation the simulated and the measured curves could be superposed. Sloping baselines could also be corrected. As the fitting is made on a visual basis, an error margin of 10 % has to be taken into account. During the study, it became clear that the border value of the apparent activation energy distinguishing between autocatalytic and non autocatalytic reactions was around 200 kJ/mol. According to that the examples were chosen to narrow this limit. Therefore the distribution of the obtained activation energies was not representative of the real distribution in industry. In order to determine this real distribution, a second study involving 100 other cases from the fine chemical industry was made and is presented below. 5

RESULTS

The proposed method was tested with 100 substances known to decompose by nth order and autocatalytic pathways. The obtained results are summarised in Table 2. Table 2

Classification of nthorder mechanism and autocatalytic mechanism according to the apparent activation energy.

Apparent activation energy rkJ/rnoll

Non autocatalytic mechanism

Autocatalytic mechanism

Exceptions

50-180

220- 1000

140, 145, 120

818

Thus a general tendency was observed: the method delivered reliable results with 97 % of the cases. However some exceptions (3 %) were found and are discussed below: -

When an endothermic process precedes the exothermic decomposition, no fitting was possible (Fig. 6), since the real onset of the exothermic reaction necessary to perform the fit could not be determined. Therefore the method could not be applied in those cases. However, it is known that decompositions from the melt have a formally autocatalytic decomposition mechanism. Problems may also occur with consecutive reactions, where the autocatalytic reaction is preceded by an nth order reaction. By fitting the curve, the calculated apparent activation energy will reflect the first reaction which is nthorder and not the autocatalytic one (Fig. 7).

1000

y

I

Simulated measured curye

500 0

-500

5p

100

150

20b1

250

300

3$0

- 1000

-1500 Temperature ["C] Fig. 6. Fit procedure in case when the exothermicity is preceded by an endothermal effect.

819

-

5000

D l

'z 4000 L

3000

%

Second reaction

-g 2000

\

2

g

4-0

I

1000

first reaction

0

0

100

200

300

400

500

Temperature ["C] Fig.7. DSC mesurement with more than one exothermal peak.

In the 100 examples analysed, this case was encountered three times. However, it is important to notice that in these three cases, the dynamic DSC measurement clearly pointed out the presence of several reactions causing different well distinguishable peaks. The proposed method is a rapid and easily applicable tool and allows us to differentiate between autocatalytic and non-autocatalytic decompositions. The error margin in the determination of the apparent activation energies of 10 % is important for borderline cases with apparent activation energies lying between 180-220 kJ/mol. For safety reasons, we recommend the application of isothermal DSC measurements if the activation energies are found to lie within 180-220 kJ/mol. Another statistical study involving 100 fine chemicals chosen at random and commonly used in the industry showed that 20 % of the analysed substances had apparent activation energies between 180-220 kJ/mol and that 60 % of the decompositions had activation energies higher than 220 kJ/mol and were thus considered to be autocatalytic.

820

6 CONCLUSION

A new method for the identification of autocatalytic decompositions was tested on 100 compounds. For apparent activation energies (obtained by fitting a first order kinetic model on the measured heat release rate of a dynamic DSC) higher than 220 kJ/mol the decomposition was shown to be autocatalytic. The method is not applicable in cases where the exothermal signal is directly preceded by an endothermal signal. The method has to be used with care when serial reactions occur (several peacks can be distinguished in the thennogram). REFERENCES [ l ] F. Stoessel, Chemical Engineering Progress, 10 (1993) 68. [2] A. Keller, D. Stark, H. Fierz, E. Heinzle and K. Hungerbiihler, Journal of Loss Prevention in the Process Industries, 10 (1997) 3 1. [3] E.G. Prout, F.C. Tompkins, Trans. Faraday SOC.,40 (1994) 40 [4] J-M. Dien, H. Fierz, F. Stoessel and G. Kill&,Chimia, 48 (1994) 542. [ 5 ] T. Grewer, Thermal Hazards of Chemical Reactions, Elsevier, Amsterdam, 1994. [6] F. Brogli, P. Grimm, M. Meyer and H. Zubler, 3'd Intemat. Sympos. Loss Prevention, Swiss SOC.Chem. Ind. Basel. [7] J. PastrB, U. Worsdorfer, A. Keller, K. Hungerbiihler, Journal of Loss Prevention in the Process Industries, 13 (2000) 7.

NOMENCLATURE Heat capacity Differential Scanning Calorimetry Activation energy Heat release Rate Heat release rate at the onset temperature Ideal gas constant Temperature Onset temperature Start temperature of a DSC measurement Constant heating rate time Time increment Time to maximum rate under adiabatic conditions Total reaction enthalpy Partial reaction enthalpy Approximation of the partial reaction enthalpy

82 1

APPENDIX For the numerical simulation of the DSC curve the value of the heat release rate at a time t + At is needed and can be given by:

However the value of the specific heat of the reaction at t + At is unknown. A first approximation (Euler) is used to evaluate this value. The approximated value is given by AH*(t+ At) and can be expressed by: M*

(t + ~ t= m(t)+ ) q(t).~t

(6)

By replacing AH (t + At) by its approximation we get:

Knowing the value of the heat release rate at t + At a better approximation of the specific heat of the reaction at t + At can be calculated (trapezoid integration) : At ~~(t+~t)=(q(t)+q(t+~t)).2

(8)

Eq. (8) of the heat of reaction at t + At is then introduced into Eq. ( 5 ) describing the heat release rate at t + At and the simulated curve is then calculated.

This Page Intentionally Left Blank

823

Flame Arrester Testing and Qualification in Europe H. Forster Physikalisch-Technische Bundesanstalt, Bundesallee 100, 3 8 1 16 Braunschweig, Germany

1. INTRODUCTION Flame arresters are safety devices fitted to openings of enclosures or to pipework, which are intended to allow flow but to prevent flame transmission. They have widely been used for decades in the chemical and oil industry, and national standards for testing and use are available[ 1,2, 3, 4, 51. The development of the single European Market, here especially launched by EC Directive 94/9/EC, the so-called ATEX 100 Directive [6], requires harmonisation of the certification procedures and technical requirements also for flame arresters. This work started about ten years ago and has found a certain finalisation in the draft European standard pr EN 12874 “Flame arresters, Performance requirements, test methods and limits for use” [7]. This draft standard reflects the European state of the art in this field. The Directive 94/9/EC covers flame arresters under the term “autonomous protective systems”. The formal procedures go back to Annex I11 “Module: ECType Examination” and Annex IV “Module: Production Quality Assurance” of the said Directive. These combined requirements are most stringent: The manufacturer needs certification not only for his product but also for his production quality system. The certificates have to be issued by an independent third party, the so-called “Notified Body”. With respect to the technical requirements, the “Essential Health and Safety Requirements (EHSR)” in Annex I1 of the said Directive have to be complied with. These requirements are of a rather general nature. The necessary technical specification is laid down in the draft European standard pr EN 12874 which is mandated under the Directive 94/9/EC. This mandate means that a flame

824

arrester will be supposed to comply with the EHSR if it complies with the standard. According to its title, the draft standard addresses manufacturers (performance requirements), notified bodies (test methods) and customers (limits for use). It covers application under atmospheric conditions as specified by the Directive but extends also to slightly higher pressures (1.6 bar abs) and temperatures (150 "C) for static arresters (see below). The scope does not cover external safety-related measurement and control equipment or mixtures with self-decomposing fuels and of non-atmospheric oxygen concentrations. 2. HAZARDS AND FLAME ARRESTER CLASSIFICATION

2.1 Propagating flames For propagating flames the hazards flame arresters have to cope with can (apart from very special cases) basically be described by four situations (see Table 1). Each of these is reflected by a separate standard test procedure and consequently defines a separate class of flame arresters. Table 1

Hazards and flame arrester classification

The different situations are schematically shown in Fig. 1 (end-of-line deflagration arrester), Fig. 2 (pre-volume deflagration arrester) and Fig. 3 (in-line deflagratioddetonation arrester). The difference between in-line deflagration and in-line detonation arrester is merely the tested (installed) run-up length of the flame on the unprotected side: Deflagration arresters are limited to a maximum pipe length of 50 pipe diameters between possible ignition source and arrester; for in-line detonation arresters there is no such limitation.

825

Fig. 1. Application of end-of-line deflagration arrester

Fig. 2. Application of Pre-volume deflagration arrester

Fig. 3. Application of in-line deflagratioddetonation arrester

826

2.2 Stabilised flames While the basic classification relates to hazards from propagating flames, there might be the additional hazard of flame transmission after stabilised burning. This could happen after an explosion when the explosive mixture continues to flow through the arrester as in a Bunsen burner. The associated heating-up of the whole device could result in delayed flame transmission. Flame arresters, which prevent flame transmission for a time period of at least one minute in such situations are classified as safe with respect short-time burning. They have to be equipped (and tested) with an integrated temperature sensor capable of triggering an emergency action within 30 seconds. This action might be stopping the flow or, alternatively, bypassing, diluting or inerting the flowing mixture. Flame arresters, which prevent flame transmission from stabilised burning for an unspecified time, are classified as safe with respect to endurance burning. The corresponding test requires burning until temperature stabilisation results at the arrester; in any case a minimum burning time of two hours is necessary. With regard to the combustion loads, it has to be mentioned that deflagration arresting is an indispensable capability of any flame arrester. The capability of detonation arresting is an additional option which, if present, dominates technically and with respect to the classification. So every detonation arrester also has to prevent flame transmission from deflagrations. In the same way, the capability of withstanding stabilised burning is an additional option: For example, an end-of-line deflagration arrester can be endurance burn safe and then is often simply called an endurance burning flame arrester. In-line detonation arresters often are qualified for short time burning safety (which in this case is not reflected by the name). 2.3 Operating principle Apart from the type of combustion load for which they are suited, flame arresters are also specified by their operating principle. Table 2 lists those types which are now covered by the European draft standard. Static flame arresters are by far the most important and versatile ones, so they will be discussed here in some detail, whereas the specific requirements for the other types can be given only roughly.

827

Flame arrester type Operating principle Quenching the flame in narrow Static flame arrester Producing flow velocities above flame velocity by valve action Producing and monitoring flow velocities above flame velocity by action of external equipment Forming a liquid seal (siphon) by liquid product in a product line Breaking the flow of explosive mixture into discrete bubbles in a water column

Field of application General use

High-velocity vent valve

Tank venting

Flow-controlled aperture

Burner injection, stacks

Liquid product flame arrester Liquid-filled lines Hydraulic flame arrester

In-line use

3. GENERAL REQUIREMENTS In any case the test set-up simulates one of the basic situations identified in the hazard analysis ( Sec. 2, Table 1). The tests are carried out with representative mixtures of the well known explosion groups IIA, IIB and IIC, using a subdivision of IIB as shown in Table 3.

Marking according to pr EN 12874 IIB 1 IIB 1 IIB3 IIB

Maximum Experimental Safe Gap (MESG) of test mixture in mm 2 0.85 2 0.75 10.65 2 0.50

This subdivision reflects the need to combine sufficient quenching capability of static flame arresters with minimum pressure loss, which is fundamental for practical use. The protection “flame proof enclosure” (of electrical equipment) uses the same physical principle but - with a view to practice - may completely neglect the aspect of gas flow through the gaps. The flame arrester standard does not require flameproof gaps of the arrester housing to the outside. The possible risk from flame transmissions through such

828

“gaps” is covered by pressure and leak tests, which are carried out as production tests, and by proper maintenance. 4. SPECIAL ASPECTS AND REQUIREMENTS

4.1 Pressure and temperature conditions According to the draft European standard, all “non-static” flame arresters are tested under conditions where the mixture is under atmospheric pressure at least on one side of the arrester; this agrees with the fields of application (see Table 2, line 2 to 4). The pressure on the other side of the arrester may be slightly higher or lower (maximum about 200 mbar), depending on the set pressure (of a valve) or the height of a water column. So the use of these arresters is limited to “atmospheric” conditions. For in-line static-type flame arresters certification for operating pressures above atmospheric is often requested. Though a practical need for considerably elevated operating pressures cannot be seen, North American standards allow for such a qualification. So the European draft standard - mainly for reasons of competition - also provides the possibility of testing at elevated pressure. The maximum initial pressure in the tests (and for operation) is limited to 1.6 bar absolute. Testing under elevated pressures means indeed a higher load for the flame arresters (safe gap and pressure of the mixture are reciprocally related). In some standards [ 1,2,4] pressure venting during in-line explosion through a bursting diaphragm is allowed. The European draft standard does not provide such an unspecified relief and the test set-up has to remain closed throughout the test.

Fig. 4. Set-up for in-line deflagratioddetonation flame arrester testing

829

This closed system testing according to the schematic set-up in Fig. 4 is certainly more severe than test procedures with pressure relief. The use of a closed test system, possibly with higher pressures, has created a lot of technical problems. One problem which is still unsolved is that none of the existing standards provides test procedures for stabilised burning at elevated pressures. So the use of any in-line arrester with short-time burning or endurance-burning qualification presently is limited to use at atmospheric pressure. This aspect casts additional doubts on the testing at elevated pressures. The European certification under the ATEX 100 Directive is not affected since there is a formal and general limit to atmospheric conditions. Testing with elevated temperatures of the mixture - also outside the scope of an ATEX certification - is technically not so problematic. From a series of comparative tests it was found that heating the arrester only results in a more conservative test than heating arrester and mixture to a requested temperature. The explanation can be seen in the reduced gas density in the former case, which leads to a reduction of the combustion energy and hence the explosion load to the arrester. So - for testing at elevated temperatures - heating of the arrester only was accepted as standard procedure in pr EN 12874. 4.2 In-line static deflagration arresters - testing and limits for use The testing of in-line static deflagration arresters is well established. It could be shown that - for a given flame arrester - the most significant parameter for flame transmission is the transient explosion pressure at the arrester when the flame is just going to enter the arrester element (matrix of quenching gaps) [S]. The lengths of the pipes on the protected and unprotected sides reasonably influence this pressure. This knowledge allows flexible pipe length installations in the test set-up as well as specific limits for use: For example, the ratio of pipe length (between the potential ignition source and the flame arrester) and pipe diameter shall not exceed the tested ratio. A considerable safety margin is introduced by the requirement that at least 10 % of the cross sectional area of the pipe shall be open on the ignition source side (for example the mouth of a burner injection).

4.3 In-line static detonation arresters - testing and limits for use Depending on pipe diameter, pipe length and mixture concentration, a deflagration in a pipe may undergo a transition to detonation and then continue running down the pipe as a so-called stable detonation. The stable detonation exhibits invariable velocity and pressure characteristics, the so-called ChapmanJouguet values; for ambient conditions, these are about 1800 m/s and about 20 bar for most of the hels important in practice.

830

Transition from deflagration to detonation is a local phenomenon occurring within a length of few pipe diameters and showing extremely high detonation pressures (up to 100 bar); flame velocities can hardly be defined over such short pipe pieces. In test standards the transition phase is usually summarised as unstable detonation. Clearly, an unstable detonation is a much higher load on a flame arrester than a stable detonation. Fig. 5 shows typical examples of the pressure traces in a stable detonation and in an unstable detonation phase.

Fig. 5 Explosion overpressures of a stable (black) and unstable (grey) detonation

While stable detonation conditions are well reproducible and therefore well suited for test procedures, just the contrary holds for the unstable detonation phase: Experience shows that velocity and pressure characteristics are subject to considerable scatter (a factor of five is not unusual). The reason is seen in the highly stochastic nature of the extremely turbulent flame acceleration which summits in the transition phase. That extreme scattering prevents ease of use in test procedures. In this situation and in view of the claim of other standards to provide sound testing against unstable detonations [ 1, 2,4], the European standard specifies according to the tested combustion load - stable and unstable detonation flame arresters.

83 1

Testing with stable detonations is well established and supplemented by mandatory deflagration tests to qualify stable detonation flame arresters according to the European draft standard. Testing with unstable detonations first of all requires a technically sound definition of an unstable detonation. In the European draft standard this was tried by introducing a detonation pressure criterion, comparing the reproducible and tabulated 200 ps t h e average pressure Pmd of a stable detonation with the corresponding value pmuof an unstable candidate‘event (see Fig. 5). For the purposes of the standard a test counts for unstable detonations when pmu2 3 pmd. This approach is a first step in making assessments in that field comparable and reliable but it is by far not s&sfying:

- The applied minimum criterion in the testing presumably does not cover a still unknown maximum load in practice. - Assessments on the basis of a few tests (maximum 10) are statistically insignificant; on the other hand, extended testing does not find acceptance for economical reasons. - All known “unstable detonation” test procedures attempt to produce and measure conditions in a pipe section immediately before the arrester. Unfortunately the worst case has to be expected when the transition occurs in the arrester and where test data are very likely to depend on the design of the individual device tested. So further research has to show, whether - in connection with flame arrester testing - relevant and general unstable detonation characteristics can be found at all. The splitting into a stable and an unstable detonation arrester class might first be confusing for the customers as regards application and risk assessment. First of all, in practice the location of a possible transition (unstable detonation phase) is not predictable. Therefore the position of a detonation flame arrester in a practical pipe installation is irrelevant for the choice “stable - unstable”. Indeed the splitting allows for different safety concepts developed in various countries: The (former) national German requirements asked for stable detonation testing only so that these arresters to some extent correspond to the stable detonation arresters of the European draft standard. The risk from unstable detonations was reduced to an acceptable level by national safety regulations which require redundant measures against flame transmission, depending on the likelihood of explosive mixtures and effective ignition sources [9]. This concept has been

832

used ever since without bad safety records and is reflected - on a small scale by the requirements of the European directives (categories of explosion proof equipment [ 6 ] and accepted combinations of categories and zones [lo]). As far as known, a similar view is taken in some other European countries, for example in Italy, Austria and Switzerland. In Great Britain and North America the flame arrester standards established on a national level require unstable detonation testing. The detonation arresters in these countries then to some extent correspond to the unstable detonation arresters of the European draft standard. Irrespective of the problems with testing, unstable detonation arresters are clearly superior to stable detonation arresters with respect to their flame arresting capability. So the use of an unstable detonation arrester might be rewarded by reducing the above-mentioned number of redundant measures against flame transmission. This idea gives some logical guidance for the use of stable or unstable detonation arresters in safety concepts. The equivalence of such concepts with respect to the acceptable risk has still to be assessed. The significance of any unstable detonation test procedure which at present is very small is one of the most important points for these assessments. 5. CONCLUSIONS Flame arrester testing and classification in Europe is harmonised by the draft European standard pr EN 12874. The standard test procedures for deflagrations, stable detonations and stabilised burning have been developed from existing national standards and are well established. The known test procedures for unstable detonations suffer from statistical insignificance. This problem might be inherent to the unstable detonation process and it could not be solved satisfactorily by the European standard. Despite these problems, the standard introduces - apart from the well-known stable detonation arresters - a class of unstable detonation arresters. The effect of this possibility to use different classes on established safety concepts needs to be hrther discussed.

833

REFERENCES BS 7244: 1990, British Standard Specification for flame arresters for general use, British Standards Institution U. S. Code of Federal Regulations, Federal Register, Vol. 5 5 , No. 120 (1990), Appendix A to Part 154 - Guidelines for detonation Flame Arresters, Appendix B to Part 154 Standard Specification for Tank Vent Flame Arresters DIN Normvorlage Flammendurchschlagsicherungen, August 1990 Canadian Standards Association - CSA - Z 343-96: Test Methods for In-Line and Firebox Flame Arresters, Second Edition (1996) International Maritime Organisation, Maritime Safety Committee, Circular No. 677: Revised Standards for the Design, Testing and Locating of Devices to Prevent the Passage of Flame into Cargo Tanks in Tankers, IMO London (1994) Directive 94/9/EC of the European Parliament and the Council of 23 March 1994 on the approximation of the laws of the Member states concerning equipment and protective systems intended for use in potentially explosive atmosphere. pr EN 12874 Flame arresters - Performance requirements, test methods and limits for use, CEN, final draft, July 2000 H. Forster, Deflagrationen und Detonationen als Standardverfahren zur Prufung von Flammendurchschlagsicherungen, 8. Kolloquium zu Fragen der chemischen und physikalischen Sicherheitstechnik, Bundesanstalt fur Materialforschung und -prufung, Berlin, 1999 Technische Regeln fur bennbare Fliissigkeiten, TRbF 100 Allgemeine Sicherheitsanforderungen, Bundesminister fur Arbeit und Sozialordnung (BArBl Heft 611997) [101 Directive 1999/92/EC of the European Parliament and the Council of 16 December 1999 on minimum requirements for improving the safety and health protection of workers potentially at risk from explosive atmospheres.

This Page Intentionally Left Blank

835

Thermal Hazard Evaluation of Vilsmeier Reaction M. Suzuki ', A. Miyake ', Y. Iizuka b, Y. Oka ' and T. Ogawa ' a Department of Safety Engineering

,Yokohama National University

Tokiwadai, Hodogaya-ku,Yokohama, 240-8501, Japan Yokohama Research Center, Mitsubishi Chemical Corporation Kamoshida-cho, Aoba-ku, Yokohama, 227-8502, Japan

ABSTRACT Vilsmeier reaction is one of important reactions in organic photoconductor industry, and quantitative information of thermal hazard of the reaction is needed for the process control and safety. In this paper, the thermal hazard of Vilsmeier reaction is investigated and heats of mction are measured using reaction calorimeters. It was found that thermal decomposition of the Vilsmeier complex and selection of the solvent might be a key for the suitable reaction.

1. INTRODUCTION

Formylation of aromatic compounds using the Vilsmeier complex is a popular reaction in the chemical industry, especially in organic photoconductor manufactures. However the complex has a thermal instability as reported [1,5], a quantitative understanding is needed for the process safety and optimization. The Vilsmeier complex is usually prepared by the reaction of phosphorus oxychloride (F'OCl,) and N,N-dimethyleformamide@MF) or N-methylformamide(MFA) shown below [2,3]. R2NCH0 + POCl,

--$

[R;;N+CHCl 2 R2N-C+HC1]O-POC12 [A1

(1)

836

Immonium salt such as P] is an intermediate in the Vilsmeier reaction. It is converted into formyl compound by hydrolyzation. ArH+[A]

P]

+

+ H20

ACH=N+R2.O-POCl2 +

ACHO

PI m

2

+HC1 +HOPOC12

Since the theoretical calculation of the heat of decomposition of the complex is generally difficult because of its structure, experimental measurement of thermal behavior using reaction calorimetrytechnique is usehl for the hazard evaluation. It is presumed that the Vilsmeier complex does not exist when reagents are mixed at lower temperature, and the complex is produced with the temperature rise. It is considered that POC13 are solvated with coordinating to DMF [4]. Therefore, the reaction heat of the Vilsmeier complex depends on the temperature of the system. Furthermore, the equilibrium of the complex may also depend on the temperature and the equilibrium shift cause the heat generation. In chemical industry, two typical methods of formylation using Vilsmeier reaction are used. In the first method adding the substrates to the solution including the Vilsmeier complex, and aldehyde is obtained by hydrolyzation. In the second method obtaining aldehyde by the hydmlyzation after dosing POC13into the solvent including the substrates for formylation. The thermal hazard of Vdsmeier reaction is d i f f m t in the method of formylation. In this paper, thermal stability of Vilsmeier reaction is examined by using reaction calorimeters such as RC 1, C80 and ARC, and the physical and chemical heats of reaction is determined. And the worst case scenario in this reaction is investigated. 2. EXPERIMENTAL

2.1. Reagents POC13(99wt% purity) and DMF (99.5 wt??purity, water h e ) or MFA (98 wt?! purity, water Eee) were used as the Vilsmeier complex reagents, and TPD (99% purity, solid) were used as substrate.

2.2. Experimental apparatus and methods The reaction calorimeter; Mettler-Toledo RC1 was used. Fig. 1 shows a schematic drawing of RC 1. RC 1 works to measure the temperature differencebetween the contents

837

Fig.1 Schematic drawing of Mettler-Toledo RC1

and the heat transfer fluid in the reactor jacket, and it controls the fluid temperatures according to the desired control mode. The heat release rate is determined based on the heat and mass balances in the mactor. In addition, the reactor was equipped with temperature sensors, calibration heaters and reflux units.The SVOl type glass reactor with the volume of 0.8L was used and the paddle stirrer was equipped. Experiments were carried out in semi-batch operation as follows. At first, an adequate solution for reaction, DMF or MFA or DMF dissolved TPD was heated up to the desired temperature in the RC 1 reactor. After obtainingthe thermal equilibrium at the desired temperature, POCl3 was added dropwise into the reactor with transfer pipette, and then the heat generation was measured. Fig2 shows the example of heat release rate 250

E 8

2

c,

-.

, DMF/POCl3=24/1

2oo 150

2

DMF or MFA 2oomL POC13 lOmL Reaction temp. T,= 298K

9e 100 a

c,

&

50 0

I\-_.

_I--,

2

4

I

6

.

Time[min] Fig2 Heat release rate versus time profiles of DMFPOC13 and MFAPOCI3 systems

838

versus time measured by RC1. Experiments were performed as shown below, respectively. 1. The Teaction heat (Q) of the Vilsmeier complex in DMFPOCI3 system at isoperibolic conditions was examined at a constant temperature between 288 and 323 K. The volume of DMF was 200mL, and POC13was 1OmL. 2. The dissolution heat of the Vilsmeier complex was measured by adding H20into the solution at 298K. 3. Formylation using the Vilsmeier complex proceeded in a similar manner as above. In the reactor, TPD was dissolved in DMF. POCl3 was added dropwise at 343K and 323K, and the heat generation was measured for several hours. Then the adequate H20 was added for hydrolyzation at 298K in the solution DMF with immonium salt and Vilsmeier complex, and recorded the heat generation, too. And aldehyde was obtained. The thermal behavior of Wlsmeier complex was also measured with a heat conduction calorimeter; Setaram C80. The Vilsmeier complex formed in DMF/POC13 system at 298K was heated up to 333K at a heating rate of 2Kmin-'. A SUS-316 stainless steel pressure vessel with inner glass vessel was used. The thermal stability of the Vilsmeier complex was also investigated using an adiabatic calorimeteq Arthur D Little, accelerating rate calorimeter ARC. The thermal stability of the Vilsmeier complex of DMF/POC13system was already reported [1,5]. The measurement was carried out for the complex of MFA/POC13 system. ARC was operated in a heat-wait-search mode with 5K step. A titanium bomb was used and the sample mass was approximately 4g.

3. RESULTS AND DISCUSSIONS 3.1. Thermal hazards of Vilsmeier complex From the results of RCI experiment, the heats of Vilsmeier complex generation in DMF/POC13 system at isoperibolic conditions between 288K and 323K showed a constant value as 57 kJ/mol at any temperatures.Neither exotherm nor endotherm was found by C80 scanning of the Vilsmeier complex. It is considered that the equilibrium of the Vilsmeier complex does not depend on the temperature, otherwise the complex phase does not exist.

3.2. Influence of the solvent on the thermal stability of Vilsmeier complex From the ARC data,exothermicpeaks of the Vilsmeier complex of MFA/POC13

839

system appeared at 339K and 488K. Table 1 shows the ARC test results compared with DMF/PoC13 system about the first exothermic peak. As a result, the maximum heating rate and the onset temperature of the complex in MFA system showed similar values as those of DMF system. However the heat of the complex in MFA system measured by RC1 was 2'7kJ/mol, the half in DMF system. Since the stability against thermal decomposition of the Vilsmeier complex of MFA system is the same level as that of DMF system, it can be stated that the thermal hazards of MFA system is lower than that of DMF system. Table 1 ARC test results of Viismeier complex in different solvent system Solvent

POCG / Solvent

DW [31 MFA

1114.4 U14.9

Onset temp. T[KJ 334.3 339.5

(dT/dt),

0.071 0.102

Thermal inertia 1-1 $=1.57 6 =1.59

33. Heats of reaction in formylation using Vilsmeier reaction Table 2 shows the heats of reaction of formylation at 323 K. From RC 1 data the heats of reaction of Vilsmeier reaction were determined such as generation, thermal decomposition and hydrolyzation of the Vilsmeier complex. The heats of gneneration and hydrolyzation of immonium salt of substrate TPD were able to calculate h m the data of formylation. In this experiment the obtained data involved the heats of the Vilsmeier complex and immonium salt when PoC13was dosing into the DMF solution dissolved TPD. When hydrolyzation of imrnonium solution occurred, the experimental data involved the heats of hydrolyzation of the Vilsmeier complex and immonim salt likewise. Each heat of reaction could be separated as shown in Table2. On the other hand the result of chemical analysis of the reaction products with liquid chromatography showed that TPD conversion was nearly 100percent. Table 2 The heats of reaction (0)in formylation at 323K Reaction

Generation of Vilsmeier complex

Q

57kTmol

-'

Decomposition of Viismeier complex Hydrolyzation of Vilsmeier complex

178!dmol-'

Generation of immonium salt

1.13kJg-'

Hydrolyzation of immonium salt

1.16Hg'

The maximumheat release rate 3 16Ktnin-IDMF/POC1~=3/1[5]

840

3.4. The worst case scenario in Vilsmeier reaction Fig.3 shows one of the worst case scenario; runway reaction of Vilsmeier reaction. In this scenario undesired reaction is caused by the thermal decomposition of the Vilsmeier complex. In case of adding substrates into the solution of the Vilsmeier complex, there is a potential hazard of thermal decomposition of the Vilsmeier complex. For example, adding the substrate solution involving water may raise the temperature in the reactor with the heat of dissolution or hydrolyzation of the complex or the heat of dilution of substrate solution, and it leads the decomposition of the complex. In case of adding POC13 into the solution dissolved substrate, the Vilsmeier complex is consumed immediately by formylation of substrate. Therefore it is considered that the above procedure is safer method for Vilsmeier reaction. But the heat of hydrolyzation of the Vilsmeier complex is so large that the excess mass of the Vilsmeier complex will induce runaway reaction of the system if the water exists. With regard to solvent, &om the calorimetric data of the Vilsmeier complex it is concluded that of MFA system is more stable than DMF system.

4. CONCLUSION Several kinds of heat regarding the formylation of Vilsmeier reaction were determined with reaction calorimetricexperiments,and the potential hazard scenario of

Dosing of substrate

Decomposition of Vilsmeier complex

Generation of

cooing failure

Time Fig.3 Runaway scenario of Vilsmeier reaction

84 1

the reaction was investigated. It is concluded that thermal decomposition of the Vilsmeier complex may cause a runaway reaction and MFA is more preferable than DMF as solvent in the Vilsmeier reaction system.

REFERENCES [ 1IY.IiZuka and A.Fujita, Proc. 7'hInt71Symposium on Loss Prevention and Safety Promotion in the

Process Industries, vo1.2,76-1-76-12, Taormina (1992)

[2]A.Vilsmeierand A.Haack, Ber, 60, pp. 119-122 (1927) [3]L.F.Fieser,J.L.Hartwel1et al., Organic Synthesis, vo1.3, p.98, Wiley (1955) [4]Y.Takuma and N.Imaki, JSynthetic Organic Chemistry, Japan, 49, pp.587-592 (1990)

[S]Y.Iizuka and M.Wahkwa, Proc. 2nd IWAC-Workshop on Safety in Chemical ~p.220-226,Yokohama (1993)

[6]R.Gygax, Chem. Eng Sci., 43, pp.1759-1771 (1988)

production,

This Page Intentionally Left Blank

843

The corrosion monitoring: Loss prevention and safety of complex systems in acid media V.G. Polyanchukov State Technical University of St Petersburg, 29 Polytechnicheskaya str., 195251, St Petersburg, Russian Federation. Fax: +7 (812) 557 32 18, E-mail: [email protected] Worked out the notions of methodology of corrosion monitoring of constructions and equipment of potentially hazardous industries and facilities in acid media: expert systems. Worked out concept of analytical and information system for complex evaluating of technical and corrosion condition and residual life of highly hazardous facilities operations. The system includes as traditional (well run in methods of the information analysis both estimations of a technical and corrosion condition of objects of examination), and not traditional methods: the analysis of outcomes of mathematical modelling of corrosion processes and corrosion protection in acidic inhibition media. Such approach allows receiving of an authentic, adequate and reliable estimation of a technical and corrosion condition of objects of heightened danger in a broad band of data-ins. The high performance of expert-analytical systems with usage of mathematical modelling of corrosion processes is affirmed by available perennial experience of creation and operational development up to an optimum corrosion condition of the composite equipment of heightened reliability in strong oxidants on the basis of hydrogen nitrate. 1 INTRODUCTION Problems of corrosion protection and connected safety issues are topical for all developed countries. Major damage and catastrophes are, as a rule, associated with damage of equipment by corrosion. Modern traditional theoretical presentations and methods of study of corrosion processes in many cases do not ensure efficient corrosion protection of equipment. Problems of corrosion and corrosion protection are far from solved, but corrosion factors remain decisive in strategies of technology politicians.

844

Local forms of corrosions present the most danger. Chemical interaction of metal with the ambience with provision for constructive-technological factors (CTF) plays define role in their development. An actual diversification of members of designs subject to local corrosion, dif-

ficulty of imitation and the supervision in them of corrosion processes complicate straight line experiment. Composite is the picture of transportation of material in a local seat of corrosion. In a number of cases the formation of selfcontained locuses of corrosion slightly associated with environment is rotined. Because of diffusive handicappings the speed of local corrosion can exceed speed of general corrosion on some orders, as is watched in practice. The influence of CTF upon the development of local corrosion by traditional electrochemical methods of studies completely was not taken into account, but mathematical models, adequately describing processes of local corrosion, till now were absent. Therefore until recently basic method of an estimation of a technical and corrosion condition of objects of heightened danger was the technical diagnostic with the purpose of well-timed detection of faults, possible locuses of corrosion and scoping of the subsequent repair. The lacks of the given approach are wellknown. To them concern: Difficulty of forecasting of development of corrosion processes in time (specially local) and definition of a ultimate (resource) effective life. Impossibility of carry in a full volume of the obtained outcomes on other equipment, diverse structurally - technological solutions, handling mediums, regional conditions etc. The material and financial costs were high. Offered new methods of system studies of corrosion processes and protection in acidic media are concepts of modern corrosion monitoring [ 1-31. Modern corrosion monitoring is a complex study system of checking and management of corrosion processes and protection in acidic inhibition media, in which alongside with traditional approaches to the problem of corrosion, methods of mathematical modelling are, used [4-81. By development of the concept monitoring were used: - Long-term experience of work under the decision of problems of corrosion and protection of the equipment in objects and systems developed in defensive departments former USSR, and intended for long operation in strong oxidisers on the basis of a nitric acid, - Results of the further development of the given direction at State Technical University of St Petersbura.

845

(Such approach allows to realise more full decision of given problem. Perennial experience of fhnctioning (working) an author were used at the concept development on deciding the problems of corrosion protection of equipping increased reliability (not chemical profile) in the strong oxidisers on the base of nitric acid and results of the further development of given direction in the State Technical University of St Petersburg). Further development of the given direction is associated with developing of a methodology of modern corrosion monitoring: Expert systems. 2 EXPERT SYSTEMS

The complexity of problems of researches of corrosion processes and protection having complex (“polytechnic”) nature, demands federating the scientists and specialists of a different profile, including specialists working on potentially dangerous production. The specialists having a steep professional knowledge and a rich know-how, are rather rare. It excites to create consulting models for realisation of an independent expert appraisal at all phases of a “life cycle” of potentially dangerous production and equipment. In the given report are esteemed only expert systems as problems, directly associated with developing of a methodology of corrosion monitoring of production and objects of heightened danger in acid mediums.

2.1 Aims and problems Developing of a methodology of modern corrosion monitoring of complex systems in acid mediums. Developing of the concept of analytical and information system ( A I S ) for a complex estimation of a technical and corrosion condition and residual resource at exploitation of production and objects of heightened danger in acid mediums. Rendering of the practical help to the potential customers on maintenance of corrosion and ecological safety of different productions and equipment at exploitation in acid mediums.

.

.

2.2 Main principles Offered methodology of corrosion monitoring is an “Expert systems”. During development of expert system methodology were used followkg main ideas. Basic rules of corrosion monitoring. Traditional methods of evaluation of corrosion condition, quality and reliability on all “life cycle” of equipment: Design-making-maintenance-repairing. Traditional methods of information analysis - primary stage of transformation of the documentary information: collecting, generalising and analysis of

.. .

846

.

obtained information (for the decision making about the technical condition, modernisation, repair and preliminary estimate of remaining resource to usages). Algorithm of mathematical modelling of corrosion processes and corrosion protection (system “medium-surface”). Algorithm of optimisation of concentrations of inhibitor, improvements of technology of inhibitor’s entering, improvements of standard design elements prone to local types of corrosion scientifically motivated term of corrosion and ecological safety.

2.3 Structure

The schematic diagram of corrosion monitoring is adduced on fig. 1.

Fig.1. Schematic diagram of corrosion monitoring in acidic inhibition media: Expert systems CS: Corrosion system “medium-metall” A: Expert system B: The analytic and information analysis for the technical and corrosion conditions of the industries and facilities C: The analytic and information analysis of the results of the mathematical simulation of the processes of corrosion and protection in the inhibiting acid mediums in the system “medium-surface”.

847

The scheme mirrors intercoupling of separate units (subsystems) inside a system: corrosion monitoring. The flowchart of analytical and information system (AIS) for a complex estimation of a technical and corrosion condition of production and objects of heightened danger is adduced on fig. 2.

CORROSION

Block B System "constructiontechnologycorrosionquality

Q Block C

I

System "mediumsurface"

of the technical and corrosion conditions of the industries and facilities

I

Fig.2. Bloc diagram of the analitical and information system fo; the complex evaluation of the technical and corrosion conditions of the highly hazardous industries and facilities.

The block diagram of traditional (a) and non-traditional (b) methods of analytical and information system for the evaluation of the technical and corrosion conditions of the highly hazardous industries and facilities in acidic media is adduced on fig.3.

848

1

CORROSION SYSTEM

c

SYSTEM

Q Block B

Objects for expert I

Results of mathematical modelling of corrosion processes and protection Technical an equipment Collecting, generalization, analisys of information

I

Evaluation of technical - Provision corrosion and ecological safety and corrosion conditions

Fig.3a.

The order of realisation of expertise of the unit with (System MS) by results of mathematical modelling of corrosion processes in acidic inhibition media is adduced on fig.3 (b).

849

I

CORROSION

C

I

SYSTEM

I

“medium-surface’’ expert

Inhibitor’s

concentration

Inhibiting technologies

Geometrical characteristics of construction elements

Time-limit to usages

-

Complex evaluation of corrosion conditions of industries and facilities

Fig.3b. Fig3 Block diagram of traditional (a) and non-traditional (b) methods of analytical and information system for the evaluation of the technical and corrosion conditions of the highly hazardous industries and facilities in acidic media.

Mathematical modelling of corrosion processes and protection in system “medium - surface” is executed by means of modelling a limiting stage of process - kinetic of inhibitor’s diffusion, spent during corrosion on formation of a protective film. The theory of mathematical modelling of corrosion processes in inhibiting acid media, the base algorithm of system of mathematical modelling of corrosion processes and protection in acidic inhibition media (structure, routes, system of the equations of the mathematical description of corrosion processes, base

850

models of objects of research as a basis for the subsequent development of the software) and theoretical basic of corrosion monitoring of complex system in acidic media were repeatedly reported on scientific forums and were published in domestic and foreign press [4- 121. Base algorithms for the calculation of optimum concentrations of inhibitor with provision for corrosion aggressiveness of media and actual geometric sizes of standard elements and calculation of optimum sizes with given initial concentrations of inhibitor (inverse problem) were offered. Tinned results confirmed experimental, of Russian Federation Patent executed ~31. 3 CONCLUSION

3.1 Worked out the notions of methodology of corrosion monitoring of constructions and equipment of potentially hazardous industries and facilities in acid media: Expert systems. 3.2 Concept of analytical and information system for complex evaluation technical and corrosion condition and residual life of highly hazardous facilities operations is determined. 3.3 The available successful experience of mathematical modelling of heat and mass transfer processes on the basis of modern information technologies, that the intrusion of modern corrosion monitoring in acidic inhibition media with usage of a designed system of software can be successfully resolved already as soon as possible. The legible organisation of activities, formation of creative group of the specialists and sufficient financing is required.

REFERENCES [ l ] V.G. Polyanchukov, in Proc. 3rd Int. Congr. Protection - 98, Moscow (1998) 117 (in Russian). [2] V.G. Polyanchukov, in Proc. 13th Int. Congr. CHISA’98,8, Prague, (1998) 80. [3] V.G. Polyanchukov, in Proc. ELK.Corros. Congr. EUROCORR’99, Aachen (1999) 189. [4] V.G. Polyanchukov, P.F. Drozhzhin, J. Protection of metals, 28, 4, (1992) 604 (in Russian). [5] V.G. Polyanchukov, P.F. Drozhzhin, J. Protection of metals, 28, 4, (1992) 610 (in Russian). [6] V.G. Polyanchukov, in Proc. 1st Int. Congr. PROTECTION- 92,2, Moscow (1992) 52 (in Russian). [7] V.G. Polyanchukov, in Proc. 1lth Int. Congr. CHISA’93,2, Prague (1993). [S] V.G. Polyanchukov, in Proc. Eur. Corros. Congr. EUROCORR’97,2, Trondheim (1997) 209.

85 1

[9] V.G. Polyanchukov, in Proc. 2nd Int. Congr. PROTECTION - 95, Moscow (1995) 98 (in Russian). [lo] V.G. Polyanchukov, J. Protection of metals, 32, 6, (1996) 598 (in Russian). [ l l ] V.G. Polyanchukov, in Proc. 12th Int. Congr. CHISA’96,5, Prague (1996) 127. [12] V.G. Polyanchukov, J. Protection of metals, to be published (in Russian). [13] V.G. Polyanchukov, Russian Federation Patent No. 2121525 (1998) (in Russian).

This Page Intentionally Left Blank

853

STUDY ON THE EXPLOSION OF RUN-AWAY REACTION TNGGERED BY A FAINT HEAT GENERATION Jinhua Sun, Xinrui Li, Wanying Tang and Kazutoshi Hasegawa National Research Institute of Fire and Disaster, Japan 14-1, Nakahara 3 Chome, Mitaka, Tokyo 181-8633, Japan Abstract The asphalt salt mixture (ASM), which was produced by mixing low radioactive liquid waste containing NaNO,, NaNO,, Na,CO,, N&12P04and others with asphalt at 180°C in an extruder, induced a violent explosion. Its reactivity is related to both the ingredient and processing conditions. It has been found that when phosphate exists and water evaporating ability exceeds water feeding rate, the oxidation-reduction reaction in the mixture may be accelerated especially at lower temperature. A temperature increasing process which simulated the waste pouring into the extruder suggested that the existence of NaH,P04 suppresses the decomposition of NaHCO, in the evaporating process, leaving NaHCO, more in the salt particles mixed with asphalt and continues to decompose. This, as well as a certain waste feeding rate, in turn accelerates the reaction around 170°C. A heat flux calorimeter, C80D, with advantage of a very slow temperature rise rate of O.Ol"C/min, was used to investigate the reaction heat generation, finding that under the factors of phosphate .existence and slow feeding rate as 50mllh, the heat starts to evolve at 170°C and heat generation around this region increases. The porous salt particles, which under the SEM inspection looks like a bur or sponge formed by gas arising from the decomposition of NaHCO,, govern the interface reaction. Moreover, a runaway reaction was experimentally realized to be 190°C by using dewar vessel. 1.

INTRODUCTION

On March 11, 1997, a fire and explosion occurred in the Bituminization Demonstration Facility (BDF) when it disposed of low radio-active level liquid wastes coming from Reprocessing Plant in the Tokai Works of Power Reaction and Nuclear Fuel Development Corporation, Japan. The disposing process was that after the waste liquid including salt NaNO,, NaNO,, Na,CO, and NaH,P04 was mixed with asphalt in an extruder under 1SO"C, the mixture was poured into ten 220-liter drums and stored when the ambient temperature was at 50°C. The fire and violent explosion afterwards from the drums caused total damage to

854

BDF and was considered as the most hazardous accident in the history of Japanese nuclear power development[11. On the whole, there were three singularities different from the standard safety operation in which accident never had taken place. They were: a decrease of the feeding rate of wastes into the extruder 2001h to 1601h; an occasionally addition of phosphate into the waste; and shorter agitation time for waste. So it seemed that the investigation should mainly focus on the effects of the three factors on the reaction and heat character of the mixture concerned [2]. Contrary to the existing opinions that the run-away reaction started at the onset temperature of 230 "C, caused by some physical factors like heat of friction[3,4,5], K. Hasegawa et.al. put forth a viewpoint that oxidizing reaction involving in the asphalt and NaN02 of the mixture might be improved by molecules containing intramolecular hydrogen, such as NaH2P04and NaHC03. Moreover, NaHC03 decomposition which produces gases creates many micro holes in the interior of the salt particles. This in turn promotes the oxidizing reactions that are diffusion controlled. The consequence of a runaway reaction at 180°C or lower is qualitatively by taking into account the chemical effect of intramolecular hydrogen and the physical effect of the NaHC03 decomposition gases[ 11. However, it is necessary to give a comprehensive and thorough investigation on such reaction promoting factors. To this end, in this paper, the decomposition of NaHC03, activated by the existence of NaH2P04,was discussed based on the experimental results obtained from the temperature-increasing process pretending the extruder. Then a special experimental setup was designed to prepare the mixture at higher temperature imitating the real process. The effects of various conditions like phosphate and waste feeding rate on reactivity were discussed by analyzing heat flux and fine structure of the salt particles. Finally an adiabatic dewar experiment was carried out to determine the onset temperature for a run-away reaction. 2.

EXPERIMENTAL

2.1

Waste preparation

The sample's ingredients and preparation are illustrated in table 1, simulated exactly to those of the accident when several kinds of inorganic salts like NaN03, NaN02, Na2C03, and NaH2P04 were dissolved at certain concentrations, precipitated by Ba(OH)2, with pH value modified to 9.0, and then added by other two extra salts, &Fe(CN)6*3H20 NiS04*6H20. To be convenient for

855

discussion, W 1 to W6 stand for samples prepared under different conditions such as pH values, as well as with or without phosphate. Table 1 Simulated wastes samples Abbreviations of simulated wastes solution Mixing order and chemical reagents

WI

w2

w3

SimulatedNaN02 mixed Na2C03 aqueous NaH2P04 wastes Volume of distilled water Ba(OH)?* 8H20

w5

and making method Simulation wastes solution without phosphate

250

250

250

250

250

250

50

50

50

50

50

50

80

80

80

80

80

80

20

20

20

0

0

0

18.93

18.93

0.71 18.93

18.93

18.93

~

Precipita- With 13N HN03 step

W6

Composition of the simulation wastes solution (gll) Simulation wastes solution with phosphate

NaN03

w4

18.93 ~

8.5

9.0

10

8.5

9

10

&Fe(CN)6*3H20

9.72

9.72

9.72

9.72

9.72

9.72

NiS04 6H20

12.09

12.09

12.09

12.09

12.09

12.09

Total volume of solution is 1 I

2.2

C 0 2 Gas Collection in a Temperature-increasing process

To study the pertinent reaction in waste, two kinds of solution, with and without phosphate, were introduced under different pH values of 8.5, 9.0 and 10 modified by €€NO3based on table 1. In a three opening glass flask sealed by condensation, thermometer and gas collector, the solutions were heated in an oil bath to 90"C, and were kept at that temperature for another 48 hours. The C02 generated was collected by a silicon-oil substituted method all along the process of heating and keeping at constant temperature. All the chemical reagents used in the processing were the super fine products made by Kanto chemical limited company, Japan.

2.3

Bituminization process

In the accident, waste was fed in an extruder which provided heating by three electric-heating stages until 180°C where it was mixed with hot asphalt during

856

which water in solution was evaporated. The key for accurately studying the effect of the condition on the reaction of mixture is to prepare and repeat the situation of the three singularities. For this purpose, Fig.1 shows a special experimental system equipped with a waste feeding part, a mixing and evaporation determining device and a temperature recorder. Among them the mixing and evaporation-determining device consisted of an oil bath, a stainless beaker filled with asphalt, stirrer and three thermocouples which were respectively positioned near the exit of the waste, about 2 mm distanced from the inside wall of the beaker and lmm outside the beaker's wall in the bath. The temperature of the oil bath was maintained at 18Ok3"C.The feeding rate of waste into asphalt was controlled by a syringe pump. The mixtures, ASM1, ASM2, and ASM3 manufactured at different feeding rates are listed in table 2.

To discuss the influence of the waste feeding rate on the reactivity of asphalt salt mixture, the limitation of water-evaporation ability of the setup was essentially measured as 40mlh before other experiments. Here waste feeding rates of 50ml/h and 100mlh were selected to make sample. Compared to the water evaporating ability of the setup, the former has lower water feeding rate of 36.5ml/h, while the latter has higher one of 73mlh.

Fig. 1. Experimental setup

Table 2. Manufacture condition of asphalt salt mixture Manufacture condition

ASMl

ASM2

ASM3

Waste Feeding rate (mlh)

w2 50

w2 100

w5 50

857

2.3

Thermal and structural determination

The reactivity of the mixture was measured by a heat flux reaction calorimeter with a high detection sensitivity of 10 W, C80D, manufactured by Setaram Co. in France. 0.500g sample under test and alumna oxide as reference were put into two 8.5ml vessels, respectively. Temperature was controlled by program with rise rate of 0.0 1"C/min. The experiment was undertaken in nitrogen atmosphere. The micrograph of the sample was observed by a Scanning electron microscope of JEOL, Japan, with a magnification of 2000. In order to analyze the surface area of salt particles in the mixture, the salts were extracted from asphalt in the toluene solvent. After the solvent evaporated, the salt particles' surface area was determined by BET method. 2.3

Dewar Experiment

The construction for an adiabatic experiment is shown schematically in Fig. 2. 500ml cylinder-shaped dewar filled with the samples under test was placed in a chamber to execute ambient temperature controlling experiment. In order to cut down heat loss, the atmospheric temperature in the chamber was manually controlled so that it followed the dewar internal sample's temperature by the increment of 1°C. The dewar was equipped with three thermocouples, whose diameter was lmm in a type of sheath, to monitor the temperatures at different sites like the center, bottom and upper surface of sample. All the thermocouples including one measuring the ambient were connected to a recorder and a computer to collect raw data.

Fig.2. A measuring system for sample inside 500ml dewar flask (1 heater; 2 fan; 3 Aluminum box; 4 5 6 7 thermocouples)

858

3.

ANALYSES AND DISCUSSION

3.1

Effect of Phosphate on Decomposition of NaHCO3 in Waste

It seems that the existence of phosphate is one of main reasons to lead to an accelerated reaction during the induction stage. In this case, the pH value of waste was adjusted to 9.0 by 1.3N nitric acid. It is important to point out that during this process, most of Na2C03 in the waste is changed to NaHC03 which is not chemically stable and starts to decompose above 65"C[6]. Fig. 3 shows the amount of collected gas C02 vs. time curves during heating for about 100 min and temperature constant stages. It can be seen that the amount of C02 generated by the two types of solutions is increased at first and then attains constant when all the NaHC03 has decomposed. But it quite varies with both phosphate and pH value. On the whole, the generation of C02 has nearly stopped in the W4, W5 and W6 solutions without phosphate for 100 min before the temperature gets to 90°C regardless of pH values. On the other hand, CO2 gas was continually generated from W1, W2 and W3 solutions with phosphate till about another 300 min at 90°C. The total amount of C02 from solutions with phosphate is as twice as from solutions without phosphate for each pH values, but at the beginning for heating process, it seems less than the latter. Meanwhile, as the pH value of the solution decreases, the total amount of C02 generated increases in the range of pH 8.5 to 10.

240

1

100

80 60

160

.ogY

40 20

40

0 Time, rnin Fig.3. CO, generating amount and temperature increasing program versus time in wastes

2

859

The decomposition of NaHC03 can be described as 2NaHC03+ Na2C03+C02+H20 Therefore, the rate of C 0 2gas generated can be written as: d[C02]/dt=2k[NaHC03] where k is the reaction rate constant. Assuming that phosphate has no effect on the above reaction process, a rate constant k having the elementary property of the chemical reaction is supposed to be independence of the differences between two types of solutions. Accordingly, during heating progress to 90°C, the amount of C02 from solutions with phosphate should be nearly identical to that from the solutions without phosphate. However, the experimental result shows contrarily that when there is phosphate in the solution, below 90°C, the decomposition rate of NaHC03 is lower and the amount of C 0 2gas generated is less. It is 79ml/l, which is only 46% of the total amount, indicating that more NaHC03 will be conserved in the solution and continue to decompose afterwards. Whileas, it is 86% in solutions without phosphate, which almost occupies the total amount, that is to say, NaHC03 has decomposed when temperature goes up to 90°C. This phenomenon indicates that the existence of phosphate in the solution gives great influence on the decomposition of NaHC03 in the solution. At first, there is no doubt that phosphate serves as a buffer solution as follows:

At the mean time, there exist other two precipitation reactions in the solution if phosphate exists: NaHC03+ Ba(OH)2 +BaC03&+ NaOH+H20 Na2HP04+Ba(OH)2+ BaHP04&+2NaOH The real initial concentration of NaHC03 in the solutions with phosphate is a little bit lower than that without phosphate, because it has been consumed when it reacts with Na3P04. With the temperature increase, all the above equilibrium reaction will move to the left side, that is to say, the NaHC03 in the solution with phosphate must be replenished, indicating that such solutions continue to produce gas for so long time that more C 0 2 is generated afterwards. On the other hand, NaHC03 and Na2HPO4 are precipitated by Ba(OH)* competently,

860

thus the latter will counter-balance and in turn there is more NaHC03 left. 3.2

Effect of phosphate and waste feeding rate on structure of salt particles

In order to discuss the effect of phosphate and feeding rate of waste into asphalt which were supposed as the main singularities of incident on the reactivity of asphalt salt mixture, three kinds of simulated waste with different concentration of phosphate and feeding rate were prepared. As shown in Fig.4- Fig.6, the micrographs of salt particles in the mixture were observed by a scanning electron microscope. It is clear that the appearances of salt particles also depend on the waste feeding rate and the existence of phosphate in the waste. In Fig.4, under the condition of the waste feeding rate of 50ml/h and with phosphate in waste, there are a plenty of porous particles, e.g. about 70% in the mixture ASM1, and the salt particles appears as a lot of needle-shaped crystals which are about 1-2fimthick and 3-8 fim long to form a bridged configuration like bur or sponge. When the waste feeding rate is 100mlh for ASM2, the porous particles occupy less than 30% of the total particles and most of them compose massive crystal about 3-5 fim ( as Fig.5). The reason for this phenomenon lies in different state of NaHC03 decomposition which depends on phosphate and competence between waste feeding rate and water evaporation. The water in waste is evaporated right away when waste is fed into hot asphalt at lower feeding rate, so no more NaHC03 decomposes in the liquid phase and instead it tends to form eutectic together with NaN03 and NaN02. It continues to decompose in the salt particle in the bituminazation when the temperature is controlled up to 180°C and have more porous structure left. On the other hand, when the feeding rate is larger than evaporation ability of the device, water can not be evaporated immediately and will retain in the beaker, under 90-100°C for longer time, leading to most NaHC03 decomposing in the liquid, so at last salt particles incline to emerge a lot of massive crystal by salt eutectic having no NaHC03 rather than many pores. It can be seen from Fig.4 and Fig.6 that phosphate also influences the decomposition of NaHCO3 because it can to some extent restrain the decomposition of NaHC03 in the solution. Therefore it is favourable to produce a porous Fig. 4. SEM of ASMl structure in the mixture.

86 1

Fig.5. SEM of ASM2

Fig.6. SEM of ASM3

At listed in table 3, the surface areas of salt particles were measured quantitatively by BET method. ASMl's specific surface area is 1.18 m2/g., much more than that of the other samples which are only 0.67 and 0.77 m2/g , respectively. Table 3 Average specific surface area of each asphalt salt mixture Sample ASMl ASM2 ASM3

Weight, g 1.847 2.226 2.212

Average specific surface area, m2/g 1.18 0.67 0.77

3.3 Effect of phosphate and waste feeding rate on reactivity of simulated asphalt salt mixture Figure 7 shows the heat flux versus temperature curves for the three simulated samples. For the sample ASM1, heat evolves from an initial temperature about 155"C, From this point heat flux increases slowly with temperature until 195"C, nearly maintains constant in the range of 195-250°C, and rises quickly above 250°C, Thus the reaction can be divided into three regions, that is, from 155°C to 195"C, 195°C to 250°C and above 250°C. At the first stage, asphalt can contact directly with oxidizing particles, and thus the reaction is mainly determined by an initially reaction-controlled stage on an interface. This results that with more and more product covered on the surface of the particles, the reaction mechanism turns to a diffusion-controlled stage in a product layer and its rate tends to slow down although it will be accelerated with the increasing temperature. As a result of the two contradicting effects, the reaction and heat generation become constant at the second stage. When temperature goes up to 250, at which a11 salt melts and asphalt becomes fluid, the reaction changes from solid-liquid surface to a homogeneous reaction-controlled stage in liquid phase and acts as an index law based on Arrhenius.

862

The other two .samples, ASM2 and ASM3, have the similar tendency in heat flux. However, their onset temperatures of heat release are both 200 and heat fluxes are also smaller than ASM1. Fig.8. shows in detail a relationship of heat release and temperature by integrating the area. It is evident that at the lower temperature region the heat release of ASMl is much higher than the others.

As described above, it was difficult to verify on a lab scale that the run-away reaction happened at a lower initial temperature than 230°C[2,3], for the oxidation-reduction reaction of asphalt and salt in the mixture is very complicated, undergoing from an interface-controlled solid-liquid reaction to homogeneous liquid reaction. For the former stage, reaction under lower

TOO

150

200

250

300

Temperature, "C

Fig.7. Heat flux vs. temperature curves

FJ c,

1200

Y

400

200 160 180 200 220 240 260 280 300 Temperature, "C

Fig.8. Heat generation vs. temperature curves

863

temperature obeys neither Arrhenius and nor n order rules. So the heat generation from asphalt salt mixture is rarely dependent on temperature and its amount is so faint that it is readily lost during general experiments, thus it has led to too much doubts for discussion at one time[3-6]. 3.4

Temperature Controlling Dewar Experiment

The dewar experiment, one of the most usehl techniques in assessment of chemical reaction hazards, is herein developed to carry out a strictly adiabatic self-heating test under the lowest amount of filling sample. However, different Erom normal isothermal dewar tests keeping the surrounding temperature constant, considering a faint heat generated by the mixture, heat loss from dewar should be eliminated further by abating one factor like heat transfer forces, i.e., narrowing down temperature difference between sample and ambient atmosphere. Therefore, the particular method in our study is to let the ambient temperature follow the sample's temperature when it rises during the experiment. 290

r

.

,

,

,

,

,

.

,

,

, ,

,

280 210

d.,

280

-Tr

9

250

-T, ambient (controlled)

5

c

u

4-

upper surface

240

no 220

210

2w 190 0

time. min

Fig. 9. Dewar test (onset 190°C)

Fig. 9 shows temperatures versus time curves for asphalt salt mixture inside 500ml dewar under initial 190°C, in which TI, T2, T3 and Tq refer to temperatures of the center, the upper surface, the bottom of sample in dewar and the ambient, respectively. When the Sample's temperature inside went by 1°C up to the ambient since its self-heat, the ambient temperature was changed ladderlike by the increment of l°C,until above 265°C when the inside temperature rose quickly, the manually

864

controlled ambient followed no longer i.e., runaway reaction. Finally the sample's temperature went beyond 290°C, and the sample burned violently.

As mentioned above, it is necessary to set up the experiment as close as possible in order to reproduce the adiabatic conditions of real process. Considering that only dewar's condition is not enough to protect the heat generated by a faint reaction from heat loss, the temperature of the sample will be taken as the set point for the ambient temperature control. These two temperature readings (the center of sample and ambient) are maintained at least 1°C for a judgment that there is certainly heat generated from the sample, making full allowance for a slight temperature difference among the thermocouples even after they are calibrated (only those whose temperature difference less than 0.4 "C were selected to use.). It took first 50 hours to go through the early stage of induction period and attain 210"C, and then took another 30 hours to give rise to a run-away reaction and fire. When the experimental initial temperature was descended to 170°C, compared with the former experiments, it was difficult for sample's temperature to go beyond the ambient, and it took much longer time for the simulated mixture's temperature to reach a balanced temperature, as shown in Fig. 10. So in this experiment, bigger temperature increment was taken. But even when the initial temperatures were changed up to 183"C, the sample's temperature did not go over 1"C higher than the ambient. I81 183

-

p

I

182

I61

IS0 (19 178

3 :;: 1 ;;: I13 112 111

I10

I69

I 1

0

1 m

2 m

3 m

um

smo

f

time (mid

Fig. 10. Dewar test (onset 170'c)

4.

CONCLUSIONS

In a summery, it can be seen that

a

865

1) For the sake of settling down a long-time doubtfbl point that whether or not a run-away reaction can arise from a faint chemical reaction under a low feed temperature around 180°C, it is important to deeply study three singularities as the main reasons in an accident. To the end, a special experimental setup was established to prepare the sample which could be exactly simulated the real conditions. 2) It implied that if phosphate is introduced in the asphalt salt mixture, it will influence the decomposition of NaHCO, to such an extent that more NaHCO, will be maintained during water evaporation and brought to the asphalt salt compound where it composites continually and leave much pores in the mixture. This can be seen clearly by its micrograph under the inspection of SEM.

3) Waste feeding rate is another important factor that causes the change of the reactivity, because slower waste feeding rate will cause water having enough time to evaporate and NaHCO, having no chance to decompose in solution. As the same consequence, it leads to a porous structure when CO, gas is produced from the mixture. The BET test suggested that under the conditions that both there is phosphate and feeding rate is 50ml/h, the salt particles has larger surface area and the surface will control the initial reaction rate. 4) Heat flux from the thermal analyzing apparatus C80D also showed that the two factors are favorable to lead the heat generating from lower onset temperature about 155°C. While if either of them non-exists, the onset reaction temperature will rise up to 200"C, and heat generation will decrease much more.

5 ) An adiabatic dewar experiment proved that the runaway reaction can arise from 190°C. REFERENCES [ 11 K. Hasegawa and Y. Li, Explosion investigation on asphalt-salt mixtures in a reprocessing

plant, J. Hazardous Materials, in press (2000). [2] Y. Iwata and H. Koseki, Combustion characteristics of asphalt and sodium compounds, 29th Symposium of Safety Engineering, Tokyo, Japan (1999) 2 11. [3] An investigative committee for the fire and explosion in the Btuminization Demonstration Facility (BDF) of the reprocessing plant on the Tokai Works of the Power Reactor and Nuclear Fuel Development Corporation (PNC), A report on the fire and explosion in BDF of the reprocessing plant of the Tokai Works of PNC, Nuclear Safety Bureau, Science &

866

Technology Agency of Japan, 15 December, 1997 (in Japanese). [4] T. Hasegawa, J. Chen, H. Uchida, A. Kimura, T. Kataoka and T. Yoshida, Thermal hazard Evaluation of asphalt-salt mixture, 23rd International Pyrotechnics Seminar, Tsukuba, Japan (1997) 193. [5] Japan Atomic Energy Research Institute (JAERI), The heating experiment of asphalt-salt mixture (1998). [6] K. Hata (Ed.), Handbook of Chemistry, Press of Maruzen, Tokyo (1984) 804.

867

Assessment of the thermal and toxic effects of chemical and pesticide pool fires based on experimental data obtained using the Tewarson apparatus Christian Costa, Guy Treand, Franck Moineault and Jean-Louis Gustin* Rhodia, 24, avenue Jean-Jaures - 63153 Decines - France ABSTRACT

The Tewarson apparatus is a combustion calorimeter developed by Factory Mutual Research Co. USA, in the 1970s. A modified and computerized version of this calorimeter is used at the Rhodia Decines Centre to study the combustion of plastics, fabrics, chemicals and pesticides on 30 grams samples in a 0.1 metre diameter glass dsh. The combustion of up to 100 products has been studied in this experimental set-up and the following thermal data obtained : mass of product burnt, experimental heat of combustion, combustion efficiency, burning mass flwc, ratios of convection and radiant heat, flame height, flame temperature. The on-line analysis of combustion gases provides the following chemical data : production of COZ,CO, HCN, NO*, NO, SO*, HCl, HF, HBr, chemical yield for the combustion of carbon, nitrogen, sulphur, chlorine, fluorine, bromine. The thermal data obtained is an input to the POOL 2.0 Computer code to estimate the thermal effect of chemical pool-fires. The combustion chemical data obtained is an input to atmospheric dispersion codes to estimate the toxic effect of chemical pool fires. The correlation of experimental data obtained using the Tewarson apparatus, based on the sample chemical formulae helps provide the missing combustion data. As an example, a correlation is given for the combustion characteristics of chlorinated organic chemicals. Keywords : Pool fires, combustion data, Tewarson apparatus, combustion efficiency, chemical yield.

* To whom corresyondance should be addressed

868

INTRODUCTION The assessment of fire hazards in chemical and pesticide storages and warehouses is based on both the determination of the material combustion thermal data and the identification of the toxic emission from combustion gases. The combustion thermal data is the input data required in fire simulation softwares to estimate the consequences of industrial fires. This combustion thermal data includes the determination of the mass of product burnt, the experimental heat of combustion, the combustion efficiency, the burning mass flux, the ratios of convection and radiant heat, the flame height and flame temperature. [l] [2]. The simulation of large industrial fires provides information on the thermal effect of the accidental fire on adjacent equipment and on the protection needed to prevent the fire from spreading. Large industrial fires are also source-terms for modeling atmospheric dispersion of volatile toxic combustion products. The input data to atmospheric dispersion models are combustion chemical data including the production of combustion gases COz, CO, HCN, NO2, NO, S02, HCl, HBr, depending on the burning material composition. Also necessary is the determination of the chemical yield for the combustion of the chemical elements present in the burning material formula : Carbon, Nitrogen, Sulphur, Chlorine, Fluorine, Bromine if any [3]. The thermal and chemical data characterizing the combustion of chemicals and pesticides can only be obtained using a bench-scale apparatus, due to the great number of experiments to be performed on a wide range of products. Such a combustion calorimeter was developed by A. TEWARSON at Factory Mutual Research Corporation (USA) in the 1970s [4]. A modified and computerized version of the Tewarson apparatus was built at the Rhodia Decines Centre to study the combustion of plastics, fabrics, chemicals and pesticides on 30 grams samples. This new experimental set-up is described in the following section with special attention to the improvement of the original design.

DESCRIPTION OF THE MODIFIED TEWARSON COMBUSTION CALORIMETER The principle of the modified Tewarson combustion calorimeter built in Decines is shown on figure I . The experimental set-up may be divided in three sections :

869

Combustion chamber The lower part of the apparatus is the combustion chamber, section A on figure 1. The combustion chamber consists of a standing cylindncal quartz tube 0.160 metre in diameter and 0.490 metre high. In this combustion chamber, a 30 grams sample in a 0.1 metre diameter glass dish is placed on the plate of a balance to measure the sample weight during combustion experiments. An external heat-flux is applied to the combustion chamber by eight infra-red heaters in an air flushed jacket, allowing tht; sample to be heated to a temperature where its vapours or fumes can be ignited by an ignition source. The maximum external heat-flux applied to the combustion chamber is 30 kW/m2. The i p t i o n of the sample by an electric spark was preferred to the original pilot-flame ignition source, to avoid additional heat input and combustion gases to the experiments

The ignition of the sample is obtained without external heat-flux applied if the sample is flammable under ambient temperature. If not, an external heat-flux is applied to raise the sample temperature until ignition is obtained.

If the sample combustion is self-sustained, the sample is allowed to burn without external heat-flux applied. If not, an external heat-flux is applied to allow the sample combustion, in whch case the radiant heat-flux cannot be measured. Preliminary experiments are necessary to choose the most suitable operating conditions.

A permanent air flow of 5 m3h is blown to the combustion chamber bottom through a glass sphere bed to obtain homogeneous inlet gas composition and regular air stream. The inlet air is under flow control and its oxygen concentration may be varied by adding oxygen or nitrogen to the air flow. The combustion air composition is measured by a continuous oxygen analyzer during experiments.

A calibration of the external heat input to the sample is acheved by replacing the sample holder by a heat-flux meter. The heat-flux received by the sample is measured as a function of the power input to the &a-red heaters. This calibration allows the compensation of the mfra-red heater aging by an increased electric power supply to the external heating device. For samples exhibiting self-sustained combustion, the radiant heat-flux released during combustion is measured using a heat-flux meter. The heat-flux meter position is at flame mid-height, at 0.2 metre distance from the combustion chamber axis and directed toward the flame. The radiant heat-flux released during the sample combustion as a function of time is estimated assuming a spherical distribution of the radiant heat-flux around the flame centre. The reference area for the estimation of the radiant heat-tlux is that of the glass dish.

870

Figure 1. Modified Tewarson apparatus.

871

Dilution shaft The intermediate part of the apparatus is the dilution shaft, section B on figure 1. The dilution shaft is a standing Teflon cylinder 0.1 metre in diameter and 0.6 metre high intended to dilute and mix the flow of combustion gases and smokes with air. Teflon was preferred to stainless steel, to avoid soot deposits which could absorb contaminants such as HC1, HCN, dioxines, etc. The dilution air inlet flow to the dilution shaft is controlled by the exhaust fan mass flow rate of 70 kg/h. The aim of the combustion products dilution is to avoid losses of volatile combustion products by condensation or leaks, while limiting the dilution ratio to keep the oxygen concentration analysis accurate and controlling heat losses from combustion products. Mixing of combustion products with dilution air is acheved by the convergent nozzle at the dilution shaft bottom. At the top of the dilution shaft, the smoke temperature is measured by a thermocouple and the gas flow is sampled for continuous on-line analysis. The convection heat-flux is deduced from the smoke temperature and smoke exhaust mass flow-rate. The reference area for the convection heat-flux is that of the glass dish. The on-line gas analysis of the diluted smoke includes the determination of 0 2 , CO, COz, SO;! and NOx. Ths is achieved after passing the gas sample over a filter and a desiccant. Other analysis are performed after absorption of the gas on a Draeger tube followed by mass spectrometer analyses or after absorption on resins followed by gas chromatography. Smoke chamber The upper part of the Tewarson apparatus is the smoke chamber, section C on figure 1. This device, intended to measure the optical density of smoke, is equipped with an external photoelectric system to measure the optical density in a standing stainless steel cylinder 0.1 metre in diameter and 0.3 metre high, extending the combustion shaft. The smoke chamber exit is connected to the exhaust fan inlet. The fan flow cdntrol principle is shown on fig. 1. The fan volumetric flow rate is adjusted taking into account the smoke temperature to obtain a constant mass flow rate of exhaust gases. Data acquisition and processing system T h s section includes a CHESSEL recorder / converter and a graphic data treatment allowing display of the variation of the measured parameters as a function of time. A test result sheet is produced, giving the most important test characteristics and results.

812

EXPERIMENTAL RESULTS

To date, up to 100 products have been studied using the modified Tewarson apparatus. An overview of the results obtained on well known chemicals and pesticides is given in tables where the following data is listed under the product current name :

-

Gross chemical formula

-

Molecular weight

- External heat flux applied

-

Initial sample mass Mass fraction of product burnt

- Net calorific value

-

Heat of combustion per kg of product burnt

- Heat of combustion per kg of sample - Combustion thermal efficiency i.e.The ratio of the combustion heat measured on 1 kg initial sample to the net calorific value of this 1 kg sample.

-

Average combustion mass flux

(g/m2.s>

Maximum combustion mass flux

(g/m2.s>

-

Ratio of convection heat to combustion heat

-

Ratio of radiant heat to combustion heat

(%I (%I

Production of C02, CO, HCN, NO?, NO, SOz, HC1

- Chemical yield for the conversion of carbon into C02, CO and HCN i.e.The ratio of the carbon contained in the C02 CO and HCN produced by 1 kg sample to the carbon present in that 1 kg sample.

(g of g a s k of sample) (%>

873

-

Chemical yield for the conversion of nitrogen into N02, NO and HCN i.e.The ratio of the nitrogen contained in the N02, NO and HCN produced by 1 kg initial sample to the nitrogen present in that 1 kg sample.

(“m

- Chemical yield for the conversion of chlorine into HCl i.e.The ratio of the chlorine contained in the HCl produced by 1 kg sample to the chlorine present in that 1 kg sample

(YO)

- Maximum flame height

(cm)

- Maximum flame temperature

(“C)

- Specific extinction area i.e.The surface darkened by 1 kg of fuel, deduced from the measured optical density.

(m2/kg>

The detailed calculation methods for the combustion heat, convection and radiant heat, opacity of smokes and other parameters are given in reference [ 5 ] and are not reproduced in the present paper. The total combustion heat was deduced from the oxygen depletion during combustion according to Thornton [6] [7]. The convection heat is the heat carried out in the gas plume over the combustion chamber. The radiant heat is measured using a heat-flux meter. The combustion data for some chemicals and solvents is given in table 1. The combustion data for some pesticides is given in table 2.

Table 1 :

Combustion characteristics of chemicals and solvents, obtained in the modfied Tewarson apparatus

875

Table 1 (continued) : Combustion characteristics of chemicals and solvents, obtained in the modified Tewarson apparatus

877

Table 1 (continued) : Combustion characteristics of chemicals and solvents, obtained in the modified Tewarson apparatus

879

Table 2 :

Combustion characteristics of various pesticides, obtained in the modified Tewarson apparatus

Note : n.m = not measured The net calorific value of 2,4 D acid was not available and was deduced fiom the combustion chemical yield for the conversion of carbon.

882

COMBUSTION PROPERTIES AS A FUNCTION OF TIME

In addition to integral combustion data deduced from experiments, dynamic and time dependent properties are also obtained from combustion experiments performed in the modified Tewarson apparatus. As an example, a set of time dependent combustion properties obtained using the modified Tewarson combustion calorimeter is gwen below, concerning the combustion of a 33.6 g sample of 50 % wt solution of adiponitrile in methanol. The sample was flammable under ambient temperature and could be readily igmted by the electric spark. The sample combustion was self-sustained and did not require any external heat input to proceed. The sample mass loss during combustion was recorded as a function of time (see figure 2). The combustible mass-flux consumed as a function of time was deduced from the derivative of the sample mass loss as a function of time. The reference area for the combustible mass flux is that of the glass dish (see figure 3). The sample temperature measured in the glass dish during combustion is given as a function of time on figure 4. The flame temperature as a function of time is given on figure 5. The combustion heat-flux, convection heat-flux and radiant heat-flux measured during the sample combustion are shown on figures 6-7-8. The reference area for the heat-fluxes is the glass dish area. The mass-fluxes for the production of COZ and NO during combustion are shown on figures 9 and 10. Again, the reference area for the mass fluxes is that of the glass dish. In the example considered, combustion proceeds in two separate steps. In the first step, methanol is essentially burning exhibiting high COz and low NO production, hgh combustion mass-flux, high convection heat-flux and low radiant heat-flux. The flame temperature is hgh and the sample temperature is low as is the sample boiling point. In the second step, reached after 400 seconds of combustion, adiponitrile is essentially burning ehbiting a lower constant combustion mass-flux, high NO production, lower constant convection heat-flux, higher radiant heat-flux and higher sample temperature as the remaining sample boiling point is rising. The records of this combustion experiment show that methanol and adiponitrile are burning separately in their mixture and that the most volatile component, methanol, is burning first. T h s example chosen for convenience shows that combustion may present complex phenomena which can only be observed using a bench-scale apparatus such as the modified Tewarson combustion calorimeter. The many records obtained in an experiment help understand the sample combustion behaviour and provide the data necessary for computer simulation of large industrial fires.

Methyl Alcohol I Adiponitrile Mixture 35

30

-

25

cn

I

tE

20

L.

0

v)

8 -J

\\\

15

10 I I

MeOH

I

5

ADN

I I 1

0

I

o

iw

m

3w

4w

500

600

7w

aw

900

1000

iiw

izw

1300

14~)

1500

Time (sec)

Figure 2 : Sample mass loss during combustion as a function of time for a 33.6 g sample of 50 % wt solution of adiponitrile in methanol. The dotted line shows two combustion steps where methanol (MeOH) and adiponitrile (ADN) are burning separately.

i-

Methyl Alcohol I Adiponitrile Mixture

12

10

‘it

.-c0 Y

u)

3 a

5

0

4 I I

MeOH

I

ADN

I I I

I

Time (sec)

Figure 3 : Coinbustion mass flux as a function of time for a 33.6 g sample of 50 % wt solution of adiponitrile in methanol. The dotted line shows the separation between two combustion steps where methanol (MeOH) and adiponitrile (ADN) are burning separately.

Methyl Alcohol I Adiponitrile Mixture

0

2w

~_

300

400

500

600

7w

800

900

1wO

1100

1200

Time (sec) -~

Figure 4 : Sample temperature ("C) as a function of time for the combustion of a 33.6 g sample of 50 % wt solution of adiponitrile (ADN) in methanol (MeOH). The dotted line shows the transition between two combustion steps where methanol and adiponitrile are burning separately. Also shown are the atmospheric boiling points of methanol and adiponitrile.

900

7w 600

I I

I I

, I

MeOH

ADN

I

I I

0

100

200

300

400

500

Mx)

700

800

900

lD00

11W

I200

13W

I400

1500

Time (sec)

Figure 5 : Flame temperature as a function of time during the combustion of a 33.6 g sample of 50 % wt solution of adiponitrile (ADN) in methanol (MeOH). The dotted line shows the separation two combustion steps where methanol and adiponitrile are burning separately.

Methyl Alcohol I Adiponitrile Mixture 250

k

200

3

z

-

$ 150 F m

0

.c E

I

.a 100

I

+a

u)

na

I

I

5

0

I

I

50

MeOH

I I

ADN

I I I I

0

0

100

200

300

400

5W

600

700

BOO

900

1WO

1100

12W

13W

1400

1500

Time (sec)

Figure 6 : Combustion heat-flux as a function of time during the combustion of a 33.6 g sample of 50 % wt solution of adiponitrile (ADN) in methanol (MeOH). The dotted line shows the separation between two combustion steps where methanol and adiponitrile are burning separately.

Methyl Alcohol I Adiponitrile Mixture

O C

0

100

_________

200

300

400

5W

600

700

800

Time (sec)

900

1000

1100

1200

__

1300

1400

1500

Figure 7 : Convection heat-flux as a function of time during the combustion of a 33.6 g sample of 50 % wt solution of adiponitrile (ADN) in methanol (MeOH). The dotted line shows the separation between two combustion steps where methanol and adiponitrile are burning separately.

I

I

40

I I

30

20

to

0

0

100

200

300

400

500

____

6W

700

800

Time (sec)

900

1000

1100

1200

1300

1400

1500

Figure 8 : Radiant heat-flux as a function of time during the combustion of a 33.6 g sample of 50 % wt solution of adiponitrile (ADN) in methanol (MeOH). The dotted line shows the separation between two combustion steps where methanol and adiponitrile are burning separately.

W

0 UY

Methyl Alcohol I Adiponitrile Mixture 16

14

K 7

8

10

E 8

F I B *-

O

I I

6

.se 4 C

I

0

I

c. 0

1

I I

MeOH

0.

I

ADN

I

2

I I

0

0

100

200

300

400

500

600

700

800

9W

1000

1100

1200

1300

1400

1500

Time (sec)

Figure 9 : Mass flux of CO;! released as a function of time during the combustion of a 33.6 g sample of 50 % wt solution of adiponitrile (ADN) in methanol (MeOH). The dotted line shows the separation between two combustion steps where methanol and adiponitrile are burning separately.

Methyl Alcohol I Adiponitrile Mixture 0.08

0.07 A

-2 Y

ol

\

0.06

x

iln m

4 c

-

.-0

0,05

0,04

0.03

0

4 0,02 g

n 0.01 I

0 0

100

200

300

400

500

600

700

800

900

1000

1100

1200

1300

1400

1500

Time (sec)

Figure 10 : Mass-flux of NO released as a function of time during the coinbustion of a 33.6 g sample of 50 % wt solution of adiponitrile (ADN) in methanol (MeOH). The dotted line shows the separation between two combustion steps where inethanol and adiponitrile are burning separately.

892

INFLIJENCE OF THE CHEMICAL COMBUSTION THERMAL DATA

FORMULA

THE

ON

The experimental results obtained on the chemicals and pesticides studied in the modified Tewarson apparatus, show that the combustion thermal data is influenced by the chemical formula. For the most useful combustion characteristics used as input data for the simulation of large industrial fires i.e. the coinbustion thermal efficiency, the chemical yield for the conversion of carbon, the ratio of radiant heat, whch were defined in the previous section, recommended specific values can be deduced from the experimental results obtained on the different types of chemicals. A summary of the thermal data suggested is given in table 3 for aliphatic derivatives, in table 4 for C, H, 0, N aromatic and unsaturated cyclic compounds and in table 5 for miscellaneous organic compounds including chlorinated and fluorinated organic compounds. The combustion thermal data in table 3, 4 and 5 may be used as a first estimate in fire simulation softwares such as the POOL 2 program in the absence of specific experimental data. Table 3 : Suggested values of thermal data for aliphatic derivatives Chemical compound Alkanes Alcohols Esters, Ethers, Ketones Nitiiles Amines C, H, 0, N compounds C, H, 0, S compounds

Combustion thermal efficiency

Chemical yield for carbon

Ratio of radiant heat

97 98 96 98 91 95 95

(Yo) 93 97 95 98 82 90 91

I

("/.I

(%) 22 22 23 26 12 22

Table 4 : Suggested thermal data for aromatic and unsaturated cyclic compounds Chemical compound C, H, 0, N compounds C, H, 0, N aniline derivatives C, H, 0, N, nitro derivatives

Combustion thermal efficiency

Chemical yield for carbon

Ratio of radiant heat

(%) 70 75 40

(%) 70 75

(YO)

45

30 40 40

893

Table 5 : Suggested thermal data for miscellaneous organic compounds Chemical compound

Combustion Chemical yield Ratio of theimal efficiency for carbon radiant heat

Monochlorinated compounds with C , H, N, Cl atoms Polychlorinated compounds with C, H, 0, C1 atoms C, H, N cyclic compounds Fluorinated aromatic compounds

w.)

(%)

(%)

55

51

35

50

50

40

90 55

95 55

40 40

INFLUENCE OF THE FUEL CHEMICAL FORMULA ON THE TOXIC EMISSION OF THE FIRES The combustion chemical data obtained in the modified Tewarson apparatus, on a great number of chemical compounds can be used to estimate the chemical yield for the conversion of Nitrogen, Sulphur, Chlorine, Fluorine, during combustion. This allows the prediction of missing data for chemical compounds whch have not yet been studied in combustion experiments. As an example the chemical yield for the conversion of Chlorine into HCl during the combustion of chlorinated organic compounds was studied on a selection of 25 chlorinated organic derivatives. A summary of the results obtained is given in table 6 for chlorinated and poly-chlorinated derivatives. The data in table 6 can be used as a first estimate of the chemical yield for the conversion of chlorine into HCl, to replace missing data on specific chemical compounds for which no experimental data is available. The chemical yield for the conversion of hetero atoms is an input data to atmospheric dispersion models. Table 6 : Suggested values of chemical yield for the conversion of chlorine into HCl during the combustion of chloiiiiated organic compounds Type of chlorinated compound. Number and position of chlorine atoms One CI atom per chain or ring Two C1 atoms per chain or ring 3 C1 atoms per chaiu or ling 4 C1 atoms per chain or ring 5 or 6 C1 atoms per chain or ring 3 C1 atoms on the same carbon (- C C13) Atnine hydrochloride (RNHz . HC1)

Chemical yield for the conversion of Chloiine into HCI during combustion 80 40

20 0 0 100 % 95 %

894

The definition of the chemical yield for the conversion of chlorine in table 6 is gwen in chapter 3 above. CONCLUSION

The modified Tewarson apparatus described in this paper, is a useful experimental set-up to study the coinbustion of chemicals and pesticides. To date, this apparatus has been used to investigate more than 100 different chemicals and pesticides. The thermal and chemical data obtained was used as input data for computer simulation of large industrial fires and for atmospheric dispersion calculations to evaluate the toxic impact of industrial fires. The modified Tewarson apparatus is also a valuable tool to compare the combustion behaviour of plastics, resins and fabrics whle determining the nature of the combustion products. The modified Tewarson apparatus was used as a bench scale apparatus in the STEP European Program to study fires and their consequences, in the MISTRAL 1 program. The partners associated with this European program are : CEA / IPSN (France) CIS1 (France) CNRS / LCRS (France) (Italy) ENEA / AEAS ISSEP (Belgium) Rhodia (France) University of Aveiro (Portugal) University of Poitiers (France) other partners who joined t h s project in the course of the program are :

EDF / CLI INERIS

(France) (France)

It was shown in the course of this European project that the modified Tewarson apparatus was a key item to investigate the consequences of large chemical fires on a wide range of chemicals and pesticides.

895

LITERATURE [l] G . Mangialavori , F. Rubino, "Experimental tests on large hydrocarbon pool fires", 7 t" Int. Symposium on Loss Prevention and Safety promotion in the Process Industries, Taormina, Italy, 4-8 may 1992 - Paper no 83.

[2] S. Ditali, A. Rovati, F. Rubino, "Experimental Model to assess Thermal radiations from hydrocarbon pool fires", ibid Paper no 13. [3] L. Smith - Hansen, "Toxic hazards from pesticide warehouse fires''. 8 th Int. Symposium on Loss Prevention and Safety promotion in the Process Industries, Antwerp, Belgium, june 6-9, 1995, I, 265-276. [4] A . Tewarson, F. Tamanini, "Research and Development for a Laboratoryscale flammability test Method for cellular plastics". Final report FMRC serial no 22524 RC 76 - T 64 ( 1 976). [5] C.Costa, "Step European program. Study of fires and of their consequences. Mistral 1 program, small scale studies", 1994. [6] W.M. Thornton, Philos. Mag. 33, I96 (I 91 7).

[7] C. Hugget, "Estimation of the rate of heat release by means of oxygen consumption measurements", Fire and Material, 4, no 2, 61-65, 1980.

This Page Intentionally Left Blank

897

Hazards of surface explosions Hieronymus, H., Henschen, Ph., Hofmann, M., Bender, J., Wendler, R., Steinbach, J.", and Plewinsky, B. Bundesanstalt fiir Materialforschung und - p r i i h g * TU-Berlin ABSTFUCT The explosion behaviour of liquid solvents such as toluene, cyclohexane, and methanol with smooth surfaces below a gaseous oxidiser composed of oxygen and nitrogen is reported. In these systems difhsion flames, both types of explosions, i.e. deflagrations and detonations, can occur even when the gas phase, composed of the vapour of the solvent and of the oxidiser, is below the lower explosion limit. Since the presence of the liquid surface plays an important role, explosions in such a system are called surface explosions. Experiments have shown that the most dangerous form of surface explosions, the surface detonations, occur within a specific range of physical and chemical parameters such as the composition of the oxidiser, the initial pressure, and the geometrical factors of the equipment. Experimental investigations on surface explosions are presented. From the experimental data proposals are derived for the experimental determination of safety characteristics to estimate the specific explosion hazards in such heterogeneous systems. The influence of obstacles on the behaviour of surface explosions is investigated, additionally.

Bundesanstalt fiir Materialforschung und -priifung Unter den Eichen 87 D- 12205 Berlin Tel.: +49 30 8104 3426 Fax: +49 30 8104 1217 e-mail: [email protected]

898

1. INTRODUCTION

Oxidation processes involving a liquid solvent and gaseous oxidisers such as air or mixtures of oxygen and inert gases are widespread in chemical processes. Many of these processes can be improved by introducing a higher content of oxygen in the oxidisers or a higher process pressure. For gaseous systems as well as for heterogeneous systems it is obvious that both of these optimisation approaches can introduce higher explosion risks. A hrther aspect that is up to now not extensively investigated is the particular explosion behaviour of heterogeneous systems [ 11. According to different types of heterogeneous mixtures of organic liquids and gaseous oxidisers such as aerosols, foams, bubbly liquids, and the smooth surface of the liquid under the oxidiser, different types of explosions and detonations can be distinguished [ 1-61. This contribution concentrates on the type of heterogeneous systems consisting of a smooth surface of an organic solvent under a gaseous oxidiser. Since the presence of the liquid surface plays an important role, explosions in such systems are called surface explosions. Similar to gases, two major types of surface explosions exist. These are called surface deflagrations and surface detonations. For practical reasons it is useful to distinguish between surfaces of a long narrow and a large circular shape. Explosions in these sub systems are called one-dimensional and twodimensional surface explosions, respectively.

2. EXPERIMENTAL Two different experimental arrangements were used to investigate onedimensional and two-dimensional surface explosions. For the investigation of one-dimensional surface explosions a tube was used [6]. Two-dimensional surface explosions were investigated in a spherical autoclave using a flat cylindrical sample container. The solvents cyclohexane, toluene, and methanol were used for studying surface explosions. Pure oxygen and mixtures of oxygen and nitrogen were used as oxidiser. All experiments were carried out at room temperature.

A tube of 1174 mm in length with a diameter of 50 mm was used for studying one-dimensional surface explosions. The solvent could be filled into the tube directly or could be filled into a long narrow sample container placed in the tube. One flange is holding an incandescent wire used as ignition source. The pressure is measured with three piezoelectric pressure transducers.

899

The investigation of the two-dimensional surface explosions were carried out in a spherical autoclave. The experimental set-up is shown schematically in Fig. 1. The organic solvent was filled into a flat cylindrical sample container placed on a bed of steel spheres in the spherical autoclave. In most of the experiments the piameter of the sample container was 400 mm. The explosions were ignited by hn incandescent wire. The wire was located 2 mm above the centre of the liquid surface. The explosion pressure was monitored using piezoelectric pressure transducers. Furthermore high-speed video films were taken from a view point on top of the autoclave. The burning behaviour was observed through a glass window coupled to an endoscope that was connected to the high-speed video camera. The maximum frame rate was 4500 fi-ames per second.

1

Pressure sensor lngnition source

,

\

Duct for the endoscope

, / ;

- Sample

container

.Steel spheres

’/

Gas inlet

sensor

Gas outlet

Fig. 1. Experimental arrangement for the investigation of two-dimensional surface explosions

900

3. SURFACE DEFLAGRATION AND SURFACE DETONATION

The two major types of explosions well known from gaseous systems are also found in the heterogeneous systems under investigation, i.e. surface deflagrations and surface detonations. For illustration the different stages are shown in Fig. 2. In this case the spherical autoclave was used as a reaction vessel. Using toluene as solvent and oxygen pressures of more than 2.4 bar the gas phase above the liquid, i.e. the gaseous mixture consisting of the vapour of the solvent and of oxygen, is at room temperature not in the explosion range [ 7 ] . Despite of this fact an explosion in the heterogeneous system can occur. After activating the ignition source a pre explosion burning is observed that consists of a diffusion flame period and a cellular flame period. First the difhsion flame spreads over the surface concentrically from the centre of the surface. The propagation velocity of this diffusion flame is about 5 d s . Fig. 2a and Fig. 2e show a special frame from a high-speed video series imaging the stage of the diffusion flame after spreading a few centimetres over the surface of the liquid. The next phase of the combustion process creates cellular structured flames on the surface of the liquid that are shown in Fig. 2b and 2f, respectively. The size of the cells depends on the initial pressure and varies from 50 mm to 1 mm as the initial pressure is varied from 3 bar to 20 bar. After this period, typically 200 ms to 400 ms after ignition, the system explodes either in a deflagrative or detonative way. As an example the surface deflagration and surface detonation shown in Fig.s2c and 2g occur after 400ms and 330ms after ignition, respectively. Fig. 2d and 2h were taken after the main reaction has finished [8]. As can be seen in Fig. 2 surface deflagrations are characterised by a pressure rise similar to the corresponding explosion type in gases. Measurements with different variations in the experimental parameters led to the conclusion that surface deflagrations take place within the gas phase. A theoretical model explaining this deflagration must be based on a transport of solvent molecules during the burning period into the gas phase.

As can be seen from the corresponding pressure-time diagram in Fig. 2 the surface detonation produces much higher pressure rises and maximum pressures than the surface deflagration. Like surface deflagrations, surface detonations can take place within the gas phase. In this case the gas phase is enriched with he1 by a transport mechanism during the burning period. For the one-dimensional surface detonation in the system composed of tetramethyl-dihydrogendisiloxane and oxygen another transport mechanism was observed. In this case a

90 1

Fig. 2. Different stages of the combustion process in the spherical autoclave; system tolueneoxygen; oxygen pressure 8 bar (surface deflagration) and 11 bar (surface detonation)

shock wave is built during the combustion process that is responsible for the transport of solvent into the gas phase [9]. 4. SAFETY CHARACTERISTICS

To characterise the hazards of gaseous mixtures under atmospheric conditions safety characteristics are used that originally were defined in the literature [ 101 or in the European standard EN 1127-1 [ l l ] . For the application to heterogeneous systems it is useful to modify some of these definitions [5]. A selection of these safety characteristics related to heterogeneous systems is listed below. Maximum rate of explosion pressure rise Maximum explosion pressure Detonation run-up time Detonation pressure Detonation velocity Detonation range Detonation limits Limiting oxygen content In this contribution the two characteristics "detonation run-up time" and the "detonation velocity'' are discussed in more detail.

902

4.1. Detonation run-up time The safety characteristic detonation run-up time is known as the time delay between the activation of an ignition source and the transition from deflagration to detonation [lo]. This definition can be applied to heterogeneous systems without restrictions. One-dimensional as well as two-dimensional surface detonations show a dependence of the run-up time on the initial pressure. In Fig. 3 the measured run-up times for two-dimensional surface detonations in the system toluene-oxygen are shown in dependence of the initial pressure.

No significant dependence of the run-up time on parameters like the volume of the liquid or the volume of the gas phase above the sample container was observed. The initial pressure has significant influence on the run-up time. Up to an initial pressure of about 2 bar the run-up times are well below 100 ms. For higher initial pressures the run-up time ranges between 150 ms and 900 ms with an unsystematic spread. This behaviour can be explained by the fact that the gas phase, composed of the vapour of the solvent and the oxygen, is within the explosion range for low initial pressures and out of the explosion range for higher initial pressures. As will be show below, the run-up time can be influenced by obstacles placed on the surface of the liquid.

Fig. 3. Detonation run-up times of two-dimensional surface detonations in the system tolueneloxygen

903

4.2. Detonation velocity

In analogy to gas detonations, the detonation velocity of surface detonations is considered to be the propagation velocity of the shock wave coupled to the reaction zone. In tubes sufficiently long compared to the detonation run-up distance, the detonation velocity is generally constant. The detonation velocity in heterogeneous systems is normally lower than in gases. The velocity of surface detonations can not exceed that of gas detonations. But the detonation velocity of surface detonations is larger than the velocity of sound in the gas phase. In Fig. 4, the dependence of the detonation velocity on the initial pressure in the system cyclohexane-oxygen-nitrogen is shown for various oxygennitrogen mixtures [6]. The propagation velocity of the one-dimensional surface detonations shows no significant dependence on the composition of the oxidiser at corresponding pressures. In contrast thereto a noticeable dependence of the velocity on the initial pressure is seen. The dotted vertical line marks the gas detonation limit, that was determined experimentally. For low initial pressures the propagation velocity of the onedimensional surface detonations nearly equals the detonation velocities in the pure gas phase. For initial pressures well above the pressure indicated as gas detonation limit, the detonation velocities of the surface detonations are noticeably lower and nearly independent of the initial pressure. The solid line in Fig. 4 is calculated according to the Chapman-Jouguet theory for the corresponding gas detonation.

t 3000 I mls

.-E -8

100%02 60%02 A 55 %02 - gas det

: detonation

2000

0

> C

g. 1000 1 m

A

c

0 0 '0

h

a

A

=

a

+I

0

0

5

10

initial pressure

15

bar

Fig. 4. Detonation velocity of one-dimensional surface detonations in the system cyclohexane-oxygen-nitrogenfor different mole fractions of oxygen [6]

25

904

5. OBSTACLES

All the reported experiments involving obstacles were performed with sample containers of 400 mm in diameter (see Fig. 1). The filling height of toluene was 3 mm and 4.5 mm, respectively. The oxygen pressure was 11 bar. Under these experimental conditions detonations have been observed in all the experiments without obstacles. The obstacles used to divide the surface of the liquid were built of sheet-metal strips. The strips were formed to give obstacles of quadratic and circular shape with a height of 20 mm and 40 mm. These obstacles were placed on the bottom of the sample container so that the upper edge of the strip is located at a height h = x - y above the surface of the liquid, where x is the width of the strip and y is the height of the liquid layer. Two small notches in the lower edge of the obstacle served to connect the liquid inside and outside the obstacle. The inner area varied from 36 cm2 to 356 cm2. The ignition source was 2 mm above the liquid surface of the inner area. The influence of the obstacle height on the explosion behaviour can be inferred from the comparison of the pressure-time diagrams in Fig. 5 . The curves show the pressure development after ignition of the heterogeneous system without an obstacle, with a quadratic obstacle with a height of 17 mm, and with a quadratic obstacle with a height of 37 mm. The lateral length of the squares was 120 mm. In each experiment the height of the liquid layer was 3 mm. a

without obstacle

b

low obstacle (17 mm)

c

high obstacle (37 mm)

C

0

1 -

I

( 7 . -

0

1

time

2

1--r-

3

S

Fig. 5. Comparison of pressure development without obstacle and with quadratic obstacles of different height, t, denotes run-up time

905

Fig. 6 Frames from a high speed video illustrating the explosion process with a quadratic obstacle with a height of 37 mm

Without obstacle a detonation was observed after a run-up time t, = 337 ms. The obstacle with a height of 17 mrn was also not capable of preventing the transition from deflagration to detonation, but the run-up time was significantly prolonged to t,= 1111 ms. Using the higher obstacle, a detonation was suppressed completely. The corresponding pressure-time diagram shows a slow pressure rise with a maximum explosion pressure much lower than the detonation like process. The different stages of the deflagration can be seen in selected frames of a highspeed video in Fig. 6. The time written below each frame is the time at which the fi-amewas taken with respect to the activation of the ignition source. As can be seen from the frames at 20ms and at 80ms the diffusion flame spreads over the inner area and is stopped by the obstacle. After this period the cellular structured flame is burning in the inner area only. During this period the gas volume above the surface of the liquid changes to a flammable mixture that deflagrates at about 2400 ms after the activation of the ignition source. This deflagration is accompanied by the rise of pressure as can be seen from the corresponding pressure-time diagram in Fig. 5 . After this deflagration the rest of the liquid is burning as can be seen from the frame at 3320 ms. Selected frames from the video that was taken in the experiment with the lower obstacle (h=17 mm) are shown in Fig. 7. There was a shorter period of cellular flames which was followed by an inflammation of the outer area at about 800 ms. During the burning of the whole area, i.e. inner and outer area, the gas phase was changed to be detonable and the transition to detonation occurred after the run-up time tr = 1111 ms. Generally, a detonation was preceded by a burning of the whole surface of the liquid. This seems to be a necessary precondition for a surface detonation.

906

Fig. 7. Frames from a high speed video illustrating the explosion process with a quadratic obstacle with a height of 17 mm

Although the prolongation of run-up times does not provide a reliable concept of process safety, it can be useful in case of secondary explosion protection measures such as explosion suppression system. In Fig. 8 the run-up times for surface detonations with and without obstacles are compared. Because of the poor reproducibility of the measurements, the comparison is done in three different categories. The category "Minrrcompares the minimum of run-up times measured with and without obstacle under comparable conditions. Analogous the categories "Average" and ''Max'' compare the average and the maximum of the run-up times measured with and without an obstacle.

Fig. 8. Detonation run-up times with and without obstacles; system toluene-oxygen

907

Experiments with different shapes of the obstacles, i.e. circular and quadratic shapes with different areas, did not show significant differences in the prolongation of run-up times. Experiments of surface detonations show a lack of reproducibility. The obstacles have different efficiency when being applied to samples of different filling heights. Increasing the height of the liquid layer reduces the efficiency of the obstacles. Two measurements with the same type of obstacle that succeeded in suppressing a detonation at a filling height of 3 mm were carried out with a 4.5 mm liquid layer. The lateral length of the quadratic obstacle was 120 mm and the height of the metal strip was 40 mm so that the upper edge was 35.5 mm above the liquid surface. In contrast to the lower filling height both experiments with 4.5 mm liquid layer resulted in a detonation. The fact that a detonation could not be suppressed, might be due to the larger amount of liquid and the reduced effective height of the obstacles (35.5 mm instead of 37 mm). Another explanation could be the lower heat transfer to the bottom of the sample container resulting in a more spontaneous evaporation of a large amount of the liquid leading to a quick enrichment of the gas phase with the combustible vapour of the solvent. 6. SUMMARY Different stages of burning and explosion of a liquid in the presence of oxygen are presented. Depending on the oxygen pressure the final stages are surface deflagrations or surface detonations, respectively. The "detonation run-up time" and the "detonation velocity" are discussed as examples of safety characteristics describing explosion hazards in heterogeneous systems. The influence of obstacles on the run-up time was investigated. The presence of obstacles has a significant influence on the detonation run-up time. Although the prolongation of run-up times does not provide a reliable concept of process safety, it can be useful in case of secondary explosion protection measures such as explosion suppression system.

REFERENCES [l] Plewinsky, B., Hieronymus, H. Ch. 5.2 Heterogene Systeme aus organischen Fliissigkeiten und Sauerstoff in: Steen, H. (editor): Grundlagen des Explosionsschutzes,

WILEY-VCH, Weinheim (2000), pp. 518-557 [2] Sychev, A.N. Structure of a Bubble-Detonation Wave Combustion, Explosion, and Schock Waves; Translated from Fizika Goreniya I Vzryva (Russian); Vol. 31, No. 5 ; Consultants Bureau, New York; 1995

908

[3] Henschen, Ph., Hieronymus, H., Rockland, U., Wendler, R., Plewinsky, B. Explosions and detonations of foams 9th International Symposium on Loss prevention and safety promotion in the process industries (1998) Proceedings 2, pp 632-640 [4] Bull, D.C., McLeod, M.A., and Mizner, G.A. Detonation of unconfined fuel aerosols, Prog. in Astronaut. and Aeronautics 75 (1981), pp. 48-60 [5] Hieronymus, H., Plewinsky, B. Anwendbarkeit sicherheitstechnischern KenngroDen zur Beschreibung der Explosionsgefahr im heterogenen System organisches Losemittel/gasfdrmiges Oxidationsmittel 8. Kolloquium zu Fragen der chemischen und physikalischen Sicherheitstechnik, BAM, PTB 1999, Berlin [6] Henschen, Ph. Untersuchung von Oberflachen- und Schaumdetonationen. Dissertation, BAM/TU Berlin 1999 [7] Hofmann, M., Bender, J., Plewinsky, B., Hieronymus, H., and Steinbach, J. Influence of obstacles on surface detonations 2nd internet conference on process safety paper EH 1 available at http://www.safetynet.de/activities/conference2/index.html [8] Hofmann, M., Dissertation BAM/TU Berlin, in progress [9] Plewinsky, B., Wegener, W., and Henmann, K.-P. Surface detonations and indirect ignition processes Prog. in Astronaut. and Aeronautics, 133 (1991) pp. 279-294 [lOIBerthold, W., Loffler, U. Lexikon sicherheitstechnischer Begriffe in der Chemie, Weinheim (198 1) [llIEuropean standardEN 1127-1 Explosive atmospheres - Explosion prevention and protection - Part 1: Basic concepts and methodology

909

Relation between Ignition Energy and Limiting Oxygen Concentration for powders Klaus Schwenzfeuer,Martin Glor and Andreas Gitzi

Swiss Institute for the Promotion of Safety & Security WKL-32.302, CH-4002 Basle, Switzerland ABSTRACT

During a preceding examination [ l ] a relation was found between the ignition energy of a dust cloud and the Oxygen concentration. This relation was tested for a series of different products and it always worked well. But it was not possible to use this relation for calculating the Limiting Oxygen Concentration of a powder. The present work was designed to investigate in general the relationship between the oxygen concentration and the ignition energy of powderNitrogen-Oxygen mixtures. For this reason the used ignition energy varies within a huge range from 1 mJ up to 10 kJ.For all products a steady relation was found across the whole energy range. With the results a model could be developed which shows the hdamental relationship between the oxygen concentration and the ignition energy. 1. INTRODUCTION

One of the common measures to avoid an explosion hazard is the inertisation. It means that the oxygen of the air will be exchanged with nitrogen or any other inert gas. The part of oxygen which has to be replaced depends on the Lower Oxygen Limit of the product and of the type of inert gas. This value varies between approximately 15 Vol% and 8 Vol% for most organic dusts. Sometimes the only possible ignition sources are electrostatic discharges with a low energy. In this case it often not necessary to reduce the Oxygen concentration below the Lower Oxygen Limit, because this limit includes ignition sources with much higher energy. The question arises, how the safe

910

limit can be determined based on known product data like Lower Explosion Limit, Lower Oxygen Limit or Minimum Ignition Energy. With a preceding examination [l] this question was investigated. An equation was found, which allows to calculate the necessary ignition energy (IE) of a dust/Nitrogen/air mixture based on the Minimum Ignition Energy (MIE) and the existing Oxygen concentration ( co2) (Eq. 1). 23.2-(23.2/21).cO2 IE=MIE-e This numerical equation works very well for a large amount of products in a range between 10 Vol% and 21 Vol% Oxygen. The calculated ignition energy was in the range between 1 mJ and 1000 mJ. The relationship was tested with approximately 15 different dusts and the calculated data fit very well with the measured results for 10 dusts. These products were always synthetic dusts like dyes or antioxidants. Some dusts like pea flour and Lycopodium failed to give a good agreement. For some dusts, where the measured results fit well with the calculated values, additional tests were done with higher Oxygen concentrations up to 30 Vol%. No agreement was found between the measured and the calculated values. In the same way the Lower Oxygen Limit was measured and calculated with Eq. (1) for all 15 dusts. Also in this case no agreement was found between the measured values and the calculated ones. 2. EXPERIMENTAL WORK

The preceding examination [ 11 was done with a modified Hartmann tube and a spark discharge as ignition source. The available energy range was between 1 mJ and 1000 mJ. For the present work additional apparatus were used like the 1 m3 vessel and the 20 1 sphere. In the 20 1 sphere the tests were done with usual chemical igniters. The energy range varied between 100 J and 10 kJ. Additionally a spark discharge was used as ignition source. The energy range in this case was between 5 J and 50 J. Some of the dusts were measured in the 1 m3 vessel, too. In this case only the chemical igniters were used. The energy range was between 100 J and 10 kJ,as in the 20 1 sphere.

3. RESULTS For the whole measured energy range a continuos dependence on the Oxygen concentration was found, within the accepted measuring errors. Figures 1 to 9 represent all results obtained for different dusts.

91 1

The comparison between the results obtained in the 20 1 sphere and in the 1 m3 vessel confirmed the statement by Bartknecht [2], that the Lower Oxygen Limit is only measurable, if the shape of the ignition source is a point. If this is not the case, corrections of the results must be done. Bartknecht [2] predicts a factor of 1.64 for the difference between the values measured in the 1 m3 vessel and in the 20 1 sphere. In the present work this factor was used to correct the values measured in the 20 1 sphere with an ignition energy of 10 H.The values, determined with ignition energy of 2 H, were corrected by the factor 1.32. Below 2 kJ no corrections were applied.

-25 P

’

30

25

Y

g

+Igniter

20

.I Y

80

g

8 “ 2

0

15 10

lm3

-0-

Igniter 201

-A-

Spark 201

+MIKE3

5

0 0.001

0.1

10 1000 Ignition Energy [J]

100000

Fig. 1. Pea flour: The figure shows the results obtained in the 1 m3 vessel, the 20 1 sphere and the modified Hartmann tube (MIKE 3). In the 1 m3 vessel chemical igniters were used. In the 20 1 sphere chemical igniters and spark discharges were used. The values determined with energy of 2k.l and higher were corrected. The ignition source in the modified Harhnann tube was a spark discharge.

Bartknecht [2] assumed, that the ignition source used for the 1 m3 vessel had always the shape of a point. The measured values for the Antioxidant A in the present work (Fig. 2) suggests, that even in this case the energy of the chemical igniter influences the result of the Lower Oxygen Limit established with the 1 m3 vessel.

912

+Igniter

%! 0.001

0.1

10 1000 Ignition Energy [J]

lm3

-0- Igniter 201

+-Spark 201 +MIKE3

100000

Fig. 2. Antioxidant A: The figure shows the results obtained in the 1 m3 vessel, the 20 1 sphere and the modified Hartmann tube (MIKE 3). In the 1 m3 vessel chemical igniters were used. In the 201 sphere chemical igniters and spark discharges were used. The values determined with energy of 2 kJ and higher were corrected. The ignition source in the modified Hartmann tube was a spark discharge.

I 0.001

0.1

10 1000 Ignition Energy [J]

+-Spark201

I

100000

Fig. 3. Lycopodium: The figure shows the results obtained in the 20 1 sphere and the modified Hartmann tube (MIKE 3). In the 201 sphere chemical igniters and spark discharges were used. The values determined with energy of 2kJ and higher were corrected. The ignition source in the modified Hartmann tube was a spark discharge.

913

8

30 25

Y

g

20

-0-

Igniter 201

8

15

-A-

Spark 201

. Y 3

8

8 ;

0

10

5 0 0.001

0.1

10 1000 Ignition Energy [J]

100000

Fig. 4. Coal: The figure shows the results obtained in the 20 1 sphere and the modified Hartmann tube (MIKE 3). In the 20 1 sphere chemical igniters and spark discharges were used. The values determined with energy of 2 kJ and higher were corrected. The ignition source in the modified Hartmann tube was a spark discharge.

25 I

I

-c- Igniter 201 -A-

Spark 201

+MIKE3

0.001

0.1

10 1000 Ignition Energy [J]

100000

Fig. 5. Anthrachinon: The figure shows the results obtained in the 201 sphere and the modified Hartmann tube (MIKE 3). In the 20 1 sphere chemical igniters and spark discharges were used. The values determined with energy of 2k.T and higher were corrected. The ignition source in the modified Hartmann tube was a spark discharge.

914

0

L 8 *

30

25 20

A

.C

80

g G

15 10

2 5

8

fa

+Igniter 201

+Spark 201 +MIKE3

0 0.001

0.1

10 1000 Ignition Energy [J]

100000

Fig. 6. Red dye pigment: The figure shows the results obtained in the 20 1 sphere and the modified Hartmann tube (MIKE 3). In the 20 1 sphere chemical igniters were used and a spark discharge with an ignition energy of 50 J. The values determined with energy of 2 kJ and higher were corrected. The ignition source in the modified Hartmann tube was a spark discharge.

25

Li -o- Igniter 201

c

R

0

5

0 0.001

0.1

10 1000 Ignition Energy [J]

100000

Fig. 7. Blue dye pigment: The figure shows the results obtained in the 20 1 sphere and the modified Hartmann tube (MIKE3). In the 20 1 sphere chemical igniters were used. The values determined with energy of 2 kJ and higher were corrected. The ignition source in the modified Hartmann tube was a spark discharge.

915

i?

0

I

1

, 1 1 1 , 1 1 1

I

I 1 1 1 1 1 1 1

I

I

““L

Fig. 8. Meritena: The figure shows the results obtained in the 20 1 sphere and the modified Hartmann tube (MIKE 3). In the 20 1 sphere chemical igniters and spark discharges were used. The values determined with energy of 2 kJ and higher were corrected. The ignition source in the modified Hartmann tube was a spark discharge.

20 18

16 14

12 10

8 6 4 2 0 0.001

-0-

Igniter 201

-A-

Spark 201

+MIKE3

t

0.1

10 1000 Ignition Energy [J]

100000

Fig. 9. Antioxidant B: The figure shows the results obtained in the 20 1 sphere and the modified Hartmann tube (MIKE 3). In the 201 sphere chemical igniters and spark discharges were used. The values determined with energy of 2 k J and higher were corrected. The ignition source in the modified Hartmann tube was a spark discharge.

916

4. CONCLUSION

With the results obtained in the present work a theoretical model on the relationship between the ignition energy and the Oxygen concentration can be developed. A reasonable approach is a steady relation between two asymptotes (Fig. lo). One asymptote represents the energy threshold, below which no ignition at all is possible even in a pure Oxygen atmosphere (LIE). This value should not be mixed up with the Minimum Ignition Energy, which is always tested under atmospheric conditions, that means at 21 Vol% Oxygen. The second asymptote represents the real Limiting Oxygen Concentration. Below this value no ignition is possible even with an unrealistic high ignition energy. Between this two asymptotes the relation between oxygen concentration and ignition energy is represented by a continuos curve for one oxidation reaction. A qualitative similar result was once found by Glarner [3]. Glamer did

'

0 ' """"' 0.001 0.1

' '

"""'

' '

10

"""'

I

1000

Ignition Energy [J] Fig. 10. Model, LIE = Lowest Ignition Energy, LOL = Lower Oxygen Limit

REFERENCES [ 11 M.Glor, K.Schwenzfeuer, Einfld der Sauerstoffgrenzkonzentrationauf die

Mindestziindenergie von Stauben, VDI-Berichte 1272, VDI-Verlag 1996 [2] Wolfgang Bartknecht, Explosionsschutz - Grundlagen und Anwendungen, Springer-Verlag 1993

[3] Thomas Glarner, TemperatureinfluO auf das Explosions- und Zundverhalten brennbarer Staube, Dissertation ETH Zurich Nr. 7350, 1983

917

PROCESS SAFETY AT ELEVATED TEMPERATURES AND PRESSURES: Cool flames and auto-ignition phenomena A.A. Pekalski, J.F. Zevenbergen, H.J. Pasman, S.M. Lemkowitz, A.E. Dahoe, B. Scarlett

Explosion Group, DelfChemTech, Delft University of Technology, Julianalaan 136, 2628 BL Delft, The Netherlands The cool flame phenomenon can occurs in fuel (-air) -oxygen mixtures within the flammable range and outside the flammable range at fuel-rich compositions, at temperatures below the auto-ignition temperature. It is caused by chemical reactions occurring spontaneously at relatively low temperatures and is favoured by elevated pressure. The hazards cool flames generate are described. These valy from spoiling a product specification through contamination and the appearance of unexpected nomuzl (hot)flame (two-stage ignition) to explosive decomposition of condensed peroxides. Key words: Autoignitioin, slow oxidation, cool flame, explosion, hazard, risk, and two-stage ignition

1. INTRODUCTION Partial oxidation processes, carried out at elevated conditions, are widely used in the chemical industry. Propylene oxide, ethylene oxide, methanol, and phthalic anhydride are examples of versatile, widely applied petrochemicals. They are produced at elevated temperature and pressure. Table 1 lists some process conditions. Such conditions demand rigorous safety considerations. Due to these conditions, relatively explosiveness increases as flammability limits become wider while minimum ignition energy and auto-ignition temperature decrease. Detailed knowledge about relevant explosion indices is essential for operating not only safely, but also in the economically most efficient way. Such explosion indices must be known under realistic process conditions; thus at (high) temperature, (high) pressure (and high turbulence) conditions, as are encountered in practice.

918

Table 1 Service c

Pyrolysis Gasification

230-875 260-1815

1-379 1-310

However, the explosion indices mentioned above, which are essential for design and safety assessment, are not complete. It is, for example, widely believed that a fuel-rich, flammable mixture kept in process apparatus below its auto-ignition temperature can not ignite and therefore can not explode. Unfortunately this is not always true, since phenomena like cool flames may lead to unwanted sidereactions and, in the worst case, to explosion. The resulting by-products may spoil the quality of the main product through contamination. The process in which a cool flame is followed by ignition so that explosion occurs is called two-stage ignition. Ignorance of cool flame behaviour leads to sub-optimal operation. To cite Coffee (1980): 'Due to the lack of available data and the complexity of the problem, to assure safety in high temperature operations, one must work at temperatures sufficiently below the cool flames initiation temperature such that a sudden change in pressure, temperature or composition cannot cause a transition to ignition." Another citation from the CCPS Guidelines for Engineering Design for Process Safety (1993) ISBN 0-8169-0565-7 is ' Autoignition in chemical processes is poorly understood and the subject requires study under realistic conditions'. That such warnings should be taken seriously is illustrated by the following. D'Onofrio 1979, described several accidents in which cool flame phenomena was the cause. One of them refers to a distillation process. Long-chain fatty acid was distillated in a distillation column operating under vacuum (50-1OOmm Hg), at above 200 "C. The column was shut down and opened to air. As soon as pressure in the vessel reached atmospheric, or very shortly after, the manhole at the bottom of the column was opened. A big flash of flame came out and several workers had lSt, 2nd and 3rd degree burns. The trays in the column were

919

demolished. As well as human injury and process damage, the accident also caused significant business interruption. Indeed, any review of so-called ‘hnexplained” industrial losses will quickly uncover numerous incidents, which can be explained as possibly being due to the initiation of cool flames with subsequent transition to a hot ignition.

2. GENERAL COMBUSTION KINETICS Any combustion reaction of hydrocarbons in air or oxygen (even at stochiometric or fuel-lean concentrations) is not a one step oxidation process leading to the final products (typically carbon dioxide and water). In reality the mechanism of the process involves many intermediate compounds, like carbon monoxide, aldehydes, ketons, alkenes and oxygenated species. The general oxidation scheme (1) shows the overall reaction and contains absolutely no information about the intermediate steps the oxidation mechanism goes through as the fuel is converted to the final products.

C,H,O, + (n+x/4-y/2)02 +nCO2 + x/2H20 (1) It is very much unlikely that all of the molecules needed [C,H,O, + (n+x/4y/2)02], possesses energy exceeding the required activation energy and collide at the same place and time. The general oxidation reactions can be divided into three mechanisms namely: initiation, propagation and termination. In the initiation stage, fuel is converted into radicals:

RH + R - + H *

(2)

or RH + 0 2 +R-+HO2 (3) Where RH denotes any hydrocarbon and R- is its radical. At low temperatures formation of the HOz. radical is favoured. However, at low temperature the reaction rate of reaction (3) is much lower than for reaction (2), so the initiating oxidation reactions occur mainly through reaction (2). The lowest temperature at which the H abstraction reaction may occur is about 140 OC, in case of aldehydes, since the bond strength between the carbon and hydrogen atom is the weakest. In case of alkanes the rank of bond strength is as follows: weakest is a tertiary carbon atom, then a secondary carbon, strongest is a primary carbon atom. Additionally to reactions (2) and (3), especially higher alkanes (C4 or higher) may also decompose thermally forming two alkyl radicals. After undergoing the primary oxidation reactions, in which only compounds initially present in the mixture participate, there is a secondary oxidation reaction in which already formed compounds react together and with unconverted fuel:

920

RH + X + Re + X'

(4)

Where, X represents, depending on conditions, Ha, -OH, 0. and H02. radicals forming H2, HzO, .OH and H202, respectively. When initially radicals are formed, they react with other compounds present in the mixture (propagation) by a straight chain or a chain branching mechanism. In a straight chain reaction, one radical reacts with a stable molecule creating another stable molecule and one (other) radical. In a chain branching reaction, two radicals are formed for each radical consumed. Since both mechanisms are present during oxidation, the multiplication factor, mostly denoted as a,has a value in the range between one and two. It is very important to emphasise the difference between the effects of the mechanisms mentioned. We can express the time needed for full conversion by dividing the number of needed collisions by the frequency of the collisions. Let us consider a one cubic meter vessel kept at 300 'C. The number of moles in the vessel (ideal gas law) is 21. For hydrocarbons, typical oxidation reactions are bimolecular with a pre-exponential factor, A, in the range of 4 x 1013and 5 x 1014 cm3 mol-' s-'. To simplify, let us assume a value of A of 1014cm3 mol-' s-', which is equal to 10' m3 mol-' s-'. The estimated collision frequency between the molecules is (lo8m3 mol-' s-') x (21 m01/m3) = 2.1 x lo9 [s-'1. Assuming in the vessel only one active molecule initially, the reaction time for straight chain propagation mechanism is given by:

21-6.02~1023[moZ/m3 -molecules/mol] /;;molecule/ T=( 6.02.10"[s] = 190. lo6[ years]

m3l)

*( ,~!.1.109[1/

s]) =

If, by contrast, a pure chain branching reaction mechanism is assumed, the multiplication factor a equals 2. For full consumption of the reactants we need N number of steps: 2 = 2 1 .6.02.loz3[molecules/ m3] thus N = 83 steps, what results in:

In reality these two reaction mechanisms occur simultaneously, and the multiplication factor has a value lower than 2. Additionally, some radicals are

92 1

terminated and converted to a stable molecule. Assuming e.g. a is equal to 1.001, the number of steps N is 57827 and the time for consumption is 27.5 111s.

From this comparison one can conclude that the occurrence of chain branching reactions greatly shortens the oxidation time relative to that occurring via straight branching reactions. Moreover, if only one radical is formed in the system capable of undergoing branching reactions and if within the branching reactions there is at least one chain branching step and if no termination reactions occur, then the system is likely to convert all fuel and to be explosive. Due to the increase in the concentration of radicals formed during the initiation and propagation stages, the rate of termination reactions increases. When the rate of radical formation is lower than the rate of radical termination of newly formed radical, the termination stages begins, and the oxidation reaction ceases. It should be stressed that, although the general oxidation Chemistry of alkanes is reasonably well understood, many detailed aspects are still speculative. The oxidation proceeds through many intermediate compounds prior to the formation of the final products. These intermediates, whose formation is more pronounced at low oxygen concentrations and low temperatures, include aldehydes, ketones, alcohols, 0-heterocyclic compounds, alkenes, peroxides and carbon monoxide. They play an important role in the peroxy oxidation chemistry regime. One can generally state that the oxidation chemistry of hydrocarbons depends on temperature, pressure and oxygen contents of the system. The oxidation path can be divided into: A low temperature regime, where peroxy oxidation chemistry occurs, An intermediate temperature regime, where HOz and HzOz chemistry dominates, A high temperature regime, where small size radical chemistry occurs. Examples of dominating chain branching reactions in these regimes are (Westbrook 2000): Low temperature oxidation mechanism:

ROOH +RO. + *OH

Zntemediate temperature oxidation mechanism:

H- + 0 2 + M + HO2. + M RH + HO2- +R. + H202 H202 + M + 2 *OH+ M

922

High temperature oxidation mechanism: Ha + 0 2 + 0.+ *OH

0. and -OH radicals are very reactive and therefore generally do not react selectively with other molecules. In contrast Re and HO2. radicals are much less reactive, and one may consider them as termination radicals. At low temperature, the alkyl radical Re reacts with an oxygen molecule ( 5 ) forming a peroxy radical. At high temperatures, the equilibrium is shifted to the left, preventing formation of the peroxy radical.

Re + 0 2 ROz. (5) Therefore the low temperature oxidation path ceases at higher temperature. However, if the temperature remains below about 45OoC, at 1 bara the peroxy radial is formed, and the oxidation mechanism occurs as presented in Figure 1 (Ranzi 1995, Gaffuri 1997). It should be emphasised that the temperature limits are dependent on fuel molecular structure and system pressure. Increasing pressure favours the low temperature oxidation mechanism, so at higher pressure low temperature oxidation mechanism will dominate even at higher temperature. smaller R* and alkene The alkyl radical R. may thermally decompose giving a smaller alkyl radical and an alkene, or it may react with oxygen. Reaction with oxygen produces either the H02. radical and an alkene containing the same number of ROO* carbon atoms as the alkyl radical, or the Peroxy isomerisation alkyperoxy radical ROO-. The alkyperoxy radical undergoes peroxy / OH + cyclic ethers *QOOH isomerisation. During this process, hydrogen is transferred internally to OH + prodcusts Possible peroxy isomerisation form the hydroperoxide group (-OOH) I and a new alkyl radical centre. After *OOQOOH that, the molecule is denoted as QOOH. -Hop QOOH may contribute to the propagation stage by decomposition to R'OOH an .OH radical and further products (e.g. aldehydes), or it may undergo a RO*+OH cyclisation process forming cyclic ethers. Figure 1. Simpl$ed alkane low temperature oxidation mechanism

It

TI

\

923

At low temperature, QOOH may add molecular oxygen to form hydroperoxyalkylperoxy radicals, -0OQOOH (Baldwin 1982, Bozzelli 1994). Finally, this radical may abstract HOz, forming R’OOH, which is a degenerate branching agent. It decomposes into two radicals resulting in rapid multiplication in the number of radicals (Swern, 1970). However, in spite of a rapid and significant development of knowledge of the kinetics of hydrocarbon oxidation mechanisms, there is still a lack of kinetic data for elementary reactions. This lack of data particularly concerns reactions associated with large alkyl radicals. This hiatus is due to the complexity of the chemistry and the simultaneously occurring thermal effects as well as the complex interactions with surfaces (wall effects). Low temperature oxidation mechanisms of aromatic hydrocarbons are even less well understood.

3. THE COOL FLAME PHENOMENON

3.1. Introduction The reactions of hydrocarbons and air at low temperature, which occurs after an induction period, accompanied by a pale blue chemiluminescence was first reported by Humphry in 1812. In 1929 Emeleus used the name ‘cool flames’ to describe the weakly luminous flame that gave the same emission spectrum, regardless of fuel. The same spectrum was observed for different hydrocarbons (saturated and unsaturated), alcohols, aldehydes, ketons, acids, oils, ethers and waxes. In the past fuel whose capability to exhibit cool flame was questionable was methane. However, recent publications proved the existence of cool flame even for methane (Vanpee 1993, Barbieri 1995, Caron 1999). Cool flames are associated with the low temperature gas phase oxidation (gases and vapours) of an organic substance in air or oxygen in a fuel-rich region within the flammable range and above the upper explosion limit, Figure 2.

924

I

700,

I

1w 0

I

10

20 C W f R IN I1R. PERCENT

30

I

40

Figure 2. Flammability diagram for diethyl ether/air mixtures as a function of pressure. Typical values of temperature increase are up to 200°C; the highest value observed is 400 "C (Coffee 1980, Sheinson 1973). Similarly, the pressure pulses developed in confined spaces are small compared to those generated by normal flames and typically do not exceed twice the initial pressure. At certain conditions, several consecutive cool flames are observed in the system. Pressure and temperature rise generated by these cool flames are transient and fall almost to their initial value after passage of each successive cool flame. For a given fuel concentration, an example of envelopes of multiple cool flame is given in Figure 3. Shape and borders of the envelopes depends on fuel concentration, molecular structure, and vessel shapes and sizes (surface to volume ratio). 173. Y

c-

613,

20

10

60

r, kPa

80

Figure 3. The ignition diagram of a propane/oxygen (1:l) mixture (Lignola 1987). The numbers 1, 2, and 5 refer, to the number of cool flames occurring in the respective region.

925

The cool flame temperature (CFT) is reported as the lowest temperature at which the pale blue luminescence can be visually observed. The CFT is significantly lower than the auto-ignition temperature, see Table 2. Table 2 Comparison between cool flames temperature (CFT) and auto-ignition temperature (AZT)(NFPA 325 M, CofSee 1980). Compound CFT["C] AZT

I

I

I

Methyl Ethyl Ketone

265

ISO-PrOpyl Alcohol n-Butyl Acetate

360 225

I

515 400 420

3.2. Visual appearance and products formed In 1926 Emeleus was the first to record the emission spectrum of cool flame phenomenon. The emission spectrum appeared to be the same for several different fuels. The spectra of cool flames consist of a series of bands, shaded toward the red, the intensity of which is greatest in the blue and near-ultraviolet regions. The blue luminescence originates from an electronically excited state of formaldehyde, which is formed in a chemiluminescent reaction mainly by the radical + radical reactions:

Additional emission sources might be present, but their contribution to emission is very minor compared to formaldehyde chemiluminescence (Sheinson 1973, Fowler 1935, Agnew 1957). The sequence of temperature increases before the appearance of a feeble pale blue glow, the increase in its intensity, the appearance of a cool flame, its disappearance, and finally the onset of ignition of a normal flame is the same for all hydrocarbon fuels investigated. The absolute value of these temperatures in the case of rich fuel mixtures varies slightly with the ratio of fuel to air. For the series of paraffin hydrocarbons, these temperatures decrease with increase in the molecular weight of the hydrocarbon. However, they increase if the corresponding olefin or aromatic replaces the paraffin.

926

A wide variety of stable and moderately stable products is created after cool flame phenomena occur. In case of alkanes, these are alkenes, alcohols, saturated and unsaturated aldehydes and ketones, and 0-heterocyclic compounds. In addition, oxides of carbon and water are formed, the concentrations increasing with the availability of oxygen. With increase of temperature, the yields of oxygenated organic products gradually decrease while those of alkenes and of hydrogen peroxide increase. Because aldehydes and carbon monoxide are formed (among many other products), rather than the water and carbon dioxide produced by normal combustion flames, cool flames are often referred to as the phenomena associated with partial or intermediate oxidation reactions.

3.3. Effect of pressure and temperature In hydrocarbon-fuel mixtures, for each temperature in the cool-flame zone, there is a certain critical initial pressure above which cool flames arise following an induction period. Below the critical pressure, cool flames are not formed (Figure 2). The induction period of a cool flame is defined as the time from the introduction of the mixture into the reaction vessel until the cool flame luminescence starts. Inside the cool flame zone, an increase in temperature for a certain constant initial pressure is accompanied by a decrease in the induction period and increase in intensity (brightness of luminescence, magnitude of pressure increase) of the cool flame. Further increase in temperature results in an even greater decrease in the induction period but with a decrease, instead of an increase, in intensity of the cool flame. This effect is due to disappearance of the peroxy radical (reaction (5)), whose presence is necessary for the further low temperature oxidation path. If, on the other hand, the temperature is kept constant and the pressure is increased progressively, then the duration of the induction period falls continuously and the intensity of the cool flame increases. (Figure 3 and 4). This effect is due to the fact that the low temperature oxidation path is favoured by increasing pressure. The appearance of cool flame at higher than atmospheric pressure (> 15atm) has also been observed (Minetti 1995, 1996, Affleck 1967). Since reactions leading to the cool flame are not isothermal, obviously the greater the volume the shorter the induction period.

927

INITIAL PRESSURE ( k P n )

Figure 4. The dependence of the induction period f o r a cool flame on initial pressure and temperature of Zsobutane/oxygen (1:2) mixture. The system temperature is shown close to the relevant curves (modified after Luckett 1973).

3.4. Two-stage ignition phenomenon During the cool flame induction period, a slow oxidation process occurs leading to the consumption of only insignificant quantities of the initial reactants. In a cool flame the extent of oxidation usually reaches 50 percent, so that the products contain about 50 percent non-oxidised hydrocarbon, 30 percent aldehydes, 10 percent peroxides and a more or less significant quantity of oxygen. In this mixture reactions, can occur involving both further oxidation of oxygen-containing compounds and oxidation of the hydrocarbon. With increase in the initial pressure, both the rate of these reactions and the quantity and rate of heat evolved increase. If the pressure exceeds a certain critical pressure, the rate loss of heat becomes less than the heat evolved; thus, a breakdown occurs in the heat balance and ignition takes place. Since the cool flame preceded this ignition, the whole process has a two-stage character and is called two-stage ignition (Figure 2 and 6 d,e,f). Important to note is that the products of the second stage (hot flame) are very different from those of cool flames. During the high exothermic second stage of ignition, the wide variety of oxygenated products produced in the cool flame stage is largely destroyed. However the concentrations of water, oxides of carbon, and of low molecular weight hydrocarbons increase. In fuel rich mixtures, extensive cracking of the excess fuel occurs, giving high yields of simple aliphatic and of aromatic hydrocarbons and, in very rich mixtures, depositing soot.

928

Concerning fuel concentration in the mixture, there are two possibilities of transition from cool flame to hot ignition, Figure 2. In the first possibility, the fuel concentration is within the flammable range, close to the upper explosion limit. In the second case, the mixture is kept above, but still near to, the upper explosion limit. The temperature and pressure of the mixture increase due to cool flame phenomena, widening the flammability range. When the flammability region is entered, an explosion may take place. This is illustrated in Figure 5 on a typical ignition diagram. At some pressure, Pg, the heat generated by cool flames is sufficient to rise the temperature to the ignition point. Increase in pressure causes the same effect: shift from point A to B on Figure 5. Since in closed systems the cool flame increases both temperature and pressure, the resulting direction of change will be upwards not parallel to either the temperature or pressure axis (Coffee, 1980, D’Onofrio E.J. 1979, Luckett 1973).

I Y/,

PRESSURE

-

Figure 5. Typical ignition diagram for fuel concentration within the flammable range.

Moreover, intermediate compounds created during the induction time and products of cool flames have higher upper explosion limits than the fuel. Due to the contribution of these more flammable gases, the upper explosion limit of the mixture increases and the flammability range becomes wider. For an illustration of this effect the Le Chatelier’s equation for multi-component mixtures can be used. This is a convenient method for making a rough estimation.

929

4. POSSIBLE PHENOMENA AT LOW TEMPERATURE OXIDATION

At low temperatures, several oxidation phenomena have been observed like a single cool flame, successive cool flames (up to seven, Luckett, 1973), two stage ignition, and multiple stage ignition (Griffiths 1971). These are presented on Figure 6.

I

TIME [arbitrary units)

Figure 6. Pressure versus time for isobutane/oxygen mixtures (1:2) (Luckett 1973). For experiments presented in Figure 6 a spherical Pyrex glass vessel of volume 500 cm3 was used with the mixture of iso-butane and oxygen at a ratio of 1:2. Below 340°C (line a), the pressure rise generated by these cool flames is transient, and the pressure falls almost to its initial value after passage of each successive cool flame. Between 340°C and 35OoC,the transient pressure pulses are smaller and are superimposed upon continuous pressure increase due to slow combustion (line b). Above 350"C, only one cool flame propagates, but its build up is much faster (line c) than previous cases. Two stage ignition (lines d, e, f) with and without intermediate temperature decrease are observed above 350°C and high initial pressure (> ca 51 P a ) . Additionally, a three-stage ignition is observed at high pressure and temperatures between starting from 310°C (line g). At temperature higher than 410°C auto-ignition always occurred.

930

-

5. SAFETY ASPECTS ACCIDENTS Since cool flames generate only minor temperature and pressure changes, them-selves, they do not present a significant hazard. However, products forn and mixed with the chemicals in a given process may lower the final qualitj the products through contamination. Build-up of peroxides during the induct period can create additional safety problems. Peroxides behave unstable, an( they manage to accumulate, they may lead to damage causing loss containment and may serve too as an unexpected ignition source. Accumulat may occur either in ‘dead spaces’ or due to condensation in cold spots within equipment. Peroxides have higher boiling points than their precuI hydrocarbons. Additionally, there is the danger of transition via ignition to flames, as shown in Figure 5 and 6 d, e, f, g. Temperature pulses associated u pressure changes may also promote transitions to ignition. A compari: between the effects of gas explosions and cool flames is given in Table 3.

Table 3

6. CONCLUSIONS We have shown that the generally followed practice of operating below the au ignition temperature does not always guarantee safe operation since cool flar can lead to hot ignition. On the basis of the information presented, the follow general conclusions may be presented: For a given compound in air or oxygen, cool flames may occur temperatures several hundred of degrees Centigrade lower than autoignition temperature (AIT) of that compound (see Table 2). Cool flames can be initiated by a process disturbance, e.g. hot spots ( metal ball) Cool flames may lead to explosion by so-called two-stage ignition. Pressure increase promotes the occurrence of the low temperat oxidation chemistry where, cool flames and two-stage ignition occur.

93 1 0

0

0

0

Temperature and/or pressure increase shortens the induction time for cool flames. Cool flames can not be seen in a lighted room. To an observer with a good dark vision adaptation and in a darkened room, cool flames appear as a pale blue luminescence. If the cool flame temperature is exceeded but the residence time is too short, cool flames will not occur. The same applies to the AIT. Products of cool flames and of the induction period increase the upper explosion limit. Formed peroxide (induction period) may condense in the system and accumulate, leading to increased risk of ignition and or even possible explosion.

Possible dangerous situations may occur if 0 Process conditions are within the cool flame regime. Residence time in the process equipment, for example due to 'dead spaces', exceeds the induction time for cool flame. Such conditions may occur, for example during shutdown of the process. Hot spots are present within the process equipment. Such conditions locally increases the rate of oxidation processes, thus increasing the concentration of active intermediate compounds. Cold spots exist in the process equipment, allowing condensation of peroxides. Their explosive decomposition may lead to damage causing loss of containment and may serve too as an ignition source In summary, cool flame temperature and limits should also be considered as a safety parameter for processes operating at elevated temperatures and pressures.

LITERATURE 1. Affleck W.S., Fish A., 1967, 'Two-stage ignition under engine conditions parallels that at

low pressures', 15thInternational Symposium on Combustion, pp.1003-1013. 2. Affnes W.A., Sheinson R.S., 1980, 'Autoignition: The importance of the cool flame in the two-stage process', AIChE 86" National meeting. 3. Angew W.G., Angew W.G., Wark J.K., 1965,'Comparison of emission s ectra of low temperature combustion reactions in an engine and in a flat-flame bumer',6! t International Symposium on Combustion pp.894-902. 4. Baldwin R., Hisham M., Walker R., 1982,'Arrhenius parameters of elementary reactions involved in oxidation of neo-pentane', J. Chem. SOC.Faraday Trans. 1, 78, pp.1615 5. Barbieri G., Dimaio F.P., et al., 1995,'Modelling methane cool flame and ignitions', Combustion Science and Technology, vol. 106, pp 83-102. 6. Bozzelli J., Pitz W., 1994,'The reactions of hydroperoxypropyl radicals with molecular oxygen', 25" International Symposium on Combustion, pp.783.

932

7. Center for Chemical Process Safety (CCPS), Guidelines for Engineering Design for Process Safety, American Institute of Chemical Engineers, New York, 1993. 8. Coffee, R.D., 1980,‘Cool flame and Autoignitions: Two oxidation processes‘, Journal of Loss Prevention’, Vol. 13, pp. 74. 9. D’Onofrio E.J., 1979,‘Cool flame and autoignition in glycols’, Loss prevention, vol. 13, pp. 89-97. 10. Emeleus H.J., 1926, J. Chem. SOC.pp. 2948. 11. Emeleus H.J. 1929, J. Chem. SOC.pp. 1733. 12. Fish A., Read I.A., Affleck W.S., Haskell W.W. 1969, Combustion and Flames vol. 13, pp. 39. 13. Fowler, A., Pearse R., 1935, Proc. Roy. SOC.London A152, pp. 354, 14. Gaffuri P., Feravelli T., Ranzi E., et al, 1997,‘Comprehensive kinetic model for low temperature oxidation of hydrocarbons’, AICHE Journal vol. 43, no. 5 , pp 1278. 15. Glassman I.,1996,’Combustion’,Academic Press, San Diego. 16. Griffiths J.F., Gray B.F., Gray P., 1971,‘Multistage ignition in hydrocarbon combustion: Temperature effects and theories of nonisothermal combustion’, 13th International Symposium on Combustion, pp. 239-247 17. Humphry D., 1817, Philos. Trans. Roy. SOC.London, pp. 77. 18. Salooja, K.C.,1964,’Influence of surface-to-volume ratio of quartz reaction vessels on preflame and ignition characteristics of hydrocarbons, Combustion and Flame, 8, 1964, pp.203 - 213. 19. Lignola P.G., Reverchon E., 1987,‘Cool flames’, Progress in Energy and Combustion Science, v d . 13, pp. 75-96: 20. Luckett G.A., Pollard R.T., 1973, ‘The gaseous oxidation of isobutane 1’, Combustion and Flame, vol21, pp. 265-247. 21. Caron M., Goethals M., De Smedt, G. et al., 1999,‘Pressure dependence of the autoignition temperature of methanehr mixtures’ Journal of Hazardous Materials, Vol. 65, Issue 3, 19, pp. 233-244 22. Minetti R., Carlier M., Ribaucour M., Therssen E. and Sochet L.R., 1995,’A rapid compression machine investigation of oxidation and auto-ignition of n-heptane: Measurement and modelling’, Combustion and Flame, vol. 102, pp.298 - 309. 23. Minetti R., Ribaucour M., Carlier M. and Sochet L.R., 1996,’Autoignition delays of a series of linear and branched chain alkanes in the intermediate range of temperature, Combustion Science and Technology, 113-114, pp. 179 - 192. 24. Ranzi E., Feravelli T., Gaffuri P., Sogaro A, 1995,‘Low temperature combustion; Automatic generation of primary oxidation reactions and lumping procedures’, Combustion and Flame, 102, pp.179. 25. Sheinson R.S., Williams F.W., 1973, ‘Chemiluminescence spectra from cool and blue flames: Electronically excited formaldehyde’, Combustion and Flame, vol. 21, pp. 221230. 26. Swern D., 1970,’ Organic peroxides’, John Wiley & Sons, New York, pp. 191. 27. Vanpee M., 1993, ‘On the cool flame of methane’, Combustion Science and Technology, vol. 93, pp. 363-374. 28. Westbrook C.K., 2000,‘Chemical kinetics of hydrocarbon. Ignition in practical combustion systems’ 28” International Symposium on Combustion, to be published .

Topic 6

Storage and transport of dangerous goods by road, rail, water and pipeline

This Page Intentionally Left Blank

935

FRACTURE STATISTICS AND OFFSHORE GAS TRANSPORT BLACK SEA AND THE INDIAN OCEAN V.Polyakov", I. Kurakin aDepartment of Corrosion, Central Construction Firm of Oil/Gas Equipment's Mail 117133Teply Stan 25-1-233 or 143500 Moscow region Istra Kirova 14 fax 7 095 3666201 Email [email protected] bMaterialDepartment, Moscow OiVGas University , Lenin Avenue 65 Moscow, Russia

1.ABSTRACT In 1980-2000 there occurred nearly 600 heavy accidents of large diameter gas pipelines: 100-110 accidents of diameter 1420 mm, 190-210 catastrophes with diameter 1220 mm, about 300 accidents of diameter 1020 mm. Many thousands of short cracks are presented in gas transport pipelines. Stable crack growth fatigue rates in aged pipes have ranged from 5.10-* to 8.10-6 d s e c [ 1-4 ] and not differ much from those in new pipes. The economic effect from the Black Sea offshore gas pipeline transport would be tremendous: many thousands billion dollars. The Indian offshore pipelines might be much more profitable . However nobody has calculated money losses and ecology impact after fracture accident. To estimate transport possibility across any see; it's necessary to know sea's depth, pipeline length, see corrosion properties. Nowadays there are no data, suggesting optimism on safe operation of the Black Sedthe Indian Ocean offshore gas transport pipelines.

2.GAS TRANSPORT PIPELINES ACCIDENTS 1980-1997 (1965-2000) Gas transport pipe's fracture accidents-1965-2000 have been analyzed . Earlier data, concerning accidents 1980-1999, have been presented in [ 1-61. According to these these works, one of the maximum of accident number observed in 1986 for all diameters of gas transport pipes:-1420 mm, 1220, 1020, 820, 720, 520 and less. Many years different scientists have been using the same GASPROM data to analyze fracture statistics [ 1-14] but they obtained different results. Fracture statistics 1965-1990 worsened [14]. According to Russian officials 1980-1999 and Americans [12], the number of accidents, decreased for transmission and distribution systems. Some discussion

936

on this subject was held. Donald Strusma in his letter to Oil/Gas Journal explained this phenomenon by the decrease of the number of reports on fracture accidents [13]. But fracture time and fracture characteristics for aged materials and aged pipes are always lower than those for new pipes and new materials. Aged pipes are fractured at lower stresses and less fracture times than new pipes [9]. If we determine fracture accidentlphenomenon for one pipeline system, any improvement of fracture resistance and fracture time is impossible [6]. Inspection and repair prevent fracture. More honorable statistics would be a sum of fracture accidents plus a number repair events. "Inspection defectlaccident" is an accident without gas loss and without ecological impact. Inspection defect is not a catastrophe. Fracture mechanics estimates a minimum size of inspection defect. Nowadays diagrams of pipe pressure Vs crack depthlwidth are often used for this inspection.. Table 1 Data on transmission gas pipeline fracture accidents in the former USSR (Russia) 1980-2000 Year Pipeline Accidents'Corrosion Gas losses Accidents' number' length, number accidents' million cubic per 1000 kilometers per kilometers number meters vear 1980 124000 81 27 328 0.65 1981 129000 89 35 445 0.68 1982 138000 52 22 134 0.38 1983 148000 76 40 280 0.5 1984 160000 87 34 267 0.55 1985 170000 99 37 326 0.58 1986 177000 79 24 21 1 0.45 91 22 156 0.48 1987 188700 1988 196000 56 19 122 0.28 1989 207000 66 11 170 0.32 1990 212000 54 16 157 0.25 1991 215000 43 11 140 0.2 1992 138295 25 4 41 0.18 1993 139269 30 11 125 0.22 140000 35 5 450 0.25 1994 1995 143333 31 8 85.7 0.215 1996 thesame 35 13 138.1 0.24 1997 14400039 10-20 -148000 There were several heavy accidents of 1420 mm diameter pipes. One them 23.3.1997 3rd April in Moscow region there occurred large explosion and fire.

937

Diameter of the crater in the earth was 20 m. Some animals were in fire. Deaf of wild board was described by Moskovsky Komsomoletz paper 4 April 1997. June 1997 -a catastrophe near Myshkino (Moscow river), 14200 mm pipe. 10 July 1997pipeline fracture near Petersburg 1998 14500036 10-20 - 150000 1999 145500more than 8-15 150000 20 January-October there occurred 20 catastrophes 2000 25-45

3. OFFSHORE GAS TRANSPORT REALITY ACROSS THE BLACK SEA As was shown in [3-71, the Back Sedthe Indian Ocean offshore gas transport pipelines will fracture many times (Fig. 1). These scientists do forecast catastrophes and short cracks' appearance.

h4 36

The Earth's c o l l a p s e risk e d s t s due t o an increase of l a r g e diameter tranamisaion pipeline l e n g t h

/ /

24

Fig. 3 or 12

.

Dietanoe e f f e c t "Length e f f e c t " a

building new l a r g e diameter Pipes 1020 mm. 1220 mm and 1420 nun

0

200000

Small number Of catastrophaa

Large number of catastrophes

b

Pipeline system l e n g t h , Inn

3.1.The Black Sea geography The Black Sea is characterized by some problems, which may block long distance gas transport from Russia to Turkey. Some of them are as follows large depths, about 2000 meters, long transport distance, high concentrations of Hz S and other corrosion agents in the sea,

938 high pressures 20 MPa. Low-alloyed steels used for gas transport pipelines are very sensitive to sulfide corrosion cracking; especially high strength steels grades X60-X100. Carbon steels have better resistance to SCC than low-alloyed ones. But their strength properties are insufficient for transporting large amount of gas from Russia to Turkey. Russian officials refused to use large diameter pipes for the Black Sea because of the size effect that has been investigated in [ l , 21. They are planning to use 610-mm diameter pipes with large thickness 32-mm (0.032 m). Steel X65. Offshore gas pipeline length - near 400-km [15]. Russian seacoast is very steep, Turkish coast is slop [16]. In Russian coast gas operation pressure is 25 MPa, pipe diameter - 1.42 m. In Turkish coast diameter 1-1.2 m and pressure 7.6 MPa. The total gas pipeline length from the Russian gas fields to Turkey equals 1213 km. Another problem is the absence of hard seabed in the Black Sea. The sea floor consists of corrosion products, mud, gel.

3.2. SIZE AND THICkDESS EFFECTS

Many specialists consider that large and thick pipes prevent fracture [ 15,171. SCC cracking occurs less frequently on heavy wall pipe where hoop stresses are lower [17]. The results are in conflict with the physical phenomena of size effect and thickness the effect according to which the effects of fracture in large and small diameter pipes differ considerably i.e. fracture accidents involving smaller diameter pipes are considered to be less dangerous (Fig.2) and the risk of obtaining a brittle thin-wall material (5-mm wall thickness or less) is much lower than the risk obtaining a brittle heavy wall material (10-mm wall thickness and larger) (Fig.3a, b) [lS-201. 24 20 16

12

=

8

Fracturetime,

4

420

520 620 720

820

920

1020 1120 I220 1320 1420

Pipe diameter, mm

Figure 2. Statistics of life time and rupture lengths of fracture accidents of transmission pipelines in Russia (1980 - 1993)

939

TD=TC+66( two 055/t CO o 7 1- I00

Tc= The 85% shear area transition temperature based on a given8 i Z 8 Charpy gpecimen, OF TW= Nominal W.T. of pipe material,

in.

Tc= W.T.

,

of the Charpy V-notch

specimens, in.

-50

I

0

I'

0.2

I

0.4

00

W.T.

I

0.8

0

in.

I

1eO

I

1.

Fig.3a. Thickness effect: temperature correction for thickness effect. Correlation exists at 85% shear area (Kiefner and Maxey, 1995)

940

BB

h

a.a

P

1

Fig.3b. A comparison of how increasing ferritic stainless steel content and thickness reises the DBTT and lowers the impact resistance

3.3. DISTANCE EFFECT AND ECONOMY

A mayor participant in the international gas business, Algeria has been playing a leading role in gas exports over the past 30 years.. Projects for of 2010 call for nearly doubling these volumes. To provide growing share of supply, two major projects have recently started up: expansion of the Trans-Mediterranean line to Italy and the Maghreb-Europe pipeline linking Algeria to Spain and to Portugal via Morocco. The economics of a long distance (2000-2500 km), large diameter (40-48in.) gas transmission line depends on a minimum pipeline throughput of 10-15 bcmy (billion cubic meters per year). A pipeline bringing gas from the fields in Southern Algeria to southern Europe and having a capacity of 10-15 bcmy would require today an investment of $ 3-4 billions. Building of pipeline land section costs $ 1.5-2.5 million/km and $ 2.5-3.5 million/km for an offshore section. Transportation costs are critically important because they tend to represent an important element of the cost of gas supply for long-distance gas pipelines. They include technical costs and transit fees. When an international gas pipeline project must cross more than one country on its way to final consumers, a transit fee is paid to third countries crossed by the pipeline. In the case of Trammed and Maghreb-Europe pipelines, only one transit country is crossed by each line [21]. Concerning Siberia-Europe and Siberia-Turkey, there exist more problems for pipelines. There are several transit countries and distances from Siberia to Europe and to Turkey are longer. Long-distance gas pipeline transport from Siberia to Europe is profitable only using large diameter pipelines, mainly 1420 mm. Russia possesses an amazing gas resource base. However, official figures overstate the recovery factor for gas in place and appear to systematically overestimate volumes of recoverable gas in undiscoverable fields. Of 212 tcm of initial recoverable resources in Russia, approximately 33 tcm of remaining

94 1

recoverable gas is concentrated in 16 fields that constitute the nation's key gas resources. It is gas that will support most of the volumes supplied over the next 20 years. These key resources are distributed very unequally with respect to the technology and investment required bringing the gas to the market. The cheapest sources will be Urengoy and Yamburg fields. Zapolyarnoye fields and the Urengoy satellites follow these. Production and transportation of gas from Yamal peninsula, the Kara and Barents seas will times the current average cost of gas production in Russia. Only a few offshore fields will contribute to supply by 2015. All of approximately 39 tcm of offshore-undiscovered gas is irrelevant to Russia supply through 2015. These resources include those distributed in the Laptev, East Siberian and Bering seas, where cost of production and transportation will be astronomical and unquestionably place these volumes (which are probably exaggerated anyway) well beyond the pale of supply over the next 20 years [22]. 3.4. HYDROGENATION EFFECT occurs during corrosion. For large diameter pipe any hydrogenated surface crack may be critical [ 1,2]. The relation between stress and critical crack length is given by: o = (2y E / n L)OT5, (1) where y is the specific surface energy density, L is the length of the crack and E is Young's modulus. The quantity "y" can be presented it t e r n of the stress intensity factor K. Let us estimate the orders of magnitude of the fracture length:

L= Kz / no2

(2)

and with the data: E=2.105 MPa, the fracture toughness value Kc for pipeline steels ranging between from 50 to 150 MPad m, o = 170 MPa. Hence, L = 0.3 m. The pipes are operated under cyclic or dynamic loading conditions and critical threshold range of the stress intensity factor in fatigue, AKth decreased to a value of 2- 1OMPa-mo3'. Hence, L may even become smaller than 0,3 m this is also justified by noting that K may become less than the level of 50-150 MPa-.\Im. this is considered to be an acceptable result. However, hydrogenation will decrease the critical levels of the fracture length to 0.1 ...0.01...0.001....0.0001m. 3.5. CATHODIC PROTECTION. The Earth civilization has not built cathodic

protection systems, which can control and provide necessary cathodic protection currents along 400 kilometers of the route at the sea depth of 2000 meters. Additionally, high cathodic protection potentials result in hydrogenation. Sometimes anodic hydrogenation occurs. 3.6. REPAIR TECHNOLOGIES have never been used in such conditions.

942

C Less than 0.05

I

Cr 25

Ni

7

Mo

4

I

Other elements, % N

However, large diameter pipes, made from this steel, have been never used. Supersteel 2507 possesses excellent corrosion and mechanical properties. But the usage of superstainless steel in the Black Sea (The Indian Ocean) will be astronomically expensive. 3.8. THE EFFECT OF SHORT CRACKS

Different definitions of short cracks may be presented. Classical definition is follows. A short crack length is less than a plastic zone size at the vicinity of the crack. Any crack with the same geometry may be physically short (e.g. large diameter pipes) or physically long cracks (small samples). Discussing this subject in Eurocorrosion 99 Congress, prof. A.Plumtree estimated short cracks as approximately five times smaller in comparison with long cracks [24]. However this is correct only for "geometry short crack definition". Long-distance fractures in pipes may be dealt with microstructure parameters e.g. distribution and geometry of second phase particles, the chemical composition [25] and also short cracks behavior in pipes . Short cracks initiate due to hydrogen induced cracking, SCC [26] or during mechanical loading. At the first stage they quickly propagate [27] (Fig.4).

943 r l

0

A

o

170 MPa 183 M€'a

174 MPa 192 YP.

u 4r'LL-LLLLLLLLJ po sw o,i o;,

4Q0''0

2oa so0 400

Crack longth, micron. Figure 4 . Crack growth rate cycle ration N,/Ni

0

0.1

0.4

0s

%I%

crack length( &,c) and (b,d). Komuxdr 5. e t al

YI

At the second stage the propagation rate decreases sharply. A part of them stops. During the third stage some of short cracks become long cracks and one or several ones develop according to Paris law: da/dN = C AK"'

(3)

Finally fracture occurs. There exist much more short cracks than long cracks (Fig.5).

944 (

>400L)

300

200

100

0

Figure

5

.

Short crack. number n VB crack length i n aged trannport large diameter pipeline

The process described is similar to classic reliability curve. Firstly, there are many fracture accidents (short cracks propagate very quickly), at the second stage fracture probability is very low (pipes "live" with unmovable cracks during long periods). At the third stage one or several cracks become critical.

3.9. Ecology Offshore pipeline gas transport across the Black Sea and the Indian Ocean is dangerous in comparison with gas transport by ships. The Black Sea ecology would suffer greatly [3-61. But the officials are planning to transport gas from

945

Russia to Turkey this year [28-301 Committee of Foreign Affairs of Russian parliament has recently adopted the project [29] Some west scientists support the project as well [23].

4. CONCLUSIONS 1. Fracture statistics of gas transport pipes have been presented in many works [l-14, 17-19, 24-26]. In Table 1 only heavy accidents are presented. Certainly the Black Sea offshore gas transport pipeline will be fractured many times. 2. Many effects can block offshore gas transport across the Black Sea from Russie to Turkey: distance, well thickness, size, hydrogenation, economy, cathodic protection, repair technology, corrosion effects, short cracks' behaviour. 3. The number of short cracks is numerous. The initiation of Short cracks may be dealt with several phenomena: hydrogen induced cracking, stress corrosion cracking, 0 static or dynamic loading during pipe fabrication from plates and pipes' transportation. Only macroscopic (small) samples can be without short defects . In oiVgas transport pipes they always exist. Studying cracks in brittle materials, A.A.Grithith opened the first page of fracture mechanics science. 4. The Black Sea gas offshore transport problems are tiny ones of the Indian Ocean offshore gas transport task. ~

REFERENCES [ 11 V.Polyakov, Proceedings of Eurocorrosion-97 Congress, Norway, Trondheim, 1997, vol. 1.165-170.. [2] V. Polyakov, et al. in Ibid 159-164. . [3] V.Polyakov, F.Ulmavsay, Proceedings of Eurocorrosion-99, Germany, Aachen, 1999, see material in laser diskette or in abstracts book., p.161. [4]V.Polyakov , T.Mitrofanova, Chen Nan-Ping, Fracture Statistics in Gas Industry. Transactions of 7" International Congress Fatigue99, Beijing, China, ~01.3,2473-2478. [5] V. Polyakov , G.Bulatov, O.Andronova, Why is a fracture of a large diameter pipeline is considered to be a catastrophe. Ecological and other aspects. Proceedings of 10" Anniversary. The Society for Risk Analysis-Europe. Stockholm, Sweden, 1997, 73 1, 850-854. [6] V.Polyakov, Transactions of the 2"d International Conference on Pipeline Rehabilitation and Maintenance. Hungary, 1988, paper n. 15.

946

[7] V.Polyakov , Gas Industry (Gasovaya Promyshlennost), Moscow, 1997, n.6. pp.29-32 (in Russian). [8] V.Dedeshko, Proceedings of the 4" International Business Meeting Diagnostics-98, Yalta, Ukraine, 1998, pp.4-9 (in Russian). [ 101 V.Kharionovsky, Gasovaya Promyshlennost, special edition. Petroleum Economist, 1996, n.3, pp.1X-X. [l11 V.Dinkov, V.Ivantsov, Gasovaya Promyshlennost, 1997, n.8 pp.16-20 (in Russian). [9] V.Dedeshko, Transactions on GASPROM Heads Meeting. Sochi, Russia, 10-12 November 1999 (in Russian). [12] P.Crow, Oil&Gas Journal,, 1995, April 25, pp.23-29. [13] D.Strusma, Oil&Gas J., 1995, Junel2, letters. [ 141 V. Kanaykin, A.Matvienko, Razrushenie trub magistrlnykh truboprovodov (Gas Transmission Pipeline Fracture), Ekaterinburg, Russia, 1997, pp. 1-102. [ 151 Y .Zaytsev, Technical Decisions Concerning Offshore Gas Pipeline RussiaTurkey. Proceedings of the 9" International Meeting Diagnostics99, Sochi, Russia, 1999, v01.2. pp.249-252(in Russian). [16] G.Yabstrebtsov, Writer G.Wells Was Not Dreaming About It.. Gas Transport from Russia to Turkey Across the Black Sea, Factor (Journal Factor), Moscow, Russia,1998, n.3, pp.34-36 (in Russian). [ 171J.Beavers, B.Harle, Proceedings of the lSt International Pipeline Conference M.Maintpour ed., Calgary, Canada, 1996, vol. 1,pp.555-564. [18] J. Kiefner, W.Maxey, Oil&Gas J., 1995, October 9, pp.66-74. [19] L.Rosenfield, Oil&Gas J., 1997, April 4, pp.66-74. [20] J.Douthett, J.Stainless Steel Industry, 1996, Jan., pp.273-278. [21] Eddine Khene, Oil&Gas J., 1997, Dec.15, pp.33-39. [22] J.D.Grece, Oil&Gas 5.1995, Feb.13, pp.79-81, Feb.6, pp.71-74. [23] Anton C.deKonig to V.Polyakov, Private Communication, 1999,Oct.6. [24] A.Plumtree,A.Lambert,R.Sutherby, Proceedings of Eurocorrosion99 Conference,G.Schmidt ed., Aachen, Germany, laser diskette. [25] S.Rousserie, Mhigalli, M.Touzet et al., In Ibid. [26] J.-L.Crolet, C.Adam, In Ibid. [27] D.Kosanda, S.Kosanda, S.Tomaszek, H.-P.Rossmanith (ed.), Failures and the Law. E&FN SPON, London, 1996, pp.353-361. [28] N.Dolgushina, Go Ahead, Many Billion Dollars Will Be Yours, Factor J., Moscow, 2000, N. 1, pp.4-7 {in Russian}. [29] M.Krutikova In Ibid, 2000, n.2, pp.34-36 (in Russian). [30] V.Sinenko, In Ibid, 2000, n.3, pp.4-9.

947

Appropriate Labelling of FIBCs for their Use in Explosion Endangered Areas Dr. C. Bluma,Dr. W. Fathb, Dr. M. Glor', G. Luttgensd and Dr. C.-D. Walther' aDeutscheMontan Technologie GmbH, Beylingstr 65, D-44329 Dortmund, Germany bBASFAG, D-67056 Ludwigshafen, Germany 'Schweizerisches Institut zur Forderung der Sicherheit, CH-4002 Basel, Switzerland d

Am Berg 27, D-5 1519 Odenthal, Germany

'Bayer AG, D-5 1368 Leverkusen, Germany

1. INTRODUCTION The topic of electrostatic hazards has long been recognized as an important but often misunderstood subject. However, too often accidents have occurred in the processing industries including the Chemical Industry because of a lack of understanding static electricity. When filling or emptying Flexible Intermediate Bulk Containers (FIBC), fires and explosions have taken place [l]. Although such incidents up to now have been relatively rare, it is necessary when handling FIBCs to have a critical look at the hazards caused by static electricity. The use of FIBCs has increased greatly in recent years, primarily because of their convenience and economics in transporting large quantities of powders and other bulk materials. In contrast to IBCs, drums etc. they are collapsible, needing less space in the work area when they are empty. In order to design explosion prevention measures as is necessary in hazardous areas electrostatic ignition sources - e.g. caused by non conductive FIBCs - have to be taken into account. Thus, it seems reasonable to classify and to label such types of FIBCs which can be handled safely in the corresponding hazardous areas. Additionally it has to be considered that combustible dusts handled in the FIBCs particularly at filling and emptying operations can form explosive mixtures with air, which must not be ignited by the packing material as an electrostatic ignition source.

948

2. IGNITION HAZARDS CAUSED BY FIBCS

When filling or emptying FIBCs, in many cases explosive atmospheres are formed either by the dust itself or they are already present in the surrounding. In general, FIBCs are made of polypropylene woven fabric which as a highly insulating material impedes the dissipation of electrostatic charge, which has accumulated in the FIBC caused by the charged product. When bulk material or powder piles up in the FIBC, electrostatic charge builds up accordingly. If the electrical conductivity of the powder is very low, the charges settled on the particles cannot flow away to ground rapidly enough. This leads to an increase of the charge density in the upper region of the bulk heap, irrespective of whether or not the FIBC is conductive. To avoid electrostatic ignition sources caused by discharges of the FIBC the electrical charges inside and/or on the wall of the FIBC have to be dissipated (leading to a decrease of the electrical field strength) to a non hazardous degree. In view of electrostatic ignition hazards different types of FIBCs have been designed to avoid electrostatic ignition sources in the different types of hazardous areas. Thus, in order to safely avoid such electrostatic ignition hazards - as e.g. is also required in the EC Directive (99/92/EC, Annex I1 2.3) it appears to be reasonable to classify said containers by unambiguous labelling. 3. ZONES AND CATEGORIES

When explosion prevention will be achieved by the concept ,,avoiding of ignition sources“ it is compulsory to subdivide hazardous areas into zones. According to the above mentioned directive the plant management is responsible for that. The area classification has to be carried out according to the standard EN 1127-1 (Explosion prevention and protection). Zone 0:

A place in which an explosive atmosphere consisting of a mixture with air of flammable substances in the form of gas, vapour or mist is present continuously or for long periods or frequently.*

Zone 1:

A place in which an explosive atmosphere consisting of a mixture with air of flammable substances in the form of gas, vapour or mist is likely to occur in normal operation occasionally.

* The definitions are taken from the Directive 99/92/EC (“ATEX 11Sa”), in which the term “hazardous place” has been taken to describe areas where an explosive atmosphere may occur. In the concerning guidelines normally the term “hazardous area” is used.

949

Zone 2:

A place in which an explosive atmosphere consisting of a mixture with air of flammable substances in the form of gas, vapour or mist is not likely to occur in normal operation but, if it does occur, will persist for a short period only.

Zone 20:

A place in which an explosive atmosphere in the form of a cloud of combustible dust in air is present continuously, or for long periods or frequently.

Zone 2 1:

A place in which an explosive atmosphere in the form of a cloud of combustible dust in air is likely to occur in normal operation occasionally.

Zone 22:

A place in which an explosive atmosphere in the form of a cloud of combustible dust in air is not likely to occur in normal operation but, if it does occur, will persist for a short period only.

For the safe operation of equipment in potentially explosive atmospheres precautions have to be taken to avoid ignition hazards, depending on the zone in which it will be used. As the manufacturer of equipment is responsible for constructional safety of his products in potentially explosive atmospheres, he has to label them according to the following system of groups and categories: Equipment group I applies to equipment intended for use in underground parts of mines, and to those parts of surface installations of such mines, liable to be endangered by firedamp and/or combustible dust. 0

Equipment group I1 applies to equipment intended for use in other places liable to be endangered by explosive atmospheres.

According to the level of protection categories are defined for the equipment for intended use in potentially explosive atmospheres: Equipment in category 1 meets the requirements of zones 0 and/or 20. Equipment in category 2 meets the requirements of zones 1 and/or 2 1. Equipment in category 3 meets the requirements of zones 2 and/or 22. As it is necessary to distinguish between the equipment suitable in the zones 0, 1 and 2 (gas atmospheres) or the zones 20, 21 and 22 (dust atmospheres) the letters G for gas and D for dust will be put after the category index. Example: equipment suitable for use in zone 1 will be marked I1 2 G.

950

4. TYPES OF FIBCS AND THEIR ELECTROSTATIC PROPERTIES

There are a lot of different FIBCs in use for different purposes. Concerning the aspects of the avoidance of - electrostatic - ignition hazards up to now 4 types of FIBCs (A,B,C and D) have been described, differentiated according their ability of charge dissipation and/or limiting the energy of possible discharges. These 4 types of FIBCs are given in the following: 0

0

0

Type A: A FIBC made from non conductive material without any measures against electrostatic charging. As no electrically conductive material is interwoven in the fabric, grounding and therefore charge dissipation is hardly possible. Explosive atmospheres of gases as well as explosive atmospheres of dusts can be ignited. Thus, a Type A FIBC must not be used to handle combustible dusts. If such a FIBC - containing inert material - has to be handled in hazardous areas, this may only happen in Zone 2 or Zone 22. Type B: A FIBC made from non conductive material (including the commonly applied inner coating) having a breakdown voltage not exceeding 4 KV to avoid electrostatic propagating brush discharges. This reliably prevents the ignition of explosive dust atmospheres but explosive gas atmospheres can still be ignited. Like Type A the Type B has no interwoven conductive material. Thus, a Type B FIBC can be used to handle combustible dusts; but it must not be used in hazardous areas Zone 1 or 0. Type C: A FIBC normally made of non conductive fabric with interwoven conductive threads (see CENELEC Report R044-001 [3])

-

forming a reliably interconnected grid of maximum 50 mm mesh size

or

-

having a distance less than 20 mm (threads interconnected at least once).

Those conductive threads must have a resistance to ground of less than lo8 Q and must be grounded especially during filling and emptying operations. Some Type C FIBCs have interconnected loops to enable grounding via a (grounded) hoist system. When grounded properly there is no risk of discharges effective for ignition. The inner surface of the FIBC may have a thin coating, its breakdown voltage to the conductive threads must not exceed 4 KV.

95 1

This description of the Type C FIBC differs somewhat from that originally given by Maurer et al. [2] and in [4],where a completely conductive or at least dissipative FIBC-material is named having a resistance to ground of (not more) less than lo8 0. The above given description refers the Type C FIBCs which are actually available and present in the market and can be used as well as the "original" Type C of Maurer et al. Thus, a Type C FIBC can be used to handle combustible dusts, and there is no risk using it in hazardous areas Zone 1, 2, 21, 22, provided it is properly grounded. Type D: A FIBC made from non conductive material containing a system of separated conductive fibres which have no electrical contact to each other. This FIBC is not conductive but enables a charge dissipation into the surrounding via corona effect. To decrease the charge (e.g. at voltages below 5 KV) which is still remaining after discharging via corona Type D FIBCS are sometimes equipped with an ,,antistatic" coating lowering the surface resistance of the fabric. Grounding of a Type D FIBC is not possible. Because of the charge dissipation into the surrounding via corona discharge the Type D FIBC - as available in the market - can easily charge insulated conductive parts or persons (who are conductive from the electrostatic point of view). Those parts or persons can generate electrostatic spark discharges being able to ignite explosive mixtures of gases or vapors in air when they contact ground or grounded parts. Thus, a Type D FIBC may be used with combustible dusts, but only in hazardous areas Zone 2 and 22+ as is allowed for FIBC of Type By if it can be shown by test that the breakdown voltage is less than 4 KV. The application of a Type D FIBC in a hazardous area Zone 1 requires further measures decreasing its effective charge (e.g. in terms of surface potential) to a non hazardous degree. A test method for the identification of Type D FIBC which are suitable in Zone 1 is given in Chapter 6 . 5. PROPOSAL FOR LABELLING FIBCS It is not the aim of this paper to discuss whether FIBC or like packaging could represent ,,equipment" in the sense of the ATEX 100 directive 94/9/EC. But nevertheless the precise labelling of equipment should apply to FIBCs. This will

Some manufacturers claim that FIBC Type D might be used in explosive gas atmospheres if the charge accumulation will not exceed certain values which are marked on the bag. These instructions seem not to be very helpful to the customer.

952

enable the customer to select the appropriate FIBC for the particular application following the requirements given in the ATEX 118 directive 99/92/EC. In general, equipment for use in hazardous areas is marked with the well known “EX“label (hexagon). It would be desirable and plausible to the customer when those FIBCs which are permitted to be used in hazardous areas were labelled with the ,,EX“label as well. According to the above mentioned categories FIBCs for the use in potentially explosive atmospheres might be labelled in the following manner: Type A: Attention: no use in hazardous areas Type B: “Ex” label + I1 2 D Type C: “Ex” label + I1 2 D + I1 2 G Type D: “Ex” label + I1 2 D This labelling should be done in the responsibility of manufacturer based on the demands given in the literature [ 1, 4, this work]. The label has not the status of an ATEX 100 label.

6. APPLICATION OF A TYPE D F€BC Bv HAZARDOUS AREA ZONE 1 In order to permit a Type D FIBC in a hazardous area zone 1 such that it may become labelled as I1 2 D + I1 2 G, the following tests and limiting values are suggested: To exclude discharges effective for the ignition of explosive gas atmospheres arising from the FIBC fabric and to avoid charging of insulated conductive parts or persons the following test procedures are recommended:

. .

A sample of the FIBC fabric of the size 1000 x 1000 mm2 supported by a highly insulating frame has to be charged to a high surface charge density e.g. by corona spraying discharge. When approaching a metal sphere with a radius of 25 mm at ground potential to the charged surface the measured maximum charge transfer by a single discharge must not exceed 30 nC (limit for gases or vapours of explosion group IIA and IIB). The ,,blown up“ FIBC has to be charged by corona. For this purpose a corona tip is located in the centre of the FIBC and a corona current of 5 yA is switched on. Charging by corona has to be stopped as soon as the electric field outside the bag attains a constant level. (This typically occurs after 2 to 5 minutes). Then the corona tip has immediately to be removed from the FIBC. The potential of an electrode made of a 500 x 500 mm2 metal plate placed 1 m apart from the FIBC is recorded. This plate is mounted parallel to

953

one surface (face to face) of the investigated FIBC already before the corona charging is started. The plate has to be kept electrically insulated from ground. Its total capacity including the measuring device has to be adjusted to 200 pF. 10 s after switching off the corona current the measured potential of this plate must not exceed 300V. The Test method is based on experimental investigations. The limiting value for the potential is chosen so that an explosive Hydrogedair-mixture will not be ignited under the conditions assumed. For a safe use of Type D FIBCs - meeting the requirements listed above - in a hazardous area zone 1, it should be stated that all conductive parts of the equipment and installations including the operators (who are conductive from the electrostatic point of view) within a distance of minimum 1 m from the surface of the FIBC must properly be grounded. This has to be implemented in the instructions for use.

REFERENCES [l] [2] [3] [4]

L:G: Britton, Process Safety Progress, 12,4 (1993) 241-250 B. Maurer, M. Glor, G. Luttgens and C. Post, Inst. Phys. Conf. Ser. No 85, Sect 3, Oxford (1987) CENELEC Report R044-001 “Safety of machinery - Guidance and recommendations for the avoidance of hazards due to static electricity”, ( 1999) Beispielsammlung zu den Richtlinien “Statische Elektrizitat” Merkblatt TO33 Ausgabe 3/98 der BG-Chemie, Jedermann-Verlag Dr.Otto Pfeffer oHG, Heidelberg (1998)

This Page Intentionally Left Blank

955

Risk assessment and decision-making strategies in dangerous good transport. From an Italian case-study to a general framework B. Fabiano, E. Palazzi, F. Currb and R. Pastorino DICheP - Chemical and Process Engineering Department “G.B. Bonino”, University of Genoa, Via Opera Pia, 15 - 16145 Genoa, Italy

1. INTRODUCTION The relentless drive of consumerism has required increased quantities of dangerous goods to be manufactured, transported, stored and used year on year, despite the relative recent move towards “inherent safe” materials [l]. The safety and efficiency of road transport is to be considered a strategic goal in particuIar in those countries, like Italy, in which about 80% of goods is transported by this means with a 30% increase with reference to the 2010 forecast. Moreover, recent severe accidents, like the Monte Bianco tunnel one, have emphasised the problem, making it clear that the present system does not hnction optimally and that the risk connected to dangerous goods transport is comparable with the fixed plants one. Generally speaking, the concept of risk is the relation between frequency and the number of people suffering from a specified level of harm in a given population from the realization of specified hazards [2]. The recent EEC Directive 96/82/EC implies the evaluation of risk in highly industrialized areas by means of Quantitative Area R s k Analysis techniques. It can be noted that certain dangerous substances are transported along particular Italian road sections in quantities that would exceed the threshold for safety notification or declaration, set down in Italy by Seveso I1 Directive, if stored in a fixed installation. As reported by different researchers, a specifically tailored QRA methodology can represent an effective tool to assess the risk to people associated with the transport of dangerous substance. The risk from dangerous goods transport by road and strategies for selecting road loadroutes are faced in t h s paper, by developing a site-oriented framework of general applicability. Poor appreciation of factors related to road conditions such as road class, designated speed limits, traffic density, as well as of the population characteristics, is likely to result in a

956

risk assessment insensitive to route specifics and over- or under-estimating the overall level of risk [3]. It was therefore chosen to develop a high level of detail in the frequency model, by considering in-depth the traffic accident environment; a “cautious best estimate’’ approach was employed adopting either realistic and directly detected assumptions, or conservative overestimating hypotheses. Contrary to other models [4,5], this approach considers the risk from normal traffic accidents in addition to the risk from the major hazard aspects of the transport of dangerous substances. 2. RISK MODELLING

The frequency of an accident on the i-th road stretch can be expressed by the following equations:

fi = y,L,n,

(1)

6

Yi = Y o C h j j=l

(2)

where: yi = expected frequency on i-th road stretch (accidentkm vehicle); Li = road length (km); ni = vehicle number (vehicle); yo = statistical basic frequency ( a c c i d e n h vehicle); hj=local enhancing/mitigating parameters (-). The frequency of an accident evolving according to a scenario S, on the i-th road stretch, can be expressed as:

where: P, = probability of evolving scenarios of type S, following the accident initialiser (i.e. collision; roll-over; failure etc.); P, = ignition probability for flammable substances. In considering the magnitudo of the accident, it seemed important to include both the motorist on the road and the off-route population. The number of fatalities N, caused by the accident evolving according to a scenario S, on the i-th road stretch, can be calculated according to following equations:

where: N,,=road fatality number (fatalities); w e h i c l e density on the road area (vehicle/m2); k=average vehicle occupation factor; A,, = road letal area (m2); N,,= off-road fatality number (fatalities); A,, = letal area (km,); D=population density (inhabitants/km2).

957

When considering different concurrent scenarios y and j (i.e. toxic release and delayed ignition), in order to avoid overestimating, the total letal area will be considered as: A L,t=A,,+Aj-[Ay&,]. 3. A PRACTICAL APPROACH

It is clear that a realistic evaluation of the accident frequency is to be considered an essential step in the risk assessment. As an example, an evaluation at a national level, making reference to ISTAT (National Institute of Statistics) data referred to 1999, can be performed starting from the following data: national road gasoline consumption 12.5.1O6 T year-'; average distance covered 10 km/L; yearly distance covered 1.95.10" km year-'; number of accidents 168.103; obtaining an accident frequency for cars corresponding to 8.6.10-7 accident year-'.km-'. In a similar way, starting from the annual number of trunk accident (18 lo3 accident-year-')and an average yearly distance of 10 km year'.truck-', the truck accident frequency corresponding to 1.8. accident year' '.km-'can be calculated. When dealing with a particular route, a realistic evaluation of the frequency must take in account on one side inherent factors (such as tunnels, rail bridges, height gradient, bend radii, slope, characteristics of neighbourhood, meteorological conditions) on the other side factors correlated to the traffic conditions (traffic frequency of tank truck, dangerous goods trucks etc), suitable modifylng the national frequency.

Figure 1. Pilot area

958

In order to provide a framework of general applicability for a road evaluation at local level, field data were collected on the selected highway, by systematic investigation, providing input data for a database reporting tendencies and intrinsic parameterhite-oriented statistics. A pilot area was selected to this purpose, referring to the routes starting from the Genoa port area (the most important in the Mediterranean basin) towards the industrialized North Italian and Central Europe districts. Genoa-Milan A7 highway is characterized by high truck traffic (mainly ADR) and inherent factors determining to a major accident risk, with reference to both individual and social risk, defined according to European limits. As reproduced in Fig. 1, A7 highway is connected to A10 highway to the West and to A12 highway to the East. An alternative route towards Milano is represented by the highway Voltri-Alessandria A26, starting at the west side of Genoa and joining A7 highway after Serravalle exit. Historical frequencies, calculated for each highway stretch, are reported in Table 1. If compared with the historical accidents, it can be noticed that A7 highway is characterized by values higher at least an order of magnitude than the accident frequency calculated b other researchers for certain type of load threatening accidents [6], (6.0.10- ), thus approaching the calculated values for urban road. The results can be ascribed to the already-mentioned particular characteristics of the route, with intrinsic hazard factors also due to its old construction time (1935).

Y

Figure 2. Average daily traffic flux and daily traffic of hazardous materials (ADR), monitored on the different stretches of A-7 North highway, in the year 1999

959

Table 1. Accident frequency on the highway A7. ~~~

~

Highway stretch

~~

Length [km] Yearly traffic (n)

Accident frequency ( a c c i d e n m )

1

1.9

10977375

8.63.10-7

2

3

11541300

4.04.10-7

3

2.9

1013 1670

6.47.10-7

4

14.3

5648740

6.56.10-7

5

5

4485485

13.4.10-7

6

5.8

4395330

7.45.10-7

7

6.6

43 15395

4.56.10-7

As reported in Table 2, this assumption is confirmed by the average speed calculated for the different A7 highway stretches and vehicle type, making reference to the statistics obtained from Italian Highway S.p.A. Table 2. Average speed on A7 highway, for the different vehicle categories Average speed (km/h)

Highway stretch Car

Truck

Total

Genova Ovest-ConnectionA-7lA-10

84

67

83

Connecti0n.A-7lA-10Connection A-7lA- 12

80

64

78

Connection A-7/A-12- Bolzaneto

77

62

75

Bolzaneto- Busalla

80

64

77

Busalla- Ronco Scrivia

80

64

77

Ronco S.- Isola del Cantone

80

64

77

I. del Cantone - Piemonte

80

64

77

960

Figure 3. Accident hourly distribution on A7 highway Genova-Serravalle.

The statistical distribution of the accidents during the hours of the day, a resulting from on-site survey performed by Road Policy of Genoa district over span of one year, is reproduced in Fig. 3. In order to verify the existence of a correlation between accident and heav traffickazardous materials transport (ADR), a statistic elaboration over the Sam time span was carried out, considering as well the results reproduced in Fig. 4 .

Figure 4.Percentage daily distribution of heavy traffic (ADR)on A7 highway.

96 1

By considering the daily ADR traffic on the different highway sections, reported in bold number in the already mentioned Fig. 1, it results that the higher values of dangerous goods fluxes correspond to the intersection between the highways A10 (West riviera) and A12 (East riviera), in the stretch between the towns of Bolzaneto and Busalla and in the starting stretch, from the central port of Genoa (Genova Ovest tollgate) to the connection between the highways A10 and A7. Globally, the considered highway can be divided into 22.63 km of straight stretch ;9.33 km of tunnels and 7.54 km of bends. As a basis of comparison, the number of accidents in Liguria for the different vehicle categories was obtained by elaborating ISTAT statistics, as follows: motorcycles: 1024; cars: 5635; trucks: 444; other: 91. The proportion of severe accidents on A7 highway north during the years 19951999 is in the range 27%-40% of the total accidents, defining a severe incident as one involving death, serious injuries, a fire or explosion, or more than Euro 25.000 worth of damage. By elaborating the data collected on the field, over an observation time of one year, the immediate causes of the accidents on the highway A7 north, can be grouped as reported in Table 3. Table 3.

Immediate accident cause on A7 highway north.

Accident cause

Number of accident

Percentage [“h]

Speed

67

40,3

Lane change with no signalling

6

34

Dangerous overtaking

3

1,s

Fit of drowsiness, illness, carelessness

20

12,o

Loading loss or movement

3

1,s

No right of way at an intersection

2

12

No safe distance

5

3,1

Accidental obstacle on the caniageway

55

33,l

Loading back exceeding

1

076

Bursting of a tyre

1

0,6

Fire

1

0,6

Vehicle stop due to failure

2

12

166

100

Total

962

As is well known, various factors influence the accidents: mechanical, environmental, behavioural, physical, road intrinsic. The main points of interest resulting from table 3 are the high proportion of incidents due to speed, corresponding to 40.3% and the proportion due to drive errors equal to 21.7%. The striking high percentages of these factors are to be correlated again to the intrinsic characteristics of the analyzed highway. In fact, the high proportion of stretches with curves characterized by small radii (< 200m) and steep descent, make it necessary to respect low speed (i.e. 40 km/h), not usual on this type of road. When dealing with HAZMAT incidents, historical data reported by Hardwood et al. [7] show that the proportion due to traffic is 11%, while the proportion involving a failure of the truck (body, tank, valve or fitting) is as high as 44.5. It can be pointed out that, dealing with dangerous good transport, the main difference with process industry is the need of a noteworthy improvement in the inherent safety of the system and in the human factor. A statistical multivariate analysis was performed by correlating historical accident data, directly collected on the field, with relevant intrisic road factors and meteorological, traffic conditions. A significative (P<0.05) degree of correlation was highlighted making reference to following parameters: h,-h, geometrical characteristics; h,-carriageway type; h,-meteorological conditions; h,- baffic intensity and typology. The number of accidents verified in tunnel or road bridge was limited, allowing to obtain numerical results (h6), which would need fiu-ther investigation. It is however clear that the data reported are to be considered more from the qualitative viewpoint, as well as that the results of risk modelling would be considered for the comparison of different alternatives, rather than in its absolute value. Table 4 summarizes the results of the statistical elaboration of the different enhancing/mitigating factors, carried out on the highway considered. Table 4.

Factors correlated to intrinsic road characteristics. INTRINSIC CHARACTERISTICS Straight road Road bend (radius > 20Om) Road bend (radius < 200m) Plane road Slope road (gradient < 5%) Steep slope road (gradient > 5%) Downhill road (gradient < 5%) Steep downhill road (gradient > 5%) Two lanes for each carriageway Two lanes and emergency lane for each carriageway Three lanes and emergency lane for each carriageway Tunnel Bridge

h, 1 1.3 2.2

h2

h3

h6

1 1.1 1.2 1.3 1.5

1.8 1.2 0.8

0.8 1.2

963

Table 5.

Factors correlated to meteorological conditions METEOROLOGICAL CONDITIONS Fine weather Rain Snowlice

h4 1 1.5 2.5

Table 6 .

Factors correlated to traffic characteristics on the highway A7 TRAFFIC CHARACTERISTICS Low intensity < 500 vehicleh Medium intensity <1250 vehicleh with heavy traffic <125 trucWday High intensity > 1250 vehicleh High intensity > 1250 vehicleh with heavy traffic > 250 trucWday

h5 1 1.4 2.4

4. RESULTS AND DISCUSSION

The study on the density of the population which might be exposed to hazardous materials hazards from transport must include data on population density along the route and on the so-called motorist density, considering as well the proportion which may be considered particularly vulnerable or protected. Otherwise, all individuals within a threshold distance from a road stretches incur in the same risk regardless of their location. The average density on the route can be calculated starting from the collected statistical data relevant to average daily traffic, average speed and geometrical data of carriageway and lanes, in each highway stretch considered. A summary of the results is schematized in Table 7, together with the average population density along the route resulting from the elaboration of ISTAT statistics. By comparing these data with the usual classification of the environment typology, it appears that the first three stretches can be classified as urbanhuburban environment, while only the two last have rural characteristics. In order to evaluate correctly the number of on-road population involved in the accident, the response and variations in the motorists density following an accident were considered. In particular, heavy goods vehicle were assumed to occupy 20 m of lane length and other vehicle 4 m. Two classes of motorist density are to be considered: the former refers to the carriageway where the accident occurs, the latter considers the opposite carriageway, were the “ghoul effect” causes the slowing down of the traffic.

964

Table 7.

Average density on highway A-7. Stretch of A7 Highway

On-route density [vehicle/m2]

Population density [personflan2]

Genova Ovest- Al1.A-.//A- 10

2.52 10-3

2729

Al1.A-7lA- 10-Al1.A-7lA-12

2.85 10-3

1360

All.A-7/A- 12- Bolzaneto

2.57 10-3

2729

Bolzaneto- Busalla

1.40 10-3

766

Busalla- Ronco Scrivia

1.21 10-3

290

Ronco S.- Isola del Cantone

1.09 10-3

119

I. del Cantone - Piemonte

1.07 10-3

36

In order to evaluate the letality area, the consequence model was applied making reference to the event tree reproduced in Fig. 5.

Failure

Bum out of

of tanker

tanker by

, I

Release

of vapours

Blow out of tanker

I

I

23

23

POOL FIRE

Figure 5.

Event tree of truck accident

FIRE BALL

965

Making reference only to flammable and explosive events, five scenarios were theoretically considered, i.e. bleve, unconfined vapour cloud explosion, jet-fire, flash-fire and pool fire. Dealing with these scenarios, it seemed realistic to consider that owing to the congestion of the traffic and to the low protection offered by cars and trucks to these events, all motorists in the lethal area die. Making reference to off-road population a two steps model was considered [8], total lethality within the LD,, hazard range; 25% lethality between the LD,, and LD, ranges; no lethality beyond LD, range. The above-described technique was adopted for the evaluation of individual risk, defined as “the frequency at which an individual may be expected to sustain a given level of harm from the realization of a specific hazard” [9]. In this way, an in-depth evidence on the distribution of the risk along the route and on the localization of high spots is performed, with good accuracy and precision. Considering the potential for transported hazardous materials to cause multiple fatalities and the likelihood of the occurrence, the well-known societal risk can be modelled with tha same approach, by the frequency of exceedance curve of the number of deaths (F/N curve) due to transport. The results show that the risk associated with the transport of hazardous materials on the highway considered, in the stretches 2 and 3 is at the limit of the personally acceptable level of risk set down aemrding te the w d l - h w n criterion [2)

where P, is the acceptable probability of death from the individual point of view and P,, is the probability of being killed in the event of an accident. These results are to be considered carefully also owing to the fact that the stretches defined at major risk are common to different directions, namely Genoa port-North and East riviera-North. On this basis, the opportunity of limiting hazardous materials travelling during particular time bands, must be considered. As an example, making reference to the already-mentioned Fig. 4, about 53% of ADR traffic is focused in the time interval 8 a.m. -13. A second strategic opportunity consists in imposing a different highway route for hazardous materials transport. In this case-study an alternative route is represented by A26 highway, from Genoa Voltri toward Alessandria. This highway actually collects the traffic from the West port of Genoa, from Multed oil port and from the West riviera, but being more recent and characterized by lower intrinsic risk factors, it could gather also the traffic from East and Genoa central port. However, the practical utilization of this option is made difficult by the need of crossing a long urban stretch, while the risk of the transport of hazardous substances is lower if the route followed avoids centres of population.

966

A solution for the risk mitigation is therefore the construction of a slip road connecting Genoa central port and highway A26, even if the feasibility of this option is obviously constrained by economical and environmental impact issues.

5. CONCLUSIONS The risk from transporting dangerous goods by road and strategies for selecting road loadroutes are faced in this paper, by developing a site-oriented framework of general applicability. A methodological approach for the assessment of standard vehicle and dangerous good truck flows was applied to a pilot area, allowing a statistical reinforced evaluation of intrinsic enhamindmitigating parameters. In this way a risk assessment sensitive to route specifics and population exposed is proposed and the overall uncertainties by the risk analysis can be lowered. The developed model, of general applicability, can represent a useful tool not only to estimate transport risk but also to define strategies for the reduction of risk (i.e. distribution and limitation of ADR road traffic, improvement of highway section, alternative routes) and emergency management.

REFERENCES B.J. Thomson, Proc. of International Workshop on Safety in the Transport, Storage and Use of Hazardous Materials, NRIFD, Tokyo, Japan, 1998. J.K. Vrijling, W. Van Hengel, R.J. Houben, J. of Hazardous Materials, 43 (1995), 245-261. P.A. Davies, Loss Prevention Bulletin, 150 (1999), 22-23. L.H. Brockhoff, Loss Prevention and Safety Promotion in the Process Industries VII, SRA ed. Taormina, Italia (1992), 160-1-160-19. S.A. Gadd, D.G. Leeming, T.N.K. Riley, Loss Prevention and Safety Promotion in the Process Industries JX,Ed. Graficas Sign0 S.A., Barcelona, Spain (1998), 308-317. I.A.James, Dept. Of Environment, Report DoE/RW, London, (1986), 85-175. D.W. Harwood, E.R. Russell, J.G. Viner, National Research Council , Transportation Safety Board, Transportation Research record 1245, Washington, DC, 12, 1989. G. Purdy, J. of Hazardous Materials, 33 (1993), 229-259. V.D. Dantzig, J. Kriens, The economic decision problem of safeguarding the Netherlands against floods. Report of Delta Commission, The Hague, NL, (1960), 3, 11, 2.

967

Assessment of Storage Life of Energetic Substances Close to Safety Critical Conditions Dr. A. Eberz", Dr. G. Goldmann" aBayerAG, WD-SI VA, Building B 407,51368 Leverkusen, Germany

SUMMARY An uncontrolled decomposition of energetic substances may cause considerable damage. When screening measurements such as DTA exhibit a critical exothermic decomposition close to the designed storage temperature, a sound assessment of storage life for such substances becomes a safety issue of great importance. This paper is to demonstrate the use of powerful software tools which will reliably give a kinetic model of decomposition behaviour of compounds such as Butadiene-1,2 and a nitro aromatic residue based on DTA/DSC measurements at a range of different heating rates, allowing to calculate the adiabatic induction time for different temperatures based on model parameters. Extended calculations based on the "Thomas model" even take realistic yet sufficiently conservative heat transfer conditions in a vessel or package into account. The application of such tools demonstrates that below a certain critical temperature a heat explosion will not occur even for an arbitrarily long storage time.

1. INTRODUCTION An uncontrolled decomposition of energetic substances may cause considerable damage. Nevertheless energetic substances often have to be stored before they are converted or dissipated. The storage of large amounts of these substances may come along with specific risks caused by long residence time in combination with heat accumulation because of missing heat transfer from the bulk material to the surroundings. As described by Arrhenius and van t'Hoff, most chemical reactions that run with significant rates at elevated temperatures will become much slower at lower temperatures yet they will not stop. That means that under strict adiabatic conditions, all thermodynamically unstable substances will decompose in a runaway reaction after a characteristic time, called the "time to maximum rate" (TMR). When the storage of energetic substances with respect to thermal stability needs to be assessed, the TMR at the maximum storage temperature is the most

968

important characteristic. For the safety assessment of chemical reactions or unit operations, the TMR may be directly measured using equipments that realize nearly adiabatic conditions, or the safe range of the TMR may be guessed by screening experiments [ 13. Such measurements are carried out on a time scale of several hours up to several days. Under storage conditions, TMR values at a year's scale may be critical if such residence times do occur and the storage conditions are really adiabatic. At that scale it is impossible to measure the TMR directly. In practice it is also impossible to measure any heat flow or self heating rate that corresponds to such a TMR. Thus, the TMR and the corresponding heat flows must be calculated by extrapolation of measured data carried out on a short time scale. For this purpose a kinetic model of the decomposition reaction is needed. Several simple models for the description of decomposition kinetics have been described in literature, and practical applications are established [2,3]. The parameters (e.g. activation energy, frequency-factor) needed to fit the model to measured values can be evaluated from DTA/DSC measurements or from adiabatic measurements. A widely used simplified model is based on the assumption of a one-step zero-order reaction mechanism with a temperature dependence according to the Arrhenius law. The TMR is related to the specific heat cp, the starting temperature TO,the activation energy E, and the heat release rate go, according to the following equation [4]:

The heat release rates go are extracted from isothermal DSC measurements. Only the maximum isothermal heat release rate is used. In most cases, TMRs that are calculated using this model are conservative but sometimes they are not [3]. In the case of autocatalytic behaviour the results may be extremely conservative. This situation is unacceptable. At any rate, it is desirable to apply a model on a correct chemical basis with realistic values of the parameters. In reality, decomposition reactions may be complex and cannot be adequately described by a simplified model. It is necessary that a realistic model describes correctly a complete set of measurements but not only a single plot. Then it may be appropriate for the extrapolation to conditions far away from the measurement conditions. 2. METHODS

A software package developed by J. Opfermann satisfies the above mentioned requirements. It has been commercially available for several years by NETZSCH Geratebau. Successful applications have been published [5,6]. A similar package is available by A. Benin and A. Kossoy at CISP in Saint Petersburg. By using the NETZSCH 'Thermokinetics'' program, up to eight

969

dynamic or isothermal DTA/DSC runs can be fitted with a kinetic model. Dynamic measurements should be preferred. Further DSC curves can be simulated. The model is selected from a list of about 30 models of one-step up to four-step reactions. The set of one-step, two-step and three-step reaction models is shown in Fig. 1. Model-free evaluations of the activation energy (Friedman and Ozawa-Flynn-Wall analysis) give hints for the appropriate type of model. A second program (“Thermal Safety Simulation”) can be used to calculate temperaturehime curves of exothermic reactions under adiabatic conditions and under conditions with realistic heat losses. In the Safety Laboratories at Bayer, the software package has been modified so it can be applied for the evaluation of DTA curves measured with the inhouse developed equipment. Two successful applications will be presented here.

me-step reaction

A -

Bl

A-B-C-D A - B C ; A - B C C A

A+B+C

A -

+ B

I C - D

~

A

B

c-D twwstep reactions

AB --

C

A

’ 0

A C

* B

E

.D

r F

three-step reactions

Fig. 1: One-step, two-step and three-step reaction models

3. EXAMPLE 1: STORAGE STABILITY OF BUTADIENE-12

3.1 Assessment task Butadiene-1,2, an extremely flammable liquified gas, is formed during the cracking process, enriches in a residue feed and is distilled to high purity. The product is stored in 400 1 pressure drums at ambient temperature (i.e. up to about 50 “C). The residence time may be up to 1 year. It is well known that the substance polymerizes and decomposes at elevated temperatures. A safety study should be carried out to assess the storage conditions. 3.2 Measurements and evaluation Screening DTA measurements show a high exothermic decomposition potential (> 2500 kJkg) with an onset temperature of about 170 “C (heating rate: 3 Wmin, sealed glass ampoule, in-house developed equipment). The

970

thermal behaviour is not influenced by the presence of steel or stainless steel (V4A), respectively (Fig. 2). 1000

s

0

e

-1000

0)

\

aJ

c

I

:

E

L stainless steel

I

I-2000 I

1I 100 200 300 400

-3000 0

Temperature I "C

Fig. 2: "Screening-DTA" measurements of Butadiene-1,2 (3 Wmin, closed glass ampoule)

Further measurements at decreasing heating rates (in-house developed bomb DTA, stainless steel vessels) yield a shift of the exothermic peak to lower temperatures. An onset temperature of about 110 "C is measured at a heating rate of 0,l Wmin. A set of 6 dynamic DTA runs at heating rates from 2 Wmin down to 0,l Wmin was used to find the kinetic model for the assessment of the storage stability. The best fit to the DTA curves was obtained for a two-step reaction model with autocatalysis in both steps (Fig. 3).

Fig. 3: Fit of 6 DTA curves (measured in stainless steel vessels) of Butadiene-1,2 by a twostep reaction model (Step 1: E, = 85 kJ/mol, lg k = 5.226, n = 2.125; Step 2: E, = 98 kJ/mol, lg k = 5.403, n = 0.964; lg Kcat = 0.92)

97 1

Table 1 Substance characteristics of Butadiene-1,2 and vessel data Geometry and geometry factor ( j )

Cylinder with infinitely long axis (conserative modelling) and j = 2

Inner diameter (2 Ro)

700 mm

Heat transfer coefficient ( k )

2,7 W/m2K

Substance density ( p )

0,675 g/cm3/ 0°C; 0,540 g/cm3 / 100°C; 0,405 g/cm3/ 200°C

Specific heat ( c, )

2,2 kJkgK

Thermal conductivity ( 2)

0,l w/mK

Heat of decomposition (AH)

3592 kJkg (measured by bomb DTA in stainless steel vessels)

Upon parameter optimization, temperaturehime curves for adiabatic storage conditions could be calculated corresponding to TMR values of about 22 days at 50°C and 151 days at 30°C (Fig.4). Thus it can be concluded that Butadiene-1,2 is thermally not stable at 30-50 "C under adiabatic conditions for long residence times.

'",",

A -1-

~

8 -2+C

Step i wth orderwth autocatalysls by B Step 2 Prout-Tompktns equatlon

120

'

TMR(adi

80

-

/'

TMR (ad ) = 55 2 days _._ ----'

1: /' TMR (ad ) = 151 0 days

As the product is stored in 400 1 pressure drums, the storage conditions are not strictly adiabatic. So a refined calculation was carried out using realistic geometrical and physical characteristics to allow for real heat losses during storage. The calculations were based on the "Thomas model" which includes the Semenov model and the Frank-Kamenetzkii model as limiting cases [7]. The

972

relevant equations with T, being the substance temperature and T, being the ambient temperature are:

d T / d r = 0 for r = 0

(4)

The parameters and characteristics used are given in table 1. The refined calculation based on the "Thomas model" showed that a run-away reaction will not happen at temperatures up to 50 "C. 100

80

. 9

-

-Ambient

temperature

?!

3

EQ

60

n.

E,

!-

40

20

0

100

200

300

400

500

Time I days

Fig. 5: Temperaturehime curves of the decomposition of Butadiene-1,2 in 400 1 drums at realistic heat loss conditions

As can be seen in Fig. 5, at an ambient temperature of 50 "C the core temperature inside the drum will rise slowly for 9 K within a year and then decrease again. The corresponding heat flux reaches a maximum value of 0,06 Wkg at 60 "C. The calculated degree of thermal conversion over a year is significant. At 30 "C, it is less than 2 % and at 50 "C it is about 13 % (Fig. 6). At 60 "C the n o d heat losses cannot prevent a runaway. After 18 days a thermal explosion is expected.

973 100 Yo

.-

80%-

c

o!

2

60%

E tl

c

40%

20 % 0

20

60 Time I weeks

80

40

100

Fig. 6: Calculated thermal conversion of Butadiene-1,2 at isothermal conditions

The calculations are conservative. Fig. 7 shows that the measured thermal conversion at 120 "C and 140 "C during several days is less than the calculated conversion.

-Simulation

(140 "C)

m Measurements at 140 "C

-Simulation

(120 "C)

A Measurements at 120 "C

0

50

100

150

Time I hours

Fig. 7: Thermal conversion of Butadiene-1,2 at isothermal conditions

200

-

974

The values have been obtained from tempering experiments under isothermal conditions (Fig.8). As no convection is assumed for the heat loss calculation this consideration is conservative, too.

500

. g

o

a

?!

-

5 L

x

-500

-1000 0

100

200

Temperature / "C

300

400

Fig. 8: DTA curves of Butadiene-1,2 after tempering the samples (measured in stainless steel vessels, 1 Wmin)

3.3 Safety assessment From a safety point of view, Butadiene-1,2 can be stored in 400 1 pressure drums at temperatures up to 50 "C with a residence time of several years without any risk of a thermal hazard. 50 "C should not be exceeded.

4. EXAMPLE 2: STORAGE STABILITY OF A NITRO AROMATIC RESIDUE 4.1 Assessment task Nitro aromatic compounds, which are formed as byproducts during a manufacture, are collected in a separator and then the residue is disposed in a 5 m3 combustion container at elevated temperatures. It had to be assessed whether the operation would be safe at a temperature level of about 80 "C. 4.2 Measurements and evaluation The screening DTA of the residue shows a minor decomposition above 125 "C, followed by the highly energetic nitro decomposition (in the closed glass ampoule as well as upon addition of V4A or HC4, respectively; Fig. 9).

975

-

500

u

l

.

$ c

o

128 "C 150 "C

500

after 8 weeks tempering at 80 "C

-500

! 3

0 -1000 F

m

c)

Q

-1500

-2000 0

100

200

300

400

Temperature I "C

Fig. 9: "Screening-DTA measurements of the nitro aromatic residue (3 Wmin, closed glass ampoule)

From a safety point of view, the question arises whether the temperature rise due to the first decomposition in the core region of an unstirred batch will be able to trigger the main decomposition. Exposed to a temperature of 80 "C for up to 8 weeks, the sample showed neither a complete decline of the predecomposition nor a relevant change in the main decomposition (Fig. 9). Using a low heating rate DTA (0.05 Wmin, sample mass: 2.5 g), another in-house developed method, the onset of the exotherm is detected at 105 "C (Fig. 10). The energy of the predecomposition amounts to about 75 kJkg, the calculated adiabatic temperature rise amounts to about 50 K. Therefore, presuming the heat produced is safely removed, the activation of the main decomposition is not to be expected at a temperature of 80 "C. In order to describe the thermal behaviour at adiabatic conditions, a simple zero-order kinetic was established and the TMR (time to maximum rate) calculated according to Eq. 1. The isothermal DTA values at 140 - 170 "C were enhanced by very precise measurements in the microcalorimeter SETARAM C 80 at 110 "C, resulting in a maximum value of 2,s W k g at 110 "C.

916

80

100

120

140

160

180

Temperature I "C

Fig. 10: Heat flow rate of the decomposition of the nitro aromatic residue, measured by long term DTA (0,05 Wmin, closed glass ampoule, 2,598 g sample mass)

The activation energy of 87 kJ/mol obtained from the data resulted in a TMR of 19 h at a temperature of 80 "C (Fig. 11,12). 1000,0 ~

100,o -

m x

5

~

*

~

.-

--

-__

Nitroaromatic residue

L

E = 86 7 kJlmol

C

0 130

031 2,20

2,30

2,40

1

2,50

2,60

1OOOfl IlIK

measured values -linear

2,70

2,80

regression

2,90

3,OO

I

Fig. 11: Temperature dependence of the maximum heat release rate of the nitro aromatic residue

977

TernperaturelT

Start tempPC

140 TMR (ad ),= 19 hours

120 100

i

TMR (ad ) = 1 7 days

____--- --0

2000

1000

I

/

---

__/

3000 Timelmin

4000

/ /’

_/c-

TMR (ad ) = 3 9 days

5000

6000

. 12: Calculated temperaturehime curves of the decomposition of the nitro aromatic residue at adiabatic conditions (using the simple zero-order kinetic model)

From this discussion one may conclude that this highly simplified kinetic )del, along with the assumption of adiabatic conditions, will result in a safe : unacceptable storage time. In order to obtain refined kinetics, the predecomposition was examined ng DTA measurements at different heating rates. Although the fit of the Aied kinetic model appeared relatively good, the onset of the decomposition, iich is important with respect to the TMR, could not be described in an :eptable manner. Therefore, a kinetic fit was done based upon the long term DTA measuremt, giving an improved description of the decomposition onset (Fig. 13). /Heat flow rate/(10A-3’(W/g))

A -l+B -2-

C

Step 2: n-th order

I

110

120

130 TernperaturelT

140

150

;. 13: Fit of a long term DTA curve by the two step reaction model

lg k = 19.091, n = 2.442)

160

(E, = 178 kJ/kg,

978

The DTA plots evaluated from these kinetics exhibit heat release rates higher than the measured ones; the lunetic model therefore being ,,on the safe side,, (Fig. 14).

0 -

-1 -

3 -2 - A-1-3

-

-4 -

B -Z+C

Step 1 n-th order

J ex0

-

Fig. 14: Comparison of measured Screening-DTA curves and calculated curves by using the parameters of the long term DTA fit

The temperaturehime curves that were calculated using this model are shown in Fig. 15. As can be seen a TMR of 46 days (i.e. less than two months) is calculated for the starting temperature of 80 "C. This value is much higher than the value valculated by the zero-order model. TemperaturePC T%(ad

i

;

Start templ"C A-I+B-Z+C

Step 1 wthorder Step 2 n-th order

80 {

__

I

-

100

) = 46 days

i '4

1

-

0

1

2

3 Time/( 10*5"min)

TMR (ad ) = 3 2 years -

4

5

6

Fig. 15: Calculated temperaturehime curves of the predecomposition of the nitro aromatic residue at adiabatic conditions (using the fit of the long term DTA)

A refined calculation was carried out using realistic geometrical and physical characteristics of the separator and the substance to allow for real heat

979

losses during storage. The data are given in table 2. The results obtained for the temperature profile will be described now. Table 2 Substance characteristics of the nitro aromatic residue and vessel data Geometry

Cylinder with infinitely long axis (conserative modelling)

Inner diameter

613 mm and 1400 mm, resp.

Thermal transfer

350 W/m2K (value from. VDI-Wtirmeatlas)

Substance density

1,30 g/cm3/ 100 "C; 1,18 g/cm3 / 200 "C; 1,05 g/cm3/ 300 "C

Specific heat

1,23 WkgK / 0 "C; 1,47 HkgK / 100 "C; 1,71 WkgK / 200 "C; 1,98 HkgK / 300 "C

Thermal conductivity

0,180 W/mK / 80 "C; 0,172 W/mK / 100 "C; 0,136 W/mK / 200 "C; 0,100 W/mK / 300 "C

Heat of decomposition

75,6 kJkg (measured by long term DTA)

In the core of the separator (613 mm diameter), from a starting temperature of 80 "C, a maximum of nearly 81 "C was predicted to be reached after about 10 days In Fig. 16 the temperature increase at varying distances from the centre is plotted. Respective data for starting temperatures of 90, 100 and 110 "C are 94 "C after about 6,3 days, 125 "C after nearly 3 days, and 155 "C after nearly 1 day. Thus, when a temperature of 80 "C is safely maintained, there is no danger of triggering the main decomposition. At a temperature level of about 130 "C (calculated final adiabatic temperature of the predecomposition), the main decomposition will run away within a few days. TemperaturePC

Simulation using parameters from a long term DTA

3

I3 1,

A_. 06

I

The vessel is a cylinder of infinite length and a diameter of 613 mrn Dist from Centre

0

,,="-

I

0.5

1.0 Timel(lO"4'min)

--_ -- -

1.5

2.0

2.5

Fig. 16: Calculated bulk temperature as a function of time at varying distances from the core of the vessel at an ambient temperature of 80 "C

980

For the combustion tank (diameter 1400 mm), the calculation predicted a maximum of 84 "C after 31 days starting from a core temperature of 80 "C. Starting from 90 "C, the maximum temperature is 122 "C after 12 days. Therefore, a storage temperature of 80 "C is not critical under these circumstances either. A variation of the heat conductivity up to an order of magnitude towards the ,,unsafe side,, resulted in a maximum temperature of 81,l "C for a starting temperature of 80 "C (Diagr. 17). 81,2

.

P

80,8

2

K

a

80,6

f

80,4

+0,018 W/mA2*K +0,1 W/mA2'K +-0,18 W/mA2*K

80,2

-

80,O 0%

10%

surface

20%

30%

40%

50%

60%

Percentage of distance

70%

80%

90%

100% center

Fig. 17: Calculated maximum temperatures in the vessel as a function of the distance from the center at an ambient temperature of 80 "C by using different values of heat conductivity

4.3 Safety assessment Therefore, on the base of the described results, the collection of the nitro aromatic compounds in the separator, as well as their disposal in a 5 m3 combustion container, does not present a thermal hazard presuming the heating temperature does not exceed 80 "C. 5. CONCLUSIONS

The "Thermokinetics" program is a very useful tool for the assessment of thermal hazards. On the basis of a set of thermoanalytical measurements, a reliable kinetic model of the chemical reactions can be obtained. Using the characteristics of the evaluated model, the temperaturekime behavior of chemical substances and mixtures can be calculated not only for the worst case of strictly adiabatic scenarios but for the case of realistic heat losses as well. With sufficiently conservative assumptions the results will be in the safe range.

981

Such calculations help to optimize chemical processes and technical operations and to minimize the need of safety measures.

REFERENCES [l] J. Past& U. Worsdorfer, A. Keller, K. Hungerbuhler, J. Loss Prev. Process Ind. 13 (2000) 7-17 [2] T. Grewer, “Thermal Hazards of Chemical Reactions”, Elsevier, Amsterdam (1994) [3] A. Keller, D. Stark, H. Fierz, E. Heinzle, K. Hungerbuhler, J. Loss Prev. Process Ind. 10 (1997) 31-41 [4] D. I.. Townsend, J. C. Tou, ThermochimicaActa 37 (1980) 1-30 [5] J. Opfermann, J. Thermal Anal. Calorimetry, 60 (2000) 641-658 [6] J. Opfermann, W. Hadrich, ThermochimicaActa 263 (1995) 29-50 [7] P. H. Thomas, Trans. Faraday SOC.54 (1942) 60-65

This Page Intentionally Left Blank

983

A New Concept When Designing Parking Areas for Lorries Carrying Dangerous Goods: the Dynamic Segregation J. A. Vilchez",Xavier PCrez-Alavedrab,J. Arnaldos", Carlos Amieiro', and Joaquim Casala aCentrefor Studies on Technological Risk (CERTEC), Department of Chemical Engineering, Universitat P o l i t h i c a de Catalunya-InstitutdEstudis Catalans, Diagonal 647, 08028-Barcelona,Catalonia, Spain bTr6mites,Informes y Proyectos, S.L. Rbla. Onze de Setembre, 62-64, 1". 08030-Barcelona, Catalonia, Spain 'Civil Protection Department, Barcelona City Council. Barcelona, Spain

ABSTRACT There is an urgent need in industrial cities to find solutions to the difficult -and sometimes dangerous- situation caused by the transport of hazardous goods by road. Suitable parking zones are required to park trailers when drivers are waiting for loading/unloading operations and resting to comply with regulations concerning maximum driving times. In this study, the main features that should be required by this kind of parking area are analysed both from the point of view of operability and safety. The study is based on a particular case (the city of Barcelona). 1. INTRODUCTION

A big city always entails considerable movement of dangerous goods; this movement is still more intense when the city is a major sea port. These hazardous materials are often just transported through the city area; however, a significant number of lorries are actually obliged to remain in urban areas for a certain time (often overnight, sometimes for a weekend) awaiting embarking or, simply, to allow the drivers to comply with the legal regulations on driving time. In many towns this situation has not been taken into account by local authorities, and lorries are parked in an uncontrolled way -often in highly populated areas. This gives rise to a rather dangerous situation, in which an accident with severe consequences could take place.

984

Therefore, it is evident that suitable parking areas for trailers carrying these dangerous goods should be provided. There are several possibilities for such as area: a) a parking zone guarded by a person aware of the nature of the cargoes and the location of the drivers; b) a public or private parking zone where trailers cannot be damaged by other vehicles; c) an appropriate free zone, far from big roads and inhabited areas, an area which is not a meeting place or walking area for people. Usually, the city council regulations concerning the transport of dangerous goods encompass the following aspects:

. . 1

.

prohibition on parking on the public way, except for loadinghnloading operations; prohibition on transit-vehicles driving through the city; prohibition on driving on local holidays (and the eve), with occasional exceptions for specific routes; in the event of a breach of regulations, provision is made for immobilisation of the vehicle in a suitable area.

Furthermore, it is obvious that parked trailers carrying dangerous goods in nonauthorised urban zones pose a risk to the population. Another fact to be considered is that professional drivers have difficulties complying with regulations which limit driving times and often have insufficient technical training in the properties of the dangerous goods being transported. All these facts point to the need to prepare special parking zones for trailers carrying dangerous goods near large cities. However, in most countries there are no technical regulations with regard to the design of such areas. This paper describes the main features that such a parking area should provide.

2. FLOWS OF DANGEROUS GOODS IN THE URBAN AREA Dangerous goods can be of different types; the contribution of each type to total traffic can be seen in Table 1. Table 1 Distribution of dangerous goods transported % of total transported Type of Dangerous Goods Flammable Liquids 60 Gases 15 10 Corrosives Other 15

985

This table shows the distribution for the approximately 6x107 tons transported annually in Spain (it can be assumed that the distribution for other industrial countries would be similar). As can be seen, flammable liquids are the most usual hazardous material transported, followed by gases. Another classification can be seen in Table 2, which shows the distribution of tank-trailers in Spain in 1984, according to the materials being transported. Table 2 Distribution of tank-trailers according to the material transported Product N. of tank-trailers Combustible 3,457 Butane and propane 253 Other gases 552 Chemicals 1,510 Total 5,772

The situation is a little more complex if the city is a large sea port. Sea ports involve major movement of goods and, consequently, of dangerous goods as well. As an example, Table 3 presents the 1997 figures for transport of the main dangerous goods in the Port of Barcelona (one of the largest ports on the Mediterranean). Table 3 Dangerous goods in the Port of Barcelona (1997) Dangerous Goods Tons (embarked + disembarked) Compressed, liquefied or pressurised gases 35,767 Flammable liquids 49,572 Flammable solids 77,293 Peroxides and comburents 41,385 Toxic materials 32,887 Corrosives 98,000 Other dangerous goods 16,914 Total 335,450

Looking at the figures in these tables, it seems evident that a city like Barcelona should have an area specially designed for tank-trailers carrying such goods. In the following paragraphs the main features of such an area are discussed.

986

3. DESIGN OF THE PARKING AREA

In order to make the best use of available land, a well-designed trailer park should provide parking stalls for as many vehicles as possible, whilst still allowing for vehicles to be driven in and out with minimum manoeuvring. The philosophy of the parking area must incorporate two complementary points of view:

-

reduce the possibility of leaks, spills and collisions to the minimum by application of strict safety measures: physical checking of tanks or containers on admission; suitable design from the logistical point of view, avoiding the risk of collisions in the parking area; chemical segregation of dangerous goods, avoiding the risk that an accident in one area of the parking area could reach other goods and lead to even more damage. 1 1

.

3.1. Logistical criteria There are several logistical design criteria which must be borne in mind:

1. Avoid risk of collisions: - one-way direction lanes; - 45" angle at stall access; - entry and exit aisles of 10 m width; - suitably large parking stalls so as to reduce manoeuvring required.

--

Rigid vehicles Articulated vehicles

Fig. 1. Relation between aisle and stall width [3].

Fig. 2. Angle of 45" to access the stalls. Modified from [3].

987

According to these criteria, a stall length of 21 m (vehicle length + vehicle width + operability factor of 2 m), and a stall width of 4 m were decided as shown in Figs. 1 and 2. These measures allow trailers to manoeuvre safely, cut down the risk of collision and in the event of fire would facilitate the work of fire fighting teams. 2. Minimisation of the parking area: - installation for 100 to 200 trailers according to previous studies [l-41. 3.2. Chemical safety criteria In the event of incidents occurring in a vehicle -collision, leakage, fire, explosion- the characteristics of the dangerous goods and the volume stored could entail that other vehicles would also be affected (domino effect) and the final consequences could even spread beyond the confines of the parking area. Three representative scenarios were studied for the consequence analysis: a) 20 m3 styrene spillage from a tank, causing a large pool fire; b) explosion (BLEVE) of a 20 ton LPG (propane) tank; c) release of 20 tons of chlorine. Thermal radiation, fragment projection and the dispersion of toxic cloud were studied. The results are presented in Table 4. Table 4 Consequence analysis Scenario Parameter a) Fire Thermal radiation b l ) BLEW Thermalradiation b2) BLEVE Fragment projection b3) BLEVE Overpressure c) Toxic cloud Gas dispersion

Distance of concern 50 m 500m 500 m 120 m 2,500 m

The distances shown in Table 4 correspond to the values of physical effects associated to the "alarm distance": 3 kWm-2for thermal radiation, 50 mbar for shockwave and IDLH of SO2 (30 ppm) for toxic gas dispersion. They have been calculated using classic methods or codes: EFFECTS [5] for thermal radiation, ALOHA [6] for toxic gas dispersion and the method described by Casal [7] for BLEVE effects. These distances show that the effects of the accidents considered clearly extend beyond the confines of the parking zone. They also highlight the fact that traditional segregation criteria, which are very difficult to maintain, due to the continuous variation of the materials stored, would not be very useful from the point of view of safety.

988

Priority has therefore been given to a dynamic segregation, where different types of dangerous goods are distributed throughout the parking area according to demand and maintaining as far as possible the maximum distance between goods with incompatible hazard characteristics. Table 5 presents a fourfold classification of dangerous goods in accordance with their general characteristics. Table 5. Splitting up of dangerous goods Group I associated risk Group 1 Flammable gases Group 2 Comburents and oxidisers Group 3 Non flammable goods

Group 4 Flammable liquids and solids

Dangerous goods Flammable gases Flammable toxic gases Goods that in contact with water release flammable gases Comburents/Oxidisers Organic peroxides Non flammable non-toxic gases Non flammable toxic gases Chemical unstable gases Chemical unstable toxic gases Toxics Corrosives Flammable liquids Flammable solids Goods that can undergo spontaneous ignition

Finally, the distances of concern summarised in Table 4 imply an additional restriction that would have to be fulfilled by the location of the parking area with respect to other urban zones, industrial equipment, etc. 3.3. Final design Bearing in mind all the aforementioned considerations, the parking area was designed (see Fig. 3) for approximately 180 trailers distributed in four rows from 250 to 285 m in length and 15 m wide (corresponding to an axis length of approximately 21 m), with 42 to 48 stalls at an angle of 45". Three emergency exits were located in suitable locations to facilitate evacuation in the event of an incident. The total area of the stalls accounted for approximately 35,000 m2. Table 6 presents the main features of the parking area. The parking area equipment includes a complete fire protection system based on hydrants, foam, monitors and water reserves for two hours. A suitable drainage system for chemicals and fire fighting water was also established.

989

.

.

,

”

-

ir

Entrance / Exit

Fig. 3. Lay-out of the parking area. Table 6 Main features of the designed parking area Parameter Angle to access 45” and exit stalls Length of stalls 21 m Width of stalls 4m Width of aisles (lanes) 10 m Lanes One-way direction Number of emergency exits 3 Capacity 177 lorries Total area 35,000 m2

Emphasis was placed on the flexibility of the parking area. Several designs -as shown in Tables 7a and 7b- can be derived from the original lay-out, allowing for a wide range in the capacity of the parking while maintaining the safety and operational principles. Table 7a Designs obtained considering short rows of stalls 115x310 m2 115x231 m2 115x152 rnz Park dimensions Row Stalls 4 42 28 14 3 45 32 19 2 48 34 20 1 42 28 14 Capacity 177* 122 67 - (n. of lorries) Total area (m’) 35,650 26,565 17,480 * Chosen design.

990

Table 7b Designs obtained considering long rows of stalls 165x310 m2 165x231 m2 165x152 m2 Park dimensions Row Stalls 4

3bis 2bis 3 2 1

Capacity (n. of lorries) Total area (m2)

42 45 45 48 48 42 270

28 32 32 34 34 28 188

14 19 19 20 20 14 106

51,150

38,115

25,080

3.4. Filling-in procedure A dynamic segregation system establishes non-fixed areas in the parking area by grouping compatible dangerous cargo types and in accordance with the expected number of trailers of each class, as shown in Fig. 4. In the event of an incident, dynamic segregation will limit the propagation of consequences and allow the response team to act efficiently.

Entrance / Exit

Fig. 4. Dynamic segregation of dangerous goods. Proposed filling in procedure.

4. DISCUSSION

In the design of a parking area for vehicles carrying dangerous goods several aspects have to be taken into account, not only those associated with the intrinsic danger of these materials but also the variety, the variability over time and the mobility of lorries. In addition, these aspects have a noticeable influence on the location of the parking area, which must be at a safe distance from populated areas and other industrial equipment.

99 1

Finally, the scarcity and high price of land, especially in large cities, demands optimum design so as to accommodate, through criteria of flexibility, the maximum number of lorries in a fixed area while still maintaining the desired safety conditions. Essential criteria to be followed in a preliminary design such as the one presented here are safety (through the estimation of distances of concern, dynamic segregation of hazardous materials, manoeuvrability of lorries and safety response equipment) and, from an urbanistic point of view, the location of the facility and its distance from populated areas and other industrial equipment.

REFERENCES [l] Sill, O., 1969, Construcci6n de aparcamientos, manual para la planificacibn, construcci6n y explotaci6n de aparcamientos y garajes subterrheos, Ed. Blume, Madrid. [2] Department of the environment, 1971, Lorry Parking, The report of the working party of lorries, London. [3] Brannam, M., Longmore, J.D., 1974, Layout of Lorry Parks: Dimensions of Stalls and Aisles, TRRL Supplementary Report 83 UC, Transport and Road Research Laboratory, Crowthorne, Berkshire. [4] McCluskey, J., 1987, Parking, A Handbook of Environmental Design, E. & F.N. Spon Ltd, London. [ S ] TNO Institute of Environmental Sciences, Energy Research and Process Innovation, 1989, Effects, Version 1.4A, Apeldoorn, The Netherlands. [6] National Oceanic and Atmospheric Administration, 1992, ALOHA-Areal locations of hazardous atmospheres, Version 5.5 User's Manual, Hazardous Materials Response and Assessment Division. NOAA, Seattle, WA98 115. [7] Casal, J., Montiel, H., Planas, E., Vflchez, J.A., 1999, Andisis del riesgo en instalaciones industriales, Edicions UPC, Barcelona.

This Page Intentionally Left Blank

993

Gas-Pipelines in Tunnels or Galleries: A sound solution? Marco Montanarini", Christian Pluss", Gunthard Niederbaumer"

SKS Ingenieure AG, Consulting Engineers Oerlikonerstrasse 88, 8057 Zurich, Switzerland

a

Abstract Tunnels and galleries may be a convenient way to traverse with pipelines densely populated urban areas or topographic obstacles. Such solutions allow a direct traverse of such obstacles where alternative solutions are impossible or require long by-passing. Additional advantages of such solutions are the possibility of permanent survey and allow in urban areas to include other utilities infrastructure in the same corridor. However, considerable disadvantages limit the use of tunnels and galleries for pipelines: Besides the very high costs there are additional risks to be considered. In this paper an approach for risk assessment of pipelines in tunnels and galleries is presented. In three case studies it is shown, how the risk assessment was used as a decision tool to find solutions for pipeline planning in difficult environment.

994

Gas-Pipelines in Tunnels or Galleries: A sound solution? Marco Montanarini",Christian Pluss",Gunthard Niederbaumer" a SKS Ingenieure AG, Consulting Engineers Oerlikonerstrasse 88, 8057 Zurich, Switzerland

1.

Introduction

Tunnels and Galleries' may be a convenient way to place a pipeline in densely populated urban areas or in difficult mountainous terrain. Reasons for putting pipelines in such infrastructures may be In urban areas - the lack of space in construction zones - the required minimal distance to housing areas - legal requirements - existing infrastructures of other utilities which may be combined In mountainous areas - topographic obstacles - the lack of space in narrow valleys - geographical hazards such as landslides or falling rocks To traverse short distances without trench the pipelines are usually placed using bi-directional drilling technique or microtunnels. These tunnels are usually less than 1 km long and are not accessible. They cause no additional risk compared to the conventional built pipelines. To traverse longer distances, galleries or tunnels can be constructed which are accessible for inspection. Despite the fact that these constructions are relatively costly they are more and more used due to the lack of easily accessible routes. In this paper the special risks of such tunnels and galleries are described. The methodology of risk assessment is presented and applied in three case studies.

'

Tunnels are defined as drilled holes in mountains reinforced with jetted concrete or concrete shells Galleries are defined as shafts with concrete walls in urban or industrial area.

995

Risk analysis in tunnels and galleries 2. The risk analysis for high pressure gas facilities is in Switzerland standardised and described in a frame report [1,2,3] which was published in 1991 by the Swiss gas industry in collaboration with the federal authorities. A revised version of the framework was terminated in 1997. In these reports the risk caused by tunnels are only described in a very general way. Since then for several new projects risk analysis for tunnels were developed and successfully applied in the approval procedures. 2.1

Causes for failure in tunnels The failure rates of major gas pipelines in Western Europe is permanently reported by the European Gas pipeline Incident Group (EGIG, 1993 and updates)[4]. These data are currently based on the experience of 1.5 millions kilometre-years in eight countries in Western Europe (table 1).

Table 1: Failure frequencies based on failure causes and hole size. Source EGIG [4]. The hole sizes are defined as follows: Small hole: Hole size I 2 cm; Medium hole: Hole size > 2 cm up to the total pipe diameter; Large hole: Full bore rupture, hole size greater than the pipe diameter Failure causes

Failure frequency [kmyl-'

Percentage of total failure rate

Percentage of different hole sizes [%] small medium great

External interference

3.0 x lo4

51 %

25

56

19

Construction defects

1.1 x lo4

19 %

69

25

6

Corrosion

8.1

14 %

97

3

<1

Ground movement

3.6

6 Yo

29

31

40

Others/unknown

5.4

lo5

10 %

74

25

<1

Total failure rate

5.75 x lo4

100 Yo

48

39

13

[kmyl-' :The failure probabilities of pipelines are indicated per kilometre and year.

However, in tunnels and galleries, the failure rates may differ from the rates derived from failures of conventional pipelines. The deviations that were assumed in the investigations are the following:

External interference External interference are the main causes for gas leakage in Western Europe. Accidents usually occur due to not permitted construction works. Pipelines in galleries are normally not accessible to the public and are protected by

996

the construction of the tunnel infrastructure. The failure rate due to external interference can be assumed to be much lower and was therefore reduced by 90% in respect to conventional pipelines.

Construction defects Pipelines in galleries have the same quality requirements as conventional pipelines buried in the ground. There was no reason found to assume a different failure rate as for conventional pipelines. Corrosion Pipelines in galleries are protected by a special paint against corrosion, but a cathodic protection system cannot be used as it usually is the case in buried pipelines. However, due to the better possibility for inspection, the failure rate is assumed to be unaffected. Ground movement Lower Probability because only earth quakes remains as possible reason for a failure. The pipeline in tunnels or galleries are protected from landslides or falling rocks. Others/unknown Same probability Failure rates Gas pipes in tunnels and galleries exhibit smaller failure rates as conventional pipelines buried in the ground. Pipes in tunnels and galleries can be inspected regularly and experience less external interference. Explosion Scenario If an escape of natural gas occurs in a tunnel or a gallery, a dispersion or different explosion reactions are possible depending upon the type of leakage and the existing ignition source. The most important ones are described below.

2.2

2.2. I Jet fire (or Torch Fire) If a gas release stems from a full bore rupture, the whole tunnel will be filled with a non combustible atmosphere in a short time. This methane/air mixture will flow to the portal at the end of tunnel. If ignition occurs there a horizontal flame will develop. The size of the flame will depend on the gas release rate or the diameter of portal and the gas pressure there.

997

2.2.2 DeJlagration and Detonation Flame can propagate in a tunnel either as a deflagration or a detonation flame front and clearly these modes of propagation are very different in character. In the first case heat is transferred from the flame front to the adjacent layer of not burnt mixture so as to raise its temperature. Ignition occurs at the ignition temperature (for town gas-air mixture about 500OC). The speed of flame will obviously depend from the heat transfer process. The propagation of a detonation wave on the other hand depends upon the shock wave travelling at the velocity of sound at the flame front sustained by energy received from the flame. The high initial burning rate of a large volume of gas pressurises the products. The subsequent expansion of the products then accelerates the flame to high velocities [ 5 ] . Particularly high overpressures occur when the shock wave of a detonation is reflected at the end doors of the tunnel. The stability and velocity of detonations in tubes depend upon the diameter. The tube diameter beyond which the detonation propagation becomes impossible is termed the critical diameter [8,9,10]. It is very likely that detonation conditions may be met in gas explosions in very long accessible tunnels. The safety analysis of tunnels must therefore also include the possibility of detonations. The overpressure of detonations of methane/air mixtures in tunnels may attain the peak of 26 bar, according to Bartknecht (1993) [11].The detonation will be quenched in tunnel areas with not explosive methane/air mixtures. 2.2.3 Pressure wave propagation inside the tunnel The pressure wave generated by an explosion will be weakened continuously by the wall friction outside the area of flammable methane/air mixture. The peak pressure of the blast wave will be reduced and the pulse duration increased. The total pressure reduction depends from the length of gallery section in which the pressure wave propagates, the roughness of wall, the initial peak pressure and the initial pulse duration.

2.2.4 Pressure wave propagation outside the tunnel The maximum pressure in the portal of the tunnel is the determinant parameter for the effects of deflagration or detonation on objects outside the tunnel. This one may be 7.1 bar for deflagration and 26 bar for detonation. A detonation wave cannot exist anymore outside a tunnel of a diameter greater than the critical tube diameter. The pressure wave decreases in this case very quickly with distance from the tunnel portal. The isobaric surfaces of pressure p are nearly spheric. The distance of the outer surface increases reciprocally to the pressure p .

998

Fig. 1 :Isobaric surface of pressure p outside the tunnel portal. Tunnel diameter d; Distance of the outer isobaric surface r.

The pressure of the blast wave becomes determinant for lethality of people in the open air at a pulse duration shorter than 300 ms.

2.3

Consequences to structure and people If a leak develops in a pipe transporting a flammable gas, a combustible mixture with the air contained in the tunnel or gallery will be formed. Then only a source of ignition such as a spark or a hot surface is necessary to start a fire. People in the flame area would be at great risk. People being present somewhere in the tunnel could be suffocated. The explosion of an ignited combustible gadair mixture produces a pressure wave which propagates in the tunnel or gallery. The blast wave can damage not only the structure of the gallery and some electrical and water conducts inside but also the buildings the gallery has access to by its ramifications. The damage of buildings and structures can be derived from the relation between the dynamic load and the response of the structure. This relation is often presented in the form of a so called pressure-impulse-graph (P-I graph) [14] Fig. 2. The curves in the graph represent threshold curves delimiting various structural damage class.

999

Fig. 2 :Impulse and pressure load at various places in a service gallery: The curves delimit areas of damage level. Class 1: No structural damage expected; Class 2: Minor structural damages, damages at separation walls; Class 3: Major structural damages, damages to some supporting structures; Class 4: Partial demolition, more than 50% of walls may be damaged.

The damage to the people due to direct effect of the blast wave has a minor importance because of little people presence.. A blast wave in an open area of 0.21 bar will cost only 10% of injured and dead people. The most victims are due to collapsing buildings. The experience shows that 20 to 50% of people in a collapsing building will be dead.

3.

Case Studies

Example No 1:

Gallery in the centre of a city

In the context of a general urban rearrangement, two solutions of the display of service conducts shall be evaluated: In the first variant solution all urban service conducts shall be buried separately in the ground. The existing old (5 bar/ lo”) gas pipeline shall be replaced by a new one. In the second variant solution the conduction lines for gas ( 5 bar/ 10”) and water shall be placed in a gallery of cross section 2.6m x 2.3m and about 600 m length below the main road.

1000

The variant decision will be based on an evaluation of codbenefit and the safety aspect

Pipelines buried in the ground It follows from the statistics of Western Europe countries that there are rare cases of leakage in conventional 5bar pipes followed by ignition and danger to the people and objects. Leakage due to external interference uncovers usually the pipe building a crater and launching debris around.. The gas release occurs then directly in the atmosphere. Ignition of the gadair mixture would finally start a jet fire. People would be endangered until the distance of about 6 m. At Leakage not due to external interference (e.g. material failure) the released gas may creep in a house in the neighbourhood. A gadair mixture may develop inside and explode after ignition. People could be endangered by the collapsing building. The buried variant solution could produce in the worst case a great number of victims. Pipelines in galleries A leakage with gas release into a service gallery very rarely occurs. Venting holes usually prevent the formation of combustible gadair mixtures at small gas releases. Combustible gadair mixtures may develop due to greater gas releases. At ignition an explosion develops of maximum pressure of 7 bar. The gallery is therefore equipped with cover plates which produce a pressure relieve at lift up. The maximum inside pressure is then delimited to 1.1 bar by the particular choice of dimensions of gallery and cover plates. The pressure effects in proximity will be reduced sensitively. Only few persons staying close by the venting holes or at the pressure relieve gap will be endangered. Following safety measures were aimed to minimise in the case of an accident, the damage to people and objects: In respect to the possible effects to the population, the variant solution of a gallery has been considered to be better than the variant of buried pipe. The inspection capability of the gallery reduces also the accident probability. Additional safety measures may minimise the risk to a minimum. There are as follows: 0 special venting openings shall reduce the peak pressure of the explosion. 0 the ventilation system shall be a passive system. 0 the ventilation holes shall be placed closer together in places of small population density. 0 the fittings for domestic connections shall be placed outside the gallery. 0 the gallery shall be gas tight as to prevent a gas outflow in the ground. 0 an operation concept shall control the access to the gallery and minimise the access of unauthorised people.

1001 0

installation of gas detectors which are coupled to the alarm system.

This urban gallery is actually being studied by the government. The government will decide about its realisation in the next hture. Example No 2:

Service and access galleries connecting several buildings of an industrial plant.

The heating centre required the installation of a new supply line, a 25 bar/ 4”diameter natural gas pipeline. A variant solution consisted in a line in the existing service gallery. This ramified gallery serves as supply for generic products but would contain also the, 1.8 km long, high pressure gas pipeline. The gallery’s cross section has a 3.5m height and 7m width. The gas release rate of a full bore rupture of the pipe decreases so rapidly as to release the whole pipe content of 260 kg methane. A smaller leak size of 2 cm would release the whole pipe content within 4 to 5 seconds. After ignition of the gadair mixture a flame and pressure wave will propagate in the gallery. The run-up distance (the length of tunnel or gallery traversed by the flame front before the onset of detonation [7,11,12,13]) in this gallery is 330 m. But the side branches are spaced only at a distance of 260 m. The flame of an ignited gaslair mixture will therefore not propagate as a detonation flame. The propagating pressure wave is continuously weakened by the geometry of the gallery. Fig. shows the impulse and pressure loads at various places in the gallery. The total damage is eventually estimated using the defined damage classes. A risk analysis is therefore performed. Safety measures are proposed in order to further reduce the probability of accidents and the number of possible victims: an increase of wall thickness from 5 mm to 8 mm reduces the leakage probability. 0 installation of a powerful ventilation the pipe could be placed in a protecting tube which would keep the released gas inside it. the gallery could be subdivided in compartments by pressure doors as to prevent pressure wave propagation.

2

The whole project and the proposed safety measures appeared to be too expensive. The government rejected the project.

1002

Example No 3:

Series of tunnels of the Alps crossing pipeline from North Sea to Italy

The series of tunnels consists of 16 tunnels with length ranging &om 0.5 to 5.4 km, and 3 m diameter. The tunnels contain pipelines of 75 bar pressure and diameters of 36”and 48”. There are different scenarios with fire and explosions in pipelines accidents depending from the type of leakage. Figure 1 shows the event tree of gas pipe in a tunnel. There are basically two accident scenarios which are relevant for the risk analysis: 1. In case of a full bore rupture the gas will escape under high pressure and replace the air in the gallery. Due to lack of oxygen an ignition inside the gallery is not possible. If the ignition happened at the portal, there would be a horizontal jet fire at the portal. 2. If the pipeline in the tunnel has a small leak, the escaping gas will be mixed with the surrounding air. If the gadair mixture is within explosion limits and ignites inside the tunnel the flame would proceed towards the portal. In long tunnels the flame could theoretically reach the detonation velocity. Outside the tunnel the pressure would decrease rapidly, but in the vicinity of the portal damage to people or infrastructure due to the pressure wave has to be taken into account. There are usually no people inside the tunnel. The risk analysis focuses therefore principally on scenarios being effective in the portal area. A (48”/57 bar) pipeline in a tunnel creates in case of a failure and gas ignition an area of potential damage outside the tunnel portal of a radius of about two hundred meters. An isolated building with great population density such as a school or health resort hotel would be at great risk. Suitable safety measures are aimed to reduce the effects of pressure waves:

0

tunnel end opening has a sudden enlargement as to reduce the pressure level of pressure wave. a protection wall in front of the tunnel portal deviates the blast wave in a harmless direction.

This safety measures consist in massive concrete structures which increase the production cost of these tunnels.

1003

4.

Conclusion

While investments or benefits usually are rather well known by the project management, a decision should not be taken without knowing the risk involved in the projects of gas-pipelines in tunnels. There are tunnels and galleries which contain pipelines with great transport capability. These tunnels are usually placed far off the urban areas (e.g. the alpine crossing) with small population density. But some isolated buildings with great population density may stay in the impact zone. The tunnel is still executed applying particular safety measures. Whereas pipelines in galleries in urban areas have usually a smaller transport capability, but they present a much greater risk due to the great population density. The risk minimising safety measures are aimed therefore at smaller accident probability. This means additional structural measures to be carried out. The costs of required safety measures may be so incisive in the project as to decide about its execution. The risk assessment proves to be an effective decision tool for pipeline planning in difficult environment.

Acknowledgement We like to thank the Transitgas AG Company for the permission to publish this paper.

1004

References Swiss gas industry and SKS Consulting Engineers: High-pressure gas facility safety: Framework report. Swissgas SA, (1997) Zurich, Switzerland. R. Sagesser, C. Pliiss, M. Montanarini SKS Consulting Engeneers Successful Implementation of Standardised Risk Analysis for Pipelines. Annual Meeting of the Society for Risk Analysis (Europe), Vol. 1.2 (1997) Stuttgart SKS Ingenieure AG, RAPIF Version 2, Software for calculation of potential hazards of pipeline accidents, SKS Ingenieure AG: (1999) Zurich European Gas Pipelines Incident Data Group (EGIG), Gas Pipeline Incidents, Report 1970 - 1992. (Groningen 1993). P.A. Urtiew, A.K. Oppenheim: Experimental observation of the transition to detonation in explosive gas. Proc. RoySoc A295 (1966) 13 R. Knystautas, J.H.S. Lee, J.E. Shepherd, A. Teodorczyk: Flame Acceleration and Transition to Detonation in Benzene-Air Mixtures. Combustion and Flame Vol.115, Nr.3 (1998) M.A. Nettelton: Gaseous Detonations. Chapman and Hall (1987) London 1.0. Moen et al.: Detonation Length Scales for Fuel Air Explosives. Progress in Astronautics and Aeronautics Vol 94 (1984) 55-79 R. Knystautas, C. Guirao, J.H.Lee, A.Sulmistras: Measurements of Cell Size in Hydrocarbon-Air Mixtures and Predictions of Critical Tube Diameter, Critical Initiation Energy and Detonation Limits. Progress in Astronautics and Aeronautics Vol 94 (1984) 23-37 S.M Frolov, B.E. Gelfand: Limit Diameter of Gas Detonation Propagation in Tubes. Combustion, Explosion and Shock Waves. Vol27, Nr 1 (1991) 113-117 W. Bartknecht: Explosionsschutz, Grundlagen und Anwendung. Springer Verlag (1993) M. Hattwig: Detonationsanlaufstrecken von Gasgemischen in Rohren grossen Durchmessers, Amts- und Mitteilungsblatt der Bundesanstalt fiir Materialpriifung (BAM) Vol 10. Nr 4 (1980) 274-278 H. Steen, K. Schampel: Experimental Investigations on the Run-up Distance of Gaseous Detonations in Large Pipes, 4'h Int. Symp. Loss Prevention Process Industries, (1983) 111, E23, Inst. Chem. Eng. Rugby [14] W.E. Baker, P.A. Cox, P.S. Westine, J.J. Kulesz, R.A. Strehlow: Explosion Hazards and Evaluation. Elsevier Scientific Publishing Company (1983)

1005

Fire Test for the Safety in Transport and Storage of Dangerous Goods Ch. Balke, W. Heller, R. Konersmann and J. Ludwig Federal Institute for Materials Research and Testing (BAM) Unter den Eichen 87, 12200 Berlin, Germany

INTRODUCTION In April 1999 a fire test with a 45 m3railway tank wagon partially filled with 5,l tonnes pressurised liquid propane (LPG) was carried out. The test was designed to investigate the effects that an accident fire would have on a partially filled railway tank wagon for LPG, and what consequences a bursting of the tank due to the temperature and pressure load would have for the environment. Due to the uniqueness of such a test, which to the knowledge of the authors had never before been performed in this manner in Germany or in Europe as a whole, the Saxon State Ministry for Environment and Agriculture, which partially sponsored this test agreed to provide in addition to the railway tank wagon a CASTOR cask of the type THTWAVR was also subjected to an engulfing fire. The report and the test results of the CASTOR cask are not integral part of these recitation.

OBJECTIVE OF THE PROJECT It is adequately known that, compared with other fossil fuels such as coal or fuel oil, LPG in compliance with DIN 5 1622 [11, in other words, commercially available technical grade gases of the C3 and Cq hydrocarbons propane, propylene (propene), butane, butylene (butene) and other mixtures, be have in a more environmentally compatible way. This has led to the situation that LPG in the above sense is also being increasingly used as fuel both privately as well as in the commercial sector. Consequently we have seen in the past, inevitably higher transport and trade activities, which have also led to an increase in storage capacities. Transportation

1006

is accomplished for the most part with railway tank wagons, tank vehicles as well as by means of tankers. To supply the population with LPG for domestic use and business for commercial use - particularly in rural areas in which other fuels are not adequately available in the right type (electricity, natural gas), or where for reasons of environmental protection and the type of handling they are no longer used (coal, wood, peat) - their distribution to the above named consumers is inevitably accomplished with vehicle tanks approved in compliance with transport regulations, and these are then either filled at stationary distribution depots or at so called railway tank transfer stations. At the distribution depots LPG is distributed from fixed (stationary) storage tanks, while at the transfer stations distribution takes place from mobile railway tank wagons. The transfer stations are generally located in track areas specially assigned for this purpose. To ensure the safe handling of LPG, but also to protect third parties, animals, material assets and the environment, it is necessary to adhere to defined safety engineering principles. These are in Germany not always the same for both distribution depots and transfer stations. Distribution depots for LPG with a capacity of more as 3 tonnes are subject to the regulations governed by the Federal Air pollution law (BImSchG) [2] respectively by the Major-accident Regulation (12* BImSchV) [3]; they must thus be built and operated in compliance with state-of-the-art safety engineering. Transfer stations are built and operated in compliance with state-of-the-art. This particularly applies to the area of fire-protection. In designing fireprotection measures, it is decisive to determine what type of fire hazard is to be covered for a transfer station or a distribution depot, so that adequate protection against overheating is provided for the railway tank wagon respectively the storage tank and also the tank vehicle to prevent a possible tank failure. Although there may be broader safety engineering aspects that may be technically and organizationally better implemented in individual transfer processes, the main safety engineering difference between distribution depots and transfer stations is the application of adequate fire protection measures. Safetyengineering aspects of a more far-reaching kind, which relate to the transport tanks of railway tank wagons or also to tank vehicles themselves and to there possible failure, e.g. due to overfilling, material defects etc. apply in a comparable manner to both distribution methods. According to the state-of-the-artof safety engineering (12* BImSchV) as well as the state-of-the-art (Pressure-Vessel-Regulation) [4], adequate fire protection is considered implemented in the sense of technical measure when tanks in storage plants are provided with an earth covering of 1 m thickness. In individual case, adequate fire protection is also considered implemented when tank surfaces are provided with a fire protection coating suitability or effective-

1007

ness has been proven and whose reliability has been defined as preventing tank failure for a period of 90 minutes under fire conditions. Under certain boundary conditions, comparable protection can also be provided by appropriately designed water-sprinkler or water-deluge systems if technical reasons make it impossible to provide a earth covering or a coating. Where on earth covering is provided a full engulfment or a direct firing of storage tanks is excluded. Because of these circumstances the BAM and the SMUL derive the requirement, that alternative measures must also ensure that a tankirrespective of whether it is being used as a storage tank in a distribution depot or a tank wagon or tank vehicle in a transfer station - must be adequately protected against direct fire endor full engulfment for a certain time. Although these safety engineering concepts are shared by several state authorities and have already found their way into corresponding decrees, e.g. joint decree by the Social (Labour) and Environmental Ministry in Lower Saxony [ 5 ] , so far no adequate discussions have been held; rather, fire-protective measures that are not in compliance with the state-of-the-art safety engineering and the state-of-the-art for storage tanks are still applied to tank wagodtank vehicle transfer-stations. A full engulfment of LPG tank not equipped with safety relief valve and without any other thermal protection can rupture within a reasonable short fire duration. LPG tanks ruptures in a fire produce very severe consequences due to the release of pressurised inflammable gas resulting in a BLEW (Boiling Liquid Expanding Vapour Explosion). Such a B L E W causes intensive heat radiation and explosion overpressure due to on expanding fireball, and . fragments of the ruptured tank are forced away with high energy. Since the end of the 1980’s BAM has carried out numerous fire tests on small (4,85m3) unprotected, protected with a water-sprinkler system and with protective coatings provided LPG tanks. At that time it was found that unprotected tanks of the above-mentioned dimension could fail within a period of approx. 7 - 12 minutes. Many times both in the past and present it has been stated in this respect that, due to their design in compliance with transport regulations, e.g. greater shell thickness, higher test pressure etc. tank wagons behave more favourably in fire condition than comparable storage tanks. This circumstance should therefore be taken into account in fire-protection measures, i.e. the requirements with regard to the sprinkling rates could not be transferred 1 :1 to larger tanks and could be considerably reduced. Research into the heating-up behaviour and the failure limits of large tanks was thus an essential safety engineering objective of this project. Furthermore, the test was to be used to evaluate the approximation methods recommended in literature with respect to the action radii, the purpose being to gain border knowledge with regard to disaster control.

1008

TEST OBJECTS AND TEST FACILITY The fire test facility was located in the centre of a circular sandy area, with a diameter of 400 m. In the centre of this area a 60 m by 50 m U-shaped sand embankment 6 m high was constructed by the Federal army. Two steel throughs for the fuel oil pools were positioned inside this wall (Figure 1).

Figure 1: BAM fire test site

A tank wagon with the followed technical Data would exposed to a full engulfment: Nominal Volume 45360 1 Test pressure 28 bar RID requirements for design and test pressure 27 bar (propane) Filler content approx. 22 % (5,l t) Total weight 17890 kg 14,9 mm (cyl.) a. 17,O mm (ends) Shell thicknesses length (along ends) 7600 rnm length (cylinder) 5950 mm Diameter 2900 mm Material BH 42 K (fine-grained-steel)

Due to the fact that in such a test extreme temperature an pressure loads as well as mechanical effects resulting from the explosion can be expected if the rail wagon fails as a result of the temperature the opportunity was taken to position

1009

next to the rail wagon a CASTOR THTFUAVR - a previously unused cask for radioactive material - to also subject it to the effects of the fire (Figure 2). Both test objects were put in the above mentioned separate fire throughs. The fire throughs were filled with fuel oil to feed the fire for approx. 40 minutes.

Figure 2: LPG rail wagon and CASTOR cask before test

The rail wagon was extensively instrumented with 10 thermocouples to measure the fire temperature and 11 were used to measure the temperature of the shell. During the entire course of the test, the internal overpressure was measured with 3 pressure gauges and the internal temperature with 4 thermocouples; this data were recorded (Figure 3).

Figure 3: Measurement points for instrumenting the rail tank and the CASTOR

1010

Similarly, 3 pressure sensors served to determine the ambient pressure when the tank failed, 3 thermo indicator strips were provided to determine the heat load of the fireball and two further sensors served to determine the heat flow of the fireball. The test was video-documented from four different ground positions and from a helicopter. Additionally, photographs were made from a further helicopter.

TEST METHODS AND RESULTS Three ignition devices were mounted in each of the fuel oil pools. These devices, consisting of plastic dishes filled with gasoline, positioned 30 cm above the fuel oil surface, were ignited electrically by small pyrotechnic detonator. The burning gasoline dishes were destroyed after about 100 s, and ignited the fuel oil pools. The pressure inside the rail wagon began to increase continuously 130 s after primary ignition, indicating that full fire engulfment of the test objects had been reached. Due to a slight wind from a northern direction (2 m s-l) the rail wagon were only engulfed partially by the flames.

Figure 4: Improved flame envelopment towards the end of the test

As a result the right and the front side fire temperatures were lower than at the left and back (Figure 4). After a continuous pressure increase over 15 minutes (approx. 17 min after primary ignition) the propane tank ruptured at an internal overpressure of 25 bar. The tank wall split at the weakest point, starting from 8,5 O above the horizontal centre-line (and well above the liquid level), at the middle of the side furthest from the cask, when the wall temperature there reached about 550 "C. The tank ruptured at first in the axial direction, along the cylindrical tank part (Figure 5). After that, the tank ruptured around the circumference, disconnecting the two tank ends. The tank content was released instantaneously, igniting and creating

1011

an expanding fireball (Figure 6). The approximate largest fireball is shown in Figure 5, where the diameter is about 100 m with the top about 150 m above ground level. The fireball burning time was about 7 s. Figure 7 shows the test facility shortly after the tank explosion. Fragments of the propane tank have been ejected from the walled area. The main part of the cylindrical tank shell, with a mass of 6700 kg was thrown 150 m.

Figure 5: Arrangement of the rail wagon and the CASTOR and the position of rupture line

1012

Figure 6: BLEW, expanding fireball, photographs taken from helicopter

Figure 7: View of the test facility after the rail tank explosion

1013

Overall, the tank became separated into 4 larger parts, the left tank end (with manhole) the right end, a larger cylindrical tank shell, as well as a smaller part of the tank shell, which dug itself vertically into the ground (Figure 8).

Figure 8: Smaller tank shell

After the test, the left tank end, the right tank end and the smaller part of the tank shells were respectively found approx. 130 m, 155 m and 200 m away from the test facility. All these fragments where thrown out of the open side of the Ushaped will, in the direction of the CASTOR.

CONCLUSIONS The test carried out here has shown that a rail wagon partially filled with 5,l tonnes propane and subjected to a full fire engulfment can fail within 15 minutes as less than 28 bar test pressure, even if the fire does not fully envelop the tank. The fireball - resulting from a bursting tank in which released propane evaporates instantly and then ignites (BLEVE) - which had a diameter of approx. 100 m as well as the distance that some of the fragments flew (up to 200 m) indicate that a fire situation will in a relatively short time cause a serious danger that should certainly be countered by applying and providing suitable safetyengineering measures. Due to the very short time periods available in such situations primarily and/or even just secondarily by means of the fire brigade must be considered as rather unsuitable, because it must be assumed that - in the short time available after the fire brigade has arrived - the fire brigade will not be able to provide suitable measures to protect the tank(s) against a BLEVE. Furthermore, the test leads to the conclusion that tanks having a higher test pressure and a greater steel-shell thickness than equally large storage tanks do not necessarily reveal higher safety reserves in a fire situation. It was possible to confirm experimentally that, in such a fire situation - which incidentally must be assumed when adequate safety

1014

measures are being designed for storage tanks - even for large tanks the decisive factor leading to tank failure is heat to the tank shell in the area of the gaseous phase in conjunction with the increase in internal pressure brought about by the input of heat. Because a sand embankment trilaterally surrounded the test facility and there was a specific wind direction during the test, the fire developed in such a way that primarily that side of the rail wagon facing away from the embankment opening was heated and thus got hottest. When the tank ruptured in this area the tank and the chassis were accelerated rocket-like onto the CASTOR cask and abruptly decelerated on impact with it. This circumstance can explain why the tank fragments flew in a preferred direction whereby some of these parts (larger tank shell and right end) had multiple ground contacts. During the impact of the tank wagon against the CASTOR a large part of the kinetic energy was transferred to the CASTOR so that it cannot be excluded that, with "unobstructed" movement, fragments could fly even further than when happened in this test, whereby it is impossible to quantify such distances because a large part of the energy was used up in deforming the parts, particularly the chassis of the tank wagon. Although it is theoretically possible to calculate the velocity of the CASTOR from the flight distance, the measurement results and the video recordings do not facilitate determining the contact time up to which acceleration took place. To sum up the results of this test, it can be said - at least as for as fire situations are concerned - rail wagons in LPG transfer stations should be safety-engineered to the some requirements as storage tanks set up stationarily.

1015

REFERENCES

111 [2] [3] [4] [5]

DIN 51622 Flussiggase Propan, Propen, Butan, Buten und deren Gemische, Anforderungen, December 1985 Bundes-Immissionsschutzgesetz(BImSchG): Bekanntmachung der Neufassung des Bundes-Immissionsschutzgesetzesdated 14 May 1990 (BGBl I S. SO), revised by law an 22. April, 1993 (BGBl I S. 466) Zwolfte Verordnung zur Durchfuhrung des Bundes-Immissionsschutzgesetzes(Storfall-Verordnung) dated 19. May 1988, revised 02. May 2000 (BGBl I Nr. 19 S. 603) Verordnung uber Druckbehalter, Druckgasbehalter und Fullanlagen (DruckbehalterVerordnung-DruckbehV) in the version of the announcement dated 23. October 1999, (BGB1 I Nr. 93 S. 1435) Sicherheitstechnische Anforderungen an Flussiggasanlagen Gem. RdErlal3 des MS u.d.MU V. 06.07.1995 - MS 504 - 40221/04/MU 303-40501/102 1.2 voris81640000000004

This Page Intentionally Left Blank

1017

Risk analysis of the transportation of hazardous materials: an application of the TRAT2 software to Messina R. Lisi, M.F. Milazzo, G. Maschio Universita di Messina, Dipartimento di Chimica Industriale ed Ingegneria dei Materiali, Salita Sperone 3 1, 98 166 - Sant'Agata di Messina, Italy P. Leonelli, S. Bonvicini, G. Spadoni Universith di Bologna, Dipartimento di Ingegneria Chimica, Mineraria e delle Tecnologie Ambientali, Viale Risorgimento 2, 40136 - Bologna, Italy ABSTRACT The development of a methodology to study problems associated with the transportation of hazardous materials must be considered a very important target for risk analysis. For this scope an innovative procedure has been created, which represents the framework of the TRAT2 software. In this paper, after briefly outlining the main features of TRAT2, its application to the land transport of dangerous goods through the downtown of Messina is outlined. A detailed description is given of the rail and road networks, of the hazardous materials flows, of the population distribution which characterise Messina; then results about a preliminary evaluation of both individual and societal risk are shown. Finally future improvements of TRAT2 and major research developments in hazardous materials transportation risk analysis are presented and discussed. 1. INTRODUCTION

The analysis of safety themes associated with the transportation of hazardous materials is considered to be as important as the study of risk problems connected with fixed installations, since historical evidence has shown that incidents related to the transportation of dangerous goods are comparable in number and magnitude with those occurred in chemical plants. Furthermore, hazardous materials releases during transport may occur in areas which are not sufficiently controlled or protected, such as zones of high population density or of natural and historical beauty [ 1, 21. For this reason risk analysis should address both fixed installations and transportation networks, thus obtaining a complete area risk evaluation, which represents the basis on which decision makers will establish criteria for risk management, risk control and land-use planning.

1018

2. THE TRAT2 SOFTWARE

For the evaluation of hazardous materials transportation risk an innovative procedure has been developed [3], coupling time effectiveness and mathematical accuracy; its great flexibility allows to analyse at the same time different transport modalities, like truck, rail, pipelines or inland waterways, and, for each mean of transport, different typologies of dangerous goods, like toxic substances, flammables or explosives. Recently this procedure has been implemented on the TRAT2 software [4], whose fiamework is shown in Fig. 1; it is basically composed by tree executable codes (written in C++ and Fortran languages) and an ACCESS database to which communicate through direct access libraries. A user-friendly Windows interface allows the risk analyst to introduce, while communicating with the database, all the input data necessary to describe the case in examination. Then information is exported from the database to the Processing Unity, which performs calculations and conveys the output results to the database. Presentation of results can be both graphical and numerical, thus allowing data exportation for further external processing.

Fig. 1. The fiamework of the TRAT2 software

The introduction of the data relative to a case study consists of two phases. Fig. 2 shows the main menu of the TRAT2 code at the beginning of the first phase, when only some menu options are available. Clicking on the choice “Cgnfigurazione”a window appears, through which it is possible to define, further clicking on the secondary menu options, the ‘Pasquill class-wind velocity’ pairs (e.g. B-3, D-5, F-2, ...) and the number of sectors of wind rose, the hazardous materials shipped (e.g. ammonia, LPG,. ..), the transport modalities (e.g. road, rail,....), the area categories of the case study (e.g. urban, rural,. ..), the number of holes through which describe a release (e.g. small, medium, big,...), the final scenarios (e.g. pool fire, toxic cloud,...), the population categories (e.g. residential people, scholars, motorists.. .).

1019

Fig 2. TRAT2: the main menu

Instead the option “lrasporti” leads to the description of the hazardous material ‘vehicles typologies’, which are ‘substance-transport modality’ pairs; for each ‘vehicle typology’ (e.g. ammonia road truck, LPG rail tank, ...) it is necessary to define the occurrence probabilities of the holes and to relate to each hole the possible final scenarios, defining their probability of occurrence and assigning to each a ‘vulnerability map’ for all area categories, which represents the distribution of the death probability in a Cartesian plane where the origin is the release source and the abscissa coincides with the wind direction. Vulnerability maps are stored in the database for a relevant number of combinations ‘vehicle typology, hole dimension, meteo pair, area category’; otherwise they can be constructed processing the outputs of commercial consequences evaluation codes. Finally the choice “Categorie” allows to assign to each population category the probability of being indoor.

Fig. 3. TRATZ: the window related to the choice “Meteo” of the main menu

1020

At this point a template has been created; templates can be stored and saved and thus can be useful for more case studies; obviously, if a suitable template already exists, it can be loaded (clicking on the main menu option “ljle”) and in this case the first phase of the data introduction is omitted. Starting the second phase, all choices of the main menu of Fig. 2 are available. First of all a graphical imagine of the case study area has to be imported and the North direction on it has to be defined. Then, clicking on “Meteo” the window reported in Fig. 3 appears and the wind direction probabilities for each meteo pair and all wind rose sectors can be given; instead the voice “Popolazione” allows a very detailed description of the distribution of all population categories. Furthermore, clicking on “Tyatte” the network can be characterised, giving for each arc its geographical co-ordinates and its accident frequency; finally, the voice “kiende” allows the definition of the factories interested by the transport, specifying for each one the vehicle typology shipped and its path on the network from origin to destination. After having introduced all data, clicking on “calcolo” the Processing Unit starts to performs calculations, evaluating the individual risk distribution and the societal risk expressed as F(N) curves. Results can be viewed clicking on “~isualizza”; a relevant number of options are available, both for individual and societal risk: in fact total risk can be viewed, or only the risk due to the shipments of a factory, or the risk due to a single substance on the whole network or on a specific path.

Fig. 4. TRAT2: the window related to the choice “TLatte” of the main menu

3. HAZARDOUS MATERIALS TRANSPORTATION IN SICILY Sicily has a very high concentration of chemical plants and thus is an area with a great risk of accidents; in addition to industrial risk sources, natural risk

1021

sources like earthquakes and volcanic eruptions are present. To all this it is relevant to add the land decay, as well as the deficiencies of infrastructures and transportation networks. The chemical industry in Sicily presents some peculiarities; in fact there is only a limited number of small and medium units, while the major part of factories is constituted by big plants, which are located on the south-eastern side of the island in the vicinity of areas with a high population density and of strong environmental, artistic and tourist interest. The situation is summarised in Fig. 5 , where the location of the main production sites is shown together with the paths of the Mediterranean gas pipeline (coming from Algeria and directed to the Italian peninsula) and the gas pipeline network connecting the plants of Priolo, Gela and Ragusa.

I I

Fig. 5. Localisation of the main chemical plants in Sicily

The amount of oil and other chemical products which are processed in Sicily is about 50-106t/yr. This fact causes an over-production compared to the regional needs, and therefore a large part of these substances is exported; thus the region is characterised by an outflow of final products and an inflow of raw materials. Unfortunately the transportation infrastructure is inadequate to cope with such a level of traffic; the rail network, for instance, is still mostly a single track one, while important parts of the highway network are incomplete. As a consequence there are urban areas subject to an intense traffic of hazardous materials and no guarantee of the safety can be ensured.

1022

4. THE CASE STUDY OF MESSINA

The area which is the object of this study is the city of Messina, which has a population of approximately 280,000 inhabitants; its geographic position confers it the role of ‘door of Sicily’ for all the connections with the Italian peninsula which go through it. Since the downtown has developed around the harbour, the road network between the highway exits and the ferry terminals cross densely populated areas and zones of intense commercial activity. Fig. 6 shows schematically the situation. There are four highway slip roads for entering the city (Boccetta, Centro, Gazzi and Tremestieri) and two ferry terminals, one operated by the National Railway Service and one operated by private companies; the principal highway sliproad, Boccetta, reaches the sea between these two terminals. The use of the other sliproads, Centro and Gazzi, is sporadic because they have a larger travelling time due to high commercial traffic. About 22,500 trucks per year of dangerous goods are directed to the Italian Peninsula; in addition approximately 800,000 other heavy lorries and 2,500,000 cars cross yearly the Straits of Messina. For a careful evaluation of both individual and societal risk a detailed analysis of a census data is necessary, in order to define, among others, the hazardous materials traffic flows, the population distribution, and the meteorological conditions. Fig. 7 reports the road and rail networks for which risk has been

Fig. 6. Messina: connections between highway exits and ferry terminals

1023

Fig. 7. Messina: main centres of aggregated population ()., road and railway networks examined in the risk analysis study

evaluated, together with the main centres of aggregated population, that are sites where more than 50 persons are present (e.g. schools, hospitals, ...) Through the Straits of Messina about 115 different hazardous substances are transported. In order to simplify the risk evaluation, they have been grouped together into 8 clusters according to their physical-chemical properties and their hazard characteristics, in terms of flammability, explosiveness and toxicity. The yearly number of shipments of these clusters, each represented by a specific reference substance, are listed in Table 1 both for road and railway. Table 1

Road and railway annual flows of the ‘reference substances’ through the Straits of Messina Reference substances Road Railway veh iclelyear Yo vehicle/year Y O ACRYLONITRILE 103 0.5 272 3.8 CLORIDRIC ACID 771 3.5 22 0.3 FLUORIDRIC ACID 49 0.2 56 0.8 AMMONIA 0 0.0 118 1.6 CHLORINE 5 0.0 620 8.6 LIQUID FUELS 11,088 49.7 1,224 17.0 LPG 3,008 13.5 558 7.7 ETHYLENE OXIDE 360 1.6 2,398 33.3 OTHER 6,930 31.1 1,944 27.0 TOTAL 22,314 100 7,212 100 Data sources: chemical companies, Harbour Office, National Railway Service, private ferry companies.

1024

For a preliminary risk evaluation only some substances, among those listed in Table 1, have been taken into account. Results are shown in Figg. 8 and 9, where the individual risk distribution is reported both outdoor and indoor , and in Figg. 10 and 11, where the societal risk curves are plotted vs. English and Dutch risk acceptability criteria. As can be seen, in some zones along the routes the individual risk reaches values of 1-104 eventdyr, which are not acceptable on the basis of the both

Fig. 8. Outdoor individual risk due to road and railway transport (ACN, HF, Cl,, gasoline, LPG, EtOx)

Fig. 9. Indoor individual risk by road and railway transport (ACN, HF, Ch, gasoline, LPG, EtOx)

1025

English and Dutch risk criteria. This consideration is even more true if it is considered that risk values are underestimated, since not all shipped goods have been taken into account. The societal risk curves too put in evidence a very critical situation, especially for the road transport, where the frequency of having more than 10,000 deaths is EtOO

E-01 E-02 E-03

F

E04

EngHsh criteria

I--

E05

Dutch criteria

E-06

E-07 E-08 E-09 E-10

Et02

e+01

1

N

E+03

E+04

Et05

Fig. 10. Societal risk due to road shipments (ACN, EtOx, HF, Clz, gasoline, LPG) vs. English and Dutch criteria EtOO E-01

E-02 E-03

F

E-04 E-05

_--Engllh

crltedn

E-06 E-07

ri_FI

Dutch

cNda

E-08 E-09

E-10

1

EtOl

Et02

N

E+03

Et04

Fig. 11. Societal risk due to railway shipments (ACN, HF, Clz, EtOx) vs. English and Dutch criteria

1026

still equal to 1.10-* eventdyr; this is partly due to the accident frequency, which is very high on Boccetta sliproad, which has a relevant gradient towards the sea. 5. RISK REDUCTION MEASURES IN MESSINA The results of the risk evaluation allow to make the following considerations about the hazardous materials transportation in Messina: risk values, in terms of both individual and societal risk, are not only not negligible, but even not acceptable, if compared with the English and Dutch risk criteria; especially the road trucks cross for convenience (in terms of travelling time) and necessity (due to the position of the ferry terminals with respect to the highway exits) the downtown which has a high density of residential population and a relevant number of schools, offices and commercial sites; the presence of hazardous materials trucks crossing Messina generally coincides with the rush hours of the downtown; actually there are no emergency plans to withstand releases, which could have disastrous consequences involving many people, though characterised by a very low frequency of occurrence. In order to find a remedy to this situation, it is possible to make the following proposals relative to risk prevention and emergency planning: > it is necessary to limit the hours when vehicles transporting hazardous substances cross the urban area, so that their presence in the downtown does not coincide with the rush hours; this requires the construction of a suitably equipped parking area outside the city centre; 9 furthermore a dedicated Operations Centre should manage, through radio contacts, the flow of hazardous materials trucks from the parking area to the ferry terminals. Each truck arrived in the parking area should inform the Operative Centre about the substance it ships and should ask about a permission to enter the city; the Operative Centre, will give it on the base of the time of day and the traffic conditions, also indicating the route to follow; furthermore each vehicle should be equipped with a GPS system to continuously monitor its position. In this way there would be great advantages also in emergency situations due to the involving of a hazardous good vehicle in an accident, since its position and the substance it ships would be immediately transmitted to the rescue services, thus optimising the response time and the remedial actions to be undertaken; 9 finally, referring to the ferry terminals, it is possible to suggest that a valid alternative, from the risk point of view, would be to locate all them in the

.

.

. .

1027

area southern to the actual National Railway Service ferry terminal, equipping an already existing dock actually in disuse. The new ferry terminals would be reached by truck leaving the highway at the Tremestieri exit (which has no gradient) and travelling on a new dedicated coast road running along the seaside and not passing through the downtown. This solution would put the private companies and the National Railway Service near each other, thus bringing the principal Strait cross carries into equal conditions of competition; furthermore the traffic of heavy vehicles through the city centre would be sharply reduced. 6. FUTURE RESEARCH DEVELOPMENTS

The TRAT2 software joins mathematical accuracy of the procedures and simplicity of use due to its user-friendly interface, as extensively shown in this work; to allow a major internationally diffusion of it, an English version will be arranged in addition to the Italian one which has had a priority since the software has been developed for being used by Public Agencies. Referring to advances in the field of hazardous material transportation risk analysis, there are two main themes actually under study and on which attention will continue to be focused in future. The first research, in collaboration with the University of Pisa [5,6], is based on the consideration that risk analysis requires an homogenous approach to the problem and the minimisation of all the uncertainty factors present. In hazardous material transportation risk assessment these uncertainties are caused on one hand by data values (like those assumed for accident fiequencies and release probabilities), and, on the other, by the simplifying assumptions used to select and model reference scenarios for effects and damage evaluation. A revision of the accident and release frequencies data reported in literature has been made, to determine reference value suitable for the Italian situation and specifically for Messina; further the incidence on the final risk measures of different incident characterisations, that is the choice of different hole numbers, hole dimensions and probabilities of occurrence for each hole, has been investigated; further the importance of event tree assumptions has been studied. The aim of this research is to put in evidence the urgent necessity of developing a standardised approach to risk analysis studies at least in the Italian territory, in order to make risk measures more objective and thus more comparable. The second research consists in the application to the area of Messina of OPTIPATH [7,8], which is an innovative risk-based routing procedure, actually applied only on a semi-fictitious test area. First of all this code, processing the

1028

output data of TRAT2, evaluates for each network arc a parameter named ‘arc capacity’, which represents the maximum number of hazardous material vehicles of one or even more substances travelling simultaneously which can transit on the arc without exceeding both individual and societal risk acceptability criteria. Further the OPTIPATH procedure allows the determination of the optimal flow distribution on the network of all hazardous material shipments, so as to minimise societal risk while taking into account the economic feasibility of the transport. In particular this tool can be very usefil also to evaluate the incidence on risk of alternative routes, like the seaside running road suggested in section 5.0, or to establish the paths to be taken for different times of day.

ACKNOWLEDGEMENTS The financial support of the CNR, Gruppo Nazionale di Ricerca per la Difesa dai Rischi Chimico-Industriali ed Ecologici is gratefully acknowledged. The Prefettura di Messina, Capitaneria di Porto, Polizia Stradale and Comune of Messina are acknowledged for the support given in the data collection.

REFERENCES [l] CCPS, Guidelines for chemical transportation risk analysis, AIChE, New York, 1995. [2] Advisory Committee on Dangerous Substances, Major Hazard Aspects of the Transport of Dangerous Substances, HM Stationery Office, London, 1991. [3] P. Leonelli, S. Bonvicini, G. Spadoni, “New detailed numerical procedures for calculating risk measures in hazardous materials transportation”, Journ. Loss Prev., 1216 (1999) 507. [4] P. Leonelli, G. Maschio, G. Spadoni, “I1 rischio da trasporto di sostanze pericolose: un’analisi d’impatto territoriale con il TRATT, Proceedings of the VGR2k 2000 Conference, Pisa, Italy, 2000. [5] V. Cozzani, S. Bonvicini, L. Vanni, G. Spadoni, S. Zanelli, “Analisi comparativa delle kequenze di incidente e di rilascio nel trasporto stradale e ferroviario di sostanze pericolose”, Proceedings of the VGR2k 2000 Conference, Pisa Italy, 2000. [6] S. Bonvicini, G. Spadoni, “Effects of different incident characterisations in hazardous materials transportationrisk analysis”, Risk Analysis Conference, Bologna, Italy, 2000. [7] P. Leonelli, S. Bonvicini, G. Spadoni, “Hazardous materials transportation: a riskanalysis-based routing methodology”, Journ. Haz. Mat., 71/3 (2000) 293. [S] S. Bonvicini, G. Spadoni, “Ottimizzazione delle rotte nel trasporto stradale di sostanze pericolose”, Proceedings of the VGR2k 2000 Conference, Pisa, Italy, 2000.

1029

Best routing criteria for hazardous substances transportation R. Bubbico",S. Di Caveb,A. Guerrierib,B. Mazzarottab a Gruppo Nazionale

Difesa Rischio Chimico Industriale ed Ecologico, CNR, c/o Dip. Ingegneria Chimica, Via Eudossiana 18,00184, Roma, Italy

Dipartimento di Ingegneria Chimica, Universith di Roma "La Sapienza" Via Eudossiana 18,00184, Roma, Italy

1. INTRODUCTION Road mode of transport is largely used for the movement of dangerous materials: in particular, in Italy about 83 Mtodyr of hazardous substances (corresponding to 53% of the total movement) travel by road and a similar situation holds for other European Countries. These transportation activities represent a potential hazard for the exposed population and the environment, and a number of studies are being carried out in order to assess risk level. However, such evaluation is, by far, more complex than that for fixed installations, since the risk source is continuously moving and, correspondingly, the surrounding environment is continuously changing [ 13. The traditional approaches to transportation risk analysis (TRA) are mainly focused on the evaluation of individual and/or societal risk, to be possibly compared with suitable threshold values. This procedure also allows comparing the risk level of different itineraries, but does not give immediately the less hazardous route between given localities. It has to be considered that most road transportation activities are currently planned in order to minimise the length of the route or the time needed, according to a "minimum cost" routing, regardless of the potential hazard. On the other hand, the evaluation of the "minimum risk" route requires the knowledge of a large number of parameters, including factors such as accident rate, weather conditions and population in the impact zone, which may vary remarkably along alternative itineraries. In the present work a route risk index has been defined and used to determine the "minimum risk" itinerary, basing on a commercial routine, a specially developed GIS (Geographic Information System) application, and a database containing information about the hazard presented by the transferred products, including the impact areas for a number of combinations of dangerous events, amount of the spill and weather conditions.

1030

2. METHODOLOGY

The hazard considered in TRA is that deriving from the loss of containment of the load and the dispersion of the dangerous product into the surrounding environment. Therefore, the risk measure to be minimised depends on the probability that a release will occur during the trip, on the probability that this release will give rise to a hazardous outcome (fire, explosion, toxic cloud), on the expected consequences of these outcome cases, and on the exposed population [l]. In order to obtain the "minimum risk' routing, the risks calculated at each point of any itinerary connecting the desired locations should be summed. In practice, the route can be divided into portions, associating a "risk level" to each portion. However, the extension of the impact zone of the possible hazardous outcomes largely varies depending on the characteristics of the transferred substance and on weather conditions. Accordingly, a minimum risk routing will need plenty of information and a great number of calculations; on the other hand, its practical application also requires short computational time. This objective can be reached by adopting some simplifying assumptions, aimed at limiting the number of scenarios to be taken into account, by separately performing consequence analysis for these scenarios, including the results in a suitable product database, and by collecting and manipulating detailed territorial data by means of a GIs. 2.1 Accidental scenarios The loss of containment during transport may take origin from a number of different causes (a leakage from a valve, the rupture of the container, etc.) and the initial scenarios will also differ depending on size and location of the orifice, physical state of the product, transport pressure and temperature, and ambient conditions. The probability or frequency of each initial scenario has to be assessed, both in normal travel conditions and following an accident. When the dangerous substance is dispersed into the environment the initial scenarios may evolve into a number of outcome cases according to different patterns, depending on the hazard presented by the product (flammable, toxic or both), the physical state of the spill, its amount, and, broadly speaking, environmental conditions, which include weather (temperature, wind velocity, etc) but also orography, characteristics of the ground, local distribution of ignition sources, etc. For a flammable liquid, possible outcome cases cover the following: jet fire, pool fire, flash fire, UVCE (Unconfined Vapour Cloud Explosion) and fireball; however, depending on the involved substance, toxic cloud and physical explosion of the container may also occur. The probability that an initial scenario evolves into any of the possible outcome cases has to be assessed, as well as the consequences of each outcome case, in order to determine an "impact area" where the thermal radiation, the overpressure or the concentration of a toxic represent a serious hazard to human health: such impact areas strongly depend on weather conditions. The shape of the impact areas originated from the outcome cases may be circular (fireball, pool fire,

1031

UVCE, physical explosion) or elongated in a preferential direction, which may be downwind (flash fire, toxic cloud) or casual (jet fire). Accordingly, the impact areas can be defined by proper effect distances and angles. In order to reduce the number of cases to be examined, the following simplifying assumptions were suggested [2]: - the product is transported in a standard vessel of fixed volume (35 m3), which is filled at 85%; - any loss of containment is accident initiated: the probability that, following an accident, a spill will occur is taken from historical data [3] relevant to the product under exam, or to similar products; - a spill can occur according to 2 modalities: from a 25 mm orifice (medium release) or from a 220 rmn orifice (catastrophic release); in both cases the duration of the spill is 15 min; - the impact areas of the outcome cases deriving from the 2 above scenarios are calculated under 6 reference sets of weather conditions, listed in Table 1; the probability that an accidental scenario will evolve into each possible outcome case is taken from historical data [3] relevant to the product under exam, or to products with similar physico-chemical and hazardous characteristics. The weather sets were selected basing on the average seasonal values of high and low temperatures, and of wind velocity, recorded at the main meteorological sites in Italy [4]. The Pasquill atmospheric stability class D (neutral) was assumed in all cases, as reasonably conservative. Consequence analysis was carried out by means of Trace 8.0b software, supplied by Safer System LLC [5]. The concentration, heat radiation and overpressure profiles were estimated for each outcome case and compared with suitable lethality thresholds to assess the relevant impact area, determining the maximum distance and angle of the effect zone.

2.2 Product database A product database (TrHazDat) containing information related to the hazard presented during road transportation was developed, as described in details elsewhere [2]. For each substance, it gives the following data: - physical state during transport; - normal boiling point; - flammability limits; Table 1 Reference sets of meteorological conditions used for estimating impact areas Reference set 1 2 3 4 5 Temperature ("C) 5 5 14 14 26 Wind velocity ( d s ) 3 6 3 6 3 D Pasquill stability class D D D D

6 26 6

D

1032

acute toxicity thresholds; - probability that, following an accident, a spill will occur; - probability that the size of the spill will be medium or catastrophic; - probability, for each spill size, that any of the possible outcome cases Qet fire, pool fire, fireball, flash fire, UVCE, toxic cloud) will occur; - maximum distance and angle of the effect zone for each spill size and weather condition. The product database TrHazDat contains at the moment information about 30 flammable and/or toxic products. -

2.3 Territorial information Territorial information needed for the analysis include accident rate, population density and meteorological data along each road. However, the accuracy of the available information about these variables is quite different. Yearly accident rate data are available, grouped for roads falling in the same category: in Italy, they are classified according to the district, the type of vehicle, and the occurrence of injuries or fatalities [6]. Moreover, the number of accidents occurred for each 1-km portion of some roads (highways and state roads) is also recorded [7], but without any indication about the type of vehicles involved. It has to be remarked that the accidents occurred to trucks transporting dangerous goods are not listed apart: some of them appear in the records of the Fire Brigades, which are usually alerted, in all serious cases. However, the accident rate data needed in TRA should be expressed as number of accidents per vehicle and kilometre [l], i.e. they should be referred to the number of vehicles travelling on the road. Unfortunately, in Italy overall traffic data are available for rather long portions of pay-toll highway [8], while they are very scarce for the other types of road. Exhaustive population data are recorded during census operations, which usually take place every 10 years: the information is available with various degrees of accuracy, from regional data down to single census units (about 400 people) [9]. The population is assigned to the place where it is spending the night, regardless of their different location during the day, and on-road people are not taken into account at all. Weather data are hourly recorded at meteorological stations, but are usually available as monthly average values. In Italy, the network of main meteorological sites includes about 36 station [4]; a number of minor locations is also present which, however, collect less exhaustive data. All the above data should be made available "along the road", i.e. they should be referred to route portions as short as possible, and should be associated to the location of such portions on a map. This operation can be conveniently carried out by means of a GIs, grouping the various informations into different themes.

1033

2.4 GIs application The territorial database was developed by means of ArcView 3.1 GIS software and a commercial product (RoadNet Connect supplied by TeleAtlas) was taken as the basis for the road network. The coverage is quite accurate, including all the suburban roads, as well as the main urban ones: each road is divided into a great number of segments, sometimes a few meters long, in order to identify particular spots, such as crossings, or just to follow a winding itinerary. The population data, at the accuracy of the built-up areas (7 1274 localities in Italy) were taken from the last available census [9]. The weather data were taken from those recorded at the main meteorological stations [4] as follows: - monthly average high, medium and low temperature; - monthly average wind velocity; - yearly average wind probability for the main 8 directions (N, NE, E, SE, S, SW, W, NW). The first step of the procedure consisted of determining the expected weather conditions for each route portion, taking into account the period of the year and the moment of the day when the trip takes place. Initially, 36 combinations were assumed, basing on the month, and on the moment of the day (night, morninghfternoon, noon): temperature and wind velocity values were determined for each portion of road by weighting the data of the sites located on the same side of the watershed on the basis of the reciprocal of the distance (squared) between the portion of the road under exam and each meteorological station. The obtained values were then compared with the 6 sets of reference weather conditions listed in Table 1, selecting, for each period, the set closer to the actual values. As the work went on, it was noticed that the weather conditions did not vary too much within each season: therefore, also in order to reduce the size of the tables to be managed, a total of 12 combinations was assumed (4 seasons x 3 moments of the day). The probability of wind direction associated to each road portion was also included in the table. The available accident rate data were more or less accurate depending on the type of road, but only for long highway portions they could be expressed in the needed format (number of accidents per vehicle and km), while for all the other roads this was not possible, due the absence of reliable traffic information. For this reason, constant average values of accident rates were set for each type of road (highway, state, provincial, local and urban road) basing on the data of the Italian Automobile Club [6]. However, from a methodological point of view, this is not a great inconvenience: in fact, the data in the table can be easily updated and replaced with more accurate ones as soon as they will be available. Differently from meteorological data and accident rate values, the population density may change remarkably with the distance from the road; furthermore, it may also strongly depend on the direction along which this

1034

distance is measured. For example, Fig.1 shows two symmetrical routes nearby a built-up area: when wind blows from the direction indicated by the arrow, the population at risk is much higher for route 1 than for route 2. The hazardous characteristics of the substance, the release scenario and the possible outcome cases also play a significant role, since the maximum effect distance and angle may vary remarkably. Therefore, the population density to be associated to each road portion should be given at different distances from the road, and along different directions. However, it seems impractical to set the width of the buffers basing on the effect distances of the single outcome cases of all the assumed products. The effect distances listed in the product database were then examined, paying particular attention to the minimum and maximum values: then 14 buffer zones were assumed, as listed in Table 2. It can be noticed that the width of these zones increases with increasing their distance from the road: the maximum value (20 km) largely exceeds the maximum effect distance presently contained in the product database. As far as the direction is concerned, 8 axis were considered, oriented along the main 8 wind directions (N, NE, E, SE, S, SW, W, NW). The population density was then determined within each circular area, with radius equal to the buffer distance, and within each 45" circular sector oriented along the above wind directions. The former values can be directly used for the outcome cases presenting circular impact zone (pool fire, fireball, UVCE) or casual direction (jet fire); the latter have to be combined and weighted according to the probability of wind blowing towards each direction, for wind dependent outcome cases (flash fire, toxic cloud). Accordingly, the table associated to the road portions includes 14 wind independent and 14 wind dependent values of the population density.

Prevailing wind direction\

Route

'

Route 2

Fig. 1. Effect of wind direction on symmetrical routes

Table 2 Distance from the road axis of the buffer zones used for estimating population density 1 2 3 4 5 6 7 8 9 10 11 12 13 14 BufferNo. Distance (m) 50 70 100 140 200 300 500 800 1200 2000 3000 5000 10000 20000

1035

2.5 Route Risk Index In order to find the less hazardous route for transporting a certain dangerous product between assigned locations, a risk index has to be defined and associated to each portion of the itinerary. Such index will depend on the period of the year and the moment of the day chosen for the trip, on the accident rate, on the probability of each outcome case, should an accident occur, and on the population falling in the effect zone of each outcome case, estimated for each portion of route. The risk index of the i-th portion of route, RI,, can be calculated as:

where ARi is the accident rate of the i-th portion of route, Li its length, ock the overall probability that the k-th outcome case will occur, Ak its impact area and PDi,kthe population density of the i-th portion of route, relevant to the buffer just exceeding the effect distance the k-th outcome case. The overall route risk index, which can be obtained by summing the risk index of each portion of the itinerary, takes into account both the number of people at risk and the probability that a hazard will actually occur. 2.6 Development of the routing program The routing program RouTrHaz was based on the Network Analyst extension of the GIS software ArcView. The program can be applied to road network coverages and creates a graph, calculating the route that minimises the summation of some fields in the table. The built-in functions to be minimised are: length of the route, trip time (calculated basing on an average speed rate for each road type), and fuel consumption. First, in order to get realistic estimates of the trip time, the values of average velocity listed in Table 3 were assumed for the vehicles transporting dangerous products. Then, the data contained in the product and territorial databases were used to directly calculate, for each product and period of the trip, the risk index to be associated to each portion of route, basing on the local accident rate, the probability of the outcome cases for each release scenario and the population in the impact zones for each outcome case. In fact, due to the very large size of the tables, it is inconceivable to perform route index calculations (which require extremely long computational times) together with the routing ones. The final table of each product directly lists the risk index relevant to each portion of route for the 12 combinations of trip periods. Table 3

Assumed average velocity of road tankers on different road types Road type Highway State Provincial Average velocity ( k d h ) 90 70 60

Local 40

Urban 30

1036

The routing program requires selecting the substance, the season and the time of the day, i.e. the relevant field of the above tables, which is copied into the proper field and minimised by the routing program. The procedure runs in a few tens seconds.

3. APPLICATION The routing program was applied to Latium, which is one of the largest and more populated regions in Italy (surface 17 200 km2,population 5 200 000): the road network of the region, supplied by TeleAtlas, consists of 42243 records. Even if the application was limited to this region, population data of the neighbouring regions (Tuscany, Umbria, Marche, Abruzzo, Molise and Campania) were also collected for the localities within 30 km of the boundary. Similarly, the main meteorological stations located on the same side of the watershed were considered. Fig.2 shows the used territorial coverages.

3.1 Less hazardous route between assigned localities The proposed application consists in the selection of the less hazardous route between a locality just south of Rome, and another one about 40 km northwest of Viterbo. The shortest and the fastest routes between the selected points are shown in Fig.3 (a and b, respectively). Then, it was assumed that some flammable/toxic products (acetone, cianidric acid, ethylene oxide and vinyl chloride) have to be transferred from one locality to the other, and the less hazardous route was determined for each product, obtaining the results shown in Fig.3 (c, d, e and f, respectively).

e

Fig. 2. Territorial information for Latium.

1037

Fig. 3. Comparison of shortest (a) fastest (b) and safest route for the transportation of acetone (c), cianidric acid (d), ethylene oxide (e) and vinyl chloride (0.

It can be noticed that, for each examined product, the safest route is different from the fastest and the shortest one: none of the safest routes crosses the city of Rome, and all of them are much longer than the direct ones. Moreover, even if all the safest routes avoid the city of Rome, they appear rather different, the shortest being that for vinyl chloride and the longer that for acetone. In

1038

particular, it seems that the larger is the effect distance for the product, the shorter the length of the safest route. Similar comparisons between shortest, fastest and safest routes were carried out choosing different localities, products and periods of the year, allowing to draw some general considerations: - the safest route is generally different (and longer) than the fastest or shortest one; - there is not a single safe route between assigned localities, since the minimum risk itinerary strongly depends on the characteristics of the transported product; - with reference to the transportation of a certain product, the safest route between assigned localities generally does not change by changing the moment of the trip; - as the hazard associated to the product increases (longer effect distances), the safest route becomes closer to the shortest one. This last behaviour can be explained taking into account that, in case of short effect distances a derouting can avoid that large built-up areas fall into the impact area. On the contrary, in case of long effect distance, large built-up areas will be affected in any case, and the selection of a longer route, running more distant from these areas, gives no practical benefit. Of course, RouTrHaz can use all the usual options of a routing program, such as calculating the safest route from a start point to a number of destinations, and it also offers the possibility of calculating the "local" risk of each portion of the route. This option allows detecting "black points" along the route, where the combination of accident rate and population is particularly critical. 3.2 Road transportation emergency management The use of information contained in the GIS application, coupled with those of the product database TrHazDat can be of great help in managing transportation emergencies. In fact, it is possible to view directly on the map the effect zones relevant to the various outcome cases possibly originated by an accident. Moreover, the impact areas shown on the map can take into account the severity of the accidental scenario (medium or catastrophic release) and local meteorological conditions at that moment, including wind direction. This information can be used, together with the coverage included in the GIS application, to identify populated zones to be evacuated, roads to be blocked or to be reserved to the emergency forces, possible traffic derouting, etc. Of course, the standard routing abilities of the program can be used to find the emergency services (fire brigades, hospitals, etc.) closest to the accident site and the fastest route for reaching this site, provided that the location of the different emergency services has been included in the GIS coverage.

1039

The safest routing program can be also used for assigning an alternative route to a vehicle transporting dangerous goods in case of obstacles (heavy traffic, adverse weather, etc) along the original itinerary. This just requires the vehicle to be equipped with a global positioning system (GPS) connected with a central location providing the information.

3.3 Discussion The proposed approach for determining the safest itinerary couples transportation risk analysis techniques with accurate territorial information. The tool is simple and effective, and presents a great potential and some limitations. The main advantages are represented by the flexible structure of the program, which allows to easily manage and update all data, and by the use of GIs, which provides the capability of dealing with a huge amount of territorial data, showing them on maps. However, the potential of GIS applications cannot be completely exploited due to the lack of some information, above all those relevant to the accident rates. The same type of limitation also affects the historical data needed for assessing, for each transported product, the probability of a release scenario and of its evolution into the final outcome cases, even if the uncertainty about this information probably affects to a lower extent the selection of the safest route. In fact, the proposed approach actually compares the risk values of different itineraries for the same product, but is not aimed at estimating some absolute value of the risk. For this same reason also the hypopthesis about release scenarios and reference meteorological conditions are expected to have very limited effects on safest route calculations. The knowledge of the safest route can represent an important achievement for increasing safety in the transportation of dangerous goods. However, the "minimum risk' itinerary should be checked also under other practical and economical aspects. In fact, the safest route is, almost in all cases, remarkably longer than the fastest one; furthermore, keeping more distant from cities and villages, it often runs on secondary roads. Therefore, the direct adoption of the minimum risk itinerary will considerably extend the trip time, both due to the longer itinerary travelled and to the lower average speed, possibly resulting in unsustainably high transportation costs. The need of taking into account also the economical aspects of these transportation activities suggests that some other factors should be considered in order to select a safe itinerary which is at the same time practicable. This can be done in a number of ways, such as by introducing some boundary conditions to the routing program or selecting a different objective function. In the first case, a limit in the length of the route or in the trip time can be fixed for the routing program during the calculations of the minimum risk itinerary: these limits can be set by comparing the safest route length and trip time with those of the shortest and fastest route, respectively. Another approach can be that of defining a new objective function in terms of cost, which combines the overall trip costs,

1040

(fuel, vehicle maintenance and depreciation allowance, etc.) and some "economical" value to be assigned to the risk suffered by the population due to the transportation activity under exam. This approach, which is certainly open to severe criticisms from an ethical point of view, can be easily implemented into the program setting an economical value for the human life, since the route risk index accounts for both the overall number of people at risk during the trip and the probability that they actually suffer the consequences of this risk.

4. CONCLUSION The proposed methodology allows to easily and rapidly select the safest route for transporting dangerous substances by road. The application has been developed for an Italian region, but it can be immediately extended to any different zone and transport modality, just providing the needed territorial and product information. The safest route is generally remarkably longer and slower than the direct one, thus resulting in more expensive transportation costs; this suggests to consider also economical factors, which can be easily included into the program. The applications are not limited to routing activities but also cover important areas such as emergency management.

ACKNOWLEDGMENTS The authors gratefully acknowledge the financial support of G.N.D.R.C.1.E.CNR, and the technical support of H.E.L.I.O.S.project.

REFERENCES [ 11 CCPS, Guidelines for chemical transportation risk analysis, New York, AIChE, (1995).

[2] R. Bubbico, S. Di Cave and B. Mazzarotta, TrHaz: a quantified risk assessment tool for road transport of dangerous goods in Italy, Proceeding SRA 1998 Annual Conference "Risk analysis: opening the process", vol. 2, pp.665-676, (1998). [3] OSH-ROM, HSELINE, ClSDOL, MHIDAS, NIOSHTIC, London, Silver Platter (1998). [4] ISTAT, Statistiche meteorologiche anni 1984-1991, Ann. n.25. Roma (1994). [5] Safer System LLC, TRACE 8.Ob User Guide. Westlake Village (1998). [6] ACI, Analisi dell'incidentalith stradale a livello nazionale e regionale, provinciale e nei comuni con oltre 250.000 abitanti, Roma (1997). [7] ACI-ISTAT, Atti 52" Conf. del traffic0 e della circolazione, Stresa (1996). [S] AISCAT, Informazioni, Anno XXXN, n.3-4 (1999). [9] ISTAT, 13" Censimento generale della popolazione e delle abitazioni, Roma (1992).

Topic 7

The prevention, protection and mitigation, and modelling of accidental releases.

This Page Intentionally Left Blank

1043

Loss of containment: experimental aerosol rain-out assessment J.-C. Adriana,R. Leribleb,V. Marchand‘, J. Hocquet and J.-P. Bigotd aAtofina,BP 32, F69492 Pierre-BCnite bGaz de France, SEC, BP 12417, F44024 Nantes cedexl “Rhodithec,24 Av. Jean Jaurhs, F69153, Decines-Charpieu cedex dEcole Nationale Supkrieure des Mines, 158 Cours Fauriel, F42023 St-Etienne cedex 1. INTRODUCTION

Aerosol rain-out prediction is now far from accurate despite its importance in the loss of containment event. The liquid mass flow entrained with the gas as an aerosol is often assumed to have the same value as the vapor mass flow obtained from a flash calculation. This can lead to a severe prediction error. Our objective is to establish an experimental data base in order to examine the validity of the assumptions in some existing models [l-51. 2. EXPERIMENTAL

We generated water flashing jets from a pilot scale set-up (.230 m3, .1 to 1.3 Mpa) [6] through 1.8 mm ID orifice (Fig.1.a.). Inlet temperature was varied from 3 13 to 453 K and sub-cooling from 50 to 600 kPa. Twelve capture basins (Fig. 1.b.) allowed to weigh the liquid rained out under the jet as a function of the distance from the source. A thermocouple also measures the final temperature of the jet.

Jet direct@

7 9 11

2 -3- - -4- - - 5- 6 +-I----1.8 mm ID a>

4

8 10 12

01 x2mcapture ..._

0

10 m

b

basin jet axis 1.8 mm ID Orifice

b)

Fig. 1. Schematic representation of: a) the orifice, b) the downstream area.

1044

Three types of jets (Fig. 2.a.; Fig.3.a. and Fig.4.a.) are easily distinguishable to the naked eye. 2.1. Type a jet

Fig. 2.a. Jet parabolic trajectory. The Fig.2.b. Liquid capture fraction versus distance from the orifice. three first basins can be seen. Initial storage conditions TO= 383.4 K ;PO= 180 kPa

The jet is a superheated liquid cylinder all along its trajectory (Fig.2.a.). There is almost no fragmentation, no dispersion of the jet (Fig. 2.b.; the second peak is due to spattering from one basin to the other), except when a small obstacle is put on the trajectory of the jet which causes violent fragmentation. The distance of impact varies from 4 to 6 m when upstream pressure is increased (Fig. 5.a.). The temperature decrease between reservoir and end of jet is quite low (25 to 50 K) because heat transfer area is low. 2.2. Type b jet The liquid initial core changes progressively to a flow of droplets which "rain" in the basins (not visible on Fig.3.a. because droplets are too small). This fragmentation enhances the heat transfer so that some vapor can be seen along the jet's trajectory. The liquid spreads out on four meters or more. The mass center at impact is farther from the orifice than in type a case (6 to 8 m) because the upstream pressure is higher and so does exit velocity (Fig. 5.a.). The spreading of the jet increases with increasing upstream temperature (Fig. 5.b.), leading to a faster decrease of velocity and a shorter trajectory (Fig. 5.a.). Temperature decrease from the reservoir to the end of the jet is higher (50 to 85 K), because heat transfer to air is more efficient when fragmentation occurs. Experimentally we do not notice any discontinuity in the transition from type a to type b. Type b seems to be typical of a disintegration due to momentum exchange with ambient air.

1045

.-$ 4

5%

_---

O%l

0

I I---

~~

+ - -I - -~- -_ I

1----1 I

I

2

4

6

8

10

Distance from the orifice [m] Fig. 3.a. Vaporization along an Fig. 3.b. Liquid capture fraction versus essentially liquid jet's trajectory. distance from the orifice. Initial storage conditions To = 383.6 K ;Po = 480 kPa.

2.3. Type c jet No liquid core can be seen anymore, disintegration takes place immediately at the outlet; it results in very fine droplets; the jet looks like a fog with a fine drizzle under it (Fig. 4.a.). The jet spreads out over four meters or more. Jet speed decreases from the orifice, which gives a short trajectory (2 to 3 m) as shown in Fig. 5.a.; the first few basins are the ones that are the most full. Trajectory length increases slightly with upstream pressure. Type c jet behavior seems to be typical of thermal fragmentation. Mechanical fragmentation can probably no longer occur, because droplets resulting from thermal fragmentation at the orifice before air contact are small enough to be mechanically stable. 30%

7

Fig. 4.a. Immediate fragmentation of the Fig. 4.b. Liquid capture fraction versus jet. distance from the orifice Initial storage conditions To = 443.6 K ;Po = 820 kPa

1046 9.0

90 c

kPa submllng

+330

m =

5

.-

70

m

r

60 -5

0

“4

0

E

4.0

3.0

Type b jets ,4

30

._ E2.0 2

ad

4

Type b jets

8.0

1

0.0

~

,

1

.

.

1

.

~

.

.

.

,

~

.

,

.

.

~

Typecjets

I

I

1.0

/

~

~

2o

1

1

1

.

.

.

.

)

1

1

.

Typeajets,

I

I

I Typecjets

I

e. “ “ : “ ~ “ “ ‘ “ : ‘ ‘ ~ “ “ ‘ ~ : ‘ ‘ ‘ ~ I

10 1

-

I’

I ’ I\*-,.’ L‘ I

00

~

330.0 3500 3700 3900 4100 4300 4500 470 Storage temperature [K]

Fig. 5.a. Mass center position of water jets

Fig. 5.b. Spreading of water jets (number of basins in which more than 5% of the capture liquid deposited)

A discontinuity seems to appear while passing from type b to type c jet (Fig. 5.a.). At temperatures slightly less to the transition’s lower bound, an essentially liquid jet falls at 6 m from the exit. At temperatures just over the transition’s upper bound, we observe a fog which falls at 1.5 m. Fig. 6. allows comparison of our experimental rain-out data with those obtained at the CCPS [ 11 with different orifices. There is a general agreement which seems to mean that orifice diameter has not a crucial influence on this phenomenon. Every points lie approximately on the same curve, do they come from low or high initially sub-cooled conditions: rain-out fraction is not very sensitive to initial pressure conditions.

I

100,o

Present study (1.8 mm ID orifice)

90,o

80,O

70,O

60,O

20,o

10,o

0,o

330,O

350,O

370,O

390,O 410,O

430,O

450,O

Storage temperature [K]

Fig. 6. Rain-out: experimental data and model results.

470,O

490,O

510,O

I

1047

3. DISCUSSION As suggested by Brown and York [7], we have plotted our experiments on a graph (Fig.7.a.), using the growth rate constant C [8-91 (or TO- T,b) and the Weber number (or Po - Pa,,,b)as co-ordinates. C characterizes the rate of growth 0,12

!T 0,lO 'm

50

40 30

a, +

!! 0.04

2g 0,02 0,oo

20

10 0

a. Present study 0,12

F-

v)

0,lO

40

E

Y

m + m

50

50

0,08 0,06

a, +

! 0,04

30

20

Q

c

10 0,oo

0

b. Brown and York data [7] (continuous lines); present study transition to rippled surface (dotted lines) Fig. 7. Effect of Weber number and growth rate constant on type ofjet breakup.

1048

of a bubble inside the bulk of the liquid. We measures momentum exchange to surface tension forces ratio. There we can see that there is no flashing at the orifice when C is less than .085 (To- Teb < 38 K), even at Weber number of 25 (Po- Pamb= 500 Wa). Jets are then either stable (We < 7, type a), or disintegrate far from the orifice (We > 9, type b). On the other hand, jets disintegrate just at the orifice (type c) when C is more than .088 (To- Teb> 40 K). When C grows from .085 to .088 (To- Teb from 38 K to 40 K), thermal disintegration seems to occur nearer and nearer to the orifice until reaching it. For Brown and York [7] however, transition to a flash at the orifice can be promoted by increasing We i.e. Po (Fig.7.b. continuous line). Moreover this transition occurs at low Weber number, between 8 and 24: Brown and York’s jets are less stable as ours are. High speed video of the first centimeters of the liquid jet allowed us to detect a transition from a smooth jet to a rippled one there (Fig.7.b. dotted lines), but with no consequence on further disintegration. Notice that this transition does not present any discontinuity, in contrast to Brown and York data. This different behavior could be due to a different geometry of the orifices, even if Brown and York did not observe significant differences between their different orifices, either sharp-edged or hole with a length to diameter ratio of 1 and a roughness of 20mm. It should be noticed that diameters involved in potential industrial accidents are generally 10, 100 or even 1000 times larger than the one we used. We are therefore interested in the higher Weber numbers (up to lo4!). The CCPS model to predict aerosol rain-out RELEASE [l] considers parallel expansion and atomization at the orifice from which a droplet size distribution is derived. Following the approach of Wheatley [2], the model determines a critical drop size d,. Droplets larger than d, are assumed to rain-out without further evaporation. There is no attempt to model droplet trajectories or droplet evaporation rates. It is obvious from Fig. 6 . that this model doesn’t fit adequately the experimental data. The other models that we considered [3-51 assume that the jet is homogeneous (no droplets rain out of the jet). Ambient air is entrained by the jet momentum. Continuous evaporation takes place along the jet trajectory. They differ from one another by considering either equilibrium between liquid and vapor phases [3] or kinetically limited heat and mass transfer rates, with [5] or without [4] simplifying assumptions (dilution in air is infinite, wet bulb temperature in pure air is reached at the end of the jet, etc ...). Results of both models in Fig. 6. clearly indicates that the second kind of models gives better predictions: evaporation due to entrained air after initial flashing is of primary importance compared to the effect of initial size distribution on trajectory. We are now trying to refine the considered models.

1049

Both kinds of models assume that the jet disintegrates as an aerosol. This hypothesis is adequate for type c jets, but not for type a or type b jets. It is not obvious if a slope change can be noticed when To is less than 408 K (Fig. 6.). Then previous models can tentatively be used. We are looking for modeling those kind of jets. 4. CONCLUSION

In the introduction to the RELEASE program Johnson and Woodward [ 11 assert: "the liquid release models available in 1986 could not adequately predict the complicated processes occurring during the release of a superheated liquid". We saw here that the RELEASE model does not lead to a sufficient solution. Our new experimental data demonstrates that different types of jets have to be considered and that some models for rain-out give reasonable predictions. We are now looking for an improvement of these models as well as the extension of their applicability to jets issued from long cylindrical ducts.

ACKNOWLEGMENTS Financial support from "Conseil RCgional RhBne-Alpes" is gratefully acknowledged

REFERENCES [I] D.W.Johnson and J.L. Woodward, RELEASE: A model with data to predict aerosol rainout in accidental releases, CCPS Concept book, AIChE, New York, 1999. [2] C.J. Wheatley, SRD Report R410 (1987). [3] M. Epstein, H.K. Fauske and M. Hauser, J. Loss Prev. Process Ind., 3 (1990) 280. [4] A. Papadourakis, H.S. Caram and C.L. Barner, J. Loss Prev. Process Ind., 4 (1991) 93. [5] H.K. Fauske, FA1 Process Safety News, winter 1997) 6. [6] P. Alix, K. Koeberl and J.P. Bigot, 9 Loss Prevention and Safety Promotion in the Process Industries, Barcelona, Vo1.3, (4-8 may 1998) 976. [7] R. Brown and J.L. York, AIChE J., 8 (1962) 149. [8] M.S. Plesset and S.A. Zwick, J. Appl. Phys. 25, (1954) 493 [9] H.K. Forster andN. Zuber, J. Appl. Phys., 25 (1954) 474

il

NOMENCLATURE C

Growth rate constant [8-91 (m s-")

Panib Teb

ambient pressure (Mpa) upstream (reservoir) pressure (kPa or MPa) and temperature (K) boiling point at ambient pressure (K)

We

Weber number (-)

PO,TO

We=-P J J d 2a

This Page Intentionally Left Blank

1051

Effective applications of fluid curtains to mitigate incidental gas releases M. Molaga, H. Schotenaand M. Powell-Priceb TNO Environment, Energy and Process Innovation, P.O. Box 342,7300 AH Apeldoorn, The Netherlands

a

bEuropeanProcess Safety Centre, 165-189, Railway Terrace, Rugby, United Kingdom

1. INTRODUCTION Safety is an important issue in the chemical industry. In recent years chemical companies have aimed, where possible to use an “inherently safe” approach to safety. In the inherent safety approach measures are implemented during design, construction and operation of a chemical plant or storage to avoid large inventories of hazardous chemicals and the potential for releases to the atmosphere. Although all kind of measures have been taken to avoid such releases, where practicable post release mitigation measures are applied. This paper concentrates on fluid curtains, one of the post release mitigation techniques. Companies can apply various post release mitigation systems such as physical separation, containment, rapid dump and fluid curtains. Which technique to choose in which situation depends on efficiency, costs, reliability and operability of the post release mitigation system. In 1995 the European Process Safety Centre (EPSC) formed a Contact Group on the use of fluid curtains to mitigate gas dispersion. The objectives of the Contact Group’s investigation on the use of fluid sprays for the mitigation of gas dispersion were: To produce a comprehensive overview of the current practices with respect to the use of water and steam curtains in Europe. To give an overview of the design guidelines for water and steam curtains. 0 To give an overview of the available models to assess the efficiency of a specific fluid curtain application. To give an overview of the competent authority requirements on mitigation of gas dispersion To fulfil these objectives the Contact Group formulated and send out a focused questionnaire to all EPSC members seeking their current practice in the use of fluid curtains and commissioned the Department of Industrial Safety of the TNO Institute of Environmental Sciences, Energy Research and Process Innovation to perform an outline su~~lznary of Research & Development work conducted over the past 5-8 years. The results of the investigation are presented in [l] and summarised in this paper. First the basic principles of fluid curtains and the available efficiency estimates will be described, next the application of fluid curtains in the industry and finally conclusions and recommendations with respect to the application of fluid curtains in the process industry will be given.

1052

2. MITIGATING EFFECTS AND EFFICIENCY OF FLUID CURTAINS 2.1. Mitigating effects of fluid curtains Fluid curtains are used in chemical plants and refineries to mitigate the consequences of accidental releases of flammable and toxic materials to the environment. As well as water curtains steam curtains are applied, with and without additive to promote absorption of the gas in the curtain fluid. Different spray nozzles are used in fluid curtains such as flat fan nozzles, hollow cone nozzles, solid (or full) cone spray and fog nozzles. Fluid curtains are used to mitigate the effects of releases of flammable materials (e.g. hydrocarbons C2 C,) and toxic gases (e.g. hydrogen fluoride and ammonia). The fluid curtains for flammable releases are applied and designed to prevent the ignition of the flammable cloud. There are two ways that can be distinguished so as to prevent ignition, although these two ways are rather alike and enhance each other. The fluid curtain acts as a barrier for preventing the cloud reaching the ignition point. The fluid curtain dilutes the concentration within the cloud to a value below the lower flammability level. Both effects are induced by fluid curtains to protect the gas cloud from reaching ignition points like for example switch-houses and furnaces. In case ignition does occur, application of fluid curtains can reduce the effect of a burning or exploding cloud. With the supply of large amounts of water the fire is extinguished or quenched. For this purpose also use is made of sprinkler system. The fluid curtains for toxic releases are designed to reduce the concentration in the cloud to a ‘safe’ level. Example of ‘safe’ levels are the ERPG-values (Emergency Response Planning Guidelines), the IDLH-value (Immediately Dangerous to Life or Health) or the LCol (concentration that will cause 1 % lethality). Compared to flammable releases a much greater reduction of the concentration in the cloud is necessary, because the hazardous toxic concentration levels are significantly lower than the lower flammability level. For example, the lower flammability levels are often in the order of 1-10 vol %, while the hazardous toxic concentration levels are usually in the ppm range. This further reduction can be reached by the barrier and dilution effect (as for flammable releases) and in addition by absorption of the toxic gas in the fluid. The mitigating effects of fluid curtains are summarised in table 1. Important parameters that describe the performance of the spray produced by the nozzle are the Sauter Mean Diameter, the Nozzle Flow Number and the Momentum Flow Number.

1053

Table 1

Effects of fluid curtains Effect Barrier effect Dilution effect Upward momentum effect Heating effect Cooling and extinguishing Absorption effect

Effect achieved by Spray momentum is greater than cloud momentum Generated turbulence in the surrounding air enhances air entrainment Upward spray momentum is transferred to the cloud, cloud is 'pushed' upwards Fluid heat capacity is transferred to the cloud, vertical dispersion is encouraged Cloud heat capacity is transferred to the fluid, hot gases are cooled and fires are extinguished Mass transfer of pollutant gas to fluid via available surface area

2.2. Fluid curtain experiments Considerable practical research has been performed to determine the efficiency of fluid curtains. The experimental research concerned the application of fluid curtains include: hydrogen fluoride (Goldfish [2] and Hawk tests [3]); steam curtains for phosgene releases [4]; and comparisons of the efficiency of water and steam curtains [ 5 ] . Also experimental work has been done to investigate the mitigation of explosions by fluid curtains [6]. The results of the experimental work are summarised in table 2. The experimental tests indicate that high efficiencies are possible under idealised conditions, both for flammables and toxics, but that the efficiency of the fluid curtain strongly depends on the design, the various curtain parameters and the meteorological conditions. For example, a fine water droplet size will result in small barrier and dilution effects, but enhances absorption of the pollutant in water. For a good barrier effect the curtain should be close to the release and is improved by large droplets. The barrier effect is better in a stable atmosphere. Flammable gas clouds can be efficiently diluted below the LFL concentration by using the mechanical effect of a water-spray curtain [7]. For high wind speeds, vertical upward spray curtains based on coarse droplet distribution are recommended. This mitigation technique is characterised by a significant water mass flow rate that can be optimised by placing the curtain not too far Erom the source. The forced dilution implies a violent action which can be created by high discharge capacity nozzles fed under high pressure; the limiting factors for dilution action are the liquid flow rates which can be realistically established in an industrial site.

1054

Table 2

Overview of measured concentration reduction Experiment Measured reduction Goldfish tests [2] Water curtain spray systems achieved approximately a 36 to 49 percent reduction in downwind concentrations of HF at a waterflowlacid-flow ratio of 20: 1. Hawk tests [3] HF removals of 25% to 90% were demonstrated at water-to-HF liquid volume ratios of 6: 1 to 40: 1. Steam curtain tests It was demonstrated that a mean dilution factor of 6 to 66 can be achieved at curtain working pressures of 2.5 -10 barg. 141 Water and steam curtain tests [5] Water curtains to protect fire fighters [61

Typical concentration reduction factors for steam jets 15 m downwind of the curtain were less than 4, compared with 4-16 for upward water sprays. The effectiveness of the water curtain has been confirmed, since concentrations behind this kind of banier fall by a minimum factor of 3 at a distance of approximately 20 m, and a factor of 10 at least at 13 m.

Toxic gas clouds can be used to reduce the on-site toxic concentrations. For the far field only a reduction below the IDLH limit will be achieved if the toxic material is absorbed in the fluid. This approach needs moderate water consumption and requires fine droplet sprays to be effective. In general the absorbing systems has to be based on fine sprays with droplet sizes ranging from 100 to 300 pm to improve interfacial area and contact time of the liquid phase. For highly water soluble gases such as hydrogen chloride (HCl), hydrogen fluoride (HF)and ammonia (NH3), it is strongly recommended to use the two effects: tiny droplets spray for absorption (100 - 300 pm) and maximum contact time in the spray combined with dilution. For gases with low water solubilities such as chlorine (Clz), phosgene (COC12), hydrogen sulphide (H2S)and nitrogen oxides (NO,), the use of chemical additives in the water can strongly enhance the absorption effect.

2.3. Models for design and efficiency estimates As can be seen from the results from the experiments each type of fluid curtain has its own advantages, drawbacks and design rules in creating the desired effects, i.e. as a barrier, for dilution and for absorption. Several models have been developed to model the efficiency of water sprays taking in account the three effects. The most important are: The prediction of the concentration reduction by a water spray where the water-spray barrier can be simulated by a line source of air [S]. The entrained air produces a sudden change in the composition and geometry of the plume. For example the width and height of the plume are altered (increased) to simulate the extra dilution of the cloud by air entrainment due to the spray.

1055

As a result the concentration reductions behind the spray can be predicted and evaluated. 0 The HGSPRAY and HGSYSTEM models can be used together to study the efficiency of water-spray mitigation systems [S].The HGSYSTEM models describe several stages of an accidental gaseous release, including depressurisation, phase change, and atmospheric dispersion of buoyant or denser-than-air gases. HFSPRAY is a complete model of mass, momentum and heat transfer between air/HF and drops injected by water sprays. HFSPRAY simulates the mass, momentum and energy interactions between multiple water sprays and a plume of HF in air; it predicts the flow fields of velocity, temperature, water vapour, and HF concentration in twodimensional geometry, for sprays in any direction. The HFSPRAY model has been verified against all the Hawk water spray experiments performed at the DOE Nevada test site [lo]. In the RIDODO project a model has been developed to predict the mitigation potential available and to optimise the curtain design for toxic gas dispersion [ 11, 121. In the model the curtain is described as an open-air reactor in which momentum, mass and heat transfer occur simultaneously. RIDODO is based on small scale experiments, but has not been validated by large scale trials. The engineering code developed in the frame of the project can be used to design spray curtains to mitigate accidental releases. These models can predict the efficiency of fluid curtains under specific defined conditions. However the models are not widely used in the process industry because of unavailability, unfamiliarity, complexity and poor validation. 3. APPLICATIONS AND DESIGN IN THE PROCESS INDUSTRY

Several European companies have been interviewed to get an insight in the current applications and experience with fluid curtains. The decision on when to apply fluid curtains may be based on site specific considerations, company policy and sometimes on requirements of the competent authorities. The response to the questionnaires on fluid curtains send to the competent authorities show considerable differences between the different states in Europe. In some countries there are strong pressures to consider fluid curtains, with some countries including the request for the installation of fluid curtains in the “conditions” attached to a site. In other countries little emphasis is placed on the use of fluid curtains. It was clear from the interviews that many fluid curtains are installed in the European Process Industry. The four main reasons to apply fluid curtains on industrial sites are: Isolation of ignition sources for flammable clouds Isolation of on- and off-site population Reduction on-site toxic concentrations Reduction off-site toxic concentrations

1056

Table 3.

Fluid curtain techniques and duties in the process industry Fluid Water Steam SteadAmmonia Water Solution Water monitors

FLAMMABLES C2-C4 (e.g. LPG), hydrocarbons, propyleneoxide, butylene-oxide Olefins C2-C4 (e.g. LPG)

TOXICS HCl, HF,N H 3 , Clz, acetic acid, bromine, amines, foaming acids, phosgene, ethylene-oxide, CS2, BF3 Phosgene Bromine For (small) releases of HCl, Clz, S02, N H 3 , chlorosulfonic acid

The fluid curtain techniques currently used, and their duties (against the releases of certain chemicals), are summarised in table 3. Mobile monitors are especially used by emergency response teams or professional fire brigades. Within most companies the existing fluid curtains designs were developed from the companies own engineering practice or were developed by a supplier or subcontractor using off-the-shelf technology. In general companies have no specific guidelines to design fluid curtains. Some exceptions are: A “standard” design for some types of curtains; Models for optimum curtain design (e.g. engineering codes); Company guidelines based on the NFPA guidelines. In general the models as described in section 2.3 had not been applied for the curtain design. Operability of the fluid curtain is an important issue in the process industry. The main concerns are activation time and availability of sufficient fluid. Especially for flammable clouds a rapid activation is important to isolate the cloud from an ignition source. Fluid curtains make it very difficult to isolate the source of the release because they obscure the release point, so automated systems are not widely believed to be practicable. Reduced visibility restricts escape possibilities of on-site plant operators and the isolation of the leak. For fluid curtains with the addition of an absorbing chemical, for instance ammonia, automated activation is not desirable so as to avoid accidental exposure to the absorbing toxic chemical. The capacity of the water or steam supply is limited (for efficient use of limited supply, manual operation is preferred). The most important fluid curtain maintenance problem is corrosion. Especially spray nozzles with a small orifice which may be blocked by corrosion products. To avoid these problems, standard procedures for regular testing are required to guarantee the system reliability and activation of the fluid curtains when necessary. For nozzles with a large orifice diameter, hydroshields and steam curtains corrosion is not a big problem. Mobile fluid curtain systems have the advantage that they can be more easily cleaned, dried are stored inside and therefore corrosion is not important.

1057

However there are some doubts that a fluid curtain is a good investment, due to: Increased level of inherent safety resulting in smaller inventories of hazardous materials. It is difficult to demonstrate the efficiency and justify the investment due to the lack of good design guidelines, experimental data and models to demonstrate the efficiency. Maintenance and operability problems

4. CONCLUSIONS AND RECOMMENDATIONS Fluid curtains are often applied at process plants to avoid the dispersion of flammable and toxic gases. Two major drawbacks for the application of fluid curtains are on the one hand the non availability of design guidelines and on the other hand the lack of experimental data and insufficient validated models to demonstrate the efficiency of a specific fluid curtain design. Table 3 gives some general conclusions with respect to the efficiency that can be drawn from the experiments and models. The indicated effect on the reduction of the concentration strongly depends on the applied fluid curtain system and release scenario. Fast responding automated fluid curtains will give better results than mobile systems with a longer response time. From experiments and models it can be concluded that fluid curtains applications could be effective in the following situations: 0 Fixed, automated, steam curtains to isolate instantaneous and large releases of flammable clouds from ignition sources. Fixed water curtains are a little less effective because of the lower dispersion potential and corrosion problems. Mobile fluid curtain that require a long activation time are not useful for these releases. To reduce on-site toxic exposure fixed absorbing and non-absorbing fluid curtains can be effective. To reduce off-site (far-field) toxic exposure only an absorbing water or steam curtain are likely to be an effective option. Table 3

Efficiency estimates for fluid curtains Application Water curtains Absorption No absorption Steam curtains Steadammonia curtains for phosgene Mobile svstems

flammable hazards

on-site toxic hazards

off-site toxic hazards

not applicable major reduction major reduction

major reduction minor reduction minor reduction major reduction

Minor reduction no effect No effect Minor reduction

minor reduction

minor reduction

No effect

1058

Absorbing mobile fluid curtains could reduce the on-site exposure to large and small releases of soluble toxics, provided the response time is not too long. The advantage of the mobile fluid curtains is the flexibility, and units not equipped with a fixed system could be protected. Also maintenance is less problematic for mobile systems. Application of a fluid curtain is sometimes the only available technology to reduce the consequences of releases from a unit with a high inventory of a toxic material (e.g. HF in an alkylation unit). In addition, it can be the only technology to separate an accidentally released flammable cloud from an ignition source. It is important to make informed decisions on the application of fluid curtains and to demonstrate that a fluid curtain is an effective tool to reduce the hazards of accidentally released gas clouds. As indicated some models are available but not widely used. To increase the application of these models it is recommended that: the process industry is made familiar with the possibilities of the models 0 to make the models less complex 0 to further validate the models to make models more user friendly to demonstrate the models with some well defined examples

REFERENCES M. Molag, H.H. Schoten and M. Powell Price, The use of fluid curtains to mitigate gas dispersion, EPSC, Rugby (2000).. Blewitt et al., Effectiveness of water sprays on mitigating anhydrous hydrofluoric acid releases, Proc. Int. Conf. on Vapour Cloud Modelling AIChE, New York, (1987), pp. 155-171. Schatz K.W. and Koopman R.P., Water spray mitigation of hydrofluoric acid releases, J. Loss Prev. Proc. Ind., 3 (1990), pp. 222-233. Barth U., Worsdorfer K., Water and steam curtains - Mitigation of heavy gas clouds on industrial terrains, Eur. Saf. & Reliability Conf., Copenhagen (1993). Moore P.A.C., Rees W.D., Forced dispersion of gases by water and steam, IChemE N.W. Branch Papers, 5 (1981). Bara A., Dusserre G., The use of water curtains to protect firemen in case of heavy gas dispersion, J. Loss Prev. Proc. Ind., lO(3) (1997), pp. 179-183. Buchlin J-M., Mitigation of problem clouds, J. Loss Prev. Proc. Ind., 7(2) (1994), 167174. McQuaid J., Fitzpatrick R.D., The uses and limitations of water spray barriers, IChemE N. W. Branch Papers, No 5 (1981). Fthenakis V.M., Blewitt D.N., Recent developments in modelling mitigation of accidental releases of hazardous gases, J. Loss Prev. Proc. Ind., 8(2) (1995), pp.71-77. [lo] Fthenakis V.M., Blewitt D.N., Mitigation of hydrofluoric acid releases: simulation of the performance of water spraying systems, J. Loss Prev. Proc. Ind., 6(4) (1993), pp.209-218. [ll] St-Georges et al., Fundamental multidisciplinary study of liquid sprays for absorption of pollutant or toxic clouds, Loss Prev. Saf. Prom. Proc. Ind., May Vol. 2 (65) ( 1992). [12] Griolet et al., Mitigation of accidental releases of toxic clouds by reactive fluid curtains: a cooperative Europ. Research Prog., Loss Prev. Saf. Prom. Proc. Ind., Vol. 1 (1995), pp. 577-588.

1059

Assessment of design explosion load for control room at petrochemical plant S. Hoiset and 0. Saeter Norsk Hydro ASA, Research Centre, P.O. Box 2560,3907 Porsgrunn, Norway

ABSTRACT During a review of the risk level at a petrochemical plant, the possible effects of an eventual explosion on the control room was brought forward. The control room was designed for more than 20 years ago, and the plant management wanted to know if new knowledge about gas explosions and methods for assessing explosion risk would influence on the perceived risk level for the operators. The design accidental leakage for the process was identified according to Norsk Hydro ASA risk analysis procedures. With the use of the Multi Energy Method for explosion pressure estimation, the results came out unsatisfactory. The final figures from this tool showed up with an unacceptable risk. The Multi Energy Method is known to sometimes produce conservative estimations. Hence, Norsk Hydro ASA decided to use an advanced consequence estimation tool in order to provide a better explosion load estimate. A CFD computer model of the plant was established. The relevant dispersion scenarios were then simulated in the CFD model. The dispersion scenarios took into account the direction of the leakage, wind speed and direction, according to actual meteorological data statistics, the time until ignition and the ignition point location. All parameters were combined with their associated probabilities. Simulation of ignition of the resulting flammable clouds were carried out in the CFD code, the explosion progress calculated, and the explosion pressures at the control room building registered. The result was a set of explosion pressure figures at the control room wall, ranging from 0 to 1.2 barg, each associated with a probability. For a best estimate of the risk, the weighted mean was chosen to be the design accidental load. This estimate showed that the safety level was acceptable.

1060

1. INTRODUCTION

1.1. Background Norsk Hydro ASA is an international industrial company with 39000 employees in 70 countries. The main office is located in Oslo, Norway. Norsk Hydro ASA’s main products are fertilisers, light metals, energy and oil and gas. They also have a petrochemical division, producing ethylene, propylene, chlorine, sodium hydroxide, VCM and PVC. One of Norsk Hydro’s petrochemical plants was constructed during the middle of the 1970’ies.The plant control room building was originally designed to withstand the pressure from a gas explosion in the process area, the nearest process equipment being less than 50 m away. The basis for the design was the prevailing knowledge of the gas explosion mechanism at that time, and a design strength of 0.3 barg for the building wall facing the process was originally used in 1974. This was thought to be an appropriate estimate of an unfavourable outcome of an explosion. But when the horror of the Flixborough accident emerged, the building was reinforced in 1976 to a capacity of withstanding an explosion pressure of 0.6 barg. In 1996, a risk analysis for the plant was carried out. This risk analysis covered i.a. the probability and strength of the design explosion. For explosion pressure estimation, the multi-energy method (MEM) [ 11 was used. This method is slightly more sophisticated than any tool available in 1975-76. The risk analysis concluded that the design explosion pressure load that should be expected at the control room building wall was greater than 0.6 barg. 1.2. Explosion pressure assessment A further reinforcement of the control room building was undesirable. A question of the level of conservatism in the MEM was raised. MEM is known to produce somewhat conservative figures for explosion pressure close to the explosion centre. It was decided to perform an extensive explosion study for the plant based on a computer code named FLACS (FLame ACcelleration Simulator), developed by Christian Michelsen Research (CMR) in Bergen, Norway [2]. FLACS is a computational fluid dynamics code that incorporates combustion, forming an explosion simulator. The desired outcome of the explosion study was the best available estimate of the design accidental load (DAL) from an eventual explosion with the current knowledge of gas explosions.

1061

1.3. Abbreviations CCR CFD CMR DAE DAL FLACS HSRA

LFL

MEM PVC VCM

Central Control Room ComputationalFluid Dynamics Christian Michelsen Research Design Accidental Event Design Accidental Load FLame ACcelleration Simulator Norsk Hydro ASA’s Hardbook of Safety Risk Assessment Lower Flammability Limit Multi-Energy Method Polyvinyl Chloride Vinyl Chloride Monomer

2. RISK ANALYSIS METHODOLOGY As explained, the risk analysis claimed the risk level to be unsatisfactory. A brief explanation of the methodology used in the risk analysis that was carried out is provided in this chapter in order to understand the chosen solution in the following explosion study work.

2.1. Risk acceptance criterion The integrity of any control room in the company is described in Norsk Hydro ASA’s techrical standards: <<Wherethere is a risk of explosion the CCR shall be designed to withstand the blast pressure from an explosion resulting from a design accidental event, either in the plant itself, or in an adjacent plant. >> The design accidental event is defined in the internal Handbook of Safety Risk Assessment (HSRA) [3]: <> The explosion pressure from the design accidental event (DAE) is usually called the design accidental load (DAL). So DAL is a term describing the statistical properties of any explosion that might occur at the plant. Smaller explosions may occur more frequently, but the will not represent any threat to the integrity of the CCR if the DAL is used as design basis.

1062

2.2. Failure frequencies A gas explosion is a possible result of a flammable gas leak. A leak may occur if some process equipment fail. Thus, in order assign a frequency to any explosion, knowledge about process equipment failure frequencies is necessary. Commercial databases with failure frequencies exist. Norsk Hydro ASA operates with their own set of failure frequencies in their HSRA. For pipelines and valves, failure frequencies are described for the modes <>, <<majorleakage>>and eminor leakage>>.The failure frequencies are intended to represent a best estimate, thus representing a neutral assumption. 2.3. Leakage The equipment failure mode will, along with the process stream component, phase, pressure and temperature result in a leak with a specified mass rate. Its frequency is equal to the equipment failure rate for the specified mode. The leakage direction from the source is usually unknown. If a uniform distribution is assumed, the resulting gas cloud will have equal probability of ending up at any side of the leakage source location. A gas cloud centred around the leakage source location is therefore often assumed as a neutral assumption. The flammable gas cloud is furthermore assumed to form a stoichiometric mixture with air. This is a conservative assumption. 2.4. Ignition The flammable gas cloud resulting from the leakage may or may not ignite. The probability of ignition is incorporated into the event frequency. If the gas cloud ignites, the time of ignition is of importance. A longer duration will result in a larger flammable gas cloud, and, most likely, a more powerful explosion. It is assumed that a flammable gas cloud will ignite within a minute from the leakage start. A linear ignition model within the first minute of the leakage is applied to the event frequency. The level of conservatism for this ignition model is unknown, but assumed neutral with certain limitations, see subchapter 3.5.

2.5. Multi-energy method

At this stage, following the risk analysis procedure has resulted in a set of flammable gas clouds that will ignite. The gas clouds will have unequal sizes, varying locations and may be composed of different gases. All the gas clouds will have their own associated frequency. The multi-energy method bases its calculations on the energy of the gas cloud that is located within congested process areas. It assumes central ignition within that volume, and an estimate of the central explosion pressure is required. With a given distance to the point of interest, the MEM produces

1063

maximum explosion pressure and duration. The frequencies for the gas clouds is transferred to the set of explosion pressures with accompanying durations. Norsk Hydro ASA favour the MEM for estimates of explosion pressures from gas explosions. The main drawbacks with the MEM are in our opinion too high estimates of explosion pressures close to the explosion centre and the method’s assumption of central ignition.

2.6 Ranking and accumulation After applying MEM to the events, the available data is a set of pairs of explosion pressure and individual frequency. These are sorted by decreasing consequence (pressure), and the frequencies are then accumulated from the top. This is often illustrated in reverse order, as in Fig. 1, with the most unfavourable consequence at the bottom. the design accidental load is When the accumulated frequency reaches the current load.

Fig. 1. Establishing the design accidental event from a series of events with individual frequencies.

1064

3. EXPLOSION STUDY 3.1. Status The status after the risk analysis procedure in chapter 2 was a documentation (based on MEM) which showed that the design accidental load was greater than the wall’s structural strength. This situation was unsatisfactory. It was decided to carry out a more thorough estimation of the explosion load by applying more sophisticated tools for parts of the explosion scenarios. For the following work, it was assumed that the new estimation method did not alter the mutual consequence ranking order. 3.1. Choice of leakage points The design accidental event was identified to be a rupture of a valve at a given location in the plant. This event, along with the two neighbour events was chosen for further calculations 3.2. Leakage direction The three leakage events were all assumed to have a uniform distribution in leakage directions, thus upwards, downwards and the directions of the four comers of the world were all assumed to have a probability of 1/6. 3.3. Meteorological data Approximations of the actual meteorological data for the plant were used. This plant happens to be located in an area were the dominating winds are in the north-south direction, so all wind measurement entries were lumped into the two main directions, from the north and from the south. Furthermore, all entries of wind less than 5 m/s were said to be 3 m/s, and 10 m/s was used for all entries with wind speed greater than 5 m/s. Thus, frequency data for 4 combinations of wind speed and direction were established. 3.4. Gas dispersion A computer model of the plant was assembled. This model was the basis for gas dispersion simulations with the FLACS CFD code. The leakage from 3 sources, each in 6 directions and with 4 possible climatic conditions were considered for simulations. Some of these scenarios resulted in flammable gas clouds purely in open areas, and others blew upwards, away from the congested process equipment areas. When ignited, these were all assumed to produce a plain fire with insignificant explosion pressure at the CCR location. Their probabilities, however, were kept in the calculations.

1065

In the other scenarios, with gas dispersing into the obstructed process area, the gas cloud outlines were plotted at 5, 30 and 60 seconds. These time figures represent the time of ignition in the ignition model, see next subchapter. The many gas dispersion patterns (i.e. gas cloud formation with flammable gas concentration above LFL) obtained from this procedure were grouped into a limited set of gas clouds with a rectangular footprint and a height of 12 meters (top of pipe rack). The transformation was based on retaining the flammable gas cloud volume. In this way, the number of necessary explosion simulations were reduced to a practicable figure. Some gas cloud were assumed to be lean or rich, based on concentration plots, but most clouds were assumed or conservatively adjusted to be represented by a stoichiometric mixture. The latter decision was also based on an assumption of the FLACS software possibly being nonconservative in open geometries in the software version at that time.

3.5 Time of ignition All gas clouds were assumed to ignite within the first minute. Within this minute, a linear ignition model was used. Any gas cloud formed was ignited at 5, 30 and 60 s, with an associated probability of 5/60, 25/60 and 30/60. This ignition model is intended to approach a neutral assumption. Some gas clouds, especially gas clouds formed by small leaks, may well have a longer time until ignition. For these clouds, the assumption is nonconservative. However, small leaks will probably not contribute to the design accidental event. For the current problem, a leakage lasting 60 s was for many cases long enough time to fill the complete process area with flammable gas. 3.6. Ignition point location Five ignition points were chosen within each gas cloud. The sides of the rectangular footprint were divided into 3, producing 9 smaller rectangles. The centres of the corner rectangles, along with the centre of the middle rectangle were used as ignition point locations, 1 m above ground level. Giving equal probability to each of these ignition point locations is intended to be a neutral assumption. 3.7. Explosion simulations The explosion simulations were carried out using the FLACS code [2], the 97 version of the software. The FLACS Multiblock algorithm was used to speed up simulation time and accuracy for pressure propagation outside the process area.

1066 Accumulated pressure probability for CCR wall

1

I I

Iu

0.9 I

i i

e! 0.7

O.'

0

i

t I 0

I

Pw =0.29

I

0.2

I

0.4

0.6

Simulated explosion pressure [barg]

0.8

1

Fig. 2. Accumulated probability for explosion pressure at CCR wall.

Several pressure monitoring points were located in front of the CCR wall, in varying heights. The distance from the wall to the monitors was 1/2 control volume in the CFD model.

3.8. Associated probabilities A total of 3 leakage points, with leakage in 6 directions under 4 climatic conditions, ignited at 3 different times at 5 distinct points results in 1800 possible scenarios with associated probabilities. A lot of these could visually be established to produce very small or no pressures, i.e. by producing gas clouds outside the process area, or producing too rich mixtures. All the other scenarios were grouped together according to gas cloud size and location for the simulations, but their individual probability was kept. The total number of exploding gas clouds that was simulated was between 10 and 20. With 5 ignition point locations, the number of simulations ended up between 50 and 100.

1067

3.9. Statistical properties The design accidental event, a leakage followed by an explosion, could be represented by 1800 scenarios. Many of these were very similar or resulted in zero explosion pressure. The calculations were narrowed down to less than 100 explosion simulations, but the 1800 individual frequencies were kept. The accumulated frequency curve for the explosion pressure at the CCR wall is shown in Fig. 2. We see that the explosion pressure from the design accidental event varies from 0 to 1.2 barg, depending on the properties of the event and the climatic conditions. As a best estimate of the design explosion pressure, a weighted figure was chosen. Each explosion pressure was multiplied with its original probability. This resulted in a design accidental load of 0.29 barg. The plant management accepted this value as a most probable outcome of the design accidental event.

4. CONCLUSION A risk analysis was carried out for a petrochemical plant within Norsk Hydro. The analysis applied the multi-energy method for estimation of explosion pressure acting on the central control room. This procedure lead to an estimate of the explosion pressure that was higher than the design strength, and thus unacceptable. In order to reduce conservatism, a refinement of the explosion pressure estimation procedure was introduced. The design accidental event, together with its neighbour events, was split down into several cases, with varying leakage direction, wind direction, wind speed, time of ignition and ignition source location. Each case was assigned its unique probability. The cases of the design accidental event was simulated during dispersion and explosion, and the explosion pressure acting on the central control room was recorded. From the set of explosion pressures, ranging from 0 to 1.2 barg, 0.29 barg was determined to be the best estimate based on a weighted mean.

REFERENCES [ 11 A.C. van den Berg: The Multi Energy Method. A Framework for Vapour Cloud Explosion

Blast Prediction. J Hazardous Materials, 12 (1985). [2] I.E. Storevik et al.: FLACS-96 version 2.0. User’s Guide revision 1.1. CMR report CMR-97-F30021, CMR, Bergen, 1997. [3] Handbook of Safety Risk Assessment, Norsk Hydro ASA, Oslo, 2000.

This Page Intentionally Left Blank

1069

Heat-up and failure of Liquefied Petroleum Gas storage vessels exposed to a jet fire* M.A. Persaud",C.J. Butlerb,T.A. Robertsb,L.C. Shirvill"and S. Wright'

"Shell Global Solutions, Cheshire Innovations Park, P.O. Box 1, Chester CHI 3SH, United Kingdom bHealth & Safety Laboratory, Harpur Hill, Buxton, Derbyshire SK17 9JN, United Kingdom 'Technology Division (Unit 5), Health & Safety Executive, Magdalen House, Stanley Precinct, Bootle, Merseyside L20 3QZ, United Kingdom

1.

INTRODUCTION

Liquefied petroleum gas (LPG) is commonly stored in large pressurised vessels. If these vessels are subjected to engulfing pool fires or impinging jet fires significant amounts of heat may be transferred to the vessel. If the fire exposure lasts for sufficient time, the vessel may fail catastrophically, resulting in a Boiling Liquid Expanding Vapour Explosion (BLEVE). In these events, it is the temperature rise and subsequent loss of strength of the steel wall which determine the time to failure. Although vessels are usually protected with pressure relief valves, failure can occur in just a few minutes. On the other hand, the use of water deluge systems or passive fire protection (PFP) materials decrease heat flow to the vessel contents and can reduce or eliminate the risk of a BLEVE occurring [l]. In order to be able to assess this behaviour and the hazards posed from fire-engulfment of LPG storage vessels it is important to understand the mechanism of failure and to be able to predict the response of vessels under such conditions. This paper first considers the physical processes that are involved in the interaction of a fire with an LPG-containing vessel and the subsequent BLEVE. 'This paper and the work it describes were undertaken by the Health and Safety Laboratory and Shell Global Solutions. Its contents, including any opinions and/or conclusions expressed, do not necessarily reflect Health and Safety Executive or Shell Global Solutions policy.

1070

Next, a computer code, HEATUP, developed by Shell Global Solutions in order to model the behaviour of LPG vessels exposed to fire and produce suitable data as input for hazard consequence analysis tools, is described. Details are given of a series of tests undertaken by the UK Health and Safety Laboratory (HSL) on behalf of the Health and Safety Executive and the European Commission [2]. In these tests, 2 tonne vessels containing commercial propane were taken to failure in a jet fire and the vessel response, mode of failure and consequences of failure characterised. Four trials with vessel fill levels of 20,41, 60 and 85 vol.% of the water capacity of the vessel, were completed. Finally, the measured results are compared with the HEATUP code [3], which was used to independently model the response of the vessels in the HSL trials. 1.1

Background The primary purpose of HSE's research is to underpin its regulatory function and as such, much of the research undertaken is reactive in nature. However, Technology Division (TD) uses research as part of its rolling programme of problem identification, analysis, investigation, solution and codification. The division commissioned its first Jet Fire research project in 1991. This followed a number of incidents that demonstrated the dangers of a jet fire, including Mexico City [4] and Piper Alpha [5]. TD recognised that a jet-fire incident posed an increased threat compared with the pool fire scenario that previous work had considered. The results of the research have been taken into consideration when LPG guidance was revised in 1997/98. LPG storage vessels are designed to contain LPG in equilibrium with its vapour. At ambient conditions, liquid propane is in equilibrium with propane gas at -7 bar. The pressure will vary with temperature and composition, because commercial propane consists of propane and approximately 10% butane. If the storage vessel becomes engulfed in fire, the heat transfer to the vessel results in the liquid and vapour being heated. This in turns increases the equilibrium pressure in the vessel. If the heating continues, the pressure generally increases until the set-pressure of the pressure relief valve (PRV) is reached, at which point vapour is vented from the vessel in order to prevent further pressure increases. If the heating is severe, the resulting increase in wall temperature that occurs is accompanied by a decrease in the wall strength, due to the thermomechanical behaviour of steel. If the wall strength falls sufficiently the vessel will fail, allowing the contents to flash and a BLEVE occurs. HEATUP was developed to predict the conditions of a vessel at the point of failure due to exposure to a fire source. The aim was to use the data produced from the HEATUP code as input to further BLEW codes [ 6 ] , which are designed as consequence models for BLEVE failures and as input for other risk assessment tools. The HEATUP code was designed to quantify the

1071

thermodynamic properties of propane and other hydrocarbons in the vapour phase and liquid phase of the contents of vessels exposed to a range of fire scenarios. The code allows for fluid loss though a PRV whenever the set pressure of the valve is exceeded and it can also be set up to model vessels with PFP coatings. By calculating the thermodynamic properties of the fluid remaining inside the tank, at the point of catastrophic tank failure, HEATUP effectively determines the source terms essential to evaluating the hazards associated with the resulting BLEVE. The tank pressure, liquid fill level, fluid and wall temperatures and fluid enthalpy in the liquid and vapour zones are all predicted up to the point of vessel failure. 2.

PHYSICAL PROCESSES

There are many different physical processes occurring when a flame interacts with an LPG vessel due to the complex behaviour of the flame, the vessel and the vessel contents. The important processes occurring during jet-fire impingement on vessels containing LPG include: Heat transfer between the fire and outer surface of the vessel, in the vapour and liquid 'zones', by radiation and convection. Heat transfer through the vessel walls by conduction. The wall may comprise of an outer passive fire protection (PFP) coating plus the underlying steel wall. Heat transfer into the vessel fluids by predominantly radiation in the vapour space, and by natural convection or nucleate boiling in the liquid phase. Mass transfer from the bulk liquid or vapour to the outside environment through any holes in the vessel. Mass transfer out of the vessel through any open or partially open pressure relief valves (PRVs). Mass transfer within the liquid phase by flow of heated fluid into a stratified 'hot' layer lying above the bulk liquid. The hot layer may or may not be stable. Mass transfer between the liquid and vapour phases by evaporation. Pressure, enthalpy and LPG composition changes (relative fiactions of propane and butane) in the fluids during each of the above processes. Catastrophic vessel failure resulting in a possible BLEVE. The heat transfer processes described above are shown schematically in Fig. 1.

1072

Fig. 1. Heat transfer processes involving the fire and the vessel.

3.

MODELS

Increasingly, computer models are being used to predict the behaviour of various systems, including the response of vessels subjected to fire. It is often the intention to use the results of these predictions as part of the safety assessment of installations and operating plants. However, in order to do so, it is important that the models used are modelling realistic physical processes, have appropriate boundary conditions, include all the necessary parameters that may influence the predictions, and, finally, that the models are validated. The use of models for assessing the response of vessels containing LPG when subjected to fire is considered below.

Features The following features should be considered when evaluating the available models of fire-engulfed pressure vessels: 3.1

0 0 0

0

fire scenarios modelled; range of vessel geometries; modelling of protective coatings and other means of fire protection; heat transfer to the vessel;

1073

0

heat transfer to the vessel contents; energy balance between liquid and vapour phases; modelling the pressure relief system; energy balance during relief operation; degree of physical realism; and efficiency and correctness of the mathematical solution procedures used.

These fit with the general features of model evaluation protocols as presented by the European Commission's Model Evaluation Group [7]. Table 1. Vessel thermal response models

MODEL

SOURCE

ENGULF [%I 11

AEA Technology plc.

PLGS [ 12-151

University of New Brunswick

Tsolakis (not the BLOWDOWN model) [I61

Imperial College of Science, Technology, and Medicine

HEATUP [31

Shell Research

DESCRIPTION The vessel is considered to have a vent, which may be either fully open or shut and expressions are given for the mass flux (considered gas only) through the vent, for choked and unchoked flow. The thermodynamics of the vessel are formulated on a pertime-step basis. Internal energy is lost from the system when the vessel vents (in proportion to the mass loss at a specific energy assumed to be that of an ideal gas at the vapour space temperature). The model recognises that there will be different sub-zones within the liquid space, which it splits into four regions: the bulk liquid at the bottom of the vessel in the centre; a stratified liquid layer above the bulk liquid and below the gas space; and two boiling regions down either side of the vessel. The vessel is considered to have a vent, which may be either fully open or shut. Swelling of liquid is included and may ultimately result in two-phase flow through the vent. The interface between the liquid and gas (described as a very thin layer) is considered to have its own temperature. There are thus three fluid zones in the vessel: the gas, the liquid, and the infinitesimallythin interface region. The vessel is considered to have a vent, which may be either fully open or shut. If the vent is above the liquid level, expressions are adopted for the mass flux (considered gas only) through the vent, for choked and unchoked flow. Vessel failure considerationsare beyond the scope of this model. The model recognises that there will be different sub-zones within the liquid space which is split as for PLGS. The vessel has a pressure relief valve, which may be either fully open or shut or, in one of the provided options, partly open. Expressions are given for the mass flux through the vent for liquid and vapour releases. Vapour releases are always assumed to be choked flow. Realistic conditions are applied for the boundary conditions and for the radiation and convective heat transfer..

1074

Thermal response models for Liquefied Petroleum Gas (LPG) vessels There are a number of computer models available for predicting the response of vessels fitted with pressure relief valves (PRVs) when subjected to fire. The models available and the main differences in physical representation are summarised in Table 1. 3.2

This paper is primarily concerned with application of the HEATUP code and this is described in more detail below. 4.

HEATUP

The methodology utilised in HEATUP to calculate the thermal response of the vessels is outlined below. The methods of heat transfer to and within the vessel are considered 4.1

Heat transfer through the vessel wall Heat transfer from the fire into the vessel is considered as follows:

External boundary condition Figure 2 shows the external boundary conditions connecting heat transfer between the fire and the outer wall of the vessel or coating. The equations describing the heat flow are given below.

4.1.1

The net absorbed heat flux by the outer wall in the liquid zone, (W mV2)is given by:

qabs-liq,

and the net absorbed heat flux by the outer wall in the vapour zone, (W m-2)is given by:

qabs-

where the forced convection heat transfer coefficient, hFC(W m-2 K-I), is given in terms of an average Nusselt number according to:

1075 OUTSIDE

2 LAYER VESSEL WALL

INSIDE

FIRE '2vap

VAPOUR

,\\\\\\\\\

..............

\ \ \ \ \

FIRE

\

LIQUID

Qin-/iq

QNC

or QMI

r21iq

1

2

Fig. 2. Schematic diagram showing the heat transfer through the wall. T represents a local temperature and Q represents total heat flow.

Here, < > denotes spatial averaging over the surface of the impinged target and the thermal conductivity of the 'fire' is taken as that of air at the mean film temperature, T, , given by:

for impinging fires.

1076

Internal boundary condition for the vessel wall in contact with the vapour space The internal boundary condition for the wall in contact with the vapour space is of the general form:

4.1.2

In the current version of the HEATUP code the natural convection term is omitted on the assumption that its contribution to the total heat transfer is small compared with the radiative term throughout most of the heating process. Inclusion of natural convection in future HEATUP code development would reduce the rate of temperature rise of the steel wall in the vapour space and increase the temperature rise of the vapour itself. For illustration, calculations of the heat fluxtransfer into the vapour space, based on correlations appropriate to natural convection between vapours and horizontal surfaces, (see Eq. (8) and discussion in section 4.1.3) are shown together with the calculated radiative heat flux transfer in Table 2. To maximise the natural convection heat flux transfer, the vapour properties used to calculate the natural convection term in this example are appropriate for propane at 60 "C and 21.2 bara. The emissivity of the steel is taken to be 0.8 in calculating the radiative heat transfer term. Internal boundary condition for the vessel wall in contact with the liquid space The variation in heat flux transferred to the liquid is described by the general 'boiling curve' as shown in Fig. 3. The dominant mode of heat transfer into the liquid space is initially by natural convection when there is a small temperature difference between the inner wall and bulk liquid. The heat transfer between the wall and liquid is however enhanced slightly through the turbulent effects of 'bubble stirring' [17]. As the difference in temperature between the wall and liquid increases, the liquid enters the nucleate boiling regime and, in theory, the heat transfer increases up to a local maximum at the so-called 'critical boiling' point. Beyond the critical boiling point, the net heat transfer to the liquid reduces again (transitional boiling) due to the insulating effects of the formation of a thin vapour film when the bubbles at the wall surface start to coagulate. As the temperature difference increases further still, the net heat flux transfer increases again due to the increasing dominance of radiative heat transfer across the vapour film gap. In practice, for a fire-engulfed LPG vessel it is unlikely that the critical boiling and film boiling regimes will ever be attained, even for the most severe fire conditions. This assumption is justified by the figures shown in

4.1.3

1077

Table 2.

A comparison of natural and radiative heat fluxes between carbon steel and propane vapour TzVap- Tvap

50 "C 100 "C 500 "C

Natural Convection Radiative Heat Flux Heat Flux (assuming E = 0.8 ) 0.2 kW m-' 1.O kW m-' 0.5 kW m-2 1.6 kW m-' 4.5 kW m-' 21.9 kW m-'

Table 3.

Critical Boiling Heat Flux for Propane and n-Butane

Temperature Vessel Pressure Critical Boiling Heat Flux

Propane 20 "C 8.4bara 612 k w m-2

Qcriacal

:onvection'

rransitiona Boiling

n-Butane 20 "C 2.1 bara 384 k w m-2

1 Film Boiling

Fig. 3. Schematic showing the variation in heat flux transferred to the liquid with the temperature difference between the inner wall and liquid.

1078

Table 3, which shows calculated [ 181 values of the heat flux required for critical boiling to occur. It can be seen that heat flux required for critical boiling is much greater than the heat flux obtained from even the most severe jet fire (See section 6.1.3). Thus, this analysis is limited to the natural convection and nucleate boiling regimes, which are used in the HEATUP code. Natural convection in the liquid In the natural convection regime the internal boundary condition for the wall in contact with the liquid space is given by: 4.1.4

where:

and the Nusselt number is chosen to be that pertinent to horizontal surfaces, as recommended by Jakob [3]: Nu, = 0.16(G~Pr)’/~

(8)

For vertical surfaces the Nusselt number is given by: Nu, =0.61(GrPr)’/4

(9)

where the Prandtl number (Pr) and Grashof number (Gr) are calculated for pure propane and butane liquid properties. Eq. (8) naturally gives more conservative (higher) values than Eq. (9) and is therefore considered more appropriate for partially filled LPG spheres and horizontal cylinders. Both Eq. (8) and Eq. (9) include the effects of bubble stirring, in that the respective coefficients, 0.16 and 0.61, are higher than those recommended for natural convection in vapours (which are 0.13 and 0.56, respectively). A full discussion can be found in reference [17]. Treating the wall as a horizontal surface has the additional advantage that the length scale, L, in Eq. (7) cancels and only the thermophysical properties of the wall and liquid are required. Eq. (8) has been implemented in the HEATUP code.

1079

4.1.5

Nucleate boiling There are numerous empirical correlations in the literature describing the heat transfer in the nucleate boiling regime for single component liquids [ 19-22]. These correlations vary considerably in predictions of heat flux values for a given temperature difference. Some of the differences can be attributed to surface roughness effects, because many of the experiments were undertaken under ideal laboratory conditions using apparatus designed with smooth surfaces. Also some correlations do not include the effects of pressure. One popular correlation [19] has the disadvantage that the final result is extremely sensitive to a generally unknown parameter whose value depends on the 'surface-liquid combination'. However, one correlation presented in reference [22] has the following advantages: There are no unknown parameters that have to be either pre-guessed or precalibrated. The hnctional form of the correlation is similar in construction to those widely accepted for natural convection and forced convection heat transfer. i.e. it has a Pr and an effective Re group. Pressure forces are included and treated in a physically realistic way. All parameters involved are readily calculated using the available thermodynamic computer packages and databases. In the nucleate boiling regime the internal boundary condition for the wall in contact with the liquid space, according to McNelly [22] is given by:

where the heat transfer coefficient is related to the Nusselt number according to:

The first term in brackets on the right hand side of Eq. (1 1) is simply the Prandtl number, the second term represents an equivalent 'Boiling Reynolds Number', the third term relates bubble to pressure forces, and the final term accounts for the change in volume. In the HEATUP code, Eq. (11) is simplified into an equivalent heat transfer coefficient and a temperature difference according to:

1080

where AT = TIvap-Tvap. For both the natural convection term, Eq. (7), and the nucleate boiling term, Eq. (12), solutions are evaluated for the pure components of the LPG liquid mixture (i.e. separately for propane and for butane) and then combined in a simple way according to:

where x is the mole fraction of propane.

4.1.6

Heat conduction through wall The mathematical formulation describing heat transfer through the vessel wall in the single layer (bare steel) case is simply:

where the absorbed heat fluxes from the fire are given by Equations (1) and (2) for the liquid and vapour zones, and the heat fluxes into the vapour and liquid, q,, ,are given by Eq. ( 5 ) in the vapour space and by Eq. (13) in the liquid space. For the double layer wall (Fig. 2) the heat conduction is obtained by discretising the transient heat conduction equation as follows: At boundary 0:

At boundary 1:

At boundary 2:

Solving Equations (15-17) for both the vapour and liquid wall zones gives the temperature distribution within the wall layers at each interface.

1081

Mass transfer out of the vessel

4.2

Holes Mass transfer of either vapour or liquid through holes in the vessel wall are treated as in the following.

4.2.1

For vapour/gaseous releases, the rate of mass transfer, mg,is given by: mi2

mg(sonic)= C, -

4

where C

y = 2 , C"

and for liquid releases the rate of mass transfer, ml,is given by: mi2 P-Po m, =cdP-[2(-J+gh] 4

x

In the HEATUP code, all vapour releases are assumed to be sonic, which is a realistic assumption for venting gas directly from the vessel (P 15-17 bara) to ambient air pressure. Currently the discharge coefficient is set to a value of 1.0 for vapour releases and the user is therefore advised to enter an 'equivalent' or 'effective' hole diameter. This treatment enables more convenient use of manufacturer's pressure relief valve (PRV) data. The discharge coefficient for all liquid releases is set to 0.61.

-

Mass transfer through pressure relief valves PRVs fitted to LPG spheres or cylinders have distinctive opening and closing characteristics as a function of vessel pressure. There are three PRV characteristics programmed into the HEATUP code corresponding to a 'square' , a 'triangular', and a 'trapezium' response. The trapezium characteristic is appropriate for a PRV fitted with a Calor Gas 535 Adaptor. 4.3

For all PRV characteristics, infullrepresents the mass flow rate of vapour or liquid through the fdly open PRV as calculated by Eq. (18) or Eq. (20), respectively.

1082

Square Characteristic

% Open

t

loo ---

-Trreseat

pset

Fig. 4. PRV with a square characteristic

4.3.1

Square characteristic A PRV with a square characteristic (Fig. 4) remains closed until the 'set pressure' is reached, then opens instantly to the 'full' open position. The PRV then remains fully open until the 'reseat pressure' is reached. The reseat pressure is less than the set pressure. The mathematical formulation is:

mpmv = mfull

4.3.2

for ( P 2 p,,,) for (p,,,, < P <

e8,) after being fully open.

(22)

Triangular characteristic A PRV with a triangular characteristic (Fig. 5 ) remains closed until the 'set pressure' is reached, then opens instantly to the 'full' open position. The PRV then remains fully open while the vessel pressure remains greater then the set pressure. If the pressure falls below the set pressure, then the PRV closes linearly with pressure and becomes fully closed at the 'reseat pressure'. The mathematical formulation is:

1083

for ( P P , , e m ) for (p,,,,, < P < eel) after being fully closed,

(23)

Trapezium characteristic (PRV with a Calor Gas 535 Adaptor) A PRV with a trapezium characteristic (Fig. 6) remains closed until the 'set pressure' is reached, then opens linearly with pressure until the 'full' open pressure is reached. The PRV then remains fully open until the 'reseat pressure' is reached at which point the PRV closes instantly. The reseat pressure is less than the set pressure, which is less than the fully open pressure. The mathematical formulation is: 4.3.3

mpow = m,rr

mpow

= m,o

for (p,,, < P < P,,,) after being fully closed,

(27)

for ( P 2 P,,,) for (p,,, < P < P,,,) after being fully open.

(28)

For the Calor 535 Adaptor and for all pressures expressed in bara: P,ull= 1.2(p,,,- 1) + 1

1084

Triangular Characteristic

% Open

A

--

Pset

Fig. 5. PRV with a triangular characteristic

Trapezium Characteristic

I

% Open

Fig. 6. PRV with a trapezium characteristic

P (bara)

1085

Fig. 7. Schematic of an LPG vessel showing the mass flow ofliquid into the hot layer.

4.4

Change in composition Mass transfer through holes or PRVs in the vessel wall alters the composition of the remaining propane and butane in the liquid and gashapour phases. The changes in the composition of the contents of the tank and the associated changes in enthalpy as the different components are differentially vented are calculated in the code.

Mass and heat transfer within the vessel Mass transfer in the LPG tank occurs within the liquid phase by virtue of mass flow of heated LPG liquid into a stratified hot layer, as depicted in Fig. 7. If the stratified hot layer is stable, then the liquid phase within the vessel splits into two zones. One zone, known as the 'hot liquid layer' lies on top of the other zone, known as the 'bulk liquid layer' as illustrated in Fig. 7. If the stratified layer is not stable due to the movement of hot fluid being too fast, then the program reverts back to there being only a single liquid zone. Heat transfer from the walls to the liquid, as described in previous sections, remains unaffected by the presence or not of a hot liquid layer, because the differences in the temperature gradient across the steel for the two layers is negligible. 4.5

1086

Mass and heat transfer within the liquid phase Calculation of the mass flow rate of heated liquid into a stable stratified hot layer follows the analysis of Yu et al. [23]. The HEATUP code builds on the analysis and assumes that the mass flow rate per unit length scale, mhot, is always turbulent in nature 4.6

4.7

Total heat energy transfer The total heat energy transfer (in J) into the vessel from the fire in a time step, A t , is given as:

for the hot liquid layer, bulk liquid layer and vapour layer, respectively. Here, q represents the heat flux (in W m-2) into the various fluid zones and A is the surface area of the vessel in contact with these fluid zones. The subscripts b, g and hot refer to the bulk liquid, the gas and the hot layer, respectively. The Ffire-hof, FJre-bulk, and Ffire-,.. are variables to represent the fraction of surface area affected by the incident heat flux from the fire, in each of the zones (hot liquid zone, bulk liquid zone and gadvapour zone, respectively). The use of F, represents a method of allowing the radiative energy emitted from the inner vessel wall to be re-distributed between the gashapour zone and the hot liquid zone according to the fraction of vessel surface area in contact with the gashapour. Thus F, and(1-F,) are analogous to radiation 'view factors' but are much more simple to evaluate. Mass and heat transfer between the liquid and gas phases Mass transfer between the liquid and gas phases takes place through evaporation or flashing of the liquid during heating. In HEATUP these processes are performed in a number of stages. The objective is to evaluate the thennophysical properties of the liquid and vapour phases and to find the new vessel pressure. There are two cases of interest, one case is when there is no hot layer in the liquid (single liquid layer) and the other is when there is a hot liquid layer above the bulk liquid layer (double liquid layer). In both cases the underlying equation of state to be satisfied in all fluid phases is: 4.8

H=U+PV

where changes in each time step obey:

(34)

1087

AH= AU+PAV+VAP

(35)

Here H is enthalpy, U is internal energy, P is pressure and V is volume. For the whole system, there is no volume change. Also, for the gas and liquid phases considered separately, the expansion work done through evaporation is negligible. Typically:

-PA' - 0.06 VAP Thus:

applies and forms the basis of all thermodynamic calculations. It is also assumed that negligible work is done by the system during operation of the PRV.

4.9

Vessel failure For design purposes, the yield stress point (which can often be approximated as the elastic limit point or the proportionality limit point, because these all lie in close proximity on the stress-strain diagram for low carbon steels) of the steel vessel wall represents the limit of steel strength in most applications. However, the vessel does not actually fail through rupture until the fracture stress or ultimate tensile strength (UTS) of the steel is reached [24]. In the HEATUP code, vessel failure for both a cylindrical vessel and a spherical vessel is treated simply by comparing the internal circumferential or 'hoop' stress (assumed to be most appropriate for a thin walled vessel) at each time step with the UTS of the steel. For a cylindrical vessel, the hoop stress, o ' h , is calculated using: rP Ax

d,(cylinder) = -

(3 8)

and for a spherical vessel: rP oh(cylinder) d h(sphere) = -= 2Ax 2 '

(39)

1088

where Y is the vessel radius, P is the pressure and Ax is the thickness of wall. = rP/2Ax for both the cylinder and sphere, cannot The longitudinal stress, dlOng exceed the hoop stress and therefore is not considered in HEATUP. In general the UTS can be derived from the known mechanical properties of the steel as a function of temperature. In the HEATUP code, the variation of UTS with temperature was derived by considering steel data curves found in Lees [24]. The derived form is: (MPu) = 560

C T ' ~

dun(MPu)= 1164.21- 1.4737Twa,

for TWa,/ 5 4OOOC for T,, >400°C

It should be noted here that there is no such thing as 'generic' steel data and that, in reality, the strength of the steel and other properties are highly dependent on the steel composition in addition to the temperature. This matter is discussed extensively in reference [25]. Measurements carried out on the remains of an LPG tank used in one of the HSE jet-fire impingement tests are described later and show values used in the HEATUP code are in reasonable agreement with the measured ones (see Fig. 12) 4.10 Miscellaneous features

4.10.1 Vessel coatings The HEATUP code is currently programmed to handle up to two material layers in the vessel wall, namely an optional outer material of Passive Fire Protection (PFP) layer and an inner wall of low carbon steel (See [3]). 4.10.2 RampedJives To accommodate fires which do not reach their maximum heat fluxes immediately (e.g. pool fires in which the fire takes time to spread and get established) there is an option in HEATUP to apply a time ramp to the fire radiation and kinetic fire temperature. 4.10.3 Partial impingement Values for the fraction of vessel surface area affected by the fire in each of the zones, Ffire-ho,,Ffire-bu,k,F/ire-gos are all currently set to a value of 1, corresponding to total engulfment by fire. However, these can be modified to account for non-engulfing fires (e.g. thermal radiation from neighbouring or remote fires) or for partially impinging fires (e.g. pool fires having a flame

1089

length less than the height of the vessel). Because the liquid fill level is always known at every time step, it is possible to track the wetted area inside the vessel relative to the area affected by fire on the outside of the vessel in each of the fluid zones. This allows re-evaluation of the FfireguihOne values at every time step.

Setup output files, read input da d set initial conditions (time, t=O)

update time

Calculate heat transfer between fire and vessel contents in liquid and vapour zones. Calculate wall temperatures

t Calculate mass transfer within liquid layers. Establish hot layer properties for vessel geometry

I

I

t Calculate mass transfer between liquid and vapour phases. Quantify final thermodynamic properties in each fluid zone

I

I

Test for vessel rupture

no rupture

Fig. 8. Flow Chart showing the structure of the main routines used in HEATUP

1090

4.10.4 BLE VE

The BLEVE event itself is not modelled in the HEATUP code, but the LPG fluid conditions at the point of vessel failure are available to provide input into a suitable BLEVE model [6]. The presence of a stable hot layer is expected to have a significant effect on the resulting BLEVE characteristics because the energy available to feed a BLEVE is not evenly distributed in the liquid [26]. That the bulk liquid layer, has a lower temperature than the liquid in the pressure-determining hot layer, means there is less total energy in the system than would be expected in the case of a single liquid layer in saturated equilibrium at the same pressure. The BLEVE scenario is therefore expected to be less severe during those events where the vessel ruptures while accommodating a stable hot layer. 5.

OPERATION OF THE HEATUP CODE

For illustrative purposes, the order in which the physical processes described above are handled in the software is shown on a flow chart in Fig. 8. The program follows the sequence shown in each time step. Calculations continue in the time loop until vessel rupture occurs. The variation of vessel and fluid properties (Pressure, liquid and vapour temperatures, wall temperatures and heat fluxes, liquid and vapour enthalpies, volume fill level, propanehutane mole fraction etc.) with time, are all written to appropriate text and graphic output files at every time step, including at the point of BLEVE when the final conditions of the LPG fluid are recorded. The output files fiom HEATUP are configured to be read directly by Excel spreadsheets for presentation purposes. 6.

EXPERIMENTAL TRIALS

Trials on 2-tonne, unprotected (i.e. no passive fire protection or water deluge system) LPG storage vessels were undertaken by the Health and Laboratory in Buxton, UK. In these tests, the vessels were taken to failure by exposure to a jet fire. The trials were designed to produce as much data as possible to provide information on the behaviour of vessels exposed to fire and were intended to identify:

- the pressure and temperature conditions at failure; - how the tank ruptured; and - the characteristics of the fireball from the released material. Four unprotected tanks, containing different quantities of propane (20%, 41%, 60% and 85% of the water capacity), were engulfed in a jet fire until they failed

1091

[2]. Normally the tanks were unrestrained but, because rocketing occurred in the 60% full tank trial, the 85% full tank was restrained. 6.1

Jet fire Details of the jet fire are given below.

6.1.1 Supply system andjet conditions The jet fire scenario considered was liquid discharge through a hole in a punctured adjacent tank or damaged pipework. A series of preliminary experiments [2] were performed to determine the conditions which gave a stable, engulfing jet fire of a size representative of a credible incident scenario. The jet-fire size and location was chosen so that the target tanks were at least three quarters engulfed in fire and the effects of wind were minimised. The jet fire consisted of ignited, flashing, liquid propane at a flow rate of about 1.5 kg s-' from a nozzle equivalent to a 12.7 mm diameter hole. The target tanks were placed at a position close to the still-air lift-off position of the flames. The resulting flames were approximately 12 m in length and had a width of 3-4 m at a distance of 4 m from the nozzle. The temperature of the flames is discussed below. The supply system was designed to be operated from a distance with adequate failhafe features. 6.1.2 Flame temperatures The flame temperatures were measured around the tanks by shielded thermocouples standing approximately 2 cm proud of the tank surface and located on the central circumference. There was considerable variation in the temperatures measured in each trial and in the position of maximum temperature. However, the general indication was that the flame temperatures were in the range 700 to 1020 O C in each trial, compared to 800 to 1050 O C when measured for the free jet. The temperatures recorded are likely to be lower than the general flame temperature because: - they were not measured at positions where the shell temperatures rose fastest: and, - they were measured at positions close to the tank surface where the combustion gases may be cooled by the tank.

The position of maximum temperature appeared to be a function of wind speed and direction, the propane mass flow rate and of how the jet interacted with the tank. The visual records from the trials indicate that at least three quarters of the tank surface was enveloped in flame in each trial.

1092

6.1.3 Heatfluxes An approximate measure of the incident heat flux from the fire was obtained [2] by using pipe calorimeters fixed to a 2.8 m long, 1.24 m diameter steel pipe placed in the same position as the target tanks. Four calorimeters were used. These ran the full length of the target and were spaced at 900 intervals around the circumference of the target. Water was pumped throu h the calorimeters and the temperature rise measured. The heat flux, Q (kW m - ), was calculated using the expression:

B

Q

=

where

( d d d t . cWafe,. . AT) I ( E . A ) dmldt = cwaf,, = AT = A = &

=

(42)

Water mass flow rate (kg s-I) Specific heat of water (4.1 80 kJ kg-' K-') Water temperature rise (K) Surface area exposed to flame (0.165 m2) Absorptivity of copper surface (1 .O uncorrected)

The heat fluxes for a 1.7 kg s-' Fropane jet were measured. The highest mean heat flux density was 200 kW m- and the average, over the four positions, was 179 kW m-2. If the heat flux density is taken to be the surface emissive power (E, kW m-') then, using the Stefan-Boltzman relationship:

where

&

=

CJ

=

TJ;,, T,,

=

=

emissivity (1 for a black body); Stefan-Boltzmann constant (56.7 x 10-l2kWm-2K-4); radiation temperature of the flame (K); and ambient temperature (ca. 293 K).

These heat fluxes correspond to black body radiation temperatures of 1371 K (1097 OC) and 1334 K (1061 OC), respectively. These are slightly higher than the temperatures measured by the thermocouples. 6.2

Target tanks The target tanks used were standard two tonne tanks with length 4.0 m and diameter 1.2 m. They were bullet shaped, had torispherical ends and were constructed of 6.7-7.1 mm thick, low carbon steel. Each tank was mounted on a steel frame, supported by load cells, so that the mass could be recorded, and was located in a trench mounded on three sides for safety reasons.

1093

Each tank was fitted with a pressure relief valve (PRV), which was set to relieve at 17.24 barg and was protected by thermal insulation during the trials. The tanks were instrumented with thermocouples in the liquid and vapour space. Thermocouples were also mounted on the outside of the shell and protected from direct flame impingement by 3 mm plates. Pressure transducers were fitted to take-offs from the liquid and vapour space.

6.3

Thermal radiation In addition to the parameters identified above, measurements were also made of the thermal radiation produced from the fireball generated by the BLEVE. The results of these measurements are reported elsewhere [27].

6.4

General observations In each trial, the propane vapour released was immediately ignited by a pilot light when ejected from the nozzle. It burnt with a bright yellow flame, which became slightly darker as the proportion of liquid ejected increased. This gave a flame (Fig. 9) which almost enveloped the target tank but, occasionally, the left side (in relation to the jet) of the tank could be seen, indicating that the flames were slightly skewed to the right. After 1 to 2 minutes, the PRV opened giving a jet of flame. All the tanks failed catastrophically within about 3 minutes of the PRV opening, giving a large fireball. On failure, three tanks split longitudinally and opened out flat and one, after initially splitting longitudinally, split circumferentially and rocketed.

Fig. 9. Typical jet fire engulfing the target tank.

1094

Fig. 10. Measured vessel pressures in HSL trials

6.5

Unprotected tank pressures In three of the four trials, the PRV opened and stayed open until the tank failed. For the 85% full tank, the PRV opened and shut twice before remaining open until tank failure. The times taken for the PRV to open and the time to BLEVE are shown below in Table 5 and the vapour pressure plots are illustrated in Fig. 10. Only vapour pressures are given as there was very little difference between the vapour and liquid pressures. When the PRVs opened, the escaping propane immediately ignited giving a flare 7 to 15 m in height. The average discharge rates were in the range 1.0 to 2.2 kg s-'. 6.6

Unprotected tank shell temperatures There was considerable variation in the tank wall temperatures depending on whether the wall was in contact with liquid propane or not. In every trial, the wall temperature just above the liquid level was much higher than that just below the liquid level suggesting that there was relatively little level swell, with consequent cooling of the wetted wall. The temperatures at the back were lower than those at the front, except for the 60% full tank trial, which was the only trial in which the wind was in the same direction as the jet. In all cases, the wall in contact with the vapour space reached the highest temperatures. Figure 11 shows plots of the average wall temperatures measured for each of the trials up until the point of failure.

1095

Fig. 11. Vapour wall temperatures from HSL trials.

Conditions within the liquid volume As there was no personnel access to the tank interior, the temperatures within the liquid volume could only be measured using a single vertical thermocouple array near the PRV. All the tests indicated that there was some vertical temperature stratificationbefore the PRV opened, with the liquid coolest at the bottom and hottest at the top, due to buoyancy effects because the density of liquid propane decreases with temperature. The temperatures measured suggested that there was relatively little level swell or frothing on heating. Most stratification occurred in the 85% full tank. This was evident from the temperatures measured in the liquid layer for each of the trials. The degree of stratification reduced considerably once the PRV opened, indicating that bulk mixing is improved andor more latent heat of vaporisation is proportionately taken from the upper, hotter layers. The liquid temperature at the failure pressure of 25.43 bara, predicted using the Antoine equation:

6.7

Ln [P(bara)]

=

9.9945 - {2338.78/[T(K)+5.67]}

(44)

is 66.5 O C compared to the 80 - 86 O C range measured. The actual temperatures measured should be treated with caution as measurements in what is nominally liquid could be affected by the presence of superheated vapour bubbles, because the thermocouples themselves can act as

1096

nucleation sites. However, the data suggest that the liquid was at, or above, the superheat limit temperature (the maximum temperature for a given pressure to which the liquid can be heated without boiling. In the case of propane at 18.3 bar, this is 53 "C) at the time of tank failure. The liquid could therefore flash to vapour very rapidly. There were no signs, e.g. burning liquid on the ground, of liquid rain-out in any of the trials.

Conditions within the vapour space The vapour space temperatures increased rapidly on fire-engulfment, with the vapour being superheated by the hot tank walls. Vertical temperature stratification in the vapour space was more pronounced than in the liquid, with the temperatures near the top of the tanks rising fastest. There was a considerable drop in vapour temperature once the PRV opened, reflecting the heat loss from the system through vapour discharge. However, there was still a considerable degree of stratification. This indicated poor vapour space mixing and the absence of any significant flashing or frothing of the whole tank contents. Using Eq. (44) at the failure pressure of 17.53 bara, the equilibrium vapour temperature is calculated as 48.5 OC compared with the 54 - 122 OC range measured. 6.8

Metal strength Measurements of the strength of the metal at different temperatures were made on the tanks from the HSL trials. Samples were taken from the bottom of the tank used in the 60% fill trial. At this location on the tank, it is known that the temperature of the steel had not exceeded 300°C during the test. A set of 0.2% proof stress and ultimate tensile stress measurements from ambient to 900°C were obtained. Checks were made at 500°C and 700°C on steel taken from similar locations on the other three tanks and were shown not to vary significantly. The results for the 60% tank steel are shown in Fig. 12. It is clear that above 300°C the strength of the steel decreases significantly with increasing temperature. 6.9

7. 7.1

COMPARISON OF THE HEATUP CODE PREDICTIONS

Background information Assessment of the predictions from the HEATUP code was performed by direct comparison of model predictions with the experimental data. The fire loading conditions used in HEATUP to evaluate the heat flux absorbed by the outer wall surface of the vessel (for use with Eq. (42) and Eq. (43)) were identically defined in all four test simulations. The jet-fire conditions,judged to

1097 700 600

,

1

,

1

,

1

,

1

,

1

,

1

400

,

1

,

1

,

-0-

m

,

-+-

a

,

0.2% proof stress

Ultimate tensile stress

-

-

*

200

-

-

100

-

-

0

100

200

300

400

500

600

700

TEMPERATURE (Celsius)

800

900

1000

Fig. 12. 0.2% proof stress and ultimate tensile stress for 60% tank steel

be representative of the time averaged experimental jet-fire conditions, were modelled as: grad

=

z

=

Tfire ufire

=

Tu

=

=

120 kW m-2 0s 1100 "C 25 m s-1 0.1

Where grad is the thermal radiation heat flux, z is the ramp time constant, Tfireis the flame temperature, ufireis the flame velocity, and Tu is the turbulent intensity. For the steel wall, the most important parameter for evaluating the fire-wall boundary condition is the emissivity of the steel surface. The emissivity values for each material surface are pre-defined within HEATUP. For bare steel, the value depends on whether or not the surface is impinged by fire. For the interior steel surface, denoted by subscript 2 on material b in Fig. 2., the steel emissivity is fixed at E, = 0.8. This value also holds for exterior steel surfaces not impinged by fire. However, for the exterior steel surface impinged by fire, and in the absence of protective coatings, the steel emissivity is set to

1098

0.65 following an analysis of measured values for a carbon steel pipe impinged by a jet fire by Persaud et al. [28]. so =

HEATUP model predictions The fire loading, vessel geometry and ambient environmental conditions define the scenario and provide all the necessary input data for HEATUP. The individual input conditions used for each of the four tests, corresponding to the 20%, 41%, 60% and 85% fill levels were selected based on the HSL trials data. In each case the variation with time of the tank pressure, fluid temperature, wall temperature, liquid volume fill level and fluid mass remaining in each zone were calculated up to the point of vessel failure. Other data, such as fluid enthalpy in each zone and heat fluxes at each wall layer boundary, were available in the output files of HEATUP.

7.2

7.3

Discussion of the results HEATUP predictions of all physical properties for each test show good agreement with the experimental data. HEATUP predictions for the high liquid fill level are particularly interesting because the results show the effect of having a hot liquid layer on the edge of stability. Sometimes the hot layer is stable, giving a double layer liquid (hot liquid layer on top of the bulk liquid layer), and at other times it is unstable and therefore assumed to be totally mixed with the bulk liquid to form a single layer liquid. It should be noted that when no hot layer is predicted, the properties of the hot layer such as temperature and mass default to a zero value. Since the pressure in the vessel responds predominantly to the top surface liquid properties the presence of a hot layer results in a higher calculated pressure than when there is only a single liquid layer. Both values for pressure are physically realistic, but the 'real' one depends on the hot layer stability. When the hot layer is intermittently stable, it is reasonable to assume that on average it is actually well mixed with the underlying bulk liquid and the corresponding curves for the single liquid layer case are more appropriate to real situation, as confirmed by the experimental data.

The following sections detail general observations from considering the predicted values for each parameter in all the tests. 7.3.1 Pressure Generally all predictions of pressure with time are in good agreement with the test data up to the point of the PRV opening (see Fig. 13.). After initial PRV operation the predicted pressure is slightly high and HEATUP does not capture the pressure dropout and recovery well when using the trapezium PRV characteristic. The discrepancy is most likely to be due the unpredictability of

1099

the PRV characteristic under conditions of high thermal loading. In fact, in the trials, there was evidence that some PRV seals had melted leading to slight sticking of the valves. 7.3.2 Fluid temperatures Values predicted for the liquid phase temperature are in good agreement with the measured values. Vapour temperatures are also generally well predicted, but model predictions are systematically lower than temperatures indicated by thermocouple data. This could be attributable to a number of reasons, for instance neglecting the natural convection term in Eq. (15) or allowing too much heat to be radiated through the vapour space into the liquid. However, the latter would also result in an overprediction of liquid temperatures, but this is not observed. Another plausible explanation follows from the use of thermocouples in the tests, which show clearly that those in the vapour space generally measured higher temperatures than the thermocouples in the liquid space, before PRV opening. This is partly due to the thermocouples being in direct physical contact with the superheated LPG vapour (which may be temperature stratified), and partly due to them receiving thermal radiation directly from the hot vessel walls. No attempt has been made to decouple these contributions from the thermocouple measurements, but it should be expected that the contribution arising from wall surface thermal emissions is likely to be most significant for thermocouples located near the top of the vessel where the optical path lengths are shorter. 7.3.3 Wall temperatures Generally HEATUP predictions of wall temperatures in both the liquid and vapour zones are good given the high degree of spatial inhomogeneity in the measured temperature distribution over the vessel surface. The fire-vessel wall boundary conditions used in HEATUP were designed to be realistic but slightly conservative, hence higher average wall temperatures were expected from the model when compared with experimental values. In reality, the vapour wall temperatures measured in the HSL trials are very close, albeit slightly higher, than those predicted. The measured and predicted vapour wall temperatures are shown in Fig. 14. The wall temperatures shown in Fig. 14 are representative of the wall temperatures measured on a majority of the parts of the wall in contact with vapour. They are not maximum vapour wall temperatures, which can occur due to localised hot-spots.

1100

Fig. 13 Prediction of vessel pressures produced from HEATUP

Fig. 14. Measured vapour wall temperatures and HEATUP prediction

1101

7.3.4 Liquid volumefill level and fluid mass The mass remaining in the vessel at the time of BLEVE was measured in the trials using the load cells under the vessel. Using this information it is possible to determine the mass of propane vented from the vessel. The values measured are shown in Table 4. The HEATUP code predicts the fill level in the vessel during the time exposed to fire. The accuracy of the model predictions depends on knowledge of the effective diameter of the PRV used to calculate mass loss from the system. In reality, the effective diameter may be somewhat different from the one used in the model. The details of the PRV were derived fiom information supplied from the manufacturer. Also, the effects of heating from the fire may cause substantial deviation from the recommended PRV opening/closing characteristic used. It is possible for the PRV to stick open, partially open or even closed depending on the degree of fire damage. These effects, if present, were not considered in the modelling since they are unpredictable. The masses vented from the vessel are shown in Table 4. It can be seen fiom the table that the predicted mass vented from the vessel is greater than the mass vented in the trials in the time leading up to the BLEVE. However, only in the case of the 60 % fill is the predicted time to BLEVE close to the experimental BLEVE time. In this case, the predicted mass of vented gas is twice that observed in practice. In the other examples the model predicted failure at least 29 seconds early. Increasing the time to vent in the model would also increase the predicted mass of gas vented. It would appear from these results that the model significantly over-estimates the rate of venting from the PRV. There is a much closer correlation with the actual masses remaining in the vessels at the point of BLEVE. The values here are very close to those predicted. The slight differences in the initial masses are due to the "%Fill" in the experimental trials being based on the percentage of the total water capacity of the vessel, compared to it being the percentage of the calculated total vessel volume used in the HEATUP model. Although not reproduced in this paper, the HEATUP data also show clearly the rise in liquid level due to thermal expansion of the liquid before initial PRV opening. This result suggests the possibility of hydraulic vessel failure if the tank is originally over filled and the PRV is incorrectly sized or fails.

1102

Table 4. Masses vented from the vessel at the time of BLEVE Initial Fill

HSL Start Mass at Mass BLEVE

HEATUP Mass at Mass BLEVE

HSL

455 929 1364 1932

450 950 1400 2000

176 219 92 224

20 41 60 85

279 710 1272 1708

Start

315 690 1200 1700

Mass Lost

Difference in time to HEATUP BLEVE (Model - Expt) 185 -29 310 -44 220 4 300 -29

7.3.5

Time to initial PRVopening and time to B L E m The ability to predict the temperature and mass of liquid remaining in the vessel at the point of failure is important as these parameters determine the total energy available to feed a BLEVE event. It is therefore essential to predict the time taken until the PRV initially opens to release fluid, and the time taken to vessel rupture. (All curves shown for HEATUP predictions in Figs 13 and 14 terminate at the point of vessel failure.) HEATUP predictions of time to PRV opening and time to vessel failure are compared with experimental values in Table 5. It can be seen from Table 5 that the built-in conservatism into HEATUP generally results in a slight underestimation of the time taken from initial fire exposure to initial PRV opening and the time to vessel failure. Given the uncertainties in evaluating all the contributing physical processes involved, it can be concluded that these times are well predicted. Overall HEATUP compares extremely favourably with experimental test data. Table 5.

Comparison of experimental and predicted time to initial PRV opening and time to vessel failure Test Initial Fill 20% 41% 60% 85%

Time to Initial PRV Opening (s) Experiment HEATUP Difference (Model-Expt) 112 114 2 130 108 -22 109 90 -19 68 70 2

Time to Vessel Failure [BLEVE] (s) Experiment HEATUP Difference (Model-Expt) 250 22 1 -29 222 -44 286 22 1 4 217 225 -29 254

1103

8.

CONCLUSIONS

From the work undertaken in this paper the following conclusions are drawn: The Fortran-based HEATUP model is capable of predicting the thermal response of an LPG vessel and its contents during fire attack. The fire in question can be a jet fire or pool fire, impinging or just radiating onto the vessel surface. The vessel geometry can be either a horizontal cylinder or sphere of any realistic size and may be coated with a single layer of protective material. 0 HEATUP predictions have been compared with data from LPG tank BLEVE experiments carried out by the UK Health and Safety Executive (HSE). HEATUP predictions were found to be in good agreement with the experimental data obtained. 0 The comparisons of the model predictions with experimental data are limited in this work to LPG-filled tanks only and to tanks of one size and jet-fire impingement. 0 The model predicts important input parameters, which may be used in the input to BLEVE, risk assessment models. 0 The general application of such models to predict the response of vessels exposed to fire should be undertaken with care. It is important that the models have been shown to give good prediction for conditions similar to those been modelled in order to have greater confidence in the results. This may require validation of the model with a greater range of experimental data. The results of an initial study to compare HEATUP predictions with pool fire impingement scenarios have been previously incorporated in work presented in reference [25]. These results show reasonable agreement between HEATUP predictions and available test data.

1104

9.

NOMENCLATURE

Symbol T

Q

4

Ax

0, 1, 2 E (T

0’

h h’ hf‘ k

D

Nu Re Pr U

P

P

c Tu d Gr AT

P

X

g

At

m

Units K J W m-2 m NIA dimensionless J s-1 m-2 K4 Pa W m-2 K-1 m J kg-1

Description Temperature Energy Heat Flux Thickness of wall or of wall layer Position marker for boundarylinterface in wall Emissivity or absorptivity Stefan-Boltzmann constant (5.67 x 10-8) or Mechanical stress Heat transfer coefficient Height above base of vessel Heat of formation of gas

W m-1 K-1 m dimensionless dimensionless dimensionless m s-1 kg m-1 s-1 kg m-3 J kg-1 K-1 dimensionless m dimensionless K Pa dimensionless m 5-2

Thermal conductivity Diameter of vessel Nusselt number Reynolds number Prandtl number Velocity Dynamic viscosity Density Specific heat capacity Turbulent intensity Diameter of PRV or hole Grashof number Temperature difference Pressure Mole fraction of propane Acceleration due to gravity Time step Mass flow rate Discharge coefficient

S

cd

Kg s-l dimensionless

I V A F U

dimensionless m3 m2 dimensionless J

M

Pa

AU

J

Ratio of specific heats = c p / c , Volume Area Fraction of total or fluid zone vessel area Internal energy Change in internal energy Change in pressure

1105

2

S

E

KWm-2

Subscript atm a b VaP liq, 1 abs rad FC ref emit fire 0, 1, 2 NC boil, nucleate-boil in abs-liq abs-vap

rn wall P V

e27-h propane butane eff flow full set reseat ingas inliq, fire-hot fire-bulk fire-gas fire-fluidzone

UTS

Ramp time constant surface emissive power

Description Property of ambient atmosphere Property of outer material in vessel wall (PFP) Property of inner material in vessel wall (steel) Property of or associated with vapour/gas space Property of or associated with liquid space Absorbed by outer wall Thermal radiation Forced convection Reflected radiation Emitted radiation Property of fire Position marker for a boundary in wall layer ( Fig. 1) Natural convection Nucleate boiling Flow into a fluid zone Property absorbed by liquid Property absorbed by vapour/gas zone Mean value Property of wall Evaluated at constant pressure Evaluated at constant volume Effective property of liquid mixture Property of pure propane component in LPG Property of pure butane component in LPG Effective value Flow through PRV Flow through PRV when fully (1 00%) open Quantity at PRV set pressure (for initial opening) Quantity at PRV reseat pressure Associated with flow into vapour/gas space Associated with flow into total liquid layer Property of fire overlap with hot liquid layer Property of fire overlap with bulk liquid layer Property of fire overlap with vapour/gas layer Property of fire overlap with a fluid (gas, hot liquid, bulk liquid or total liquid) zone Ultimate Tensile Strength

1106

REFERENCES 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28.

T.A. Roberts, S Medonos and L.C. Shirvill, HSE Offshore Safety Report, OTO 2000 051 (2000). N.J. Duijm, Hazard consequences of Jet-Fire Interactions with Vessels containing pressurised liquids - JIVE Final report, TNO report R95-002, 1995 M.A. Persaud, Shell-Research Limited, Internal Report, (1994). C.M. Pietersen, J. Hazard. Mater., 20 (1988) 85. W. D. Cullen, Public Enquiry into the Piper Alpha Disaster, HMSO, London, UK 1990 S.R. Shield, AIChE Symposium Series 295, 89 (1993). EC Model Evaluation Group, Model Evaluation Protocol, EC DGXII, 1994. D L M Hunt and P K Ramskill, IChemE Symposium, The Assessment and Control of Major Hazards, UMIST, April 1985. D L M Hunt and P K Ramskill, UKAEA Report SRD/HSE R354 (1987). P K Ramskill, UKAEA Report SRD/HSE R414 (1987). P K Ramskill, J. Hazard. Mater., 20 (1988) 177. N U Aydemir, V K Magapu, A C M Sousa, and J E S Venart, J. Hazard. Mater., 20 (1988) 239. J E S Venart, U K Sumathipala, F R Steward, and A C M Sousa, Plantloperations Progress, 7(1988) 139. J E S Venart, K Sumathipala, G V Hadjisophocleous, and A C M Sousa, 6" Int. Symp. Loss Prevention in the Process Industries, Vo13 (1989). G V Hadjisophocleous, A C M Sousa, and J E S Venart, Int J. Numer. Methods Eng., 30 (1990) 629. T Tsolakis, S M Richardson, & G Saville, HSE Fire Loading: Thermal Response of Process Vessels in the Presence of Fire Loading, Imperial College, 1995. M. Jakob, Heat Transfer, Vol. 1, Wiley, (1967). F.P. Incropera and D.P. DeWitt, Fundamentals of Heat Transfer, J. Wiley & Sons, (1981). W.M. Rohsenow, Trans. ASME, 74 (1952) 969. C.T. Sciance, C.P. Clover, C.M. Sliepcevich, Fundamental Research on Heat and Mass Transfer, Chemical Engineering Progress Symposium Series, p 109-114. R.H. Perry, D.W. Green, Perry's Chemical Engineers' Handbook, McGraw-Hill, 6th Ed., (1984). M.J. McNelly, Journal - Imperial College Chemical Engineering Society, 7 (1953) 18. C.M. Yu,N.U. Aydemir, J.E.S. Venart, J. Therm. Sci., l(1992) 114. F.P. Lees, Loss Prevention in the Process Industries, Vol l., 2nd Edition, Chapter 12, Butterworth-Heinemann, (1996). D. Agoropoulos, L.C. Shirvill, Shell-Research Limited, Internal Publication (1996). A.M. Birk, M.H. Cunningham, J. Hazard. Mater., 48 (1996) 219. T. Roberts, A. Gosse and S. Hawksworth., Trans Inst. Chem. Eng., 78 B (2000) 184. M.A. Persaud, L.C. Shirvill, A. Gosse, J.A. Evans, Proceedings of Eurotherm Seminar No. 37 - Heat Transfer in Radiating and Combusting Systems 2, , EUROTHERM, (1994) 221.

1107

Developments in the Congestion Assessment Method for the prediction of vapour-cloud explosions J.S. Puttock HSE Consultancy, Shell Global Solutions, Cheshire Innovation Park, P.O. Box 1, Chester, CH1 3SH, England

1. INTRODUCTION The implementation of the Seveso 2 directive in Europe has emphasised the need for simple methods to predict the possible consequences of a gas explosion in industrial plant. Historically, the first approach used for such predictions was the analogy with high explosives, i.e. TNT. However, it has been well known for over a decade that the pressure decay from a detonation is markedly different from that produced by a vapour-cloud explosion (deflagration). Because the rate of pressure decay is different, the TNT equivalence method can be simultaneously be conservative at some distances and underpredict at others. Since there are other simple methods widely available, there is now no reason to use TNT equivalence. Other simple methods include the TNO multi-energy method [ 11 [2] and the Baker method [3]. Cates [4]was the first to give a clear method for deriving the source overpressure from the plant layout and fuel type. This method, named the Congestion Assessment Method (CAM), was updated by Puttock [5] with new pressure decay curves which were calculated on the basis of a realistic explosion source. More recent changes have resulted in a new version, referred to as CAM 2, which is included in version 3 of the Shell FRED suite of hazards models*. This paper describes the formulation of CAM 2. 1.1. The generation of overpressure in a gas explosion All the modern approaches recognise that high overpressures are not generated by combustion of gas clouds in an open environment. In the absence of turbulence, the (laminar) burning velocity of a hydrocarbon flame is quite * www.ShellFRED.com

1108

low, around 0.5 m/s. As the flame ball grows this velocity can increase owing to instabilities, but only by a factor of two to three. However, the expansion pushes gas ahead of the flame. If the resulting flow passes obstacles (e.g. vessels, pipework), turbulence will be generated. The flame speed in a turbulent flow is much greater than the laminar flame speed, principally because the turbulence wrinkles the flame, creating a much greater area for reaction. Therefore, when the flame reaches the turbulent region downstream of the obstacles, it bums faster. This faster burning in turn creates faster flow and so a higher level of turbulence downstream of the next group of obstacles. The more intense turbulence results in even faster burning, and so on. This process is known as the Shchelkin mechanism. In the absence of confinement, which can produce high overpressure owing to the expansion of the gas as it burns, it is therefore the obstacles which determine the strength of a vapour-cloud explosion. Typical industrial plant has areas with very little obstruction and other regions with significant congestion, e.g. vessels and pipework. Understanding of the physical mechanisms indicates what parameters are important in vapour-cloud explosions. This can guide the development of suitable correlations to relate features of the plant to possible explosion overpressures. 1.2. Components of a simple method Any method of the simple type described above has three components, which provide methods to predict: a) The source overpressure, i.e. the pressure generated in the area where high flame speeds are produced; b) The source volume, i.e. the volume occupied by the high-pressure source; c) A pressure decay law, which determines the pressure at a distance from the explosion; this is scaled by the source pressure and radius. This paper is mainly concerned with the source overpressure. The other two parts of the CAM method have not changed significantly since the publication of Ref. [5]and are summarised in Section 4.1 and the Appendix.

2.THE FIRST STAGE: PREDICTIONS FOR REGULAR AND SYMMETRICAL CONGESTION As a first stage in developing a predictive method, a correlation is to be derived for the peak overpressure generated in a symmetrical unconfined, congested region consisting of regular arrays of uniform cylinders. To define "symmetrical", assume that ignition occurs in the centre of the congested region, but on the ground if the congestion is placed on a ground plane. Then,

1109

in burning towards the outside in the north, south, east, west or upwards directions, the flame should pass the same amount of congestion, i.e. the same number of rows of obstacles of the same blockage. Explosions in regions which are not symmetrical will be considered later.

2.1. Data from experiments Experimental data are needed to develop a suitable correlation. Experiments which meet the criterion of symmetry are listed in Table 1. First are the MERGE experiments [6]. Here the congestion comprised a mesh of cylinders oriented in all three co-ordinate directions and intersecting. The congested region was a half-cube on the ground; the horizontal dimensions were 2m for the small scale experiments performed by TNO and 4.5m and 9m for the medium- and large-scale experiments performed by BG Technology. The gases used are listed in the Table. In the small-scale series, the experiments with the lowest blockage gave low overpressures and low flow velocities; this, combined with the small obstacle diameter would result in a low Reynolds’ number of the flow past the obstacles. These tests may well have been significantly influenced by viscous effects, and so have been omitted from the data set. The remaining experiments in this table are those performed at our Buxton test site, and described by Snowdon et al. [7]. These used uniform rows of Table 1 Experiments with symmetrical congestion, not enclosed Experiment

MERGE

Shell

Number of obstacle rows, counting from centre

Average area blockage per row, %

Small

6-10

Medium Large

so1 so2 SO3 SO4 SO6

Fuels:

Obstacle diameter

Fuel

mm

Pitch to diameter Ratio

Comment

38

19

5

5-15

38-52

41-86

3-5

5-10 3-6 3-7 4 3-4 4-6

38-39 18-44 19-26 27 27-32 27

86-168 27 27 27 49 27

5 6-11 6-17 6 3-6 6

M,MP,P,E,Mo, MooPo,Poo M,MP,P,E, MoPo M, MP, P M, P, E P,E M, p M, P, E M, p, E Stoichiometry variations

-

M methane, P propane, MP methane/propane (ratio 3:1), E ethylene (ethen subscript 0 and 00:oxygen enriched, 0 2 concentration before fuel addition 22.3 ,-, 24% respectively

1110

parallel cylinders. Parameters varied included area blockage, pitch (distance between row centres), obstacle diameter, fuel and stoichiometry. Two other sets of experiments were considered but not used because of the lack of symmetry, as defined above. The explosions with a three metre 3D corner of Hjertager [S]. Van Wingerden [9] used horizontal rows of parallel cylinders oriented in alternating directions. Thus vertically the flame had to pass through every row, but horizontally it would just be travelling along the length of half of the cylinders. Equally, the experiments reported by Harrison and Eyre[lO,ll] used vertical rows of horizontal cylinders. The spacing between the rows was such that considerably less blockage was provided to vertical flow than in the horizontal direction. The presence of a roof over the congested region alters the development of an explosion, and so a separate correlation is needed for this circumstance, and a different group of experiments. For these experiments, symmetry was only required in the horizontal directions. The experimental series used for this purpose are listed in Table 2. The DISCOE trials [12] used vertical cylinders arranged in semicircles. A rigid vertical wall was used so that the semicircular experiment simulated what would occur in a full circle. Area blockage and pitch were varied separately. Visser and be Bruijn [13] used rigid walls to simulate a fully circular arrangement by placing the obstacles in a 45" wedge-shaped region. In both series, area blockage, pitch and fuel were the main parameters varied. In the experiments with ethene where the reported overpressure exceeded 2 bar, the results may well have been affected by localised autoignition, and so these cases have not been used. Further experiments of this type were performed at our Buxton site [7]. The rig then had a solid roof one metre from the ground, and straight grids of vertical cylinders were used in a square arrangement. Table 2

Experiments with symmetricalcongestion and a roof. (See Table 1 for fuel key) Experiment

TNO Shell

DISCOE CECFLOW SO5 s10

Number of Average Obstacle Pitch to Fuel obstacle rows, area diameter diameter mm Ratio counting from blockage centre per row, 8

4-8 4-16 4-6 3-1

10-50 20-55 18-22 20-31

80 80 21 21

3-6 2-6 6-11 6-17

M,P,E M,P,E M,P M,P

1111

2.2. The basic correlation As already stated, the first stage is to develop a correlation for the overpressure produced by ignition on the ground in the centre of a gas-filled region of congestion comprising regular rows of cylinders; the region is of length and width 2L, and height L* , and the flame would pass through an equal number of similar grids to reach the open space in each direction. We would expect the overpressure to be dependent on the following: a) the fuel. Much higher overpressures are produced by a reactive fuel such as ethene (ethylene) than by methane, for example. b)the number of rows of obstacles in each direction, n (counting from the centre). c) the blockage of the rows of obstacles, as an area blockage ratio b. d)the obstacle diameter d . Since the remaining parameters are expressed as ratios, this determines the effect of overall scale on the overpressure, which is known to be important. e) the spacing between the rows of obstacles, expressed as a pitch-to-diameter ratio r p d . Each of these aspects is discussed in more detail below. 2. 2. 1. Fuel scaling The MERGE project included experiments at small, medium and large scale with a variety of fuels. Results were presented by Mercx et al. [14] who evaluated the results against several scaling theories. The results showed that the fractal scaling theory of Taylor and Hirst [15] predicted the effects of changing fuel very well. The fractal theory predicted that the overpressure should be proportional to (U,E)2.712,where UO is the laminar burning velocity, and E is the expansion ratio, i.e. the ratio of unburned to burned gas densities. If the expansion ratio were to drop towards one, then the burning would not be driving any flow ahead of the flame, and there would be no overpressure generated. Since one volume of gas is consumed as E volumes of products are generated, the rate of volume generation is proportional to ( E - 1). Thus it is more consistent to make the overpressure proportional to (u,(E - 1))2'71, which tends to zero as the expansion ratio tends to one 2. 2. 2. Number of rows and spacing of rows The overpressure is strongly dependent on the number of rows of obstacles passed by the flame. We take the overpressure to be proportional to nai . An * Since the ground can be regarded as a reflective surface, this is equivalent to central ignition in a cubical region (side 215)in free space.

1112

exponential dependence was also tried, but the power law was found to give a better fit. A power law is also used for the row spacing: rpda3. It should be noted that, for sufficiently large spacing between rows, there is a possibility of turbulence intensity, and hence flame speed, decaying before the next row is reached. However, it is very unusual to find plant with obstacles in well-defined rows and then a large gap, repeated several times. Thus ignoring this possibility is conservative, but would rarely apply. A separate issue is the question of when two regions of congested plant are sufficiently far apart that they can be considered as separate areas for the purposes of assessing explosion hazard. This deserves study but is not addressed in this paper.

2. 2. 3. Blockage ratio Two formulations were tried for the effect of blockage ratio. The first follows Phylactou [16], using exp(a,b). An alternative was tried which takes into account the extreme effects as the blockage ratio approaches one:

(

exp a 2 -

However, it was found that a better fit was obtained using the

former expression.

2. 2. 4. Size scaling If a gas explosion experiment is performed at two different scales with the same fuel, the overpressure generated at the larger scale is greater. The fractal scaling theory [ 151 predicts that the overpressure should be proportional to scale to the power of 0.71, but comparison with the MERGE results showed that this prediction does not fit observations as well as the prediction for fuel scaling. A more comprehensive compilation* of a variety of studies where experiments were repeated at more than one scale shows appreciable scatter, but concluded that the best estimate of a suitable exponent was 0.55. Therefore, we take the overpressure to be proportional to do 55. Putting these components together gives the expression to be fitted for the overpressure: P = a,(U,(E

-

1))2'71d 0.55nalexp(a2b)rpda3

where a. is a constant. (Note that a0 is not dimensionless; its value will depend on the units used.)

* J.S. Puttock , unpublished

1113

2.3. Severity index It would be possible to fit Equation I to the data, determining the constants uo to u3. Indeed, a good fit can be obtained in this way. However, there is no limit to the pressure predicted by Equation 1. With congestion much more severe than that in the experiments, for example higher blockage, more rows and larger scale, the expression might predict an overpressure of many bars. This is usually not realistic if we are trying to predict the typical pressure in the congested region. (Localised peak pressures are discussed later). As an example, suppose that we change from one hydrocarbon fuel to another which is more reactive, and that the second fuel generally gives overpressures double those obtained with the first. Then for an overpressure of 40 mbar with the first fuel, it would be correct to allow that the overpressure would be 80 mbar with the second. But if the overpressure with the first were 4 bar, the change to the second fuel could not produce a (mean) overpressure of 8 bar. A hydrocarbon fuel reaches an overpressure of about 8 bar when burned at constant volume, i.e. with no flow at all. Thus, in an explosion, if the gas were being compressed to nearly 8 bar as it burned, there would be no flow, and therefore no turbulence to create the high overpressure! In this range there is a negative feedback effect which reduces the flow and limits the increase of pressure. 4 bar would probably be increased to between 5 and 6 bar by a change which would double the result at low pressures. The converse of this is that (proportionate) reductions in overpressure are also smaller in the high-pressure range. Examples are the effects of changing stoichiometry or ignition location from their worst-case values. In order to allow easy application of correction factors or error bounds to explosion model predictions for vented explosions, we have in the past used a "severity index", S. S is directly related to the overpressure P . It is defined to be equal to overpressure, in bars, at low overpressure, but to increase by the same ratio for a similar perturbation (say, a change of fuel), whether at low or high overpressure. Consequently S eventually increases very much faster than P . Such an approach, with a suitable expression for S, can be used here for explosions in open, congested areas. The relationship between S and P for open, congested plant was calculated by performing runs of the SCOPE 3 phenomenological model [ 171 for a variety of input conditions, from lightly to heavily congested. SCOPE 3 explicitly calculates the flow ahead of the flame and the compression of the gas, and so takes into account the relevant effects. The same perturbation (an increase in laminar burning velocity) was applied in each case, and the increase in predicted pressure noted. From these results an empirical relation between S and P could be deduced. The result is shown in Figure 1. S tends to infinity at

1114

1

10

Overpressure, bar Figure 1. The severity index is equal to the pressure in bars at low overpressure, but increases rapidly as an overpressure of just over 8 bars is approached.

an overpressure near 8 bars, which would correspond to adiabatic burning with no expansion. For ease of use, an analytical expression has also been fitted to the empirical curve of Figure 1. This is:

(

S = P exp 0.4

El,o8

-1-P

where P is the overpressure in bars, and E is the expansion ratio at atmospheric pressure.* To determine P from S , it is not possible to invert this equation analytically, but the inversion can easily be done, for example, by a lookup process in a spreadsheet. The significance of the severity index in the current context is that, if the expression in Equation 1 is indeed a useful approximation for P at fairly low overpressures, then it would equally be a good expression for S; this is true because S is equal to P at low overpressure. As pressure increases, the * For hydrocarbons, is a good approximation to the absolute pressure resulting from combustion at fixed volume; this is not equal to E; as might be expected, because the expansion ratio decreases as the pressure increases

1115

correlation (1) takes no account of the negative feed-back discussed above, but if the correlation is used for S, then the median overpressure P is automatically limited in a realistic way. For this reason, the fit will be performed using S = ao(Uo(E- 1))2’71d 0.55nuI exp(a2b)rNa3

(3)

It should be noted that the discussion of severity index refers to typical overpressure, for example over a whole congested region. It is this which is predicted by a model such as SCOPE. In comparing with experiments, we normally take the median of the measured values to represent this. Overpressures may be locally much higher, as discussed below.

2.4. The fitted expression For the 198 experiments (without roof) in the database, the measured pressure was converted to values of S using Equation 2. A non-linear leastsquares fit was then used to determine the constants a0 to a3 in Equation 3. At the first attempt, some inconsistency was found between those experiments where the first rows of obstacles were very close (in relation to obstacle diameter) to the ignition point, and those where the first obstacles were further away. It was found that, for the latter, it was necessary to ignore the rows (in reality perhaps four individual cylinders) closest to the ignition in order to get a good fit**. This seems reasonable because in this region the flame kernel would not be much larger than the obstacles and would tend to be deflected bodily by the obstacle; there are also very few of these obstacles. From this initial fit, it was noted that the estimated value of a3 was very close to 0.55. An opportunity was thus presented for a useful simplification of the formula. If a3 is set equal to 0.55, (3) becomes

s = a o ( u 0-(1)) ~ z

2.71 0.55

n a’1 exp(a2b)

(4)

where u; = a, - 0.55, and 1 = nr,,d is the length of the congested region through which the flame has to pass (i.e. the half-length of the plant). This change provides the considerable benefit that it is no longer necessary to specify the diameter of obstacles. Although defining a typical obstacle diameter can be easy in idealised experiments, it is often difficult in real plant.

I*

Numerically, for the experiments where the first row of obstacles was at half the pitch from the ignition point, n was reduced by 81rpd

1116 10

0.01 0.01

0.I

1

10

Observed P, bar Figure 2. The results of fitting Equation 4 to the data (excluding cases with a roof). Circles show the MERGE experiments, triangles the Shell Buxton experiments. The line indicates equality of predicted and observed.

The results of fitting Equation 4 to the data are shown in Figure 2. It can be seen that the fit is good, with the majority of points within factor-of-two bands. The values of the fitted constants were a, = 3 . 9 ~ 1 0 - ~a;, = 1.99, a, = 644. The value of the dimensional constant a0 is based on burning velocity in m / s , length in metres and pressure in bars. 2. 4. I . Correlation for plant with a roof A similar exercise could be performed for all the data from experiments with rows of cylinders and a roof. A separate correlation, based on Equation 4, was fitted for the data listed in Table 2. The reduction of n, allowing for grids close to ignition was also applied where the “grids” of obstacles started very close to the ignition point. The resulting correlation was

S = 4.8~10-~(U,(E - 1))2’71 I 0.55n 1.66 exp(7.24b)

(5)

using the same units as above. The fit is shown in Figure 3 It should be noted that this correlation would only be expected to apply when the flame travel is essentially in two dimensions, normally horizontal. Thus if the height is greater than half of either of the other dimensions, there

1117

/ P

I

I

0.01 0.01

0.1

1

10

Measured overpressure, bar Figure 3. The results of fitting to the experiments which included a roof. Circles: TNO DISCOE; triangles: TNO CECFLOW; squares: Shell Buxton.

would be significant vertical flame travel for ignition on the ground at the centre, and so the correlation from the previous section should be used if it gives a higher pressure.

3. LESS IDEAL CONDITIONS The correlations fitted so far relate to a very idealised layout: symmetrical congestion, regular rows of equal cylinders etc. Real plant is rarely so simple. For a tool such as this to be practically useful, the user needs guidance and methods for calculating the effect of less ideal aspects of any particular layout. On the basis of a wide variety of experiments, it is possible to quantify such effects.

3.1. Obstacle complexity Obstacles, e.g. vessels and piping, have an effect in a gas explosion in two principal ways. As gas flows past them, they generate turbulence, and turbulent burning velocity is larger than laminar burning velocity. The second effect is that, as the flame burns through a group of obstacles, the flame front becomes distorted, increasing in area. This “macroscopic” flame area

1118

generation occurs at a different scale from the flame area increase associated with the turbulence, and so is an additional effect. The total burning rate is proportional to the burning velocity multiplied by the flame area, and so flame area enhancements are important. The obstacles in a real plant environment are typically much more complex than the simple arrays of cylinders used in most idealised experiments. In particular, there is a great range of length scales present. The effect of this is to increase the “macroscopic”flame area generation above that pertaining to rows of uniform cylinders. We have performed experiments to demonstrate these effects, using idealised obstacles but with a range of obstacle sizes. In the SCOPE model we have used the results of these experiments and others to account for these effects by increasing the macroscopic flame area generation for the higher levels of obstacle complexity. Four “complexity levels” are defined in semi-quantitative terms as follows: Level 1 Idealised arrangements of obstacles of the same diameter, or very few obstacles of significantly different dimension than the dominate obstacle diameter. (Note that, e.g., interconnecting pipes, and fittings on vessels may all count as obstacles). Level 2 Rather more complex than level 1, for example with two obstacle sizes an order of magnitude apart. Level 3 Much more like real plant but with much of the detail missing. This is best defined as being similar to the layout of the “high density”

Figure 4 A computer-generated view of the layout of the B E T S Phase 2 rig

1119

arrangement in the BFETS Phase 2 experiments [18], which is illustrated in Figure 4. Level 4 The full complexity of typical congested refinery or offshore plant. To relate these complexity levels to something which could be used quantitatively for CAM, the SCOPE model (version for unconfined, congested plant) was run for a large number of conditions . The expectation was that it would be necessary to change some of the fitted parameters in the CAM correlations, e.g. the exponent of n, to be dependent on complexity level. However, examination of the results showed that as good a fit was obtained by just taking a factor, different for each complexity level, to multiply S . Calling this a “complexity factor” we have the values in Table 3: The conclusion is that the highest, but typical, level of complexity leads to a factor of four increase in the severity index, which implies a factor of four change in pressure at low pressure levels, although a smaller change for the higher pressures. A factor of four may appear large, but large effects of increasing small-dimension congestion have been seen experimentally. Inexperiments at Spadeadam in the “BFETS Phase 2” Joint Industry Project [ 181, the differences in overpressure between the low- and high-density configurations were larger than predicted by most models available at the time. In later experiments in the same rig sponsored by the UK Health and Safety Executive [ 191, large increases in overpressure were observed when scaffolding was added.

3.2. Sharp-edgedobstacles All the experiments used in developing the correlations involved cylindrical obstacles. The drag of obstacles which are sharp edged, for example of square cross-section, is higher; the drag coefficient is typically 2.0, compared with 1.2. The importance of the area blockage of obstacle grids is in its influence on the drag; therefore allowance must be made for the greater effect of sharp obstacles. This can be done approximately with an increase in the blockage ascribed to the sharp obstacles, by dividing by 0.6. 3.3. Non-symmetrical congestion Table 3

Values of the factor for obstacle complexity Complexity level Complexity factor 1 1.o 2 1.7 3 2.8 4 4.0

1120

3.3. Non-symmetrical congestion The discussion so far has related to plant in which the same number of grids, of the same blockage, are encountered when travelling out from the centre of the congested region in any direction. Most plant is not symmetrical in this way and so a way is needed of estimating the overpressure when the congestion is different in the different directions. (Note that we are still considering central ignition; other ignition locations will be discussed below.) In the rig at the Buxton site, we have performed experiments in which the grids obstructing the flow could be different in the north/south, easdwest and upward directions. The number of grids, counting from the centre, and their locations were kept the same, with the blockage being varied. Grids of nominal blockage ratio lo%, 20% and 30% were used. (Details of the grids and supporting framework are given in Ref. [7]) Results are given in Table 4. The first three cases for each fuel are “baseline” cases where the blockage ratio of all the grids was the same. The results with the mixed grids could be compared with the three values obtained from experiments with the same grids in all directions. For example, Table 4

Results from experiments where different level of congestion were used in the three co-ordinate directions Nominal area blockage of grids, % Peak overpressure, mbar NortNsouth East/west Up Observed Estimate from mean Propane 10 10 \ 10 48 20 20 20 177 Baseline 30 30 30 313 I 10 20 10 98 91 10 20 20 140 134 20 10 129 134 20 10 30 10 134 136 10 30 30 227 225 Methane 10 10 10 22* \ 20 20 20 80 Baseline 30 30 30 145 I 10 20 10 37 41 10 20 20 59 61 20 10 56 61 20 10 30 10 46 63 10 30 30 90 104 *This measurement was not available; the value has been estimated by taking the same ratio from the propane overpressure (2.2) as was obtained for the 20% and 30% grids

1121

the fourth line of results with lo%, 20%, 10%grids gave a peak overpressure of 98 mbar; this can be related to 48, 177 and 48 mbar, obtained in the baseline experiments. It was found that taking a simple average of the three values, as shown in the last column, provides a very good prediction of the result with the mixed grids. Note that the comparisons in Table 4 have been done using overpressure rather than severity index. At these pressure levels, there is only a small difference between the two. If all the P values in the Table are transformed to S, similar conclusions are reached. This result can be used in applying the method to plant assessment. The number and average blockage can be assessed for obstacles passed travelling through the length of the plant; a similar count can be done across the width, and upwards. The correlations can be used three times, and the resulting values of S averaged. In the case of plant with a roof, there would be two values to average, as upward flow would not normally be considered.

3.4. One wall If there is a wall along one side of the plant, an assessment can still be performed, as the wall can be considered as a reflecting surface, and ignition at the wall would be a worst case. Thus source calculations can be performed for a plant twice the size of the actual plant, taking a reflection in the wall. Nearfield pressure decay would also need to use the doubled plant volume. For distances much greater than the dimensions of the wall, the actual plant volume could be used.

3.5. Long, narrow areas of plant If a plant is very long, but small in the other two dimensions, it is possible that the lateral venting of combustion products will be sufficient to limit the acceleration of the flame along the length of the plant. Then a steady flame speed may be reached, with the volume production due to combustion balanced by lateral venting, or at least the acceleration along the length will be reduced. In the case of a steady flame speed, beyond a certain length, adding more length does not increase the overpressure further. The “certain length” will be dependent on the other two dimensions, and the relative blockage in the various directions. In order to provide some data on this effect, calculations have been performed with the EXSIM CFD model [20,21]. An arbitrary section of congested plant, a 6m cube, was chosen. Using this cube as a building block, congested areas of various dimensions were constructed with height 6m., width 6m. and 12 m., and length from 6m. to 42 m. The ignition was taken in the centre of the congested region at ground level. Computations have been

1122

performed with and without a “roof” 6m. above the ground, covering the congested region. Figure 5 shows an example of the results from these numerical experiments: the median overpressure for the 12m wide plant with roof, plotted against length-to-width ratio. Results from the C A M 2 correlation are also shown for a suitable choice of grid parameters. It can be seen that the pressure initially increases in line with the correlation, but then tends to level off (with variations) for the larger values of L/W. The highest values of median overpressure obtained are lower than the value given by the correlation for L/W = 3. In fact, all results suggest that it is acceptable to ignore length greater than three times the width when calculating the overpressure. If this were generally true, the length could be reduced to three times the width for the purposes of the pressure calculation, and the lengthways number of grids reduced in the same proportion. Harris and Wickens [22] carried out experiments with thirty grids of pipes

6

5

1

0

0.0

0.5

1 .o

1.5

2.0

Ratio of length to width

2.5

3.0

3.5

Figure 5. Symbols show the increase of overpressure predicted by EXSIM as the length of the plant is increased. The solid line is the prediction from the basic CAM 2 correlation; the dashed line shows the effect of using Equation 6.

1123

(40% blockage) in the 45m length of an open rig. The width and height were both 3m. Using methane, they did find that a steady flame speed was reached. With propane and cyclohexane, however, the flame continued to accelerate along the whole length of the rig. By use of initial confinement, they were able to start the flames at a higher speed and investigate what would have happened in the first experiments had the rig been longer. With both cyclohexane and propane there was a transition to detonation. (Detonation is discussed in the next section.) The experiments of Harris and Wickens show that it is not possible to set a limit at, say, three times the width and ignore all length beyond this. But analysis shows that the flame acceleration was more gradual than would be expected for congestion extending to 45m in all directions. An approach which is conservative against all available data is to take a unit of length, L,,, which is twice the lateral dimension. If the length is less than Lo, then no correction is needed; otherwise express the length as a multiple of L,, and allow for the reduced acceleration by taking the square root of this, i.e. effectivelength / L,, =

,/m

(6)

The formulation needs to be robust against a case where the congestion is more dense in the lateral direction than longitudinally; “more dense” could refer to more grids per unit distance or greater blockage ratio. To allow for this, Lo can be taken to be twice the lateral width or the longitudinal distance over which twice the lateral congestion is encountered. Note that the pressure may still be generated along the whole length, and so the full congested length should still be used in calculating the effective source volume VO. Also, if there is significant non-uniformity in the congestion along the plant, use of average parameters may not be appropriate; the properties of the most congested section of length equal to the “effective length” should be used. 3.6. Partial fill It is possible to estimate the effect of only having a small volume of gas-air mixture available to take part in an explosion. The volume which is relevant for pressure generation is the volume after combustion. A first estimate of this is to take the flammable volume and multiply by the expansion ratio E for the gas in question, which is about eight for most hydrocarbons. However, if an appreciable overpressure is developed the final volume will be less (by a factor of P - ’ ‘ ~ assuming , ideal gas) owing to the compression. yis the ratio of specific heats for the combustion products, usually about 1.2. In general, not only is the

1124

volume dependent on the pressure, but the pressure will depend on the volume, as discussed below. However, a result can easily be obtained by iteration. If a first calculation is made using the full expanded volume, then an overpressure can be calculated; the volume can then be corrected for this overpressure and a new pressure calculation done. We have found that the calculation converges after a few iterations. In order to use the source volume, it must be related to a length, width and height of a gas cloud. For a small volume, we assume that the cloud is a halfcube, i.e. equal height, half-width and half-length, at the centre of the congestion. If the volume is large enough for this to extend beyond the congested region, then one or two dimensions are reduced, and others increased, in order to keep the cloud within the congested region. In reality, of course, the expanded cloud may well extend outside the congested region in one or two directions, even if its volume is less. The approach is intended to be conservative, and it can be simply applied. The calculation gives a half-length, half-width and height l‘, w’,h’ of the burnt-gas region to compare with equivalent dimensions of the congested region I, w,h. If, for example, 1‘ is smaller than I, we derive an effective number of ’ 1’ grids along the length to be n1 = - n l . In general this will not be an integer, 1

but the value can still be used in the correlation (Equation 4), and the result is that the overpressure is a continuous function of the gas volume. In real plant, obstacles are not usually present as planar grids, so taking the flame to be influenced by part of a grid is not an inconsistent assumption. Experiments have shown this approach to be significantly conservative for uniform stoichiometric clouds [23] (because the gas at the edge dilutes in the flow ahead of the flame) but it would be less so for richer fuel-air mixtures.

3.7. Non-central ignition The correlations have been developed on the basis of experiments with ignition at the centre of the congested region. This is based on the assumption that central ignition represents a worst case for the quantity we are trying to predict, which is the typical, or median, overpressure generated over the congested region. A series of experiments was conducted on our Buxton site to test this hypothesis. Several of the “unconfined” congested experiments were repeated with the ignition point moved from the centre to the centre of one edge, and to a corner of the rig. The ratio of maximum overpressure generated with edge ignition to that from the central ignition varied from 0.32 to 0.67. With comer ignition, the ratio was between 0.33 and 0.44.

1125

Experiments at larger scale and with more complex layouts appear to confirm this conclusion; an example is given in the next section. However, localised peak overpressures may be greater for the cases when the flame travel distance is longer.

3.8. Continuing acceleration and detonation The flames discussed above consist of the normal type of burning known as a deflagration. Almost all gas cloud explosions are deflagrations. In a deflagration, the burning velocity is limited by the diffusion of heat and species through the flame front. In a detonation, by contrast, the gas mixture ahead of the flame is heated by a shock wave coupled to the flame. A detonation is supersonic and self-sustaining, and, once initiated, will continue to propagate at the same speed even through an unconfined, uncongested cloud. A deflagration flame slows down soon after leaving a congested region, as the turbulence decays. The pressure generated by detonation in a hydrocarbodair mixture is about 18 bar, with speed around 1800 m/s. A detonation is likely to have a devastating effect on the plant directly involved in the explosion, but so would a deflagration producing two or three bars overpressure. At a distance from the explosion also, there is not a great difference between the effects in these two cases, because the shape of the pressure decay curves (see Appendix) is such that the overpressure ratio at a distance is much less than that at the source. Thus the principal increase in hazard due to a detonation is that the explosion source may not be confined to the congested region; if the gas cloud is larger than the congested region, it could all be involved in the explosion, although with no expansion. Gases vary considerably in their susceptibility to detonation. The overpressure which would be expected from a deflagration, given by the correlations already presented, may be a guide as to when a detonation is a possibility. In an environment without confinement, the overpressure is related to flame speed, and a minimum flame speed is needed for transition to detonation to occur. A little empirical guidance can be obtained from some of the experimental series. Overpressure exceeding 18 bar, and so possible detonation, was obtained in a MERGE experiment using ethylene where the deflagration overpressure would have been expected to be about 3 to 3.5 bar. A simplistic estimate can be made of the overpressure just before transition to detonation in a propane experiment of Harris and Wickens [22]; this is about 5 bar. It is believed that detonation of methane in unconfined congestion is very unlikely. It should be noted that the detonability of gases decreases as the concentration moves away from stoichiometric. Thus, compared with the ideal

1126

uniform stoichiometric experiments, detonation may be significantly less likely to occur in real dispersing gas clouds; if initiated, detonation may subsequently fail when gas of a different concentration is encountered. There have been no incidents involving gas cloud explosions in congested, unconfined plant which have clearly involved detonation. In less severe cases, there may still be explosion effects which go beyond deflagration, as discussed in the next section.

3.9. Localised peak overpressures There can be limited regions with significantly higher overpressure than the general overpressure generated in a congested region. In experiments which produce low overpressures, up to a few hundred millibars, measurements usually show little variation of pressure with location. But, as the overpressure increases, the peak-to-mean ratio increases also. The “hotspots” can be caused by: a) waves from pressure generated at two different locations happening to meet and constructively interfere at some location; b)pressure wave reflection if there are surfaces of significant area in the congested region; c) localised auto-ignition. Each of these mechanisms produces high overpressures which are quite localised, i.e. giving a small source radius at that pressure. Pressure spikes due to (c) are generally very short. Because the effects at a distance are strongly dependent on source radius, away from the explosion the influence of such “hotspots”is usually masked by the pressure generated by the overall explosion. Very short duration pulses are also of less significance in their effect on structures. An example which illustrates the issues of end ignition and “hotspots” is provided by two the experiments in the “Phase 3A” series, sponsored by the U.K Health and Safety Executive [19]. The rig was 28m long, 12m wide and 8m high. In test 4,ignition was at the centre of one end. The overpressure measurements were smoothed with a 1.5 ms moving average to remove very short spikes of no structural significance. The median of the overpressure measurements was 0.44 bar, but at one location 7.2 bar was measured (17.1 bar before smoothing). Eleven out of 34 sensors registered over one bar. The equivalent experiment with central ignition (on the ground), test 1, gave a median of 0.77 bar, complying with the suggestion that the edge ignition is no worse than central in this respect. The highest measured overpressure was Pressures were also measured at a distance from the rig. The 1.9 bar. measurement 54m from the rig was 0.22 bar in test 1, compared with 0.25 bar

1127

for test 4. Thus the localised high pressures in test 4 had little effect away from the explosion.

4. OTHER PARAMETERS 4.1. Source volume The overpressure at a distance from the explosion is strongly influenced by the size of the explosion source. It is thus important to estimate this volume. What matters is the spatial extent of the region over which the peak overpressure is generated. In the ideal case when this is a sphere (or a hemisphere on a ground plane), the pressure initially decays inversely with distance from this level, and the distance scaling is determined by the radius of the sphere. From the description of the mechanism of pressure generation given in the introduction, it can be seen that the flame accelerates as it passes through successive rows of obstacles. As the flame reaches the last row, there is already turbulence downstream of these obstacles generated by the flow between them. The turbulence level initially increases with distance from the obstacles and then decays further downstream. The flame burning into this region initially continues to accelerate; then it meets the decaying turbulence and starts to decelerate. Since the pressure generated increases with flame speed, the extent of the maximum pressure contour is a little beyond the last obstacles, probably by about ten obstacle diameters for uniform cylinders. Cates [4] suggested using 2m beyond the last obstacles for typical industrial plant, and this seems reasonable.* A number of methods, harking back to the TNT equivalence approach, have based the source volume (and hence the radius) on the combustion energy of the fuel, or better of the fuel burning in the congested region. Since the energy content of most stoichiometric hydrocarbon-air mixtures is very similar, this is just a convoluted way of deriving a number proportional to the volume of the congested region. But for high pressures or for a material with a different energy density, the approach is likely to be misleading, as well as unnecessarily complex. The source volume recommended for use in CAM is therefore (L+4)( W+4)(H+2) (dimensions in metres), or the expanded partial-fill volume discussed above, if that is smaller. The 2 metres can be modified if the size of obstacles is untypical, for example when analysing small-scale experiments. * Cates also recommended doubling the resulting volume, but analysis of more recent experimental data shows that this is not necessary.

1128

4.2. Pressure decay, rise time and duration In the first paper on the Congestion Assessment Method [5], correlations were introduced for the decay of pressure with distance from the source, and for the duration and rise time of the pressure pulse. The pressure decay formulation was based on detailed calculations using a realistic pressure-time profile at the source, obtained from gas-explosion experiments. Other methods have tended to use a constant-velocity piston, which is unrealistic, since the gas explosion is a process of acceleration of the flame through the congestion. The correlations used for these parameters have not been changed, and so the relevant results are just summarised in the Appendix.

5. ACCURACY The accuracy of predictions from the simple correlations in methods such as CAM is, of course, limited. The goodness of fit of the correlations to the experimental data can be seen from Figures 2 and 3; most predictions are within a factor of two of the observations. However, it should be noted that these results are from idealised experiments. Any real plant does not have welldefined rows of obstacles of equal blockage, and so there is additional uncertainty arising from the need to idealise the real layout into equivalent regular rows. In addition, it should be remembered that the correlations were fitted specifically to the data shown in the Figures. It is helpful that the nature of the pressure decay curves often leads to a much smaller (proportional) uncertainty in the pressure at a distant receptor than the uncertainty at the source. Even with limited accuracy, the method does provide a useful screening tool. On many occasions, it can be used to show that the likely overpressure at a structure is well within the capacity of the structure to withstand the blast. There will be occasions when the results do not provide enough confidence, and more sophisticated methods may be needed for the analysis Then it may be necessary to use a phenomenological model such as SCOPE [17], or full computational fluid dynamics, for example EXSIM [20,21].

6. CONCLUSIONS There are several methods which have a similar approach to the prediction of overpressure in congested plant gas explosions. It is worth emphasising the areas where we believe the Congestion Assessment Method takes a more realistic approach than the other methods we are aware of:

1129

a) One expression for open geometries (with another for roofed plant) has successfully correlated a very wide range of data. b)The source radius is based on the physics of what is occurring in the explosion, and so should be equally applicable to materials with different energy of combustion. c) Pressure decay curves were derived using a realistic accelerating flame, not a constant-velocity piston. d) An understanding has been developed, and applied, for the differences between the obstacles in typical plant and the regular arrays of cylinders used in many experiments. e) Methods have been developed to allow the user to take account of other nonideal aspects of plant such as long narrow areas and particularly small gas clouds; a number of these have been validated or derived from specially designed experiments. f) Use of the “severity index” takes into account the reduction of expansion and the flame acceleration mechanism as pressure becomes higher This avoids the prediction of unrealistically high median overpressures even for many obstacle rows with high blockage. The formulation given here has been implemented as a practical tool in the Shell FRED suite of programs.

ACKNOWLEDGEMENTS Thanks are due to Dr. Simon Chynoweth, who performed the EXSIM calculations reported in this paper.

REFERENCES A.C. van den Berg, The multi-energy method: a framework for vapour cloud explosion blast prediction, J.Hazardous Materials, 12 (1985) 1. A.C. van den Berg and J.B.M.M. Eggen, GAME: guidance for application of the multienergy method, (1996) Proc. Intl. Symp. Hazards, Prevention and Mitigation of Industrial Explosions, Bergen, Norway, June 1996. Q.A. Baker, M.J. Tang, E.A. Scheier, and G.J. Silva, Vapour cloud explosion analysis, (1994) Proc. 28* Annual AIChE Loss Prevention Symposium, Atlanta, GA, April 1994. A.T. Cates, Fuel gas explosion guidelines, (1991), Int. Conf. Fire and Explosion Hazards, Inst. Energy. J.S. Puttock, Fuel gas explosion guidelines - the Congestion Assessment Method, Second European Conference on Major Hazards Onshore and Offshore, 267, IChemE Symposium Series no. 139, 1995

1130

W.P.M. Mercx, Modelling and experimental research into gas explosions; overall final report of the MERGE project., (1993) Commission of the European Communities, contract STEP-CT-011 (SSMA). [7] P. Snowdon, J.S. Puttock, E.T. Provost, T.M. Cresswell, J.J. Rowson, R.A. Johnson, A.P. Masters, and S.J. Bimson, Critical design of validation experiments for vapour cloud explosion assessment methods, Proc. Intl. Conf. "Modeling the Consequences of Accidental Releases of Hazardous Materials", San Francisco, Sept. 1999. [8] B.H. Hjertager, Explosions in obstructed vessels, (1994) "Explosion Prediction and Mitigation" course, Dept. Fuel and Energy, Univ. Leeds, U.K., November 1994. [9] K. van Wingerden, Course and strength of accidental explosions on offshore installations, J.Loss Prev.Process Ind., (1994) 295. [lo] A.J. Harrison and J.A. Eye, The effect of obstacle arrays on the combustion of large premixed gadair clouds., Comb.Sci.Tech., 52 (1987) 121. [ l l ] A.J. Harrison and J.A. Eyre, Vapour cloud explosions - the effect of obstacles and jet ignition on the combustion of gas clouds, 5th. Int. Symp. "Loss Prevention and Safety Promotion in the Process Industries", Cannes, France, 1986. [ 121 C.J.M. van Wingerden, Experimental investigation into the strength of blast waves generated by vapour cloud explosions in congested areas, 6th. Int. Symp. "Loss Prevention and Safety Promotion in the Process Industries", 1988. [ 131 J.G. Visser and P.C.J. de Bruijn, Experimental parameter study into flame propagation in diverging and non-diverging flows, Data reported in: J.B.M.M. Eggen, "GAME: development of guidance for the application of the multi-energy method" TNO Prins Maurits Laboratory, publ. by HSE Books, Sudbury, England (1991) [14] W.P.M. Mercx, D.M. Johnson, and J.S. Puttock, Validation of scaling techniques for experimental vapour cloud explosion investigations, Process Safety Progress, 14 (1995) 120 [15] P.H. Taylor and W.J.S. Hirst, The scaling of vapour cloud explosions: a fractal model for size and fuel type, Intl. Comb. Symp., 22 (1988) [ 161 H. Phylaktou, Experimental scaling, "Explosion Prediction and Mitigation" course, Dept. Fuel and Energy, Univ. Leeds, U.K., November 1995. [17] J.S. Puttock, M.R. Yardley, and T.M. Cresswell, Prediction of vapour cloud explosions using the SCOPE model, J. Loss Prev. Process Ind., 13 (2000) 419. [18] C.A. Selby and B.A. Burgan, Blast and fire engineering for topside structures - phase 2: final summary report., SCI publn. 253 (1998) Ascot, U.K., Steel Construction Institute. [ 191 Reports on "Phase 3A" programme "Explosions in full-scale offshore module geometries", prepared by BG Technology for UK Health and Safety Executive (Contract MaTSU 8847/3522). To be available from, HBrSE, Bootle, England (2000). 1201 B.H. Hjertager, Computer modelling of turbulent gas explosions in complex 2D and 3D geometries, J.Hazardous Materials, 34 (1993) 173. 1211 S. Mogensen, B.H. Hjertager, and T. Solberg, Investigation of gas explosions in open geometries using EXSIM, Proc. Intl. Conf. "Modeling the Consequences of Accidental Releases of Hazardous Materials", San Francisco, Sept. 1999. [22] R.J. Harris and M.J. Wickens, Understanding vapour cloud explosions - an experimental study, Institution of Gas Engineers, 55th Autumn meeting, 1989. [23] G.A. Chamberlain and J.J. Rowson, Gas explosion experiments in congested plant partially filled with fuel-air mixtures. Intl. Conf. "Major Hazards Offshore - Practical Safety Implications", ERA Technology, 2000

[6]

1131

APPENDIX. PRESSURE DECAY AND PULSE SHAPE Let the source pressure be Po bar, and the effective source volume VO . Consider a receptor at a distance r' from the edge of the congested region. Then define:

r = R,

+ r'

log P, = O.08lr4 - O.592lr3 + 1.631,' - 3.281,

+ 1.39

r

1, = log - + 0.2 - 0.02P0

where

Ro Then the pressure in bars at the receptor is

(A21

(N.B. logarithms to base 10)

(7 1

P = min - Po,P,

10

$

g

P

1

v)

2

3 6

0.1

0.01 0.1

1

10

100

Scaled distance r/Ro Figure 6. The pressure decay curves given by Equation A3 for source overpressure of 0.2,0.5, 1,2,4 and 8 bar

1132

The curves are plotted for a number of source pressures in Figure 6. They are similar in shape to the TNO multi-energy curves, but the point at which the faster decay commences is different, and the curves do not all coincide after transition This is a result of the more realistic behaviour of the "spherical piston" representing the source, which we have now been able to base on the experimental data. It can be seen in Figure 6 that at 1 bar source pressure the pressure decay extends to about nine times the source radius. For lower source pressures, the straight line extends much further. Thus, for pressures up to 1 bar, the simple assumption of pressure decay inversely proportional to distance is reasonable, although in the far field the pressures calculated now would be lower. Note that the peak pressure of the front face of a building may be doubled (or much more for large P ) by pressure wave reflection. For r' < R o , the dynamic pressure may also be significant, and "edge of the hazard area" should be carefully defined to allow for the expansion of the explosion source beyond the congested region. The calculations also take no account of the effect of atmospheric inversion, which typically occurs at night, particularly after a sunny day or with low wind speeds. An inversion will tend to act as a reflector, resulting in a much slower pressure decay with distance; lensing effects can also be produced, with locally higher overpressures.

Pulse duration and shape If estimated pressures are to be used with structural response calculations, then information is needed on the duration of the pressure pulse and its rise time. Defining the times tl, t2 and t3,as shown in Figure 7, the pulse is defined by the peak pressure, already determined above, and a duration and "shape factor". (t3- t l )is the duration and (tz - t l )l(t3t l )is denoted the shape factor, which is the ratio of the rise time to the duration; this becomes zero as the front of the wave becomes fully shocked. The rate of change of the pressure wave shape is much greater for higher pressures. This leads to the use of a distance parameter:

where P, is atmospheric pressure. Then

1133 0.25 0.2

0.15

=B P

2

c4

0.1 0.05

0 -0.05

4.1

0.18

0.19

0.2

0.21

0.22

Time, s.

Figure 7. An example of a triangle fitted to the positive part of a pressure pulse, showing the definition of t l , t 2 and t 3 .

10.65

d,< 5

Note that the maximum pressure has been denoted P,' here to emphasise the fact that consistent units must be used, e.g. when using SI units P,' must be in Pascals, i.e. bars multiplied by lo5. pa is the density of air (approx. 1.2 kg/m3). Equation (A5) is not valid inside the explosion source. The shape factor is well represented by taking a linear decay with distance: _ I' _t1_-- max(0.65(1t 3 - tl

1.25df),0)

From the simple expressions in Equations A5 and A6, a good, if slightly idealised, representation of the positive pressure pulse can be obtained. It should be noted that the positive overpressure pulse is followed by a negative pulse (rarefaction) typically of lower amplitude and longer duration. This may in some circumstances be as damaging as the positive pulse.

This Page Intentionally Left Blank

1135

Explosion vent sizing in flammable liquid spill scenarios F. Tamanini Research Division, Factory Mutual Research, 1151 Boston-Providence Turnpike, Norwood, MA 02062, USA

ABSTRACT The assessment of the explosion hazard from flammable liquid spills or slow leaks of a gaseous fuel requires the characterizations of the properties of the explosive layer and the determination of the pressure development from the combustion of the layer as a function of the amount of venting. The question has been addressed by a combination of experiments and modeling, resulting in the development of a methodology to determine the protection requirements for an enclosure subjected to a postulated spill situation. Due to the number of variables affecting the problem, the methodology is designed to address the specific scenario of interest. It calculates the vapor diffusion assuming a onedimensional layer formation process and it predicts the pressure development on the basis of a model that uses experimental data for the flame propagation rate. The approach yields vent areas that have been validated by experiment and are more realistic than the conservative values predicted on the basis of current guidelines which assume a full-volume explosion. These results show how a practical protection problem can be solved through a combination of theoretical and experimental input.

1. INTRODUCTION The reactive vapor layer produced by a flammable liquid spill or by a slow leak of a gaseous fuel, in the region near the floor of an enclosure, represents an explosion hazard, which must be addressed with appropriate measures. Explosion protection requirements for flammable liquid processing and dispensing areas are specified both in the NFPA 30 standard [l] and in the Factory Mutual Property Loss Prevention Data Sheet 7-32 [2]. In the case of the first document, design of the protection is referred to the NFPA 68 guideline [3]. The second document relies on Factory Mutual Property Loss Prevention Data Sheet 1-44 [4]. In the NFPA standard [I], explosion protection is required in the

1136

case of Class IA liquids (flash point below 22.8"C [73"F]) and boiling point below 373°C [100"F]). The Factory Mutual guideline [2] provides a more advanced set of criteria, which distinguish among different levels of hazard, based on the properties and the amount of material spilled. In the absence of specialized methods to determine the required vent area, sizing is currently carried out using correlations developed for full-volume explosions. The two design guidelines referenced above [3,4] are no exception. In both cases, they address the venting of weak enclosures, which are defined as structures that are capable to withstand pressures up to 100 mbar (1.5 psi). The guidance implied by these guidelines generally leads to conservative design requirements; a point that will be further discussed in this paper. Factory Mutual Research (FMR) has been working toward correcting this situation because of the costs associated with the present approach. The research has been structured by addressing separately the two components of the problem: spill evaporation and vapor diffusion; and flame propagation in the stratified mixture. Reports on various stages of this work have already been presented [see Refs. 5-81. The first part of the problem has been tackled by developing a model to calculate the rate of generation of vapors and their mixing with air in the enclosure. The second part, concerning the pressure development following ignition of the mixture, has been approached mostly experimentally. Data for the pressure rise produced by the explosion have been used to assist in the development of a second model, which yields bounding estimates of the test results. The two models, respectively to predict the formation of the layer and the consequences of the explosion, have been combined into a tool for use in engineering calculations of the vent areas needed for these partial-volume deflagrations. The paper provides an overview of the considerations that have led to the selection of this approach and discusses the implications of this new method on the vent sizing requirements for protection of r o o m where flammable liquids are processed or dispensed. 2. TECHNICAL ISSUES

2.1. Layer formation In an accident scenario, involving vaporization from a liquid spill or the slow release of a leaking gas, mixing of the (generally) heavier-than-air vapor with surrounding air generates a flammable layer. In the gas release case, the rate of vapor addition is easily calculated from the conditions (pressure, break size, etc.) of the leaking system, whereas in the second case it must be calculated from the initial conditions of the liquid and from the properties of the ambient. This latter step involves the evaluation of the energy balance for the vaporizing pool of liquid and the imposition of the saturation condition at the pool surface.

1137

There are no major conceptual difficulties with the performance of these calculations. During most of the vaporization process, the liquid is typically at a temperature lower than ambient, even in those cases where the scenario involves a “hot” spill. As a result, the pool receives energy from the floor by conduction and from the ambient atmosphere by convection and radiation. Somewhat surprisingly, this radiation term accounts for the bulk of the gas-phase heat transfer and, therefore, cannot be neglected. The presence of natural or forced ventilation can also be an important factor to be included. Ventilation has two major effects: it increases the rate of vapor evolution from a spill and it promotes mixing. The first effect leads to an increase in the hazard, while the second tends to reduce it in most cases. If the combined action could always be assumed to act in the direction of mitigating the event, ventilation could be neglected within the context of conservative safety analyses. Since a contribution of ventilation to an increase in the hazard cannot be ruled out, its presence must also be included when appropriate.

2.2. Flame propagation modes The most common situation reproduced in experiments or addressed by modeling efforts involves flame propagation through a uniform fuellair mixture. In the case of explosions over stratified mixtures, this simple description of the process is not appropriate. In the general situation, a region with compositions within the explosive range is sandwiched between an underlying rich layer and one above, in which the fuel concentration is too low to support combustion. Ignition is only possible in the intermediate layer. Following the ignition event, a premixed flame will propagate through this layer at a velocity (relative to the unburned mixture) that is determined by the most reactive concentration present. In terms of its overall shape, the premixed flame is better approximated as a cylindrically propagating front, rather than by the more commonly assumed spherical shape. A second difference from the traditional treatment of flame propagation is that the premixed flame is followed by combustion of the rich portion of the layer. For this to occur, additional oxidized must be mixed in with the fuel. This process, which is controlled by buoyancy-induced mixing, occurs in a convective flame and is characterized by a different (typically longer) time scale than that of the premixed combustion. As a result, the contribution to pressure development in a vented explosion from convective combustion is generally not very large. However, since the relative effect of this combustion mode is dependent on scale, its role cannot be entirely neglected. 2.3. Modeling considerations Some of the modeling issues associated with this problem have already been introduced. They include the simulation of the effects of ventilation during the layer formation phase, and the proper accounting for the dual-mode character

1138

(premixed and convective) of the flame propagation process. It is reasonable to anticipate that computational fluid dynamics (CFD) codes should be ideally suited to handle the layer formation part of the problem. This is particularly true considering the ability of these types of codes to properly account for the threedimensional effects introduced by ventilation, for example. The success of the same models in dealing with the dual-mode character of the combustion, on the other hand, remains to be demonstrated. The context in which the output from the predictive methodology is to be used also has an impact on the selection of the most suitable approach. In the case of the work carried out at Factory Mutual Research, its ultimate goal is the development of an engineering tool for the accurate and rapid assessment of the consequences of defined spill accident scenarios. Because of their complexity and computational requirements, CFD codes are unsuited for the purpose. In terms of complexity, the development of general criteria to classify the level of hazard lies at the opposite end of the range of possibilities. This approach was attempted, but the effort was unsuccessful. In conclusion, it was judged that the best solution would be offered by a model to account for most of the complexities of the problem, which could still be used within a user-friendly environment by engineers without highly specialized training. This concept was implemented by developing a onedimensional treatment of the vapor diffusion process. The simplifying assumption of neglecting horizontal gradients in composition is appropriate for situations involving heavy vapors and is supported by the intermediate-scale testing described below. Where this assumption may not be valid, the resulting impact on accuracy of the predictions is believed to be acceptable. For the explosion part, a second model was developed to yield bounding predictions of the explosion test results. The model includes a treatment for the dual-mode character of the combustion: a premixed flame sweeping through the upper portion of the layer, followed by a diffusivekonvective flame, which consumes the fuel at concentrations above the upper explosive limit (UEL). The premixed flame is assumed to propagate at the velocity measured in the experiments, while the reaction in the convective flame is assumed to occur at a constant rate selected to be consistent with the rate of combustion in pool fires.

3. RESULTS 3.1. Experiments Explosion tests were carried out in a 63.7-m3 (2250-ft3) chamber with stratified mixtures of propane in air, under both vented and unvented conditions, and with the enclosure empty or fitted with obstacles. FueVair layers were formed by slowly injecting propane at the chamber floor through diffusers, at a rate of the order of the estimated rate of vaporization of a typical solvent such as

1139

acetone. Gas concentrations were measured at twelve locations in the room to provide an accurate characterization of the fuel vapor distribution as a function of time. Several composition profiles were simulated, including layers in which the concentration of propane at the floor was above the UEL. Details on the test program are available in Refs. [5-81. The data for the flame propagation velocity in the empty enclosure have been found to be in substantial agreement with the results from previous works, while values about 50% higher were observed with obstacles present. The pressures developed in the presence of venting have confirmed the conservatism of current recommendations that do not account for the fact that the mixture is confined to a fraction of the total volume. Some residual questions remain, concerning the effects of scale and different blockage geometries on the flame propagation velocity and, consequently, on the pressure development. These issues are being addressed by additional work currently in progress.

3.2. Layer characteristics In the absence of a means to arrive at an accurate estimate, current methods (including that of Ref. [2]) assume that the entirety of the spilled fuel vaporizes and then mixes with air to produce a stoichiometric mixture. The result of this calculation is expressed as the fraction of the enclosure volume occupied by this ideal mixture. This is the quantity plotted in the abscissa of Fig. 1, which presents data from the propane injection tests introduced in the previous section. The quantity on the ordinate is the experimental value of the premixed fraction. This is the fraction of the enclosure volume actually occupied by concentrations within the explosive range, which most contribute to the pressure rise during a vented explosion. As can be seen, the actual energy that can be released by the combustion of the layer in an explosion is only a fraction of the maximum theoretical value. Over the conditions of the tests shown here, this fraction varied from a high value of about 75% to a low of 0%, if one includes a test in which no flammable mixture was formed. The large variation in premixed filled fraction is a function of the broad range of conditions used during the propane injection experiments. In some cases, fuel was injected throughout the entire test, whereas in others injection was followed by a dwell period. It should be noted, however, that in these tests all of the fuel was actually introduced in the gas space, unlike the case of a liquid spill, where only a fraction of the spilled fuel would in fact vaporize. In this latter case, one would expect an even wider variability between the actual mass of vapors participating in an explosion and the amount calculated on the basis of the size of the spill. Also shown in Fig. 1 are the predictions from the one-dimensional vapor diffusion model. They can be seen to be in good agreement with the experimental results, confirming the model reliability in estimating this

1140

10

8 6 4 2

0 0

5 10 15 20 25 Nominal Stoichiometric Filled Fraction [%]

30

Comparison of actual premixed filled fraction with nominal stoichiometric ----:d fraction from propane injection tests in the FMR 2250-ft3 (63.7-m3) Chamber.

important quantity (pairs of points on the same abscissa represent data and predicted values for a particular test). The model can be used to consider the effect of different parameters on the explosive layer characteristics. For example, in the case of a test that had a nominal stoichiometric filled fraction of 27%, introduction of the same total amount of propane at 1/10 of the injection rate used in the experiment would make the premixed filled fraction go from about 5% to 17%. These estimates confirm the importance of a methodology that can account for the actual conditions of the spill (or the vapor injection process), rather than relying on general rules that are bound to be affected by large errors.

3.3. Pressure development The part of the methodology that addresses the prediction of the venting requirements uses two quantities to characterize the reactivity of the explosive filled fractions. As already layer. They are the premixed (Xh)and the rich (Xf,.) indicated, the quantity X, plays a more significant role in determining the pressure development from the combustion of the layer in an unvented explosion. The rich portion of the layer (quantified by Xfr)becomes increasingly important at larger scales. Figure 2 shows a comparison between model

1141

-

3

'iii 2.5 CL

Y

.-5 w

0

2

5 1.5 2! n -

Q,

1

'EI

0.5 0 0

0.5

1

1.5

2

2.5

3

Experimental Measurement [psi] Fig. 2. Comparison of reduced pressures predicted by the explosion model with those measured in experiments in the FMR 2250-ft3(63.7-m3)Chamber.

predictions and measurements for the peak reduced pressure obtained in tests in the FMR 2250-ft3Chamber fitted with obstacles. The reduced explosion pressures predicted for the conditions of the tests can be seen to generally exceed the experimental values, with differences that are fairly large in some cases. Where they occur, it is in correspondence with large differences between the measured and the assumed flame propagation velocity. This, however, is not considered a problem, since the model is not optimized to reproduce the data, but rather it is intentionally set to yield bounding predictions. While the open issues mentioned earlier (scale effects, obstacles) still need to be resolved, the model and associated choice of input parameters, in their present form, are believed to constitute a tool that is appropriate for engineering applications. As further discussed in the following section, the method generates predictions of vent area requirements that are much more realistic than those from other currently available methods.

3.4. Vent sizing implications The implications of the methodology in terms of the sizing of vents for partial-volume deflagrations are discussed next by an example. The case of a structure capable to withstand 48 mbar (100 psf) will be used for illustration purposes. The NFPA 68 guideline [3] predicts a required vent ratio, A,/A,, of 4.9 (Ay is the vent area and A, the internal surface area of the enclosure). There are some restrictions to the applicability of the NFPA design formula in the case

1142

120

-d

n

a .-6

90

3 .I-

60

Q

U

P

.I-

30 0

0

0.05

0.1

0.15

0.2

0.25

Premixed Filled Fraction, Xtp [-I Fig. 3. Vent area requirements based on the prediction of the explosion model and on the recommendations in NFTA 68 and Factory Mutual DS 1-44.

of elongated structures, but no generalized constraints associated with the shape of the enclosure. A difference of at least 24 mbar (0.35 psi, 50 psf) is recommended between the maximum explosion pressure and the vent relief pressure. The weight of the panel should not exceed 12.2 kg/m2 (2.5 lb/ft2) without independent analysis of its efficiency. In the case of the Factory Mutual protection guidelines, full damagelimiting construction is recommended if the hazard is defined as “severe” in accordance with the prescriptions of Ref. [2]. For the hypothetical situation of a 100-psf structure, the vent ratio, A, /A,,, calculated by the method in Ref. [4] would be 5; essentially the same value required by NFPA. These prescriptions from existing design methods are compared in Fig. 3 with the predictions of the model for explosions in stratified layers, results from which have been presented in the previous section. Since the model includes a dependence on the geometry, a room of 7.6 by 7.6 m (25 by 25 ft) in plan view, 6.1 m (20 ft) high, is considered in the calculation. The model predictions are shown in the figure by the points joined by the solid line, whereas the vent ratio recommended by the current published guidelines [2,4] is indicated by the dashed line. The important conclusion, which is quantified by the comparison in the figure, is that the proposed method clearly predicts much lower vent areas than the existing guidelines. As an example, for a premixed filled fraction, X,, of lo%, the model indicates that adequate venting would be provided by a vent area 10 times smaller than that required by NFPA 68 or DS 1-44. It should be noted

1143

that X, represents the fraction of the entire enclosure occupied by the layer with fuel in the explosive range. To produce the mass of vapors in this layer, however, a greater amount of liquid needs to be involved in the spill, with the specific quantity being dependent on the characteristics of the spill and on the environmental conditions.

4. CONCLUSIONS Predictive methods for explosions in stratified mixtures are not available, despite the practical importance of these relatively mild events in industrial and residential accident scenarios. The gap is now being filled by an engineering method to calculate the venting requirements of these partial-volume deflagrations. The research done to develop the method has relied on measurements of reduced pressure obtained in vented explosions where reactive layers were formed by steady and slow injection of propane. This has allowed for better control in the experimental investigation of the effects of layer depth and composition on the evolution of the explosion. The formation of the layer in the case of a vaporizing liquid spill is calculated by a one-dimensional model, which has been validated against the propane injection data. The use of a model, instead of generalized correlations, makes it possible to account for the details of the accident scenario in determining the protection requirements. As a result, the magnitude of the potential severity of the explosion event is now quantified by rigorous physical modeling, instead of approximate rules based on judgment. The limited technical background for the conservative estimates of vent area requirements from current methods has occasionally been responsible for some reluctance in the implementation of the recommended protection. The provision of a design approach with a strong justification should contribute to a higher degree of acceptance. Certain aspects of the methodology still require additional work. While the model takes into account the properties of the fuel to define its flammability characteristics, the venting calculation is done assuming the flame propagation velocity of propane. Since the methodology is intended for flammable liquid spills, this assumption is probably not critical. However, there may be greater uncertainties associated with effects of scale and blockage density/geometry that still need to be resolved.

REFERENCES [l] NFPA 30, "Flammable and Combustible Liquids Code," National Fire Protection Association, 1996 Edition. [2] Factory Mutual Property Loss Prevention Data Sheet 7-32, "Flammable Liquid Operations," May 1998.

1144

[3] NFPA 68, "Guide for Venting of Deflagrations," National Fire Protection Association, 1998 Edition. [4] Factory Mutual Property Loss Prevention Data Sheet 1-44, "Damage-Limiting Construction," May 1998. [5] F. Tamanini and J. L. Chaffee, "Combustion Behavior of Stratified Propane/Air Layers

Simulating Flammable Liquid Spills," Proceedings of the Mediterranean Combustion Symposium - 99, pp. 1366-1377, Antalya, Turkey, June 20-25, 1999. [6] F. Tamanini and J. L. Chaffee, "Mixture Reactivity in Explosions of Stratified FueVAir Layers," Paper presented at the AIChE 34h Loss Prevention Symposium, Atlanta, Georgia, March 5-9,2000. [7] F. Tamanini, "Partial-Volume Deflagrations -- Characteristics of Explosions in Layered Fuel/Air Mixtures," Paper presented at the 31d International Seminar on Fire and Explosion Hazards of Substances, Lake Windermere, UK, 10-14 April 2000.

1145

Analysis of risk of transportation of the liquefied petroleum gases on pipelines E.Telyakov, F.Guimranov Kazan state technological university (KSTU), 68 K.Marks st., Kazan, 4200 15, Russia

1. INTRODUCTION The transportation of liquefied hydrocarbon gases on large spacing intervals on uderground pipe lines is rather efficient from the point of view of minimization of transport expenses, but at the same time if bound up with the certain risk. The experience of exploiding demonstrates as compared with emergencies on oil pipelines that the moments of emergency on gas pipelines are more slowly find out, emergencies are characterized by more fast development, and the consequences of emergency turn out more severe. It takes place even that the diameters of pipe lines for condensed gass (d=200+300mm), as a rule, are much less, than diameters of oil pipelines (d=800+1600mm). The conveyed mix of light hydrocarbon gases includes saturated hydrocarbons (paraffines): ethane (boiling point Tb =-88.6"C), propane (Tb =-42.07"C), normal and isobutane (Tb =-11.73" & Tb =-0.5OC), normal and isopentane (Tb =27.85OC & Tb=36.07OC) and hexane (Tb =68.7"C). The bubble point of a mix, as a rule, is below -2OOC. There are also other components in the mix: methane (C&), nitrogen (Nz),carbon dioxide (COZ),hydrogen sulphite (H2S). 2. ANALYSIS OF RISK

There are series of tasks while analysing risk of exploitation of a pipeline transport: - calculation of quantity of a product elapsed from the pipe line with breaking its air-tightness; - the computational definition of dynamics pressure profile lengthwise of pipe line; exactly the pressure profile will be used for identification of emergency; - calculation of process of interaction of an elapsed product with environment; - calculation diffusion of a steam-gaseous cloud; The transport pipe lines are layed in a soil below than point of soil freezing. For

1146

conditions of an european part of Russia temperature of a soil varies from +4”C (in winter) up to +16”C (in summer), and depth of laying is 1.6m. The breaking of air-tightness can arise in the pipe line owing to caverns (flaws) as a result of corrosion or other mechanical damages. The formation of flaws is most probable. Under the statistical data their diameter on the moment of detection usually makes 2-4mm. Delayed detection of break and its subsequent development can result in to full pipe gap. In all cases the source of the outflow of mix can be esteemed as a source with some equivalent diameter(d,,).

2.1. Outflow of liquefied petroleum gas from an opening in the pipe line The outflow of condensed gas in a soil if accompanied by its adiabatic vaporization and cooling up to a boiling point with simultaneous cooling of nearby soil and pipe line up to the same temperature. In case of openings with a small deqthe vaporization of a liquid inside a tube does not occur, that allows to use for calculation of quantity of an elapsed liquid an equation:

V

P

w- velocity of outflow, m per sec; dp- pressure overfall at pipe sides, Pa; pmix density, kG.m-3; K =0.62 - outflow factor. Calculations using the theory of a soil mechanics demonstrates, that at deq275 mm there should be an outbreak of the majority of types of soils from a tuba1 trench and removal of resistance from a soil to the outflow of a product. In this case vaporization of a liquid starts already inside the pipe line, and from an opening the vapour-liquid mix will be threw out. In this case the vapour lock inside a tube will be formed and expire through an opening with a velocity close to an acoustic velocity:

’ ,J= 848kTg 0,

k - isentropic index of gas mix; T - absolute temperature, OK; g - acceleration ofgravity, m.secm2;M - molar mass. Confrontation of outcomes of calculation on the Eq.(l) and Eq.(2) with experimental data for a case of the outflow of liquefied propane through round openings of capacities has shown their practically complete concurrence. The rate of flux of condensed gas from an opening in the pipeline can be determined.

2.2. Forming of a pressure profile lengthwise the pipe line The feature of calculation of pressure profile forming at pumping-over of condensed gas is that the pressure at any point of the pipe line can not fall below

1147

than magnitude of pressure of saturated steams of a mix of condensed gases. Temperature of a system & molecular ratio of a formed vapour phase are bound with emqmsitios &-base mix by:

2 + E(K-, - I) = O ,=I

1

Z,W,

1)

Ki = f( P , T ) - constant of phase equilibrium; P - mix pressure; N - number of components of a mix; i - component's index. The Eq.(3) allows to determine beginning and final boiling point of a mix or pressure of saturated steams of a system at a given fraction of distillate of a vapour phase. The pressure at any point of the pipe line will be defined by:

q' = 'beg

-a

m j

-N

u b

(4)

<,s.

4,-

pressure at the begining of pipe line, Pa; AHj- overfall of altitudes between a m a r k j and a pipe line pump, m; A&b- hydraulic resistance of a section of the pipe line from its beginning up to a markj, P a ; j - section index. Outcomes of measurements at the pipe line of length 1 15 kms after some interim of shutting down of the force pump at the begining of the pipe line with continuing reception of a product by a customer are shown at Fig. 1. As follows from a fig. 1 in neighborhoods of 20 kilometer right-of-ways in a considered case the boiling up of a system and formation of a vapour phase (PS.,.=0.4MPa)took place. It is necessary to mark, that the vaporization and condensation of condensed gas of broad fractional composition proceeds differentially. Therefore, there were not cavitation phenomens at variation of conditions of pumping-over of gases (shutting down and the actuation of the force pump). The boiling up of pumped over gas at some point of trass can qualitatively model the process of the outflow of condensed gas from a corrosive fistula. As shown this process is not accompanied by essential pressure drop at the begining of the pipe line. Moreover, the calculations demonstrate, that even complete pipe breaking on sufficient removal from the force pump (L > 5Km) will not result in H.m 250 -

P,MPa P,MF 'a 1.3 -1.1 200 0.9 150 0.7 100 --- 0.5 V 50 0.3 0 20 40 60 80 100 120 L K m Fig. 1. Experimental and model data along the pipe line --

+Pipeline model data + experimental

1148

sharp pressure drop at the begining of the pipe line. It is explained to that in this case there is a sharp vaporization of condensed gas at the break point of a tube, pressuiemmp of earth from a trench and intensive outflow ofvapour-liquid mix from an emergency point and the process of adiabatic vaporization of a mix is shifts inside the tube. The outflow of a vapour phase at emergency point of a tube also has a subcritical speed (Eq.(2)), and the rate of flux of a vapour phase is even less, than normal rate of flux of a product. Therefore on some removal from a break point the pipeline's pressure will be equal to pressure of saturated steams and the rapid pressure drop at the begining of the pipe line nor will happen. This effect was scored while analysing consequences of real pipe breaking.

2.3. Calculation of process of interaction of an elapsed product with surroundings (soil, atmosphere) The final boiling point of liquefied petroleum gas for conditions of Russia is equal to +23"C. Therefore complete vaporization of a system in a place of an emergency point can be reached only in summer. In other conditions the liquid phase will spread on a contour of a surface of earth in neighborhoods of emergency. The further vaporization of a liquid phase will take place for account of heat removal from enclosing sections of soil and from an atmosphere. On the basis of a collateral solution of a heat conduction equation of soil, heat emission from an atmosphere and convective diffusion of steams of a product in an atmosphere the model of vaporization of a liquid phase from a wetted spot of soil was designed permitting to institute a surface of a spot, intensity of vaporization and regularity of scattering of steams in an atmosphere depending on climatic and meteorological conditions. The carried out study of progressing of an emergency at the pipe line with formation of openings and fractures of deqof 2,5,10,20,50,100 mm has shown: - at diameters of fistulas less than 5 mm explosion-dangerous concentrations in place of emergency can not occur at any meteorological conditions; - for deqof 10,20, 50 and 100 mm the diffusion of explosion-dangerous groundlevel concentrations along front of a plume of pressure bump at wind speed 0.5m per sec in summer makes 45,80,275 and 4500 m accordingly. 3. RESUME The mathematical modelling of process of progressing of emergency on the pipe line, pumping-over of liquefied petroleum gass, has allowed to reveal a series of features distinguishing considered process from process of pumping-over of oil. Model can be utilised for a quantitative assessment of progressing of emergency, and also for matching levels of risk for different alternatives trasses of pipe lines while designing.

1149

Imxs-tion on the mitigation during accidental release of heavy gas by technical devices Puls, E., Engelhardt, F., Hartwig, S. Fachbereich Sicherheitstechnik, Bergische Universitat Wuppertal, Gaul3str. 20, 42097 Wuppertal, Germany

ABSTRACT The present paper investigates the efficiency of different types of water curtains to mitigate the consequences of accidental released heavy gas clouds. Two effects are responsible for the mitigation. Firstly the momentum transfer with the effect of entrainment of surrounding air into the heavy gas cloud, and secondly the solution of the chemical compound of the heavy gas cloud in the liquid of the water curtain. Both effects are discussed in this paper. 1 INTRODUCTION

In the past years an increasing massflow, production mass and with that storage and transport of hazardous material has occurred. With optimized process safety, the probability of an accidental release of a toxic and / or flammable gas decreases, but through higher massflows within occuring accidents the catastrophic potential rises [l]. The past has shown that especially the spillage of heavy gases shows a high catastrophic potential. This is true of accidents inside industrial estates and also for accidents during transport. The high catastrophic potential of heavy gases is due to their fluiddynamical behaviour [2]. In order to reduce the consequences of accidental spillage of heavy gases mitigation devices are used [3-51. Through mitigation the concentration in the cloud is to be reduced below dangerous concentrations. For this purpose air-, steamand water curtains are already being used successfully. The dilution of the cloud occurs mainly through entrainment of air into the cloud (dynamic effect). Concentrations are also lowered through physical or chemical absorption of the gas by means of the sprayed liquid. Special emphasis must be put on the analysis of accidents during transport, because in these accidents is an especially high catastrophic potential. The reason for this lies in the high volumes being transported, transport in regions with high population rates and the difficulties of using static devices in order to mitigate consequences of spillage. Fire brigades use different devices for these purposes. These devices have not been fully tested for their usefulness.

1150

In this paper therefore the usefulness of static devices (water curtains) has been evaluated and compared to mobile devices such as Hydroschilde and jet tubes. In addition enhancement of the rate of absorption through additives to the water used in mitigation devices has been investigated. 2 LARGE SCALE EXPERIMENTS

To get information about the different efficiencies of different static (water spray) and mobile (Hydroschild) technical devices, large scale experiments were carried out. Detailed information on the test site and the experimental facilities is available elsewhere, e.g. [6-71. Because of a construction flaw located in the gas detectors, most of the trial data were lost. Nevertheless comparison was possible and the results are impressive. In addition to other values the ground level dose equivalent values and the corrected maximum carbondioxyd concentration were established at different measurement points on the site. The results of the trials showed, that both, Hydroschild and water spray, mitigate the heavy gas concentration. Their use shows a decreasing concentration on the test site down to 530% of the concentration of a release without using technical devices (e.g. fig.1). This mitigation is based on two different effects. The mitigation efficiency of the Hydroschild is based on a canalising effect. The water curtain dilutes the heavy gas in z-direction by air entrainment (fig.2). In contrast to Hydroschild the water curtain produces a nearly monodisperse droplet spectrum. This forces the air entrainment by momentum transfer from the droplets. The mitigation efficiency of the Hydroschild is dependent on the ambient wind speed and the masses released. At masses released higher than 500 kg (mass flow = 7kgls) and a wind speed at higher than 1.5 m f s the gas passes the Hydroschild sidewards.

This Page Intentionally Left Blank

1152

Transferring the data to water based mitigation devices individual sauter diameter and droplet velocities have to be considered. The mass transfer after the flight phase, when the droplets have fallen to the ground, has to be taken into account as well.

ACKNOWLEDGEMENTS This work was supported financially by the Bundesministerium fir Bildung Forschung und Technologie. The authors wish to acknowledge the BASF AG for supporting the mass transfer experiments and the Institut der Feuerwehr Sachsen Anhalt (IdF) on whose test site the large scale experiments were carried out.

REFERENCES [I] Kirchsteiger, C.: Trends in accidents, disasters and risk sources in Europe; Journal of Loss Prevention in the Process Industries 12, p.7-17, 1999 [2] Hartwig, S.: Schwere Gase bei Storfallfreisetzung; VDI Verlag 1989 [3] Barth, U., Hartwig, S.: Heudorfer,Wolfgang: Experimentelle Untersuchungen uber Wasservorhhge als technische MaBnahme zur Konsequenzminderung bei Storfallfreisetzung von schweren Gasen. Chem. Ing. Tech. 60, p.898-901, 1988 [4] Barth, U., Hartwig, S.: Der Wirkungsgrad von Dampfvorh2ngen zur Verdiinnung von Schwergasschwaden bei Storfallfreisetzungen. Chem. Ing. Tech. 61, p. 1026-1027, 1991 [5] Moodie, K.: The use of water spray barriers to disperse spills of heavy gases. Plant Operation Progress 10. 1985 [6] Puls, E., Hartwig, S.: Groaskalige Feldversuche zur Untersuchung der erzwungenen Dispersion von Schwergaswolken durch technisches Feuwerwehrgerat - Ein GerateVergleich von Wirkungsgraden zur Gaskonzentrationsminderung, VDI-Fachtagung Kothen, 2000 [7] Puls, E.: thesis (not completed and published) at the Fachgebiet Gef&liche Stoffe, Konsequenzanalyse, Prof. Hartwig, Bergische Universitat Wuppertal [8] Hartwig, S.: Die Risikoanalyse als Hilfe f i r Sicherheitsentscheidungen am Beispiel schwerer Gase und des Chlorstoffzyklus. Erich Schmidt Verlag; Berlin, Bielefeld, Munchen, 1999 [9] Hartwig, S., Engelhardt, F., Mayr, C., Puls, E.: Risk assessment of railway transport, loading and unloading of rail tank cars and pressurized storage of chlorine in Germany, in: Associacio d'Enginyers Industrials de Catalunya, Loss Prevention and Safety Promotion in the Process Industries - 9th International Symposium - Proceedings 3, Barcelona, 1998 [lo] Astarita, G., Savage, D.W., Bisio, A.: Gas treatimg with chemical solvents. John Wiley & Sons, New York, 1983 [1 I] Engelhardt, F.: thesis (not completed and published) at the Fachgebiet Gef&liche Stoffe, Konsequenzanalyse, Prof. Hartwig, Bergische Universitat Wuppertal

1153

Gas explosion in cement kiln: causes and lessons learned S.Vliegen",E. van 't Oost",A. van den Aarssen", B. Smit-Rijnhart", F.Michelb "DSM Services, Industrial Safety & Reliability, P.O. Box 10,6160 MC Geleen, The Netherlands bENCIN.V., P.O. Box 1,6200 AA, Maastricht, The Netherlands. 1. Introduction On 7 September 1996 a gas explosion occurred at ENCI Nederland B.V., of Maastricht, as a cement kiln (number eight) was heated up by a natural gas burner in preparation of start-up. No personal injuries were sustained. The property damage, however, was enormous: the kiln was heavily damaged and the cyclone tower was completely destroyed. The explosion caused a loss of $25 million and the plant was down for about half a year.

Immediately after the incident ENCI Nederland B.V. requested DSM Industrial Safety & Reliability to investigate the causes of the explosion. This DSM department is an independent team specialised in explosion hazards and process safety. The final report, with findings and recommendations, is summarized as follows. 2. The kiln installation

General No. 8 kiln is a rotating drum 178 meters long and 5.5 meters in diameter, widening to 6.3 meters near the smoke chamber of the cyclone tower. The drum is equipped at the burner side with nine satellite coolers with a length of 20 meters and a diameter of 2.55 meter. The pre-heater consists of a double string each with a two-stage cyclone. A marl drier downstream of the cyclone tower is heated with the hot kiln gases from the cyclone tower. Flue gases are dedusted in an electrostatic precipitator and then discharged

1154

through the stack. Combustion air is taken in by the flue gas fan and two kiln gas fans via the satellites and the air box at the burner. The kiln is shown schematically in Appendix 1.

Burner unit The kiln is fired up in 24 hours from cold or partly cooled down condition seven times a year on average. Pre-heating (firing up) takes place with natural gas. When the kiln inlet temperature is 450 "C, natural gas is gradually replaced with lignite. The main gas burner in the kiln is ignited by an ignition burner located at the centre of the main gas burner. In the burner head of the main gas burner are located, in addition to the four main feed openings, 24 holes to stabilise the main gas flame. The flame of the main burner can be observed by means of a camera with a monitor in the central control room. The ignition burner has two ionisation electrodes, which are connected to an ionisation relay, for dual flame detection. As the safety system is based on these two electrodes, the main burner has no flame detection. Appendix 2 provides a schematic representation of the burner unit of No. 8 kiln showing the mass flows of the individual streams.

3. Time scale of event The explosion occurred at 03.32 am on Saturday 7 September 1996. A few days earlier, on 5 September, the kiln had been taken out of service for inspection of the kiln gas fans owing to stability problems. After the inspection it was decided to start up the kiln again on Friday afternoon 6 September 1996. As problems were encountered putting and keeping the ignition burner in operation, the start-up was postponed until the night shift of 6/7 September. On Friday evening a second start-up attempt was made at about 23.00 hrs. The ignition burner came on without a hitch whereupon the main gas burner was started. As the ionisation electrodes tripped the safety system of the ignition burner, it was decided to inspect the electrodes. One proved to be damaged and was replaced. Soon after, a leak was found in the gas supply to the ignition burner, and this was repaired. Now the ignition burner could be lighted without any problem.

1155

The main gas burner was lighted at 02.06 a.m. and the kiln temperature increased from 115°C to 135°C. Between 02.06 and 03.18 a.m. the natural gas feed rate to the main burner was increased in increments from 900 to 2,340 Nm3/hour. At that point, the operators observed an unusual temperature profile, see Appendix 3. The temperature ceased to increase from 02.18 a.m. onwards, indicating that at that moment the main gas burner must already have gone out. As the operators saw no flame on the monitor at 03.18 a.m., it was decided to conduct a field inspection. Through the inspection hatch no flame could be observed on the main gas burner. It was then decided to shut off the gas supply. The explosion occurred immediately after the gas shut-off valves were closed. 4. Thedamage

Kiln The kiln was not damaged by the explosion except that at a distance of about 140 meters from the burner some refractory bricks had come loose. The encasing of the cooler outlet at the satellites, however, was damaged beyond repair. Cyclone tower The damage to the cyclone tower, in contrast, was enormous. The smoke chamber at the inlet side of the kiln was completely destroyed. The damage was such as to suggest that a detonation or an overdriven detonation had occurred at the end of the kiln. All six cyclones were also heavily damaged. The flue gas discharge ducts, also known as collecting leads, were tom open and torn off from the cyclones in several places. The cyclone tower was cordoned off immediately after the explosion because it might collapse. Other equipment No damage had occurred in the marl drier, the electrostatic precipitator, the flue gas fan and the stack. There was some minor damage to the piping from the cyclone tower to the kiln gas fans.

1156

5. Causes of the incident Initially, the investigation centred on whether replacement of the ionisation electrode (just before the start-up of the kiln) might have been the root cause. This must be excluded. If the electrodes had malfunctioned, the ignition burner flame would have been disturbed. The main burner would not have lighted and the accident would never have happened. Furthermore, no overrides were put in place (this was later confirmed by Gasunie).

Fouled burner Investigation revealed that all 24 stabilizing holes for the gas supply to the main gas burner were blocked. The four main supply openings of the main gas burner were fouled up as well: one opening was blocked entirely, one 50% and the other two about 10%. The fouling product was analyzed by the Chemistry, Environment & Quality department of ENCI, and proved to consist mainly of clinker residues, but also of residues of organic substances. Main flame extinguished With the 24 stabilizing holes blocked, the main burner flame must have been highly unstable. These holes allow natural gas to be premixed with air and ensure a stable flame. As the four openings for the gas supply of the main gas burner were also partly blocked, the exit velocity of the gas was much higher than normal. As a result, hardly any premixing of natural gas and air occurred near the ignition flame. The flame of the ignition burner was completely surrounded by natural gas and no air. So the main gas flame was blown away from the burner tip and was eventually extinguished. For the same reasons the gadair mixture present was not reignited by the ignition burner. These conditions are shown schematically in Appendix 4. The safety philosophy was based precisely on the permanent presence of a protected flame on the ignition burner. This philosophy clearly failed in this exceptional situation. The flame of the main gas burner burned for about 10 minutes and was then extinguished, as described earlier, by a local excess of natural gas. During this transition incomplete combustion occurred for a short time [11. The excess of natural gas in air caused hydrogen and carbon monoxide to be formed. The moment of extinguishment can therefore be

1157

broadly derived from the CO concentration measured in the smoke chamber, where a minor peak was observed at about 02.20 a.m.

Explosive mixtures After the extinguishment of the main flame, the ignition burner remained lighted and the gas feed to the main burner was even increased. This caused the kiln to be filled with a mixture of natural gas and air. The air feed rate heavily affects the gas composition in the kiln. Appendix 5 shows the calculated air feed rates during the start-up phase. Especially during a cold start-up large volumes of air can infiltrate into the system in a number of areas. Because of the low air velocities in combination with air in-leakage, the accuracy of the calculated air feed rates is only + or 25%. On this basis, and in combination with the accurately known natural gas feed rate, the natural gas concentration in the kiln is shown in Appendix 6. This indicates that an explosive mixture formed in the kiln after at least 20 minutes. Given the average gadair flow rate, the gas flow velocity in the kiln is 0.45 d s . This means that the gas mixture travels the length of the kiln (178 m) within ten minutes. At the end of the kiln, the gas is divided and passes through the cyclones and downstream equipment. An explosive gas mixture flowed through the kiln for approximately one and a half hours, so also the upstream apparatus could have been filled with an explosive mixture at the time of ignition. Ignition When the operators found that the main gas burner had gone out, the natural gas supplies to the main gas burner and to the ignition burner were shut off simultaneously. The ignition burner continued to bum for a short time using the gas still present in the feed lines downstream of the shut-off valves. Natural gas flowing out of the main burner had sufficient opportunity to mix with the unreduced supply of combustion air. The ignition flame constituted a perfect ignition source for the explosive mixture which had accumulated throughout the kiln and the cyclone tower, marl drier and electrostatic precipitator. Near the burner was another ignition source which was hot enough to ignite the mixture, i.e. the pilot burner head.

1158

Accelerated explosion It appears from eyewitness accounts that only a few seconds passed between thepoint when the natural gas supply was shut off and the explosion. The laminar flame propagation velocity of natural gas is 3.5 d s . At such a low initial velocity, since the cyclones were damaged only after a few seconds, the flame in the kiln must have accelerated. Recent research into methane/air mixtures [2] by IBExU (Insitut f i r SicherheitstechnikGmbH of Freiberg, Germany) indicates that the flame propagation velocity in a DN 300 line 63 meters long is only 30 d s . The pressure at the end of the line averaged 2 to 4 bar. This pressure was measured after an induction time of 200 ms using methane/air mixtures containing 8.2 and 9.5% by volume of methane. This composition corresponds with that in the kiln at the time of the explosion. The measurements by IBExU indicate that neither stable detonation nor overdriven detonation occurred. What did occur was overdriven deflagration, i.e. deflagration with a subsonic flame speed. Catholic University of Leuven, Belgium, has investigated the pressure build-up, especially in the smoke chamber, on the basis of the damage pattern. This study [3] indicates that the pressure in the smoke chamber must have been as high as 2 bar. The average pressures after 200 ms cited in literature [2] are higher because the containment is sealed. The ENCI kiln, in contrast, was open and included a 90" elbow at the far end. In this elbow occurred on the one hand a lower pressure build-up ahead of the flame front and on the other a certain degree of flame acceleration. The results in [2] and [3] are well in agreement.

Cyclone tower At the time of the explosion, an explosive natural gadair mixture was also present in the cyclone. The natural gas concentration was lower than in the kiln due to air leaking in through the opening between the kiln and the smoke chamber. Further dilution with leakage air lowered the gas concentration still further, and the concentration may have been within the explosion range of natural gadair mixtures. The pressure wave generated by the explosion detached marl residues in the six cyclones. Marl is known to have a flame extinguishing effect. For this reason, among others, the effect of the explosion was less severe in the area of the gas fans. The kiln gas fans themselves were not damaged.

1159

Dilution with infiltrated air and the extinguishing effect of marl dust explains why no damage occurred downstream of the kiln gas fans and further down to the stack.

6. Recommendations Although an investigation has established that the kiln installation of ENCI complies with the applicable regulations (e.g. VISA regulations) [4], DSM Industrial Safety & Reliability has made a number of recommendations aimed at preventing similar explosions in the future. The recommendations include both technical and organisational measures. Technical measures - Add a flame monitoring system for the main gas burner. Until now, only the ignition burner has been monitored. - Supply natural gas to each of the 24 stabilizing holes separately. Blockage will then be prevented by a continuous flow. In addition, fouling of the holes can be detected before start-up. - During start-up, control the primary air supply by means of the axial and radial fans. In that case, the operator has direct control over the flame stability of the main burner. In the current design the air supply is controlled by valves downstream of the cyclone tower. This system is complex and difficult to oversee by the operator. Organisational measures - Improve knowledge and skills of operating and maintenance personnel by means of education and training programmes in accordance with ATEX 118A.

- Record the firing process in a systematic manner by keeping a logbook. - Conduct a Hazard and Operability (HAZOP) study (meanwhile completed).

1160

7. Finalnote DSM Industrial Safety & Reliability has expressed that the Dutch VISA regiilations should provide more detailed guidelines for safe operation of fired heaters. More attention should be paid to the configuration in which the burner operates and to safety in the flue gas section of firing installations. The flue gas should always be analyzed (LEL meter) to detect high methane concentrations. Also, the LEL meter should respond to hydrogen and carbon monoxide to warn of incomplete combustion resulting from incorrect fbel/air ratios.

References 1)

Physical properties of natural gases. 1988 N.V. Nederlandse Gasunie

2)

Forschungsbericht IB-98-5 17 f h e r Untersuchungen zur Normspaltweite bei erhohten Gemischdriicken und zur Gasdetonationen in Rohrstrecken verschiedener Nennweite. Dip1.-Ing. F.Gutte; Dip1.-Chem. F.Flemming; Dip1.-Phys. H.Harte1

3)

Onderzoek van de explosie in ovenbedrijf 8 ; ENCI Nederland B.V., Maastgncht (mei 1997) Dee1 3: Evaluatie van de opgetreden drukken ir. M.Goethals; ir. B.Vanderstraeten; Prof.dr.ir.J.Berghmans

4)

VISA Voorschriften; Aanvulling 5 12 november 1996 Gastec N.V. Apeldoorn

Appendix 1: General overview of the kiln installation of ENCI Nederland B.V.

1161

1162

Appendix 2: Schematical representation of the burner unit of kiln 8 with mass flows

spentglycol natural gas solid fuel air Radial fan 100 m3/min

max. 1800 l/hr max. 1800 m3/hr max. 3 1.2 tons/hr max. 282 m3/min

1163

Appendix 3: Temperature measurement kiln inlet during start-up phase

02:07

03:32

1164

Appendix 4: Schematic presentation of the gas burning process (with stability holes blocked)

vvhm

I I

I

flammable gas mixture

I

flame of ignition burner

i"J

axial air

'

i 1

laturalgas

radial air

h I

I

1165

Appendix 5: Air supplies through the various parts of kiln 8 at the start-up phase

1166

Appendix 6 : Natural gas and air supply to main gas burner during start-up

Time from - to [hh.mm]

2.06 - 2.09 2.09 - 2.14 2.14 - 2.16 2.1 6 - 2.20 2.20 - 2.2 I 2.21 - 2.26 2.26 - 2.27 2.27 - 2.30 2.30 - 2.32 2.32 - 2.36 2.36 - 2.37 2.37 - 2.40 2.40 - 2.42 2.42 - 2.55 2.55 - 2.57 2.57 - 3.06 3.06 - 3.08 3.08 - 3.15 3.15 - 3.18 3.18 - 3.32

*

Natural gas supply main gas burner LNrn'/h] 0 - 900 900 900 - IS00 I050 1050 - 1 I70 1 I70 I I70 - 1350 1350 I350 - 1530 I530 1530 - 1665 1665 1665 - 1800 1500 1800 - 1950 1950 1950 - 2160 2160 2160 - 2340 2340

air supply

10 Nm'/sec

I

Natural gas concentration in kiln tube [V-%] air supply 9 NmVsec

I

air supply 8 Nm'/sec

I

air supply 7 Nm%ec

I

air supply 6 Nm'/sec

2.5

2.5

3.1

3.6

4.2

3.0

3.3

3.5

4.3

5.0

3.3 3.5

I I

I I

I I

4.6

I

5.3

5.4"

1

6.3"

1 1 1 1 3.6

4.2

4.1

4.7

I

7.1"

4 :

5.3 5.8"

6.1" 6.6"

7.7"

5.6*

6.3*

7.1"

8.3"

5.5*

G.l*

6.9*

6.0*

6.7"

6.5 *

7.2*

5.o

8.1*

This mixture is within the explosion range of natural gas in air.

T h e explosion range for natural gas in air at 1bar and 125 "C is lowest explosion limit = 5.4 V-% natural gas highest explosion limit = 16.2 V-% natural gas

9.2"

9.3*

10.8"

1167

An innovative unified model for the rate of air mixing with releases from high velocity sources E. Palazzi, R. Pastorino and B. Fabian0 DICheP - Chemical and Process Engineering Department "G.B. Bonino", University of Genoa, Via Opera Pia, 15 - 16145 Genoa, Italy

1. INTRODUCTION The evaluation of the rate of air mixing with a sudden release of flammable or toxic material is an essential tool for properly designing flares, vents and other safety devices, as well as to quantify the potential risk connected to the existing ones or arising from the various kinds of accidents which can happen in process industries. Moreover, the knowledge of the behaviour of a jet of flammable or toxic materials deriving from ruptures of pressurized vessels is required in studies of hazard assessment and risk evaluation, particularly as concerning the so called "domino effects". With reference to these topics and in particular to high velocity releases of gaseous hydrocarbons, Hoehne et al. [ l ] developed an iterative procedure for the evaluation of the boundaries of the cloud flammable region, making use of experimental data obtained in wind tunnel. An interesting application of this method has been carried out by Brmstowski [2], to evaluate the radiant heating of flares. In a recent work [3], Palazzi showed that a significant subset of Hoehne's data can be really correlated, so to describe the boundaries of the flammable cloud by means of a simple formula. Moreover, it was also demonstrated that a similar approach can be applied to the whole set of the data, resulting in a more general mathematical description of the jet dispersion, applicable to face much more easily the different kinds of design problems concerning upward directed releases. The resulting simple model, unfortunately, is not able to deal with domino effects, since the emerging directions of jets coming from accidents are randomly distributed, which causes different rates of the air entrainment and elevations of the jets axes. As an example, by comparison of the ground level concentrations, a recent experiment in wind tunnel [4] indicated that the dilution of an horizontal jet can be lower up to a factor 2, with respect to that of an identical, upward directed, one. In order to eliminate the aforesaid drawback, a more general model has been developed, so to describe the behaviour of the jet, whatever its emerging direction may be.

1168

The model, validated by means of replicated tunnel experiments, substantially agrees with the existing ones for the limiting cases of horizontal and upward directed jets. The model directly gives the boundaries of flammable clouds and the ground level concentrations of toxic releases; moreover, with some modifications, it can be applied to evaluate the heat transfer on vessels and buildings due to flame radiation and impingement. 2. EXPERIMENTAL EQUIPMENT Experiments were conducted in a wind-tunnel with a length of 3.5 m and a test section of 0.5 m diameter, for a wind speed, u, adjustable in the range 0.1-10 ms-'. The tunnel consists of four sections: air flow inlet; prehomogeneization chamber; transparent testing chamber; post-release chamber, with an adjustable helical fun installed at the end of the equipment. The choice of a circular section allows the attainment of a more homogeneous flow, thus excluding the generation of vortices and consequent stagnation phenomena favoured by sharp corners, characteristics of a rectangular section [5]. In each experimental run, for photograph recording, air is seeded with ammonium chloride (NH4CI), obtained using HCl and NH3 vapours. Compressed air is mixed with this white smoke in a mixing box; the jet exhausts from a tube with diameter = 8 mm, mounted in the testing chamber, with an exit velocity adjustable in the range 1+50 ms-'. A typical jet is represented in Fig. 1, together with the reference system adopted in this work.

Fig. 1 Typical jet evolution with adopted reference system.

x

1169

During experimental runs carried out with analyses of the samples by gasanalysers, the compressed air was mixed with,CO2 in the mixing box. The exhausting sgstem can be trimmed, so to cover a wide range of jet emerging directions, namely from horizontal 80=0" to vertical 80=90°.

3. MODEL DEVELOPMENT 3.1. Jet dispersion in absence of wind The particular case of the behaviour of a jet in calm weather condition will be firstly discussed. This is really the most simple situation since, in absence of wind, the jet axis behaves as a straight line whatever the release direction may be, provided that the jet dilution occurs so rapidly to make negligible the buoyancy forces. As an example, let's refer to Fig. 2, where is represented a jet of density PO and mass flow rate mo, emerging with velocity vo from a vent of diameter do.

Fig. 2. Jet dispersion in wind absence.

Because of the air entrainment, at a distance x from the source, the mean values of the aforesaid jet parameters change respectively in p, m, v and d. According to Cude [ 6 ] ,the jet behaviour at a certain distance from the source, where m>> mo, pzpa and d >>do, can be described with good approximation by means of the equations: mv = movo

(1) 2

mo = ~ / do 4 vopo

d=kox

(4)

1170

where p a is the air density. Eq.(4) results from experimental observations; Ricou and Spalding [7], in particular, found that ko=2tgp=0,32. By solving the model, one obtains: v/vo = lko do/x (po/pa)1’2

(5)

The mean concentration of the release, c (v/v), at the location x, is given by:

and, taking into account that m >> mo, can be approximated by: c = M$M0 mo/m

(8)

and finally, by virtue of Eq.(6):

where Mo and Ma are the mean molar mass of release and air, respectively. So far, only the mean properties of the jet were considered. To take into account the radial distribution of these properties, Cude calculated the release concentration on the jet axis doubling the right hand side of the Eq.(9): c, = 2 M$Mo lnC, &/x (p0/pa)ll2 3.2.Air entrainment Eq.(6) implies that, at any position, the air is entrained into the jet at constant rate: d d d x = mo ko/do(pa/pO)ll2

(1 1)

so ko can be considered as an air entrainment coefficient under calm weather conditions. In the more general case of an uniform wind speed, u, represented in Fig. 1, we assume that the rate of air entrainment remains still constant along the jet axis, according to the equation:

1171

where s is the length of the arc OA and buthe air entrainment coefficient under windy conditions. One can expect that bumainly depends on the excess velocity ofthe jet at the source, v with regard to wind speed:

Then, we assume that the air entrainment coefficient in windy conditions can be expressed as:

In equation (14), k is an appropriate adjustment coefficient, to be determined experimentally, which could depend in some way on O0 and u and must become when u is extremely low.

3.3.Jet dispersion in presence of wind 3.3.I.Horizonta1 releases At first, let’s apply the previous approach, Eqs.(l-4), to the particular case of an horizontal release (80=0, s=x). In describing this situation, it is required to modify the expression of momentum conservation, Eq.( l), as follows:

and to substitute the Eq.(4) with the integrate form of the air entrainment law, Eq.( 12):

where, from Eq.(14):

By solving the model, one obtains:

It should be noted that, in the here considered situation, the dependence of d on x is approximately linear only near the source, since:

1172

ExpeEimeW observatlonsqualitatlvely confirmed the behavzur of d(x) corresponding to the Eq.(20); moreover, the measured axial concentrations practically agree with the Cude hypothesis, that is: ~

In Fig. 3 are reproduced, as a function of the ratio u/v, some values of the parameter bu, calculated fkom the experimental data by means of the Eq.(21). As one can see, the trend of kouapproximately follows the straight line drawn in the figure, corresponding to the Eq.(17) for k = b.Then, it can be deduced that k doesn’t appreciably depends on the wind speed.

0

0.2

0.6

0.4

0.8

1

ulv

Fig. 3 Trend of the parameter K ,,+as a function of the adimensional ratio dv.

3.3.2.Anyhow oriented releases Coming now to the general case of OO>O, the corresponding mathematical description is as follows:

mv, = mOvOz

(23)

1173

where v, and vy are, respectively, the horizontal and vertical components of the mean velocity of the jet:

In this situation, the model accounts for conservation of both the horizontal and vertical components of the jet momentum, Eqs.(22) and (23), respectively. Solving these equations with respect to v, and v, , one obtains:

vz = voz mo/m Then: dddz = v,/v, = vox/voz + bus/dou/voz(pa/p0)’” = cotgoo+ s/a

(29)

where: a = a /keu seneo and:

a = do vo/u (po/pa)li2 is a typical scaling factor used by Hoehne in his work [ 11. Since: ds/dz = [ l+(d~/dz)~]’” one obtains, taking into account the Eq.(29): dddz = [l+(cotgeo+ ~ / a ) ~ ] ” ~ Integrating the last equation with the boundary condition:

s(0) = 0

(30)

1174

we have: s/a = Sh(z/a+b) - cotgeo

(34)

where: b = In[( l+cos~o)/sen~o].

(35)

Combining Eqs.(29) and (34), one obtains: dx/dz = Sh(z/a+b)

(36)

Integrating the last equation with the boundary condition: x(0) = 0 the behaviour of the jet axis is easily determined: x/a = Ch(z/a+b) - coseceo Combining Eqs.(24) and (34), one obtains:

m/m= bua/& (pa/po)”2 [Sh(z/a+b) - cotgeo] which, together with the Eq.(8), gives the behaviour of the jet dilution: c = Ma/Mo l k , &/a (Po/pa)”21/[Sh(da+b)- cotgeo] 4. MODEL VALIDATION

The results of some replicated experiments realized on jets emerging with different directions, namely 45 ”, 60” and 90” are reproduced in Fig. 4. The behaviour of the jet axes is displayed by the points in the figure, corresponding to the positions where the maximum concentrations on the transverse section of the jet were measured. As one can see, the theoretical behaviour of the jets axes, Eq.(37), fits satisfactorily with experimental data. Moreover, experimental results indicate that the coefficient k in the Eq.(14) increases with 8 0 according to the empirical formula:

1175

reaching, in particular, a value of 0,63 for a vertical jet. Making reference to the release concentration on the jet axis, unlike the horizontal jets, a good agreement with the experimental data is obtained by multiplying for 1,6 the right hand side of the Eq.(39), that is: c,

= 1,6 M,/Mo

I&, do/a(po/p,)'~21/[Sh(da+b)- cotgeo]

(41)

The case of the vertical jet was examined with particular accuracy, since it allows a comparison between our results and the ones obtained by Hoehne. Therefore, several experiments on vertical jets were carried out, focusing our attention on the region where the release concentration is of the order of the low flammability limit, for the mixtures of the most common hydrocarbons with air. This is the most interesting region to practical purposes and, according to Hoehne, can be identified as follows, making reference to the range of the nondimensional parameter z l a : 1 Iz/a I 3 , l In the case of vertical jets, the Eq.(37) becomes: x/a = Ch(z/a) - 1

(42)

and can be directly compared whit that obtained by Hoehne:

by virtue of Eq.(30). One can observe, in this way, that the Eqs.(42) and (43) give a very similar behaviour for the jet axis, for z/a>2. On the contrary, as d a diminishes, the Eq.(42) tends to overestimate more and more the horizontal jet deflection, xla, as well as the air entrainment, in comparison with eq.(43). Then, in these situations, our model gives more conservative results, from a safety point of view. Making reference to the axial concentration, in the case of vertical jets, the Eq.(39) becomes: c,

=

1,6 M,/Mo I&, &/a (po/pa)1/21/Sh(z/a)

(44)

and can be only numerically compared with the Hoehne data, being the last one in graphical form.

1176

The results of the comparison are consistent with the previous ones, since the concentrations are very similar for z/a>2, while the values given by the Eq.(44) rapidly decreases together whit z/a, owing to the greater rate of air entrainment into the jet, as already discussed.

Fig. 4. Experimental and theoretical results reported in an adimensional coordinate system and referred to runs performed with jet at different orientations: 45", 60" and 90"

4. CONCLUSIONS

A relatively simple model have been developed to describe the rate of air mixing with jet releases of different emerging directions. The model was validated by means of replicated experimental runs in wind tunnel and by comparison with the results obtained by existing models for vertical and horizontal jets. Besides other results, the model gives in analytical form the behaviour of the jet axis and the jet dilution, allowing to perform a simplified approach to different and practical safety problems related to this topic.

1177

REFERENCES [l] V.O.Hoehne and R.G.Luce, 35th Meeting on MI, Houston, (1970) 1057. [2] T.A.Brzustowski, Canadian Chemical Engineering Conference, Toronto (1972). [3] E.Palazzi, The First European Congress on Chemical Engineering, Florence, 1 (1997) 759. [4] J.Donat and M.Schatzmann, Journal of Wind Engineering and Industrial Aerodynamics 83 (1999) 361. [5] D.M. De Faveri, A.Converti, A. Vidili, A. Campidonico and G. Ferraiolo, Atmospheric Environment 11 (1990) 2787-2793. [6] A.L.Cude, The Chemical Engineer, (1974) 629. [7] F.P.Ricou and D.Spalding, Journal of Fluid Mechanics, 11 (1964) 21.

This Page Intentionally Left Blank

1179

Instantaneous velocity fields and vorticity distribution of the movement of coherent structures at the surface of large-scale JP4-pool fires C. Kuhr",D. Opitz", R. H. G. Mullerb,A. Schonbucherb aDepartement of Chemical Engineering, University of Duisburg, Lotharstr. 1, D-47057 Duisburg, Germany bF.I.B.U.S. Forschungsinstitut fur Bildverarbeitung, Umwelttechnik und Stromungsmechanik, Paul Klee Weg 8, D-40489 Dusseldorf, Germany

Abstract As Pool fires can be formed in accidentally ignited fires in the processing industry, their properties are of both fundamental and technical interest. Velocity fields of the movements of hot spots and soot parcels at the surface of largescale JP4-pool fires (8 m I d I 25 m) are determined with a digital image analysis. The transient vector fields of velocity and the calculated mean velocities as well as the transient fields of vorticity indicate the presence of rotational flows at the flame surface. The velocities of hot spots are in the same order of magnitude as data from literature. It is concluded, that the velocities of hot spots and soot parcels, as well as the vortex structures have a major influence on the intensity of radiation of large-scale pool fires. 1. INTRODUCTION

Since pool fires, which can be formed in accidentally ignited fires in the processing industry, can cause huge hazards due to their heat radiation and pollutant emissions, they are subject of intense research. Detailed knowledge of their flow field and their heat radiation is necessary to evaluate models for predicting possible hazards on neighbouring facilities. A suitable model to predict the heat radiation is OSRAMO I1 [l], which considers the different heat radiation of coherent structures as soot parcels and hot spots and their flame surface fraction. In this paper a method is presented, to determine velocity fields of the movement of these coherent structures (Fig. 1) at the surface of large pool fires (8 m I d I 25 m) from film recordings of their VIS-range. The instantaneous two-dimensional velocity fields and the calculated mean

1180

Fig. 1. Typical coherent structures of a JP4-pool fire with a pool diameter d = 25 m

velocities, as well as the instantaneous fields of vorticity can help to understand heat radiation of these fires.

2. EXPERIMENTAL METHODS The VIS-range of the flame-radiation of large-scale pool fires with pool diameters 8 m I d I25 m were recorded on 16 mm-film. The recording frequency is 50 pictures per second. The setup of the large-scale pool fire experiments is described in Ref. 2. By recording the fires on film, the three-dimensional coherent structures of a fire are projected into the two-dimensional plane of the image. Since radiation from the inside of the fire is blocked by the soot particles [3], only structures at the surface of the fire are visible. The movements of the projections of these structures are determined and a two-dimensional field of velocity vectors is obtained.

2.1 IMAGE PROCESSING METHODS The individual images of a film sequence are digitised using a film projector with integrated CCD-camera and a standard frame-grabber. The velocity vectors are determined, similar to the mathematical analysis in the Particle Image Velocimetry [4], by cross-correlation of the pattern of grey values in the windows g") and g"' in two successive images. The displacement vector S is calculated as the maximum of the cross-correlation coefficient R(?) :

1181

To save computation time, cross-correlation is carried out in frequency domain. The velocity vectors u'(x,y , t ) are calculated from the determined displacement vectors and the known time step of At = 20 ms. The most significant influence on the computation time results from the size of the window used in the correlation. The larger the patterns of the coherent structures are in the image, the larger the window has to be chosen. To achieve a major time saving, the images are resized to the fourth of their original size, so that the correlation window can be reduced appropriately. Since very small structures remain incomplete after the reduction, a suitable filter has to be used to remove remaining fragments of these structures in the image. To achieve this, a 3x3 Gaussian filter is used on the images during their reduction. By adopting this method, which is known as Gauss pyramid [5],the correlation window can be reduced from 64x64 to 32x32 pixels, which leads to a saving of computation time of 80% and allows the analysis of long film sequences in an adequate time. The displacement vectors were determined every four pixels in vertical and horizontal direction, so in the case of the JP4-pool fire with a diameter of d = 8 m, for example, the distance from one vector to the next is 0.66 m. While the small structures are often very short-lived and their projections into the image interfered by noise, the projections of very large structures are bigger than the correlation window. Thus, their patterns are not suitable for the crosscorrelation and have to be suppressed. This is done by using the Difference of Gaussian (D.O.G.) operator [6] on the images. The resulting images keep only the intermediate patterns, the disturbing patterns of very small and large structures are eliminated. While without application of the D.O.G. method the vector fields contain many zero vectors, with its adoption vectors can be determined over the whole surface of the flame. 2.2 VORTICITY The vorticity 9 is computed as the curl of the velocity field and is a measure of

how much rotation exists at each examined point of the flame. In a twodimensional flow vorticity Qz may be written in scalar form as:

1182

The sign of Qz indicates the direction of the rotation. While a negative sign indicates a clockwise rotation, a positive sign indicates a counterclockwise rotation. Since u'(x,y , t ) describes a discontinuous function, the vorticity Qz is obtained by differentiating the velocity field using a finite difference analysis.

3. RESULTS

3.1 VELOCITIY Fig. 2 and 3 show two examples of transient velocity fields, determined for JP4pool fires with a diameter of d = 8 m and d = 25 m, respectively. The velocity vectors show the movement of the pattern of coherent structures projected into the two-dimensional image plane. For a clearer representation, velocity fields with a shift of eight pixels between each vector is printed. The shown velocity fields of the large pool fires differ clearly from fields of flow velocity of small pool fires (d c 1 m), which can be estimated with the Particle Image Velocimetry (PIV) [4], for example. While almost all of the

Fig. 2. Transient velocity field of the movement of hot spots and soot parcels at the surface of a JP6pool fire with a pool diameter d = 8 m

1183

Fig. 3. Transient velocity field of the movement of hot spots and soot parcels at the surface of a JP4-pool fire with a pool diameter d = 25 m

velocity vectors of small flames point downstream, in both flames above many of the vectors point upstream. The reason for this is the development of coherent structures like soot parcels. These rise with a certain velocity, but at the same time they perform a considerable rotation. In higher regions of the flame, where the vertical velocity of the soot parcels becomes lower, the angular velocity at the surface of these structures dominates and the particles on their surfaces flow upstream. This becomes clear in Fig. 4 and 5, where the mean velocities of a JP4-pool fire with d = 8 m in different dimensionless heights d d are shown. The velocities were averaged over 384 images or 6.84 seconds, respectively. The mean velocities ii and in vertical direction have nearly the same value and direction up to a dimensionless height d d = 2. With increasing height, tends to become smaller, until many of its values become even negative. This shows, that due to the rotation of the structures, in higher regions many of the flame particles at the surface of this fire flow upstream. The reason for the appearance of most negative values for y > 0 was a windy condition, which slightly inclined the fire.

zx

zx

1184

surface of

7-

xld

6-

u)

Y

It3

A 0.7

5-

-1.3

-

4-

*1.9

-2.8

3-

2:

1-

3.4 5.0

0-

-1 -

-2.

I

,

I

.

I

8

I

I

,

I

,

Fig. 5. Mean velocities Ex of the movement of hot spots and soot parcels in vertical direction at the surface of a JP4-pool fire with a pool diameter d = 8 m

Apart from soot parcels, an occasional rise of hot spots can be observed. These consist of hot gas particles, which have higher temperatures than the soot and consequently rise faster. This becomes clear by comparing the mean velocities ii with the maximum velocities umax in Fig. 6. The maximum velocities of this JP4-pool fire, for example, are up to a factor of 1.7 higher than the mean velocities. The hot spots rise with up to umax = 12.4 d s , while the mean velocity, which is dominated by the slower, but more often observed soot parcels, is only up to U = 7 d s .

1185

12-

-. cn

E

I

E 3

10-

A

x/d 0.7

-1.3

8-

642-

0-20

0

-10

10

20

30

Y [ml

Fig. 6 . Maximum velocities umax of the movement of hot spots and soot parcels at the surface of a JP4-pool fire with a pool diameter d = 8 m x/d 0.2 9- 4 8- *0.4 7- --+-0.9 65-

107

-P E

Y

E

3

43210-

-11

-20

.

,

-10

6

.

,

0

.

,

10 Y

.

I

20

.

,

30

.

,

40

.

1

50

[ml

Fig. 7. Maximum velocities um,of the movement of hot spots and soot parcels at the surface of a JP4-pool fire with a pool diameter d = 25 m

The maximum velocity of a JP4-pool fire with d = 25 m is determined as ii = 9.2 m/s (Fig. 7). This shows, that the influence of vortices on the ascending velocity of coherent structures becomes more important with increasing diameter. Despite of the much larger pool diameter of d = 25 m, the difference in the maximum velocity is not nearly as big. This is in agreement with studies by Takahashi [7]. He determines for kerosene pool fires with diameters of d = 30 m and d = 50 m ascending velocities of hot spots of u = 15 m/s and u = 16 m/s, respectively. These ascending velocities are in the same order of magnitude as the determined maximum velocities in this work. The differences

1186

of the values may occur because of the larger pool diameter and the different types of fuel. Because of the higher velocities of the hot spots, in comparison to the soot parcels, their residence time at the flame surface is much shorter. This affects the duration of the heat radiation maxima, which are coupled with the attendance of hot spots. The shorter residence time may also affect the heat radiation model OSRAMO I1 [l], since it considers the hot spot’s mean flame surface fraction. This mean fraction depends on the mean size of the hot spots, the frequency of their rising and their velocity.

3.2 VORTICITY Fig. 8 shows an exemplary scalar field of vorticity Qzand its corresponding field of velocity vectors of a JP4-pool fire with a diameter d = 8 m. The determined vorticities are between Qz = - 4.3 and Qz = 3.9. From the marked regions { 1) and {2), the existence of vortices due to shear forces can be concluded. In region { 1) the vorticity Q2 is clearly higher than in the ambient regions. Thus, a counterclockwise rotation takes place. In region { 2) the amount of the vorticity Qzis also higher, but the values are negative. Thus, a clockwise rotation takes place in this region. The estimated vorticities Q2 of this flame are in agreement

Fig. 8. Instantaneous field of vorticity of a JPCpool fire with d = 8 m. The marked regions { l } and (2) indicate a clockwise rotation ({Z}) and a counterclockwise rotation ({ l}), respectively, which is in agreement with the forming of vortices

1187

with the generation of vortices. The generation of these vortices has direct effects on the intensity of radiation. The intensity of radiation as a function of theheight, changes with the movement of vortex structures like soot parcels or hot spots [8]. Both the maximum and minimum of the intensity of radiation move with the rise of the vortex structures. Because of the lack of experimental data on large-scale pool fires, the validation of the calculated vorticities Qz is not yet possible.

4. CONCLUSIONS Instantaneous, two-dimensional velocity fields and vorticity distribution of the movement of coherent structures at the surface of JP4-pool fires with d = 8 m and d = 25 m have been determined by digital image processing methods and the following conclusions have been derived. 1. The maximum velocities, which can be assigned to hot spots, for the pool fires with d = 8 m and d = 25 m are 12.4 m/s and 9.2 d s , respectively. This is in the same order of magnitude of literature data for similar pool fires. 2. The instantaneous vector fields show, especially in the higher regions of the flame, many upstream pointing vectors. This indicates a rotation of the coherent structures, in this case the soot parcels, which is intense in comparison to their rising velocity. 3. The determined vorticities are between QZ = - 4.3 and Q, = 3.9. The vorticity distribution of the JP4-pool fire indicates rotations at its boundaries, which are in agreement with the generation of vortices. 4. The application of these investigations is to achieve a better understanding of the movements of hot spots and soot parcels, which influence the heat radiation of large-scale pool fires. This may result in an improvement of the OSRAMO I1 - model [l], as it considers the mean flame surface fraction of the hot spots and soot parcels and their intensity of radiation. 5. On the base of the results, CFD (Computational Fluid Dynamics) - modelling of large-scale pool fires will be made and the results will be used for verification.

REFERENCES [l] D. Gock, R. Fiala, X. Zhang, A. Schonbucher, TU 33 (1992) 4,137 [2] C. Balluff, VIS-Ballenstrukturen und Oszillationen in GroBflammen, Dissertation, Universitat Stuttgart, 1989 [3] H. Koseki, T. Yumoto, Fire Tech. (1988) 33 [4] X. C. Zhou, J. P. Gore, 27. Symp. (Int.) Combust. (1998) 2767 [5] B. J a n e , Digitale Bildverarbeitung, Springer-Verlag, Berlin Heidelberg, 1997

1188

[6] J. C. Russ, The Image Processing Handbook, Springer-Verlag, Heidelberg, 1999, pp. 263-265 [7] N. Takahashi, M. Suzuki, R. Dobashi, T. Hirano, Fire Safety J., 33 (1999) 1 [8] S. Staus, A. Schonbucher, in: Scientific Computing in Chemical Engineering II; F. Keil, W. Mackens, H. Voss, J. Werther (Eds.), Springer Verlag, Berlin ,1999, pp. 417-424

1189

Experience with the What If analysis applied to specific operations or chemicals Christel Perret, Jean Claude Adrian

ATOFINA - CTL Chemin de la L8ne BP 32 69492 Pierre Benite Cedex France ABSTRACT Hazard evaluation encompasses a wide range of process industry activities. These include research and development work, engineering studies at various stages, routine operation of plants, accident investigations, etc.. .Among the numerous techniques available, HAZOP (Hazard and Operability study) and FMEA (Failure Modes and Effects Analysis) are widely used. However, due to their highly structured features, these techniques may exhibit major drawbacks when applied to specific operations or chemicals. As indicated by CCPS (Center for Chemical Process Safety) in their "Guidelines for Hazard Evaluation Procedures", the What If analysis technique is the most versatile. Our experience has shown that this technique, together with specific checklists, is the best choice when reviewing specific operations such as startups and shutdowns, or when reviewing operations with specific chemicals such as peroxides. Atofina uses a computerized What If code. The main advantages in using such a tool are : Focusing the group's attention on the topic being discussed Issue memos right after the meeting and therefore speed up any potential feed back 0 Gain in flexibility by choosing keywords relevant to the operation or chemicals being discussed 0 Globalize the discussion around unit operations or process stages.

1190

It is generally recognized that the What If analysis technique requires a better understanding of the process being reviewed. We found, however, that one major advantage is the ability to adjust the analysis to the complexity of the topic. This results in the hazard review being simultaneously shorter, more efficient and better documented. INTRODUCTION ATOFINA has been using standard hazard evaluation techniques for many years, namely the Preliminary Hazard Analysis technique, the Hazop Analysis technique and the Cause-Consequence Analysis technique. These techniques are powerful tools and they generally allow satisfactory completion of hazard evaluations. It was found, however, that added flexibility was required for situations encountered with specialty chemicals or during batch operations, startups and shutdowns. ATOFINA therefore developed a technique which allows to combine the findings of the Preliminary Hazard Analysis with such versatile techniques as the What If or the Cause-Consequence technique. This paper describes how this technique was developed and can be used. HAZARD EVALUATION METHODOLOGY AT ATOFINA Our hazard evaluation methodology is based on three hazard evaluation techniques : 0 the Preliminary Hazard Analysis [ 11 the Hazop analysis 0 the Cause-Consequence analysis. The Preliminary Hazard Analysis is essentially used during the early stages of engineering studies but has also been proved useful to check the adequate operation of a production unit or for accident investigation purposes. Its objective is to identify hazards and safeguards and incorporate these into later studies to avoid otherwise costly delays and change orders. A Hazop Analysis is generally conducted later during the detailed engineering stage to check PID's before approval for construction.

A Cause-Consequence Analysis may be preferred to a Hazop Analysis when complex processes exhibit generic type of hazards. This would be the case with a stream cracker unit, for instance.

1191

The Preliminary Hazard Analysis is the workhorse of our hazard evaluation methodology. Its purpose is to help us gain a thorough knowledge of the hazards associated with the operation of a new or existing unit. It deals with the following topics : 0 hazards related to the products being used hazards related to the plant surroundings 0 known incidents and accidents process hazards 0 environmental hazards occupational hygiene. Identification and evaluation of process hazards and associated safeguards are major components of the Preliminary Hazard Analysis, as they directly translate into action items for engineering studies. The information gathered in the first three topics -product hazards, plant surroundings hazards and known incidents and accidents- is the basis for covering the process hazards section. Although gathering the needed information essentially is a one person's job, it may be useful to cover the process hazards analysis by means of a group review. The analysis technique used for this group review should be versatile as information items very different in nature are being handled. On the other hand, identification of all potential hazards is a must. Choosing the right tool to conduct this analysis is a difficult task as these two criteria are somewhat in contradiction. EXPERIENCE WITH THE WHAT IF TECHNIQUE CCPS [2] in its "Guidelines for Hazard Evaluation Procedures" provides a comprehensive description of the What If analysis technique, when and how to use it.

A What If analysis is a very powerful technique as it may cover all types of concerns. It provides answers in terms of cause / consequence / safeguards / recommendations topics to the generic question "What if.. . ' I . It is very flexible and versatile by nature and appears therefore to be well suited for products having specific characteristics ( e g organic peroxides), for specific unit operations ( e g incineration) or for specific operations (e.g. startup and shutdown). It can also be used in a wide range of circumstances : research or conceptual design, preparation of startup and shutdown procedures, incident or accident investigation.

1192

Although these constitute invaluable assets, the What If technique also shows one major drawback. The answers generated are no better than the questions asked, or even worse : no question asked, no answer. In other words, a lesser experienced review group will most likely miss hazards, a situation which cannot be tolerated. This drawback is well known and an improved technique, the What IfXhecklist technique, has been developed. Here again, information on this technique may be found in the CCPS guideline (ref. 1). The checklist is a generic list of "What if . . . ' I questions which is made available prior to the review. We experimented with such a technique. We found out that using a generic checklist helped somewhat in the completeness of the review. However, what was gained in structure was lost in flexibility. Adding group generated "What if ... I ' questions only marginally improved the situation. Furthermore, the generic checklist added situations of no concern to the review. Based on the experience thus gained we came to the conclusion that the "What if ...I1 questions should be generated based on the findings in the Preliminary Hazard Analysis. This would provide both flexibility and completeness, which is our objective. IMPROVED WHAT IF TECHNIQUE

Fig. 1 is a schematic diagram of how hazardous situations are generated. Horizontal layers correspond to causes which generate consequences on the layer right above, which in turn are causes for the next consequence layer. The bottom layer thus corresponds to initial causes and the top layer corresponds to the ultimate hazard. For instance, an instrumentation failure may lead to a process deviation, further leading to a loss of confinement which ultimately may lead to a vapor cloud explosion. The hazard assessment review may be structured according to the same scheme. The successive layers are addressed, preferably from bottom to top, to generate "What if ...I1 questions. This gives us the order in which questions are generated, as well as the immediate cause and immediate consequence. This scheme greatly helps in being exhaustive throughout the review and also clarifies the cause/consequence relationship. It does not give us the exact nature of the questions to be asked.

1193 Fig. 1 Hazard review sehem

The nature of the questions to be prompted derives from the information gathered in the Preliminary Hazard Analysis. Let us assume, for instance, that we operate a reaction producing an organic peroxide. We know from the Preliminary Hazard Analysis that the reaction is highly exothermic and that the peroxide is heat sensitive. Should a decomposition occur, then the decomposition gases are flammable and spontaneous ignition is likely. The initial design of this reactor (Fig. 2) provides brine-cooling and the brine flow controls the reactor temperature. Furthermore, the reactor is protected against overpressure by a rupture disc. The Preliminary Hazard Analysis data suggests the following question to be asked during a hazard review : "What if the reactor temperature increases above its normal operating value ?". One possible cause would be the temperature control failure leading to the closure of the temperature control valve. This would lead to the following series of consequences : a rise in reaction kinetics a further rise in temperature the product decomposition

1194

0

a pressure increase the rupture of the disc the release of flammables into the atmosphere and ultimately ignition of the decomposition gases

Ignition within the process area may be considered intolerable. Fig. 2 Peroridc r e a c h TO SAFE LOCATION

KUI”I‘UKY UISC

T

This analysis leads to the following recommendations : 0 we may want to add some preventive safeguard : this could be using direct relaying for the temperature control instead of using the DCS (distributive control system) 0 we may want to add some corrective safeguard : this could be a high temperature control which fully opens the brine flow at a given set temperature ; this safety instrumentation may be considered critical and should be treated accordingly we may want to consider some mitigating safeguard : this may be locating the vent exit in a safe area or providing a fire-proof protection to eliminate fire impingement on process equipment or instrumentation lines. The input from the Preliminary Hazard Analysis via “What if ...‘I questions (left hand side of the diagram) leads to engineering actions or requirements as an output (right hand side of the diagram via the hazard review (central core of diagram). This being done in a structured way helps in speeding up the analysis and ensures that the analysis is exhaustive.

1195

Finally, since questions are asked in an open form, there remains ample flexibility& adapt these questions to the operation being reviewed (continuous, batch, transient operation), as well as specific properties of the products being handled. It is worth noting that what is described in this paper as a modified What If technique can be adapted to obtain a similarly modified Cause/Consequence technique. CONCLUSION

ATOFINA was looking for a hazard analysis technique which would be simultaneously flexible, versatile and exhaustive. Existing techniques include the What If analysis and the Hazop analysis. While the What If analysis is flexible and versatile, there is a high risk of missing hazards when this technique is used by non expert personnel. The What If/Checklist variation of the method only marginally changes this situation. On the other hand, the Hazop analysis is very structured and hopefully also more exhaustive. This technique, however, cannot be used at early engineering stages or is unnecessarily cumbersome when dealing with specialty chemicals or transient operations. By using the information gathered from a Preliminary Hazard Analysis to generate process-specific or operation-specific questions used in a What If analysis, we were able to come up with a hazard analysis technique which was simultaneously flexible, versatile and exhaustive. REFERENCES [ 11 Preliminary Hazard Analysis, Atofina (Proprietary documentation). [2] CCPS, Guidelines for Hazard Evaluation Procedures, AIChE, 1992.

This Page Intentionally Left Blank

1197

Explosion safety in gas transferring systems without using external control A.D. Tyulpinov, M.A. Glikin State Research and Design Institute of Chemical Engineering "Khimtekhnologiya", Vilesova st. 1, 93400 Severodonetsk, Lugansk reg., Ukraine Flame arresters used in industry at present localize burning without extinguishing it. To stop burning the flow of combustible mixture has to be cut off. A new approach is proposed to extinguish flame without interrupting the flow based on use of catalytically active material as a flame arrester packing (Tyulpinov A.D., Glikin M.A. Elimination of emissions into atmosphere and equipment shutdown during inflammation of combustible gaseous and powdedgas fluids. The 9-th International Symposium on Loss Prevention and Safety Promotion in the Process Industries, Barcelona, May 4-7, 1998). Investigations in this area found out the presence of a high-temperature zone of catalytical oxidation of combustible components. The influence of gas flow rate through the bed on stability of the high-temperature zone position and its velocity in longitudal direction has been studied. The data obtained were used to develop a novel method of explosion protection in operation of gas transferring systems. A typical method requires additional means to maintain a desired catalyst temperature and have a flame arrester of rather a complicated design with insufficient reliability attributed to built-in heat-exchanger with heat carrier flow controller, temperature controller, control system of heat carrier flow, which increases failure and misoperation probability of an explosion safety system. Our purpose was to improve the explosion safety of gas transferring systems by maintaining corresponding gas inflow rates to provide cooling of the catalyst bed after the flame has been extinguished. It allows to eliminate measures maintaining temperature regime of the catalyst by supplying heat carrier to heat exchanger and therefore to exclude the heat- exchanger from the flame arrester design which, in its turn, enables to simplifj the flame arrester design and make it more reliable.

1198

Safety method for gas transferring systems including passing through the flame arrester element comprising a fixed bed of oxidizing catalyst in amount effective to convert 0,55 of the gas to be oxidized is achieved by preliminary determination of the heat propagation velocity of catalytical oxidation zone and starting fluidization velocity of catalyst particles. Gas flow rate in flame arresting element under normal conditions and free cross-section is limited by Wp < Wn < Wb range for non-contracted fixed catalyst bed and Wp < Wn for contracted fixed catalyst bed, where Wp - heat propagation velocity of catalytical oxidation zone; Wn - gas flow rate in the flame arresting element Wb - starting velocity of under normal conditions and fiee cross-section; catalyst fluidization. The upper limit of gas flow rate for contracted fixed catalyst bed is not defined, that is maximal velocity is not limited. Transfer velocity of high-temperature zone is determined by combustion mixture and catalyst bed paramenters ( Fig. 1,2 ).

40 20

0 -20 -40

-60

Fig. 1 High temperature zone transfer as a function of packing type and natural gas concentration in the mixture with air: 1 - iron-chromium catalyst; 2 palladium catalyst.

- quartz; 3 - alumina -

1199

WP, cm/hr

t

100

50

0

-50

t 4

Fig. 2 High temperature zone transfer as a function of flow rate: 1 - alumina-palladium catalyst; 2 - iron-chromium catalyst; 3 - nickel catalyst.

By maintaining gas flow rate in the flame arresting element at normal conditions relative to its cross-section, within the range that is higher than the heat propagation velocity of catalytical oxidation zone but lower than the starting velocity of fluidization, the decrease in packing temperature down to initial temperature before ignition is provided after the flame has been extinguished. Layer-by-layer cooling of fixed catalyst bed occurs using cold make-up mixture of combustible gas. Local volumes are excluded fi-om the reaction volume. When contracted fixed catalyst bed is used the upper limit of gas flow rate is not limited as no heat transfer will occur due to the lack of mass transfer in the bed volume. So in both cases there is no need in additional procedures connected with catalyst bed cooling down to the temperature existing before ignition ; supplying heat carrier to the heat-exchanger when packing temperature rises to catalyst operating temperature; interrupting heat carrier supply when the packing temperature gets not higher than catalyst starting temperature ( Table 1).

1200

Table 1

Flame localization without interrupting the combustible gas tlow. No Catalyst Space Gas flow Relationship of gas flow rate volume, velocity of rate, Wn, (Wn), heat propagation velocity of ml gas mixture, d s e c reaction zone (Wp) and starting m3h velocity of catalyst fluidization ~

(wb)

1. 2. 3. 4. 5. 6. 7.

8.

9.

250 270 300 295 325 400 460 600 650

235 2,7 390 3,3 33 4,o 5,o 690 6,s

0,35 0,38 0,43 0,47 0,50 0,57 0,70 0,85 0,92

wp <wn <wb

wp <wn <wb wp <wn <wb

Conversion efficiency of the feed to be oxidized 0,62 0,62 0,62

wp <wn <wb

0,55

wp <wn <wb

0,60 0,62 0,60 0,62 0,62

wp <wn <wb wp<wn wp<wn wp<wn

When the heat propagation velocity of catalytical oxidation zone exceeds the gas flow rate then no cooling occurs either in a non-contracted or in contracted fixed catalyst bed and the combustion mixture is oxidized in the packing volume. When the gas flow rate exceeds starting velocity of the non-contracted fixed bed fluidization, catalyst particle stirring results in intensive heat transfer in the bed volume, oxidation occurs throughout all catalyst volume and no temperature drop takes place. Thus the novel method of explosion protection for gas transferring systems provides for independent, external control-fi-ee effective flame localization and extinguishing without interrupting the combustible gas flow.

Topic 8

Safety and environment in specific process industries

This Page Intentionally Left Blank

1203

Sources and solutions of fire and explosion in semiconductor fabrication processes J. R. Chen Department of Safety, Health and Environmental Engineering National Kaohsiung First University of Science & Technology 1 University Road, Yenchau, Kaohsiung, 824, Taiwan

1. INTRODUCTION Semiconductor fabrication processes are special kind of chemical processes. The semiconductor manufacturing industries differ from the chemical process industries in the types and quantities of chemicals used, and the way chemicals reacted. Although the semiconductor industries use much less chemicals compared with the chemical industries, the widespread use of exotic chemicals such as silane, nitrogen trifluoride, etc. in the semiconductor fabrication processes rendered the “fab” extremely vulnerable to fire and explosion. This paper focuses on the fire and explosion hazards of semiconductor fabs from the point of view of chemical process safety through several illustrated examples. Differences and similarities of the hazards between semiconductor fabs and chemical plants are highlights. Although current chemical process safety technologies can be readily applied to the semiconductor fabs, further works are required to completely elucidate the sources and solutions of the hazards in semiconductor fabs. 2. HAZARDS IN THE SEMICONDUCTOR PROCESSES

Semiconductor fabrication processes are usually divided into the following categories [l-31: 0 Implant/diffusion - introduction of dopant impurities into silicon substrate 0 Thin films deposition - growth of films as silicon substrates, insulators or conductors 0 Photolithography - transfer patterns from photomasks to the silicon wafer through exposure and photoresist development 0 Etching - remove unwanted patterns on the wafer by wet chemical etching or plasma etching The fabrication of complex integrated circuit (IC) is in fact repeated applications of the above processes for tens to hundreds times. Most chemicals or gases used are corrosive, flammable, pyrophoric, and toxic such as silane, nitrogen trifluoride, etc. All processes are enclosed in a cleanroom to minimize the contamination from particles in the air. The semiconductor industries are

1204

also highlighted by the rapid advances of technologies in order to deliver everincreasing complexity chips at ever-decreasing cost. Thus, unlike the chemical industries where the same plant can produce the same product for almost 20 to 30 years, a fab built 10 to 15 years ago would be out of date and probably bulldozed for new fabs. Although the semiconductor industry is evolving rapidly leading to increasing complexity, its loss experience on the other hand is minor compared with that of the chemical process industries. Factory Mutual Research Corporation (FMRC) reported that there were 407 reported incidents worldwide between 1977 to 1997 [4]. 52% of these incidents were resulted from fire and explosion. Ten years average cost of an incident was only US$ 812,650. These loss experiences indicate that the semiconductor industry was safer compared with the chemical process industries, possibly owing to very low inventory of chemicals and gases. Recently, however, the cost of an incident is increasing dramatically owing ever-increasing capital investment in the new fabs. Two recent fab fires in Taiwan in 1996 and 1997 [4] resulted in loss exceeding US$ 220 million and US$ 470 million, respectively. Both fires were believed to originate from very small sources of chemical or gas fires. In addition to huge property loss, the operations in both fabs were also interrupted for more than two years. Thus, the industry is gradually reaching consensus that any fire, no matter the size, is not tolerated. Identification of all the potential sources of fire and explosion is the most important task for all fabs. In the author’s own experiences [5], the hazards in the semiconductor fabrication processes differ from the hazards in the chemical processes in the following aspects: 0 Flow rates in semiconductor processes are several order of magnitudes smaller than that of chemical processes. Thus, never overlook a small line, even a 1/4” line in the fab. 0 Flows in semiconductor processes are recipe-based rather than the continuous, uniform flow in chemical process. Thus, recipe-based hazard analysis is required for every line. 0 Consequences of hazardous operations in semiconductor processes differ significantly from those of chemical processes and are also difficult to assess. Further studies on the consequence analysis are generally needed. 0 The acceptable risk in semiconductor processes is much lower than those of chemical processes. Simultaneous failures are also considered necessary. In the following sections, some potential sources and possible solutions of fire and explosion in the fab is highlighted though case histories. Comparable hazards in the process industries are also highlighted whenever possible.

1205

3. FIRES IN PHOTORESIST STRIPPER PROCESSES Photoresist coating, exposure and removal are the major steps in photolithography for transferring pattern from photomasks onto the wafer. Among these steps, the photoresist removal step involving immersing wafers in a photoresist stripper solution at elevated temperature. As most photoresist stripper solutions are flammable as well as corrosive, great cares must be made regarding the heating of the solution. Improper heating of the solution will lead to fire of the chemical station. In one case, a stripper solution containing hydroxylamine, ethylamine and pyrocatechol was used in a chemical station for positive photoresist removal. The solution was stored in a quartz tank and heated by a quartz-coated electric immersion heater. Unfortunately, the quartz coating was leaking probably due to poor maintenance and the stripper solution contacted the heating elements directly and led to a fire on the tank. Luckily, the fire was detected by IR detector and extinguished by an automatic carbon dioxide system. The fire was limited to the chemical station and did not spread to other process modules. A better heating design is to heat the liquid in a remote, safe place and circulate back to the liquid tank. However, special cares must be taken in the circulation loop. In another case, air bubbles trapped on the circulation loop resulted in poor heat transfer and increase heating power. The excessive heating power eventually led to a local hot spot that ruptured the PFA circulation tube. Liquid was spilled and ignited. The fire was again extinguished by an automatic carbon dioxide system. Similar incidents are numerous and have led FM data sheet 7-7/17-12 [6] to recommend that the process liquid heating should be done using heat transfer systems using hot water or other noncombustible heat transfer media instead of direct heating. In the process industries, the direct heating of flammable liquids is a common practice of process operations. The fire hazard is simply eliminated by removing the oxidant, namely purging nitrogen in the vapor space. In chemical stations, nitrogen purging is rarely used as the tank has to be opened for transferring wafers. Instead, noncombustible constructions, IR fire detectors, leak detectors and automatic carbon dioxide systems are almost mandatory for fire safety in chemical stations.

4. FIRES AND EXPLOSIONS IN PROCESS EXHAUST SYSTEM 4.1 The process exhaust system A semiconductor fab usually consists of tens to hundreds of process modules. Each process module requires individual supplies of gases or chemicals. In cases of chemical vapor deposition (CVD) or plasma etching modules, reactant gases

1206

are fed into the reaction chamber through mass flow controllers at the gas box. The chamber is maintained at vacuum by a vacuum pump. The gases pumped out may contain unreacted gases and product gases or solids. Very often, these exhaust gases are disposed by a local scrubber and vented to a collection header (pipe) and eventually to a main exhaust header and a main scrubber for final abatement of the gases as shown in Fig. 1. Indeed, the exhaust system looks very much like a flare header system in a typical petrochemical plant. However, several features render an exhaust system more complicated and possibly more hazardous compared with a flare system. These features include: 0 The gases from process chambers may contain flammable, pyrophoric as well as corrosive and oxidizing gases. In principle, the local scrubbers should render these gases harmless before vented to the exhaust system. 0 The exhaust system usually contains air, mostly originated from burning air of the local scrubber. 0 The exhaust system may contain solid generated in the chamber and carried over from the local scrubber. 0 The corrosive gases may be trapped by water mist from local scrubber and condensed on the exhaust lines. In short, the safety of the exhaust system relies very much on the effectiveness of the local scrubber. The performance of the local scrubber is rarely evaluated and is generally unknown. Below are several cases showing how incidents occurred in the exhaust system.

4.2 Explosions in local scrubbers An in-situ doping polysilicon (DPOLY) process uses silane (SiH,) for the polysilicon film deposition and phosphine (PH,) as the dopant of phosphorus. The process operates in a low pressure, vertical furnace with a throughput of 150 wafers per batch. The process chemistry can be summarized as follows [l, p.2311: (1) SiH4,g) + s i (s) + 2 H2(g) (2) 2 PH3 (g) -+ 2 P(S)+ 3 H2 (g) Both silane and phosphine are decomposed in the furnace by high temperature to form silicon and phosphorus, which are subsequently deposited on the wafer surface forming doped polysilicon. It should be note that not all solid formed will deposit on the wafer. Frequently, solids are carried out by the carrier gas. Both silane and phosphine are supplied from central gas cylinders, regulated at a valve manifold box (VMB) and metered at a gas box before fed into the furnace chamber. Chamber pressure is controlled by a vacuum pump. The exhaust from the pump is fed into a scrubber called CDO (Controlled DecompositiodOxidation) [7] to dispose residual silane and phosphine. The CDO has a heating section for decomposing/oxidizing flammable gases and a wet scrubbing section for removing powder or water-soluble gases.

1207 Gases from facility Gases h-om facility

Sub-FAB .....................

VMB

........................................

Gas box

FAB

Reaction Chamber

$338

.........

...............................................................................................................................

Sub-FAB

Nz Air N2

-

Local

scrubber

Atmosphere

Sub-main exhaust Sub-main exhaust Facility

scrubbe

Fig. 1. Schematic diagram of a typical process exhaust system.

The flow rate of silane for a DOPLY furnace is around 1.5 standard liter per minute (slm) and the flow rate of phosphine is around 80 standard cubic centimeter per minute (sccm). The process has been operating for more than half a year without a major problem except that the CDO required frequent maintenance to clean up powder in the wet scrubber section owing to the silicon powder in the carrier gas. One day, a DPOLY furnace was undergoing a recipe change. The new recipe required continuous feed of silane and phosphine for eight hours, which is longer than normal recipe of one hour. On second batch of the new recipe, a sump tank in the CDO beneath the wet scrubber was exploded. There was no fire but the exhaust gases escaped into the fab and resulted in a fab evacuation. After the wet scrubber was removed and opened for inspection, it was found that the wet scrubber was completed plugged by silicon powder. Preliminary calculations reveal that at least 1 kg of silicon was generated during a batch of deposition. A CDO wet scrubbing section has a diameter of four-inch and packs

1208

with packing. Undoubtedly it was unable to remove large amount of powder. Thus, the CDO requires regular maintenance, preferably once per batch run for the new recipe. Another design deficiency of the CDO is that there is no highpressure alarm in the CDO system. As the CDO is designed to operate at slight vacuum, pressure indication is also limited to a few inches of water. A highpressure alarm and gauge will provide an indication of powder plugging conditions. A similar accident also occurred in a metal etching process with a CDO scrubber. The undesired aluminum metallization pattern is usually removed by chlorine and boron trichloride (BCl,) [l, p.3591: (3) A1 (s) + c12 (g) + AlC13 (s) (4) A1203 (s) + BC13 (g) B2°3 (s) + Mc13 (s) There are also side reactions for this process: (5) A1C13 (s) + H2° (I) A1203( s) + HC1(g) (6) (I) + B2°3 (s) + HC1 (g) BC13 (g) + H2° (7 ) c12 ( 9 ) + H2O (I) + HC1(I) + HOCl (I) This process is worse than the DPOLY as the exhaust stream contains not only solid powder but also corrosive gases. In this case, the water spray nozzle was completely corroded by the acidic gases. The water in the wet scrubbing section was then distributed unevenly. Powder accumulated quickly and finally completed plugged the whole section. The exhaust gases with pumping force from the pump again blew the sump tank of the scrubber. Thus, solid powder, corrosive gases and flammable gases are the major sources of hazards for metal etching and thin film deposition processes.

4.3 Fires due to incompatibility The tungsten silicide (WSi,) CVD process involves dichlorosilane (SiH2Cl,) reduction of tungsten hexafluoride (WF,) to form a low-resistance polycide gate. The process operates in a vacuum, single wafer chamber. The process chemistry can be summarized as follows [l, p.3931: w F 6 (g) + 3.5 SiH,Cl, (g) + Wsi, (s) + 1.5 SiF, (g) + 7 HC1 (g) (8) + 6 HF(,) + HCl,,, w F 6 ( , ) + 3.5 SiH2C12(g)+WSi,(,, + 1.5 (9) The WSi, deposited not only on the wafer but also on the chamber wall. Regular cleaning of the chamber, usually once per several wafer runs, is necessary to minimize particulate contamination. The cleaning is done by a powerful oxidizing gas - chlorine trifluoride (ClF,). The chemistry of cleaning is actually an oxidation reaction of WSi, back to gaseous w F 6 for removal: (10) WSi,(,, + 4 ClF, (g) -+ w F 6 (g) + 2 SiClF, (g) + C1, (g) Chlorine trifluoride is hypergolic, namely it ignites organic fuels on contact. No ignition source or air is required. Lee et al. [S] have studied the flammability Limit of chlorine trifluoride, dicholosilane and nitrogen mixtures. They found

1209

that 0.3% of ClF, in nitrogen will ignite 0.3% of dichlorosilane in nitrogen. This ignition limit is far lower than the normal lower flammability limit of 4.1% of dichlorosilane in air. Great cares must be taken in disposing the ClF, exhaust gas. One day, an exhaust pipe was underwent maintenance work for replacing a leak sub-header. The maintenance port was located downstream of a ClF, exhaust line and a bypass line of WSi, exhaust. Normally the exhaust of the WSi, process went through a flame type local scrubber during deposition. During cleaning steps, the exhaust will switch to a special adsorption type of scrubber for removing ClF,. Without any notice, fire was broke out from the opened maintenance port. The fire was quickly extinguished with fire extinguishers. The WSi, tool was immediately shut down. The exhaust system for the WSi, tool was checked and found that the flame type local scrubber was tripped for unknown reasons. The flow was automatically directed to an auto-bypass, which is located upstream of the ClF, exhaust line as shown in Fig. 2. It is very likely that the maintenance port drew huge air from the ambient environment such that upstream flow was almost stopped and resulted in flow recirculation. Untreated dichlorosilane from the auto-bypass line mixed with residual ClF, gas in the recirculation flow and ignited. Eventually, the flame propagated downstream and escaped through the maintenance port as shown in Fig. 3.

Fig. 2. Proposed mechanism of WSi2 exhaust fire: recirculation flow in WSi2 exhaust due to large air flow from maintenance port.

Fig. 3. Proposed mechanism of WSi2 exhaust fire: ignition and flame propagation.

1210

Table 1

Lower flammability limits of oxidizing and flammable gases used in semiconductor fabs. Oxidizing Flammable gas (volume %) gaddilutant dichlorosilane Silane H, PH, NH, Air 4.1 1.37 4.0 1.6 15 Air/N, 4.0 4.0 15 0.1-0.68 4.1 C1F3/N2 0.3 0.2 0.5 n.d. 0.14 0.06 1.8 n.d. 0.3 F2N2 0.07 5 .O n.d. n.d. 0.66 n.d. NF3/N2 1.9 3.1 n.d. n.d. N,O/N, n.d. Note: n.d. indicates data not available

The accident can be prevented by ensuring all exhaust gases are disposed or diluted to concentration well below the lower flammability limits before vented to collection headers. Avoid air flow from the maintenance port by a temporary cover plate will minimize upstream flow recirculation and reduce the mixing and ignition of ClF, and dichlorosilane. Table 1 summarizes various literature data [%lo] of the lower flammability limits (LEL) for various oxidizing gases commonly used in the semiconductor industries. These oxidizing gases are rarely encountered in process industries. The incompatibility problems between the oxidizing gases and flammable gases are thus peculiar to the semiconductor industries. It should be noted that data in Table 1 is limited to a single flammable gas mixed with a single oxidizing gas. Multiple flammable gases mixed with multiple oxidizing gases may have an even lower LEL. For example, hydrogen is not pyrophoric but 0.5% of silane and hydrogen mixture is reported to be pyrophoric [ll]. Further studies on the gas incompatibility hazards will help to minimize similar accidents. 4.4 Fires Due to Gas Accumulation

The Tungsten (W) CVD process is similar to the Tungsten silicide except that the WF6 reduction reaction is done with hydrogen instead of dichlorosilane. Tungsten is used both as a contact plug and as a first-level metal. The main process chemistry is as follows [1, p.3871: (11) w F 6 (9) + SiH4(g)+ W(S)+ SiF,(g) + 2 HF,,, + HX,) wF6 ( 9 ) + HZ (g) (s) HF (9) (12) The reduction reaction is usually carried out with silane for a short period to generate a prenucleation layer and followed by hydrogen reduction. The hydrogen reduction is a less favorable reaction compared with dichlorosilane reduction. Thus, large excess hydrogen must be used to have a good deposition rate. Normally, the flow rate of w F 6 is around 100 sccm while the hydrogen flow rate is around 1.5 to 2.0 slm. Flow rate of silane is also small and is generally less than 100 sccm. The cleaning is done by a less reactive gas - nitrogen trifluoride:

1211

w

(13) + 2 NF, (g) + WF6 (9) + Nz (g) One day, an exhaust pipe of a W CVD tool was leaking and underwent maintenance work for replacing. The tool’s local scrubber was shut down and its exhaust was directed to another bypass line. The maintenance port was located on the right-hand-side (RHS) of a vertical collection header while the bypass line was located on the left-hand-side (LHS) of the vertical collection header as shown in Fig. 4. Ten minutes before the fire, an exhaust pressure sensor at the main exhaust header sensed a pressure rise from -70 mmH,O to -40 mmH,O. Backup exhaust blower started automatically to bring the pressure back to -70 mmH20.Then fire broke out from both the main header as well as the maintenance port. The fire caused a significant damage to the fab. The W CVD exhaust was said to diluted with nitrogen at the pump outlet to a concentration of 3.8% which is only slightly lower than the LEL of hydrogen. The large air flow from the maintenance port on the RHS of the vertical exhaust pipe rendered the sealed exhaust pipe on the LHS almost like a reservoir of hydrogednitrogen mixture. It is suspected that hydrogen concentration in the reservoir is higher than 4% due to insufficient dilution or accumulation in the sealed end. Alternatively, the hydrogen may carry a small amount of silane from the prenucleation step and rendered the mixture pyrophoric. The hydrogen mixture flowed slowly from the reservoir by upstream pumping force and mixed with air at the vertical junction. The mixing resulted in ignition and continued flaming. The exhaust pipe was made of polypropylene (PP) which is combustible. The hydrogen flame subsequently melted and ignited the RSH PP pipe insertion. Fire flake with melted PP fell into the main exhaust header as shown in Fig. 5 . The main header is a large pipe with a diameter of 2 m. Exhaust flow velocity in the main header is certainly lower than those of sub-headers. Fire continued and eventually burnt through the main header wall. Upon burnt through, all upstream exhaust flows were ceased. Fire quickly propagated upstream, as shown in Fig. 6., towards the maintenance port where air was still available. (s)

W CVD manual bypass H2

VMB

exhaust

Normal WCVD exhaust

Sealed

Directi& of flow

Fig. 4. Proposed mechanism of W CVD exhaust fire: exhaust flow before ignition.

1212

Fig. 5. Proposed mechanism of W CVD exhaust fire: hydrogen ignition.

Fig. 6. Proposed mechanism of W CVD exhaust fire: fire broke out.

This proposed scenario is consistent with the finding after the fire that only the RHS pipe insertion was melted while the LHS was intact. The high-pressure alarm in the main header also confirmed that fire broke out at the main header before the fire was seen from the maintenance port. The only uncertainty in the proposed mechanism is the ignition source. Whether the hydrogen was ignited by silane or other sources like static discharges remains to be investigated. The lesson learned from this incident is numerous. In the past time, the exhaust system was considered “dirty” compared with the process tools in the “cleanroom”. Very few efforts have been devoted to the study of exhaust system in the semiconductor fabs. The application of chemical process safety

1213

knowledge to the hazards of exhaust system is also limited. I saw only a few works on accidental release of bulk silane [12, 131. There were reports [14] on the explosion resulted from flow stagnation in the process industries that may bear some similarity to the present case. The specialties from chemical process industries can certainly contributes to the semiconductor industries for a better understanding of the peculiar sources and solutions of hazards in the semiconductor fabrication processes.

5. CONCLUSIONS Several examples of fire and explosion in the semiconductor fabs are discussed from the point of view of chemical process safety. Differences and similarities of the hazards between semiconductor fabs and chemical plants are highlighted. Although current chemical process safety technologies can be readily applied to the semiconductor processes, further works are required to completely elucidate the sources and solutions of the hazards in semiconductor processes.

DISCLAIMER This article is written solely for the purpose of promoting good safety practices and better safety researches in the semiconductor industries. This article and the author are not responsible or intents to incur any legal or insurance liability for the examples discussed.

REFERENCES [l] C. Y. Chang and S. M. Sze, ULSI Technology, McGraw-Hill, 1996. [2] S. A. Campbell, The Science and Engineering of Microelectronic Fabrication, Oxford, 1996. [3] M. E. Williams and D. G. Baldwin, Semiconductor Industrial Hygiene, Noyes, 1995. [4] B. Sherin, Solid State Tech., February (1998) S11. [5] J. R. Chen, HazOp for Semiconductor Fabrication Processes, Internal Report for Utek Semiconductor Co., 1998. [6] FMRC Data Sheet 7-7/17- 12, Semiconductor Fabrication Facilities, January 2000. [7] Delatech Co., Controlled DecompositiodOxidation (CDO)System 859, 1997. [8] Lee, S. G., H. Ohtani, Y. Uehara and M. Aramaki, J. Loss Prev. Process Ind., 5 (1992) 192. [9] S. Kondo (ed. in chief), Handbook of Specialty Gas Safety in Semiconductor Industry, Japan Society for Safety Engineering, 1996. [lo] S.Kondo, K. Tokuhashi, H. Nagai, M. Iwasaka and M. Kaise, Comb. Flame, 101 (1995) 170. [ 1 11 M. L. Hammond, Solid State Tech., 23 (1980) 104. [12] L. G. Britton, Plant/Oper. Prog., 9 (1990) 16. [13] F. Tamanini, J. L. Chaffee and R. L. Jambor, Process Safety Prog., 17 (1998) 243. [14] A. H. Heemskerk, gthIntl. Symp. Loss Prev. Safety Prom. In the Process Ind., Barcelona, Spain, 1998.

This Page Intentionally Left Blank

1215

Radioactive contamination of city territory due to work of uranium- processing plant and the ways of its solution 1

G.Shmatkov, V.Korovin, *Yu.Koshik, 3S.Ryaboshapka, Y u.Shestak

“Sorbent” Scientific-Pedagogic Center, 2 Dnieprostorevskaya st., Dnieprodzerzhinsk 51918, Ukraine. Phone/fax + 38 05692 77918. E-mail: [email protected]; ‘Dniepropetrovsky Regional State Administration, 5 1000 Dniepropetrovsk, Ukraine; 2 Ukrainian Research & Design Institute for Industrial Technology, 52204 Zholtye Wody, Ukraine; 3Dnieprodzerzhinsky Urban Municipality, 5 1900 Dnieprodzerzhinsk, Ukraine City Dnieprodzerzhinsk is one of the most unfavorable Ukrainian industrial cities where ecological state is evaluated as critical. This situation appeared as a result of neighbor location of large metallurgical, chemical and coke plants in the city center. Millions tons of industrial wastes are accumulated in storage places and dumps on the city territory. The most critical is the problem of radioactive pollution of the city and Dneproptrovsky region appeared as a result of long-term processing of uranium-contained ores at production union “Pridneprovsky Chemical Plant” from 1948 to 1991 [I]. 9 deposits of radioactive wastes (RW) formed during this period contain 36 million tons of RW with total activity about 75000 Ci. The deposits have the following parameters [2]: Waste Storage “Zapadnoe”. Preservation is not finished. Dump site contains 0,7 million tons of solid radioactive wastes with volume 0,35 million m3 and total area 60000 sq.m. The maximum dose of y-radiation on site surface is 2500 pP/hour, radiation dose near the border of protective zone is 30 pP/hour. The RW total activity is about 4900 Ci. Waste Storage “Centralnv Yar”. Preservation is not finished. The storage contains 0,2 million tons of solid RW wastes with volume 0,l million m3 and total area 24000 sq.m. The maximum dose of y-radiation on deposit surface is 4400 pP/hour, radiation dose near the border of protective zone is 30 pP/hour. RW total activity is about 2800 Ci. Waste Storage “South-Eastern”. Preservation is not finished. The storage contains 0,3 million tons of RW with volume 0,15 million m3 and total area 18000 sq.m. The maximum dose of y-radiation on the dump site surface is 2300 pP/hour, radiation dose near the border of protective zone is 30 pP/hour. RW total activity is about 1800 Ci.

1216

Waste Storage "D". Preservation is not finished. The storage contains 12 million tons of solid radioactive wastes with volume 5,84 million m3 and total area 730000 sq.m. The maximum dose of y-radiation on deposit surface is 1300 pP/hour, radiation dose near the border of protective zone is 30 pP/hour. The RW total activity is about 17000 Ci. The close site location to river Dnieper may cause blowout of the wastes as a result of natural cataclysms. Storage of Lanthanide Fraction Waste. The storage is mothballed. It contains 6,6 thousand tons of solid RW with volume 3,3 thousand m3 and total area 600 sq.m. The maximum dose of y-radiation on deposit surface is 3000 pP/hour, radiation dose near the border of protective zone is 30 pP/hour. RW total activity is about 3600 Ci. Waste Storage Blast furnace 6" (village Dolinskoe, village Sukchachevka) is preserved. It contains about 0,04 million tons of solid RW with volume 0,02 million m3 and total square 160000 sq.m. The maximum dose of gammaradiation on the deposit surface is 2700 pP/hour, radiation dose near the border of protective zone is 25 pP/hour. RW total activity is about 9000 Ci. Waste Storage "Baza C" (former depot of uranium raw, village Dolinskoe, village Sukchachevka). The storage is not mothballed. The deposit contains 0,3 million tons of radioactive wastes with volume 0,15 million m3 and total area 250000 sq.m. The maximum dose of gamma-radiation on the deposit surface is 4700 pP/hour; radiation dose near the border of protective zone is 30 pP/hour. The RW total activity is about 8000 Ci. Waste Storage "C", 1st section (village Dolinskoe, village Sukchachevka). The storage is not mothballed. 15,4 million tons of solid radioactive wastes occupy volume 8,5 million m3 and total area 160000 sq.m. The maximum dose of yradiation on the deposit surface is 1600 pP/hour, radiation dose near the border of protective zone is 20 pP/hour. RW total activity is about 18500 Ci. Waste Storage "C", 2nd section (village Dolinskoe, village Sukchachevka). This storage is acting and is not preserved. It contains 7,4 million tons of solid radioactive wastes that occupy volume 3,7 million m3 and total area 390000 sq.m. The maximum dose of gamma-radiation on deposit surface is 500 pP/hour; radiation dose near the border of protective zone is 20 pP/hour. RW total activity is about 8000 Ci. Waste Storage "Baza C" (former depot of uranium raw, village Dolinskoe, village Sukchachevka). The storage is not mothballed. The deposit contains 0,3 million tons of radioactive wastes with volume 0,15 million m3 and total area 250000 sq.m. The maximum dose of gamma-radiation on the deposit surface is 4700 pP/hour; radiation dose near the border of protective zone is 30 pP/hour. The RW total activity is about 8000 Ci. Besides, the RW storage "Lazo" was found out within the city area. It was formed after processing of liquid radioactive nitrogen-containing compounds to

1217

chemical fertilizers in 50-60*, This waste storage needs the further study to define its quantitative parameters.

Figure 1. Location of RW Dump Sites on territory of city Dnieprodzerzhinsk and Region: 1 “Zapadnoe”; 2 - “Centralny Yar”; 3 - “South-Eastern”; 4 - “D’; 5 - “Lat.lthanideFraction”; 6 - “ Blast furnace 6”; 7 - “Baza C”; 8 - “C”, 1’‘ section; 9 - “C”, 2ndsection; 10 - “Lazo”

Almost all mentioned storage places do not have environmental isolation and create the threat of radioactive pollution for underground waters, atmosphere and neighbor soils. Fig. 1 shows location of waste deposits on the territory of Dnieprodzerzhinsk and region. Production Union “Pridneprovsky Chemical Plant” found in 1947 was one of the first Soviet enterprise for the processing of various uranium ores. For dozens years the different technologies for the obtaining of uranium compounds were developed and tested at the plant. Since the part of waste disposals is located near Dnieper river, there is real threat of radio nuclides migration with underground waters and their penetration to the river. Another problem is the radioactive pollution of industrial stainless hardware and production areas at the plant. Thus, there are radiation-polluted floors with y-radiation from 100 to 10000 pP/hour. The total polluted area is about 250000 sq.m. at radiation power more than 100 pP/hour. Besides, there are polluted places at the neighbor plant “DnieproAZOT” with radiation level from 60 to 3000 pP /hour. According to radiation security requirements, this situation is considered as radioactive accident that needs the urgent deactivation and burial [ 3 ] .

1218

Additionally, inspection of city area has disclosed the significant number of limited zones, including living area, where the dose rate is higher than average one for the city. These zones have area from 10 cm2 to 10 m2 with exposition radiation doze from 100 to 1000 /hour on the surface. Increased radioactivity in the zones is caused by use of building materials (crushed stone and blast furnace slag) with high content of radioactive elements. All these factors influence negatively the incidence of city population (about 300 000). All this factors influence negatively the morbidity factor and demographic indexes. Thus, child-birth of population is the lowest for the last 20 years, and decreased twice as compared with 1998. Mortality index exceeds birthrate 3 times. Besides, cancer morbidity exceeds two times the similar index both for Dnepropetrovsky region and whole Ukraine. In cooperation with broad range of specialists we have made preliminary monitoring of radio-nuclides distribution upon city territory within the earlier developed approach to ecological monitoring of industrial region [4]. We have also established a number of programs directed to solution the problem of radioactive pollution: Liquidation, preservation or activity change of the plants finished their main work. The program anticipates development of measures that make waste disposals ecologically safe. Program realization aims: to ensure the safe storage of radioactive wastes in preserved state, to decrease radiation exposure of personnel and population by radioactive contamination from industrial area and premises. It will also allow the further use of machinery assets of converted plants. Program of radiation monitoring and information of population anticipates the creation of monitoring network and information center upon the question of radiation monitoring. Complex processing of radioactive wastes, including development of ways and methods for recovery, localization and burial of RW with accompanying removal of valuable components; Program of technical supply for individual radiation monitoring foresees creation of radiation monitoring system and definition of costs for it embedding. For the purpose of deactivation of industrial territories it is necessary to establish the specialized plant based on "Pridneprovsky Chemical Plant" that dealt earlier with processing of radioactive materials. One must start the works at "Pridneprovsky Chemical Plant" and process the waste disposals "D", "Centralny Yar" and "South-Eastern". The waste disposals of coke and metallurgical plants influence essentially the waste storage "D", one of the most unfavorable one located too close to Dnieper river. Preliminary hydro- and geochemical study of surface water and ground sediments showed the increased content of leaching products of solid RW. Analysis of samples from river Konoplyanka and Tritusnyi quarry showed anomalous content of uranium series elements. It was established using

1219

mathematic modeling that dump site "D" is the source of radioactive pollution of underground waters. Penetration of polluted underground waters to Dnieper is possible in single areas, especially in northwestern part of the territory. There is real danger of underground waters pollution by radioactivity on the whole territory up to Dnieper river. In this situation the zones of tectonic destruction may be the ways for the increased migration of contaminants. Duration of radioactivity migration is connected with RW leaching, the rate of contaminants migration depends upon rocks distribution. Since this disposal in not studied properly, one needs its further study for the definition of the following parameters: level of underground waters, types of radionuclides compounds and their content in wastes and underground waters, geologic structure of the territory, filtration properties of tectonic destruction and wastes, sorption properties of rocks, bottom and silt sediments, leaching of radioactive elements from solid phase. Since the wastes in disposals I'D", "Centralny Yar" and " South-Eastern" may contain uranium concentration corresponding to modern industrial ores, one should study the possibility of their processing that may be profitable and decrease the cost of uranium elimination and preservation. Pulps created during processing may be evacuated (with or without uranium removal) to waste storage "C" (2nd section) which is intended for this purpose and prepared according to modern requirements. It is expedient to use RW isolation for the disposals with high activity "Lanthanide Fraction", "Blast Furnace 6" as well as for decrease of dust formation from the surface cf dehydrated site "C" (1 section). Utilization of radioactive wastes and deactivation of living zone are the problems that must be solved at municipal, state and international level. The "Program of Outcome of City Dnieprodzerzhinsk from Ecological Crisis for 2000-2005" was developed according to the Decree of President of Ukraine "About Ecological-Economic Experiment in cities Krivoy Rog, Dnieprodzerzhinsk, Mariupol and Zaporozhie" (No 235/97 from June 11 1997). But it is necessary to attract foreign investors, technical or financial support for solution of the problem of radioactive pollution. Reference:

1. Complex Approach to the solution of Problem of Radioactive Contamination of Territory of City Dnieprodzerzhinsk / G.Shmatkov, G.Seminec, Yu.Korovin et al // Proc. VIII Int. Scientific - Technical Conference "Ecology and Human Health. Protection of Aqueous and Air Environment. Wastes Utilization", Schelkino (Crimea), June 12-16 2000, v. 1, p.69-71, 2. The Program for the Improvement of Radiation State of Uranium Establishments in the Region (from 29.12.99). 3 Principles of Radiation Security in Ukraine (NRBU-97): State Hygienic Standards. Kiev, Department of Health Protection, 1998. 135 p. 4. G.Shmatkov. System of Ecological Monitoring and tasks of GIS-technologies. Collection of NGA Scientific Papers, No 7, v. 1, p. 42-45.

This Page Intentionally Left Blank

Topic 9

The impact of legislation and industry initiatives

This Page Intentionally Left Blank

1223

Strategies for Industrial Risk Prevention and Management in the European Union: The Major Accident Hazards Bureau and the Seveso I1 Directive J.S. Duffield Major Accident Hazards Bureau, European Commission, Joint Research Centre, Institute for Systems, Informatics and Safety, Ispra, 1-21020 (Va), Italy.

ABSTRACT The process industry is one of the major wealth producing activities of our modem day society. Its products are so diverse and widely used that our dependence on them is taken for granted and little consideration is given as to their origin. It is of paramount, strategic importance therefore, that the safety of this industry is assured. It is also of equal importance that the public has a rational perception of the risks posed by it to the environment and society at large. The awareness of this fact, together with the knowledge that the consequences of major accidents are no respecters of national boundaries, has resulted in a number of initiatives, and the formation of organisations aimed at maintaining and continually improving a “process safety culture”. Primary among these initiatives has been the efforts of the European Commission in the formulation and implementation of the “Seveso Directives”, (82/501/EEC and 96/82/EC). Closely coupled to this activity was the creation of the Major Accident Hazards Bureau (MAHB) located at the Commission’s Joint Research Centre at Ispra in northern Italy. MAHB gives scientific and technical support to DG Environment, the directorate responsible for the Seveso Directives, and operates the Commission’s Major Accident Reporting System (MARS) database and the Community Document Centre on Industrial Risk (CDCIR). This paper describes the pertinent features of the Seveso I1 Directive, problems that have arisen in its implementation in the Member States

1224

and ongoing work to ensure its success. The functioning and achievements of the Major Accident Hazards Bureau are also highlighted. 1.

INTRODUCTION

The European Union is the world’s leading producer of chemical products. The chemical industry supplies virtually all sectors of the economy and their products are so diverse and widely used that our dependence on them is taken for granted and little consideration is given as to their origin. It is also expected that the demand for chemicals will increase with the growth of the European economies. Chemical production is certainly not risk free and major accidents involving dangerous substances have occurred and continue to occur worldwide in the process industry. It is of paramount, strategic importance therefore, that the safety of the process industry is assured. It is also of equal importance that the public has a rational perception of the risks posed by it to the environment and society at large. The awareness of this fact, together with the knowledge that the consequences of major accidents are no respecters of national boundaries, has resulted in a number of initiatives and the formation of organisations aimed at maintaining and continually improving a “process safety culture”. In addition, the appreciation of the fact that a major accident in one sector of the industry gives no market advantage to a competitor if it leads to a general loss in confidence by the public in the industry, has recently led to a healthy openness and exchange of information regarding safety issues amongst the major industrial players. Primary among these initiatives aimed at improving process safety has been the formulation by the European Commission of the “Seveso Directives”, and closely coupled to this the setting up of the Major Accident Hazard Bureau (MAHB) located at the Commission’s Joint Research Centre at Ispra in northern Italy. MAHB gives scientific and technical support to DG Environment, the directorate responsible for the legislation in this field, and operates the Commission’s Major Accident Reporting System (MARS) database, the Seveso Plant Information Retrieval System (SPIRS), and the Community Document Centre on Industrial Risk (CDCIR). The Commission has also funded a considerable number of research activities, focused on industrial safety, in the “Third, Fourth and Fifth RTD Framework Programmes”. Other international organisations that are directly concerned with major accident hazards and emergency response include: the Council of Europe (COE), the International Civil Defence Organisation (ICDO), the International

1225

Labour Organisation (ILO), the International Programme on Chemical Safety (IPCS), the North Atlantic Treaty Organisation (NATO), the Organisation for Economic Co-operation and Development (OECD), the United Nation Economic Commission for Europe (UNECE), the United Nation Environment Programme (UNEP), and the World Health Organisation (WHO). Major industrial initiatives have seen the creation of the European Process Safety Centre (EPSC), and include the work of the Loss Prevention Working Party of the European Federation of Chemical Engineering (EFCE), the European Chemical Industry Council (CEFIC), the American Institute of Chemical Engineer’s Center for Chemical Process Safety (CCPS), and the Design Institute for Emergency Relief Systems (DIERS) to name just a few. At the same time process safety has been included in the chemical engineering curriculum of many universities. It is clear that accidents will continue to occur in the future, however there is the determination that through the diligent application of the Seveso I1 Directive their consequences can be minimised, and the risks posed to mankind and the environment reduced to a “tolerable” level.

2.

HISTORICAL BACKGROUND

In Europe, in the 1970’s two major accidents in particular prompted the adoption of legislation aimed at the prevention and control of major accidents occurring in the process industry. The first occurred in 1974 at the Flixborough plant in the United Kingdom. A huge explosion and fire resulted in 28 fatalities, personal injury both on and offsite, and the complete destruction of the industrial site. It also had a ‘domino’ effect on other industrial activity in the area, causing the loss of coolant at a nearby steel works which had the potential to cause a further serious accident. The second accident happened in 1976 at a chemical plant in Seveso, northern Italy where pesticides and herbicides were being manufactured. A dense vapour cloud containing tetrachlorodibenzoparadioxin (TCDD) was released from a chemical reactor, used for the production of trichlorofenol. Commonly known as dioxin, this was a poisonous and carcinogenic by-product of the uncontrolled exothermic reaction that was the cause of the accident. Although no immediate fatalities were reported, kilogram quantities of this substance, lethal to man even in microgram doses, were widely dispersed, resulting in the immediate contamination of some twenty five square kilometres of land and vegetation. More than 600 people were evacuated from their homes and as many as 2000 were treated for dioxin poisoning.

1226

After almost three years of negotiations in Council and the European Parliament, the ‘Seveso I Directive’ [l] was adopted in 1982. In the decade that followed, due to the mandatory nature of the reporting requirements, comprehensive information of some 130 major accidents that had occurred within the European Union were compiled. In the light of the worlds worst industrial accident at the Union Carbide factory at Bhopal, India (1984), where a leak of methyl isocyanate caused more than 2500 deaths and over 200,000 injuries; and the accident at the Sandoz warehouse in Bask, Switzerland (1986) where fire-fighting water contaminated with mercury, organophosphate pesticides and other chemicals caused massive pollution of the river Rhine and the death of half a million fish, the Seveso I Directive was amended twice in 1987 [2] and in 1988 [3]. Both amendments aimed at broadening the scope of the Directive, in particular to include the storage of dangerous substances. The Seveso I Directive itself had provisions laid down for a review of its scope following the experience gained with its implementation. The Member States, in accompanying resolutions concerning the fourth (1987) and the fifth (1993) Action Programmes on the Environment, had called for a review of the Directive in which there was a general desire to widen the scope of the Directive by including land-use planning policy, risk assessment and accident management. A resolution from the European Parliament also called for a review, and following these actions a proposal for a new ‘Seveso I1 Directive’ was presented to Council and European Parliament by the Commission in 1994. On 9 December 1996 the Seveso 11 Directive [4] was adopted by the Council, and following its publication in the Official Journal of the European Communities, entered into force on 3 February 1997. Member States then had up to two years to bring into force the national laws, regulations and administrative provisions to comply with the Directive. From 3 February 1999 the obligations of the Directive became mandatory for industry as well as for the public authorities responsible for the implementation and enforcement of the Directive. The fact that Seveso I was not amended but was replaced by a completely new Directive indicated that important changes had been made and new concepts had been introduced into the Seveso I1 Directive.

3.

THE ‘SEVESO I1 DIRECTIVE’

The principal aim of the Directive is two-fold: Firstly, the Directive aims at the prevention of major accident hazards involving hazardous substances.

1227

Secondly, as accident will inevitably occur, the Directive aims at the limitation of the consequences of such accidents not only for mankind but also for the environment. Both aims should be followed with a view to ensuring high levels of protection throughout the Member States in a consistent and effective manner. The Directive places more emphasis on the socio-technical aspects of the control policy and attempts to bring more transparency and openness into the process by allowing for public consultation and by strengthening the role of MAHB as an information exchange system. For a comprehensive description of the background, contents and requirements of the Seveso I1 Directive the reader is referred to the excellent article by Wettig et.al.[5], but the important new features appearing in the Directive are described below: 0

The scope of the Directive is both broadened and simplified. There is no list of industrial installations, therefore there is no need to define the term industrial activity. In its place the concept of an industrial establishment is introduced, characterised by the presence of dangerous substances. There is a short list of named substances (Annex I, Part l), and a more systematic list containing generic categories (Annex I, Part 2) such as toxic, explosive or flammable. Concerning the definition of these generic categories reference is made to other Directives relating to the classification, packaging and labelling of dangerous substances, preparations and pesticides. Depending on the quantities of dangerous substances present on site an establishment will be deemed either upper-tier or lower-tier. It is assumed that the risk of a major accident hazard arising increases with the quantities of substances present at the establishment, and consequently the Directive imposes more obligations on upper-tier than lower-tier establishments. The socio-technical aspects in an establishment are expected to be strongly affected by the obligation placed on the operator to provide a Major Accident Prevention Policy (MAPP), and for an upper-tier establishment, a Safety Report implemented by means of Safety Management Systems (SMS). These provisions are a major addition to the Directive and have been introduced after the discovery that most of the major accidents notified to the Commission over the years under the Major Accident Reporting System (MARS) had root causes in deficiencies in the management process [6-81. Similarly, the obligation of a land-use policy as set out in Article 12 will have important socio-technical consequences, especially for those countries where such an obligation was not part of national legislation prior to the Directive. In particular, planning policies are required to establish and maintain appropriate distances between establishments and residential and other areas, and when this is not possible additional technical measures need

1228

to be taken. The general public, which until now had the right to be informed on existing risks and on how to react in case of an accident, will have a much more active role in the overall process of risk management. The Competent Authorities are obliged to identify establishments, or groups of establishments, where the danger of an accident and its possible consequences may be increased because of the location and the proximity of the establishments and the dangerous substances present: the so called domino effect. The provisions for emergency planning and public information are reinforced, since the Safety Report becomes a public document and the public must be consulted in the preparation of emergency plans. The emergency plans also have now to be tested regularly. The Competent Authorities are obliged to organise a system of inspections under Article 18, comprising a systematic appraisal or one on-site visit every year: this is to be followed by a report. The Directive is concerned with dangers posed to the environment from hazardous installations following the inclusion of a generic category related to substances harmful to the aquatic environment. Finally, a concise and unequivocal definition of what constitutes a ‘major accident’, based on quantitative threshold criteria, is included in the Directive. It is expected that this will result in an overall reduction of the criteria for notification to MARS and lead to an increase in the homogeneity of data at the European level. It can be seen that the Directive establishes a broader perspective as far as risk management of the storage and processing of hazardous substances is concerned. This is a perspective that should increase the awareness of the general public on risk control issues and help provide a rational basis on which the risks posed by the industry to the environment and society at large can be judged. 4.

THE MAJOR ACCIDENT HAZARDS BUREAU

The Major Accident Hazards Bureau (MAHB) was established with the specific remit to give independent scientific and technical support to the Commission and ensure the successful implementation and monitoring of EU policy on the control of major hazards and the prevention and mitigation of major accidents. Furthermore, in order to fulfil its information exchange obligations towards the Member States, the Commission established the Major Accident Reporting System (MARS), the Seveso Plant Information Retrieval System (SPIRS) and the Community Documentation Centre on Industrial Risks (CDCIR) which are

1229

managed and maintained by MAHB. The main customers for the services offered by MAHB, apart from the Commission, include all the actors in the legislative, regulatory and management activities concerned with process plant safety, (e.g., national and local authorities, industry, research organisations, safety consultants, trade unions). In order to facilitate an efficient and effective information exchange, MAHB has developed and maintains a dedicated web site (http://mahbsrv.jrc.it) from which information, guidance documents, scientific publications and software can be accessed and downloaded. The principal tasks of the Bureau are briefly described below:

- The maintenance and periodic updating of the Major Accident Reporting System database (MARS). This task involves the collection, in a consistent manner, of data on major industrial accidents involving dangerous substances from Member States; the analysis and processing of such data and the distribution of all non-confidential data and analysis results to the Member Sates. MARS is an up-to-date distributed information exchange and analysis tool, which is made up from two connected parts: one for each local unit (i.e. for each Member State Competent Authority) with which accident data is reported, and one central part for the Commission. Both parts can serve as data logging systems and, on different levels of complexity, as data analysis tools. The central database allows complex pattern analysis to be made, identifying and analysing the succession of disruptive factors leading to an accident. On this basis, ‘lessons learnt’ can be formulated for industry and the regulatory bodies to assist in further accident prevention. Examples of such analyses can be found in [9-121. -

The development and management of the Seveso Plants Information Retrieval System (SPIRS) [13]. This information system will contain all upper-tier Seveso sites throughout the EU and will display the geographical component of risk. Also included in this system is a largely user-defined risk ranking tool so that comparative risk assessments can be performed.

-

The management of the Community Documentation Centre on Industrial Risk (CDCIR). This task involves the acquisition, storage and assessment of relevant documents (guidelines, regulations, codes of good practice, accident case histories, risk studies, scientific literature etc.) related to major accident hazard control. It is perhaps unique in the fact that much of the contents are made up of ‘grey literature’ not readily available from alternative sources. In this context MAHB produces regularly a Bulletin [14], containing summaries of the material in the CDCIR, and provides an on-line search facility of CDCIR through its web site to ensure widespread dissemination of information to the National Authorities, industry and other interested parties.

1230

- The Directive has a substantial scientific and technical content, some of which is not fully defined within the legislation, and is a result of the fact that the state of scientific knowledge or of industrial practice is still evolving. This was recognised at an early stage by the Commission and the Member States and has led to various Technical Working Groups (TWGs) being established with the objective of producing non-prescriptive guidance on specific aspects of the implementation of the Directive. MAHB provides scientific, technical and administrative support to the functioning of the various Technical Working Groups, which are made up with experts drawn from Member State Authorities and representatives from industrial groupings; either those of the process industry in general or those specifically concerned with the safety or environmental issues. - MAHB also organises, on a regular basis, various technical meetings and international seminars covering topics connected with control of major hazards and the prevention and mitigation of major accidents; see for example [ 15-1 91. To enhance the effectiveness of the support the Bureau provides, a number of research activities are being pursued. These include: the development of statistical analysis tools to identify patterns of accident characteristics, based on free text retrieval and clustering of similar text elements; the assessment, through a benchmark exercise, of the uncertainties related to the different risk assessment methodologies commonly used in land-use planning activities and the development of novel techniques to detect the onset of thermal runaway events in batch-type reactors and the safe disposal of reaction products.

4.1. Guidance In view of the recent transposition into national law of the Seveso I1 Directive, one of the important achievements of MAHB has been the publication of the guidance documents resulting from the deliberations of the various Technical Working Groups. The need for guidance arises from two closely related sources: on the one hand there are areas where the Directive states requirements but does not state how to meet them; and on the other hand the requirements themselves may be defined in the Directive at a level of detail insufficient for direct operability. These documents are intended to provide guidance for operators and authorities, while not excluding other reasonable interpretations; however, as they have been agreed over extensive discussions between representatives of the Member States, the European Commission and industry, their interpretations do have a certain authority as presenting ‘current European good practice’. Described below are the salient points of guidance documents: however the reader is referred to the documents themselves or to the review article of Mitchison [20] for additional information.

1231

4. I . I The Safety Report [21] One of the most significant provisions of the Seveso I1 Directive is the requirement for upper-tier establishments to produce a Safety Report, which must contain all the information required to convince the National Authorities concerned with the safety of the establishment. It will therefore have to be prepared according to the practices and requirements of the Authorities concerned, and in certain technical areas these practices and requirements vary significantly from one Member State to another. This is particularly the case concerning hazard identification, risk analysis and consequence assessment. The guidance document therefore gives general guidance as to the content of the Safety Report, describes the various approaches to risk analysis etc. but does not take a position as to what approach should be taken. It is likely therefore, that some Member States will wish to supplement this document with more specific national guidance.

4.1.2. Information for the Public [22] People living near a hazardous plant have to know what to do in the event of a major accident. This principle was set out in the original Seveso Directive and was significantly reinforced in the 1988 amendment which set out a list of items of information to be supplied, and stated explicitly that the information should be supplied without the persons concerned having to request it. The guidance developed a two-tier information strategy, divided into ‘technical’ and ‘pragmatic’ information - the first being of general character and standardised in all Member States, while the second, what is actively communicated, has to depend much more on the exact local context. 4.1.3. Safety Management Systems [23] As mentioned earlier, the analysis of past accidents uncovered the fact that most accidents were not simply the result of the failure of technical measures, but usually involved an organisational or management failure. For this reason, specific requirements on Safety Management Systems (for upper-tier sites) and on a Major Accident Prevention Policy (for lower-tier sites) are included in the Directive. The guidance document tries to answer the questions: What is a Safety Management System? What should it cover? What is the relationship to other management systems? What is meant by a Major Accident Prevention Policy, and what sort of document is needed to present it?

4.1.4. Land-use Planning [24] Land-use planning is one of the more difficult aspects of the Directive to implement in a harmonised fashion. This is the result of the differing approaches being adopted in the Member States, the responsibility often being at the local level, and the fact that the policy should be operational from 31d

1232

February 1999, some two years before the first Safety Report is required to be submitted. However, the Working Group performed an in-depth analysis of the various methodologies followed in Member States and discussed the advantages and limitations of each. This analysis showed that, while some countries have already adopted well-established approaches, procedures and criteria, many others lack such approaches and deal with the problem on a case-by-case basis. As far as the approaches themselves are concerned, these can be grouped into three broad categories, namely: (i)

establishing "generic distances", according to the type of activity;

(ii)

the "consequence based" approach, in which the land-use planning decisions are based on the level of consequences of a number of reference scenarios; and

(iii) the "risk based" approach, in which decisions are based on both the consequences of a number of accident scenarios and the relevant likelihood of their occurrence. This categorisation was also verified during the performance of a small "Benchmark" Exercise. The resulting guidance document provides information both on procedural aspects and on the content and form of the technical advice that has to be taken into account for planning purposes. The administrative procedures are not prescribed, since these depend on the administrative system of each country. Instead, for each land-use planning case (siting, modifications, new urban developments), checklists are given of all the important issues that have to be addressed. The important issue of land-use planning will be re-visited in the near future: it being the intended subject of the next MAHB international seminar. 4.1.5 Harmonised Criteria under Art. 9(6) [25] This concerns the justification to limit the information required in the Safety Report. It addresses the situation where an establishment can demonstrate that, despite the presence of more than the threshold quantities of dangerous substances, there are good objective reasons why these substances, at the particular establishment concerned, cannot actually cause a major accident. There was a fairly wide agreement that the criteria to be used for granting such waivers or dispensations should be agreed at Community level, even if their application would remain the responsibility of the Member State concerned. The provisions of Article 9(6) were therefore inserted into the Directive, as laid out in the guidance document. Under these criteria, a substance can be regarded as incapable of creating a major-accident hazard if it fulfils any one of four broad generic criteria: physical form, location, containment or classification. This has the following two consequences. Firstly, that the calculation initially

1233

made to decide whether an establishment comes under the provisions of the Directive must consider all substances present at the site, irrespective of whether they may turn out to be covered by a dispensation. Secondly, that a Seveso I1 site remains a Seveso I1 site, and hence comes under the other provisions of the Directive. 4.1.5. Inspection Systems [26] Ultimately, any law is only as effective as its system of enforcement permits. The inspection of Seveso sites is therefore an essential part of the overall system of major hazard control. It is found that this is an area where some Member States have well-established procedures, often coordinated with inspections under other legislative provisions. Provided that those established procedures are conformant with the formal requirements of the Directive Member States are unlikely to wish to change them. Therefore, the overall tenor of the document is, ‘if you are doing it already in a different way, fine; if not here are some ideas on how it can be organised’.

4.2. On-going initiatives At the time of the original drafting the Seveso I1 Directive there were extensive discussions in both the Council and the European Parliament that indicated there were still a number of open questions to be resolved. These included: reviewing the qualifying quantities for substances defined as being dangerous to the aquatic environment (risk phases R50, R51 and R53); examining the list of carcinogens in Annex 1 Part 1 of the Directive, amending this list and recommending the appropriate qualifying quantities; and studying the major accident hazard potential of transporting dangerous substances in pipelines. Since the time of the entering into force of the Directive MAHB has actively pursued these open questions through the operation of special Technical Working Groups and the organisation of seminars and workshops.

4.2.6. Substances Dangerous to the Environment Within the list of generic categories of substances in Annex I, Part 2 there are included substances which are classified as being dangerous to the aquatic environment. However, it became clear that there was no consensus on the qualifying quantities to be assigned to such substances, and in addition there was incoherence between the Seveso I1 Directive and the UN/ECE Convention on Transboundary Effects of Industrial Accidents. This is important because the Seveso I1 Directive is considered the legal and technical instrument for EU Member States to fulfil the obligations arising from the Convention. The Council therefore and requested the Commission to carry out a detailed examination and submit a proposal for an amendment to the Directive on the appropriate qualifying quantities for this category of substances. This work has

1234

now been completed and a report [27] has been prepared which will form the technical basis for a future amendment to the Directive. The report tries to strike a balance between the risk posed to the environment by these substances; the administrative difficulties imposed on the Competent Authorities and industry by setting very low qualifying quantities, and consideration of the comparative risk posed to mankind and the environment by other generic classifications of substances defined in Annex 1, Part 2. The report also identified issues of special concern such as the continuous revision of the dangerous substances classification, and recommended a special treatment of petroleum products with respect to their thresholds, taking into account the diverse properties of these substances and their extensive use. 4.2.7. Carcinogenic Substances The list of carcinogenic substances in Annex I, Part 1 of the Directive for which the very low threshold quantity of 1 kg was set is a straight carry over from the Seveso I Directive. However, doubts have remained as to whether this list of substances and the associated thresholds are appropriate. These doubts arise from two principal sources. Firstly, it is not clear for many substances whether they are human carcinogens or not. The existing classification is based on the strength of evidence of their carcinogenicity rather than on their potency. Secondly, the scientific knowledge on the effects of short-term exposure, such as the exposure after an accident, is very limited. Acknowledging these difficulties, the Council requested the Commission to examine the subject in detail and to propose a list of carcinogens to be included as named substances in Annex I, Part 1 of the Directive, together with the relevant qualifying quantities. Considering these points, the Working Group decided to pay particular attention to high-potency carcinogens, and to medium-potency carcinogens where there was evidence suggesting the possibility of “one-shot’’ effects. The group also studied medium-potency carcinogens which are produced in large volumes in the EU. This work has now been completed and a report [28] has been prepared which will form the technical basis for a future amendment to the Directive. Eight additional substances were considered to be appropriate for inclusion in the list of named carcinogens in Annex I, Part 1, and the group recommended a significant increase in the qualifying quantities taking into consideration the comparative risks posed to mankind and the environment from other categories such as “very toxic”.

4.2.8. Major Accident Hazards arising from Pipelines Both Council and the European Parliament recognised that accidents had occurred in Europe and worldwide, which clearly indicated the “major accident

1235

hazard” potential of pipelines and called for a special study of their case. In this respect, Recital 13 of the Directive states: “Whereas the transmission of dangerous substances through pipelines also has a potential to produce major accidents; whereas the Commission should, after collecting and evaluating information about existing mechanisms within the Community for regulating such activities and the occurrence of relevant accidents, prepare a communication setting out the case, and most appropriate instrument, for action in this area if necessary.”

A view that pipelines should be included within the scope of other Community legislation dealing with major accident hazards has previously been expressed. This is consistent with the so-called “precautionary principle” on which EU environmental law is based. In response to this concern several international workshops have been organised. MAHB together with DG ENV have undertaken a review of existing legislation within EU Member States, have performed reviews of pipeline accidents involving hazardous substances [29,30] and have elaborated a “regulatory benchmark” and have compared each Member States existing legislation against this benchmark. The results of this work have been reported back to the Committee of Competent Authorities and the Commission is currently studying whether it wishes to propose new legislation in this area. 5.

CONCLUSIONS

The safety of the European process industry is of strategic importance; similarly, it is equally important that the general public has a rational perception of the risks posed by it to the environment and society at large. It is our strong belief that the Seveso I1 Directive, an up-to-date piece of goal oriented legislation, provides the mechanism through which this can be assured by bringing transparency to the risk related decision making processes throughout the European Union. The Commission’s Major Accident Hazards Bureau supports this initiative by operating and maintaining the Major Accident Reporting System, the Community Documentation Centre on Industrial Risk and by running the various Technical Working Groups set up to develop guidance for a coherent implementation of the Directive. The Bureau also fulfils a strategic role in providing an efficient information exchange system, for the authorities, industry, research community and the general public through the operation of its dedicated web-site. The Directive has only recently been transposed into national law; the main challenge therefore will consist in ensuring that it is implemented in a consistent and effective manner throughout the Community.

1236

ACKNOWLEDGEMENTS The author is pleased to acknowledge the help and support of all his colleagues at the Major Accident Hazards Bureau and those in DG ENV, the Directorate General responsible for the Directive.

REFERENCES [l] Council Directive 82/501/EEC of 24" June 1982 on the Major Accident Hazards of certain industrial activities, Official Journal of the European Communities, 1982 (OJ No: L 230).

[2] Council Directive 87/216/EEC of 19" March 1987 amending Directive 82/501/EEC on the Major Accident Hazards of certain industrial activities, Official Journal of the European Communities, 1987 (OJ No: L 85). [3] Council Directive 88/610/EEC of 24" November 1988 amending Directive 82/501/EEC on the Major Accident Hazards of certain industrial activities, Official Journal of the European Communities, 1988 (OJNo: L 336). [4] Council Directive 96/82/EC of 9" December 1996 on the control of major-accident hazards involving dangerous substance, Official Journal of the European Communities, 1997 (OJNo: L 10). [5] J. Wettig, S. Porter, C. Kirchsteiger, Major industrial accidents regulations in the European Union, Journal of Loss Prevention in the Process Industries, 12, (1999), 19-28. [6] G. Drogaris, Learning from Major Accidents Involving Dangerous Substances, Safety Science 16, 1993. [7] K. Rasmussen, The Experience with the Major Accident Reporting system from 1984 to 1993, EUR 16341 EN, 1996. [8] C. Kirchsteiger, N. Kawka, Characteristics of accidents notified to MARS, Proceedings of the EC-EPSC seminar on 'Lessons Learned from Accidents', Linz, EUR 17733 EN, 1998. [9] G.A. Papadakis, A. Amendola, Learning from Experience The Major Accident Reporting System (MARS) in the European Union, Proceedings of PSA 96 Conference, Crete, June 24-27 1996. [lo] G. Drogaris, Major Accident Reporting System - Lessons Learned from Accidents Notified, EUR 15060 EN, 1993. [11] C. Kirchsteiger, A. Rushton, N. Kawka, Contribution of human errors to accidents notified to MARS, Proceedings of the EC-EPSC seminar on 'Lessons Learned from Accidents', Linz, EUR 17733 EN, 1998. [12] S. Porter, C. Kirchsteiger, The Challenge of Learning Lessons from Accidents, Proceedings of the EC-EPSC seminar on 'Lessons Learned from Accidents', Linz, EUR 17733 EN, 1998. [13] C. Kirchsteiger, Availability of Community Level Information on Industrial Risks in the EU. Trans IChemE, Vol78, Part B, 2000.

1237

[I41 C. Kirchsteiger, C. Carnevali, N. Brinkhof, Community Documentation Centre on Industrial Risk, Bulletin No. 17, S.P.I. 00.73,2000. [15] P.C. Cacciabue, I. Gerbaulet, N. Mitchison, Proceedings of the EC seminar on Safety Management Systems in the Process Industry, Ravello, EUR 15743 EN, 1994. [I61 N. Mitchison, B. Smeder, Proceedings of the EC seminar on Safety and Runaway Reactions, Frankfurt, EUR 17723 EN, 1997. [17] C. Kirchsteiger, Proceedings of the EC seminar on Lessons Learnt from Accidents, Linz, EUR 17733 EN, 1998. [18] N. Mitchison, A. GarcCs de Marcilla Val, B. Smeder, , Proceedings of the EC seminar on Accident Scenarios and Emergency Response, Toledo, EUR 18733 EN [19] G.A. Papadakis et.al., Seveso 2000, The Challenge of Implementing Council Directive (96/82/EC). European Conference Athens, Nov 1999. [20] N. Mitchison, The Seveso 11Directive: guidance and fine-tuning, Journal of Hazardous Materials 65, 1999,23-36. [21] G.A. Papadakis, A. Amendola, Guidance on the preparation of a safety report to meet the requirements of Council Directive 96/82/EC (Seveso II), EUR 17690 EN, 1997. [22] B. De Marchi, S. Funtowicz, General Guidelines for Content and Information to the Public (Directive 82/501/EEC-Annex VII) EUR 15946 EN, 1994. [23] N. Mitchison, S. Porter, Guidelines on a Major Accident Prevention Policy and Safety Management System, as required by Council Directive 96/82/EC (Seveso II), EUR 18123 EN, 1998. [24] M.D. Christou, S. Porter, Guidance on Land-Use Planning as required by Council Directive 96/82/EC, EUR 19695 EN, 1999. [25] J. Wettig, N. Mitchison, Explanations and Guidelines for the application of the Dispensation Rule of Article 9, paragraph 6 of Council Directive 96/82/EC on the control of major-accident hazards involving dangerous substances, EUR 18124 EN 1998. [26] G.A. Papadakis, S. Porter, Guidance on Inspections as required by Article 18 of Council Directive 96/82/EC (Seveso 11),EUR 18692 EN, 1999. [27] M.D. Christou (ed), Substances Dangerous for the Environment in the context of Council Directive 96/82/EC - Final Report of Technical Working Group 7, EUR 19651 EN, 2000. [28] M.D. Christou (ed), Carcinogens in the context of Council Directive 96/82/EC - Final Report of Technical Working Group 8, EUR 19650 EN, 2000. [29] G.A. Papadakis, Review of Transmission Pipeline Accidents involving Hazardous Substances, EUR 18122 EN 1999. [301G.A. Papadakis, Major Hazard Pipelines: a comparative study of onshore transmission accidents, Journal of Loss Prevention in the Process Industries, 12, (1999), 91-107.

This Page Intentionally Left Blank

1239

Land use planning and chemical sites (LUPACS) Dr Tommy Rosenberg Swedish Rescue Services Agency, Karolinen, Karlstad, Sweden

1. INTRODUCTION A general objective in land-use planning concerning chemical sites is to manage tasks in such a way that net land-development benefits are maximised and the various categories of costs and unwanted consequences such as accidents are minimised. This paper deals with the decision tasks of planners at a local level, who are faced with industry’s applications for changes and for building new sites, and with the range of conditions to review and evaluate in order to fblfil Seveso Directive I1 and other relevant legislation. In 1996 the LUPACS project (Land Use Planning And Chemical Sites) was started under the EU research programme Environment & Climate and was fmalised in 1999. The aim of the project was to develop a method by which to support local planners by establishing a basis for their decision making on such issues as site selection, safety distances and restrictions on operation. This paper is based on a summary of the project and our findings [ 11. The objective of the project is to present an overall methodological fi-amework for supporting decisions on the location or on larger modifications of chemical complexes and the land-use patterns around them. The method addresses situations such as: a) given the location of hazardous installations determine the development (land-use) patterns in the area, b) given a specified land-use pattern determine the siting of hazardous installations and c) determine both the siting of hazardous installations and the land-use patterns around them simultaneously. Land-use planning is a complex process involving actors at different decision making levels with different interests. The boundaries and conditions for the land-use-planning problem can be defined and influenced by different aspects, e.g. physical, geographical, political or organisational. Decision support in land-use planning will reflect contributions from a variety of disciplines such as risk analysis, management science, computer science, economics, operations research, planning, chemistry and psychology. The developed frame emphasises safety-related aspects, but the method can be adjusted to include other objectives, e.g. health, environmental impact, cultural heritage, social/economic aspects, company aspects. The intention is to prepare a dynamic method that can

1240

be updated and revised by users on the basis of experience gained from land-use planning situations and lessons learned from disturbances, near misses, and accidents occurring. The LUPACS project includes three principal activities according to the work programme:

- A brief description of the state of the art with notes on other relevant projects and scientific work. - Identification and analysis of present options for efficient land-use planning processes concerning chemical industrial complexes and communities. The development of a methodological framework for supporting decision makers concerning the location of chemical industrial complexes and land-use patterns around them including practical case studies in Denmark and Sweden.

- An education programme which involves an introduction to land-use planning principles and training with the LUPACS method in selected problems. This paper deals mainly with the methodology. 2. PROBLEM CHARACTERISATION

The last decade of implementing the Seveso Directive has been characterised by the development of methods for safety work inside chemical plants, like Hazard Operational Analysis (HAZOP), internal control activities and I S 0 9000 and I S 0 14000. The methods used on site have had a mathematicallprobability and quantitative approach. Some general conclusions can be drawn about the present situation. Our investigations indicate, that in the next 5- 10 years there will most probably be only a few new "Seveso-industries", so questions concerning expansion or alteration on site will be more frequent instead. Our research questions [2] were:

What should the land use planning process achieve? What is the current land use planning process achieving? What are the efects of the process? Which of the problems are crucial?

Our work has been conducted according to the principle that the land use planning process should contribute to the protection and saving of life, the environment and property. The land use planning process as a tool for health and safety improvement has not previously been examined and thoroughly analysed, thus there has been a lack of knowledge in the ways the planning process can be improved and on what grounds the planning authorities should make their decisions. Our methodology has been developed in close co-operation with local planners and representatives for relevant industries. It treats land use planning as

1241

a multi-criteria decision-making problem and structures the planning process in seven steps. The specifications of objectives setting the frame in which alternatives are assessed and compared are essential for the methodology. The objectives include different parts, such as: accidents and safety, environmental impact, societal and company aspects with a focus on the safety-related items. Empirical studies have been gathered from planning cases, especially in Sweden and Denmark. An important problem to deal with is how to handle safety zones. Could or should safety zones and safety regulations be mutually defined between local authorities and chemical sites? And if so, on what grounds? We found that there is a lack of feed-forward of experience gained from accidents, near misses and disturbances to improve the land use planning process. We also found that there is a need to develop expert systems to improve the planning process. For example, tools for visualisation of the possible effects of a new localisation, alterations or expansions on and off site are needed. One way to handle this is to develop Geographical Information Systems (GIs). If GIS is to be more integrated in the physical planning process as a tool for handling different aspects of health and safety it must be combined with high quality and updated data from different bodies covering the environment, rescue service, planning, population statistics etc. The issues investigated in LUPACS have been the development and application of decision support for land use planning, with emphasis on safety cases involving chemical sites. At the outset, the decision would be modelled as a Multi-Criteria Decision Problem, but no particular tool or algorithm was prescribed, on the contrary, our first aim was to look through the state of the art. This produced two results with significant influence on the following work, namely 1) schematic reviews of European practices in the field, and 2) a flowmodel description of planning, picturing the Swedish land use planning process. The survey revealed national differences in the "planning environment", i.e. where and by whom planning is worked out and decided. Differences in national practices for risk assessment with chemical complexes will be an essential condition, when prospects of using LUPACS like tools is to be judged. We performed the practical studies with a tool developed, by NCSR-Demokritos, prior to the present project [3]. This featured applying Multi Criteria Decision Analysis to land use planning and involved an associated computer decision support system, which could calculate and present efficient frontiers for different land uses (solutions) considering two parameters at the same time, for instance risk vs. economic benefits. One of the first development steps was to construct a decision frame [4] that unified the multi-criteria decision structure with the flow characteristics emphasised by the Swedish process flow model. To conduct Multi-Criteria Decisions indices are needed, that measure the fulfilment of the criteria used. A comprehensive set of criteria for land use planning was

1242

therefore set up and specific indices were sought. While there is a choice of suitable indices for risk criteria, and while some socio-cultural criteria can be handled quantitatively as well, many criteria for land use can not be represented directly through quantitative indices. There has been a high priority on case studies in the project, with the purpose of trying out the methodology and to get a direct insight into practical land use planning from the viewpoint of possible decision support. As the project team is made up of both scientists and experienced physical planners, these cases acquired a central role as "test sites" for decision and as representative images of real life planning. The planners in the project group provided four cases: two in Sweden and two in Denmark. The Multi- Criteria Decision frame was applied in all cases. The cases represent four different planning situations: 0

0 0 0

the expansion of an oil refinery in Denmark, a pipeline for ammonia on-shore versus an offshore alternative in Denmark, a steel industry in Sweden were a near miss had occurred, and a case in Sweden where both the chemical industry and the municipality wanted to expand into the same area.

3. USER NEEDS We have based our suggestions on user needs and requirements to support land use planning decisions. This identification has been carried out through the collection and collation of the needs expressed by the end users of the method, i.e. decision-makers and physical planners at a local and regional level, together with the needs derived from the industrial domain. Close contacts have been held with the end users in Sweden and Denmark during the development of the case studies and the methodology. This paper reflects the results of these discussions. The use of decision support should have the following purposes in mind: -the generation of new ideas and new solutions -the handling of large volumes of information -addressing multiple objectives in a systematic and efficient manner -ensuring that relevant topics are dealt with. Land-use planning concerning a specific plant is essentially a decision process characterised by an evaluation of alternatives, where objectives of different types and values are weighed up. Briefly our proposed decision process is divided into the following steps: 0

detailed hazard identification and risk assessment (carried out by the industry)

1243

ranking of the problems and formulation of the decision situation description of the case specification of objectives development of alternatives assessment of benefits, costs and consequences evaluation (ranking of alternatives) and selection of the best solution presentation and communication together with important feedback of information -concerning disturbances, near misses and accidents- to the decision makers to improve the planning process. The preparation of alternatives can be seen as a complex, iterative process, where the decision-maker begins with a vague image of some ideal solutions. For each alternative - in order to make them comparable - the benefits, costs, and consequences shall be assessed and therefore it is necessary to keep the number of alternatives and variations at an operational level. We have found that user needs could be grouped into the following areas: Risk identification 0 inventory of hazards and objects at risk Risk analysis 0 questions regarding health and safety in surroundings 0 rough analysis methods 0 knowledge bank with failures and incidents at chemical sites. Risk evaluation (a multi-criteria perspective) 0 introducing and evaluating safety zones 0 checklists 0 methods and tools for health and safety assessments. Visualisation 0 risk maps with sources and objects 0 visualisation of installations, consequences, different alternatives etc. 0 integrating data from several sources in GIS (population, environment, rescue services) 0 consequences of a choice, outside one’s own region Risk communication 0 public hearings 0 citizens as a knowledge bank.

1244

4. METHODOLOGY

The steps in our method are shown in figure 1

Formulation of the decision situation Identification

<

L

Description of the case

Development

Specification of objectives

<

Development of alternatives

<

consequences Selection

Evaluation of choice Presentation and communication I

1 L I

Fig. 1. Steps in the method

The decision-making procedure in figure 1 includes a straightforward line and opportunities for feedback loops between the different steps. The steps are: Formulation of the decision situation, Description of the case, Specification of objectives, Development of alternatives, Assessment of benefits, Costs and consequences, Evaluation of choice, Presentation and communication of decisions. 4.1. Step 1 Formulation of the decision situation Initially the land use situation and its overall goal are described. That is a description of the decision situation of the development of land use patterns in the area including location of a chemical site. The formulation of the overall goal shall address a specification of the origin of land use decision situations for example, application of changes from the industry, revision of a municipal district plan, national interests in the area versus safety goals. In the first step the decision maker and planner must ensure that information concerning all types of constraints are considered, e.g. legislative requirements, safety zones, preserved areas, identification and contact to actors and other key persons.

1245

4.2. Step 2 Description of the case Information about the site and its surroundings shall be obtained and provided early in the decision process. Description of the site could include for example: Intention: Site and facility: Process and equipment: Substances and materials: Operation conditions: Emergency preparedness: Review critical events:

plans for siting and modifications products, capacity, standards process conditions, control systems, transport and supply systems raw materials, products, waste products, and toxicological properties emissions, noise, waste water, quantities of substances and materials on site/in the municipality and region accident causes, near misses.

Description of the area includes, for example, demographic information and population density, topographic features like identification and description of dispersion routes (air, soil, water etc) and meteorological factors like wind direction and speed, atmospheric stability. A land use planning process can be carried out at different levels of detail and the needed level of detail should be considered during the first steps of the decision process. The level of details is limited to access of information and relevant data. 4.3. Step 3 Specification of objectives Land use planning is essentially a decision process characterised by an evaluation of alternatives where objectives of different types and values are weighed up. The objectives to be used in the decision making process are often identified by a more in depth analysis leading to the determination of the evaluation objectives. Proposals for subdivision and attributes are given, for example, Meta-objective Safety Reduce environmental impact

Subdivision

Attribute

Potential Loss of Life (PLL) Minimise PLL on- and -acute or latent off site Waste and disposal Minimise landfilling Optimise re-use

The decision-maker should define all relevant objective attributes. The determination of objectives is a step in the decision making process which forms the frame for subsequent steps. Benefits, costs and probable consequences are assessed for each alternative. In our study we have also used other subdivisions

1246

like Total Socio-economic Benefit (TSB); Total Expected Loss of Life for Sensitive Population (ELLSP); and Total Expected Injuries (TEI) 4.4. Step 4 Development of alternatives The development of alternatives is no simple process. Relevant alternatives need to be defined and discussed, for example, could the company’s production profile be changed? Could the procedures for loading and unloading be changed? Is it necessary to build a school so close to the industry? Are there other alternatives? All in order to improve safety on-and off site. The fundamental concept of the proposed methodology is that the area under consideration is divided into a number of small parts (cells). Next a number of alternative land development types (LDT) are defined for each cell. Classical Multi-Criteria Decision Making Analysis (MDCA) approaches, after the determination of alternatives and the evaluation of each alternative on the set of attributes, involve two final steps, i.e. the assessment of preferences by the decision-maker; and the choice of the most preferred alternative. This in general comprises the assessment of a value h c t i o n andor of a utility h c t i o n quantifying preferences among certain and uncertain alternatives, respectively. This approach, however, is not very practical or useful in a policy context where these decisions are negotiated among a number of policy actors. As a result the LUPACS methodology has adopted a different approach. The cornerstone of this approach is the fact that value trade-offs among highly debated issues, for example, economic benefits and public health consequences, are not formally set. Such trade-offs are unavoidable and are always made implicitly or explicitly when the final decision is made. The LUPACS methodology, however, aims not at making such a decision but rather at facilitating or creating a platform to facilitate the final choice by the appropriate people at the appropriate fora. In order to achieve this the LUPACS approach uses the concept of dominance. An alternative I is said to dominate another 11, if I is either better or equivalent in each and every attribute of evaluation and strictly better in at least one attribute. Comparisons in one dimension (one attribute) are rather easy since they do not involve value trade-offs. So if an alternative results in 40 deaths and lo6 monetary units of benefit, it is definitely more preferred to one that results in 50 deaths and the same economic benefit. An alternative is called dominant or efficient if there is no other alternative in the feasible set that dominates it. The set of all efficient alternatives constitutes the efficient set or the efficient frontier. The efficient set is usually a small subset of the original set of all possible alternatives. Further choice among the alternatives requires a preference assessment. In several instances however, knowledge of the efficient frontier limits the practical alternatives to such a degree that the choice of the most preferred alternative is greatly facilitated.

1247

The concept of efficient frontier can be used also to support decisions about alternative expansion or location for hazardous facilities. Each potential expansion alternative is associated with an efficient frontier representing the available land development patterns in the general area of the installation. In order to provide additional help to the planner/politician in selecting the mostpreferred solution and to stimulate/facilitate meaningful discussions on the problem, the Reference Point method was implemented. The idea of the reference point is that we search through the set of feasible alternatives looking for the one, which deviates least seriously from the target. The second element in the generation of alternatives is the land-development types available for each cell. The methodology accepts, in general, alternative LDTs that may be different for each cell. Of course similar alternative LDTs for every cell are possible. Table 1 Land Development Types (LDTs). Land Development Type LDTl Protected LDT2 Agricultural LDT3 Residential LDT4 Industrial LDT5 Existing residential Relocation possible with compensation

Economic Benefit 0.5 monetary units/cell 1.O monetary unitdcell 13.32monetary unitskell 10 monetary unitdcell 26.64 monetary unitskell

Population density 0.5 personskell 1.2 persons/cell 40 personskell 30 persons/cell 40 persons/cell

4.5. Step 5 Assessment of benefits, costs and consequences For each relevant alternative the benefits, costs, and probable consequences should be assessed. In this connection different issues should be considered, for example, 0 0 0

0 0

Identification of hazards Assessment of accident consequences Potential exposure ( human, environmental, property) - in the event of an accident Expenses and benefits to society and the company Expected future effects on development patterns in the area

1248

4.6. Step 6 Evaluation and choice In general terms the overall purpose of the evaluation process is twofold, to maximise net land developments and to maximise various categories of costs and unwanted consequences. 4.7. Step 7 Presentation and communication of decisions. In the decision making process it the significant that the possible solutions are visualised in an appropriate way to support the actors and key persons as well as the public involved in the understanding of how the solutions will influence the area and society. GIS could be one useful analysis and visualisation tool. 5 CONCLUSIONS

It was initially a problem for land use planners to conceive the principles and the functioning of the methodology, but through working with the cases, they acquired some understanding. The gap between scientific views and the planner's work has to be taken very seriously. The work and the methodology was communicated to groups of planners outside the project group, using case results for illustration; these opportunities showed that the idea could be roughly communicated, and interest in the methodology could be aroused. The results of the used method show that it is technically possible to implement the method. The strength of the method is that it is a tool for analysing a field where methods are undeveloped [5]. Although the involved planners collaborated in each case with a "tool expert" to do the calculations and a "risk expert" to complete the input data, the practical use of the methodology is far from being fully tested. Our conclusion is, that treating land use planning with chemical complexes as a Multi Criteria Decision can probably be done by land use planners, given suitable education and training, but more investigation is needed to better define and understand the weaknesses of the land use planning process per se, and to find the key presentations and the proper ways to manipulate objectives and indicators. The following partners are primarily associated with the project: fis0 National Laboratory, Denmark Emergency Management Agency, Denmark The county board of West Zealand, Denmark. Fredericia Community, Denmark Joint Research Centre, JRC, Ispra, Italy, and the EU National Centre for Scientific Research " Demokritos", Greece University Pierre et Marie Curie, LAFORIA, Paris, France Swedish Rescue Services Agency, Sweden The county board of Sodermanland, Sweden

1249

REFERENCES [13 Land Use Planning and Chemical Sites, ENV4-CT96-0241, EU report, 2000 [2] T. Rosenberg LUPACS planning process in Sweden and Questionnaire, SRSA, Sweden, 1996 [3] H. Briassoulis et al, Development and Application of a Multicriteria Evaluation Methodology, Athens, Greece, 1994 [4] B Rasmussen B et a1 Multi-Objective decisions in land use planning involving chemical sites, =so, Denmark, 1996 [5] I Johansson I “Land use planning and chemical sites; a Swedish case study”, Gothenburg University, Sweden, 2000

This Page Intentionally Left Blank

1251

Modeling the Formation and Release of Hazardous Substances in the Loss of control of Chemical Systems containing Brominated Flame Retardants Federica Barontinia,Valerio Cozzanib,Luigi Petarcab,Severino Zanellib "Consiglio Nazionale delle Ricerche - Gruppo Nazionale per la Difesa dai Rischi Chimico-Industriali ed Ecologici, via Diotisalvi n.2,I-56 126 Pisa, Italy bDipartimento di Ingegneria Chimica, Chimica Industriale e Scienza dei Materiali, UniversitA di Pisa, via Diotisalvi n.2,I-56126 Pisa, Italy 1. INTRODUCTION

Among the many innovative features of "Seveso-11" Directive (96/82/EC), relevant modifications have been introduced in the criteria for the identification of the inventory of "dangerous substances" to be covered by the Directive requirements. In particular, Article 2 states that: "for the purposes of this Directive, the presence of dangerous substances shall mean the actual or anticipated presence of such substances in the establishment, or the presence of those which it is believed may be generated during loss of control of an industrial chemical process". As a matter of fact, DPR 175/88, the previous Italian implementation of Directive 82/501/EEC, explicitely required to take into account also the substances likely to be produced in accidents. However, this requirement could be hardly applied in the absence of well-accepted criteria for the identification of these substances. This study was focused on the assessment of the relevance of hazards due to the unwanted formation of hazardous substances in the loss of control of chemical systems. Chemical systems containing brominated flame retardants were chosen as potential sources of hazardous substances in "out of control" conditions. A methodology developed in a previous study carried out in cooperation with the Major Accident Hazards Bureau of the European Community was applied to identify the hazardous substances of concern with respect to the application of "Seveso-11" Directive. An experimental study was performed to assess the source term with respect to substances potentially formed and quantities to be expected. Several accidental scenarios were identified and assessed. An estimation of the potential damage to humans and to environment was performed for the different scenarios. The effects on site

1252

inventory of the quantities of hazardous substances formed in the different accidental scenarios considered with respect to ” Seveso-11”Directive application were also evaluated. 2. DEFINITION OF THE CHEMICAL SYSTEMS OF INTEREST Additive and reactive brominated flame retardants are widely used in industrial practice to improve the resistance of polymeric materials [l]. In particular, products containing more than 20% of bromine by weight are commonly used for the production of computer electronic boards. However, even if a growing concern is present on the possible formation of hazardous products in the thermal degradation of these substances, scarce data are present on the decomposition products of brominated flame retardants other than brominated diphenyl ethers, as tetrabromobisphenol A (TBBA) and hexabromocyclododecane (HBCD). The chemical systems considered in this study were selected among those of industrial importance in which TBBA and HBCD are present, and are summarized in Table 1. As a matter of fact, TBBA and HBCD are among the most important brominated flame retardants from an industrial point of view. The systems considered included pure TBBA and pure HBCD, that are used as additive flame retardants, and linear brominated epoxy resins obtained by reaction of diglycidyl ethers of bisphenol A (DGEBA) with TBBA. Table 1

Chemical systems considered in the analysis and quantities of HBr formed during the decomposition of the examined materials Material HBCD

Bromine Decomposition g HBr content temperature formed / lOOg (%) range (“C) sample 74.7 240-270 58.4

Bromine released as HBr (%) 77.2

TBBA

58.8

240-350

19.7

33.1

DGEBNTBBA 1 DGEBNTBBA 1.85 DGEBNTBBA 2.75 DGEBNTBBA 4

34.9 26.0 20.4 15.8

320-370 280-390 270-390 250-400

20.8 14.9 6.67 4.38

58.7 56.5 32.2 27.4

3. IDENTIFICATION OF THE DANGEROUS SUBSTANCES FORMED IN “OUT OF CONTROL” CONDITIONS

Predicting the hazardous substances that may be formed in uncontrolled conditions in an industrial chemical process results in a major problem, since the number of potentially dangerous compounds and of possible reactions may be

1253

enormous. Given a compound present in a chemical process, the products of all possible chemical reactions starting from that compound should be considered with respect to the possible hazards deriving from their unwanted formation. However, grouping the chemical compounds on the basis of their similar characteristics and reactivity would substantially reduce the complexity of the problem. A methodology based on lumping analysis of chemical systems was proposed in the framework of a specific study promoted by the Major Accident Bureau of European Community [2]. Lumping analysis consists in the study of chemical systems in which a great number of chemical species is present by the introduction of t'macrocomponents'' (or "pseudocomponents"). Chemical species having similar behaviour are lumped in a single macrocomponent. The criterion used for macrocomponent schematization was the presence of heteroatoms. Further details on the method are given elsewhere [3]. CxHy-X

I+- '

17

halogenated esters

w

COCIZ

:19

x 2

halogenated aromatic hydrocarbons

7

20

21

PHDD PHDF u

chlorohydrine

Fig. 1. Lumped reaction scheme for halogen-containing compounds.

Figure 1 summarizes the preliminary information that was obtained by lumping analysis on the hazardous substances that may be formed in "out of

1254

control" conditions starting from halogenated macrocomponents. The specific information on reaction pathways collected and organized following the macrocomponent methodology in Ref. 2, suggested to consider mainly the reaction pathways 2-4, 9, 19, and 22 (direct and indirect formation of hydrogen bromide and of hazardous brominated hydrocarbons as polybrominated dioxins and furans). However, no data are available on the quantities of these substances that may be formed following accidental events. Thus a preliminary experimental study was necessary in order to confirm the formation of the hazardous substances identified. A further aim of the study was to detect the dangerous substances more relevant with respect to the quantities formed and to the hazard related to their release in the environment following an accidental event. 4. EXPERIMENTAL PART

4.1 Materials The following compounds were used for the study: 1,2,5,6,9,10hexabromocyclododecane (HBCD) and tetrabromobisphenol A (TBBA), supplied by Aldrich, and epikote 828 epoxy grade diglycidyl ether of bisphenol A (DGEBA), supplied by Shell. Linear brominated epoxy resins were prepared by reaction of DGEBA with TBBA, using the procedures described in previous papers [4,5]. In the following, the brominated epoxy resins will be identified by the molar ratio of DGEBA to TBBA. 4.2 Techniques Simultaneous themogravimetric (TG) and differential scanning calorimetry (DSC) data were obtained using a Netzsch STA 409/C thermoanalyzer. A constant heating rate of lO"C/min and typical sample weights of 5-30mg were used in experimental runs. Runs were carried out using a purge gas flow of 60ml/min and alumina crucibles. TG-FTIR simultaneous measurements for the on-line analysis of volatile compounds formed during TG runs were carried out coupling the FTIR spectrometer to the Netzsch TG using a transfer line heated at 200°C to limit the condensation of volatile decomposition products. FTIR measurements were carried out using a Bruker Equinox 55 spectrometer equipped with DTGS and MCT detectors. A laboratory-scale fixed bed reactor (FBR) was used to cany out thermal decomposition runs in inert and oxidizing atmosphere. The experiments were mainly aimed to the recovery and characterization of the gaseous and condensable fraction of volatile decomposition products. Typical sample weights of 200-400mg, sample heating rates of lO"C/min and a 61/h purge gas flow were used for experimental runs. A residence time of lOmin at the final

1255

temperature (usually of 500°C) was accomplished. Further details on reactor characteristics and mode of operation are given elsewhere [6]. A Fisons MD 800 mass spectrometer interfaced to a Fisons GC 8060 gas chromatograph was used for GC/MS analysis. Further details on the experimental devices and techniques used are given elsewhere [4,6]. 4.3 Analysis of TG-FTIR data A linear relation between spectral absorbance at a given wavenumber and concentration of a gaseous compound is postulated by the Lambert-Beer law. Thus, TG-FTIR measurements may be used to generate a specific gas profile to monitor qualitatively the evolution of a gas as function of time or of the temperature of the TG furnace. Suitable wavenumber absorption intervals were identified for the compound of interest, in order to avoid interferences from other substances [6].

Table 2

Pyrolysis products of TBBA identified by GCMS analysis Compound

Molecular weight

Non-brominated compounds Phenol Dibenzofuran Bisphenol A

94 168 228

Monobrominated compounds 2-Bromophenol 4-Bromophenol Bromobisphenol A

173 173 307

Dibrominated compounds 2,4-Dibromophenol 2,6-Dibromophenol 2,6-Dibromo-4-methylphenol Dibromobisphenols A

252 252 266 386

Tribrominated compounds 2,4,6-Tribromophenol Tribromobisphenol A

33 1 465

Tetrabrominated compounds TBBA

544

The more important gaseous product formed in thermal decomposition of brominated flame retardants is hydrogen bromide (HBr). Thus the results of TGFTIR runs were also analyzed in order to estimate the quantities of HBr formed during the thermal degradation in the TG analyzer. The methodology used for

1256

quantitative analysis of TG-FTIR measurements is extensively described elsewhere [ 6 ] . 1

s

.-

....

Y

.-04 3 0

0.8

0.8

Y

's

1

' I

0.6

0.6

i !

0.4

0.4

i ..I

0.2

0.2

c (

T

f

P ~

5 m

z

5:

9

v

0 100

150

200

250

300

350

0

400

Temperature ("C)

Fig. 2. Weight loss curve and evolution profiles of HBr (2498-25 16cm-I) and hydrocarbon compounds (2830-3150cm-I)during HBCD decomposition (constant heating rate of 1O"C/min, 100% nitrogen).

1

1 n

0

.-*

0.8

0.8

."

0.6

0.6

0.4

0.4

0.2

0.2

'3 3

2

q

f

H

2 z

T 5

i.

0 150

200

250

300

350

400

450

0 500

Temperature ("C)

Fig. 3. Weight loss curve and evolution profiles of HBr (2498-2516cm") and hydrocarbon compounds (2830-3 150cm-I) during TBBA decomposition (constant heating rate of lO"C/min, 100% nitrogen).

1257

4.4 Results and discussion

Simultaneous TG/DSC analysis was used in order to evaluate the thermal stability and the thermal effects associated to the decomposition. Simultaneous TG/DSC runs in pure nitrogen at a heating rate of 10"C/min were carried out. An endothermic decomposition was observed for HBCD and TBBA samples, while exothermic effects were obtained for brominated epoxy resins. Further data on thermal effects and thermal stability of these materials are discussed elsewhere [61. TG-FTIR and FBR runs allowed the characterization of thermal degradation products at the low heating rates (lO°C/min) used in the present study. The condensable ffaction of degradation products recovered from FBR runs was analyzed by GC/MS. GC/MS analysis allowed the identification of many products. The results obtained for TBBA are reported in Table 2, while the results obtained for the other materials are discussed elsewhere [6]. Based on the identified products, the main pathways of thermal degradation could be investigated and decomposition mechanisms were proposed [6].

Fig. 4. Weight loss curve and evolution profiles of HBr (2498-2516cm-') and CO (20302235cm-') during decomposition of the 1.85 DGEBNTBBA resin (constant heating rate of lO"C/min, 100% nitrogen).

Qualitative emission profiles as a fimction of temperature were obtained from TG-FTIR runs. Hydrogen bromide was one of the main products generated during the thermal decomposition of the materials analyzed. Figures 2 and 3 show the evolution profiles for hydrogen bromide and for hydrocarbon compounds compared with the weight loss curve during the thermal degradation of HBCD and TBBA, respectively. The evolution profiles for hydrogen bromide

1258

and for carbon monoxide during the degradation of the 1.85 DGEBNTBBA resin are reported in Fig. 4. FTIR data were used to obtain data on the quantities of hydrogen bromide generated during decomposition. Table 1 reports the results obtained for the different samples considered. The bromine content of the pyrolysis residue was determined by combustion followed by argentimetric titration. A mass balance on the recovered product fractions allowed the estimation of the bromine distribution among the different product fractions. The results obtained for HBCD and TBBA are reported in Tables 3 and 4, respectively. Table 3 Quantitative data on the bromine distribution between the different fractions of HBCD degradation products Fraction of sample initial mass (weight %) Fraction of bromine initially present (weight %) Bromine content (weight %)

HBCD

HBr

Condensables

Residue

100

58

36

6

100

77

23

=O

74.7

98.8

48

=O

Table 4 Quantitative data on the bromine distribution between the different fractions of TBBA degradation products Fraction of sample initial mass (weight %) Fraction of bromine initially present (weight %) Bromine content (weight %)

TBBA

HBr

Condensables

Residue

100

19.7

65.3

15

100

33

64.5

2.5

58.8

98.8

58

10

In order to investigate the influence of oxidizing conditions on thermal stability, constant heating rate (lO°C/min) TGDSC, TG-FTIR and FBR runs were performed using air (21% oxygen by mol) as the purge gas. No relevant differences were observed in the weight loss and decomposition thermal effects, in the decomposition products identified and in the quantity of hydrogen bromide formed. Thus, these results suggest that even at the low heating rates used in the experimental runs (lO°C/min), the primary decomposition process of the brominated materials considered is not influenced by the presence of air, and that the data obtained may have a more general validity.

1259

5. SCENARIO IDENTIFICATION The analysis of major accidents databases and of specific databases on the formation of hazardous substances as a consequence of “out of control” conditions [7] suggested the identification of two different accidental scenarios for the unwanted formation of hazardous substances in the chemical systems studied: the involvment in fires of pure TBBA and HBCD, or of brominated epoxy resins; and the runaway of TBBADGEBA polymerization processes. For the sake of brevity, only the consequences of the first type of scenarios will be discussed herein. The more severe fire scenario involving these substances is a pool fire in which brominated flame retardants and solvents are contemporary present. This scenario may take place either in warehouses or in storage tanks where the TBBNDGEBA linear resins are stored using acetone as a solvent to reduce the viscosity of these products at ambient temperature. The source terms for hydrogen bromide and for high molecular weight organobrominated compounds were directly derived from the experimental data obtained. This is obviously only a working hypothesis, but it is believed that the experimental data obtained may be used at least to obtain indicative values of the quantities of hazardous substances that may to be formed following accidental events. Table 5

Parameters of the accidental scenarios considered in the analysis

HBCD weight fraction in pool pool diameter (m) combustion velocity (kg/m2s) quantity burned (kgk) HBr formed (kg/s) flame temperature (K) plume raise initial velocity ( d s ) atmospheric conditions fire duration (h)

0.5 40 0.09 55 32

1200 1.1 D5 2

TBBA 0.5 40 0.09 55 11 1200 1.5 D5 2

DGEBN TBBAI 0.7 40 0.09 77 17 1200 1.4

D5 2

6. CONSEQUENCE ASSESSMENT

Only off-site consequence assessment was performed. Thus the analysis was aimed to assess the consequences of the release of the hazardous substances formed due to plume dispersion and to organic particulate deposition. Dispersion of hydrogen bromide was analyzed using literature neutral gas

1260

dispersion models [8], considering the dilution due to the presence of other combustion products and to the plume raise. The main parameters used for the study of the hydrogen bromide dispersion are summarized in Table 5 . Combustion velocity was assumed to be equal to that of the solvent present in the pool (acetone). Conservative assumptions were used for the determination of this and of the other model parameters, in order to obtain worst-case results. Figure 5 shows the down-wind hydrogen bromide concentrations for the scenarios studied. As shown in the figure, with the hypothesis used, the IDLH concentration for HBr (99.3mg/m3) is obtained at ground level only for a fire involving pure HBCD. Figure 6 shows the isoconcentration curves obtained for this scenario. The release of organobrominated substances was studied using Clancey particulate dispersion model [9]. Particulate diameter distributions and fraction of condensables released to the environment were assumed on the basis of literature values obtained from large-scale pesticide fire simulation experiments [ 10-131. Further details on modeling assumptions are reported elsewhere [6]. Modeling results show that for the scenarios considered, particulate deposition after 2h may reach values as high as 50glm2up to downwind distances of 5km and cross-wind distances of about 300m. Since the study mainly concerned worst-case scenarios, two important conclusions may be drawn: the accidental events considered are unlikely to cause off-site lethal concentrations of gaseous hazardous products, but the possibility of a severe contamination of the ground up to about 5 km should be considered, caused by the deposition of particulate containing high molecular weight brominated organic compounds.

I I I I I

604020 0

Fig.5.

I

I

\

,-.

\

\

\

\

\

\

.'..---

-.

I

-- - _ -I

HBr down-wind concentrations at ground level for the accidental scenarios considered.

1261

--_

Down-wind distance [m]

Fig. 6. Isoconcentration curves for HBCD fire scenario.

7. ASSESSMENT OF “SEVESO-11” REQUIREMENTS

It is interesting to assess the possible requirements of Article 2 of the “SevesoII” Directive with respect to the scenarios studied. The relevant text of Article 2, concerning the definition of “presence of dangerous substances”, was reported in the introduction to the paper. The hazardous product formed in higher quantities in the scenarios assessed is surely hydrogen bromide. From Table 5 , total quantities of HBr formed may be easily estimated. The results are reported in Table 6. As shown in the table, all the three scenarios studied concern the formation of a toxic substance (HBr) in quantities higher than those required for the application of Articles 6/7 (notification) and, in the case of HBCD, of Article 9 (safety report). However, the compound is not present in normal process conditions and is formed as a consequence of an accident involving substances that are not included in Annex I of the Directive. Thus it is questionable if the full application of article 2 of the Directive would require the application of obligations present in articles 6/7. 8. CONCLUSIONS

A preliminary assessment of the consequences of the formation of hazardous substances in “out of control” conditions was perfomed for chemical systems of industrial importance where brominated flame retardants are present. The study was based on an extended preliminary experimental work. The scenarios

1262

analyzed resulted in the possibility of severe off-site contamination due to particulate deposition following fires. The relevance of these scenarios with respect to the possible application of the obligations of Directive 96/82/EC should be thoroughly considered. Table 6

Assessment of possible “Seveso-11” Directive requirements HBCD total quantity burned (t) total quantity of HBr formed (t) pure substance: limit for Art.6/7 obligations HBr: limit for Art. 6/7 obligations HBr: limit for Art.9 obligations

396 230 --50 200

TBBA 396 79

DGEBAI TBBA1 554 122

50 200

50 200

_--

---

REFERENCES A. Pettigrew, Halogenated flame retardants, in Kirk-Othmer: Encyclopedia of Chemical Technology, 4” ed., John Wiley & Sons, New York, 1993, Vol. 10, p. 954. V. Cozzani, S. Zanelli, EUCLID: A study on the Emission of Unwanted Compounds Linked to Industrial Disasters, EUR 17351 EN, Commission of the European Communities, Luxembourg, 1997. V. Cozzani, S. Zanelli, Journal of Hazardous Materials, 65 (1999) 93. F. Barontini, V. Cozzani, L. Petarca, AIDIC Conference Series, EMS C.T., Milano, 1999, Vol. 4, p.115. F. Barontini, V. Cozzani, L. Petarca, Industrial & Engineering Chemistry Research, 39 (2000) 855. L. Pecori, Bs. Thesis in Chemical Engineering, University of Pisa, Pisa (2000). V. Cozzani, S. Zanelli, A. Amendola, M. Smeder, Proc. Annual Meeting of the Society for Risk Analysis, Center for Risk Research, Stockholm, 1997, p. 224. E.A. Bakkum, N.J. Duijm, Vapour cloud dispersion, in Yellow Book, CPR 14E, 31d ed., TNO, NL, 1992, Chapter 4. F.P. Lees, Loss prevention in the process industries, Znd ed., Butterworth-Heineman, London, 1986. F.M. Davie, P.F. Nolan, EUR 15340 EN, Commission of the European Communities, Luxembourg, 1993, p. 79. D. Booker, K.D. Horton, C.R.F. Petchey, Industrial Fire Workshop Proceedings 11, EUR 15967 EN, Commission of the European Communities, Luxembourg, 1994, p. 179. F.M. Davie, P.F. Nolan, Industrial Fire Workshop Proceedings 11, EUR 15967 EN, Commission of the European, Luxembourg, 1994, p. 191. M. Molag, H. Bartelds, D. De Weger, Toxic products from pesticide fires, Report 92366/112327-17897, TNO, Apeldoorn (NL) 1992.

1263

An Approach to the Assessment of Domino Accidents Hazard in Quantitative Area Risk Analysis Valerio Cozzani and Severino Zanelli

Dipartimento di Ingegneria Chimica, Chimica Industriale e Scienza dei Materiali, Universita degli Studi di Pisa, via Diotisalvi n.2, 56126 Pisa, Italy 1. INTRODUCTION The severity of accidents where propagation effects took place, generally named as "domino" or 'knock-on" accidents, is well known [l-41. The European Community "Seveso-11" Directive (Directive 96/82/EC) [5] requires to assess ''domino" accident hazards inside and outside the industrial sites that fall under the obligations of the Directive. Moreover, the Italian implementation of the Directive (DL 334/99) also requires the comprehensive quantitative risk analysis of areas where a high concentration of industrial sites is present, in order to assess the potential hazards due to the interaction of multiple risk sources in a narrow area. The development of land use planning criteria for the reduction of industrial hazards for the population calls for the application of quantitative area risk analysis (QARA) methods [6]. However, available QARA techniques are mainly derived from quantitative methodologies for the analysis of single risk sources. Thus the main limitation of the QARA techniques currently available is in the correct analysis of the effects of the interaction of the different risk sources present in a narrow area. In particular, specific quantitative criteria for the estimation of "domino" or knock-on accidental scenarios are still lacking, even if it is well known in the literature that also minor accidental events may start "knock-on" phenomena that may result in high-severity accidents. Previous work in this field was mainly addressed to the systematization of the problem and to the development of qualitative methodologies [ 1,7-91. Literature data are present on threshold values of physical effects that may cause "knockon" phenomena [3,4]. Proposed methodologies for quantitative domino hazard assessment usually require a very complex analysis of site lay-out [2,7,10] or are based on not completely justified simplifying assumptions [3,11,121. Furthermore, the potential use of geographical information systems (GIS) for a straightforward analysis of domino effects has not been considered up to date.

1264

This study was aimed to the development of a systematic procedure for the assessment of domino hazard within quantitative area risk analysis. The starting point of the work was the assumption that a full characterization of all primary risk sources present in the area was available, as usual when a QARA study is undertaken. Two different kinds of accidental scenarios due to "domino" hazard were identified: i) propagation of low-severity initiating events (not considered relevant "top events" in quantitative risk analysis of primary risk sources); and ii) interaction of different "top events". A quantitative probabilistic methodology was based on this distinction. A considerable effort is currently dedicated to the selection and the development of specific probabilistic functions to estimate accident propagation probability. The study was carried out within a more general research project concerning the revision and further development of QARA techniques and softwares for the application to industrial risk assessment of an Italian industrial area. Therefore, the procedures for the evaluation of knock-on effects were oriented towards the development of a systematic approach suitable to be combined with the use of vulnerability models for hazard assessment. A GIs-based software for quantitative area risk analysis (Aripar-GIs) [6] was used to manage information on primary events and to evaluate individual and social risk from domino hazards. A preliminary assessment of domino events in an Italian industrial area was performed in order to quantify the relative importance of domino hazard with respect to the total social and individual risk due fixed installations and to the transport of hazardous substances in the area. 2. IDENTIFICATION OF ACCIDENTAL SCENARIOS

2.1. Types of domino effect The starting point in the assessment of domino accidents is the identification of the accidental scenarios. Even if conventional techniques as event tree method may still be used, it seems useful to approach the problem introducing different categories of domino effect. As a matter of fact, domino accidents may have two different causes: i) propagation of low-severity initiating events; or ii) interaction of different "top events" These two categories of knock-on accidents may take place separately, but may also result in a single accident. An example is given by an accident that took place in an Italian plant for ethylene and propylene production in 1985. The accident was initiated by the rupture of a small diameter (2") ethylene pipe caused by the unboltening of a flange due to vibrations originated by repeated opening and closing of a safety valve. A minor jet fire started, that impinged on a 600mm pipe containing C,-C, hydrocarbons. The pipe suddenly ruptured and

1265

a major jet fire started. The ignited jet impinged a vertical pressurized propane storage tank. In a few minutes, a first BLEVE took place, followed by the BLEVEs of several other pressurized storage vessels present in the tank park. The plant was almost completely destroyed. This example shows both the possible knock-on effects. The main jet fire was started by a minor event as a 2" pipe jet fire. This event was possibly neglected in plant safety analysis, since a jet fire from a 2" pipe is not likely to be considered a ''major accident" if only primary consequences are considered. On the other hand, the complete sudden rupture of a 600mm pipe is usually not considered in plant safety analysis, since primary external events causing the full-diameter rupture of a pipe of diameter higher than 10" are regarded as highly unlikely. Thus if domino effects are overlooked, the consequence analysis of the jet-fire of the 600mm pipe could possibly be neglected. Nevertheless, the more severe consequences of the accidents were caused not from the first major event (the 600mm pipe jet fire) but from the secondary major events: the BLEVEs of the pressurized tanks. These were the consequence of the second type of domino effects defined above. The safety analysis of pressurized storage vessels usually considers the possibility of tank BLEVE and includes BLEVE consequence analysis. However, the frequency of this top event is usually estimated only on the basis of sequences of primary events, as the release and ignition of flammable material from the tank. The increased hazard caused by possible knock-on effects is in general neglected, also due to the lack of well-accepted procedures for quantitative domino assessment. The example given above shows that the accidental scenarios due to the two different types of effects have quite distinct features. Thus the methods to be used for the identification of the accidental scenarios are quite different. 2.2. Accidental scenarios caused by the first type of domino effects In order to define the scenarios due to the first kind of knock-on effects (propagation of low-severity initiating events), it is necessary to identify all potential low-severity initiating events (LSIE). Assuming that the hazard and operability analysis (Hazop) of the plant is available, the identification of LSIE may only require the critical revision of all the top-events identified in Hazop but considered of negligible importance and not further examined in consequence analysis. Minor jet fires (i.e. from small diameter pipes or valves) or pool fires (i.e. caused by leaks from seals) are the more likely events that may cause accident propagation. The LSIE propagation analysis may result in: 1) The identification of accidental scenarios not previously considered in the safety analysis of the plant, thus requiring a complete frequency and consequence analysis

1266

2) The identification of knock-on as a cause of accidental scenarios considered unlikely and thus neglected in the consequence analysis (i.e. the sudden and complete rupture of pipes of diameter higher than 2"). The assessment of these scenarios requires the revision of the frequency analysis and a complete consequence analysis of the event. 3)The identification of knock-on as a further cause of accidental scenarios already considered in the safety analysis of the plant. The assessment of these scenarios requires only the revision of the frequency analysis of the event. 2.3. Accidental scenarios caused by the second type of domino effects The identification of scenarios caused by the second type of knock-on (interaction of different "top events") requires the analysis of the effects of primary accidental scenarios that may trigger secondary events. Since the consequences of both the primary and secondary accidental events should be available from the safety analysis of the plant, the assessment of this second type of domino accidents should only require the application of propagation assessment criteria and of frequency analysis.

3. CRITERIA FOR PROPAGATION ASSESSMENT Accident escalation may take place due to three different effects: i) overpressure; ii) radiation; and iii) missile projection. Khan and Abbasi [3] also propose toxic release as a possible cause of domino events. However, this may be only an indirect cause of accident escalation, mainly due to deficiencies in emergency procedures, and thus will not be considered herein. Many literature methods for the assessment of accident propagation are based on the identification of threshold values for the primary physical effects. The more common values reported in the literature are of 37kW/m2for radiation and of 0.7atm for overpressure [3,4]. However, the reliability of these thresholds is questionable and different values are suggested by other sources [ 131. A further problem is that no general threshold is present for missile damage. Moreover, a quantitative assessment requires also the estimation of the probability of propagation: thus probability propagation functions are needed. In the literature, three different approaches are proposed: i) propagation functions based probit functions [3,4,8]; ii) propagation functions based on empirical physical effect decay relations [12,141 and iii) worst case approach (propagation probability 1 if the secondary target is inside the threshold for accident propagation). Even if the first approach seems the more promising, further work is needed in this field. The current work of the authors is aimed to the development of simplified probability propagation functions [ 151. However, this aspect will not

1267

be discussed further in this paper, and in the following it will be assumed that suitable probability propagation functions are available.

Figure 1. Example of first-kind domino event (LSIE escalation)

4. FREQUENCY ANALYSIS 4.1. Accidental scenarios caused by the first type of domino effects Figure 1 shows an example of a possible scenario for a first-type domino event. The possibility of confined explosion inside blast-furnace and coke-gas pipe networks was assessed in plant safety report, resulting the possibility of missile projection. An atmospheric blast-furnace gas storage tank was identified as a possible target of missile projection. The primary event is reasonably a LSIE, as confirmed by plant management experience. On the other hand, the secondary event (leak of blast-furnace gas from atmospheric tank puncturing) may result in a major accident. Frequency of the secondary accident caused by LSIE may be calculated as:

1268

(1) fde = fp ’ Pd where fd, is the expected frequency of the domino event, fp is the expected frequency (eventdyear) of LSIE and P, is the propagation probability, estimated on the basis of the criteria discussed above: Pd = P(IslEILG) (2) If accidental scenarios not previously considered or considered unlikely are identified, the frequency of the secondary accident is equal to fde. If the LSIE is identified as a further cause of the secondary event, the frequency of the secondary event is: (3) fse = fpt + fde where f,, is the total frequency of secondary top event and fptis the frequency of top event as a primary event.

Figure 2. Example of second-kind domino event (primary top-event triggering a secondary top-event)

4.2. Accidental scenarios caused by the second type of domino effects An example of the second type of domino events is given in figure 2. A leak from atmospheric tank 1 may result in a pool fire. Pool fire radiation may cause the failure of a second tank. Both primary event (pool fire in tank 1) and secondary event (tank fire 2) may be regarded as major accidents and are considered in the safety report of the plant. In the conventional approach for the safety assessment of chemical plants and in QARA studies, it is a common practice to consider the different top events as “independent” and “mutually exclusive” from a probabilistic point of view. This hypothesis (P(ln2)mO) may be justified only if primary events expected frequencies have low values and if domino effects of second tvpe may be excluded.

1269

If second-type domino effect events are possible, the “mutual exclusivity” hypothesis should be removed. Thus a quantitative assessment of domino probability may be the following: (4) fDE = fpl ’ pd,l-+2 -I-fp2 ‘ pd,2+1 where fDEis the expected frequency of the second type domino event, fpland fp2 the total frequencies of primary events 1 and 2, and Pd,1+2 and Pd,2+1 the propagation probabilities. Obviously, in general fp, # fp2and Pd,1+2 f Pd,2+1.In particular, one of the propagation probabilities may be 0 if the physical effects of primary event are not likely to trigger the secondary event. Furthermore, if second-type domino events are possible, the frequencies of the primary top-events taking place in the absence of domino events should be recalculated: (5) fptl = fpl ‘ (1 - pd,l+2) (6) fpt2 = fp2 * - pd,2-+1 )

t1

5. CONSEQUENCE ANALYSIS

5.1. Accidental scenarios caused by the first type of domino effects With reference to the three different situations defined in section 2.2, consequence assessment of the event is already available in case 3. In cases 1 and 2, conventional methods should be applied, thus requiring the use of quantified event trees, release models and fire, dispersion or explosion models. Vulnerability models based on probit equations may be used to evaluate damage probabilities [4]. 5.2. Accidental scenarios caused by the second type of domino effects Since these scenarios arise from the interaction of two major accidents, a full consequence assessment of the primary and secondary event should be available in the safety reports of the plants. Thus, a first approach to the consequence analysis may be to neglect the synergetic effects that may arise from accident interaction. Thus accident consequences may be analyzed superimposing the physical effects (radiation, overpressure, toxic gas concentration) separately calculated for the single scenarios that may take place. A more simple approach is obtained if vulnerability functions are used for damage evaluation. In this case, if the non-linear dependence of dose-effect relation in vulnerability equations may be neglected, damage probabilities of the single events can be directly added to yield at least a rough estimate of the overall damage probability. This result is of particular interest in QARA techniques, were the vulnerability maps of single accidental scenarios are usually available.

1270

Vulnerability is usually estimated in QARA studies using probit functions: (7) Pr = a+b.ln(Da at) where a, b, and a are parameters depending on the physical effect considered, D is the dose and the time of exposure. A mathematical function correlates damage probability and probit value: v = f(Pr) (8) where V, the damage probability, ranges between 0 and I . The vulnerability at a generic position P of the area studied, V,, due to a second-type domino accidental event is given by: (9) vt = F(vl v2) where V, and V, are the vulnerability values due to top events 1 and 2 respectively, and F is a function that needs to be defined. Since the damage probability ranges between 0 and 1, assuming that consequence maps of the primary and secondary top events are not modified by synergetic effects, the function F may have the following expressions: 7

1.

if the two events cause different types of physical effects (radiation and overpressure, radiation and toxic gas concentration, etc.), and if synergetic effects of the different physical effects are neglected: F(V1,V2)= min{(vl +v2)~1) (10)

2.

if the two events cause the same physical effect (e.g. radiation) and if it is assumed that synergetic effects may be neglected: F(V1,V2)= f(Prt) with Pr, = Pr(Prl,Pr2) and Pri = f-'(Vi), i=1,2 (11) where f is the function that correlates probit and damage probability (see eq.8). Thus, the total probit value Pr, results from the following:

1-

Pr(Prl,Pr2)=a+b-ln e

=]a ab

+e

ab

The calculation of (12) may be simplified by a linearization: Pr(Prl,Pr2) M p1 Prl+ p2 Pr2+ R,

(12)

(13)

This simplified method was used for a preliminary quantitative assessment of domino effect in a QARA study of an Italian industrial area.

1271

Figure 3.

The area considered in the QARA study.

6. ASSESSMENT OF DOMINO HAZARD IN AN INDUSTRIAL AREA 6.1. The QARA study ARPAT promoted in 1998 a QARA study of an Italian industrial area in the Toscana region. The study was performed by the University of Pisa with the cooperation of two private companies, and was supported also by CNRGNDRCE. Social and individual risk due to chemical plants and to the transport of hazardous substances to and from the industrial sites and the harbour were evaluated. In order to show the extension of the area considered in the study, a map is reported in fig.3. Table 1 summarizes the accidental scenarios due to fixed installations present in the area. The QARA study was based on methodologies developed in a previous Italian studies of comprehensive quantitative risk assessment of industrial areas [ 6 ] .A GIs-supported software was used for the calculation of social and individual risk. Frequency values and physical effects maps available in safety reports

1272

where used to estimate the risk due to fixed installations. Ab-initio analysis of risk related to road, rail, pipe and ship transport of hazardous goods was performed. The results are reported in the literature [16] and will not be further discussed herein. Table 1

Scenarios due to chemical plants present in the area studied

Type of Scenario

Pool-fire UVCE Jet-fire Toxic Cloud Flash-fire BLEVE Fireball Confined Explosion Total

number of events 106 78 53 40 26 5 7 7 322

maximum damage distance (m) 210 1700 125 450 1015 220 3456 20

Frequency 0

1E-04 1E-05 1E-06 1E-07 lE-08 1E-09

F.I. considering domino -Total

1E-10 1E-11

1

10

100

1000

10000

Fatalities (N)

Figure 4: Social risk in the area studied considering domino accidental events [I61

1273

6.2. Assessment of domino effect The above discussed methodology was used to assess the influence of domino events. Only radiation and overpressure effects were considered in the analysis. The approach to propagation probability estimation was based on a worst case hypothesis (P,=l) and on threshold criteria (0.7atm for overpressure and 37.5kW/m2for radiation). The main source of domino accidents was found to be the LPG storage of an oil refinery present in the area. First type domino accidents were found to have a negligible effect on overall social risk. On the other hand, second-type domino events resulted in a relevant modification of the social risk due to fixed installations, as shown in figure 4. The figure points out that domino events are particularly important for high fatalities (N) values. This indicates that second type of domino effects mainly result in severe accidents. The worst-case hypothesis used to define propagation probability obviously leads to an overestimation of social risk due to domino hazard. However, the curves reported in figure 4 respectively considering and not considering the domino hazard are the boundaries of the “domino” region. Clearly, the “true” value of social risk should be comprised between the two curves in figure 4. Thus the figure is the starting point to verify the possible use of different propagation probability functions for a more realistic estimate of “domino” hazards.

7. CONCLUSIONS An approach for a systematic and simplified quantitative assessment of domino

effects in QARA was developed. Criteria for the quantitative evaluation of domino scenarios were obtained. The proposed approach shows that only in a limited number of cases a full consequence and frequency assessment is necessary for domino scenarios. In particular, if synergetic effects are neglected, knock on scenarios resulting from the interaction of different 'Yap events” may be evaluated from probabilistic techniques using the maps of the physical effects (radiation, overpressure, toxic concentration) obtained for the single events. Even if further work is necessary to define reliable propagation probability functions, the results obtained showed that domino hazard highly influences social risk curves, in particular in the high severity (N>lOO) region.

1274

ACKNOWLEDGEMENTS

The authors gratefully acknowledge Prof. Fausto Gozzi, Dr. Marcello Mossa Verre, Dr. Francesco Marotta, and Dr. Stefan0 Baldacci for usefid discussions, and ARPAT (Agenzia Regionale per la Protezione Ambientale della Toscana) for technical support to the present study. Financial support from CNR Gruppo Nazionale di Ricerca per la Difesa dai Rischi Chimico-Industriali ed Ecologici is acknowledged. REFERENCES C. Delvosalle, Domino effects phenomena: definition, overview and classification, Proc. European seminar on domino effects, Leuven, 1996, p. 11. C. Delvosalle, A methodology for the identification and evaluation of domino effects, Rep. CRC/MT/003, Belgian Ministry of Employment and Labour, Bruxelles, 1998. F.I. Khan, S.A. Abbasi: “Models for domino effect analysis in chemical process industries”. Proc. Safety Prog. 17 (1998) 107. F.P. Lees, Loss Prevention in the process industries (I1 ed.), Buttenvoth-Heineman, Oxford (UK), 1996 Council Directive 96/82/EC of 9 December 1996 on the control of major-accident hazards involving dangerous substances. Official Journal of the European Communities, L 10/13 , Brussels, 14.1.97 D.Egidi, F.P.Foraboschi, G.Spadoni, A.Amendola, Reliability Eng. System Safety, 49 (1995) 75 S.Contini, S.Boy, M.Atkinson, N. Labath, M.Banca, J.P.Nordvik, Domino effect evaluation of major industrial installations: a computer aided methodological approach, Proc. European seminar on domino effects, Leuven, 1996, p.1 P.Latha, G.Gautam, K.V.Raghavan, Strategies for tha quantification of thermally initiated cascade effects, J. Loss Prev. Process Ind. 5 (1992) 18 R.L. Greenwood, Research into the methodologies and criteria for domino effects, Proc. European seminar on domino effects, Leuven, 1996, p. 19 M.Monis, A. Miles, J. Copper, Quantification of escalation effects in offshore quantitative risk assessment, J. Loss Prev. Process Ind. 7 (1994) 337 G.N.Pettitt, R.R.Schumacher, L.A.Seeley, Evaluating the probability of major hazardous incidents as a result of escalation events, J. Loss Prev. Process Ind. 6 (1993) 37 D.F. Bagster, R.M. Pitblado, The estimation of domino incident frequencies: an approach, Proc.Safety Environ. 69 (1991) 196 R.W.Nelson, Fire protection design, Hydroc. Processing 8 (1977) 103 F.P.Lees, B.R.Poblete, The assessment of major hazards: generalisation of the impact model for the estimation of injury and damage around a hazard source, J. Haz.Mat. 13 (1986) 187 V.Cozzani, W.Folgheraiter, M.Carcassi, Procedures for risk analysis of pipeline networks, Proc. 9” Annual Meeting of the European Society of Risk Analysis, Delft University Press, Delft (NL), 1999, p.134 M. Mossa Verre (Ed.), Analisi del rischio per l’area di Livorno e strategie di intervento, ARPAT, Firenze, 2000

1275

Chemical accident risks in U.S. industry A preliminary analysis of accident risk data from U.S. hazardous chemical facilities James C.Belke' United States Environmental Protection Agency Chemical Emergency Preparedness and Prevention Office Ariel Rios Building 1200 Pennsylvania Avenue, N.W. Washington, D.C. 20460 United States of America 1. INTRODUCTION

In response to the chemical accident that occurred in Bhopal, India, in 1984, and a series of large chemical accidents in the United States in the late 1980s, the U.S. Congress passed a series of laws intended to minimize the likelihood and consequences of catastrophic chemical accidents. The most recently enacted of these laws created a new regulatory program called the Risk Management Program. This program, which took effect in June 1999, requires certain chemical facilities to implement chemical accident prevention and preparedness measures, and to submit summary reports to the government every five years. Approximately 15,000 facility reports have been received to date, and these contain significant information on each facility's accident history, accident prevention program, and the potential consequences of hypothetical accidental chemical releases. These data have been assembled into a searchable computerized database, called RMP*Info. The full RMP*Info database was originally intended to be available to the general public via the Internet, so that concerned citizens could use the information to influence local facilities to adopt +

Unless otherwise noted, all opinions expressed in this paper are those of the author, and do not necessarily represent official positions or policies of the United States or the US. Environmental Protection Agency.

1276

safer practices, and to allow researchers to identify factors statistically associated with accident-prone or accident-free facility performance. However, the chemical industry and U.S. security agencies raised concerns that some of the data would allow terrorists to easily identify those facilities likely to cause the greatest harm to the public in the event of a release, and target those facilities for attack. These concerns prompted Congress to pass legislation in August 1999, that, along with subsequent federal regulations, currently restricts public access to portions of the RMP*Info database. Therefore, as of this writing, the complete database is only accessible by a relatively few individuals at EPA headquarters, and, with the exception of one other preliminary study that considered only its non-restricted portions, it has not been subject to the robust statistical analysis that might lead to identifying accident indicators or causal factors. This paper proceeds in that direction by providing some basic descriptive statistics that characterize the database, including its restricted portions, within the limitations set by United States law. 2. A BRIEF HISTORY OF U.S. CHEMICAL ACCIDENT LEGISLATION 2.1. Emergency Planning and Community Right-to-Know Act The first major law intended specifically to address the problem of chemical accidents in the United States was the Emergency Planning and Community Right-to-Know Act of 1986 (EPCRA) [l]. This law requires states to create State Emergency Response Commissions (SERCs) and communities to form Local Emergency Planning Committees (LEPCs) to prepare local emergency response plans for chemical accidents. It also requires chemical facilities to provide LEPCs with information necessary for emergency planning, and to submit to SERCs, LEPCs and local fire departments annual inventory reports and information about hazardous chemicals. The statute also established the Toxics Release Inventory (TRI), which requires certain facilities to annually report the quantities of their emissions of toxic chemicals. The chemical inventory data are available to the public and EPA maintains a national database containing TRI reports.

2.2. OSHA Process Safety Management standard EPCRA focused on community emergency planning, but contained no provisions for the prevention of chemical accidents and, because major accidental releases continued to occur, Congress subsequently included two provisions in the Clean Air Act (CAA) Amendments of 1990 to institute federal regulatory programs to prevent chemical accidents that harm workers, the public and the environment [2].

1277

The first of these programs (section 304 of the Clean Air Act Amendments) called for the Occupational Safety and Health Administration (OSHA) to develop chemical accident prevention and emergency response regulations to protect workers at hazardous chemical facilities. OSHA responded by developing the Process Safety Management (PSM) standard (29 CFR Part 19lo), which places accident prevention and emergency response requirements on facilities having listed hazardous chemicals above certain threshold quantities. The PSM standard went into effect in 1992 [3].

2.3. EPA Risk Management Program The other accident prevention program contained in the amended CAA (section 112(r)) called for EPA to develop regulations to prevent and respond to chemical accidents that could affect the public and environment off-site. EPA met this obligation in 1996 by promulgating the Risk Management Program regulations (40 CFR Part 68) [4]. The Risk Management Program is similar to OSHA’s PSM standard, as it covers many of the same toxic and flammable substances+,and requires virtually the same set of accident prevention requirements as the OSHA standard. These requirements include using written operating procedures, providing employee training, ensuring ongoing mechanical integrity of equipment, analyzing and controlling process hazards, and the like. However, while the accident prevention elements of PSM and RMP are nearly identical”, section 112(r) of the CAA and the resulting EPA Risk Management Program contain several additional requirements beyond those +

The EPA Risk Management Program covers 77 toxic and 63 flammable substances. In the CAA Amendments of 1990, Congress mandated 16 specific hazardous substances for regulation under the RMP, and required EPA to list at least 100 such substances which pose the greatest risk of causing death, injury, or serious adverse effects to human health or the environment from accidental releases. ++

The RMP regulation places each covered process into one of three “programs,” labeled 1,2, or 3. The program level assigned to the process is based on the potential for the process to impact the offsite public, the accident history of the facility, and whether the process is already subject to OSHA PSM. Processes that have the greatest potential to affect the offsite public in the event of an accident or that are already subject to OSHA PSM are subject to program 3, which imposes the most rigorous set of accident prevention requirements (essentially the full set of PSM requirements). Processes which are unlikely to affect the offsite public in the event of a worst-case release and that have no history of such accidents in the last five years are placed in program 1, which imposes a minimal set of requirements. All other processes are subject to program level 2, which imposes a streamlined set of requirements [4].

1278

contained in OSHA PSM. These include the following Facilities must prepare a history of accidental releases occurring over the past five-years. Facilities must perform an Offsite Consequence Analysis (OCA), which is an analytical estimate of the potential consequences of hypothetical worst-case and alternative accidental release on the public and environment around the facility. Facilities must submit a summary report, called a Risk Management Plan (RMP), to the EPA. The RMP contains the facility’s five-year accident history, a summary of its accidental release prevention program, its offsite consequence analysis, and a summary of its emergency response plan. EPA must make all RMPs available to state and local governments and the public [2,4]. EPA promulgated RMP requirements in June 1996 and the first RMPs were due three years later. EPA designed software tools and forms so that all RMPs could be submitted electronically to EPA and stored in a central database. This was done to reduce paperwork burden on regulated facilities, while also allowing government officials to have immediate access to the most recent information. Consequently, the majority of RMPs have been submitted electronically and EPA has assembled a searchable electronic database of this information. To date, this database contains RMPs from approximately 15,000 facilities [5]. 2.4. US. law restricts public access to Risk Management Program data In designing the Risk Management Program, Congress and EPA anticipated that public scrutiny would help regulate the behavior of hazardous chemical facilities to a greater extent than the regulatory requirements alone [2,4]. In this regard, the government had learned from its experience with the earlier EPCRA legislation. It was found that hazardous chemical information, when conveniently available to the public in an easily understandable format, was often obtained and used by various sectors of the public to influence facility behavior [6]. With this in mind, EPA originally planned to place the entire RMP information system on the Internet for easy access by state and local governments and the public. However, concerns were raised by the chemical industry and U.S. security agencies that Internet access to a large, searchable RMP database, and particularly the portion of that database containing OCA information, could be used as a targeting tool by terrorists and other criminals. Proponents of this concern postulated that the OCA data contained in RMPs was sufficient to identify those chemical facilities that could result in the

1279

greatest number of casualties to the surrounding population. Furthermore, it was argued that a chemical plant could effectively be converted into a weapon of mass destruction (WMD) relatively easily: “In recent years, criminals have with increasing frequency attempted to obtain or produce WMD precisely because such weapons are engineered to cause wide-scale damage to life and property. However, traditional means of creating or obtaining WMD are generally difficult to execute. In contrast, breaching a containment vessel of an industrial facility with an explosive or otherwise causing a chemical release may appear relatively simple to such a terrorist [7].” Although EPA consequently decided not to place the OCA sections of RMPs on the Internet, new concerns were raised that recent amendments to the Freedom of Information Act (FOIA) would compel EPA to release this information in electronic format. Congress responded by passing the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act (CSISSFRRA), which the President signed on August 5 , 1999 [S]. CSISSFRRA temporarily exempted OCA information (sections 2 through 5 of RMPs) from public disclosure under FOIA, and prohibited public access in any form, including any statewide or national ranking derived from the information, until federal regulations were issued to codify a system of limited public access. The statute required the President to “assess the increased risk of terrorist and other criminal activity associated with the posting of [OCA] information on the Internet, and the incentives created by public disclosure of OCA information to reduce the risk of accidental chemical releases.” Based on these assessments, the President was required to issue regulations “governing the distribution of [OCA] information in a manner that, in the opinion of the President, minimizes the likelihood of accidental releases and [any increased risk of terrorist activity associated with Internet posting of OCA information] and the likelihood of harm to public health and welfare [S].” The President delegated to the Department of Justice (DOJ) the authority to perform the assessment of the increased risk of terrorism, and to EPA the authority to perform the assessment of the incentives to reduce the risk of accidental releases. DOJ and EPA were jointly delegated the authority to promulgate the required regulations. The risk and benefits assessments [6,7] were completed in April 2000, and are available on the Internet at www.usdoj.gov/criminal/april18final.pdf and www.epa.gov/ceppo/pubs/incenAss.pdf,respectively. Regulations to control public access to OCA data were subsequently published in August 2000 [9]. These regulations allow the public to gain access

1280

to OCA data at 50 reading rooms that will be distributed throughout the United States. When the reading rooms are established, a member of the public may view paper copies of the OCA data for up to 10 facilities per month. There are no restrictions on which ten facilities’ data a person may view, but the person must show valid identification and may not take the OCA information document from the reading room. The regulations prohibit the general public from analyzing or viewing the full national database of OCA information, and, practically speaking, will likely deter most members of the public from viewing even a small portion of the data. Individual facilities may grant public access to their own OCA data, and state and local government officials may, upon request, grant public access to OCA data for facilities in their and neighboring jurisdictions, but there is no legal obligation on facilities or state and local governments to grant such access. Some facilities have made their individual OCA data available to the public, but as of this writing, state and local governments have not yet received the OCA data for facilities in their jurisdictions. Even when they do obtain the data, the fact that CSISSFRRA imposes severe penalties for officials who inappropriately release OCA data may deter granting such access. The CSISSFRRA legislation also contains a provision for the entire OCA database to be made available to “qualified researchers.” However, at the time of this writing, the government has not yet disclosed any system to provide researchers with access to the full database, and only a relatively small number of EPA headquarters officials and their contractors have access to the full national database. In addition to its provisions related to OCA data, CSISSFRRA contained a separate provision that completely exempted most flammable fuel facilities from regulation under the Risk Management Program. Prior to CSISSFRRA, EPA estimated that about 66,000 facilities would be subject to the risk management program, and of these, about half would be subject to the regulations solely due to the presence of listed flammable fuels, mainly propane. However, after an intensive lobbying effort by the propane industry, Congress prohibited EPA from regulating under the risk management program any listed flammable substance when used as fuel or held for sale as fuel at a retail facility. This provision effectively reduced the estimated universe of regulated facilities by about half. In fact, even this estimate turned out to be too high, as facilities that otherwise would have been regulated took actions to legally avoid the regulation.+ +

To date, approximately 15,000 facilities have submitted RMPs. The discrepancy between the

1281

3. PRELIMINARY RMP DATA ANALYSIS BY THE UNIVERSITY OF PENNSYLVANIA CSISSFRRA has probably prevented, at least for the time being, easy access to the complete RMF database by criminals and terrorists. However, by denying this same access to academic researchers, environmentalists, industry groups, and other law-abiding members of the public, CSISSFRRA has also prevented, or at least greatly delayed, much of the data from undergoing the robust analysis that might eventually result in benefits to the public. Fortunately, some preliminary analysis of the non-OCA portions of the data has already been performed. Under a cooperative agreement with EPA, The Wharton School of the University of Pennsylvania has performed preliminary analysis of the non-OCA portions of the database and has published the results in a working paper [ 101. The Wharton working paper is available on the internet at www.epa.gov/ceppo/pubs/OO-1-215.pdf or http://opim.wharton.upenn.edu/risk/epi_downloads.html, and selected results of the paper are reproduced in Appendix A. As of this writing, the Wharton working paper contains preliminary results of analysis of the non-OCA portions of the RMP*Info database, with primary focus on its accident history portion. Wharton intends eventually to analyze the complete RMP*Info database using epidemiological techniques, and hopefully to identify factors which may predict chemical accidents or correlate to accident-free performance. Identifying such factors could significantly benefit the public by allowing industry and government to better control those underlying factors that are statistically demonstrated to either cause or prevent serious accidents. However, to date Wharton’s research has been hindered in part by the unavailability of the OCA portions of the database. The “qualified researcher” provisions of CSISSFRRA may eventually permit access to the full database for research by academic institutions, industry groups, environmental advocates, and others. In the meantime, for those few people who currently have access to the complete database, nothing currently prohibits publication of the results of OCA data analysis, provided those results do not reproduce the specifically post-CSISSFRRA estimate of 33,000 and the actual number is likely due to three factors. First, significant anecdotal information suggests that a large number of facilities took actions to avoid being regulated under the program. Such actions include reducing chemical inventory below the regulatory threshold, replacing a regulated substance with a non-listed substitute, or eliminating the covered process altogether. Second, EPA may have overestimated the number of facilities subject to the regulation. Third, some facilities may have not yet complied with the regulation.

1282

proscribed sections of the OCA information or contain any national or statewide ranking of OCA data derived from the database and identifying individual facilities [9 ]. This paper takes a first step toward filling the analytical gap by including a preliminary analysis of the OCA portion of the database. In the interest of completeness and in order to put the OCA data in context, it also includes an overview of the non-OCA portions of the database, and somewhat extends Wharton’s analysis of the accident history data. Readers should be aware that, except where noted, the statistics reported here are derived from a more recent version of the RMP*Info database than was used by Wharton in their original working paper, and therefore may differ slightly from statistics reported in that study.’ 4. OVERVIEW OF RMP DATA ELEMENTS

Each RMP consists of an executive summary and up to nine other sections. It is intended to provide information that can be used by others to judge the risk that a facility poses to the surrounding community and to understand the steps taken by that facility to manage its risk. The executive summary is an overall prose description of a facility’s risk management program, including, in general terms, a brief description of the facility’s accidental release prevention and emergency response policies, worst-case and alternative case scenarios and their potential consequences, five-year accident history, and planned changes to improve safety. The remaining sections of the RMP contain specific data elements that generally consist of yesho, check-off box, and numerical answers to standard questions. There are additional areas where facilities may include prose explanations for various entries, but these are optional (with the exception of the executive summary). The nine numbered RMP sections contain the following information (the presence of some sections and the total length of RMPs vary depending on the number and type of processes and chemicals present at a facility): Section 1: Registration information (e.g., facility name, address, process chemicals, chemical quantities, etc.) Sections 2-5: The so-called “OCA data.” Modeling methodology, input parameters, analytical assumptions and results for the off-site +

Another reason that statistics reported here may differ markedly from those in the Wharton paper is that in several cases, statistics in this paper are based on the overall number of chemical processes in the RMP database, where statistics in the Wharton paper are generally based on the overall number of facilities in the database.

1283

consequence analyses of worst-case and alternative release scenarios. These sections provide estimates of the possible consequences of the scenarios, in terms of potentially affected population and other public and environmental receptors. Section 6 : Five-year accident history data. For each accident occurring in the previous five years that exceeded specified severity thresholds, the facility provides the date of the event, chemical(s) released, source of release, on-site and off-site impacts, initiating event, and factors contributing to the release. Section 7: Accident prevention program data. Contains descriptions and data for any processes subject to prevention Program 3 (the most rigorous RMP accident prevention requirements - see footnote 2). Besides an optional narrative description of the prevention program, facilities are required to provide information such as the date of completing the last process hazards analysis, the major hazards identified by that analysis, process controls used to address those hazards, and information on maintenance, training, compliance audits, and incident investigations. Section 8: Accident prevention program data. Similar to Section 7, but for processes subject to prevention Program 2 (a less rigorous set of accident prevention requirements than those required under Program 3). Section 9: Emergency response program. Contains data on the facility’s emergency response program and plan. The advantage of this standard format is that it allows data to be easily submitted, compiled and manipulated in database form. However, also as a result of this format, much data submitted in RMPs do not contain contextual information. For example, a facility would indicate, by checking various choices in a list, what types of release mitigation measures are present in a process, but the reader can not discern precise locations, methods of operation, or design features of those devices unless the facility chooses to add an optional explanation containing these details. Nevertheless, when considered in total, an RMP can often provide a great deal of information on a facility. 4.1. Data Quality Whenever a large amount of data is collected, there is the potential for errors and steps should be taken to ensure data quality. This is a particular

1284

challenge in this case, since each individual RMP is actually a data array consisting of up to hundreds of individual data elements, some of which reflect the results of underlying scientific analysis (i.e., the OCA) that is not submitted along with the RMP itself. So EPA expected that some errors would be introduced into the database. Many errors were prevented by incorporating basic automatic error-checking features into the RMP submission software developed by EPA (RMP*SubmitTM). The software identifies and prompts the user to correct some obvious errors, such as entering letters in a numerical field, leaving required fields blank, and the like. However, many content-related errors are not detected by the software. For example, an RMP may report an incorrect value for the quantity of a particular toxic substance contained in a vessel, but if the value is within the allowed range of numerical digits accepted by the software for that field, the program will accept the entry as valid and report no error. Furthermore, an RMP may contain internal inconsistencies that the software is not designed to automatically identify. Such errors may often be manually identified by a knowledgeable analyst comparing various dependent values for logical consistency. For example, in the OCA worst case scenario portion of an RMP, the facility must report the quantity of the toxic or flammable substance contained in the single largest vessel on site, and also the “endpoint distance” (distance beyond which specified harmful effects would no longer be felt) that would occur if that same quantity of substance were accidentally released into the atmosphere. So these two values (quantity in largest vessel and distance to endpoint) are physically related and must make sense together. An RMF’ reporting a very small quantity of a toxic substance resulting in a very large endpoint distance is a potential outlier (and vice versa). Some erroneous values are easy to spot simply because they are implausible. For example, the largest OCA endpoint distance reported in the database is 255 miles. Since this value is well over an order of magnitude higher than what has been observed in any actual toxic release event, it immediately looks suspicious. Further, as the result of a release of only 114,000 pounds of aqueous ammonia, the reported endpoint distance seems absurd. In this preliminary analysis of the database, these sorts of errors, when identified, were eliminated or corrected where necessary and feasible (many reporting errors do not necessarily call into question the validity of other information in the RMP). The Wharton working paper also addresses data screening to account for errors in the accident history portion of the RMP*Info database [ 101.

1285

5. PRELIMINARY DESCRIPTIVE STATISTICS An overview of some basic statistics derived from the RMP*Info database is informative and will help place more detailed assessments in context. As of

this writing, the RMP*Info database contains information on a total of 14828 facilities containing 202 10 chemical processes’. Of these processes, 17529 contain at least one toxic chemical and 8107 contain at least one flammable chemical-.

5.1. Frequency and Quantity Distributions of RMP Chemicals Note that the number of RMP processes exceeds the number of facilities, and that the total number of chemicals exceeds the number of processes. These facts highlight an important consideration. For many purposes, grouping RMP data by either chemical process or chemical type may be more accurate than trying to characterize data on a facility basis. While most facilities contain only one RMP process and one RMP chemical, 1 1% of processes contain multiple regulated substances, and many individual processes contain multiple regulated chemicals. Figure 1 is a histogram of the number of RMP processes containing multiple chemicals.

+

The basic reporting unit within the RMP database is a facility subset called a “process.” Simply stated, a process is defined as any system of interconnected or co-located vessels and pipes which contain, in total, more than a threshold amount of at least one regulated substance. Processes can vary in complexity from a single storage vessel to large networks of vessels and pipes. Many facilities contain more than one process. Where this paper reports the number of processes containing a certain chemical, processes containing multiple chemicals are counted once for each chemical in the process. ++

Each facility need submit only a single RMP to account for all processes at the facility. Some facilities have both toxic and flammable processes, and these facilities’ RMPs contain information on both toxic and flammable chemicals.

1286

-

Frequency Histogram Number of Chemicals per Process 17993

z

1

2

3

4

5

--- 1 -I 6

7

8

9

I

10

11

120r

more

Number of Chemicals

Figure 1: Frequency Histogram - Number of Chemicals per RMP Process

The RMP*Info database contains information on 70 toxic and 57 flammable substances or mixtures+. As Table 1 illustrates, four chemicals anhydrous ammonia, chlorine, propane, and flammable mixtures - are present in nearly 70 percent of all RMP processes. Anhydrous ammonia is predominant due to its several widespread uses, including fertilizer production, refrigeration, and land application as an agricultural nutrient'+. It alone is present in about one third of all RMP chemical processes, and 48% of all toxic chemical processes. The high number of chlorine processes is mainly due to the common use of chlorine for water disinfection. Propane and flammable mixtures are found as products and chemical intermediates in oil refineries, gas extraction plants, propane distribution centers, fuel terminals, and chemical plants.

The RMP regulation covers a total of 77 toxic and 63 flammable substances. No RMPs have yet been submitted for 7 toxic and 6 flammable substances listed in the RMP rule. ++

Section 112(r) of the CAA exempts from the risk management program ammonia when held by a farmer for use as an agricultural nutrient. However, when ammonia intended for land application as an agricultural nutrient is not held directly by a farmer, it may be covered by the regulation.

1287

Chemical

Number of Processes

Percentage of Total

Ammonia (anhydrous)

8343

32.5

Chlorine

4682

18.3

Flammable Mixtures

2830

11.0

Propane

1707

6.1

Sulfur Dioxide

768

3.0

Ammonia (aqueous 20% or more conc.)

519

2.0

Butane Formaldehyde

I I

482 358 ~~

I I

1.9 1.4

Isobutane

344

1.3

Hydrogen Fluoride

315

1.2

Pentane

272

1.1

Propylene

25 1

1 .O

Methane

220

0.9

Hydrogen

205

0.8

Isopentane

20 I

0.8

All Others

4139

16.1

I I

Table 1: Frequency Distribution of RMP Chemicals

While table 1 clearly shows that toxic chemicals (particularly ammonia and chlorine) account for the majority of RMP processes, the opposite is true for chemical quantity. In fact, RMP flammable chemicals far outweigh RMP toxics overall. As table 2 shows, of the top 10 RMP chemicals ranked in order of quantity, eight are flammables, including the top three. Ammonia, which ranks first in number of processes (32.5%), ranks fourth in terms of quantity (13%). Chlorine, which ranks second in number of processes (18.3%), ranks only 1 3 in~ quantity (0.9%). While at first glance these results may seem inconsistent, they are easily explained. Many RMF' flammable chemical processes are located in refineries, chemical plants, gas extraction plants, fuel terminals and propane distribution centers. These facilities, on average, tend to have extremely large chemical processes. The most prevalent toxic chemical processes, on the other

1288

hand, include refrigeration systems, fertilizer storage containers, and water treatment plants, all of which generally contain relatively small chemical quantities.

Chlorine

0.3

0.9

All Others

2.7

7.5

Table 2 - Quantity of Prevalent RMP Chemicals in the United States*

5.2. RMP Facility Industrial Classifications Each RMP process is assigned an industrial classification code according to the North American Industrial Classification System (NAICS). This system assigns businesses descriptive categories that correspond to five- or six-digit codes. The first three digits of the code define a major business sector and the

1-

Totals and percentages represent only RMP-regulated facilities. Process quantities reported in RMPs reflect the maximum quantity that a process would contain at any one time. Therefore, these totals represent the sum of all processes’ maximum quantities, and will reflect the absolute upper limit of aggregate quantity for FWP facilities. Actual aggregate quantities for RMP facilities will be somewhat lower.

1289

last two or three digits indicate an establishment's specialty within the major sector. The RMP rule requires facilities to assign NAICS codes that most closely correspond to the function of the individual covered process, rather than the overall facility. Since most facilities have only one process that is closely aligned to the overall facility function, the process NAICS code and facility NAICS code are usually the same. However, facilities with multiple processes, or facilities desiring to identify other aspects of a process not captured by the NAICS code for the primary activity may have multiple NAICS codes. Table 3 indicates the number of RMP processes in the most commonly reported NAICS codes. The most frequent RMP process NAICS codes roughly mirror the results of Table 1,as ammonia, chlorine, flammable mixtures, and propane - the top four chemical in terms of process frequency - are also among the RMP chemicals most commonly associated with the top NAICS codes. NAICS Code and Description

Number of Processes

NAICS Code and Description

42291 Farm Supplies Wholesalers

4409

493 13 Farm Product Warehousing

22 131 Water Supply & Irrigation

2059

325 1 1 Petrochemical Manufacturing

22 132 Sewage Treatment

1646

4543 12 Liquefied Petroleum Gas Dealers

311

3241 1 Petroleum Refineries

1609

11511 Support Activities for Crop Production

302

325199 All Other Basic Organic Chemical Manufacturing

655

3 11615 Poultry Processing

253

42269 Other Chemical and Allied Products Wholesalers

607

115112 Soil Preparation, Planting, and Cultivating

207

493 12 Refrigerated Warehousing and Storage Facilities

549

325 12 Industrial Gas Manufacturing

21 11 12 Natural Gas Liquid Extraction

533

325998 All Other Miscellaneous Chemical Product Manufacturing

32521 1 Plastics Material and Resin Manufacturing

418

3253 11 Nitrogenous Fertilizer Manufacturing

325 188 All Other Basic Inorganic Chemical Manufacturing

358

493 1 1 General Warehousing and Storage Facilities

~~

Number of Processes

~

~~

Table 3: Most Frequently Occurring RMP Process NAICS Codes

I

205

I

1290

6. ACCIDENT HISTORY OVERVIEW

The Risk Management Program regulation requires covered facilities to include a five-year accident history in their RMP.The history must describe all accidental releases from covered processes in the last five years that resulted in deaths, injuries, or significant property damage on site, or known offsite deaths, injuries, evacuations, sheltering in place, property damage, or environmental damage. These criteria were intended to capture only the most serious accidents affecting covered processes, and exclude minor incidents and accidents unrelated to covered processes. Fortunately, such accidents are fairly infrequent. As a result, fewer than 8% of facilities reported any accidents in their five-year accident history. Nevertheless, an analysis of the over 1900 accidents contained in the database can potentially yield important results. Since the Wharton working paper provides a thorough description of RMP*Info accident history data, this paper does not attempt to cover the same ground in any detail, but rather extends Wharton’s research in this area somewhat by considering normalized accident rates. Selected results from Wharton’s analysis are included in Appendix A, and readers are encouraged to refer to the Wharton paper for a full description of that analysis. 6.1. Normalized Accident Rates When evaluating the actual risks of different hazardous chemicals, it is necessary to know what chemicals and chemical processes suffer the highest frequency of accidental releases. The Wharton working paper reported the total numbers of accidents over the five year reporting period, categorized by chemical type and process NAICS code (see Appendix A). While such totals technically represent an accident rate (i.e., number of accidents over a time interval) they are not normalized to account for disparities in the opportunities for accidents to occur among different substances or process types. Incident rates are commonly normalized by dividing the number of incidents by some measure of the number of opportunities for an accident to occur. For example, the U.S. Department of Labor calculates occupational injury and illness rates by dividing the number of occupational injuries at a facility by the total number of person-hours worked at the facility over a given period. This allows large and small facilities to be fairly compared, assuming that, all else being equal, the overall number of occupational injuries at a workplace over a given time period will generally be directly proportional to the number of employees working there. Likewise, when calculating transportation accident rates, the number of transportation accidents for a given vehicle or

1291

cargo type is often divided by either the number of miles traveled or by the number of shipments of that type in order to normalize the accident rate. Likewise, this study builds on Wharton’s analysis by normalizing the accident totals. However, since hazardous chemical facilities vary so greatly in size, number of processes, chemical quantities stored and produced, operating schedule, and other characteristics, it is difficult to say which single divisor best represents the number of accident opportunities over the full spectrum of facilities represented in RMP*Info. This study uses the number of processes and aggregate chemical quantity as normalization factors. In choosing these factors, the assumptions implied are that, all else being equal, a chemical contained in a large number of processes or in large quantities has more opportunities to be accidentally released than does a chemical contained in fewer processes or smaller quantities. While these divisors are certainly not perfect, they appear to be reasonable. Other divisors than these, such as the quantities of each chemical produced (instead of the amounts stored) might also be chosen as normalization factors.

6.I . I . Accident Rate by Chemical Type Table 4 indicates the rate of accidents for each chemical+divided by the total number of processes in which the chemical is present, and the rate of accidents for that chemical divided by the total quantity of the chemical in all processes containing it.

+

Table 4 contains information on only those R M P chemicals involved in more than ten accidents over the five-year reporting period, as reported in the Wharton working paper.

1292

Chemical Name (listed in order of un-normalized accident frequency)

1. Ammonia

I I

2. Chlorine

3. Hydrogen Fluoride

Number of Accidents per Process per Year

Rank

Number of Accidents per Mlbs stored per Year

Rank

0.016

16

0.014

14

0.022

I

0.064

1

13

I

3

1

0.16

1

7

0.27

1

4

~~

4. Flammable Mixture

0.007

24

0.00075

24

5. Chlorine Dioxide

0.155

1

1.97

2

6. Propane

0.006

25

0.001 2

20

7. Sulfur Dioxide

0.013

20

0.01 1

15

8. Ammonia (aqueous)

0.017

15

0.018

13

9. Hydrogen Chloride

0.060

4

0.25

5

10. Hydrogen

0.03 1

10

0.24

6

1 I. Methane

0.027

11

0.0064

17

12. Butane

0.01 1

21

0.00089

23

13. Ethylene Oxide

0.027

12

0.045

11

14. Hydrogen Sulfide

0.067

2

0.50

3

15. Formaldehyde

0.009

23

0.024

12

16. Isobutane

0.010

22

0.01 1

21

17. Pentane

0.013

18

0.0052

18

18. Titanium tetrachloride

0.056

5

0.090

9

19. Phosgene 20. Nitric Acid 2 1. Ethane 22. Oleum ~~~

I I I I

0.044

1

0.038

I

0.014 0.022 ~

I I

6

1

8

1

17 14

I

I

2.49 0.047 0.00071 0.01 1

I

1

I

25

I

I

10

16

23. Ethylene

0.014

19

0.00089

22

24. Vinyl Chloride

0.042

7

0.005 1

19

25. Trichlorosilane

0.034

9

0.10

8

Table 4 - Normalized Accident Rates for RMP Chemicals, 1994 - 1999

1293

Table 4 yields a number of interesting results. First, many of the substances with the highest gross accident totals are not among the substances with the highest normalized accident rates (and vice versa). For example, ammonia, chlorine, flammable mixtures, and propane rank first, second, fourth, and sixth, respectively, in terms of gross number of accidents, but all rank much lower when their accident total is normalized by either number of processes or chemical quantity. In fact, of these chemicals, only chlorine ranks in the top ten by either normalized rate measure (it ranks 7" in number of accidents per Mlbs stored per year). Next, several chemicals have notably high normalized accident rates relative to the other chemicals listed. The most obvious example is chlorine dioxide, which in terms of number of accidents per process-year, has an accident rate 7 times the median, and in terms of number of accidents per Mlbs stored per year, has an accident rate over 40 times the median. Other chemicals that have relatively high normalized accident rates include hydrogen sulfide, hydrogen fluoride, phosgene, and hydrogen chloride. Lastly, table 4 indicates that in general, the substances with the highest normalized accident rates are all toxic, while most of the substances with the lowest accident rates are flammable. In both rankings in table 4, the five highest accident rates are due to toxic chemicals. 6.1.2. Accident Rates by Industrial Sector

Table 5 is similar to table 4,except that it indicates normalized accident rates by NAICS code for the 25 NAICS codes having the highest gross number of accidents (Table 5 does not include the accident rate in terms of chemical quantity for each NAICS code, since a single NAICS code may be associated with several different RMP chemicals, so it is not possible to associate the aggregate quantity of a single chemical with each NAICS code).'

+

It should also be noted that some of the individual NAICS codes in table 5 are closely related, and might fairly be combined when analyzing the accident rate from a particular industrial sector. For example, NAICS code 3 1141 1, Frozen Fruit, Juice, and Vegetable Manufacturing, is a subset of NAICS code 3 1 141, Frozen Food Manufacturing. They are reported separately here because these statistics reflect the codes that individual facilities assigned to their own processes.

1294

NAICS Code and Description (listed in order of un-normalized accident frequency)

Number of Accidents per Process per Year

3241 1 - Petroleum Refineries

0.024

118

22131 - Water Supply and Irrigation Systems

0.01 1

24

22132 - Sewage Treatment Facilities

0.013

22

0.027

17

0.050

8

42269 - Other Chemical and Allied Products Wholesalers

0.029

16

42291 - Farm Supplies Wholesalers

0.004

25

325181 - Alkalies and Chlorine Manufacturing

0.116

3

3253 11 - Nitrogenous Fertilizer Manufacturing

0.086

5

3 1 1615 - Poultry Processing

0.053

7

325 11 - Petrochemical Manufacturing

0.034

14

3221 1 - Pulp Mills

0.101

4

493 12 - Refrigerated Warehousing and Storage Facilities

0.018

20

3 11611 - Animal (except poultry) Slaughtering

0.134

1

21 1112 - Natural Gas Liquid Extraction

0.013

23

3252 11 - Plastics Material and Resin Manufacturing

0.0 16

121

3 11411 - Frozen Fruit, Juice, and Vegetable Manufacturing

0.064

16

3 1 1612 - Meat Processed from Carcasses

0.048

19

322121 - Paper (except newsprint) Mills

0.132

12

325 12 - Industrial Gas Manufacturing

0.023

119

325 19 - Other Basic Organic Chemical Manufacturing

0.036

113

325 18 Other Basic Inorganic Chemical Manufacturing

0.040

112

32532 - Pesticide and Other Agricultural Chemical Manufacture

0.033

I15

3 1 152 - Ice Cream and Frozen Dessert Manufacturing

0.044

3 1 141 - Frozen Food Manufacturing

0.044

325 199 - All Other Basic Organic Chemical Manufacturing ~

~~~

~

II I

~~

325 188 - All Other Basic Inorganic Chemical Manufacturing ~~

Rank

~~

~~

-

Table 5 - Normalized Accident Rates for Rh4P Process NAICS Codes, 1994 - 1999

I I I I I I I I

1295

At this point, no firm conclusions can be drawn from these results. There are a number of possible explanations for why these measures might favor certain chemicals or industrial sectors over others, and some of these are unrelated to chemical hazards or risk management practices. For example, the accident rate for a chemical or industrial sector with a relatively low gross accident total can be greatly affected by a small increase in that total - perhaps even by accidents attributed to a single facility'. Alternatively, when normalized with other (and presumably better) factors, some seemingly high rates may prove to be insignificant. On the other hand, if after eliminating other explanations these results are upheld, they may indicate a need to improve the safety practices or other hazard controls associated with the chemicals or industrial sectors having the highest accident rates. Clearly, further study in this area is needed. 7. OCA INFORMATION

Perhaps the most interesting, and, for reasons already stated, certainly the most closely guarded, information in the RMP*Info database is the Offsite Consequence Analysis information. OCA information consists of data related to worst-case and alternative release scenarios. These scenarios represent hypothetical estimates of the potential consequences of accidental chemical releases occurring under specified atmospheric and topographic conditions. The OCA data reported in the RMP include the following: Name, physical state, and percent weight (if a mixture) of chemical involved in the release Analytical model used to perform the analysis Type of scenario (e.g., gas release, explosion, fire, etc.) Quantity released Release rate and duration Atmospheric conditions and topography Distance to toxic or flammable endpoint Residential population living within the endpoint distance. Other public or environmental receptors within the endpoint distance (e.g., schools, hospitals, churches, state or national parks, etc.) Mitigation measures accounted for in conducting the analysis

This effect was limited by considering only those chemicals and industrial sectors involved in the greatest number of accidents over the five year reporting period, but even taking this into account, some of the results in tables 4 and 5 result from relatively small samples.

1296

OCA information does not include any estimate of the probability of a scenario actually occurring. However, OCA scenarios are considered to be unlikely. Worst-case scenarios in particular are considered to be very unlikely. This is because they are based on the assumption of a very large accidental release (an unlikely event under any conditions) occurring under a combination of atmospheric conditions (low wind speed and stable atmosphere) that occurs rarely and does not persist for very long. Further, the regulatory requirements for conducting the worst-case scenario analysis prohibit facilities from accounting for any active release mitigation features such as water deluge systems and automatic shutoff valves that might significantly reduce the effects of an actual release. Facilities may, however, account for passive mitigation features such as containment dikes and building enclosures. 7.1. Worst Case Scenarios EPA defined the worst-case scenario as the release of the largest quantity of a regulated substance from a single vessel or process line failure that results in the greatest distance to an endpoint. In broad terms, the distance to the endpoint is the distance a toxic vapor cloud, heat from a fire, or blast waves from an explosion will travel before dissipating to the point that serious injuries from short-term exposures will no longer occur. For toxic worst case scenarios, EPA specified certain input parameters for conducting the analysis, such as wind speed and atmospheric stability. For flammable worst case scenarios, EPA specified that the scenario consist of a vapor cloud explosion. EPA placed numerous specifications on worst-case scenarios in order to simplify the analysis and to ensure comparability among facilities. However, EPA did not specify that any particular analytical model be used to conduct the analysis. When comparing worst-case scenarios, this is a potentially confounding variable, since the same scenario analyzed using two different analytical models can sometimes produce significantly different results. Fortunately, nearly 70% of worst case scenarios were conducted using EPA OCA modeling: and most others were conducted using other widely-accepted +

EPA published several guidance documents and one computer software program to assist facilities in conducting OCA modeling. Foremost among these is Risk Management Program Guidancefor Offsite Consequence Analysis, which contains generic OCA lookup tables and modeling equations for all RMP-regulated chemicals. EPA also published several industryspecific guidance documents which contain lookup tables for regulated chemicals of particular concern to certain large industry sectors regulated under the RMP rule. Additionally, EPA and the National Oceanic and Atmospheric Administration together produced a software program, called RMP*Comp, which conducts OCA modeling according to the same methodologies

1297

analytical models that usually produce similar results, so inconsistencies in OCA data resulting from model choice are somewhat limited. 7.I. I. Endpoint distances

In general, toxic release scenarios result in greater endpoint distances than flammable worst case scenarios. This is mainly due to the fact that for flammable substances, EPA specified the endpoint distance to be the distance from the source of a vapor cloud explosion to the point where the overpressure from the explosion falls to 1 psi. For most regulated flammable substances, this distance tends to be significantly shorter than the toxic endpoint distance resulting from the release of a similar quantity of the most prevalent RMP toxic chemicals. Figures 2 and 3 are frequency histograms of endpoint distance for RMP toxic and flammable chemical process worst case scenarios, respectively. Each bar represents the number of processes having endpoint distances in a particular distance interval. Note that both graphs are positively skewed distributions with long right-hand tails, indicating that relatively few processes of either type result in extremely long endpoint distances. However, while the shapes of the two distributions are similar, flammable scenarios are differentiated from toxics by their significantly shorter endpoint distances. The median endpoint distance for toxic worst case scenarios is 1.6 miles, while the median endpoint distance for flammable worst case scenarios is 0.4 miles. This reflects the differences in the physical nature of the two hazard classes and their worst case scenarios, as described above.

contained in the EPA guidance documents. OCA results achieved using any of these sources are derived from the same set of models.

1298

Frequency Histogram - OCA Toxic Endpoint Distance 5Mx) 1 I 4500t

4000

t

"

1

2

3

4

5

6

7

8

9

10

I1

I2

13

14

15

16

17

18

19

20

21

22

23

24

25 Mar

Endpoint Distance (miles)

Figure 2: Frequency Histogram - Endpoint Distance for Toxic Worst Case Scenarios

1

-

FrequencyHistogram OCA Flammable Endpoint Distance

-T

::l 2M) 0

0.25

0.5

1,

+

0.75

1

--,A-

- '+-

1.25

1.5

1.75

...

2

More

Endpoint Distance (miles)

Figure 3: Frequency Histogram - Endpoint Distance for Flammable Worst-case Scenarios

1299

In the distribution of toxic worst case scenario endpoint distances (figure 2) there are two class intervals representing long endpoint distances that contain a large number of facilities relative to surrounding class intervals. These occur at 14 and 25 miles, respectively. The high number of facilities in both class intervals is primarily due to the prevalent use of 90-ton rail tank cars for chlorine storage in the United States. When the release of 90 tons of chlorine is modeled using EPA’s OCA lookup tables or RMP*Comp modeling software under urban terrain conditions, the resulting endpoint distance is 14 miles. When the same release is modeled under rural terrain conditions, the resulting endpoint distance is 25 miles. 25 miles also happens to be the upper cutoff of EPA’s lookup tables and RMP*Comp software for all chemicals, so this interval arso contains the OCA results from scenarios involving large releases of other highly toxic, highly volatile chemicals. Other chemicals that result in multiple scenarios with endpoint distances of at least 25 miles include anhydrous ammonia (33 scenarios with endpoint distance at least 25 miles), hydrogen fluoride (32 scenarios), sulfur dioxide (22), chlorine dioxide (8), oleum (7), sulfur trioxide (9,hydrogen chloride(4), hydrocyanic acid (3), phosgene (2), propionitrile (2), bromine (2), and acrylotnitrile (2). 7.I .2. Potentially Affected Population Under the RMP rule, the population potentially affected by a release is defined as the residential population inside a circle with radius equal to the endpoint distance. Therefore, for a given population density, the population inside the “worst case circle” will increase according to the area of the circle, or proportionally to the square of the endpoint distance. Naturally, population density is not constant, and other factors such as terrain, geography, zoning, etc., also affect this correlation. But in general, one would expect to see population increase exponentially with increasing endpoint distance. Consequently, the disparity between toxic and flammable worst case scenarios as measured by potentially affected population should be even more pronounced than when measured by endpoint distance. Figures 4 and 5 , which are histograms of the potentially affected population for toxic and flammable worst case scenarios, respectively, confirm this notion. In fact, the median population for flammable worst case scenarios is 15 people, while the median for toxic worst case scenarios is 1500 people - two full orders of magnitude greater, whereas the difference in median values for endpoint distance is only a factor of four.

1300

Frequency Histogram- Toxic Worst Case Scenario Residential Population 5000T I

-i

l@y 5004

1

0

10

100

loo0

loo00

1OOOOO

1OOOOOO

More

Residential Population

Figure 4: Frequency Histogram - Toxic Worst Case Scenario Residential Population Frequency Histogram- FlammableWorst Case Scenario Residential Population

10

100

loo0

loo00

loaa00

More

Residential popllation

Figure 5: Frequency Histogram - Flammable Worst Case Scenario Residential Population

1301

In evaluating these results, it is again important to consider the physical difference between toxic and flammable worst case scenarios. Toxic chemical releases generally result in plume that travels in the downwind direction.+ Should an accidental release occur, only the portion of the population covered by the plume could feel its effects. This population necessarily represents only a fraction of the population inside the worst case circle. Flammable worst-case scenarios, on the other hand, consist of an overpressure blast wave which generally travels in all directions from the source. While terrain and obstructions will affect the propagation of the blast wave to some degree, in general everyone within the worst case circle would feel the effects of a vapor cloud explosion resulting from a flammable substance release. So, while figures 4 and 5 indicate a very large disparity between potentially affected population for toxic and flammable worst case scenarios, this disparity is, in fact, not as great as it may appear. It is interesting to note that the distribution of residential population potentially affected by toxic worst case scenarios appears to be log-normal in shape, but that the flammable worst case scenario distribution is clearly not lognormal++.It is unclear why the two distributions have such markedly different shapes, but the difference may be due in part to the fact that each distribution is actually a collection of underlying distributions, one for each different chemical represented in the database. Further, while EPA modeling (i.e., EPA lookup tables and FMP*Comp software) was used to obtain the majority of OCA results in the database, the fact that several other analytical models were used to obtain the remaining results probably induces some artificial variations in these distributions. 7.2. Alternative Release Scenarios The RMP regulation provides much greater flexibility in defining alternative release scenarios than worst-case scenarios. The only “hard” requirements for alternative release scenarios are that the scenario must be more likely to occur than the worst-case scenario, and that it reach an endpoint offsite, unless no such scenario exists. Facilities may account for both passive and active mitigation measures that may be in place when calculating the potential

+

Under certain conditions, the direction that a toxic gas plume travels may be dictated more by the elevation of surrounding terrain than by wind direction. ++

Due to the extremely wide range of potentially affected population (0 to 12 million for toxic worst case scenarios) both distributions are plotted on a logarithmic scale.

1302

consequences from an alternative release scenario. Alternative scenarios are generally considered to be more representative of actual emergency scenarios that might occur. Since there are no objective criteria for developing alternative scenarios, the results vary widely, even among similar facilities. For this reason, it is not clear what may be learned from broad statistical investigation of alternative release scenario data. Except for including the basic parameters of the data distribution in Table 6, this study has not attempted any in-depth analysis of alternative scenario data.

Type of Scenario

Distance or Population Toxic Worst Case

Toxic lltemative Release

Flammable Worst Case

Flammable 4lternative Release

Mean

2.9

0.45

0.44

0.14

Median

1.6

0.22

0.40

0.1

Mode

1.3

0. I

0.40

0.1

Standard Deviation

4.2

0.65

0.40

0.18

Range

60

18

6.9

4.4

Mean

40247

1024

668

87

Median

1500

40

1s

0

0

0

0

0

Zndpoint Distance (miles)

Potentially Affected Population

Mode Standard Deviation Range

2.8~10~

1.5~10~

3.8~10’

9.2~10~

I .2x10 7

1.6~10~

1.2x105

4.0~10~

Table 6 - Descriptive Statistics for Worst-case and Alternative Release Scenarios

Table 6 indicates basic descriptive statistics for endpoint distances and populations for toxic and flammable worst-case and alternative release

1303

scenarios. As expected, alternative release scenarios for both toxic and flammable scenarios have, in general, significantly shorter endpoint distances and affect smaller populations than do the worst case scenarios for the same hazard class. And, as flammable worst case scenarios are generally less severe than toxic worst case scenarios, so are flammable alternative scenarios less severe than toxic alternative scenarios (and for similar reasons). Table 6 also effectively highlights the much larger scale of toxic scenarios relative to flammable scenarios. All statistical measures for the distribution of flammable scenarios are far lower than those for the distribution of toxic scenarios. In fact flammable worst case scenarios are, on average, even less severe than toxic alternative scenarios. Notably, most flammable alternative release scenarios would not even affect any members of the off-site public (i.e., the median population value for flammable alternative scenarios is zero).

8. CONCLUSIONS Catastrophic chemical accidents, while fortunately rare, nevertheless can have a great and lasting (perhaps even disproportionate) impact on the public perception of chemical facility risk. Information such as the RMP*Info database might provide us with a better understanding of this risk and thereby help us to prevent accidents. This paper, which supplements the previous work done by Wharton, is a preliminary characterization of the RMP*Info database, and is therefore only a first step toward investigating the data for clues to the nature and causes of catastrophic chemical accidents. Much work remains to be done. Some questions for hrther study include: - Do the data reveal the need for any policy, practice, or regulatory changes with regard to particular chemicals, industrial sectors, processes, or equipment?

- Do correlations exist between accident history data and other data

elements (in RMP*Info or other databases) that might serve as predictors of accident-prone or accident-free performance?

- Does the database constitute a large enough sample of chemical facilities to determine risk distributions with significant confidence to make decisions about low-frequency, high-consequence events at the tail end of the distribution?

- Do the accident history data contain enough information to identify any trends or patterns in accidents, or is more data needed?

1304

- What changes to the database or RMP regulation might be necessary to correct deficiencies in the database or make the data more meaningful? The full value in this database can only be realized if it is made available to organizations with the willingness and capability to rigorously analyze the data and publish the results. Researchers at Wharton have stated their intent to conduct &her investigations. Hopefully, when the full RMP*Info database becomes more widely available, other organizations will make similar contributions. REFERENCES [ 13 Public Law 99-499, Superfund Amendments and Reauthorization Act of 1986, Title 111, Emergency Planning and Community Right-to-Know Act. [2] Public Law 101-549, Clean Air Act Amendments of 1990, Title 111, Sections 304,301, November 15, 1990. [ 3 ] 29 CFR Part 1910, Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents, Final Rule, 57 FR 6356, February 24, 1992.

[4] 40 CFR Part 68, Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7); List of Regulated Substances and Thresholds for Accidental Release Prevention, Stay of Effectiveness; and Accidental Release Prevention Requirements: Risk Management Programs Under Section 112(r)(7) of the Clean Air Act as Amended, Guidelines; Final Rules and Notice, 61 FR 3 1668, June 20, 1996.

[5] U.S. Environmental Protection Agency, RMP*Info Database, Ariel Rios Building, 1200 Pennsylvania Avenue., NW, Washington, D.C., 20460. [6] U.S. Environmental Protection Agency, Chemical Emergency Preparedness and Prevention Office, Assessment of the Incentives Created by Public Disclosure of Off-site Consequence Analysis Information for Reduction in the Risk of Accidental Releases, April 18,2000. [7] U.S. Department of Justice, Department of Justice Assessment of the Increased Risk of Terrorist or Other Criminal Activity Associated with Posting Off-Site Consequence Analysis Information on the Internet, April 18,2000.

1305

[S] Public Law 106-40, Chemical Safety Information, Site Security, and Fuels Regulatory Relief Act, August 5 , 1999.

[9] 40 CFR Chapter IV, Accidental Release Prevention Requirements; Risk Management Programs Under the Clean Air Act Section 112(r)(7); Distribution of Off-Site Consequence Analysis Information; Final Rule, 65 FR 48108, August 4,2000. [ 101 P. Kleindorfer, H. Feldman, and R. Lowe, Epidemiology and the U.S. Chemical Industry: Preliminary Results from RMP*Info, Center for Risk Management and Decision Processes, Wharton School, University of Pennsylvania, March 6,2000.

1306

Appendix A: Five-Year Accident History Information Selected Results from “Accident Epidemiology and the U.S. Chemical Industry: Preliminary Results from RMP*Info,”’by Paul R. Kleindorfer, Harold Feldman, and Robert A. Lowe, Working Paper 00-0 1- 15, Center for Risk Management and Decision Processes, The Wharton School, University of Pennsylvania, March 6,2000. Frequency of Accidents at Individual Facilities Number of Facilities in RMP*Info with the Indicated Number of Accidents in the Reporting Period

Number of Accidents at Facility

1

rotals

Total Accidents Represented

799

799

193

386

3

66

198

4

28

112

5

26

130

6

11

66

I

7

49

8

4

32

9

1

9

10

3

30

11

2

22

13

1

13

14

1

14

15

1

15

17

1

17

21

1

21

1145

1913

1307

Accidents Reported in RMP*Info by Chemical Involved in the Accident for the Entire Period 1994-1999 Chemical Name

Number of Accidents

Ammonia (anhydrous)

656

Chlorine

I518

Hydrogen Fluoride

I 101

Flammable Mixture

I99

Chlorine Dioxide

155

Propane

54

Sulfur Dioxide

48

I I I I I I

Ammonia (concentration 20% or greater)

I43

Hydrogen chloride (anhydrous)

I32

Hydrogen

I32

Methane

I30

I

I 19 I 19

I I

Butane Ethylene oxide Hydrogen Sulfide

I 26

Formaldehyde

17

Isobutane

17

Pentane

17

Titanium tetrachloride

15

I

I 12 I 12

I I

Oleum

I 11

Ethylene

111

Vinyl chloride

111

I I I

Trichlorosilane

11

Methyl chloride

10

Phosgene Nitric Acid (conc 80% or greater) Ethane

I 12

I

1308

Accidents Reported in RMP*Info by Chemical Involved in the Accident for the Entire Period 1994-1999 (continued)

I Chemical Name I Toluene diisocyanate

~

~

_

I Number of Accidents I 110 I

_

_

_

Propylene

10

Acrylonitrile

8

Hydrochloric acid

8

1,3-Butadiene

8

Epichlorohydrin

7

Bromine

7

Isopentane

7

Propylene oxide

6

Sulfur trioxide

6

Trimethylamine

6

Carbon disulfide

5

Ethylenediamine

5

Vinyl acetate monomer

5

Hydrocyanic acid

4

I Cyclohexylamine

14

I Dimethylamine I Chloroform

3

Phosphorous oxychloride

3

~

13 ~~

~

~

~~~

Methylamine

3

2-Methylpropene

3

I Methyltrichlorosilane I Ally1 alcohol Hydrazine

_

_

~

~

_

_

_

_

_

_

I I I

Methyl mercaptan

I Acetylene

_

12 12 2

I I I

_

~

1309

Accidents Reported in RMP*Info by Chemical Involved in the Accident for the Entire Period 1994-1999 (continued) Chemical Name

Number of Accidents

Crotonaldehyde

2

Acetaldehyde

2

Isopropy lamine

2

Isoprene

2

Dichlorosilane

12

1,l -Dimethylhydrazine

I1

Dimethyldichlorosilane

I 1

Toluene 2,6-diisocyanate

I 1

Acrolein

I 1

Chloromethyl methyl ether

I 1

Toluene 2,4-diisocyanate

I 1

Boron Trifluoride

I 1

Hydrogen selenide

I1

Arsine

I1

Nitric oxide

I 1

CBI Acids

I 1

Ethyl chloride

1

Ethyl mercaptan

1

Vinylidene Fluoride

1

1-Butene

1

Vinyl methyl ether

1

Tetrafluoroethylene Propadiene 2-Butene-cis

I 1

2-Butene-trans

I 1

Butene

11

Nitrogen Tetroxide

I]

1310

Accidents Reported in RMP*Info by NAICS Code of the Process Involved in the Accident for the Entire Period 1994-1999 (Most fi-equently occurring NAICS codes only) NAICS Code

Number of Accidents

3241 1

192

Water Supply and Irrigation Systems

22131

1 I6

Sewage Treatment Facilities

22132

110

All Other Basic Inorganic Chemical Manufacturing

325 188

89

All Other Basic Organic Chemical Manufacturing

325199

89

Other Chemical and Allied Products Wholesalers

42269

87

Farm Supplies Wholesalers

42291

85

Alkalies and Chlorine Manufacturing

325181

80

Nitrogenous Fertilizer Manufacturing

32531 1

68

Poultry Processing

31 1615

67

Petrochemical Manufacturing

32511

55

Pulp Mills

3221 1

54

149312

50

NAICS Description

I Petroleum Refineries ~

~

~~~

Refrigerated Warehousing and Storage Facilities Animal (except Poultry) Slaughtering

I Natural Gas Liquid Extraction

I Plastics Material and Resin Manufacturing

I Frozen Fruit, Juice, and Vegetable Manufacturing

I Meat Processed from Carcasses I Paper (except Newsprint) Mills Industrial Gas Manufacturing

311611 47 I211112

I 325211

I34 I34

I311411

I32

I311612

I31

I322121

I25

I32512

I I I

I

I

1311

Accidents Reported in RMP*Info by NAICS Code of the Process Involved in the Accident for the Entire Period 1994-1999 (Most fkequently occurring NAICS codes only) (continued) NAICS Description

I

Frozen Food Manufacturing

131141

Paper Mills

132212

NAICS Code

I

Number of Accidents

I17

All Other Miscellaneous Chemical Product Manufacturing

I 325998

I 17 I 17

Fluid Milk Manufacturing

1311511

I15

Aluminum Sheet, Plate, and Foil Manufacturing

331315

13

All Other Chemical Product Manufacturing

32599

12

Other Warehousing and Storage Facilities

493 19

12

~~~

~~

~

~

Frozen Bakery Product Manufacturing ~

Fertilizer (Mixing Only) Manufacturing ~~~

~

1311813

I 325314

Secondary Smelting and Alloying of Aluminum

I331314

Dairy Product (except Frozen) Manufacturing

I31151

111 111

Cheese Manufacturing

311513

10

Animal Slaughtering and Processing

31 161

10

1312

On-Site Injuries and Deaths Resulting from Accidents During Reporting Period Mean or Total

Standard Deviation

Minimum

Maximum

Yumber of Observations

On-Site Injuries to Workers/Contractors

1,912

Total On-Site Injuries

1,897

Injuries per Accident

.9922

2.810

0

67

1,912

Injuries per FTE per Accident

,0202

.0784

0

1

1,896

On-Site Deaths to WorkerdContractors

1,911

Total On-Site Deaths

33

Deaths per Accident

.O 173

,2224

0

6

1,911

Deaths per FTE per Accident

,0003

.0071

0

0.25

1,895

Property Damage and non-Medical Off-Site Consequences Resulting from Accidents During Reporting Period ~~

Mean or Total

Standard Deviation

Min

Max

Number of Observations

On-Site Property Damage ($ Millions)

Total On-Site Damage

$1,006

Damage per Accident

$0.528

1907 $6.716

$0

$219

1907

Off-Site Property Damage ($ Millions)

Total Off-Site Damage

$1 1

Damage per Accident

$0.006

1907 $0.109

$0

3.8

1907

1313

Property Damage and non-Medical Off-Site Consequences Resulting from Accidents During Reporting Period (continued). Mean or Total

Standard Deviation

Min

Max

Number of Observations

Off-Site Consequences

Total Number of Evacuations

154

1908

Total Number of Evacuees in all Accidents

25,745

1908

Number of Evacuees per Accident

13.49

Total Number of Accidents Involving Shelter in Place

97

1909

Total Number of Individuals Confined to Shelter in Place in All Accidents

198,460

1909

Number of Individuals Confined to Shelter in Place per Instance

104.0

122.02

1,956.4

3,000

55,000

1908

1909

Number of Accidents with Effects on the Eco-System

Fish or Animal Kills

17

1913

Minor Defoliation

54

1913

Water Contamination

24

1913

Soil Contamination

31

1913

Any Environmental Damage

101

1913

1314

Pattern of Accidents over the Five-Year Period Year

Number of Accidents in the Year

Percent of Total Accidents

1994

157

8.2%

1995

336

17.6%

1996

390

20.4%

1997

426

22.3%

1998

43 1

22.6%

1999

170

8.9%

Totals

1910

100.0%

Day-of-the-Week Pattern of Accidents Day of the Week

Number of Accidents

Percent of Total Accidents

Sunday

8.0%

Monday

15.7%

Tuesday

16.4%

Wednesday

333

17.4%

Thursday

17.4%

Friday

14.2%

Saturday Totals

209

10.9%

1913

100.0%

FTEs at Facility

Proportion of Facilities with Accidents

Number of Facilities

0

1.7%

888

1-10

2.9%

6,304

>10

13.0%

7,308

Total

7.9%

14,500

1315

Seveso I1 as an instrument for the introduction of formalised safety management systems in small and medium enterprises S. Loupasis’, G.A. Papadakisb,and J.S. Duffield‘ T N O Environment, Energy and Process Innovation, Industrial Safety Department, PO Box 342,7300 AH Apeldoom, Netherlands bTechnical University of Crete, Department of Production Engineering and Management, 73 100 Chania, Greece ‘Major Accident Hazards Bureau, European Commission, Joint Research Centre, TP 670,21020 Ispra (VA), Italy

1. INTRODUCTION One of the new provisions of the “Seveso 11” Directive [ 11 is the requirement for operators of certain establishments holding substantial quantities of hazardous substances to demonstrate that “a major-accident prevention policy and a safety management system for implementing it have been put into effect”. It is recognised that the requirements laid down in the major-accident prevention policy should be proportionate to the major accident hazards presented by the establishment. Small and medium enterprises (SMEs) play an important role for the national economies by providing employment to 60-70% of the working force. For example, there are about 30 000 business enterprises in the EU classified as SMEs of which 90% employ less than 100 people. In total SMEs employ around 6 million people and produce an output in value terms of over 200 billion euro. It is estimated that about 20% of these businesses are involved in chemical processing operations which require detailed investigations of the associated hazards.

1316

OECD states that “the number of SMEs in operation is vastly greater than the number of large chemical manufacturers, and the cumulative risk of many small installations cannot be ignored. At this stage, there is simply not enough information available to assess realistically the level of risk represented by small and medium enterprises” [2]. For this type of assessment the safety performance should be measured and the safety management system (SMS) should be evaluated. The basic elements of a safety management system include the organisation and personnel, hazard identification and risk assessment, control of operations, management of change, emergency planning and, actions related to monitoring and auditing. Many smaller sized companies have not yet developed safety management systems because of limited human and economical resources. The size of a company is a prevailing factor to the adoption and implementation of a safety management system. Using as criteria the magnitude of the measures related to safety taken in a company and the effects of the local culture one can make a distinction between big and small enterprises. In general, big companies have enough organisational resources to apply “strategic improvement bringing” safety measures while quite often they face inter- and intradepartmental communication problems. Small companies on the contrary do not have enough resources. Using what is in most cases a rather limited safety budget they try to handle the safety related problems of their operation. On the other hand, due exactly to the small size, they frequently do not face the coordination problems to the extent that big enterprises do [3]. It has been frequently expressed that there is a need for substantial support and guidance to SMEs on the above issues. The local culture poses certain limitations on the implementability of central guidelines most of which explicitly refer to safety management systems drawn from the experience of large companies and are not directly applicable to SMEs. The organisational characteristics of SMEs and their strengths are often overlooked e.g. the fact that when management is committed to an action they can rapidly influence and motivate the whole company. A systematic approach should consider safety culture and available resources. The analysis of the SMS on-site, the appropriate assessment methodology for SMEs and the exchange of information through networking (guidelines, criteria, codes) can greatly support the continuous improvement of the system and the position of the company. In this paper we initially present the findings of an EU-funded project that attempted to evaluate the state of the art of safety management in small and medium enterprises. We then describe a methodological approach that was

1317

developed in the framework of that project to assist companies with the formalisation of their safety management systems. The last part of the paper is dedicated to the Microrisko network of companies that was created with the objective to assist SMEs to manage safety in a more efficient way by providing them with information and contacts to cope with their limited resources.

2. THE SMMARTEN PROJECT The SMMARTEN project aimed at developing effective safety management systems to fit the needs of participating small and medium enterprises that operate industrial installations involving dangerous substances. The project was co-financed by the European Commission (DG Research). Small and medium enterprises are generally concerned with enhanced legislative requirements that may postpone or divert planned expansion of their activities. All companies participating in the SMMARTEN project have substantial experience in handling risks because they follow the same activities since many years. Unfortunately due to their size they do not have the required resources to formalise the way they manage safety. Their motivation for participating in the project was to improve their position regarding: their knowhow on SMS development and assessment, their internal decision-making process related to corrective actions and investments on safety measures, their effort to fulfil legislative requirements, measure and communicate safety to authorities and their image to the local authorities, their own personnel and the citizens living near by. The main objective of the project was to bring together the companies with the research organisations to identify priority issues among the several elements of a safety management system where guidance and support to SMEs is most needed. A further objective was to develop a methodological approach (which is discussed in section 3 of this paper) to support the companies in the implementation of an effective safety management system. Finally, the project consortium tried to identify the functional characteristics of a dedicated SME network, which will establish contacts between those enterprises interested in improving their approach to safety management systems and interested service and knowledge providers. The network (which is further discussed in section 4 of this paper) is expected to provide support on risk management and control issues to a wider range of SMEs operating in the European Union. 2.1. Findings of the SMMARTEN project At the beginning of the project all companies were provided with relevant documentation as well as with a first draft of a model questionnaire. The aim of

1318

this questionnaire, which was based on the “Guidelines on Inspections” [4] under Seveso I1 requirements was to develop a model base on which generic guidance could be developed, to: 0 address all relevant and priority SMS issues; 0 fit the strengths and the weaknesses of smaller companies; 0 prepare the companies for the relevant legislative requirements; serve as a basis to facilitate communication with authorities and other stakeholders; and 0 provide input and criteria for a self-evaluation test. The companies provided valuable input on the format and the contents of the draft questionnaire and based on this input a model questionnaire was developed. This model questionnaire provides to SMEs a basis for selfevaluation regarding safety management and has been accepted with very positive comments by the SMMARTEN participants. More details on the questionnaire are presented in another paper of this conference [ 5 ] . Site visits were carried out in the participating companies. The aim of the visits was to gain a first-hand impression of the actual situation and discuss in more detail the most important issues. A typical site visit would start with an opening discussion with the site management, followed by a visit of the installations. The examination of the available documentation would then follow. A discussion with the safety engineer would focus on specific problems and expectations and the various SMS issues would then be prioritised. Finally a report would be drafted with the most important findings of the visit. The most important findings of the site visits were the following: 0 The management of change is considered very important in most companies due to frequent changes in the substances handled, personnel, and in some cases, equipment. A high fluctuation of the number of employees due to periodically changing production requirements is not unusual. It is common to handle a large number of substances especially in the pesticides and storage sector. For companies of this size a lot depends on the requirements of the big clients. 0 Often there are few technical redundancies to protect against wrong action. As a consequence, a lot depends on the actions of the employees. It is therefore a positive sign that the shift supervisors are usually promoted from within, since this way they have a deep knowledge of the risks of the activity and can contribute more efficiently in case of an emergency. 0 The use of the safety report within the companies is limited; it is mainly produced to fulfil the legal requirements. The participating companies

1319

0

demonstrated a low interest in risk assessment. This can be explained taking into consideration the lack of time and human resources to carry out or interpret the results of a risk assessment. In companies of this size there is a limited availability of previous audit reports. The Belgian participants highly appreciated the majority of the recommendations produced by the application of the Metatechnical questionnaire by the authorities. In general there is a lack of performance indicators and no accident statistics are maintained.

The SMMARTEN project gave the opportunity to identi@ and discuss some very important characteristics of SMEs related to the way they manage safety. In general it can be said that a lot is based on experience and not on written procedures. Formalisation is limited and there is a lot that needs to be done. At the moment, human resources are very important. Support is requested in the form of acknowledged guidelines that will be applicable to the organisation structure of SMEs. In periods of reorganisation safety is often not the first priority and this can have serious consequences, especially if one considers that many SMEs are often going through prolonged periods of reorganisation due to market pressures. 3. AN APPROACH TO SAFETY MANAGEMENT IN SMALL AND MEDIUM ENTERPRISES

The SMMARTEN project considered the strengths of small and medium enterprises as a central parameter for the development of the methodology presented in this section. The participants of the SMMARTEN project expressed their satisfaction with the proposed approach and their willingness to participate in the development of relevant case studies. The methodological approach aims at indicating a way to introduce and successhlly implement safety management systems in small and medium enterprises. It is an attempt to identify a way that will keep the commitment of company-internal resources to the minimum possible. It has also been taken account of that the external resources needed by a company are kept to a minimum. In this way the main problem of SMEs, their limited human, time, and economical resources has been taken into consideration. However it must be noted that in many cases it is advisable that companies use experienced external consultants for certain tasks within the development of the safety management system. For example, it has been observed that the staff of many of the companies that were visited during the SMMARTEN project have

1320

limited experience, and in many cases no motivation to gain knowledge, in hazard identification techniques. The personnel responsible for safety issues should carry out the steps described below in collaboration with all the involved employees. Top management commitment is a must if this process aims to be successhl. The methodological approach is presented in more detail in Fig. 1 and in the rest of this section. Five phases are distinguished in this methodology. Four of them are successive to each other, whereas the continuous evaluation phase is to be carried out simultaneously to all other four phases. Each phase consists of various elements; some of them provide input to the phase and others are control elements in the sense that the information should be elaborated under the constraints that they provide. In Fig. 1 the input elements are presented in white background and the control elements in grey background.

Fig. 1. The methodological approach

1321

3.1. The “Planning” phase This phase aims to provide the safety personnel with a first overview of the available material, the requirements, and the expectations related to the management of safety. It takes into consideration the pressure from legislation, and the various stakeholders. The policy of the company is very important whereas useful input can be provided at this early stage by the already available documentation.

Legislative requirements play an important role for the implementation of a formalised way to manage safety. For many companies of this size they are the main motivation factor. The Seveso I1 Directive introduced for the first time requirements related to the implementation of SMS, and is the main legal requirement that affects companies within the European Union. Other legislation issued by the regional or local authorities should also be taken into consideration at this stage. The related legislation can be obtained through industry associations and in some cases through the related controlling authority. It should be kept up to date and it would be very useful if the company could find a way to follow the future developments of the legislation as it evolves. This is very important for two reasons: the company can influence the development of the relevant legislation and it avoids finding itself in front of new requirements with short notice to implement them. Even a small company has to interact in different stages of its operation with various stakeholders. The actors participating in this procedure may include contractors, customers, suppliers, banks, insurers, regulators, emergency services, media, neighbours, interest groups, and labour organisations. A very important parameter in the implementation of a safety management system is communication. A company should maintain procedures to ensure that its employees and the contractors and partners in all levels are aware of the importance of compliance with the safety policy and their role in achieving the objectives set in it. External communication is also essential with the various actors, as this may prove very crucial in case of an emergency. The role of communication to the public has gained importance in the Seveso I1 Directive and a company has to be confronted with it. A company could use this interaction in order to gain valuable input as to what should be improved. Taking into consideration the limited availability of resources it is advisable that a company starts its effort to formalise the management of safety using all the already acquired knowledge. The safety report and previous audit reports

1322

can provide information on substances, procedures, and accident scenarios. This documentation should be read and used taking always into consideration that it was produced in the past and as such all information should be updated before being actually used. 3.2. The “Organising” phase This phase aims to provide the company with a closer look on how the actual situation is regarding the management of safety; what exists and what is missing. 3.2.1.Performance of a gap analysis At this point it is usefil and advisable to perform an analysis in order to identify gaps and overlaps in the safety management system of the company. This can be performed in various ways and in this section we consider some of them that can be more easily applicable by SMEs. When applied thoroughly they can provide the safety personnel with very useful information. Many elements in this section are based on practices suggested by the American Institute for Chemical Engineers [6]. The model questionnaire described in section 2.1 can provide valuable input into this process and its use is highly recommended. 3.2. I . I . The management grid The purpose of this approach is to match SMS elements (in the example below we use the SMS areas defined in Annex 111 of the Seveso I1 Directive) with job titles and to identify the role each person in the company performs. The following roles have been identified as more relevant for the case of small and medium enterprises: 0 Approver (AP): allocates resources, signs off, can veto. The approver delegates responsibilities to: 0 Prime mover (PM): has more responsibility than any other staff function to ensure that an element is implemented. 0 Contributor (CO): significantly contributes to carrying out the element.

If more than one person in the company is responsible for an element, playing the same role, this indicates a potential overlap. In cases where some elements display no clearly definable responsibility as far as the above-mentioned roles are concerned this suggests a possible gap. Table 1 shows how this approach can be applied in a small and medium enterprise and the results it produces. In this example, four job descriptions (site manager, safety engineer, technical manager, and shift supervisor) are matched with the elements of the safety management system and eventual gaps or overlaps are identified.

1323

Table 1 Example of the application of the management grid OrganiIdentifi- Operatio- Managesation cation nal ment of and and eva- control change personnel luation of major hazards AP AP AP Site manager Safety PM engineer PM PM PM Technical manager Shift co supervisor Gaps or PM,CO AP,co co overlaps PM

Planning for emergencies

Monitonng performance

PM

PM

Audit and review

PM

co AP

AP,co AP,co

3.2.1.2. The maturity test This approach provides a first qualitative assessment of the state of the safety management system of the company. To achieve this three levels of “maturity” are distinguished. A company should strive to move from the low maturity (LM) through a medium maturity (MM) towards the high maturity (HM) level. In Table 2 we present various aspects of safety management and their interpretation under the different levels of maturity. 3.2.1.3. Theprogress evaluation A progress evaluation can give in regular intervals the status of the implementation of the safety management system. For each of the areas identified by the Seveso I1 Directive this evaluation can be carried out using five different levels of implementation:

i. ii. iii. iv. v.

A management system is in place, documented and fully operational A system exists but is not followed An informal system is in place An incomplete system is in place and upgrading is needed No system is in place

1324

Table 2. The maturity test LM. Staff reacts in a fire-fighting mode to the most immediate and pressing need. MM. The facility has set some goals for the safety management system and established programs exist. HM. The facility sets formal goals and objectives for the safety management system and tracks their progress. HM. Staff has moved beyond managing for compliance and is now actively managing risk. LM. Program effectiveness depends on one key person. If the key person leaves, a significant part of the program and institutional knowledge goes with himiher. MM. The program capabilities are integrated into the organisation to a greater degree than in the LM level. If a key person leaves, the program is likely to recover after a short time. HM. Program capabilities are fully integrated into the organisation. If a key person leaves, organisational recovery is a function of being understaffed, not underskilled. LM. The facility is more or less in compliance with those regulations that are known to them, but there is little assurance that all applicable requirements have been identified, let alone addressed. MM. The facility can demonstrate compliance with most applicable regulatory requirements and has identified those areas where compliance is not yet achieved. HM. The facility can demonstrate and document compliance with all applicable regulatory requirements. LM. Documentation of compliance is weak. MM. The facility periodically reviews its compliance status to assure that the programs that have been implemented are operating as designed. HM. New regulatory requirements are anticipated and tracked by the organisation and compliance is achieved according to a regulatory schedule. HM. The facility has a regular self-inspection program utilising experts from outside the facility or company in addition to internal personnel. LM. Written program documentation is spotty and incomplete and there is little co-ordination or correlation between program areas. HM. Written programs are complete and satisfy the regulatory requirements.

3.3. The “What to do” phase This phase aims to identify the needs of the company carrying out a more detailed analysis based on the use of accident databases and the self-evaluation tool mentioned previously in this paper. The most relevant substances related to the site operation should be identified. The selection can be based on the quantities present at the site andor on the risk potential of the substance. An accidents database (e.g. the FACTS database that is maintained by the Industrial Safety Department of TNO)can then be used to perform a search regarding the most relevant substances. The purpose of this search is to identify the most common causes of accidents for those substances.

1325

From the results of the database search one can keep the most relevant causes and using the accidents selected by this procedure it may be possible to identify some weak points in the way safety is managed in the specific site. The site management can use the model questionnaire mentioned in section 2.1 to identify weaknesses in issues related to safety management and gain an insight in the actual situation. The output of this phase is a short-list of all the actions that are needed in order to improve the way safety is managed in the plant.

3.4. The “Implementation” phase This phase aims to select the issues, among those identified in the previous phase, where action will be taken on the base of the available resources and the priorities of the site management. Having concluded the “What to do” phase, the site management can take action working on the issues identified. Since resources are limited it is probable that a selection (prioritisation) must take place among the identified issues. Possible criteria for this prioritisation procedure could include [6]: Compliance with regulations: Non-compliance with regulations exposes a company to the risk of financial penalties, arising from fines or from restrictions or closure of operations. In addition the company can suffer serious adverse publicity as a result of regulatory violations, which in turn can affect customer, shareholder and employee goodwill. Extent of potential hazards: The extent of potential hazards varies among units within a site. If two units have similar inadequacies in their safety management system the benefit of improvement will be greater at the high hazard unit. Compliance with company policies: Company policies must be taken into consideration and be reflected in the process to improve the safety management system. Having carried out the prioritisation of the needed actions the actual implementation of measures takes place with the involvement of the appropriate persons and the commitment of the necessary resources by the management.

3.5. The “Continuous evaluation” phase This phase aims to integrate an aspect of continuous assessment of the performance of the system, accompanied by the provision of the necessary training and the updating of the relevant documentation. It is expected to be carried out simultaneously to the other phases on a continuous basis.

1326

Appropriate dissemination activities and the necessary training must accompany improvements in the safety management system so that the new measures will not just remain on paper. It is fundamental that the implementation of all the phases will be accompanied by a procedure of constant evaluation of their effectiveness. Corrective actions should be taken if needed and the procedures should be accordingly adjusted. A management system is not only about formalisation but also includes an element of continuous improvement. Without this aspect the whole process described above will not achieve the expected results. 4. THE MICRORISKO NETWORK Microrisko is a European network of industrial enterprises, research and industrial organisations, public authorities and interested parties of the private sector acting in the area of chemical risk management. It was created in the framework of the SMMARTEN project and aims at encouraging the development and implementation of sound and practical methodologies and techniques for effective safety management. Its principle task is to accommodate and establish the experience sharing among SMEs handling dangerous substances and relevant controlling authorities with the ultimate goal to assist in the development of a common language and a wider know-how for efficient risk control in this industrial sector. The network is addressed to industrial enterprises, research and controlling organisations of the public and private sector and interested parties active in the area of chemical risk management. It is organised such as to provide the companies with the appropriate support for the development of an effective safety management system including: 0 technical, organisational and managerial aspects related to the implementation of a safety management system; 0 assessment of the conformance with the legislative requirements; 0 approved scientific approaches to risk control by establishing a platfrom for academia and research organisations to promote the results of their work; 0 support concerning safety investments by providing relevant economical data; and 0 personalised products by approved providers through the development of a marketplace where service providers can meet the industry. Addressed to all parties interested in industrial safety Microrisko is able to provide support at different levels of risk management and various activities

1327

involved in the development and implementation of safety management systems and efficient technologies. In addition, the network aims at identifjmg common priorities and general tendencies resulting primarily from the needs of small and medium sized enterprises but also from priority safety management aspects identified by larger companies and national or international organisations. The network is supported by a scientific team comprised of specialists in technical issues and legislation and co-operates with safety consultants, organisations related to safety and software developers. In this way, Microrisko has established a way to satisfy the needs of its members for high reliability and provides direct response to their questions and practical problems related to the development of safety management systems. Microrisko will establish a series of seminars in topics of general interest related to safety. The seminars will include presentation of scientific methodologies, and general guidelines for the implementation of safety management systems. The content of these seminars will be periodically adapted to the requirements of the members. Microrisko encourages new partnerships and provides all interested parties with information on project proposals. A newsletter is planned to be published in the near future containing information on the network, conference reports, contact search, reports of researchers, presentation of new projects and topics of general interest. A dedicated website has been created (www.microrisko.net) with the aim to become a gateway to information on issues related to the management of safety by SMEs, to include tools, links, and publications, and to provide all the necessary information on how to join the Microrisko network.

5. CONCLUSIONS Small and medium enterprises are managing hazardous substances since many years. The implementation of the Seveso I1 Directive poses, for the first time to many of them, requirements related to the formalisation of the way they manage safety. This is a positive development as such but a solution is urgently needed on how to fulfil these requirements especially when considering the limited resources of companies of this size.

1328

The SMMARTEN project provided a unique opportunity to assess the actual situation. In the framework of the project a self-evaluation tool has been developed in the form of a questionnaire. A methodological approach was also developed and provides a solution to many companies on how to formalise their safety management system. The approach appears to be appropriate for the resources available to SMEs while on the other hand it covers all the issues addressed by the relevant European legislation. Apart from the development of relevant guidelines and tools and the provision of the necessary consulting services companies can benefit a lot through networking activities. The framework of such a platform has been developed and is actually operating as a web based application, enabling companies to gain access to useful information at no cost. REFERENCES [ 13 Council Directive 96/82/EC of 9 December 1996 on the control of major accident hazards

involving dangerous substances, Official Journal of the European Communities, Luxembourg, 1997. [2] Organisation for Economic Co-operation and Development, OECD environment monographs No. 95: Report of the OECD workshop on small and medium-sized enterprises in relation to chemical accident prevention, preparedness, and response, Paris, France, 1995. [3] S. Loupasis, The Directive Seveso I1 and the requirements it poses on safety management systems. A case study, EUR 17345 EN, European Commission, ECSC-EC-EAEC Brussels, Luxembourg, 1997. [4] G.A. Papadakis and S. Porter (eds.), Guidance on inspections, as required by Article 18 of the Council Directive 96/82/EC (Seveso II), EUR 18692 EN, European Commission, DG JRC, Ispra, Italy, 1999. [5] G. A. Papadakis, N. Linou, A. Mengolini, D. Fatta and A. Papadopoulos Guidance on safety management requirements for smaller sized dangerous chemical enterprises: the SMMARTEN project In: 10th International Symposium on Loss Prevention and Safety Promotion in the Process Industries, conference proceedings, Stockholm, Sweden, 19-21 June 2001. [6] Centre for Chemical Process Safety, Guidelines for implementing process safety management systems, American Institute for Chemical Engineers, New York, USA, 1994.

1329

Finding a Consensus on Plant Safety - the German Way Chr. Jochum Chairman of the German Major Hazard Commission, Robert - Stolz - Str. 54,D-65812 Bad Soden, Germany 1. THE DIFFERENT PERCEPTION OF RISK

In principle, chemical plants are dangerous. As a rule they are characterized by dangerous substances being used under high temperatures and quite often under excess pressure. The necessity of the extent of such use must undoubtedly be questioned. Inherent safety, achieved by using less hazardous substances and reaction conditions could without doubt be achieved more often than is currently the case. But even if the situation were to change for the positive, dangerous substances and hazardous reaction conditions could never be ruled out completely. Anyhow the necessary technology is available. Primary safety measures reduce the probability of occurrence rather than the hazard potential. Secondary safety measures which mitigate the effects of an accident are equally important. In the end they, too, reduce the probability of accidents with serious consequences for humans and environment. This is a view which is easily accepted by engineers and scientists as well as lawyers both on the side of the plant's management and on the authority's side. From the point of view of the neighbour of a chemical plant, i.e. a potentially affected citizen and of environmentalist groups, however, it is a different thing. As much as high risks which arise from a medium danger potential and a comparatively high probability of occurrence (i.e. road accidents) are being tolerated in everyday life, the potentially affected person all the more condemns particularly high hazards even if the risk is relatively low because of a very slight probability of occurrence. In heated citizens' meetings one question comes up frequently: Surely an accident can happen tomorrow - in spite of a low probability of occurrence? As the honest answer must be "yes", the question often proves to become a dead end in heated discussions.

1330

The chemical industry may not occupy the same rank as nuclear industry when it comes to public debates, but it is neither free from the fundamental problems mentioned above nor from political arguments. On account of the facts, conflicts are preprogrammed. They discharge themselves after accidents as well as in publicly conducted llicensing procedures, known as the ,,not in my backyard" - syndrome. 2. ACCEPTABLE RISK VS. TECHNICAL STANDARDS A consent on the level of acceptable risk would be an elegant solution to the problem. Amongst continental European countries, the Netherlands are a leading force in this respect. In Germany, this approach has not been used successfully so far, for different reasons: 0

Industrial experts refer to the lack of scientific fundamentals of probabilistic safety considerations and therefore fear inappropriate decisions to their disadvantage.

As far as politics and the public are concerned, there is no sign of a commonly accepted understanding of risk, nor is there any indication of the subject being pursued with enthusiasm. Therefore, rather than specifying an acceptable risk, Germany prefers the more traditional method of defining standards for safety technology. Obviously there is a close correlation between these two different approaches and they are therefore no real alternatives in solving the problem of acceptance of risks. However, the discussion is being focussed on a sphere whose economic effect is very distinct. Safety is an open system, open to requests and demands for additional measures. Unfortunately, the economy is not quite as open in this sense so that, once again, conflicts are preprogrammed.

So in Germany, instead of coming to a consent on an acceptable risk, the task is to consent on the standard of technology. This would be quite difficult to achieve even amongst engineers and scientists but becomes a real problem where "laymen" such as potentially affected citizens or environmentalists quite rightly -join the debate. 3. THE POLITICAL SOLUTION The political solution of this conflict falls back on instruments which have stood the test in other spheres: the formation of pluralistic commissions for the consultation of politics. Where plant safety is concerned, the Technical

1331

Committee for Plant Safety (Technischer Ausschuss fur Anlagensicherheit, TAA) and the Major Hazard Commission (Storfallkornrnission, SFK) are important. Both are attached to the Fereral Ministry of the Environment. The structure of both committees shows the different tasks clearly, better so than the appropriate legal text. 3.1. Technical Committee for Plant Safety According to 9 31a of the Federal Immission Control Act, the Technical Committee for Plant Safety (TAA) consists of representatives of the federal authorities and supreme state authorities involved in the matter, representatives of science, of expert organisations, plant operators, the workers compensation insurance hnds and the chairpersons of various other committees which work in similar spheres. In addition to and beyond these legal requirements, members of environmental groups have been appointed.

Consequently, the TAA puts the emphasis of its work on the rather hard facts of plant safety - on a high technical and scientific level but quite controversial because of the varying backgrounds of its members. Its main mission is to set up Technical Rules to the Federal Immission Control Act. 3.2. Major Hazard Commission In accordance with tj 5 l a of the Federal Immision Control Act, the Major Hazard Commission (SFK) is made up of representatives of science, environmental groups, trade unions, industry and other business associations (e.g. insurers, experts), and the supreme state authorities responsible for plant and workers safety. So the commission's members represent the essential society groups affected by matters of plant safety. Consequently, discussions within the Major Hazard Commission are broader, more fundamental and usually more political. The professional standard does not suffer from this, but the point of view is often a different one. The SFK puts more emphasis on the "soft" issues of plant safety such as the human factor and management systems. The results are usually publicized as reports or guidances. 4. THE DECISION PROCESS WITHIN THE SFK

In many cases there is no common professional basis to begin with, not just because of the difference in views but also because of the difference in the members' educational background. Some scientists and engineers in the SFK were unaccustomed to the discussion required for establishing such a basis.

1332

On the other hand this not only makes it clear that there is a need for information beyond the inner circle of specialists, but in a number of cases new questions and innovative solutions to problems have been contributed. In spite of these complex conditions, consensus was reached in most cases after discussions which were - occasionally - very controversial. A guidance for the Major Accident Prevention Policy according to the Seveso I1 guideline of the European Union is an example for this. While the plant operators' representatives in particular considered the corporate policy statements to be sufficient to begin with, the representatives of the competent authorities tended to a "mini safety report". Nevertheless, after an intensive and controversial debate a compromise was found and agreed upon unanimously. The guidance provides that, in addition to the policy statement, the basic risks as well as the basic technical and organizational safety measures resulting from them are being described. However, it was not always possible to find a compromise that was accepted by every group. This happened, for example, when incidents like major accidents according to Seveso 11, other accidents and near misses were analyzed. All members of the Major Hazard Commission agreed on the fact that learning from incidents is very important. They had and still have disagreements on how this could be organized in a way covering basically all companies. By the majority, the commission has agreed on a system according to which information from the companies will be passed on to a subcommittee of the commission for analysis and evaluation. This information may even be sent via a DECHEMA-group in order to protect confidentiality. The subcommittee reports to the commission itself and, if possible, suggests appropriate mesasures. In addition to this, it will publicize descriptions of the anonymized incidents, thus making them accessible to the specialists and any other interested group. Controversial discussion is still going on about how detailed the information which will be provided by the companies and publicized subsequently should be. As I have gained an insight into many systems of this kind already established in major companies, I personally do not consider the ideas of the Major Hazard Commission to be unreasonable, so that a compromise should be possible. The diverse composition of the Major Hazard Commission has proved a success in debates following major accidents, too. Even during the hot phase of very controversial debates following spectacular accidents the basis of trust achieved through the intensive co-operation in the commission has proved to be strong enough for a discussion that was not without emotion but still orientated on facts.

1333

5. CONCLUSION

To sum up, it can be said that the broad spectrum of the groups represented in the Major Hazard Commission makes the results of its discussions acceptable in politics. But as far as consultation of politicians strictly speaking is concerned, such a commission meets ist limits. On one hand, quite a number of politicians succumb to the temptation to speak directly with groups close to themselves instead of such a commission. On the other hand, the working capacity of the commissions’ honorary members is limited. Many of them do not have an organization in the background to support them. The ones who have this in principle find it increasingly difficult to get resources from their organizations. So inevitably the commission is sometimes too slow to influence political decisions. Altogether, however, the Major Hazard Commission as well as the Technical Committee for Plant Safety are effective instruments for the improvement of plant safety in Germany. Fundamental conditions for this are the high level of willingness to co-operate between groups with a normally controversial position and a high personal committment of ist members. Hence the model can be recommended as worth emulating.

This Page Intentionally Left Blank

1335

Cost Effective Compliance with the Risk Assessment Aspects of Seveso I1 Graeme R.Ellis

SHE Assurance Department, Eutech Ltd, Daresbury Park, Daresbury, Warrington, Cheshire, WA4 4BT, United Kingdom Eutech are a wholly owned subsidiary of ICI 1. ABSTRACT

The European Directive 96/82/EC or ‘Seveso 11’ as it has become known, was enacted in the UK as the Control of Major Accident Hazards ( C O W Regulations 1999, with all ‘Major Accident’ establishments required to submit Safety Reports by February 2002. There has been considerable concern in the UK Process Industry about the costs of compliance, these include site-based resources, consultancy fees, assessment charges by the Competent Authority and the cost of any essential plant improvements. The risk assessment aspect of the Directive has the general duty that “every operator shall take all measures necessary to prevent major accidents and limit their consequences ”, which can be interpreted as a very demanding requirement. In this paper a highly structured approach to carrying out a COMAH risk assessment will be presented. This is cost effective due to a series of screening exercises at key stages during the assessment, aiming to eliminate activities from further demonstration where there is no major accident potential, hazards where the risks are judged to be broadly acceptable, and hazards where the measures meet all current standards. The approach is semi-quantitative,making reference to a risk matrix that has been calibrated against published risk criteria. The risk assessment process is captured on ‘Major Accident tables’, which form a central part of the Safety Report. The information can be presented in a concise format, assisting the demonstration to the Competent Authority and providing a useful ‘living document’.

1336

2. INTRODUCTION

The Control of Major Accident Hazards (COMAH) Regulations came into force in the UK in April 1999. These require operators storing quantities of dangerous substances above prescribed threshold limits to prepare a Safety Report. This must demonstrate that the operator has taken ‘all measures necessary’ to limit the potential for accidents to effect workers, the public or the environment. The dangerous substances are those with the potential for severe consequences due to their acute toxic or fire/explosion characteristics, and are either named substances within the regulations or based on generic ‘risk phrase’ categories in line with separate European legislation. A significant part of the demonstration under COMAH involves a risk assessment of the potential major accident hazards on the site. In this paper a process will be described that has been developed to meet the specific requirements of the UK Health and Safety Executive (HSE) for COMAH Safety Reports, whilst following general risk assessment principles. This methodology builds on process hazard analysis tools and techniques developed by Eutech. These include Process Hazard Review (PHR) for hazard identification on existing operations, and a calibrated risk matrix used for semi-quantitative risk prioritisation.

3. RISK ASSESSMENT REQUIREMENTS OF COMAH Under the COMAH Regulations a ‘major accident’ is defined as a hazardous event leading to ‘serious danger to human health or the environment, immediate or delayed, inside or outside the establishment, and involving one or more dangerous substances’. Serious danger to people has been interpreted by the UK HSE [11 as the risk of death, physical injury requiring prolonged treatment or harm to health. The UK Environment Agency (EA) have issued guidance on the definition of a Major Accident to the Environment (MATTE)[3], which gives thresholds for the area affected and the time for recovery, depending on the sensitivity of the receptor. It should be noted that in the scenarios developed for the COMAH risk assessment, a ‘dangerous substance’, as defined in the regulations, must be involved in the sequence of events leading to the accident. There may be major accident scenarios on the site which do not involve dangerous substances, either directly or as a consequence of a domino effect, and subsequently there is no requirement to include these in the Safety Report.

1337

The general duty under the COMAH Regulations is that ‘every operator shall take all measures necessary to prevent major accidents and limit their consequences to persons and the environment’. The fact that limitation measures are stipulated recognises that risk cannot be completely eliminated. It is therefore interpreted that the regulations require a judgement on whether the measures to reduce risk are adequate. The depth of the assessment of risks needs to be proportionate to the scale of hazard and the residual risk. A complex chlorine manufacturing site close to a centre of population therefore requires a greater depth of assessment than a simple chlorine storage system in a remote location. In the UK the HSE have interpreted the general duty as requiring operators to demonstrate that risks have been reduced to ‘as low as reasonably practicable’ (ALARP),which is in line with UK Health and Safety legislation. A hierarchical approach is required for demonstratingthat ALARP has been achieved. Firstly inherent safety principles need to be considered to eliminate or minimise the hazard, then Approved Codes of Practice, International standards, company standards and good engineering practice should be applied. For operators coming under the COMAH ‘top tier’ regime due to the quantities of dangerous substances held on site, a Safety Report must be prepared and submitted to the Competent Authority. The regulations define all the aspects that must be included in the report. For the risk assessment aspects the Safety Report must ‘demonstrate that major accident hazards have been identified and that the necessary measures have been taken to prevent such accidents and limit their consequences for people and the environment’. A clear link is required between the accident scenarios and the safeguards in place to control the risks. The risk assessment must also include an assessment of the severity and probability of the major accident scenarios identified. The regulations do not stipulate whether this assessment should be qualitative or quantitative. The UK HSE approach is to state that the chosen approach must be ‘proportionate’ to the scale of hazards, the nature of the vulnerable locations surrounding the site and residual risk. The Competent Authority have not provided prescriptive approaches for COMAH risk assessments, but have provided detailed guidance on the principles to be followed [2]. For all the dangerous substances held on site the Safety Report must as a minimum include a hazard identification and consequence assessment. These may be able to show that the likelihood or consequences of some possible major accident hazards are so small that no further demonstration is required.

1338

Where the consequences of possible major accident hazards are non-trivial the Safety Report must include a risk analysis with information about the probabilities of the events. This requirement is fundamental to the demonstration that ‘all measures necessary’ have been taken. Due to the complexity of the hazards in the chemical industry, it is required that a systematic process is described and used to identify all foreseeable major accidents. Recommended techniques are Hazard and Operability (HAZOP) studies, reviews of past accidents and incidents, bespoke industry checklists or failure mode and effects analysis (FMEA). Where protection against major accidents is dependent on the action of an automatic shutdown system or human intervention, the risk assessment must consider whether the reliability of these measures ensures that risks remain ALARF’. Where consequence assessment models have been used, these must be clearly referenced and a justification made for their use and any key variables or assumptions that have been made, such as wind speed and weather type in the case of toxic gas dispersion models.

4. HISTORICAL DATA ON ACCIDENTS Table 1

C O W Risk Assessment Hazard Identification diagram. Group I Hazardous Event Operated Outside Design Limits Internal explosion . I I Keaction runawav

I

Loss of containment under operating conditions

External Events

I

Natural Event

I

Maloperation of openings Human factors Vehicle imDact Knock-on effect Maintenance error

Violation Extreme weather Ground movements

I

1339

Analysis of the past major accidents in the process industry reveals a common theme that a ‘loss of containment’ of process material occurs at some stage between the initiating event and the final impact on people or the environment. This mechanism has in principle been involved in other non-process industry accidents such as the Herald of Free Enterprise ferry disaster and the explosion of the Challenger Space Shuttle. ICI carried out research in the early 1990’s into the underlying causes of published accidents in the process industry, and produced a guide-word set that has been adapted for use on COMAH risk assessments. The key headings are shown in Table 1. For each hazardous event, guide-words cover the full range of generic failure mechanisms, including equipment failures and human factors. They are used by a hazard study team to promote exploration of the possible causes of loss of containment. 5. EUTECH COMAH RISK ASSESSMENT METHODOLOGY

A methodology has been developed by Eutech that follows general risk assessment principles tailored to the specific requirements of the C O W Regulations. The key steps are outlined in Table 2.

STAGE SITE ASSESSMENT

1

MAJOR ACCIDENT SCREENING

1

HAZARD IDENTIFICATION

1

RISK SCREENING

1

CHECK AGAINST STANDARDS

.1

COST BENEFIT ANALYSIS

1

IMPROVEMENT PLAN

SCREENS OUT Sites with insufficient Dangerous Substances Plants with no Major Accident potential Scenarios that are not credible Scenarios with ‘Broadly Acceptable’ risk Scenarios with measures meeting all current standards Scenarios with measures meeting ALAW or BATNEEC Optimised set of essential improvements to comulv with COMAH

The methodology aims to answer the following questions: 0 What can go wrong? 0 Howbad? Howoften? So what? What further measures?

1340

The first stage is a hazard identification procedure to identify all reasonably foreseeable major accident scenarios, generally associated with loss of containment from the process. The effects of these releases in the worst credible case is then determined, including effects both on people or the environment. The next stage is to check the possibility of eliminating the hazard using inherent safety principles, although this will often not be feasible for existing systems. The current measures in place to prevent, control and mitigate the major accident hazard are identified, and based on these the frequency at which the hazardous event could impact on people or the environment is estimated. The consequences and frequency of the major accident scenario are positioned on a calibrated risk matrix. This is a 5 by 5 matrix with word models for Consequence and Frequency, with the risk falling into one of the following bands; Broadly Acceptable, Tolerable (ALARP band) or Intolerable. No further demonstration is required for ‘Broadly Acceptable’ risks, but for Intolerable risks further control measures must be devised and selected following a cost-benefit analysis. For scenarios in the ALARP band, the existing measures must be compared with current standards to determine if further measures can be taken to meet best industry practices. The results of the risk assessment are recorded on a Major Accident table, the table shows the causes and consequences of the accident, the measures in place to prevent, control and limit the effects of the accident, and an assessment of the risk in one of the following categories: 0 0 0

Residual risk judged to be Broadly Acceptable Risk reducing measures meet all current standards Risk reducing measures judged to be ALARP

5.1 Hazard Identification Under the COMAH Regulations a ‘suitable and sufficient’ set of major accident scenarios must be identified. These must represent the full range of potential major accidents on the site, including flammable hazards such as fires and explosions, toxic effects from gas clouds and damage to the environment by releases to air, water or ground.

A team-based approach is used for the hazard identification study with an experienced hazard study leader and a team from the site with direct experience of the activity to be studied. The team is likely to include a process engineer, plant manager, plant engineer and production supervisor. Following a

1341

description of the normal operating method for the system, the COMAH hazard identification guide diagram is used to help the team identify potential major accident scenarios. A record is made under each hazardous event heading of the major accident scenarios identified. Where no hazard exists a record of the reasoning is made to indicate that the event has been considered. The Major Accident table has the following headings, as shown in Table 3. Table 3 Major Accident Table Layout I Consequences Hazardous I Cause Event

I

Overfill

I

during oMoading

I

I

Potential run-off to river, environmental impact, fish kill hazard MAJOR I

Existing Prevention Measures

Existing Limitation Measures

Estimated Frequency and Residual Risk

Procedural checks. High level trip system.

Tank b u d with procedure for rainwater removal.

REMOTE due to high level trip system and bund.

I

Residual risk judged to be ALARF'

5.2 Consequence Assessment Having identified a loss of containment mechanism the hazard study team will next consider the worst credible consequence in terms of effects on people or the environment. An essential requirement is for the team to assume that any active forms of protection, such as trip systems or relief systems, fail to operate as intended. Passive forms of protection such as tank bunds or fire insulation are assumed to be effective, although features that compromise the level of protection such as drain valves on bunds may need to be considered. The main aim of this stage is to understand the types of hazardous events that could occur based on the properties of the material released. These will generally fall into one of the following categories: Thermal radiation effects due to pool fire or jet flame on release of a flammable material Fire engulfment effects due to ignition of a flammable cloud causing a flash fire Overpressure effects due to vapour cloud explosion of semi-confined flammable cloud Overpressure and thermal radiation effects fi-omboiling liquid expanding vapour explosion (BLEVE) on liquefied flammable gas tank. Toxic effects fi-om dispersion of toxic vapour cloud or combustion products from fire

1342

0

Adverse environmental effects on flora, fauna or aquatic life due to releases to air, water or ground

For a given hazardous event a number of effects may occur depending on factors such as whether there is instantaneous or delayed ignition, or no ignition, of flammable materials, weather conditions for toxic releases and tidal or river conditions for environmentally hazardous releases. For complex situations it may be appropriate for an event tree analysis to be undertaken to show the range of potential effects and the key factors influencing the outcome. A qualitative judgement by the team on the scale of effects will be sufficient for simple cases, in more complex situations a specialised computer based programme can be used to estimate the hazard ranges. A number of models are commercially available. These typically require source terms such as the material released, conditions such as temperature and pressure and size of the opening. The model will predict the hazard ranges for various flammable and toxic effects. Results can be provided for different weather conditions and wind speeds, a standard approach is to model a typical weather condition for the area and a worst case inverse weather condition. Models predicting the effects on the environment are not as well developed, and generally a qualitative judgement will be required.

Based on the results of the qualitative or quantitative Consequence Assessment, the worst case consequences for each scenario will placed in one of the following categories, where the first three meet the ‘major accident’ definition in the COMAH Regulations: 0 0

0 0 0

5.3

Catastrophe - e.g. fatality to member of public Extremely Serious - e.g. fatality to worker or major accident to the environment (MATTE) Major - e.g. major irreversible injury to worker Serious - e.g. serious reversible injury to worker Minor - e.g. minor (classified or ‘over 3 day’) injury to worker

Existing Control Measures

For hazardous events found to have significant consequences, the hazard study team will identify the existing control measures or safeguards. These include hardware systems, safe systems of work and human factors that combine to reduce the residual risk to an acceptable level. In guidance documents the HSE require these measures to be separated into the following categories:

1343 0

0

0

0

Inherent safety measures to remove or reduce the hazard at source, such as reduction of hazardous inventory, use of corrosion resistant materials or segregation of hazards and people. Prevention measures to stop the initiation of a major accident, such as regular inspection, use of all-welded pipes, effective operating procedures or leak testing following maintenance. Control measures to prevent a hazardous event escalating into a major accident such as relief valves, instrumented protective systems, gas detection or control of ignition sources. Limitation measures to reduce the consequences of a major accident such as bunds, toxic refuges, fire fighting equipment, emergency response procedures and design of occupied buildings.

The reliability of the control measures throughout the life cycle of the plant needs to be considered to determine how effective they are in providing protection. For instance, an instrumented trip system may have been provided in the design but if there are no scheduled maintenance procedures it is likely that the trip will not function in an emergency. During the hazard study the team will consider any known shortcomings in the control measures, for critical measures a specialist audit is subsequently required to provide the demonstration required for the COMAH Safety Report. 5.4

Frequency Assessment

Table 4

Occasional

remote

Frequency Range 1 to 10 years 10 to 100 years 100 to 1k years 1k to 1Ok years 10k to lOOk years lOOk to l m years

1 m to 1Om years unlikely

Word Model Has occurred during lifetime of plant Could occur during remaining lifetime of plant Not expected to occur during remaining plant lifetime Incidents in industry on similar technology Foreseeable event but chance of occurring is very low, requires the failure of a number of layers of protection As above Equivalent to risk of being killed by lightning strike or falling aircraft

1344

Risk is a function of both the consequences of a hazardous event and the likelihood expressed as a frequency. To carry out a risk assessment it is therefore necessary to estimate the frequency of the hazardous event. For simple systems it may be sufficient to use a semi-quantitative approach, where a team of experienced staff from the plant make a judgement based on the word models as shown in Table 4. For more complex situations or where the residual risks are judged to be high a quantitative approach may be judged appropriate. This may use data from previous incidents to estimate, for example, the frequency at which a wellmaintained pressure vessel might rupture catastrophically under normal operating conditions. To estimate the frequency at which a more complex hazardous event might occur, fault tree analysis can be used. This considers the combination of failures of plant equipment and operator action that could lead to the hazardous event and includes estimates for the reliability of the automatic protection systems and human intervention measures. Reliability data from published sources is used to quantify the logic diagram produced and provide an estimated frequency for the hazardous event. The hazardous event might be the release of a flammable material. The final consequences will depend on the event sequence taking account of factors such as the probability of the release being detected and effectively isolated or the probability that an ignition source ignites the material. A technique known as event tree analysis can be used to estimate the probabilities of the potential major accidents. A combination of fault tree analysis and event tree analysis will provide estimates of the frequency of the consequences calculated in the previous section. In carrying out a quantified analysis as described above, the HSE require that any generic reliability and probability data is justified as suitable for the site being assessed, particularly where claims are being made for higher performance than the generic industry standards. 5.5

Risk Evaluation

Having estimated the consequences and frequency of the hazardous event, this information must be compared with criteria to provide guidance on whether improvements must be made. For operational risks and minor safety issues these criteria will often be set by the company to meet their own requirements. For major accident hazards however, where the potential exists for serious injury or fatality to workers and members of the public, criteria have been set in the UK by the HSE. Risk criteria are not normally expressed as a single value, above which risk is unacceptable and below which risk is acceptable. Instead there is a broad band

1345

within which risks must be reduced to ‘as low as reasonably practicable’ (ALARP).This brings in the need to carry out some form of cost-benefit analysis to determine if the costs of an improvement can be justified by the risk reduction achieved. Above the ALARP band the risks are ‘intolerable’ with improvements seen as essential in all but exceptional circumstances, and below the ALARF’ band the risks are ‘broadly acceptable’, with no further working required to reduce risks. In recent guidance [4],the HSE have made the following statements regarding risk to members of the public. To define the upper threshold between tolerable and intolerable levels of risk they have stated: “for members of the public who have risk imposed upon them “in the wider interests of society” this limit (the dividing line between what could be just tolerable and what is unacceptable) is judged to be an order of magnitude lower (than for any substantial category of workers) - at 1 in 10,000 per annum”.To define the lower threshold between tolerable and broadly acceptable levels of risk they have stated: “HSE believes that an individual risk of death of one in a million per annum for both workers and public corresponds to a very low level of risk and should be used as a guideline for the boundary between the broadly acceptable and tolerable regions”. The above thresholds plus other criteria from the HSE for risks to substantial groups of workers have been used by Eutech to produce a calibrated 5 x 5 risk matrix. This uses a set of consequence descriptors developed by ICI/Eutech for safety and environmental accidents on a five-point scale of minor to catastrophic. The frequency word models have been developed to assist teams carrying out risk assessments. These can be supported by quantitative estimates where necessary to more accurately determine the frequency band. Based on the estimates of frequency and consequence, each scenario can be positioned on the risk matrix. These will fall within the ‘broadly acceptable’, ‘tolerable’ or ‘intolerable’ bands. 5.6 Risk Management

Where risks are judged to be within the ‘tolerable’ or ‘intolerable’ bands on the risk matrix, possible further improvements will need to be considered. The improvements considered can either reduce the consequences of the event, such as installing a taller vent stack to avoid hazardous ground level concentrationsof toxic gases, or reducing the frequency of the event by installing extra prevention measures. In either case it is necessary to make reference to current industry standards for the technology under review.

1346

Where the existing measures in place meet all the current standards, and these standards are appropriate for the technology and hazards identified, this may provide a sufficient demonstration under the requirements of C O W that ‘all measures necessary’ have been employed. Where significant hazards exist, other reasonably practicable measures should also be considered and only ruled out following a cost-benefit analysis. The above requirement is interpreted by the author as needing to have considered all the options that a reasonably competent engineer might identify. For instance, if the hazard involved the overfilling of a tank of hazardous material then a good case would need to be made for not fitting a high level alarm or trip system.

6. CONCLUSIONS The COMAH Regulations place an onerous duty on operators of sites with large inventories of dangerous substances to carry out detailed risk assessments. The process developed for the risk assessment aspects of COMAH Safety Reports has been shown to be an effective and efficient methodology. The structured approach demonstrates that a thorough evaluation of the risks posed by the operation has been undertaken, and the semi-quantitative use of a risk matrix limits the need for time-consuming and costly quantified risk assessments. The process provides the opportunity to review the existing protection measures against current industry standards, and uses a risk-based process for determining if further measures are required. The COMAH Regulations are seen by many companies as a costly and unnecessary requirement, and the potential exists for the Safety Report preparation to become a paper exercise with no real benefits. The approach described in this paper overcomes this by following a straightforward route, which escalates the level of detail in the analysis in proportion to the level of risk. This allows an improvement plan to be developed to bring about genuine reductions in the risks of major accidents. A second benefit from the involvement of site personnel in the preparation of the Safety Report, is a greater awareness of the potential for high consequence, low frequency events. These are events that they are unlikely to witness during their working lives, and yet are an ever present danger should attention to the critical safety measures lapse.

1347

REFERENCES [ 11

A guide to the Control of Major Accident Hazards Regulations 1999, L1 11,HSE Books.

[2]

Preparing Safety Reports: Control of Major Accident Hazards Regulations 1999, HSGl90, HSE Books

[3]

Guidance on the interpretation of Major Accident to the Environment for the purposes of the COMAH Regulations, Department of Environment, Transport and Regions, June 1999, The Stationery Office

[4]

The tolerability of risk from nuclear power stations, HSE, 1992, HMSO

This Page Intentionally Left Blank

1349

A consequence analysis for accidental explosions involving flammable gases S. Carol, J.A. Vilchez, J. Casal Centre for Studies on Technological Risk (CERTEC) Polytechnic University of Catalunya ETSEIB. Avda. Diagonal 647,08028 Barcelona, Spain

ABSTRACT This work presents a consequence analysis on accidental explosions involving flammable gases in fixed industrial installations (it does not cover accidents occurring during transport). The historical analysis on the consequences of a large number of accidents with common characteristics permits the establishment of the order of magnitude, or of limit values, for the most probable damage (fatalities, injuries, etc). With data concerning explosions with flammable gases all over the world (which have been obtained from MHIDAS database) is possible to draw f-N curves for developed or undeveloped countries. The risk level shown in this study is clearly more unacceptable for undeveloped countries while, for the more developed areas, this risk level is lower. The application shows also that there is a diference between modern accidents and accidents occurred in the past in developed areas. This results validate the actual legislation and the assessment of risks in companies affected by Directive 82/501/CEE "Seveso" or 96/82/CE "Seveso II", for example. 1. INTRODUCTION

Historical analysis of accidents is one of the most frequently used auxiliary techniques in risk analysis. Its usefulness has essentially centred on its application to the qualitative identification of hazards in specific installations or operations. It also offers promising possibilities for application in the estimation of the human and material damage likely in specific accident scenarios; however, this second aspect has been explored much less.

1350

The historical analysis of the consequences of a large number of accidents with common characteristics permits the establishment of the order of magnitude, or of limit values, for the most probable damage. The results of an historical analysis linking the consequences of an accident with, for example, the type of material involved, can be very useful for the qualitative evaluation of the tolerability of certain risks, for performing risk analysis in industrial areas, and for obtaining an approximation of the f-N curves associated with a particular accident scenario. To develop this historical analysis we need reports of accidents where there are a lot of information about this events (bibliographic recopilations or databases like FACTS, MHIDAS, the Accident Database or MARS). In the present study we have worked with MHIDAS[l] database (Major Hazard Incident Data Service), depending on the SDR, in UK. In January99 release, it has 9,876 references about 8,600 accidents. We have used only 331 accidents, corresponding to every accidental explosions involving flammable gases in fixed industrial installations (it does not cover accidents occurring during transport). In Table 1, we present the most important accidents reported in this database from the point of view of the number of fatalities occurred in the event. Only as a reference, we have also worked with the accidents reported by Davenport and Lenoir in their report "A Survey of Vapor Cloud Explosions: Second Update"[Z], and the report "Large Property Damage Losses in the Hydrocarbon-Chemical Industries. A Thirty-year Review", edited by MarshMcLennan Protection Consultants[3]. 2. SOCIAL RISK AND f-N CURVES

Social risk was originally developed for the nuclear industry and addresses to the number of people who might be affected by hazardous incidents. An f-N (Frequency-Number) curve is a logarithmic plot of cumulative frequency versus number of fatalities. Nevertheless, we present an alternative use of this curves assuming 1 for the value of the cumulative frequency for all the accidents included[4,5]. For example, Fig. 1 shows the f-N curves of Davenport and selected records of MHIDAS, drawed with this criteria. It is interesting to note that the results are very similar. The lower frequency for serious explosions of the MHIDAS accidents, is due to a biggest size of the sample[6].

1351

Table 1

The most serious accidents reported in MHIDAS (number of fatalities). Year Location Country Material name Activity Fatalities Injuries 1984 San Juanico Mexico LPG Storage 500 2,500 1997 Mena Plain Saudi Arabia GAS Commercial 343 1,500 1944 Cleveland USA LNG Storage 131 200 1972 Duque de Caxias Brazil LPG Storage 39 51 1990 Nagothane India LPG Process 31 30 1947 Germany Naphtha Storage 29 1966 Feyzin France LPG/Aviation fuel Storage 21 52 1977 Cartagena Colombia Ammonia Process 21 30 1986 Devnya Bulgary Vinyl chloride Process 17 19 1984 Abbeystead UK Methane Process 16 28

For Davenport, in the 44% of the incidents there are not fatalities, while, for MHIDAS, this ratio is 52%. In the Davenport series, in the 97.7% of the accidents, the number of fatalities is one hundred or less while, using MHIDAS records, this percentage is 99.1%. 1,000

0.56

...... DAVENPORT

-0.48

I I

&

Lu z

E

0,100

3

E

5 Lu

3

5

0

0,010

0,001

1

10

100

N

1.000

1o.cQo

Fig. 1. f-N Curves for Accidents registered in MHIDAS or by Davenport.

1352

3. THE f-NCURVES IN SEVERAL COUNTRIES

Using the information available in MHIDAS, it is possible to study the different severity between accidents occurred in one or another country. We have worked with two groups of accidents. The first ones have occurred in Europe, USA, Japan or Australia. The second ones have occurred in other countries of the world. Figure 2 shows the f-N curves for this two groups. According to this criteria, in the 56% of the accidents occurred in the first group of countries, the consequence does not involve fatalities while, for the second group it is easier to have one or more fatalities (only 34% of accidents without fatalities). Fig. 2 also shows that is more probably to produce one hundred fatalities in an explosion in a country of the second group (2.7%) than to produce an accident with the sarne severity in a country of the first group (0.4%). 1,000 0.65

First goup

- 0.44

......Second group

I

>- 0,100

?

u

'. .

53

s

E

'.._.

5 w

-

0.02

3

5

0,010

0,001

1

10

100

1.000

10.000

N

Fig. 2. f-N curves for accidents in diferent countries

1353

The biggest accident reported by MHIDAS corresponding to the first group was in Cleveland (Ohio, USA) in 1944, and produced 131 fatalities. For the second group, the most serious accident occurred in San Juanico (Mexico) in 1984, with 500 fatalities. 4. EVOLUTION OF THE SEVERITY OF THE ACCIDENTS

In Fig. 3 it is possible to see two f-N curves. The first one include all the accidents occurred in Europe, USA, Japan or Australia (Fisrt group) before 1983. The second one include the accidents occurred in the same countries from 1983 until today. In this case, there is a small difference in the probability of producing one or more fatalities between both curves, but there is a big difference in the severity of the biggest accidents. 1,000

> 0,100

m

0

3 (L

9

55

0,010

0,001 1

10

100

1.000

1o.ooo

N

Fig. 3. Curves f-N for accidents occurred before 1983 or later.

1354

5. CONCLUSION

When using historical accident data in a statistical manner, some errors may be introduced because estimations are too rough or there are too little data. Nevertheless, when use a big number of references, the results could be better. The method described here is useful to obtain a first approximation to a consequence analysis and to validate the policies in risk prevention. We have presented only two results comparing the severity of the explosions with flammable gases in two groups of countries or in two periods of time. If the codified information available about the accidents improves in the next years (MARS probably will be a very good instrument for this) the results using this curves will be better and more detailed. REFERENCES [ l ] Vilchez, J.A., Sevilla, S., Montiel, H., Casal, J., Historical analysis of accidents in chemical plants and in the transportation of hazardous materials, J. Loss Prev. Process Ind., 8 (1995), 87-96 [2]E.M. Lenoir, J.A. Davenport, A Survey of Vapor Cloud Explosions: Second Update, Process Safety Progress, 12 (1993), 12-33 [3]Marsh-McLennan Protection Consultants, “Large Property Damage Losses in the Hydrocarbon-Chemical Industries. A Thirty-year Review”, Mahoney D., 16th edition, USA, 1995. [4]R. Prugh, Improved f-N Graph Presentation and criteria , J. Loss Prev. Process Ind., 5 (1992), 239-247. [5]Guidelines for chemical process quantitative risk analysis, CCPS-AIChe, 1989 [6]V.C. Marshall, How Lethal are explosions and toxic escapes?, The Chemical Engineer, August 1977,573-577.

1355

Risk management in land use planning Fredrik Nystedt 0resund Safety Advisers, P.0 Box 82, SE-20120 Malmo, Sweden, E-mail [email protected], Internet http://www.oresundsafety.se

1.

INTRODUCTION

Land use planning aims at designing the future society by deciding how land and water should be used and how towns should be developed. The potential hazards in society are continuously increasing as a consequence of the rapid technical development. These hazards could lead to accidents that affect the life quality of both the individual and the society as a whole. In order to control these potential hazards, risk management should be an integrated and natural part of the land use planning process. In the CPQRA [l] risk is defined as a measure of economic loss or human injury in terms of both the likelihood and the magnitude of the loss or injury. The IEC defines risk as a combination of the frequency, or probability, of occurrence and the consequence of a specified hazardous event [2]. Note that the concept of risk always has two elements: the frequency or probability with which a hazardous event is expected to occur and the consequences of the hazardous event. Risk consideration in land use planning has traditionally involved the use of prescriptive rules based on distance from the hazardous activity. In Sweden, buildings are e.g. not allowed within 100 m from a dangerous goods route according to these rules. This approach generates a few problems. Distance rules do not consider the actual risk and generates an uncertainty on the achieved safety level. As no other risk reducing measure, than the distance, is considered, some important areas in the vicinity of a hazardous activity could be left unexploited. There is on ongoing trend in the society that transforms perspective regulations into performance-based ones. The performance-based regulations focus on the aim and purpose, instead of giving detailed information to the user. In land use planning there is a need for such a performance-based risk assessment model, which could add more flexibility to the process.

1356

2.

THE RISK ASSESSMENT MODEL

A modern risk assessment model uses a probabilistic approach where the likelihood of possible accidents is estimated. This combined with assessments on the consequences involved makes it possible to calculate the risk at a certain distance from the hazard. When evaluating the risk, acceptance criteria and fundamental risk evaluation principles on proportionality, reasonableness, distribution and avoiding catastrophes should be taken into account. Terms such as ALARP (As Low As Reasonably Practicable) and ALARA (As Low As Reasonable Achievable) are frequently used when discussing risk reduction. There are a number of requirements on a probabilistic risk assessment. The assessment should be based on reality-based frequencies, uncertainties should be treated, the evaluation must fulfill acceptance criteria as well as fundamental principles and the quality of the assessment must be assured.

2.1. Risk assessment process The risk assessment process consists of five activities. First, all hazards are identified. Second, possible scenarios and related frequencies are estimated by the use of well-known risk analysis tools, e.g. event tree analysis or fault tree analysis. Third, the consequence for each scenario is calculated by the use of either computer models or analytical expressions. Fourth, the risk measures e.g. individual and society risk are presented and evaluated. The final, fifth activity involves the development and incorporation of risk reduction measures. 2.2. Risk measures and risk evaluation criteria

Risk can be expressed as individual risk or as societal risk. These are the two most frequently used risk measures. Individual risk measures consider the risk to an individual who may be at any point in the effect zones of incidents, while societal risk measures consider the risk to populations that are in the effect zones of incidents. Risk can be evaluated and risk criteria established using four different principles [3]. The principle of reasonableness says that an activity should not involve risks that by reasonable means could be avoided. Risks that by technically and economically reasonable means could be eliminated or reduced are always taken care of, irrespective of the actual risk level. The principle ofproportionality means that the total risk that an activity involves should not be disproportionate to its benefits. By using the principle of distribution, risks should be legitimately distributed in society, related to the benefits of the activity involved. Single

1357

persons should not be exposed to disproportionate risk in comparison with the advantage that the activity affords them. The principle of avoiding catastrophes says that it is better that risks are realized in accidents with a lower number of fatalities. When discussing risk reduction, terms such as ALARP (As Low As Reasonably Practicable) and A U R A (As Low As Reasonable Achievable) are frequently used. The acceptable risk can be defined as limit lines in the FN diagram. Risks that are below the lower line are tolerated and they do not have to be reduced. Risks in the zone between the two lines are in the acceptable ALARP area. Risks in this zone should be reduced if it is practicable and does not involve disproportionate costs. Risks that are above the upper line are not acceptable and should be subjected to a risk reduction process. In a report commissioned by the Swedish Rescues Services Agency, A proposal for acceptable societal risk criteria to be used when putting assessment against criteria in a risk analysis is given in [3]. The proposal is given as an FW curve, where a gray zone is used to outline risks that could be accepted. The proposal is illustrated Fig. 1. 2.3. Treatment of uncertainties

Traditional risk analyses use point estimates to present the risk. There are mainly two problems associated with this approach. First, it is highly desirable for decision-makers to be aware of the full range of possible risks in order to make balanced decisions. Second, point risk estimates frequently are very conservative as a result of the accumulation of the effects of various conservative assumptions made at intermediate steps in the analysis [4].The consideration and treatment of uncertainties in risk analysis adds considerablyto the credibility of the results, which in this case is a model requirement. One approach to treat uncertainties is to employ Monte Car10 or Latin Hypercube sampling techniques.

Ir

L

&

p

1F02

1503 1E-04

1E-05

1 Lo6 1E07 % 1F08 l 1F09 1E-10

p

$

1

10

100

hrrber of fataliies

Fig. 1. Acceptable societal risk criteria.

1000

10000

1358

3.

CASE STUDY FROM THE 0RESUND REGION

3.1. Scope A probabilistic risk assessment model, as described above, has been developed for land use planning in the 0resund Region. The Oresund Region encompasses Sweden’s Scania and Denmark’s Zealand and has Copenhagen-Malmo as its hub. Within a radius of about 100 km, there are 3.2 million people. With the construction of the fixed link and substantial investment in better communications, the region is a reality. The model has been applied to the establishment of a new urbanity “Scanstad” in Malmo. Scanstad is situated close to the fixed link to Denmark and could be seen as a gateway to the city. The urbanity includes offices, services and housing of different types.

3.2. Hazards and assessment techniques The risk assessment is carried out in order to analyze the risk associated with the nearby traffic route for dangerous goods. Event tree technique is used to derive the scenarios, which includes three different types of releases; toxic gas, inflammable/explosive gas and inflammable liquid. Accidents considered are only those that are direct harmful to people. Events that affect property and the environment are sorted out. Possible outcomes of the selected scenarios are pool fire, jet flame, boiling liquid expanding vapor explosion (BLEVE), unconfined vapor cloud explosion (UVCE) and the release of chlorine gas, sulfur dioxide and ammoniac. The hazard calculation models are based on effective dose, pressure build-up and radiation. The criterion is set to the LCso-value. LC50is defined as the dose where half of the people exposed are dying. It is the assumed that all people inside the LCso-zonedies, and people outside survive [2] . Consequences are calculated with analytical expressions on release and dispersion and Monte Car10 simulations treat uncertainties in e.g. wind speed, release rates, exposure times and atmospherically conditions.

1359

Fig. 2. Risk contours for the individual risk. The ALARP-region is between lo-' -

3.3. Results The risk contours for the individual risk are illustrated in Fig. 2. The societal risk is illustrated in Fig. 3. The risk lies in the ALARP-region and it is therefore necessary to reduce the risk by appropriatemeasures. One reasonable measure to reduce the possible consequence is to install an alarm system that notifies the people when there is a release of toxic gas. FN-kum for Brostadens nWet till Mtre ringegen

a

lo6

I

I

I

I

2

lo8 1oo

10' X, Antalet doda per Ar

1 o2

Fig. 3. FN curve for societal risk and limit lines for the ALARP-region.

1360

3.4. Recommendations As the risk was evaluated towards the acceptable risk criteria the following recommendations could be given. 0

0

0

0

Risk reducing measures need to be undertaken for all establishment at a distance within 800 m from the road. No buildings are allowed closer than 50 m to the road. This is valid unless extreme measures are taken to reduce the impact of the hazards. Office buildings could be allowed on a distance at least 50 m from the road. Emergency control of the ventilation system is then an appropriate risk reducing measure. Residential areas must be placed further away than 200 m from the road. A public notification system is recommended.

By using this performance-based approach instead of the traditional prescriptive one a more balance and flexible use of land has been achieved.

REFERENCES Center for Chemical Process Safety Guidelines for Chemical Process Quantitative Risk Analysis. American Institute of Chemical Engineers, New York, 1989. [2] IEC International standard nr 60300-3-9: Dependability management- Part 3: Application guide- Section 9: Risk analysis of technological systems, International Electro technical Commission, 1995. [3] Raddningsverket, Vardering av risk, Karlstad, 1997 (In Swedish). [4] S.E. Magnusson, Uncertainty Analysis: identification, quantification and propagation, Report 7002, Dept. of Fire Safety Eng., Lund University, Lund, 1997. [ 11

1361

Management support for SEVESO I1 safety demonstration Louis H.J. Goossens" ,Brigitte H.J. Hemingband Linda J. Bellamy" "Safety Science Group, Delft University of Technology, P.O. Box 5015,2600 GA Delft, The Netherlands b

Arbo-Unie, P.O. Box 1079, NL-3180 AB Rozenburg, The Netherlands

"SAVE Consulting Scientists, Deventerstraat 37, NL-73 11 LT Apeldoorn, The Netherlands

Abstract

The SEVESO I1 Council Directive requires periodical inspections of the major hazards establishments by the competent authorities. For the high tier establishments a safety report is mandatory which will serve as the base for inspections. For the lower tier establishments safety reporting is not required and written documentation might be less available. The Council Directive requires at least a Major-accident prevention policy document and a Notification describing the inventory of hazardous chemicals. The Council Directive also requires these establishments to demonstrate to the authorities that they have a Safety Management System (SMS), which should address the following issues: organisation and personnel, identification and evaluation of major hazards, operational control, management of change, planning for emergencies, monitoring performance, and audit and review. The paper describes the benefits of the NIVRIM lower tier inspection tool which is originally developed to assist the inspection team of the competent authorities to identify whether establishments comply with the above-mentioned SEVESO 11-requirements.For that reason, NIVRIM can also serve to assist establishments with the relevant elements for the demonstration of a working safety management system. NIVRIM is initiated by the Dutch Labour Inspectorate services of the Ministry of Social Affairs and Employment and has a cascade approach consisting of six steps: 1) insight in major hazards risks, 2) the major accident prevention policy document, 3) logic link between risks and policy document, 4) the safety management system, 5) quality of SMS and feed back loops, 6) official report.

1362

For assistance of establishments, steps 2 through 5 contain check points which are directly usable for the SEVESO I1 requirement to demonstrate that the SMS works. The paper will review these check points in the light of this demonstration requirement.

1. BACKGROUNDS OF THE NIVRIM INSPECTION TOOL The SEVESO I1 Council Directive requires periodical inspections of the major hazards establishments by the authorities. For the high tier establishments a safety report is mandatory which will serve as the base for inspections. For the lower tier establishments safety reporting is not required and written documentation might be less available. The Council Directive requires at least a Major-accident prevention policy document and a Notification describing the inventory of hazardous chemicals. The Council Directive also requires these establishments to demonstrate to the authorities that they have a Safety Management System (SMS). Most establishments will have additional written material, like procedures and organograms. The EU-directive 96/82/EC is implemented in the Dutch Decree on Risks of Major Hazards 1999 (Brzo ’99), on which the NIVRIM inspection tool [I] is based. NIVRIM is a Dutch acronym meaning “Not Safety Report Mandatory Inspection Method”. The tool consists of a checklist with attention points which enables the inspection team to check whether the Major-accident prevention policy document complies with the requirements in the Decree. The tool also contains attention points to identify whether the safety management systems implemented by the relevant establishments exist and are adequate for major hazards risk control. The tool is not meant to test a complete safety management system containing elements outside the major hazards scope as well. The safety management system should consist of the following issues laid down in the SEVESO I1 directive: A. organisation and personnel B. identification and evaluation of major hazards C. operational control D. management of change E. planning for emergencies F. monitoring performance G. audit and review. Furthermore, it must be demonstrated (by the establishments) that these issues are part of the total establishment’s management system and that the safety

1363

management system works. For that reason, the NIVRIM tool checks three subsequent features of the safety management system’s issues: whether the issue is present, whether the issue is complete and whether the issue is just. In order to judge the quality of the SMS the AVRIM2-control loop [2] is used as a frame to check whether risk control of major hazards is performed systematically and structured. The AVRIM2-control loop checks whether 0 goals are formulated plans are made available with which the goals can be realised plans are implemented and executed the outcomes of activities are compared with the original plans based on which improvements can be defined improvements are realised the organisation can prove that major hazards risk control is a continuous process with necessary interactions within and from outside the organisation.

2. NIVRIM STRUCTURE FOR DEMONSTRATION PURPOSES The NIVRIM lower tier inspection tool is specifically developed to assist the inspection team of the competent authorities to identify whether establishments comply with the above-mentioned SEVESO 11-requirementsunder the national law. Although NIVRIM has been specifically developed for lower tier establishment, it might as well be used by high tier establishment as a simplified tool to demonstrate the working of the SMS. The demonstration activity can best be prepared by a competent team consisting of staff members responsible for safety, environment and fire protection in the management system. The six steps of NIVRIM are used to prepare the demonstration of the SMS as follows: Step I - A competent team of the establishment prepares the demonstration of the SMS on the basis of the Notification and available documentation (majoraccident prevention policy document, written procedures and so on). Step 1 aims at identifying the risks of major accidents, the identification of relevant written material and of the position of the establishment with respect to the SEVESO IIrequirements. Step 2 - The team checks whether the establishment’s Major accident prevention policy document complies with the requirements in the national laws (like the Dutch Decree Brzo’99) in which the SEVESO 11-Directiveis implemented. The aim is to control the completeness of the document. Step 3 - The team holds a dialogue with the establishment’s managing director to identify whether the establishment has a logic explanation of their majoraccident prevention policy, and why the risks can be best controlled as they do.

1364

The aim of step 3 is to identify the strong and weak spots of the establishment’s safety management system. Step 4 - The team investigates the requirements of the safety management system (the above mentioned seven issues) in greater detail based on the written material and discussions with relevant staff members. Additionally, the team makes a round through the major hazards installations and talks to personnel (operators, maintenance people) to check the effectiveness of the written procedures. The aim of step 4 is to check completeness in greater detail and to justify the effectiveness on the work floor. Step 5 - The team assesses their findings on the quality of the safety management system and formulates recommendations with respect to the weak spots in it. The findings are mapped on the AVRIM2-Control loop (developed for inspections of higher tier establishments) to identify whether the establishment’s approach to safety control is systematic.

Step 6 - The team prepares the demonstration activity for the establishment in cases the competent authority requires a demonstration of their SMS. The rounding up also contains recommendations for further improvement of the SMS. For steps 1,2 and 4 supporting questionnaires are available in the NIVRIM tool, for step 3 a list of attention points is made, and for step 5 the AVRIM2-loop is mapped on the questions of step 4.

3. STEP 1 - PREPARATION OF DEMONSTRATION The goal of step 1 is to get insight into the technical aspects of the major hazards risks, into the characteristics of the establishment and their safety management system. The team identifies which hazardous materials put the establishment under the SEVESO 11-Directive, and which risks can be expected. The team will evaluate the presence and size of the risk. Furthermore, they make a first orientation on the safety management system. Available information sources are: the notification, the licence, and any available establishment documents (such as safety handbooks, procedures, risk assessments, internal emergency plans, results of audits and so on). It has been recognised that checking documents is a necessity prior to the preparation of the demonstration, as lack of background material might hamper tremendously. In step 1 the following attention points are addressed: 1. Diversity of the establishment with respect to hazardous materials 2. Type of activities: storage, batch or continuous processes, (un)loading

1365

3. Categorisation of the establishment: one hazardous material - one activity, a variety of hazardous chemicals - one activity, production processes and other activities, mixed company, primary activity is not hazardous (additional means do, like ammonia cooling machines) 4. Amounts of hazardous materials compared to the lower tier and safety report requirements 5. Size of the terrain compared to potential accidents (also to identify potential domino-effects) 6 . Number of exposed persons within and outside the establishment for the ‘worst-case’ scenario 7. Size of the potential consequences 8. Background factors or circumstances driving the scenarios of major hazards risks, such as corrosion, erosion, operator errors, side reactions, external factors (e.g ., weather, flooding) 9. Potential effects in cases of loss of containment: fire, explosion, gas cloud 10.Age of the site 11.Age of the installation. 4. STEP 2 - CONTROL OF MAJOR ACCIDENT PREVENTION POLICY DOCUMENT The goal of step 2 is to check whether the document is presendavailable and whether it is complete. The document will be checked concerning the following points: 0 Policy goals to prevent major hazards accidents 0 Tasks, responsibilities and authority to execute prevention plans 0 Criteria to evaluate major hazards risks 0 Available means 0 Implementation of plans in concrete plans 0 Implementation and evaluation of prevention policies 0 Communication structure. Examples of questions, e.g. for the control of the policy principles are: Does the establishment have measurable main goals and principles to prevent and mitigate major accidents? Has been described who is responsible in the organisation for the realisation of the policy to prevent and mitigate major accidents? Has been described which means are available for the realisation of the policy to prevent and mitigate major accidents? Does it show commitment of the management?

1366

The quality of the Major accident prevention policy document is rated on a three-point-scale: Bad - General goals are written in the document, but they are not measurable and it is unclear who is responsible for the realisation of the safety policies. Reasonable - The document ‘hits’ most issues mentioned in the NIVRIMchecklist. In general terms, goals and principles of the prevention policy are described, the translation in concrete safety goals and plans are given for various parts of the organisation. Criteria for the evaluation of major hazards risks are provided. Also responsibilities within the establishment are clear. However, the document does not address sufficiently the available means, implementation and evaluation of policies, and the way in which policies are communicated with personnel involved in prevention policies. Good - The document contains all elements mentioned in the NIVRIM checklist of step 2.

STEP 3 - DISCUSSION WITH THE ESTABLISHMENT’S MANAGING DIRECTOR Commitment of the establishment’s management has been identified as a major concern for major hazards prevention policies and its implementation. The goal of step 3 is to get an overall picture of the major hazards prevention policy and the quality of the safety management system, in general. The discussion should lead to answers of the following questions. If the major hazards prevention policy document is present: why is it written as it is now, regarding the establishment’s major hazards risks, and how is the document related to the current safety management system? If, in any case, the major hazards prevention policy document is absent: why is it not written down, which prevention policy is implemented instead and how is that related to the current safety management system? Issues to be addressed are: Nature of the risks Mitigation measures already taken to control risks Layout of the safety management system: backgrounds, organisational structure, responsibilities, procedures, available means, communication structure, education and training, policy concerning contractors Relation with general management system Interaction with other parts of the management system (environment, occupational safety, quality and major hazards).

1367

This step should show sufficiently whether management is aware of their major hazards and whether they are fully aware of how to control these risks appropriately. There needs to be general knowledge of the mitigation measures taken and of the way in which the safety management system addresses these risks.

6. STEP 4 - CONTROL OF SAFETY MANAGEMENT SYSTEM This step is a crucial part where the functioning of the safety management system is checked in greater detail. In this step the team checks the SMS with respect to its presence, completeness and its justness at the workshop floors. The team will hold discussions with relevant staff members and production plant managers responsible for parts of the SMS, and verifies their findings by talking to personnel at the shop floor level. In this step the SMS is split into the seven issues mentioned earlier in section 1. For each issue, NIVRIM has a checklist with questions for which the presence, completeness and justness can be marked on a four-point scale indicating respectively: absent, weak, reasonable, and present. A four-point-scale is chosen in order to distinguish between above and under the average situation, as an average score might often be the result when using a three-point-scale. Each issue of the SMS is evaluated in total again using a similar four-pointscale: Absent: no systematic approach Weak: systematic approach weakly developed Reasonable: systematic approach available and more or less complete, execution could be improved Present: systematic approach is present, complete and justified at the workshop floor. For one of the seven issues an example is given in Table 1: organisation and personnel. The SEVESO 11-Directive requires to be clear on the tasks and responsibilities of the personnel involved with major hazards control at all levels in the establishment to be clear on the recognition of needs for training of personnel, and to be clear on the organisation of training and participation of personnel, contractors and sub-contractors. The structure of the safety organisation including the organisation of the establishment fire brigade, must be accomplished from the highest level in the establishment to the workshop floor level. The following elements need to be available:

1368

Checklist 1. Are tasks, responsibilities and authority of own personnel (at all levels in the organisation), involved with major accident risk control documented, for each phase of the life cycle? Desigdchanges 1 Normal operation a Maintenance during normal operation Maintenance during ‘stops’ 2. Are tasks, responsibilities and authority of personnel of &ird parties (contractors); involved with major accident risk control documented? 3. Is the communication and supply of information on major accident risk control organised (e.g. safety committees, safety top - representatives, management c o wtment)? 4. Are reauirements formulated for own Dersonnel regard&g major accident risk control (knowledge and skills, training and education)? 5 . Are requirements formulated for third party personnel regarding major accident risk control (knowledge and skills, training and education)? 6. Are training and educational programs available for own personnel, in which major accident risk control is explicitly dealt with? 7. Is there an alert mechanism that responds to external signals which might influence the organisation and demands on the personnel? 8. Are there checks whether own personnel (or third party personnel) complies with the requirements formulated for major accident risk control? 9. Does daily work comply with the division of tasks, responsibilities and authority? 10.Do communication and supply of information take place according to the established structures?

Table 1. Checklist for issue: organisation and personnel. P=present, C=complete, J=just. -- means absent, - means weak, -/+ means reasonable, + means present. organisational structure, e.g., as an organogram functions, responsibilities, authority with respect to major hazards risks for all personnel carrying out work which might influence safety

1369

0

the communication structure with respect to safety the interaction between the various phases of the life cycle: design, construction, operations and maintenance and the way in which the organisation handles that training and education of personnel and (sub)-contractors for major hazards prevention.

The team fills in the three right columns of the checklist using the four-pointscale mentioned earlier for each column (see notation in table 1). The first two columns by talking to staff and department managers, the last column by talking to personnel at the workshop level. Each issue checklist will be evaluated using the four-point-scale.For the issue in table 1, the results could be 0

0

0

0

Absent: Safety organisation is not available. The structure of the safety organisation is unclear; tasks, responsibilities and authorities are not fixed; there is no communication on safety matters and the provision of information lacks. Weak: Safety organisation is present, but not complete. It is clear who is involved in the organisation of safety. The tasks, responsibilities and authorities are fixed in an overall sense. Communication on safety matters takes place if there is a reason for it. Reasonable: Safety organisation is more or less complete, but the implementation could be improved. The structure of the organisation of safety is clear. Tasks, responsibilities and authorities are fixed. The communication structure is clear. However, working under the fixed structures lacks. Present: Safety organisation is present, complete and just. The structure of the organisation of safety is clear. Tasks, responsibilities and authorities are fixed. Communication on major hazards risks is treated systematically.There is a training and educational program adapted to the needs for present risks. The training program is evaluated constantly and adjusted to new needs.

7. STEP 5 - ASSESSMENT OF FINDINGS

This step is an important part of the check as in here all bits and pieces collected during the previous steps, are put together in order to get a quality picture of the functioning of the safety management system. In the major hazards policy of the Dutch Ministry of Social Affairs and Employment a dedicated management and control loop is developed, originally for the establishments with mandatory occupational safety reporting. The loop is known as the AVRIM2-loop [2]. Although advanced safety management systems models are currently available [3], the AVRIM2-loop might be sufficient for overall demonstration of the working of a SMS without going into too many details. Although the number of

1370

questions of the NIVRIM checklist of step 4 is much smaller than applied in the AVRIM24nspection tool, the loop can be very well used to check the adequacy of the safety management system of both lower and high tier establishments. The loop, shown in figure 1, consists of 15 elements and relations. The loop has three major compartments of which NIVRIM concentrates on the middle compartment: installation management. The middle compartment consists of three levels: human reliability, communication, control and feedback, and organisation and standards. NIVRIM checks the way external factors influence the organisation, but does not check the external factors itself. The same is true with the hardware reliability. The control of the team does not address that part of the safety assessment, but it checks the relation with human reliability and feedback. Table 2 shows a matrix in which the various questions of the seven checklists of the inspection in step 4 are mapped on the 15 elements and relations of the management and control loop in the left column. The matrix shows two rows: the upper row contains the 15 elements and relations of the loop in figure 1, the lower row contains the number of questions in the checklists of the seven issues together. If all questions are asked in the team’s control round, the matrix provides a good input to an overall assessment of the safety management system of the establishment. In many cases, not all questions will be asked, but if the questions are spread over the loop it does create a sound base for an assessment. It is, however, important that the control is not restricted to checking the presence and completeness only, verification of the justness is very important.

Table 2. Number of questions of the seven checklists of step 4 (lower row) for each element and relation of the management and control loop of figure 1

8. STEP 6 - PREPARATION FOR DEMONSTRATION The results of the control exercise will be used for final preparation of the requirement to demonstrate the functioning of the safety management system. Any deficiencies found during the control round will be documented and recommendations for further improvements can be issued to the relevant establishment’s manager and departments.

1371

Figure 1 Management and control loop [2]

1372

9. DISCUSSION The NIVRIM tool has originally been developed for the Dutch Ministry of Social Affairs and Employment for use as an inspection tool for lower tier establishments under the SEVESO 11-Directive. The contents of the tool are structured such that it also contributes largely to the preparation of the reuirement of demonstrating the functioning of the safety management system by an establishment. Due to its simplicity, it is not only relevant for lower tier establishments but is also useful for high tier establishments (with mandatory safety reporting). During the development of the original tool, NIVRIM is used in a test exercise with a (high tier) chemical company in the Netherlands. During that test exercise the inspection team was broad involving inspectors of the environmental inspection and fire inspection next to the labour inspection. For that reason, the questions are adjusted to a broad inspection team. The use of NIVRIM in the test exercise was well received by all parties, and it has shown its usefulness in inspections by the competent authorities. A point of concern might be the lack of control of the technical hardware during the preparation of the demonstration round. The development of NIVRIM was explicitly aimed at not taking technical controls into account. It is however recommended to accommodate to some extent for this concern. In any case, in step 1 a few questions are inserted to check the basic causes of potential major accidents (e.g., corrosion). The control team always has the opportunity, if deemed necessary, to dig deeper in the hardware safety. It may also investigate level 1 (containment reliability) of the management and control loop presented in figure 1.

REFERENCES [ 11 B.H.J. Heming, L.H.J. Goossens and L.J. Bellamy, NIVRIM - Een inspectiemethode voor niet veiligheidsrapportplichtige bedrijven in het kader van het Brzo 1999 - Checklist en

toelichting, Ministerie van SoZaWe, Den Haag, 1999, nr. 136 (in Dutch)

[2] SAVE, AVRIM2 version 1.0, Den Haag, Ministry of Social Affairs and Employment, The Hague, the Netherlands, 1996 [3] Hale, A.R., Baram, M. (eds). Safety Management: the challenge of change. Pergamon, London, 1996

1373

Impact of the Czech SEVESO I1 Directive on Industry F. Babinec a and A. Bernatikb ”Brno University of Technology, Faculty of Mechanical Engineering, Technicka 2,6 16 69 Brno, Czech Republic, P:[email protected] bRegionalCenter EIA, ChelEickCho 4,701 00 Ostrava , Czech Republic, P [email protected] 1. INTRODUCTION The Czech SEVESO I1 Directive “On Major Hazard Accident Prevention...” entered into force on January 21, 2000. Czech Ministry of Interior and later Ministry of Environment were preparing the directive from 1992 and during this time some problems appeared. The main problem is the absence of the Council Directive 82/501/EEC - Seveso (I) in Czech legislation, and therefore deficient sense of necessity of prevention. Czech SEVESO I1 Directive is hannonised, but executive regulations are not so perfect as original. Specific features of Czech Seveso I1 Directive: general obligations of the operator concern both juristic and physical person, mandatory insurance after safety report / program acceptance for establishments of A and B category, preliminary risk assessment for the purpose of notification.

..

.

It seems, that Czech SEVESO I1 is stricter than original SEVESO I1 Directive. The implementation of SEVESO I1 is for most of the Czech chemical establishments really significant step. For many companies the law presents aprofound change in safety securing and risk management. The principle of accident prevention lies in the background of the directive being prepared. Some specific problems of Czech SEVESO I1 Directive identified in the duration of the implementation are: 0

Czech Directive No. 157/1998 ,“On chemical substances and chemical preparations” is not totally compatible with Czech Directive No.353 (Table 11, Selected Properties of hazardous substances), there is tendency to apply unified approach to hazardous substance classification,

1374

0

executive Regulation No.8/2000 (Preliminary Risk Assessment for the notification) is derived from IAEA-TECDOC-727 method; the derived method is too simplified and does not accept assumptions (mainly for toxic substances classification), results are very different and method is more rigorous than original.

2. SOURCES OF INFORMATION

Work on the proposition of the Czech directive started as early as in 1992. Source of information was the Directive 82/501/EEC - SEVESO ,,On the major hazard accident of certain industrial activities" amended by Directives 87/216/EEC and 88/610/EEC. This directive is concerned with the prevention of major accidents which might result from certain industrial activities and with the limitation of their consequences for man and environment. Regulation OSHA 1910.119 - ,,Process Safety Management of Highly Hazardous Chemicals" was also a valuable source of information. Experience from the newer Directive 96/82/EC - SEVESO I1 ,,On the control of major accident hazards involving dangerous substances" has been used in the course of preparation. The work on the final design of the directive continued in 1999. The final version includes also the change of the directive on district offices "On prevention of major accidents involving dangerous substances", and changes in directive "On district offices". 3. THE IMPACT OF THE TIME DELAY

Seveso directive was introduced in EU countries in 1982. The main idea of the directive is the necessity of industrial accidents prevention, above all after accidents at Flixborough Works of Nypro Limited (1974) and Seveso - Icmesa Chemical Company (1976). Relatively significant was also accident in Chemopetrol Litvinov (Czech Republic) in 1974. All of these accidents had a significant impact on public perception and the chemical engineering profession (new emphasis and standards in the practice of safety). Directive SEVESO was introduced in 1982, Czech directive was prepared from 1992 and entered into force on January 2000. The influence of the time delay is very significant. Thanks to long-term activity and education in EU, the prevention has been accepted by industrial companies, which is necessary for the implementation. This phase cannot be skipped and it will be very difficult to reduce it.

1375

4. BASIC PARTS OF CZECH DIRECTIVE

0

0

0

0

Basic Appointment - aim, definitions, exclusions General Appointment - major accident prevention policy - insurance General Obligations of the Operator - major accident risk assessment (modified IAEA-TECDOC-727 method) - establishment classification ( A or B category of establishment) - safety program (for B category). safety report ( for A category) - updating Emergency Plans - internal emergency plan - external emergency plan Public Participation - discussion on safety program and safety report - information on safety measures - Information to be supplied in case of accident Competent Authority - ministry of environment, Department of Home Affairs - technical inspection - district office, hygiene, etc. Penalties

5. GENERAL OBLIGATIONS OF THE OPERATOR The operator of the establishment is obliged : - to notify classification of establishment to group A or B - to assess risk of a major accident - to produce a safety program ( for class A) - to produce a safety report (for class B) The classification of the activity or installation to group A or B in dependence on type and amount of substances is a relatively new obligation of the operator. The time-sequence of obligations : 9 send a notification within prescribed limit to the competent authority July 29,2000 > produce a safety report January 29,2002 (for the new establishment - prior to start construction) 9 after safety report acceptance, mandatory insurance 100 days after acceptance 9 notify internal emergency plan January 29,2002 > information for external emergency plan January 29,2002

1376

5.1 Governmental Regulation No. 291998 This regulation “Classification of chemical substances and chemical preparations” introduces “List of classified hazardous substances”. 0

0

Every chemical substance or preparations should be classified (a significant step- it is necessary to check it), if one substance has more hazardous properties, the worst property from the quantity limit point of view decides.

5.2 Directive No.157/1998 Sb., “On chemical substances and preparations” This directive introduces categories of dangerous substances as very toxic, toxic, oxidizing, explosive, flammable, highly flammable, extremely flammable, etc. The category “highly flammable liquid” is not introduced in directive No. 157, however directive No.353 uses this category (and original SEVESO I1 Directive too). Practically it means, that every highly flammable substance belongs to “highly flammable” category, which represents a very low quantity limit. Consequences of such categorisation are able influence the classification of establishment to group A or B. The original SEVESO I1 Directive has simple algorithm /notes in Annex I, part 2. Especially Note 3 explains flammable, highly flammable (liquids) and extremely flammable categories. 5.3 Regulation No. 8/2000 .,“Principles of Risk Assessment “ The executive regulation No.8/2000 introduces Major Accident Risk Assessment for the Notification. The method prescribed here is evidently derived from IAEA-TECDOC-727 method; the prescribed method is too simplified and it uses only substance categories from directive No. 157 (for toxic substances : toxic, very toxic).

Authors of the IAEA-TECDOC-727 method call attention on assumptions of the original method (mainly 5 classes for toxic substances are needed - low, medium, high, very high and extreme toxicity ). The derived method does not accept assumptions; results significantly differ from the original method, distance category and affected area category are significantly large (order differences of magnitude). Next problem uncovered in duration of the first step implementation is substance classification. The original IAEA-TECDOC-727 uses special classification introduced in guidelines. Special classification is needed because of predicate possibilities of knowledge based models.

1377

The derived method applied in Czech SEVESO I1 Directive uses unified approach used in Directive No. 157/1998, “On chemical substances and preparations” and used for establishment categorisation. Practically it unfortunately means that benzene and ammonia are substances with the same class of toxicity. Results of such a risk assessment are nonacceptable, toxicity of such substances is quite different. Risk assessment for toxic substances is more rigorous than the original results. Documentation of such unrealistic risk estimations seems to be irresponsible.

6. SAFETY REPORT The operator of the installation or equipment is obliged to work out the safety report and follow it, if the installation or equipment belongs to group B. The operator produces a s f e t y report for the purposes of : - the description of the program - the description and the geographical location of the installation or equipment - the description of the installation or equipment - the detailed assessment of major accident risk - the detailed description of safety precautions - the detailed description of protective and operation measures that decrease results of a major accident The operator of the installation or equipment is obliged to submit the program of the safety report to control.

7. SAFETY ANALYSIS/STUDIES Many analyses and studies will have to be made in order to work out the program of the safety report. Safety studies are results of a work of a team of specialists and the results testify to the specialists only (specific methods and results are involved)[9]. List of methods widely used for hazard identification and risk assessment is known. Unfortunately, there is no universal method (panacea) for all problems to be solved. However, there is the following problem - the selection of the method appropriate for aspecific task. A generic methods should be used for a basic screening of the hazards. The detailed systematic methods should be used for a risk sources identified using screening methods. Another question is the authorisation of safety reports. In Czech directive, a significant role in the executive of Civil Service is assigned to district offices, where there are not experts for this area.

1378

8. CONCLUSION Legislative in the area of prevention of serious disasters in the Czech Republic was introduced much later than in the EU countries. The detailed workout of the SEVESO directives I and I1 and the EU countries’ experience with the directives suggest that the introduction of the new directive is problematic matter : the perception of the prevention principle is burdened by the interval between the Czech directive and the original SEVESO 82/501/EEC directive, there is a significant terminological variety - intuitive interpretations of the basic terms : hazard, risk (i.e. risk of occurrence), safety studies and safety reports are a relatively new reality,

.

.

. .

.

the realisation of adaptations necessary for higher safety may be costly, it is necessary to guarantee education in the field of danger identification and hazard evaluation for the supervisors.

These institutions are accredited with the execution of the state administration : Czech Ministry of Environment, Czech Inspection of Environment, Inspection of Work Safety, State Fire Supervisors, Czech Mining Office, chief health officer and district offices. Some specific problems of Czech SEVESO I1 Directive identified in the duration of the implementation are:

>

Czech Directive No.157/1998, “On chemical substances and chemical preparations” is not totally compatible with Czech Directive No.353 (Table 11, Selected Properties of hazardous substances), existing incompatibility of directives No.353 and No.157 should be extracted,

P executive regulation No.8/2000 (Preliminary Risk Assessment for the

notification) is derived fiom IAEA-TECDOC-727 method; the derived method is simplified and does not accept assumptions (mainly for toxic substances classification), results are very different and method is more rigorous than original, prescribed method for societal risk assessment (in executive regulation No.8/2000) should be substituted by the original IAEATECDOC-727 method.

The approach of the companies for the implementation of the directive is varied. Some companies proceeded to the realisation of safety studies (identification of hazard sources and also quantitative evaluation of the level of hazard) a few years ago, with arational idea of the analysis being timedemanding.

1379

Concerning the fact that the directive presents an innovation for the industrial companies, that experience with implementation is minimal and the level of knowledge in the area of modern safety engineering is still low, it is necessary to count on troubles and complications while exercising the directive. Education of the supervisors and of the responsible persons in industry may be now considered a necessary step in support of the prevention directive. The conception of the Czech directive is different in comparison with the SEVESO I1 directive. The directive determines the aims, but the means of achievement are not obligatory. The directive has its specifications. The domain of the state administration execution in the field of disastrous accident prevention together with the proposed fines and fees seem to be rather repressive. Positive experience is that some great company understood this approach and they gradually perform risk analysis. Method HAZOP is the most popular for hazard identification of particular equipment. From other side some industrial region have also responsible approach and perform screening study of risk sources in their area mainly by method IAEA 727 TEC-DOC.

REFERENCES [ 11 Czech Directive No.353/1999," On the control of major accident hazards involving dangerous substances and on the changes in district offices", vol. 111, 1999. p.7609. [2] Directive 82/501/EEC - SEVESO ,,On the major-accident hazards of certain industrial activities", 1982. [3] Czech Directive No. 157/1998, On chemical substances and chemical preparations, vol. 54, 1998, p.9715. [4] Regulation No.8/2000, Principles of the Major Accident Risk Assessment Digest No.8/2000, vol. 3, p.75. [5] Directive OSHA 1910.119 - ,,Process Safety Management of Highly Hazardous Chemicals", June, 1992. [6] Directive 96/82/EC - SEVESO I1 ,,On the control of major accident hazards involving dangerous substances", 1997. [7] Manual for the classification and prioritisation of risks due to major accidents in process and related industries, International Atomic Energy Agency, IAEA TECDOC - 727, Austria, 1993,60 p. [8] Regulation No.25/1998 Sb., Hazard substances classification. List of hazardous substances. Digest No. 25/1999 Sb., vol. 1, p.11. [9] CROWL,A.D.,LOUVAR,J.F.:Chemical Process Safety Fundamentals with Applications. PTR Prentice Hall, New Jersey, 1990. [ 101 LEES,F.P.: Loss Prevention in the Process Industries.. Buttenvorths Heinemann, Second Edition, London, 1996.

This Page Intentionally Left Blank

1381

Safety Management Systems in application of the Seveso I1 Directive - Lessons learnt from implementation in SMEs 0. Salvi, I. Vuidart, M. Caumont, F. Prats Institut National de 1’Environnement Industriel et des Risques (INERIS), Parc Technologique Alata, BP 2, F-60550 Verneuil-en-Halatte, France

Abstract The Council Directive 96/82/EC of 9 December 1996 on the control of majoraccident hazards involving dangerous substances, known as Seveso I1 directive, requires that the operators of hazardous establishments must demonstrate that they have assessed their major risks and are managing them throughout a Major Accident Prevention Policy (MAPP) and a Safety Management System (SMS). Because of the diminution of the threshold quantities in the Seveso I1 directive, a lot of establishments that were not covered by the first version of the directive must apply the requirements of the second directive. In particular, a lot of small and medium size enterprises (SMEs) that were not prepared to implement a SMS are concerned. The paper describes first the characteristics of the SMEs which are important for the implementation of a SMS: for example the small number of employees, the difficulties to access to the new developments in technology and regulations, the multiplicity of roles for the managers.. . Then, the authors present the lessons learnt from interviews with safety managers and plant managers of SMEs and describe the difficulties they apprehend for the implementation of SMS, and give some advice to overcome the weakness of SMEs. Finally, some proposal are made to facilitate the implementation of SMS. 1. CONTEXT

In order to anticipate the implementation of safety management systems (SMS) in the fiamework of the application of the Seveso I1 Directive, a working group was built at INERIS. Objectives were on the one hand, to measure the industrialists’ level of information of concerned by the directive, and on the other hand, to highlight the difficulties related to the implementation of a SMS.

1382

The overall objective was then to identify the needs in terms of tools, methodologies, information set to facilitate the implementation of the directive. To be able to obtain the manufacturers co-operation, the working group has elaborated with Ref. 1 a manual with slides that were going to serve as support to the study. Also, this manual presents : Observations and objectives related to SMS implementation, A presentation of the contents of the Seveso I1 Directive, A brief description of the documents they have and that could be part of a safety management system based on a Plan, Do, Check, Act (PDCA) model. The manual of slides has allowed us to meet industrialists and to expose the requirement of the directive to them. These interviews have allowed us to perceive difficulties that apprehend manufacturers, notably SMEs, for the application of the directive, in particular the definition of a Major Accident Prevention Policy (MAPP) and a Safety Management System (SMS). The working group then launched the enquiry and contacted some industrialists M F U S is working with. Finally, the results of the described inquiry provided us with a better knowledge of the terrain and to reveal the difficulties foreseen by industrialist in the implementation of safety management systems in compliance with the objectives of the Seveso I1 directive. The main results of the study are presented hereunder. 2. SYNTHESIS OF THE RESULTS CONCERNING DIFFICULTIES APPREHENDED BY INDUSTRIALISTS

The experience resulting from discussions with SME’s operators revealed some elements that make the SMS implementation in the fi-amework of the directive Seveso I1 difficult. Thus, the following observations have been made : 0 The implementation of SMS is, for most SMEs, a regulatory constraint, generating a supplementary work cost ; 0 Available human resources for the implementation and the hctioning of the SMS seem often insufficient ; 0 It often seems to be difficult to keep oneself up-to-date about regulation and normative requirements, notably at the level of SMEs ; 0 Industrialists have difficulties to apprehend major hazards of the enterprise, and to use risk analysis and management methods ; 0 There exists often many documents or an oral safety culture but the formalisation and the integration in a SMS seems often to be difficult ;

1383

The implementation of a SMS has often a great financial impact for SMES ; The perception of what is a SMS is not evident, neither the manner to make it working ; Enterprises have the quality reflex, sometimes health and safety but not major risk prevention ; Enterprises having a quality system (like I S 0 9000) wish to integrate the SMS, but the persons in charge of the quality system have not always a major accident prevention culture. This quick overview shows that difficulties on the terrain are real and that they result in many factors that can be regrouped in four categories: 0 Difficulties of perception of major risk ; 0 Difficulties linked to the regulation ; 0 Structural difficulties specific for SME's ; 0 Difficulties of SMS appropriation. The following sub-chapters develop the origins of the difficulties mentioned above. In each paragraph, possible solutions are proposed. 2.1. Difficulties concerning the perception of major hazards If the safety at the working place is relatively well integrated in enterprises, it is not the same for the prevention of major hazards. For a long time, the notion of protection of the worker linked to the application of the work regulations is part of the safety preoccupations in the enterprise, and this under the pressure of actors such as unions and competent services of the State (Work inspection). The notion of major risk, however, is not often well assimilated among workers. The probability of occurrence of a major accident is low compared to an accident at the work place. Thereby, the major risk is occulted because it is not well perceived. Moreover, the perception of major risk is more difficult, because industrialists don't use easily risk analysis methods. These methods allow, by studying the installations, to identify potential hazards and to evaluate technical or organisational safety devices that are installed, and to propose improvements. Operators of SMEs need to appropriate tools such as risk analysis to rank the hazards in their establishment.

2.2. Difficulties linked to the regulation Contrarily to the quality management system (IS0 9000 or EFQM) or to the environmental management system (IS0 14000), that are voluntary steps, the implementation of a SMS derives directly from the application of the Seveso I1 directive on the control of major accident hazards involving dangerous substances.

1384

For a number of enterprises, the SMS appears first as a regulatory constraint and the commitment of the top management is not spontaneous. However, it is clear that a management system can efficiently function only if the top management is really involved in the work with a strong determination communicated to the personnel. Need of a tool to inform and convince top management and decision-makers concerned with risk management. Besides, in the spirit of the operators, the topics covered by the SMS overlap with the work condition regulations and the accident prevention at the work place. At the same time, a confusion comes up between the role of Inspectors of the work condition and the Inspectors in charge of the application of the Seveso I1 directive. (This problem might be specific to France). Need to clarzB interfaces between the work regulations and the environment regulations about safety. The implementation of a SMS implies to keep oneself up-to-date about the regulatory system as an important aspects of the management system. But often, SMEs have difficulties to follow the evolution of the regulation and to manage it with their internal resources. Need to have tools to insure to follow the evolution of the regulation.

2.3. Organisational difficulties specific to SMEs The implementation of a safety management system and keeping it up-todate represent an important amount of work, that asks almost full-time human resources. In a number of SMEs, the safety function is insured by the production manager or the plant manager. Only few SMEs have identified a person who is in charge of the safety management system. This fact is partly explained by the lack of financial resources, but also, as written above, by the bad perception of major risks and the bad evaluation of the impact of a major accident on the enterprise. Commercial or productivity stakes are not well perceived, and this from a financial point of view as well as in terms of image and productivity. Need of costs /benefits evaluation tool for safety management. Well often the role of the safety chief is merged with the function of the production manager, maintenance manager or even sometimes the plant manager. The top management of the enterprise has to understand that it concerns a task that cannot be sustained together with others responsibilities. Implementation and reviewing SMS necessitates not only time, but also particular competence. Need to encourage SMEs to employ a safety specialist, even in time shared.

1385

2.4. Appropriation difficulties We have seen that the time devoted to the SMS is considerable and must be planned on the long term. If not, the SMS might be only a system that employees do not appropriate. Even if a safety department exists within the enterprise, the SMS is implemented with the help of a technical support coming from central services of an industrial group, or of an external consultant. Because of the costs, after the short passage of the technical help, the system is in its beginning only formal, but not yet anchored in the safety culture of the enterprise and in the automatism of decision-making. The SMS should therefore be the results of a dialogue within the enterprise and a thorough work. The choice of the system is the decision of the top management ; on the other hand, building the SMS should be the result of a collective work.

Need to explain the approach for implementation and the review of the SMS, especially by identihing and by driving collective and federative actions in the long term. One key for the efficiency of the SMS resides in the choice of the referential, referential that must at least take into account the requirements of the annex I11 of the Seveso I1 directive. But to make the SMS really efficient, it has to deal with the production process. The SMS shouldn’t be a system that superposes on the activity of the production, but the SMS has to integrate the production process and to modify it if necessary. The objective is to produce safely, and not to have a production activity and a safety management activity with interfaces. This penetration of safety in production can be particularly difficult in the case of existing structures. Need to favour the integration and the penetration of the SMS in the production activity. 2.5. Success factors During the interviews, success factors for the implementation and functioning of SMS appear clearly, especially, we can underline : 0 Strong implication of the top management right from the beginning ; Existence on the site of a Quality Management System (IS0 9000) or Environment Management System (IS0 14000) or Health and Safety Management System ; Existence of a safety culture. Furthermore, it seems that the good functioning of the SMS is based on some particular points. These points should have inevitably to be tackled during the SMS implementation.

1386

The table hereafter presents our recommendations in front of the particular points we noticed. The list is not exhaustive, but is the result of our experience. Table 1 Recommendations on particular points Particular points Confusion between SMS with Seveso requirement and Health and Safety Management, and bad perception of the regulatory context Bad evaluation of the extent of the study

Recommendations f i e intervention has to begin with the training of the top management and the team that will work on the implementation of the SMS.

A technical support can help to show what is "major" so as to structure the work and to increase its efficiency by going to the essential : the SMS should be proportionate to the major-accident hazards Identification of major hazards, of The team in charge of the SMS has to be trained to important safety elements (safety risk analysis (methods and uses). Indeed, risk barriers) ,risk management analysis is both : A tool for major hazard identification and help for the definition of the important safety elements (barriers) ; A tool for ranking the hazards that has to be reiterated, and that constitutes the motor of the SMS. Learning from accident and historical It is important to define a structure to collect and treat accidents and near-misses, and to share the knowledge lessons learnt in the enterprise

3. PROPOSALS

The experience from the interviews and the Ref. 2-5 shows in a flagrant manner that it is important to communicate to operators, to inform them and to make them aware of the major accident prevention. It is proposed to focus on the following points : 0 Improving interest in major hazard prevention ; 0 Involving the personnel in the MAPP ; 0 Reinforcing the responsibility of the operator ; 0 Using risk analysis as a hndamental tool ; 0 Taking into account the role of men in the enterprise.

1387

3.1. Improving the interest in major hazard prevention To improve the interest in major hazard prevention, the technical support for the SMS implementation has to convince the top management, because often the decision to put in place such a system is a regulatory requirement. Therefore, in the beginning, the managers often want to do the strict minimum to comply with the law. In that case, this can be insufficient. Some major accident case studies with heavy consequences and the presentation of statistics on disaster consequences might wake up the conscience to prevent major accidents. Major accidents are so rare nowadays, that people have forgotten what occurred in the past and think it can not happen again to them. It can be valuable to insist on measurable and not easily measurable benefits when accident prevention is implemented : Reduction of financial loss in case of an accident, due to the destruction of the production equipment and the loss of production, and of market shares ; 0 Preserving the image of the enterprise (media impact) ; 0 Diminution of insurance costs ; 0 Building a communication policy with the stakeholders for a best integration at the local level. 3.2. Involving the personal in the MAPP The Major Accident Prevention Policy (MAPP) constitutes the foundation of all Safety Management Systems in the context of Seveso 11. Indeed, it reflects, on the one hand, the commitment of the top management of the enterprise with objectives in the long term generally with a continuous improvement process, and on the other hand, it outlines the structure and the means that will be implemented to fulfil these objectives. And precisely, these are the structure and the organisation of the means that are described in the SMS. This idea appears clearly in the Seveso I1 directive. Indeed, the directive imposes that, both “high tier” and “low tier” establishments must define their MAPP and decline it in SMS.

The difference between “high tier” and “low tier” establishments is that the first have to produce a demonstrative document (safety report), that justifies the choice of the MAPP, while the second have to make the MAPP available to the competent authorities, in the form of a descriptive document.

1388

Extract from the Seveso I1 directive : Article 7 Major-accident prevention policy

1. Member States shall require the operator to draw up a document setting out his majoraccident prevention policy and to ensure that it is properly implemented. The major-accident prevention policy established by the operator shall be designed to guarantee a high level of protection for man and the environment by appropriate means, structures and management systems. 2. The document must take account of the principles contained in Annex I11 and be made available to the competent authorities for the purposes of, amongst other things, implementation of Articles 5 (2) and 18. Article 9 Safety report

1. Member States shall require the operator to produce a safety report for the purposes of: (a) demonstrating that a major-accident prevention policy and a safety management system for implementing it have been put into effect in accordance with the information set out in Annex I11 ;

[...I

The MAPP must be defined for both establishments concerned by articles 6 and 7, and by the article 9. The MAPP must be declined in appropriate means, structures and management system. In others terms, in the two cases, the SMS materialises and structures the MAPP. For this reason, it is important that the MAPP is the result of a thorough work on safety in the entire enterprise. Reflections leading to the definition of the MAPP should tackle the safety culture of the enterprise, and should involve all employees (for example by consulting them with questionnaires or debates). MAPP and SMS will be establish in the enterprise only if they touch all collaborators, through common objectives. Of course, the MAPP presents objectives and general principles, but it would have to be declined each year in intermediary objective, and an annual review would allow to improve the SMS. During the annual evaluation and review of the SMS, it is important to involve again all collaborators in order that they can judge the work and efforts accomplished and thus to maintain the motivation.

1389

3.3. Reinforcing the responsibility of the operator For some years, SMS including self-control and continuous improvement become generalised. It is clear that industrial systems becoming increasingly complex and resources for the control (in particular by public authorities) being always limited, a tendency is being developed to safety self-control in the framework of SMS. This concept appears clearly in SMS based on the Plan-Do-Check-Act principle. In an industrial establishment, the operator has the best place, on the one hand, to identify the major hazards and, on the other hand, to allocate the means to prevent them. The Seveso I1 directive is there to lock the system and to guarantee that the self-control functions are correctly achieved. During an inspection of the SMS, the review should be carried out with interviews with employees, in order to perceive the safety culture and the level of co-operation between the employees, who reveal the level of appropriation of the SMS. It shouldn’t be only a formal review. But the safety depends clearly on the efficiency of the SMS implemented by the operator. 3.4. Using risk analysis as a fundamental tool To put in place a MAPP and a SMS, such as required by the Seveso I1 directive, the risk analysis is a hdamental tool. So as to lighten the purpose, the risk analysis can be defined as a process that uses information (input data) to identify potential accidents (hazards), to evaluate their likelihood and the gravity of their consequence, so as to reduce their occurrence or their effect. Also, for all SMS, risk analysis is both the input of the system, for hazard identification, and its motor. Indeed, risk analysis is used at the beginning of the implementation of the SMS to identifjr the hazards on which preventive actions will be set up. Risk analysis allows on the one hand, to create a safety culture by putting around a table different persons involved in the functioning of the enterprise (people involved in the conception, operation, maintenance, quality, safety...) to exchange and imagine harmful situations, and on the other hand, to guarantee a certain exhaustiveness and homogeneity of preventive measures. The hazard ranking that is carried out at the end of the risk analysis, allows to define priorities for actions to lead at short, medium and long term. Then, revisions of the frequency and severity of identified accidents by taking into account preventive and protective measures (barriers) allow to build, by successive iteration, plans to improve the safety level of the plant. Risk analysis is therefore a good tool for safety improvement, which is the goal of the SMS too.

1390

Eventually, to the level of SMEs, the lack of information and the idea that risk analysis methods are not adapted to the small structures are the main brakes to a more widened use of these methods. Indeed, often SMEs hesitate to launch such risk analysis by fear of the heavy process and costs. The accompaniment by an external organism expert in these methods is often very fruitful. 3.5. Taking into account the role of men in the enterprise During the implementation of a SMS, there is a great risk to superpose a formal safety system on the production system without taking account of the specific characteristics of the enterprise, that they are technical issues (specificity of the products, complexity of the installations) or human issues (history of men in the enterprise, specific activities of some personal). If the objective of SMS is to modify (by improving it) men's behaviour to avoid that "human errors" do not lead to a major accident, it is important to know the initial state of the organisation. Knowing the initial state consists in, on the one hand, knowing the real situation, the daily work accomplished by men at all levels of the organisation and, on the other hand, knowing the representation and the perception that have the workers of their work. For a SMS, the path to cover can be traced only if the starting point is known. Furthermore, knowing the initial state allows to adapt the speech, in according to the level of perception of each collaborator in the enterprise. By having a good knowledge of the initial state and actions to implement, the SMS will be able to act on men's behaviour, and lead to safe production systems (with the integration of the safety in the production process).

4. SMS :FROM A REACTIVE SYSTEM TO A PROACTIVE SYSTEM The SMEs are generally structured and organised for a well precise goal: to produce. It is not natural for a SME to anticipate means, especially when they are limited, to face drifting situations or crisis that appear only rarely. All identified difficulties show that the actions led by the operator were conceived to produce. To face the unforeseen, enterprises that have no SMS count on their reactivity : to react in order to avoid the drifting to a catastrophic situation. The reactions are often curative. Especially, a lot of SMEs are structured without insuring their defence, as a sportive team that would have very good attackers but poor defenders. In order that the team wins, it is necessary that all players have a good level. In the same manner for safety, it is preferable that all collaborators know the tactics of the enterprise (policy), have the level to implement it and have a capacity of anticipation to avoid even the appearance of drift situation.

1391

The well known message that illustrates this purpose could be the following: "Safety is the affair of everyone ' I . But in order that the work on safety is the most efficient, it is necessary to be capable to anticipate by constructing a proactive system. This goal required an in-depth work on the employees who are the enterprise. 5. PERSPECTIVES

INERIS has noticed the new occurrence of so called 'post SEVESO accidents' which involved failure of safety devices [ 6 ] ,that suffered from non appropriate maintenance and testing, which are parts of the SMS. Aware of the difficulties apprehended by SMEs' operators, INERIS has just launched a project with industrialists to build a methodology evaluating the efficiency of SMS. The methodology is based on the development of safety performance indicators that might be used by the operator for monitoring the safety management system in the long term. The indicators that will be developed will reflect the formal aspects of SMS as well as the level of appropriation link with the safety culture. The final objective is to take into account the prevention carried out by the operators in the evaluation of the risk level of an industrial establishment as suggested in Ref. 7.

REFERENCES [ l ] N. Mitchison and S. Porter (TWG4), Guidelines on a Major Accident Prevention Policy and Safety Management System, as required by Council Directive 96/82/EC (Seveso 11), DG XI of the European Commission, 1998 [2] K. Cassidy and A. Amendola (eds), Special issue : The SEVESO I1 Directive (96/82/EC) on the control of major accident hazards involving dangerous substances, Journal of Hazardous Materials, Vol. 65 n"1-2, Elsevier Science, 1999 [3] C. Kirchsteiger (eds), Special Issue : International Trends in Major Accidents and Activities by the European Commission towards Accident Prevention, Journal of Loss Prevention in the Process Industries, Vol. 12 n"1, Elsevier Science, 1999 [4] C. Kirchsteiger, M. Christou and G. Papadakis G. (editors), Risk assessment and management in the context of the 'Seveso I1 Directive', Elsevier Science, Amsterdam, February 1998. [5] Seveso 2000 - Risk Management in the European Union of 2000 : The Challenge of Implementing Council Directive Seveso 11. November 10-12, 1999. Athens, Conference Proceedings (draft) edited by European Commission - Joint Research Centre, 1999 [6] J-F. Lechaudel, S. Bauchet, 0. Salvi, Assessment of two accidents involving safety devices. Loss Prevention Bulletin. Issue 146, April 1999. [7] 0. Salvi and D. Gaston, Why changing the way to measure the risk ?, Proceedings 9th Annual Conference Risk Analysis : Facing the New Millennium Rotterdam - The Netherlands October 10 - 13, Edited by L.H.J. Goossens Delft University Press, pp 263267,1999

This Page Intentionally Left Blank

1393

Seveso I1 directive - How to comply to the Safety Management System requirements in Small and Medium size Enterprises? E. van der Schansa,M.A.M. Heijnea a DHV Environment and Infrastructure B.V., Department of Industry, Environment 2% Safety, P.O. Box 1076,3800 BB Amersfoort, The Netherlands

SUMMARY

Under the Seveso I1 directive enterprises that store and/or handle large quantities of hazardous materials are obliged to prepare a Safety Report (SR) and to establish a Safety Management System (SMS). Most large, multinational enterprises, having the fundamentals of the Seveso I1 directive already in place, consider these requirements a costly, time and resources consuming paper exercise. The situation for small and medium size enterprises differs in most cases. In general their effort in improving safety is authority driven and usually there has not been a (formal) need to establish an SMS in the past. Therefore the typical small company does not yet have an SMS and the management of a small company is often reluctant to implement an SMS. This because they envisage a large, formal and paperwork oriented SMS as required when implementing known management systems such as IS0 9001 and I S 0 14001. Traditional, formal and paperwork oriented, SMS’s were based on the management structure of multinational enterprises. Management theory learns that these management systems are not necessarily applicable to small and medium size enterprises, explaining some of the resistance of these enterprises when trylng to impose a large and paperwork oriented SMS. Experience obtained as a consultant for several small and medium size enterprises shows that it is possible to develop fit for purpose management systems fully adhering to the Seveso I1 directive. 1. INTRODUCTION

The Seveso I1 directive (Ref. 1) compels enterprises that store and/or handle large quantities of hazardous materials to implement a Safety Management

1394

System (SMS). Many of the enterprises that have to comply with the Seveso I1 directive are large, multinational enterprises. These (multinational) enterprises usually have some kind of formal SMS in place either integrated in a quality management system (for example IS0 9001, Ref. 2) or environmental management system (for example IS0 14001 Ref. 3). Otherwise they may have tailor-made management systems to manage loss prevention and/or safety. Examples of these tailor-made systems are the ESSO/Exxon ‘s OIMS and Shell ‘s HEMP. For these enterprises the fundamentals of the Seveso I1 directive are already in place. In the areas of for example chemicals storage and trading or LPG bottling and storage facilities however, many niche players are active. These niche players are often small or medium size enterprises (SME)’, who tend to have no or less formal developed management systems. If management systems are in place they are generally focused on product quality and less on managing their business processes. Therefore the shift toward a formal SMS requires substantially more effort for the SME. 2. MANAGEMENT SYSTEMS IN SME

2.1 What is a management system Before focusing on the specific nature of SME and the influence of these specifics on a SMS it is may be necessary to introduce the phrase “management system”. While there are many definitions and terminology in use, it is generally accepted (Ref. 4)that a management system is based on “the management loop” also known as the Deming loop or the “plan-do-check-act loop”. It involves agreeing on an objective, defining a plan to achieve the objective, carrying out the plan, checking whether the objective is reached and taking appropriate corrective action if required. 2.2 Characteristics of SME The fundamental difference between SME and large enterprises are their type of organisation. Management literature provides different tools to analyse organisations. The classification of organisation by Mintzberg, one of the founding fathers of our current view on business, identifies 5 types of organisations, see Ref. 5. Key characteristics of these types of organisations are given in table 1.

’ Local enterprises that are part of larger, (multinational) organisation, but hardly get any directions on how to operate their day-to-day business from their head office, can be considered as an SME in the context of this paper.

1395

Most of the major Seveso I1 enterprises (i.e. chemical production facilities) may be classified as Machine or Diversified organisations. The traditional SMS are developed for these Machine or Diversified organisations, where a lot of effort is aimed at standardisation through procedures and work instructions. Standardisation of work processes andor results might not be the most preferable way of improving the business in SME. Typical organisation types for SME are Entrepreneurial and Innovative organisations. These types of organisations differ significantly from the Machine and Diversified organisations where SMS have been developed initially

Table 1 Different types of organisations Type of organisation Key characteristics Entrepreneurial Structure: - simple, informal organisation Context: - strong leadership, sometimes charismatic and autocratic - small organisations, local companies Risks: - lack of balance between strategy and execution Example: - family-owned business, shop around-the-comer Machine organisation Structure: - centralised bureaucracy - official procedures Context: - large, mature organisation - companies with focus on control and safety - control obsession Risks: Example: - Steel companies, oil & gas companies Professional organisation Structure: - bureaucratic and decentralised - services industry Context: - focused on (high) education of employees Risks: - co-ordination between specialists Example: - law firms, hospitals Diversified organisation Structure: - autonomous divisions, market focused - diverse markets Context: - large, mature organisation Risks: - potential lack of social attention, due to focus on results Example: - General Electric, Unilever Innovative organisation Structure: - volatile, organic - complex, dynamic environment Context: - young organisations lack of clarity Risks: Example: - dot.com start-ups, biotechnology start-ups Derived from: Mintzberg, Mintzberg on Management, 1989 (Ref. 5) ~

1396

2.2.1. Types of co-ordination Depending on the type of organisation, different types of co-ordination mechanisms are identified by Mintzberg (Ref. 5), see table 2. Co-ordination mechanisms are the glue holding an organisational structure together. SMS rely heavily on these co-ordination mechanisms. For small and medium enterprises the most common ways of coordination are direct supervision and mutual co-ordination. Direct supervision speaks for itself; there is a boss who has the complete overview and is able to co-ordinate his employees directly. The span of control however is limited and the environment has to be understandable for the boss. Mutual co-ordination is used in most companies when non-standard activities have to be carried out. Mutual co-ordination involves more two our more persons agreeing on a common approach to the activity. From the simplest organisations to the most complex - it works in extremely difficult circumstances. 2.2.2. Implications for management systems The theory leads to the recognition that every type of organisation requires a different strategy to design and implement a SMS. The SMS architecture should be in line with the co-ordination mechanisms present in the organisation. Nevertheless the authorities require some kind of a documented SMS, as dictated by the Seveso I1 directive, and the authorities are obliged to audit the companies on the effectiveness of the SMS on at least annual basis. Auditing or being audited while not having a documented SMS will be difficult, if not impossible, for both the enterprise and the authorities. The key success factor in implementing a SMS in a SME is to document the requirements in such a way that the following conditions can be met: - the authorities can audit the SMS, therefore the SMS shall be documented; - the SMS shall not interfere in the functioning of the normal co-ordination mechanism (i.e. direct supervision or mutual co-ordination) present in the organisation. Table 2 Co-ordination mechanisms in different types of organisation Type of organisation Co-ordination mechanism Entrepreneurial organisation Direct supervision Machine organisation Standardisation of work processes Professional organisation Standardisation of skills Diversified organisation Standardisation of results Innovative organisation Mutual co-ordination Derived from: Mintzberg, Mintzberg on Management, 1989 (Ref. 5)

1397

3. SAFETY MANAGEMENT SYSTEM REQUIREMENTS

The Seveso I1 directive states: "The safety management system should include the part of the general management system which includes the organisational structure, responsibilities, practices, procedures, processes and resources for determining and implementing the major accident prevention policy. " The SMS requirements, as included in Annex I11 of the Seveso I1 directive, form eight fundamental requirements. They do not describe a complete SMS, since it is recognised that such a system will have to reflect the culture and structure of a specific company (Ref. 4). The following paragraphs give a short explanation of each of the eight requirements.

3.1. Development of a Major Accident Prevention Policy The Seveso I1 directive states: "The major accident prevention policy should be established in writing and should include the operator's overall aims and principles of action with respect to the control of major accident hazards." Without the full support of the management, organisational changes are deemed to fail (Ref. 6). Deep investigation (Ref. 7) into the underlying causes of incidents has led to the understanding that management is an important driver of a safe working environment. Management support and the strategic direction can be formulated in a policy statement. Also for SME it is important to set a clear direction. Often the policy statement is made up in the management's hearts & minds and requires only to be explicitly formulated. 3.2. Organisation and personnel The Seveso I1 directive states: "The roles and responsibilities of personnel involved in the management of major hazards at all levels in the organisation. The identification of training needs of such personnel and the provision of the training as identified, The involvement of employees and, where appropriate, sub-contractors. I' The smaller the organisation, the simpler it is. Having a limited number of personnel it is not required to have detailed training programmes and competency requirements. However it should be ensured that the required level of competency and mandatory training is documented as well as written proof of training attendance is be available. It is thought that this requirement is rather a matter of discipline to maintain a proper file than a requirement forcing the preparation of exhaustive plans and procedures.

1398

3.3. Hazard Identification and evaluation The Seveso I1 directive states: "Adoption and implementation of procedures for systematically identifiing major hazards arisingfrom normal and abnormal operation and the assessment of their likelihood and severity. This is perhaps the heart of the SMS as well as the most difficult part to implement in any company. Hazard identification is partially a risk evaluation that has to be exercised on a regular basis (for example every 4 years), but also implies a sound management of changes (see paragraph 3.5). It is tempting to develop a procedure to identify all possible hazards, but perhaps for an SME it is adequate to keep an open eye on developments within the industry and with competitors and regularly compare their own risk reduction measures with the measures taken by their peers, which can be found amongst competitors and members of the same sector organisation. However their peers should not always be the classical under performer. 3.4. Operational control The Seveso I1 directive states: 'Ydoption and implementation of procedures and instructions for safe operation, including maintenance, of plant, processes, equipment and temporary stoppages. Many elements of operational control are routine activities for personnel. However in SME it is quite common that relevant knowledge of a part of the process is available with only one person. Keep in mind that everyone has the right to go on holiday, may get ill, may resign or may be involved in an accident. Ensure that specific knowledge is not concentrated with one person. Start documenting vital knowledge to ensure that the enterprise does not depend on one single person's presence or well being.

3.5. Management of Change The Seveso I1 directive states: "Adoption and implementation of procedures for planning modijications to, or the design of new installations, processes or storage facilities. Changes may be implemented fast without time to identify possible (negative) consequences. A management of change procedure may regulate change implementation, aligned with budget requests or requests for requisition (RFR). However, even minor changes, as changing the set point of a level controller, can have significant impact on the safety of a process. Therefore management of change is not only a procedure attached to an RFR. It requires competent personnel to recognise the impact of a (minor)

1399

change. It also requires (middle) management to consequently assess risks of irregular situations and changes. It is known that personnel will take more risks, if middle management allows them to take risks during irregular situations and upsets (Ref. 8). Management of Change requires competency of personnel to identify the situations that require further consideration, it requires (middle) management to give the right example and it requires competency inside or outside the enterprise to assess the changes.

3.6. Planning for emergencies The Seveso I1 directive states: ?tdoption and implementation of procedures to identifj, foreseeable emergencies by systematic analysis and to prepare, test and review emergency plans to respond to such emergencies." Depending on the activities of the SME, an Emergency Response Plan may vary from simple to extensive. The plan may be prepared in co-operation with the local fire brigade, aided by a safety consultant. Most SME already have en Emergency Response Plan available, which may be tested on a regular basis preferably in co-operation with the local fire brigade. Tests of the plan can easily be documented, e.g. as part of the roles and responsibilities (See 3.2). The Emergency Response Plans should be reviewed on a regular basis or whenever new activities are introduced (possible as part of the Management of Change procedure). 3.7. Monitoring performance The Seveso I1 directive states: 'Ydoption and implementation of procedures for ongoing assessment of compliance with the objectives set by the operator's major accident prevention policy and safety management system, and the mechanisms for investigation and taking corrective action in case of non-compliance. The procedures should cover the operator's system for reporting major accidents or near misses, particularly those involving failure of protective measures, and their investigation and follow-up on basis of lessons learnt." Accidents often provide valuable "lessons-learnt" and serve as a basis to change existing work procedures or routines. Each accident should therefore be investigated. Incident statistics, however, are rather useless for SME. Despite the fact that they are often used to monitor safety performance, their reliability is poor if used on a small number of employees. For example, if the enterprise has approximately 100 employees and an incident fi-equency of 2 incidents per million hours worked, it takes a decade to determine a statistically sound incident frequency. (Ref. 7) This sampling time is far too long to be used as

1400

management information. Monitoring performance should therefore be focused on pro-active signals and soft issues instead of incident statistics. 3.8. Audit and review The Seveso I1 directive states: "Adoption and implementation of procedures for periodic systematic assessment of the major accident prevention policy and the effectiveness and suitability of the safety management system: the documented review of performance of the policy and safety management system and its up-dating by senior management." Views on safety, safety management and risk assessment and reduction gradually change. The prevention Policy as well as the SMS should therefore be updated on a regular basis. It is useful to develop a simple checklist to use during the management review to ensure that the review is complete. Such a checklist will keep management focused to the review, and the completed checklist is the written record of conducting the review. 4. IMPLEMENTATION STRATEGIES 4.1. Introduction When faced with the requirement to implement an SMS the strategic choice has to be made whether the SMS should be implemented in line with another management system, i.e. IS0 14001. Especially when an IS 0 14001 system is present the implementation of the SMS requires much less effort. Table 3 gives an overview of the area's of overlap between SMS and ISO-14001 as well as areas where the SMS requires additional work when an ISO-14001 system is present. The following paragraphs describe the advantages and disadvantages of three implementation strategies": - stand-alone implementation of SMS; - modifying existing management system to implement SMS; - implementing SMS together with other management system. The selection of the appropriate strategy depends on the status of the enterprise, the ambitions and preferences of its management and the capabilities of the organisation. It is recommended to obtain sound advice on the possibilities and hurdles that come with various strategies. Especially in this stage it can be useful to request help from a consultant.

4.2. Stand-alone implementation of SMS Stand-alone implementation is the most straightforward way of implementing an SMS. There is no interference with other management

1401

systems, this benefit is also the hazard of stand alone implementation. The stand alone SMS however is difficult to root into the organisation. After implementation, management may lose track of the SMS as the system has not rooted into the organisation.

Table 3

4.4.3 Communication

4.5.4Environmental management

Key: SMS Requirements: a) Development of Major Accident Prevention Policy b) Organisation and personnel c) Hazard Identification and evaluation d) Operational control e) Management of Change f) Planning for emergencies g) Monitoring performance h) Audit and review

Coding in cross-reference table: D Detailed investigation required in coverage of SMS requirements A Additional procedure required to cover SMS requirements

1402

4.3. Modifying existing management system to implement SMS requirements Table 3 shows that many SMS elements are already covered in the IS 0 14001 requirements. Even an IS0 9001 quality management system will have several parts in common with the SMS. This makes it much easier to build on existing work practices and to root the implement into the organisation. Due care should be given that the auditors of one of the management systems restrict themselves to the scope of their management system. There is no added value in authorities auditing product quality. Neither is it advisable to develop hazard identification procedures that always completely comply with IS0 14001. 4.4. Implementing SMS together with an other management system The obvious disadvantage of implementing two systems at the same time is that an organisation is flooded with changes. However this disadvantage should be placed into perspective that it might not need to lead to many additional changes because implementing two systems at one time is actually almost identical to implementing one system in a smart way. The advantage of implementing two systems together is the benefit of the additional external credit from authorities or clients that can be gained by implementing for example an ISO-14001 system. Further it has the advantage that the auditors of an independent external accreditation company will keep the organisation on track.

5. GENERAL POINTS OF ATTENTION WHEN IMPLEMENTING MANAGEMENT SYSTEMS

5.1. Getting started When reading the requirements for the SMS and especially when setting the first steps in developing the SMS many questions will arise with respect to depth of the procedures required. However "begin with the end in mind". You do not need to have a detailed idea of the final status of the SMS, just start with developing an idea of how a safe environment can be obtained in your company. Will it require extensive procedures, guidelines and instructions or do you rely more on the competency of your colleagues? We all know that large multinational companies have developed very detailed and extensive management systems. But will it be effective for your SME? And even if it is, will you be able to create such a change in the organisation? The question for many SME's will be answered negative. The implementation of an SMS does require a different approach in a SME than a multinational.

1403

5.2. Phases to go through Every implementation has to go through various stages, see Fig. 1 . The most important stage is the beginning, the management orientation. During the management orientation, management should be familiarised with the concept of a management system and its possibilities as well as limitations. This management orientation typically involves reading case-stories, attending presentations on the subject and talk to peer enterprises that already have such a management system in place. During the management orientation the management of the SME should become familiar and comfortable with the concept of an SMS. The second phase requires management to select a strategy for implementation. This strategy should fit with the possibilities and ambitions of the SME. It is recommended that the selection process is facilitated by someone with expert knowledge on management systems . This may either be an internal expert or an external consultant. The third phase, the implementation phase, takes approximately a year. This is often considered too lengthy by management. Implementation is not only limited to the preparation of the SMS and a roll out of the system. Careful implementation is a step by step process to implement new procedures in the organisation without flooding them with changes.

41

Fig. 1. Effort required during the various stages of implementation (Ref. 6 )

1404

Because the time span of the implementation phase as well as the costs involved with the implementation it is advisable to appoint a (part time) project manager. This project manager is responsible to track progress and budget and more important to be a driving force to chase people and create progress. Further it is strongly advised to have assistance from a consultant with experience in designing and implementing management systems. The consultant can design the outlines of the management system and can help personnel in the SME with completing the various elements of the SMS. This consultant can be same person as the project manager, however this is not a requirement. The third stage is hopefully the celebration stage where the system is audited and approved either by the authorities in case of an SMS or an external certification agency in case of ISO- 14001. Unfortunately this celebration stage is followed by perhaps the most tempting challenge, maintaining the SMS and maintaining the discipline to adhere to SMS. Partially this is a matter of discipline, but it also requires flexibility to change elements of the SMS that do not function properly. The better the system is designed and implemented the easier it becomes to maintain the SMS, however it never becomes easy! 5.3. Close the loop as soon as possible Implementing changes in the organisation inevitably leads to resistance. This is a completely natural phenomenon and should be neglected nor should it create panic amongst the people implementing the changes. The longer it takes before the results of the changes become visible the larger the resistance becomes. Ref. 9 gives a good introduction in how to deal with resistance while implementing changes. "Proof of the pudding is the eating", therefore the eating should start as soon as possible. There can always be quick wins identified. Pick a few of these quick wins and start implementing them. During the implementation the organisation is exposed to the Deming circle and closing the loop of this Deming circle for the first few times is an excellent opportunity to improve the SMS and to prevent the same implementation mistakes to occur while implementing other elements of the SMS. Closing the loop as soon as possible, makes the changes in the organisation visible, reduces the amount of resistance and is a valuable lesson implementing the other parts of the SMS. 5.4. Involve personnel It sounds obvious that the personnel that will have to work with the various elements of SMS should be involved in designing and implementing the system. Nevertheless is seems to be the natural habitat of an external consultant

1405

as well as internal advisor to design the system on hisher desk without real influence of the persons that have to work with the system, and often the "desk design" is cheaper and quicker. However the risks are that it lacks commitment and does not lead to a lasting change. Initial involvement of personnel on the other hand will initially take more time, but it can be very rewarding for the persons involved and leads to tailor made and potentially lasting changes. Therefore it is strongly recommended to involve personnel in the development of the SMS (Ref. 10). This may be done by for example: - inviting them to develop some parts themselves, coached by an experienced consultant; - involving them in brainstorm session on how to design and implement an element of the SMS. 5.5. Track and communicate progress As said earlier, resistance will increase over time. Initiatives that are presented (or which are informally heard in the corridor) but not become visible are deemed to face an increase resistance. Unfortunately when implementing an SMS during a year, there will not be the breaking news every day and the potential risk that the initiative is felt to be another flavour of the day is huge. The activities undertaken to implement the SMS should therefore be as visible as possible. Therefore it is recommended to communicate the ongoing actions and their progress (as well as hurdles faced) openly and publicly in the enterprise. LIST OF ABBREVIATIONS HACCP HEMP IS0 h4APD OIMS RFR SME SMS SR

Hazard Analysis of Critical Control Points Hazard and Effect Management Process (Shell) International Standardisation Organisation Major Accident Prevention Document Operations Integrity Management System (ESSO / Exxon) Request for Requisition Small and medium enterprises Safety Management Systems Safety Report

REFERENCES [l]

[2]

Seveso I1 directive, Council Directive 96/82/EC, Official Journal of the European Communities ISO-9001, Quality systems - Model for quality assurance in design, development, production, installation and servicing, British Standard, 1994

1406 ISO-14001, Environmental management systems - Specification with guidance for use, British Standard, 1996 [4] N. Mitchison, S. Porter (eds), Guidelines on a Major Accident Prevention Policy and Safety Management System, as required by Council Directive 96/82/EC (Seveso II), Institute for systems informatics and safety, EUR 18123, 1999 [5] H. Mintzberg, Mintzberg on Management: Inside our Strange World of Organisations, Free Press, New York, 1989 [6] J.G.V. Maas, H.J. Doeleman, De kwaliteit van milieu- en ARE30-zorg (Dutch), Kluwer, Deventer, The Netherlands, 1997 [7] J. Groeneweg, Controlling the controllable; the management of safety, DWSO, Leiden, The Netherlands, 1998 [8] P. Mascini, Goed voorbeeld doet goed volgen (Dutch), Maandblad arbeidsomstandigheden, p28-p3 1, March 2000. [9] P. Senge (ed), The Dance of Change; the challenges to sustaining momentum in learning organisations, Doubleday, New York, USA, 1999 [lo] D. Hunter, Facilitation of Groups, Gower, Aldershot, UK, 1996

[3]

1407

A combined approach to improve safety performance on existing process plants. Practical application according to Seveso I1 R. Pastorino, F. Curri), M. Del Borghi and B. Fabian0

DICheP - Chemical and Process Engineering Department “G.B. Bonino”, University of Genoa, Via Opera Pia, 15 - 16145 Genoa, Italy 1. INTRODUCTION

The process of Hazop is well known as an effective highly respected method of hazard identification; on the other side, it is considered a long and expensive process. It is usually carried out along or near the end of the design process, allowing to achieve early identification of hazards, process changes in order to eliminate or reduce them, specifically designed control systems and comparison of alternatives. The problems encountered in carrying out a Hazard Review on existing plants deal with some difficulties related to different factors [ 11. Often older plants have no hazard studies at the design stage; moreover many plants suffered changes as time went on and the original design notes may no longer apply properly to the new conditions. On the other hand, Seveso I1 Directive (96/82/EC), dealing with the control of major accidents and acknowledged by Italian law D.L. 334/99, implies the need of developing adequate tools for the evaluation and mitigation of industrial risk. Retrospective Hazop is considered suitable for safety assurance, but it is rejected since it suffers limitations and involves considerable time [ 1,2]. Further difficulties arise when dealing with batch processes, in that the usual approach, consisting in dividing line by line the plant, must be performed considering as well three operative stages: charge, reaction and discharge. This paper illustrates a practical example of a combined technique, which can overcome the above mentioned limitations and difficulties. This technique has been developed ad hoc, starting from Hazop and Process Hazard Review and applied to a process of acrylic polymerization along the whole production cycle. A preliminary study, based on the Index Method, is carried out on the plant, in order to identify the most hazardous units and to provide a quantification of the risk. The Hazop will be applied only to those sections of a plant where it has been determined that a deviation from the design intent could lead to serious accidents and it will suggest the action required to reduce the risk of accidents.

1408

The evaluation of risk by Index Method allows to obtain a univocal interpretation of the hazards of an existing plant, related to both the intrinsic characteristics and the environmental conditions. Moreover, this technique tries to overcome Hazop limitations taking into account aspects usually under-evaluated in the traditional studies: plant comparison with current best practice, adoption of safe system of work, safety critical procedures, human factor precautions etc. 2. METHODS

The Index Method was developed by Dow Chemical Company and by Mond Division. Successively, it was elaborated by the research groups of the National Institute for the Prevention and Safety on Work (ISPESL), in order to obtain a standardized method: actually the Index Method is applied in the licensing procedures in Italy. The plant has to be divided into Risk Units, selected on the basis of process, chemicals, operative conditions and equipment. In every unit a “key compound” has to be identified, adopting as reference either flammability risk connected to intrinsic combustion, explosion andor exothermic properties, or toxic risk, or both of them. In detail, five indexes are calculated in every risk unit: i. Fire index,J ii. Confined explosion index, c; iii. Air explosion index, a; iv. Toxic risk index, t; v. General risk index, g . Some of the applied indexes are reported in Table 1 and they include: = hazards related to intrinsic characteristics of substances; hazards related to general processes; hazards related to particular processes; hazards related to the amount of “key compound” in the unit; hazards related to the layout of the risk unit; hazards for health. These indexes are then “balanced” on the basis of preventive and protective systems adopted. Table 2 shows the meaning of the balancing factors adopted and their maximum value of reduction of indexes. With the adoption of these factors, the indexes adopted are the following: f’=f.kl.k3.kS.k6; i. Balanced fire index, ii. Balanced confined explosion index c ’ = c . k2 . k3; a’ = a . kl . k2 . k3 . k5; iii. Balanced air explosion index t ’ = t . k 2 . k3; iv. Balanced toxic risk index g ’ = g . k l . k 2 *k 3 *k 4 . k 5 . k6. v. Balanced general risk index

.. ..

1409

Table 1

Abstract of Indexes applied to the process of polymerization [3] Hazards Characteristics of reactions Batch reactors Transfers of reactants Transferability of vessels Oxidant substances Characteristics of dispersion and mixing Spontaneous heating Spontaneous polymerization Explosive properties of gaseous phase Explosive properties of condensed phase Low pressure Highpressure Low temperature High temperature Corrosion Spills fiom joints and flanges Run-awav reactions

Range of indexes 25-50 10-60 0-150 10-100 0-20 60- 100 30-250 25-75 150-1500 200-1500 50 0- 160 0-100 20-60 0-400 0-60 20-300

Table 2 Factors used to calculate Balanced Indexes [3] Factor kl k2 k3 k4 k5 k6

Meaning Containment Process control Attitude towards safety Fire prevention Insulation of substances Fire devices

Maximum value 0.108 0.131 0.312 0.320 0.585 0.166

The next steps of the proposed method are summarized as follows: identification of accident scenarios, by the use of Process Hazard Review and Hazop methodologies suited ad hoc for batch processes; estimation of the consequences of the principal accident scenarios, related to thermal radiation, explosions and release of toxic substances in the risk units; specification of the actions required in order to reduce the risk of accident; estimation of the new balanced indexes.

. ..

3. THE FRAMEWORK INTO PRACTICE The framework proposed has been applied to an existent plant, utilized for the production of acrylic polymers (20,000 Mg/year) in water emulsion (30% vh).

1410

Polymerization reaction is carried out by stirred tank reactors (DSTR) in conditioy of atmospheric pressure. The volume of the reactors is in the range 5.8 - 15.2 m . In the first step of the process, the mixing of monomers (150 kg), catalyst and water (500 kg) is performed at the reaction temperature (330 - 370 K). At this temperature, an exothermic reaction of polymerization starts, and this reaction carries out isothermally, by removing the heat of reaction with a flux of water in the external jacket. The time of the whole process is about six hours. Otherwise, a redox process can be used, by mixing the monomers with a promoter, then an oxidant and finally a reducer. When the polymerization reaction starts, it is necessary to remove the heat of reaction in order to carry out the reaction isothermally. Both the processes are over with the addition of reactants and stabilizers, in order to close the free radicals and stop the reaction chain. Fig. 1 shows the block diagram of the plant, with the steps of the whole productive cycle: ' storage of raw materials and auxiliary chemicals products; ' preparation of reactants; reaction; addition of stabilizers; storage of polymers; packing; ' storage of packed products. Raw materials are carried into the plant by tanks or in intermediate bulk containers; then are handled in the different sections by pipelines or fork trucks. The monomers are contained in steel tanks, with containment basin, pressure relief valve, and cooling system. Auxiliary chemical products are carried in the plant in bags or drums and are stored in order to prevent accidental mixing. Vapours produced during the reactions are collected into a shell-and-tube condenser and recycled. Finite product is carried by pipelines to the intermediate storage and then to the final packaging.

.

r-iG\l=l I miGrial/l

storage

Fig. 1 - Simplified block diagram of the plant

Packing

141 1

4. THE RISK UNITS According to the method proposed, the plant has been divided into Risk Units, selected on the basis of process, chemicals, operative conditions and equipment. Five units of storage and transfer of raw materials and finite product were identified: acrylamide and methyl-acrylate storage; flammable goods storage; transfer of acrylamide and methyl-acrylate &om storage to feeders; transfer of toluene; = transfer of acrylamide and methyl-acrylate to reactors. Moreover, ten units of feedheaction were defined. In every unit a “key compound” was defined according to: energetic risk: the substance characterized by higher heat of combustion, explosion and/or exothermic reaction; toxic risk: substance or mixture in major quantity; combined risks: more reactive and more toxic substance. The “key substances” were selected as follows: Storage and transfer area acrylamide (intrinsic toxicity TLV/TWA = 0.3 mg.m-3) and toluene (low flammability limit 1.3%(v/v); high quantity 3 Mg). Feeding and reaction area acrylonitrile (high heat of polymerization and vaporization 6.3.1O5 Jakg’; high toxicity TLV/TWA = 4.5 mg*m’3)[4,51.

.. ..

5. ACCIDENT SCENARIOS

The following scenarios are a summary of the result of the analysis: release of acrylamide in the storage/transfer areas; release of toluene and fire in the flammable goods storage area; release of methacrylate and fire in the monomers storage area; run-away reaction.

..

5.1. Release of Acrylamide The immediate causes of this accident are: 1. break or failure of bulks; 2. failure of the foot valve; 3. fall or failure of piping or flanges into the feeding header. The top event was identified in the release of 1000 kg of acrylamide (50% v/v), the formation of a liquid pool and its subsequent evaporation. The liquid evaporation rate may be calculated by adopting the TNO [6] model for evaporation &om a pool of non-boiling liquids, according to Eq. (1).

1412

where: qv =

k,

=

Pv(Tp)= p = R = Tp = A =

vaporization mass flow rate mass transfer coefficient related to concentration vapour pressure at temperature of pool surface molecular weight of substance international gas constant liquid temperature at pool surface total liquid pool area

[kg/sl

[ds],

[N/m ] [kg/mol] [J/(mol.K)]

LK1 [m 1

Adopting conservative values for environmental and boundary conditions, the calculated concentration results about 3% of the fixed TLV. Table 3 shows the results of the modelling and relevant conditions. Table 3

Conditions and calculated concentrations in case of release of acrylamide Substance

Acrylamide 50% (v/v)

Mass of the release

1000 kg

Boiling Point

105.5 "C

Relative density at 25 "C

1.04

Temperature of release

25 "C

Temp of surface of basin

50 "C

Wind velocity

3 m/s

Pasquill's class of stability TLV-TWA Distance 8m 8m 8m 16 m

Height Om 0.5 m lm 1.5 m

B 0.03 mg/m3

Calculated concentration 0.0065 mg/m3 0.0034 mg/m3 0.0022 mg/m3 0.0016 mg/m3

TLV / Concentration 0.22 0.11 0.07 0.05

The identified actions to reduce the risk are: to storage bulks in protected area and to install mechanical protections against forking by trucks. In order to mitigate the consequences of the unwanted events, it is possible to contain the pool by absorbent panels and remove the liquid by adsorbent powders.

1413

5.2. Release of Toluene and fire The immediate causes of this accidental event are the forking by fork truck or the failure of the foot valve. The course of the events involves the forming of a pool of about 60 m2 and fire of the evaporated substance. The heat flux versus the distance from the centre of the pool, was calculated by adopting the TNO model for thermal radiation from pool fire [6]:

where: Q = F, = AHc

= =

X

=

mh

Heat flux [J/m2*s] Fraction of the combustion heat radiated from the flame surface Burningrate [kdsl Net heat of combustion at the boiling point of [Jkl the flammable material Distance from the source to the receiver [ml

As shown in Table 4, the calculated values of radiation result higher than the thermal resistance of close bulks and tanks. Table 4

Conditions and calculated thermal radiation in case of release of toluene and fire Substance Mass of the release Temperature of release Surface of the pool Wind velocity Combustion rate Flame height Heat radiation flux at 4 m Heat radiation flux at 4.5 m Heat radiation flux at 12 m Heat radiation flux at 20 m

Toluene 1000 kg

25 "C 61.38 m2 0.5 m / s 5.9 kgls 18.6 m 46 kW/m2 37.5 kW/m2 12.5 kW/m2 5 kW/m2

The thresholds of damye set down by Italian law are 37.5 kW/m2 for metalli! equipment, 12.5 kW/m for instruments, plastic goods and wood and 5 kW/m for people.

1414

On this basis, the accident scenario must consider the evolving situation consisting in a domino effect and the subsequent development of fire. The measures required to mitigate the risk are summarized as follows: storage of bulks in reserved and protected area; protection plate against forking; installation of automatic fire-extinguisher; = installation of water barriers for cloud and thermal radiation containment.

5.3. Release of Methacrylate and fire The top event is identified in a release of 17,000 kg of substance and subsequent fire. By applying Eq. (2), from the TNO model [6],the results, summed up in Table 5, show that thermal radiation is lower than the threshold of damaging of other equipment or closer building (17 meters from the centre of fire; thermal radiation threshold = 12.5 kW/m ). However, it is possible to apply some actions, in order to obtain further reduction of the risk: installation of automatic fire-extinguisher; installation of water barriers or walls in order to contain gas cloud and thermal radiation. Table 5

Conditions and calculated thermal radiation in case of release of methacrylate and fire Substance Mass of the release Temperature of release Surface of the pool Wind velocity Relative humidity Heat radiation flux at 0 m Heat radiation flux at 6.6 m Heat radiation flux at 12.5 m Heat radiation flux at 19 m

Methyl Acrylate 17,000 kg 20 "C 31.25 m2 3 m/s 75 % 23.7 kW/m2 12.5 kW/m2 5 kW/m2 1.5 kW/m2

1415

6. RUNAWAY REACTION Polymerization of acrylic polymers is an exothermal reaction with onset temperature corresponding to 350 K. As already reported, in order to reach reaction temperature and to provide next cooling, the reactor is equipped with a steadwater jacket. Process temperature control is realized by an automatic sequence device. The stirrer is connected to an automatic alarm and angular speed controller. The polymerization reaction is performed at a pressure of 1 atm, controlled by an automatic ICP, in an atmosphere of nitrogen: the flow rate of nitrogen varies during the process, in order to counterbalance the volume increase of the mass of reactants. The vapours produced during the reactions are condensed and recycled into the reactors by a shell-and-tube condenser provided with a relief device. Finally, the reactor is provided with a vent device. The top event is identified in the release of a cloud of acrylic monomers (3% v/v), with a rate of 3 kg/s. In applying Hazop to a batch process, the basic principle is to consider the timing and the operative sequence consisting in reactant charge, reaction and product discharge. The reaction step is divided into different stages: mixing, heating, polymerization, cooling etc. Being the time sequence of primary importance, in batch section the words “early-late” and “before-after” must consider timing and the event sequence [7]. Moreover, as suggested in [8], “sooner and later” guide words are to be adopted, while considering the relationship between the action and the time. In Table 6 is reported an abstract of the Hazop referring to the guide words “less” (quantitative decrease) and “more” (quantitative increase). It is possible to collect the main causes of deviations in these five events: 1 . wrong reactant feeding; 2. wrong temperature of reaction; 3. loss of cooling or inert alimentation; 4. fail of stirring; 5 . failure of high pressure device. The adoption of the Hazop study points out some action that could mitigate the risk; the quantification of this mitigation is realized applying the Index Method. Preventive actions were identified by the examination of the reactor, considering, in particular, the possible deviations that could take place on the control and auxiliary system (e.g. heatinghooling system, stirrer, feeding system etc). The results are summarized as follows: to install automatic flow regulation; to institute regular patrolling and inspection of the transfer line; to install reserve generator; to identify temperature check points;

..

..

1416

..

to install high temperature and high pressure alarms; to adopt redundancy of the cooling systems.

Table 6

Hazop section of one batch reactor of polymerization

Existent safe@ Guide Deviations Possible causes Consequences Action required devices words Less Loss of heating No complete Sampling Automatic flow regulation temperature vapour reaction; devices of product out of product standard Less flow Operator error Product out of Sampling Automatic flow regulation of catalyst standard devices of product Automatic flow Less flow Operator error Product out of Sampling regulation of reactants standard devices of product Losses on the IPool ISafety basin /Regular patrolling feeding line evaporation and [and inspection of 'ESS subsequent fire transfer line No stimng Mechanical Local increasing None Auxiliary power generator failure of stirrer; of temperature and runaway installation High loss of power integrity supply; operator reaction temperature error. occurrence control; training o operators Vent device Automatic flow More flow Operator error Sudden and ofreactants lregulation rapid reaction More flow I Operator error IProduct out of I Sampling /Automatic flow standard devices of the regulation of catalyst product Sudden and Vent device rapid reaction Loss of cooling Boil of reactant Vent device; Temperature alam More water level installation; temperature water; operator mass; error overpressure control; cooling pipeline and runaway temperature redudancy control Failure of Overpressure Vent device Pressure alarm More pressure pressure relief installation system, runaway

1

1

I

I

I 1

I

1

I

I

1417

The selected protective actions are: fire stop doors; thermal radiation protection walls; basins of containment in reactors and tank areas; installation of absorbent panels and powders. By applying the index method it is possible to recalculate the Index risk, as shown in Table 7: it is shown that the adoption of some safety devices can considerably reduce the global value of risk. Table 7

Risk indexes calculated for the analyzed batch reactor. Event Fire Confined explosion Unconfined explosion General Risk

FU

CRI

8.87 0.06 3.65 0.74 44.3 4.71 1110 30.57

Reduction% 99.32 79.73 89.37 97.24

7. CONCLUSIONS Process Hazards Review on existing plant, applied in order to meet with Seveso I1 Directive, deals with difficulties, while the use of retrospective Hazop is not completely useful because of its limitations and the time it required. In applying Hazop to a batch process particular consideration must be given to following topics: operative procedure and human actions; time-discontinuity of the process; thorough study of the number of operations coupled with complex chemistry, often encountered in this processes. The aim of this paper was to illustrate briefly a practical example of a technique, developed ad .hot, which combines the Index Method with the Hazop methodologies in order to identify quickly and carefully the most hazardous units of a plant and to provide a quantification of the risk. The evaluation of risk by the Index Method allows a univocal interpretation of hazards of an existing plant, related to the intrinsic characteristics, the chemistry and the environmental conditions, allowing to characterize every unit by a global risk index. On the other side, the technique attempts to overcome Hazop limitations for existing plants, taking into account all the interventions and modifications to plant design, by the use of experience, current best practice and actual tendency towards inherent safety plants.

1418

REFERENCES J.J. Mewis, H.J. Pasman, E.E. De Rademaeker, Improving Safety Health & Environmental Protection on Existing Plants Process Hazards Review. In: Loss Prevention and Safety Promotion in the Process Industries VIII, Elsevier Science B.V., Amsterdam, 1995, I, 93-105. J. Spourge, R. Pitlabo, Consequence modelling of hydrocarbons fire at Longford, Australia 25 Sept 1999, Hazards XV Conference, Hazard Symposium Series, Institution of Chemical Engineers, ManchesterUK, 2000. R. Graziani, L. Lepore, U. Poli, Metodo per l’analisi e la valutazione delle conseguenze di eventi incidentali connessi a determinate attivita industriali, ISPESL Fogli di Formazione, Milano, (1993), 1, IV. R.H. Perry, D.W. Green, Perry’s Chemical Engineers’ Handbook, 7th edition, McGrawHill, Australia, 1997 R.J. Lewis. Sax’s dangerous properties of industrial materials. VIII ed. Van Nostrand Reinhold, New York, 1992. C.J.H. van den Bosch, R.R.P.M. Weterings (eds), Methods for calculation of physical effects due to releases of hazardous materials (liquid and gases), 3rd edition, Committee for the Prevention of Disasters, The Netherlands, 1997. Kletz, T.A. Chung, P.W.H., Broomfield, E.J. and Shen-Orr, C. “Computer control and human error”. IChemE ed. Rugby, England, 1995. Knowlton, R.E. “Hazard and operability studies and their initial applications in R & D.” R & D Management, (1976) 7, 1.

1419

Assessment of health effects Thierry Gallot, Patrice Cadet ATOFINA - CTL Chemin de la L6ne BP 32 69492 Pierre Benite Cedex France

ABSTRACT The environmental impact around its plant sites is a major concern for the oil and chemical industry and special emphasis is put forward by national and european regulation on the health impact. This paper outlines how to assess these long term health effects. An environmental impact assessment is conducted according to a sourcevector-target logic. As a starting point for atmospheric impact, one needs to evaluate all existing emission sources, all ways by which these emissions disseminate into the atmosphere, and all potential targets for which adverse effects are anticipated. The criterion of exposure is the time-averaged concentration of a pollutant in reference to published no effects concentrations. The study tool is an atmospheric dispersion code characterizing the health effects according to the same standard logic : "source-vector-target". The source term is a point, area or volumetric source taking into account the release rate for every pollutant, as well as stack effects (kinetic and thermal). The vector corresponds to meteorological conditions characterized by wind speed, wind direction and atmospheric stability classes. The target is a location for which initial assessment of environmental impact shows a potential concern. A residential area would be a typical target to be investigated.

1420

The code calculates the time-averaged concentration of pollutants around the plant site, taking into consideration time-averaged source terms and timeaveraged meteorological conditions. Isoconcentration curves are thus drawn on a map to clearly visualize the impact of the projected or existing industrial activity. This tool has been applied to several Atofina plants and checked against concentrations measured in the vicinity of these plants. INTRODUCTION

During these last years, national and European legislation have stressed the need to adequately evaluate the environmental impact of the process industries. This evaluation is now required with special emphasis on health effects. As a result, there is a need for a well established methodology, together with adequate computing tools, to evaluate such effects. ATOFINA has developed and uses a computer code, DISPER, which allows the computation of time-averaged concentrations of pollutants released by our plants. This time-averaged concentration at a given location, in conjunction with known toxicity data, is the pertinent parameter to decide if long term health effect are anticipated at this location. The scope of this paper is to describe the main features of this code and to explain how it is being used. METHODOLOGY FOR EVALUATING ENVIRONMENTAL IMPACTS An environmental impact assessment is best conducted based upon a

"source-vector-target" logic. Only by clearly specifying the environmental features around a plant site can we evaluate how a given target (natural surroundings or human activity) is affected by the plant operation. We therefore need to specify, as represented on Fig 1 : 0 The source term of the release, typically the nature of the pollutants being released as well as their time-averaged release rates, the location of the release, the kinetic and thermal effects, 0 The vector of the release, i.e., how the pollutant travels from the source to the target : this is typically a wind speed, wind direction and atmospheric stability information, 0 The target, specified as the combination of a location, exposure conditions and a toxic criterion representative of the pollutant and the considered enxrirnnrnpntil nr heilth Pff-pt

1421

Fig. 1

In case of health effects the pertinent toxic criterion would typically be a time-averaged concentration of pollutant. For a certain number of pollutants, including carcinogenics, this long term toxic criterion corresponds to the dose of pollutant absorbed over an entire life time. Knowledge of the source term and the transportation vector allows the computation of an exposure level at the target location. This level is then compared to the target toxic criterion to conclude if a given health effect is attained or not.

DISPER CODE : THE COMPUTING SCHEME The accidental release of pollutants to the atmosphere has been studied for many years and well validated computer codes are available to this effect. Little has been published however on the more or less continuous releases at low level concentrations, typical of what might be expected from the normal operation of a plant. The dispersion model used in the DISPER code is a Gaussian type model. This model calculates the concentration of pollutant at every point in space, knowing the source term (location, release conditions) and the vector term (wind speed, wind direction, atmospheric stability). The emission height is corrected for kinetic and thermal effects based on the Cude [I] equation. The atmospheric stability is characterized by the

1422

Doury [ 2 ] model which includes two classes of stability. This model has been chosen as it has been extensively validated by the French nuclear industry. However, the code could easily be adapted to include the Pasquill model for atmospheric stability. For a single-source release, individual concentrations of pollutant at the target are computed for each set of meteorological conditions, i.e., wind direction, wind speed, and atmospheric stability. The total concentration of pollutant is the sum of these individual contributions weighed against the frequency of occurrence of the corresponding set of meteorological conditions. A typical wind rose for the plant site location provides the values to be used for these frequencies. For fugitive emissions, such as those resulting from potentially leaking valves, flanges, etc., the input to the dispersion model will be a virtual source. This source will be the combination of an emission rate and a volumetric source, generally the volume of the unit or part of the unit under consideration. For a multi-source release, the global concentration is obtained as the sum of the concentrationscomputed for each source. These concentrations are computed for a large series of targets around the plant site The code then treats these results to come up with concentration isoplots which may be superimposed on a map covering the area of interest. This allows for a quick appreciation of the exposure of residents around a plant site, as shows on the map below :

1423

DISPER CODE : COMMENTS ON THE MODELING

The Gaussian dispersion model used in the code is well adapted to evaluate time-averaged concentrations around a plant site. These concentrations, in conjunction with the duration of exposure, are representative of a toxic dose to be compared to a toxic dose criterion. First, these models have been shown to adequately compute concentrations for wind speed of 1 d s e c or more and for high distances. This typically corresponds to figures representative of health effects studies. Second, 2-D Gaussian dispersion models provide equations where the concentration is explicitly calculated fkom source terms data and transportation data. This significantly reduces the computing time which enables the code to be run on a standard PC. For 3-D models, the high number of individual concentrations to be calculated and then summed would not be possible on a PC with reasonable computing time and would require much more computing power. CONCENTRATION MEASUREMENTS AROUND PLANT SITES

ATOFINA ran a series of tests around one of its plant sites to see how measured concentrations could help in evaluating the environmental impact. Fig 2 shows how the wind direction highly fluctuates with time. The variations in wind direction are in the 5 to 15 degrees range during a 15 minutes time span. The computation shows that there corresponds to these variations in wind direction a rather high variation in concentration. Wind direction

13

14

15

16

17

1

time ( hour )

Fig.2

19

20

21

22

23

1424

Fig.3 shows for a deviation of 5 to 10 degrees in wind direction, the calculated concentration is ten times less than in the median wind direction.

During our test campaign, the measured concentrations were so low that the sampling needed to be done over a period of one hour. Considering the changes in wind direction during the sampling time, it is close to impossible to validate a dispersion model based on spot measurements of the concentration. ATOFINA is still looking into ways on how to improve this situation. As of today, however, this clearly shows how difficult it is to rely on spot measurements of target concentrations. As a corollary, this also demonstrates that computer modeling is a must for properly evaluating an environmental impact.

1425

CONCLUSION

The computation of time-averaged concentrations of pollutants based on Gaussian dispersion models is an appropriate way of assessing the health effects in neighboring residential areas. Such computation is likely to yield much more accurate results as those which might be obtained from fields measurements of concentrations. One should note, however, that for such a computation to be fully effective, one needs to have a good knowledge of the release term. REFERENCES [l] L. Cude, The Chemical Engineer, October, 1974, pp. 629-636.

[2] A. Doury, Commissariat a I'Energie Atomique, Rapport CEA-R-4280 (rev.Ol), "Une methode de calcul pratique et gCn6rale pour la prCvision numkrique des pollutions vkhiculkes par l'atmosphbre", Centre d'Etudes NuclCaires de Saclay, France.

This Page Intentionally Left Blank

Topic 10

Development of methodology, e.g. of risk assessment

This Page Intentionally Left Blank

1429

The ‘Purple Book’: Guideline for Quantitative Risk Assessment in the Netherlands P.A.M. Uijt de Haag, B.J.M. Ale and J.G. Post National Institute of Public Health and the Environment (RIVM), P.O. Box 1,3720 BA Bilthoven, the Netherlands

ABSTRACT The ‘Purple Book’ outlines the method to carry out a QRA calculation in compliance with the regulations in the Netherlands and overviews the various starting-points and basic data. The Guideline comprises a method to select installations to be included in the QRA, a set of default loss of containment events, default values to be used in the dispersion and effect calculations, and provides guidance on presentation of the results.

1. INTRODUCTION A Quantitative Risk Assessment (QRA) is a valuable tool for determining the risk of the use, handling, transport and storage of dangerous substances. QRA’s are used to demonstrate the risk caused by the activity and to provide the competent authorities with relevant information to enable decisions on the acceptability of risk related to developments on-site or off-site. If the results of a QRA in the decision-making process are to be used, they must be verifiable, reproducible and comparable. These requirements necessitate that QRA’s are made on the basis of similar starting-points, models and basic data. Ideally, differences in QRA results should only arise from differences in process- and site-specific information. A number of documents for attaining comparability in the QRA calculations have been published in the Netherlands over the years. The Committee for the Prevention of Disasters (CPR) has issued three reports, namely the ‘Red Book’, ‘Yellow Book’ and ‘Green Book’ describing the methods to be used in a QRA calculation. The ‘Red Book’, describing the methods for determining and processing probabilities, is to be used to derive scenarios leading to a loss of containment event [ 11. The ‘Yellow Book’ describes the models to determine the

1430

outflow and dispersion of dangerous substances in the environment [2], and finally, the ‘Green Book’ describes the impact on humans of exposure to toxic substances, heat radiation and overpressure [3]. All three books provide the scientific information to be used in a QRA on the basis of present-day knowledge. However, this information is not sufficient to carry out a complete QRA calculation. Additional information is needed, for example, information related to policy decisions and data for which adequate scientific knowledge is not available (yet). Usually, standard values for this type of data are set by consensus following discussions between representatives from industry, the competent authorities and the central government. Over the years, a need was felt to assemble all information into one report, making use of experiences gathered in conducting QRA analyses. The outcome then is the socalled ‘Purple Book’, a Guideline in which all necessary starting-points and data needed to perform a QRA calculation in compliance with the regulations in the Netherlands are recorded [4]. The Guideline also records the motivation for certain decisions and the base used for specific data and their validity. The information in the Guideline is to be considered as guidance to a QRA calculation and provides default values. The author of a QRA may deviate from the recommendations given if site-specific information demands it. However, deviations should be made in consultation with and be approved by the competent authorities, with the motivation documented in the QRA report. The Guideline is organised in the same way as a QRA calculation is performed. First, the installations that contribute significantly to the establishment’s risk are selected. Next, for each installation loss of containment events are defined, followed by the calculation of outflow and dispersion of substances in the environment. Finally, the calculation of the consequences is described. The Guideline is completed with chapters on the presentation of the results and a discussion on model development. This paper presents an overview of the contents of the Guideline, highlighting discussions on new subjects. 2. SELECTION METHOD

Since the total number of installations in an establishment can be very large, and since not all installations contribute significantly to the risk, it is not worthwhile to include all installations in the QRA. Therefore a selection method is used to indicate the installations that contribute the most to the risk and will have to be considered in the QRA [5]. The selection method is based on the amount of substance present in an installation, the dangerous properties of the substance, the process conditions and the location of the installation relative to the borders of the establishment. First, the establishment is divided into a number of separate installations. Installations are considered separate if loss of containment of one installation does not lead to the release of significant amounts of substances from other

143 1

installations, i.e. if they can be isolated in a very short time following an accident. Next, for all installations, the intrinsic hazard of an installation, A, is calculated as:

A=

O1 x02 x03 xQ G

where Q = the amount of substance present (in kg); G = the limit value for the substance determined by the dangerous properties of the substance (in kg); O1= a factor to account for process or storage; 0 2 = a factor to account for an outdoor or indoor location; O3 = a factor to account for the phase of the substance and the process temperature. Next, the hazard of an installation, S, at a specific location is calculated for a number of points on the establishment’s border and in the residential area nearby by modifying the intrinsic hazard of an installation, A, by a factor for toxic substances and a factor ( 100/L)3for flammable or explosive substances. L is the distance from the installation to the specific location in metres, with a minimum of 100 m. Finally, installations are selected for analysis in a QRA. An installation is selected if the hazard, S, is larger than one at a location on the boundary of the establishment and larger than 50% of the maximum at that location, or, if the hazard, S, is larger than one at a location in a residential area.

3. LOSS OF CONTAINMENT EVENTS The Guideline describes a default set of Loss of Containment events (LOCs) that need to be included in the QRA for establishments and their frequencies. The complete set of LOCs consists of generic LOCs, external-impact LOCs, loading and unloading LOCs and specific LOCs. The LOCs for establishments are described for stationary tanks and vessels, pipes, pumps, heat exchangers, pressure relief devices, warehouses and the presence and loadinghnloading of road tankers, tank wagons and ships. The LOCs and their failure frequencies are discussed here for pipelines, pressure vessels and atmospheric tanks only. 3.1. Pipelines The LOCs selected for pipelines represent ruptures and leaks. A rupture will be modelled as a full bore rupture, whereas a small leak is considered to be a hole with an effective diameter of 10% of the nominal diameter. The failure frequencies are given in Table 1. The failure frequencies are based on process pipework operating in an environment where no excessive vibration, corrosioderosion or thermal cycle stresses are expected [6,7].

1432

Table 1

LOCs for pipelines Pipeline Full bore rupture hka Diameter: < 75 mm Ix m-' y' 5x m-' y-' 3 x 10.' m-' y-' 2x m-' y-' Diameter: 75 mm I diameter I 150 mm Diameter: > 150 mm 1 x 10.~m-' v-' 5 x 10.~ m-' v-' a Leak is to be modelled as a hole with an effective diameter of 10% of the nominal diameter.

3.2. Pressure vessels Three different types of pressure vessels are distinguished, namely storage vessels, process vessels and reactor vessels. In a process vessel a change in the physical properties of the substance occurs, e.g. change in temperature or phase, whereas in reactor vessels a chemical change of the substances occurs. The LOCs selected for pressure vessels represent catastrophic failure and small leaks. Catastrophic failure will be modelled equally as an instantaneous release of the complete inventory and as a continuous release of the complete inventory in 10 minutes, whereas a small leak will be modelled as a continuous release from a hole with an effective diameter of 10 111111. The LOCs for storage vessels, process vessels and reactor vessels and their failure frequencies are given in Table 2. Table 2

LOCs for stationarv vessels and their freauencies Vessel type Catastrophic failurea Leakb Storage vessel 1x y-' 1 x 10.~y-l Process vessel 1 x 10'~ y-l 1 x 10'~ y-l Reactor vessel 1x y-l Ix y-l a Catastrophic failure is to be modelled as an instantaneous release of the complete inventory (probability 0.5) and as a continuous release of the complete inventory in 10 minutes (probability 0.5). Leak is to be modelled as a hole with an effective diameter of 10 mm.

The failure data are largely based on the research done in the COVO study [7]. The base failure rate of catastrophic rupture of a pressure vessel is set at 1 x per year and is applicable to static, vibration free, pressure vessels operating under conditions of no corrosion (external or internal) and thermal cycling, i.e. typical storage pressure vessels. The base failure rate of catastrophic rupture of process vessels and reactor vessels is assumed to be ten times higher than for storage vessels, i.e. 1 x per year. The failure rate of small leaks (a hole with an effective diameter of 10 mm) is assumed to be ten times higher than the catastrophic failure rate of the vessel. A deviation of the default failure frequencies is possible in specific cases. A lower failure frequency can be used if a tank or vessel has special provisions in

1433

addition to the standard provisions, e.g. according to the design code, which have an indisputable failure-reducing effect. However, the minimum frequency of catastrophic failure is 1 x lo-' per year. A higher frequency should be used in the absence of standard provisions or under uncommon circumstances, e.g. if external impact cannot be excluded. 3.3. Atmospheric tanks Atmospheric storage tanks are classified according to their type of protection. There are single containment atmospheric tanks, atmospheric tanks with a protective outer shell, double-containment atmospheric tanks, full-containment atmospheric tanks, and in-ground and mounded tanks. The LOCs of atmospheric tanks are the same as the LOCs of stationary pressure vessels, referring to the primary container only. The base failure frequency is assumed to be a factor 10 higher, whereas depending on the level of protection, the release is assumed to be either directly into the atmosphere or into the unimpaired secondary container. The influence of the various levels of protection is determined by expert judgement, leading to the results summarised in Table 3. Table 3

LOCs for atmospheric tanks and their frequencies, Tank Catastrophic failureagb Leakac Single containment tank 1 x 10.~y-l 1 x 10.~y-l Tank with protective outer shell 1 x y-l + (1 x y-') (1 x y-') Double containment tank 2.5 x y-l + (1 x y-l) (1 x lo4 y-l) 1x y-' Full containment tank (1 x y-I) In-ground tank Mounded tank 1x y" a Frequencies correspond to a release directly to the atmosphere and values in parentheses denote a release to an unimpaired secondary container, leading to pool evaporation only. b Catastrophic failure is to be modelled as an instantaneous release of the complete inventory (probability 0.5) and as a continuous release of the complete inventory in 10 minutes (probability 0.5) Leak is to be modelled as a hole with an effective diameter of 10 mm.

3.4. Discussion The assessment of the failure frequencies leads to discussions on the appreciation of the quality of the management system and the origin of the frequencies. The failure frequencies in the Guideline do not take the quality of the management explicitly into account. Various (international) projects have been initiated to assess the management system of an establishment and to evaluate the quality of the management by applying management factors to the failure frequencies [8, 91. However, a quantitative relationship between the

1434

1.E-03

1 .E-04

r

Ld

h

W inst.

Y

l.E-05 3

m

E

rc

1.E-06

1.E-07

i

Purple Book Fig. 1. Failure frequencies (instantaneous release and a large hole) used in the ‘Purple Book‘ for a pressure vessel compared to various literature sources as compiled in Ref. [lo].

quality of the management system and failure frequencies has not yet been clearly established; consequently, management factors are not widely used at the moment. The failure frequencies used are based on reports published about 20 - 30 years ago. A number of review studies published recently [lo, 11, 121 show a tendency towards higher failure frequencies than the ones reported here, as shown in Fig. 1. However, an update of the failure frequencies would require an investigation into recent data sources and an extensive analysis of original data sources to determine the validity of the data and their applicability to currentday practice. Since this investigation has not yet been realised, it was decided not to update the failure frequencies yet. Such an investigation, resulting in an update of the failure frequencies, is expected in due time.

4. OUTFLOW AND DISPERSION MODELLING Models to calculate the outflow and the dispersion of dangerous substances are extensively described in the ‘Yellow Book’ [2]. The Guideline provides the link between the various Loss of Containment events and the outflow models to be used. Although tank- and location-specific information should be used whenever available, default values relate to, for example, the location of a hole in the vessel and discharge coefficients. Furthermore, a number of topics are not covered in the ‘Yellow Book’, like the influence of repression systems on the

1435

outflow and dispersion of dangerous substances, time-varying releases and the probability of flammable releases being ignited. An illustrative example is the influence of the burst pressure of a vessel with flammable materials on the effect of a BLEVE. The effect of a BLEVE depends on the fraction of the generated heat radiated by the fireball. The fraction of the heat radiated is a number between 0.2 and 0.4 and is a function of the vapour pressure of the flammable material inside the vessel at failure [13]. Consequently, the burst pressure of the vessel is an important factor. However, the burst pressure depends on the cause of failure [2]. If failure is due to causes like corrosion or erosion of the vessel, a material defect, external impact or fatigue of vessel, the pressure at failure can be assumed to be the storage or working pressure. On the other hand, causes like overfilling or overheating in combination with failure of the safety valve results in failure at the design pressure x a safety factor (= usually 2.5). Frequently, the storage or working pressure is used in the effect calculations of a BLEVE. However, it is assumed that a BLEVE is caused by weakening of the tank vessel wall either due to a pool fire underneath the tank or to a fire nearby. Hence, the pressure at failure is set equal to 1.21 x the relief pressure of the safety valve. If no safety valve is present, the pressure at failure is set equal to the test pressure of the tank. 5. DAMAGE AND EFFECTS OF PROTECTION Models to calculate the damage and effects following the release of dangerous substances are extensively described in the ‘Green Book’ [ 3 ] . The Guideline describes the parameters relevant to calculating the societal and the individual risks, like the population present indoors and outdoors and the level of protection to be considered. The Guideline considers the lethal effects of exposure to toxic substances, exposure to blast waves and exposure to heat radiation. The lethality due to exposure to toxic substances is described by the probit function relating the probability of death to the concentration and exposure time,

where Pr = the probit corresponding to the probability of death; a, b and n = constants describing the toxicity of a substance; C = the concentration (in mg m-3); and t = the exposure time (in min). The probit function gives the probability of death for an unprotected individual remaining outdoors. Remaining indoors reduces the toxic dose since the concentration indoors is lower than the concentration outdoors during cloud passage. The effect of protection indoors may be accounted for by the generic factor 0.1 in the fraction of people dying indoors.

1436

The lethality due to exposure to blast waves is calculated using two radii of overpressure, 0.1 bar and 0.3 bar. The probability of death is assumed to be one if the peak overpressure is greater than 0.3 bar, whereas the probability of death is zero if the peak overpressure is less than 0.1 bar. For peak overpressures between 0.1 and 0.3 bar, people outdoors are assumed to survive, whereas only one out of forty persons indoors dies, due to collapse of the house. The probability of death due to exposure to heat radiation is calculated with the use of a probit function given in the 'Green Book' [3]:

0

Pr = -36.38+2.56xln Q4I3 xt

(3)

where Pr = the probit corresponding to the probability of death; Q = heat radiation in W m'2; and t = exposure time, in s. It is assumed that people die inside the fire envelope and within a heat radiation level of 35 kW m'2 due to ignition of clothes and the building catches fire.

6. USE OF NEW MODELS A QRA is intended to give the best estimate of the actual risk level caused by the activity; a QRA calculation can therefore lead either to an underestimation or an overestimation of the actual risk level. Since a QRA is intended to give the best estimate, the models used in the QRA represent the current state of technology and are regularly updated as scientific knowledge increases. New developments in hardware allow the use of more complex models. The application of an improved model in a QRA results in either an increase or decrease in the calculated risk, even if the actual risk is not changed. This is contrary to a more conservative approach, in which the calculated risk is assumed to be an overestimation of the actual risk; the application of an improved model here should result in a reduced overestimation. The use of continuously improving models in a QRA may lead to problems in the decision-making process. Examples are: - Zoning distances based on the location of the individual risk contours are set for a number of activities, e.g. transport pipelines and LPG filling stations. The use of an improved model will result in changes in the location of the individual risk contours and the zoning distances may appear to be no longer correct. - If a new QRA is made to determine the risk caused by an activity, the use of new models can lead to changes in the calculated risk. Therefore the risk caused by the activity seems to have changed, although the activity itself and the actual risk have not. - Countermeasures can be taken to reduce the risk. A new QRA is made to determine the effect of the countermeasures and to quantify the risk reduction

1437

achieved. However, the effect of the countermeasures and the risk reduction achieved can be obscured by changes in the calculated risk due to the use of new models in the QRA. The result of the new QRA may even show an increase in the risk calculated despite countermeasures. Recognition of the problems indicated above could result in the point of view that the models used in a QRA should be kept fixed to stay in line with previous results and with the decisions based on these results. However, scientific progress has led to improved estimations of the actual risk. Consequently, the gap between the best risk estimate, as calculated with the newest models, and the unchanging risk levels, as calculated with the fixed models, increases with time. Fixing the models can thus lead to other problems: - New models may indicate that larger zoning distances are required for some activities. If the zoning distances are kept fixed, a situation is created that is considered to be unsafe. - New models may indicate that shorter zoning distances are allowed for some activities. If the zoning distances are kept fixed, an excessively large area is taken up by the activity no longer demanded by the risk. It has therefore been decided to construct a QRA using the current state of technology and the best models available for this purpose. This is reflected in the approach in the Guideline: although a number of calculation methods are advised, more suitable models can be used when available. However, the user should demonstrate adequate scientific performance in applying new models. The scientific performance of the models should be demonstrated to the competent authority using the results of validation exercises, model intercomparison studies and/or publications. If the QRA using new models is made as an update of an existing QRA to incorporate developments on- and off-site, it is strongly advised to compare the results of the new and existing QRA to facilitate decision-making processes. The comparison should indicate both the effects of using the new models and of the developments on-site and off-site on the calculated risk. 7. QUESTIONS AND ANSWERS

Since the publication of the ‘hrple Book’, a number of QRA’s are carried out, e.g. for LPG filling stations. It appears that, using the Guideline, questions for clarification arise and discussions are initiated on the use of risk-reducing measures and their appraisal in the failure frequencies. To keep the users of the Guideline continuously informed on the answers given for clarification and the outcome of the discussions, a website will be set up. On this website, questions can be posted and, after approval in the Committee for the Prevention of Disasters, the answers will be published.

1438

8. CONCLUSIONS

The ‘Purple Book’ overviews the various starting-points and basic data used to do a QRA calculation in compliance with the regulations in the Netherlands. The Guideline comprises a method to select installations for inclusion in the QRA, a set of default loss of containment events, and default values to be used in the dispersion and effect calculations. Future research is directed towards an update of the failure frequencies of installations and the application of management factors.

REFERENCES Committee for the Prevention of Disasters (CPR), Methods for determining and processing probabilities (‘Red Book‘), SDU, The Hague, 1997. Committee for the Prevention of Disasters (CPR), Methods for the calculation of physical effects (‘Yellow Book’), SDU, The Hague, 1997. Committee for the Prevention of Disasters (CPR), Methods for the calculation of damage (‘Green Book’), Ministry of Social Affairs and Employment, Voorburg, 1990. Committee for the Prevention of Disasters (CPR), Guidelines for Quantitative Risk Assessment (‘Purple Book’), SDU, The Hague, 1999. Staatscourant, Nadere Regels met betrekking tot rapport inzake de exteme veiligheid (Ministerial decision, 3 February 1989, Stcrt. 31), SDU, The Hague, 1989. N.W. Hurst, R.K.S. Hankin, J.A. Wilkinson, C. Nussey and J.C. Williams, 1992, Failure rate and incident databases for major hazards, In: Proceedings of the 7” International Symposium on Loss Prevention and Safety Promotion in the Process Industry, Taormina, Italy, 4 - 8 May 1992, SRP Partners, Rome, 1992. COVO Commission, Risk analysis of six potentially hazardous industrial objects in the Rijnmond area, a pilot study, A report to the Rijnmond public authority, Central Environmental Control Agency Rijnmond, Schiedam, 1981. J.H. Oh, W.G.J. Brouwer, L.J. Bellamy, H.R. Hale, B.J.M. Ale and J.A. Papazoglou, The Irisk Project. Development of an Integrated Technical and Managment Risk Control and Monitoring Methodology for Managing and Quantifying On-site and Offsite Risk. In A. Mosleh and R.A. Bari (eds), Probablistic Safety Analysis and Managment 4.Springer Verlag, New York, 1998. B.J.M. Ale, J.G. Post and L.J. Bellamy, The interface between the technical and the management model for use in quantified risk assesment. In A. Mosleh and R.A. Bari (eds),-Probablistic Safety AnaGsis and Managment 4. Springer Verlag, New York, 1998. M.Th. Logtenberg, Derivation of failure frequencies for LOC cases, TNO, Apeldoom, 1998. AMINAL Dienst Gevaarlijke Stoffen en Risicobeheer, Handboek kanscijfers ten behoeve van het opstellen van een veiligheidsrapport, AMINAL, Brussels, 1994. J.R. Taylor, Review of failure rate data for risk analyses, Version 1 Issue 1, Neste and Taylor Associates ApS, Glumsoe, 1998. A.F. Roberts, Fire Safety Journal, 4 (1982) 197.

1439

RACKETman, pro-active risk identification and assessment methodology for organisational change Stefan Svensson

Akzo Nobel Surface Chemistry AB, SE-444 85 Stenungsund, Sweden 1

SUMMERY

A major re-organisation project called PSS2000 was started in springtime 1999 for the Akzo Nobel unit Production Surfactants in Stenungsund, Sweden. Management consultant studies suggested a 56% cut in staffing on operator levels as well as management level. With reference to the site HSE MS procedures regarding risk analysis in projects and management of change procedure the site HSE department looked for methods to pro-actively identify and assess risks related to organisational change. No methods were found in litterature. This lead to the ad-hoc development of the methodology we call RACKETman. RACKETman is based on the idea that four major concepts or corner stones are determining an organisation's ability to perform safely; structure and clearness of Responsibilities and Authorities, the coworkers Competence and Knowledge and the organisations work with Education and Training. Support resources, expressed as manpower for HSE activities is also important. RACKETman is a two step method. First risk identification and prioritisation is done and then detailed studies, based on detailed work task breakdown, are performed with risk assessment. RACKETman is proven in action and with its pro-active and preventive approach quite unique for risk analysis of organisational change. 2

INTRODUCTION AND BACKGROUND

January 1'' 1999 was the starting day for sub business unit Surfactants Europe (SBU SE) within the business unit Surface Chemistry (BU SC), Akzo Nobel. SBU SE was formed out of two existing SBU's and the management team immediately started the work to join these two parts. The economic situation for the SBU called for improvements and in the springtime a major economic

1440

revamp study was started for the Production Surfactants plant in Stenungsund, Sweden. The management consultant group IMAS, presently named ARV, did an improvement assessment study and their reports indicated that staff reduction from 103 full time employees down to 45 was possible, i.e. a 56% cut provided several work load reduction projects as well as technical investments was implemented. The project related to this study was named PSS 2000, Production Surfactants Stenungsund 2000. 2.1 Production Surfactants at Site Stenungsund Production Surfactants is a unit for production of nonionic, cationic, anionic and amphoteric surface active agents. The product range cover applications like Mining, Feed, Viscose, Cleaning, Personal Care, Agro etcetera. Production runs 24 hour’a day all year round in batch processes. In 1998 the plant was organised in two production departments, one process developmenthpport department, one shipping department for drumming, bulk loading/unloading, packed goods and shipping, and one QC lab department. Apart from Production Surfactants two other production units operate on the site, Basic Chemicals and Etylene Amines.

2.2 The change The PSS 2000 study suggested changes all over the Surfactants organisation, the main ones were;

P Joining the two production departments EMU and STF within Production Surfactants leading to major reduction in production management and production engineering support, as well as a major reduction in plant operators. One central control room. P Change to intermittent production, i.e. from 7 days a week to 5 days. P Excluding pilot plant activities and process engineering support from Production Surfactants. > Restructure Logistics department. Major cut in management and white collar jobs as planning and purchasing, as well as drumming, and fork lift driving operators. P Outsourcing bulk loadinghnloading to transporterddrivers. > Organising a PQC department with responsibility for process engineering and quality control. 2.3 Risk assessment Site Stenungsund have operated a HSE management system (MS) since the early 90’s. I S 0 14000 certification was done 2000, and Swedish regulations

1441

based on the Safety & Health at Work directive, 89/391/EEC is well covered within the HSE MS. Risk assessment is a natural part of the HSE MS and is used for all processrelated projects at Site Stenungsund. The site also has a Management of Change procedure. As for all bigger projects at the site, a site HSE department representative was involved in PSS2000 to ensure coverage of relevant HSE issues. For this project it was the author, the process safety engineer. 2.4 Organisational risk assessment A pro-active risk identificatiodassessment study on such dramatic organisational change had not been done at the site before 1999. Literature studies gave very little support. There are a lot of methods for organisational risk assessments but the ones found in literature were all re-active methods, i.e. used after an accident, incident or near miss to trace back to organisational shortcomings that could be the basic cause to the incident. The PSS 2000 project called for a new tool, a pro-active and preventive method, for risk identification and assessment of organisational change, this is the RACKETman. 3

RACKETman METHODOLOGY

What determines an organisation’s ability to perform well regarding HSE issues? The author suggested using four key expressions or safety corner stones, which are the basics for the RACKETman method and these key expressions are used in the two-step methodology;

9 9 9 9

Responsibilities and Authorities Competence and Knowledge Education and Training Manpower HSE activities

Firstly a cross-reference list between the suggested changes and existing HSE MS is used for risk identification and prioritisation. For the high prioritised issues detailed studies are done as step two. Secondly, detailed studies including some degree of risk assessment is performed.

3.1 First step, identification and prioritisation An extracted, condensed checklist was worked out for all the suggested changes. That list was combined with relevant parts from the HSE MS. The risk analysis team discussed, using the RACKETman safety corner stones, every

1442

item in the checklist and brainstormed around what issues/examples and risk indicators that could be affected. The team made a prioritisation of what item that could have a high risk potential and assigned work groups for further detailed studies. Examples from this first step work can be found in table 1. Table 1

Examples from PSS2000klSE MS checklist for risk identification and prioritisation Check list items

Issues/examples/risk indicators

Integrated control room

Surveillance unmanned hours? Probably better situation then today for STF during production hours.

Maintenance

Potential and action

Work permits and work Summer time turnovers with contractors - Off-production hours? -

Operations -five-day production -integration EMU/STF -integration laboratories -manpower field op. -manpower panel op. -manpower engineers

off-hour management backup High. WG 111. -1oggbooks -off-hour surveillance, field-rounds -start-uplshut-down more frequent -finish batch lateiearly, stand-by over weekend -stress -shiftsystem -control room, “aut” EMU, “man” STF, monitors -surveillance -communication, flow, technology, disturbances -job descriptions, organisation, competence , education, training -shift team competence, EMU?, STF?, common? -panel operators tasks, coordination, safety surveillance -priorities safety/production -time for rescue operations, eg activated emergency shower -incidents, tasks panelhield -production/proj ect support engineers, trouble-shooting

Operations logistics, drumming, lift trucks, bulk loadinghnloading

-stress -work alone -clearify working conditions -carrier competence our systems/technology -safety coordination responsibilities (legal)

High. WG IV

1443

Table 1

Examples from PSS2000/HSE MS checklist for risk identification and prioritisation Check list items

Issues/examples/risk indicators

Potential and action

-rail transports -carrier responsibility other actors (ex works), raw material s a r r i e r personal protection equipment -safety surveillance, technology, in practice, legal demands work alone, connecting/ disconnecting, loading/unloading Safety representatives

Available time

Accident and near miss report system

Available time

First-aid people

Available time for training

Preventive field inspections

Available time

Field rounds

- off-hours - structure, planning

Education, training

- concentration, focus education vs production -engineering support

Risk identification and assessment work, exposure measurements

-administration -cooperation site HSE dept -PQC -resources, competence

Work permits

Off hour backup -off hour work

Personal protection equipment, breathing air apparatus

Competence, responsibilities -outsourced partner, e.g. transportedcarrier equipment

New product introduction, lab, pilot, production

PQC -procedures -responsibilities -available time

Emergencies, minimum manning

Resources -available time -off hours

High. W G V

High. WG VI

1444

3.2 Work groups for detailed studies As for all risk analysis work, the quality of the result is very much dependant upon the people and competence involved in the work. The chairman need to be highly competent when it comes to chair meetings, letting every participant have a say without moving away to much from the basic structure and time schedule. Above all the chairman need to be familiar with the methodology used. In the PSS2000 studies totally six WG’s were formed, three of which the author chaired and three chaired by a colleague with many years experience from risk analysis work. Participant’s need to very familiar with the system being analysed, confident in themselves and their knowledge, open hearted and good at abstract thinking. The participants for the PSS2000 studies came from department management, process- and logistics operators and safety representatives from blue collar union.

3.3 Second step, detailed study and risk assessment After the first step with risk identification and prioritisation, the six work groups were formed and assigned the high prioritised parts. For every part a detailed work task breakdown was done. As-is situation was compared with the planned to-be situation and if the suggested changes affected the specific work task, the WG as concrete as possible pointed out hazards, described possible consequences, assessed the risk and defined and assigned action points to responsible persons. Basically the RACKETman safety corner stones were used in this step also. A few examples from the detailed study can be seen in table 2. Table 2 Examples from detailed study Work task As-is

To-be

Open correct drumming route

New Log dept to drum from area 2 also, not a Prod dept task.

Action/ Hazard

Consequence

Assessment

Comment

Release and leak hazards due to ”unknown” products, new systems, more hose connections for Log dept drummers.

Exposure, injuries, release, environmental risk.

Increased risk if not competence for systems and handled products are safeguarded.

Action 3a: Present education and training plan and competence profile for an area 2 drummer

Assigned:

1445

Table 2 Examples from detailed study Work task As-is

To-be

Actiod Hazard

Consequence

Assessment

Comment Plant Mgr Time:

Truck, railcar, container directed to correct loading station

No defined resources for this task. TV camera?

Driver goes to wrong loading station or wrong place

Traffic in a dangerous area, e.g Exarea

Personal protective equipment for driver

Wrong product loaded or unloaded

Could be very Action 14a: serious Adequate comm. systems need to be in place. Proven t e c h . NB language issue! Assigned: Plant Mgr Time: Action 14b: Clarify the plant responsibility regarding safety coordination with drivers organistaion. Assigned: Site HSE Time:

Resources available for resque operations at Basic Chemicals or Ethylene Amine in an emergency situation.

Very limited resources for this, and definitely so during unmanned hours.

Emergency escalation.

Possible difficulties to limit consequences in an emergency situation.

Action 27: Clarify site responsibility and back-up resources Assigned: Site Mgr Time:

1446

4

DISCUSSION

Allthough RACKETman was developed in an ad-hoc situation under great time stress it proved to be a systematic and structured way of working for this difficult and sometimes abstract area of risk analysis. It has given us a method to analyse risks in other organisational change situation as well. A side effect of this structured approach was also noticed in the organisation. Suddenly this drastic and for many coworkers, personally dramatic change, could be handled in concrete terms and discussions which are so important in order to bring some forward thinking and positive thinking into the organisation. 5 ACKNOWLEDGEMENTS Firstly I would like to thank b u t Andren, site HSE manager at Site Stenungsund. Knut is a dedicated HSE person and is responsible for the creative environment at the HSE department which gives the coworkers support and confidence in seeking new ways in their work as this paper describes. Secondly I would like to thank my colleagues Kerim Sasioglu and Arne Carlsson that helped me develop RACKETman. Last, but definitely not least, I would like to thank all my co-workers that participated in this important PSS2000 study. Several do not work at the site any more but contributed a lot to keeping the risk level down with their contribution in this study.

1447

A Comparison of Deterministicand Probabilistic Risk Assessment Methodologiesfor Land Use Planning J.R.Tayloraand Y. Weberb aTaylorAssociates ApS, Erantisvej 5,4171 Glumso, Denmark JRT-ITS [email protected] Ludan Engineering Ltd, Checkpost, Haifa, Israel Weberl @Ludan.co.il Abstract Quantitative Risk Assessment has come to be used in a systematic fashion for land use planning purposes. Some countries have developed officially approved QRA methodologies to support the planning process. Unfortunately, some counter intuitive examples arise in the application of these methodologies, where the decisions turned out to depend more on weakness in methodology than on the physics and statistics of plant accidents. Because of this, a concerted effort was made to provide a QRA methodology which could produce consistent and reproducible results, in agreement with actual accident statistics. As an alternative, deterministic land use planning criteria were developed.. Background

Quantitativerisk assessment, at its best, provides an excellent tool for risk assessment and risk minimisation for process plant. It can also provide a basis for land use planning decisions which is “universal” in that it allows a full range of accident problems to be taken into account, and is flexible enough to allow new plant and process types to be incorporated into the assessment methodology. The actual practice of QRA in land use planning (a observed in a number of cases) however reveals a number of drawbacks: 1. Criteria are often used for selection of just the larger inventories for analysis. These criteria often result in some of the largest contributors to risk being overlooked. One widely used methodology, would in fact eliminate accidents of the type that occurred at Milford Haven in 1994. There are two problems here . One is that the domino effect risks from small inventories are suppressed from the analysis. The other is that accidents arising from substances flowing to the “wrong” place, as at the Milford Haven refinery, are ignored. 2. Existing methodologies do not provide for a full range of accident types. Typical omissions are boilover, fire induced tank explosion, and sewer explosions.

1448

3. In modem practice, standard lists of release frequencies are used (e.g. [9], [14]) These lists have been found in some cases to be in error by several orders of magnitude when used outside their originally intended context. 4. There is at present an almost total lack of documentation of the assumptions underlying the release frequency, ignition probability, and safety measure reliability values. Using frequency data without knowing the assumptions on which the data is based is a little like buying a used car without enquiring about the make, year or price.

As a result of these problems in actual cases, deterministic criteria have been proposed in several countries. These select specific accident scenarios and calculate safety and planning distances on this basis. There is a difficulty, however, in deciding which scenarios to choose. In order to investigate these problems, a full scale investigation was carried out, the QRA Quality project. Four methodologies were rigorously defined, and applied to six different “virtual” plants. This allowed detailed sensitivity analysis to be carried out, both on variations in methodology, and variations in plant design. The plants were a 300000 bbl per day refinery, a fertilizer plant with ammonia and sulphuric acid production, a speciality chemicals plant, a pharmaceuticals plant, a chemicals warehouse, and an LPG storage terminal. Complete flow sheets, piping and instrumentation diagrams and plant layout were developed for these. Three different sitings were investigated for the plants, one typical of Central and South America, one typical of the Middle East, and one European. These different sites affect the distance to other industry and to population centres, average temperatures, and wind speeds.

The methodologies chosen for investigation were based on the Dutch ‘‘Purple Book”[l4]; a methodology based on deterministic criteria; one which is based on quantified hazard and operability analysis; and an upgraded QRA methodology which uses US statistics for plant accidents collected under the RMP rule. The methodologies differ in the degree to which they use plant failure rate data. In some methodologies accident frequency data is only given for “vessels, tanks,hoses”,i.e. a limited list. In the last methodology, accident frequency data were obtained for 60 different equipment types. Upgraded consequence models were also used, based on reports published by UK HSE and by Shell. In order to investigate the effect of safety engineering standards, each plant was analyzed with three assumptions about standards. The first used practices based on US and international standards from the 1970’s, the second made use of modern US international standards and the third made use of “high integrity engineering” principles. Plant layout and spacing were also investigated.

The effect of differing safety management standards was investigated by means of a detailed model, based on an extensive review of accident cases, and on data from safety audits at a large number of plants of the kind studied. On the basis of the studies, it was possible to identify some of the pitfalls involved in using simplified methodologies. Emphasis was focused on those cases which would

1449

lead to bad safety engineering advice. A few instances were found in which it is impossible to reconcile standard QRA methodologies with good safety engineering practice. The studies also allowed different risk acceptance criteria to be investigated. There is by now a reasonable consensus about the numbers used for risk acceptability criteria., but the interpretations differ between countries. The sensitivity studies were used to investigate the feasibility of satisfying the different criteria under different conditions of siting and prevailing weather. One special aspect of risk assessment is the sensitivity of the results to assumptions about human error. Most of the simple whole plant QRA methodologies avoid this issue, and focus on equipment failure only. It was possible to deal with this aspect of risk assessment by means of an extensive collection of root cause analyses carried out over a period of years. This enabled the frequency of accidents arising from human error to be determined directly for different equipment types. These data were incorporated into the equipment failure rate data base. Because the plants investigated are "virtual" i.e. do not exist in reality, it is possible to review the analysis results openly, without problems of commercial security arising. The examples can therefore be investigated and reviewed by specialists quite openly. The plants are being used for teaching safety engineering courses at the master degree level. Release frequency data from the US RMP reports

The US industry has completed the majority of reports required by the Risk Management Plan rules. These reports have been made available on the internet, about 1500 reports in all. They contain five year accident histories of accidents for accidents with offsite consequences. Only a small fraction of the reports could be used as a basis for deriving release frequency data at the unit process level, because it is necessary to determine just how many pumps, tanks, vessels etc. there are in the plants in order to provide the denominator in the frequency calculation. The amount of equipment could only be determined for eight types of plans so far, covering about 2000 releases. The data have the advantage that they are collected according to standardised criteria, and, unusually, contain data about the plants which have not had accidents. Just a couple of sets of data (out of many) are shown to illustrate the results. Figure 1 shows data on vessel release frequencies from the RMP data, copared alongside data based on API refinery statistics used previously by the authors, data derived from detailed hazop and fault tree analyses, and Dutch regulation data for very rapid releases (vessel contents within 600 sec). Of course the various data need careful consideration of the factors underlying the differences. Figure 2 gives the hole size distributions which could be derived for one of the plant types studied.

1450

Figure 1, Vessel release frequencies

Figure 2. Hole size distributions

Observations from the QRA comparisons When the results of the QRAs were studied some results could be determined which are obvious a priori, but which could be quantified. Three sets of isorisk curves are shown, for a refinery at the fictional site. These are calculated respectively with changes in engineering standard and with different methodology

1451

Fig. 3 Fire and explosion risk and toxic release risk for refinery at a fictional site, case with artificial symmetrical wind rose, API 1978 accident data as basis

Fig 4 Fire and explosion risk and toxic release risk for refinery at a fictional site, case with artificial symmetrical wind rose, API data, high integrity safety engineering.

Fig. 5 Fire and explosion risk and toxic release risk for refinery at a fictional site, case with artificial symmetrical wind rose, Purple Book data

1452

The differences in safety distances for the refinery to per year individual risk curve, when exposure was taken into account varied from 200 m. to 1.8 km, depending on the data source used, and on the engineering standard assumed. The safety barrier approach to risk acceptance

The safety barrier method is a semi quantitative approach to risk acceptance. The key ideas underlying the method [ 11:

1. Potential accident scenarios are described by means of event sequence diagrams, with initiating events on the left, progressing to a critical event at the centre, and with a tree of potential consequence events at the right. The diagrams are thus very similar to cause consequence diagrams 2. The designed or engineered safety measures, and any other risk reduction measures such as safety distances are marked onto the event sequence diagrams, as barriers. 3. The quality of the barriers is assessed.

4. The overall risk is assessed on the basis of initiating event frequency, the severity of the consequences, and the number and quality of the safety barriers.

The emphasis on quality assessment of safety barriers is one of the key features of the method. Quality assessment goes beyond simple availability calculations and takes into account many design review issues. It is this aspect which appeals to many engineers. A passive barrier is defined as one that requires no movement or expenditure of energy in order to function. Examples are dikes and bunds around tanks, fire walls, and blast walls. An active barrier is one that does require movement or expenditure of energy to

function. Examples are a safety relief valve or an emergency shutdown valve together with its sensors and activation systems. A procedural barrier is one that involves a person carrying out a procedure in a safe way. One example is the correct draining of water from an LPG vessel, using dual valves, one with spring return. Another example is monitoring of temperature rise in a batch reactor, and applying cooling water if the rise is too fast.

A circumstantial barrier is any set of naturally occurring circumstances that serve to reduce risk. Examples are low exposure to risk, in the case of an operator who only visits a hazardous area once per day, in order to take samples. Another example is that of wind direction, which may only blow in the direction of habitation some 10% of the time, for example.

1453

The concept of a circumstantial safety barrier is often surprising and not particularly easy to grasp, but it is needed if the safety barrier philosophy is to be used for risk assessment purposes. By definition, a high quality active safety barrier is one that reduces risk of a single accident scenario by two orders of magnitude. This definition is chosen because it is achievable by careful design with conventional techniques such as pressure switches, transmitters, relays, circuit breakers and shut down valves. To ensure that such risk reduction is achieved, the safety barrier must satisfy a list of requirements. A very general set of such requirements has been given for barriers in general, and detailed requirements for wide range of specific safety barriers are given in [ 171 and [20]. Passive barriers typically reduce risk by three or four orders of magnitude, provided that they are complete i.e. cannot be by passed. Passive barriers typically fail due to lack of maintenance, or due to operational errors e.g. a fire door left open. Procedural safety barriers are generally regarded as lower in quality than active or passive safety barriers, and generally or only considered to be worth one order of magnitude in risk reduction. Under certain circumstances, though, such as in preflight checks on aircraft, procedural barriers can deliver much higher reductions in risk.

Initiating event

Typical frequency per year

Consequence assumed

Degree of exposure

Pump seal leak

1 to 0.1

Fatality

100%

No. of high quality barriers to achieve criterion 3

1%

2

Tank ovefflow

0.3 to 0.1

Fatality

Runaway reaction

0.01

Fatality

100% 1% 10%

3 2 2

Fatality

10%

1

[oseruDture in large unit Vessel rupture

10.01

0.0001 (in absence of protective measures)

Table 1 Typical numbers of high quality safety barriers required to meet per year release frequency criterion for a single accident scenario. Note that these values depend on assumptions as described below.

1454

Distance as a safety barrier

Distance from a potential release of hazardous material obviously reduces risk. If the distance is greater than the worst case accident distance, the risk reduction is absolute. At lesser distances, the risk depends on the width of the toxic plume or cloud at the particular distance, and the probability for a particular wind direction and speed (the wind rose). A normalised table risk reduction level as a function of distance for toxic releases was calculated in [l]. Other release types have since been investigated (to be published) and show a similar pattern as follows: -

a factor 100 reduction distance 25% of the maximum distance for instantaneous release, for neutral dispersion

-

a factor 1 000 reduction at a distance of about 60% of the maximum for instantaneous release, for neutral dispersion.

-

a factor of 100 reduction at a distance about 50% of the normalisation distance for heavy gas dispersion

-

a factor of 1 000 risk reduction at a distance of about 100 % of the normalisation distance, for heavy gas dispersion.

Of course there are many assumptions underlying these simple rules of thumb, in particular assumptions about terrain, wind rose and release type. Deterministic procedure for land use planning

The objective in devising a deterministic procedure for land use planning was to allow calculations made on the basis of specific and detailed scenarios which are transparent and checkable (QRAstend to be quite opaque) but which nevertheless give similar or identical results to the QRAs. The method chosen can be described in simplified form as follows: 1. Investigate each plant unit which has some inventory of flammable or toxic

substance. Check by calculation whether there is a possibility for any release, fire or explosion to reach the public, by any physically possible means such as pipe break, overpressure rupture of a vessel, or internal explosion. (Whether the release is physically possible may be determined by investigating whether any similar releases have occurred elsewhere in the world - there is enough data for this.) 2. Develop scenario descriptions for all the release types, and mark on the resulting safety barrier diagrams the number of safety barriers. 3. Check that the assumptions underlying table 1 (or its equivalent for other risk tolerance criteria) are actually satisfied. 4. Retain as "design basis accidents" those accidents which have insufficient safety barriers to reduce the scenario risk to a level significantly below the risk tolerance criterion . As a starting point, retain those which have only the number of barriers

1455

shown in table 1. Discard those which have at least one additional barrier i.e. have a frequency which is between and lo-'. Discard also those scenarios which do not have significant consequences outside the heavy industrial zone. 5. Calculate consequence distances for the design basis accidents. For each location, (each unit) take the largest of these. This will be the planning distance for that unit 6. Draw the circle for the planning distance for each unit, and take the envelope of the circles. 7. The need for safety barriers can be relaxed if there are only very few design basis scenarios. The complete procedure is more complex, because it takes into account wind speeds, domino effects, release and exposure times, and different land use planning zones.

An excerpt from the assumption list for on equipment type (chlorine storage) is given in table 2. In all, forty standard sets of scenarios, along with assumption lists, have so far been developed. Assumption

Slow filling of liquid chlorine pipes by manual or automatic control No or only insignificant external vessel corrosion Periodic vessel NDT inspection, once per 7 years or more frequent Emergency shutdown valve on liquid exit

Yl

N

Effect on scenarios if assumption is not satisfied Rapid opening can lead to pipe rupture due to hammer effects Increased probability of vessel leak or rupture Increased probability of vessel leak or rupture Increased duration of release from piping Reduced reliability of ESD

Base failure frequency pr. yr.

Additional failure frequency if assumption false 1o - per ~ Year

Additional barriers required if assumption false 1

1o -per ~ year if corrosion heavy 10.' per year

0.5

Piping release scenarios fr. * 30 ESD valve tested Piping periodically, at release least once per year scenarios fr. * 30 Table 2, Excerpt from an assumption list. Fractions of a barrier rounded to whole number

1456

Discussion

Both the deterministic and probabilistic methods were applied for all the test plants and locations described earlier. The results for the QRA approaches were disappointing. The same plants, calculated for identical conditions, but using different methodologies, yielded widely varying planning distances. The planning distances were also heavily dependent on the source of release frequency data. Three conclusions which could be drawn are:

- Data for QRA should not be used outside the context for which it was originally collected.

- The dependency of risk calculated risk values on methodology means that methodology and acceptance criteria cannot be separated. When a country decides on a risk acceptance criterion, it must at the same time choose a risk calculation methodology which gives a sensible decision basis. The problem arises because although QRA appears to be very “scientific”,the existing methodologies do not satisfy the basic requirements for valid science. - No calculation should ever be used as a basis for serious decision making unless the assumptions underlying the methodology and data selection are made clear. The deterministic method described produced land use planning distances very close to those of the augmented QRA used together with data based on the US RMP and ARIP statistics for off site releases. This is hardly surprising. The deterministic and probabilistic methods have also been applied alongside each other, in one case for planning at a completely new LPG terminal and packing station site, and in the other case, for planning for extension of an industrial area. The experience has been that the assumptions which lend the method quality, can be checked reasonably quickly by an experienced plant engineer. Typical effort required is 2 to 4 analyst hours per unit process. At the time of writing there is still some work to do to make the treatment of domino effects more streamlined. The deterministic method has been quite well received by engineers and planners alike, because it is quite transparent. It is fairly easy to identify ways to solve the problems which arise in planning (usually insufficient distance or space) by engineering methods. The planners have had rather more faith in the calculations, and less suspicion that these have been manipulated to satisfy planning needs. There is of course a built in uncertainty in the deterministic methodology, of on average one order of magnitude, but this has turned out in the sensitivity studies to be about the same or better than the methodological uncertainties in current QRA methodologies.

References and Bibliography [ 11 J.R.Taylor, C.G.Petersen, J Kampmann, L. Schepper, EK Kragh, RS Selig,

P.Becher, K.E.Petersen, Quantitative and Qualitative Criteria for Risk Assessment, Miljoprojekt 112, Danish Environmental Agency 1989

1457

[2] J.R.Taylor and E Vangsted A Comparative Evaluation of Safety Features Based on Risk Analysis for 25 Plants. Int Symp Loss Prevention and Safety Promotion in the Process Industries, Taonnina, 1992 [3] Office federal de l'environment, des forets et du paysage, Critkres d'appreciation pour l'ordonnance sur les accidents majeurs OPAM, 1996 [4] Int conf. Ammonia Transportation Risk, Haifa 1999 [5] A.Amendola, Contini, Ziomas, Uncertainties in Chemical Risk Assessment,: Results of a European bench mark exercise J. Hazardous Materials, 1992 [6] A.Amendola. Presentation to Danish Engineering Society, RISK, 2000 [7] Technica Ltd. Techniquesf o r Assessing Industrial Hazards, technical paper 55, The World Bank, [8] Interprovincial Overleg. Guidelines for the Preparation of Offsite Safety Reports, Report P O A-73,1994 [9] Hurst, Hankin, Wilkinson, Nussey, and Williams, Failure Rate and Incident Data Bases for Major Hazards,, Int Symp Loss Prevention and Safety Promotion in the Process Industries, Taonnina, 1992 Munday, Phillips, Singh and Windebank, Instantaneous Fractional Annual [ 101 Loss, Loss prevention and Safety Promotion in the Process Industries, 31d Int Symp. Basle 1980 [ 113 Bellamy and Geyer, Organisational, Management and Human Factors in Quantified Risk Assessment, HSE CSR No. 3311992 [12] C. Matthiessen, Current status of the RMP reporting. Workshop presentation, Int conf and Workshop on Modeling the Consequences of Accidental Releases of hazardous materials AIChE 1999 [ 131 Cox, Ang, and Lees in Hazardous Area Classification ,I Chem E. Although the purpose of this publication was to derive a better basis for hazardous area classification, it provides one of the few risk analyses for a complete plant in which all the basis assumptions are explained clearly, and it is, in addition to this, a piece of work of high quality. [14] B Ale et al. Guidelinesf o r quantitative risk assessment, Purple Book, Director General for Social Affairs and Employment 1999 [ 151 Rijnmond public Authority Risk Analysis of Six potentially hazardous Objects in The Rijnmond Area, Reidel, 1982 [16] J.R.Taylor Review of Release Frequency data f o r Risk Assessment 2nd edition, Taylor Associates ApS, 1999 [ 171 J.R.Taylor Process Safety References, Taylor Associate 1994-2000. [18] J.R.Taylor Risk analysis Methodology for Process Plants. 3rdEdition 1999 [ 191 J.R.Taylor. Guidelinesfor application of failure rate data, 1998 [20] J.R.Taylor Process Safety Engineering Manual, 2ndEdition, 1999 [21] J.R.Taylor. Comparative study of Process Plant Risk Assessments, 2000 [22] J.R.Taylor Quality Standards for Risk Assessment, 1996 [23] J.R.Taylor ,Hazardous Materials Accidents in Train Marshalling, 2000 [24] J.R.Taylor, Review of Road transport Accident frequencies, I999 [25] J.R.Taylor, Review of Component Failure Rates for Risk Analyses, 1998 [26] J.R.Taylor, A Deterministic Approach to Risk Assessment for land use planning, 2000 1271 J.R.Taylor, Application of Risk Acceptance Criteria and QRA Methodologies for Land Use Planning in Four Countries , Int. Conf. On Risk Acceptance Criteria, Sao Paolo, 2000

This Page Intentionally Left Blank

1459

Four explosions: four times static electricity was the most probable ignition source M.Th. Logtenberg TNO-MEP Department of Industrial Safety P.O. Box 342,7300 AH Apeldoom, The Netherlands 1. INTRODUCTION

TNO is an independent organisation carrying out scientific applied research in widely diverging fields. One of the activities is to investigate the cause of accidents on request of industrial and insurance companies. Such an investigation can make benefit of the input of any of the 5,000 employees to be consulted through the internal network of TNO. The accident investigations and the analyses of accident descriptions [2] reveal that mostly not one particular event is the cause of an accident, but that more factors play a role. The contributing factors are for many reasons often difficult to identify afterwards, for example the accident has wiped away the necessary proofing facts or the recollection of involved people is influenced by the accident. An example of difficult proof afterwards is in the case of explosions where certainly no open flame was present and the only credible explanation is the formation of static electricity. Below four examples of recent accidents investigated by TNO are described. In each case static electricity was taken as the most probable cause. The circumstances were, however, quite different. The reason to mention the accidents here is to make designers and operators aware of the fact that static electricity still can play a role despite the normal standard precautions have been taken. TNO is of the opinion that the possibility of static electricity may be underestimated and should have more attention in the system analyses of a design.

1460

2. ACCIDENT INVESTIGATIONS

2.1. Explosion in a compressed air buffer system

2.1.1. System and accident The compressed air system is part of a hydraulic system and consists of cylinders with a volume of several cubic metres and piping. The pressure in the system is about 60 bar and is maintained by a set of compressors. Depending on the operation conditions more or less cylinders are on standby. If additional buffer volume is necessary an operator is requested to open a manual valve placed under a cylinder, thus connecting the cylinder to the main system. The air pressure in the cylinder is mostly higher than in the main system. The explosion in the system occurred just at the moment, or shortly after, the operator had put one or more cylinders on stream by opening the respective manual valves. The damage was mainly in the header piping and subsequent lines to the hydraulic system. The operator was severely injured.

2.1.2. Investigation The investigation of the accident concentrated on the type of flammable substance and source of ignition. First of all the lubricating oil of the compressors were thought to have spread in the system, but analyses of the substance on the walls of the cylinders did not justify that assumption. The only material that was found were traces of the hydraulic oil. Besides that, the flammable components analysed in the traces hydraulic oil did not match the product specification. Further investigation made clear that the analysed component was part of deliveries some years ago and that a substantial amount was inserted into the cylinders to prevent internal corrosion of the cylinders. The hydraulic oil was generally believed to be not flammable because of the high water content. Further analyses showed that the water content had decreased, resulting in an increase of the flammable content. Additional to this it was found that residues of acids after a cleaning operation were present in the oil. The possibility of static electricity could be explained by the fact that a small amount of the flammable material from the walls accumulated before the ball valve of the manual valve. On opening of the manual valve in a quiet way the oil became dispersed in the header line, thus forming droplets that became electrically charged. The fact that an ignition occurred at that very moment may also be due to the presence of residues of acids.

1461

2.1.3. Lessons learnt The lessons learnt are several. First of all the assumption that the material was not flammable, which was true in its original composition, but it became flammable after a long time of use. Secondly the oil could accumulate before an opening where it could be atomised. Precautions should have been taken to drain the oil and at least not could be displaced by a moving air stream. Thirdly the cleaning operation that had left residues of acids should have been done more thoroughly. This accident proved again that several factors in combination led tot the accident. The difficulty is to foresee the possible dangerous situation. At least the placing of the valve should have been designed otherwise. 2.2. Explosion in a high-pressure air supply system

2.2.1. System and accident The explosion in another compressed air system that was investigated had little similarities with the previous accident, except for the fact that the air pressure was also high (more than 30 bar) and that compressors provided the necessary air pressure to a buffertank. A certain amount of air had to be delivered in a rather sudden pulse with high velocities. In order to prevent entrainment of compressor lubricant an oil demister was placed in the line between the compressors and the buffer tank. Before the oil demister a dehumidifier was installed. Shortly after the first practical runs a fire was noticed in the oil demister. The manufacturer discussed the findings with his suppliers and as a solution some adaptations were made especially with respect to the earthing of the demister. This proved to be of no help and a second explosiodfire took place in the demister. 2.2.2. Investigation On investigating the accident it became clear that after some time in operation an oil film formed at the outside of the demister. During the sudden impulse the oil became atomised. It was strange that in this system this could lead to a fire as comparable systems were designed almost identical. The only difference was the place of the dehumidifier. In the other systems the dehumidifier was located after the demister. Apparently the very dry air caused more than else the formation of static electricity.

1462

In order to verify the assumption of the correct place of the dehumidifier a literature search was done. The result was that quite a number of articles gave a description of comparable accidents that had taken place in the past. Recommendations directed mainly to too high temperatures of the outlet air of compressors, but also to dehumidifying not before but after removing oil particles and vapour.

2.2.3. Lessons learnt The lesson learnt here is that a small adaptation in the design led to the accident. If the designer or operator would have known the reasons for a certain design the accident could have been prevented.

2.3. Explosion in an incinerator 2.3.1. System and accident The incinerator was installed mainly to prevent odour nuisance from a plant with off-gases containing low concentrations of organic components. A main part of the incinerator was a buffer tank in which from time to time a part of the off-gases was re-circulated, in order to increase the effectiveness of the incinerator. The explosion took place about 15 hours after the first demonstration run. The incinerator was badly damaged, especially the buffertank.

2.3.2. Investigation The investigation of the accident revealed that a leak in the instrument air system has caused the incorrect fimctioning of the main valves for re-circulation. Furthermore a sensor was incorrectly installed and the software contained a programming error. The ultimate result was that the concentration of natural gas, the fuel for the incinerator, had increased in the buffertank. The possibility of ignition of the gas mixture was not directly to be explained. The only explanation that could be given is that in the large buffertank a cooling down had taken place during the night and that this has caused the formation of electrically charged droplets. The explanation was not very satisfying, but all other possibilities were not likely such as short cuts of electrical wires, sparks from metal to metal contact or an open fire.

1463

2.3.3. Lessons learnt The lesson learnt here is that the design should be adapted in such a way that on a system fault the concentration of natural gas cannot increase. Furthermore strict checking procedures have to be applied to prevent installation errors. 2.4. Explosion of benzene during loading

2.4.1. System and accident Benzene was being transferred from a storage tank onshore to an inland waterways tanker. The tanker has nine tanks that are loaded according to a certain procedure, which means that firstly the tanks with uneven numbers are loaded and then the even numbered ones. Halfway the loading an explosion took place in tank number 2. The amount loaded in that tank was about a few cubic metres. 2.4.2. Investigation On investigation of the accident no deviations fiom the standard loading procedures were found. The only exception was that after the accident an unusual smell of ammonia was perceived in the tanks that were loaded. Further analyses concentrated on the possible source of ammonia. The concentration ammonia in the samples benzene was, as may expected, very low, nevertheless higher than in previous shipments. No specific source could be identified. A hrther indication was that the coating of the tanks slightly was affected by the loaded benzene. The coating contains metallic zinc and the ammonia may have reacted with the zinc layer. A reaction product is hydrogen. The gas could have been formed during loading of the other tanks and could have been transferred to the tank where the explosion took place. An explanation for this possibility is that during loading a slight under-pressure in the empty tanks develops. From soot traces in the tank it became clear that at some point between the tank wall and the pump lines the vapour in the tank was ignited. The ignition source was certainly static electricity. However, practical experience does not support this, as no specific additional triggering element was present. In this case it could have been the ammonia producing hydrogen. 2.4.3. Lessons learnt The discussion following the incident concentrated on the question whether, in general, the loading rate is too high or that the ammonia has played a role in the explosion. A comparable accident a few years ago was attributed to a too high loading rate. Remains the fact why so many previous loadings in this tanker and many other tankers went on safely,just a matter of bad luck? The

1464

proof that traces of ammonia could have been responsible is hard to give and the simplest solution is a drastic decrease of the loading rate at the beginning of loading a tank. An even better solution would be to carry out the loading in an inert atmosphere.

3. DISCUSSION The accidents investigated had as similarity that in all cases static electricity was believed to be a main contributor to the accident. The systems, circumstances and root causes are quite different from each other. The accidents have also shown that minor deviations from the standard design or procedures may have played a role. In hindsight of these accidents the following questions can be asked: Are we working on the edge of the possibilities? 0 Do we know enough about the mechanisms of static electricity, especially with respect to the influence of certain substances? 0 What procedures do we have to apply to avoid these types of accidents? It can be stated, from the lessons learnt with the described accidents, that a general rule is not to be given. A major point of attention is the avoidance of the possible formation of chargeable droplets [ 13. "NO is of the opinion that analyses, such as Hazop, FMECA, and What-if, carried out on a system in the design state are the most appropriate vehicles to bring this to the attention of the experts involved. It should be one of the deviations to be discussed with respect to the possibility and safeguards.

REFERENCES [ 11 L.G. Britton, Avoiding Static Ignition Hazards in Chemical Operations, American Institute of Chemical Engineers, ISBN 0-8 169-0800-1.

[2] FACTS, databank with descriptions of accidents with hazardous materials. TNO-MEP, Apeldoorn, the Netherlands.

1465

Risk analysis for soil protection and industrial safety Lex Stax’, Patrick Korvers’, Reineke Klein Entink3 1.

TNO, PO Box 342,7300 AH Apeldoorn, The Netherlands Phone: ++31 55 549 3818; Fax: ++ 31 55 549 3390; Email: [email protected]

2.

Eindhoven University of technology, faculty of technology managemendquality of products & processes, PO Box 5 13,5600 MB Eindhoven, The Netherlands. Phone: ++3 1 40 247 5442; Fax: ++3 1 40 246 7497; Email: [email protected]

3.

IWACO BV, PO Box 525,5201 AM ‘s-Hertogenbosch,Phone: ++31 73 6874184; Fax: ++3 1 73 6120776; Email: [email protected]

1.

INTRODUCTION

The Netherlands is a densely populated country. There can be effects on public health. There can also be economical effects: a polluted area has a lower economical value. Therefore, in the last decade there has been a strong emphasis on soil remediation. The insight has risen that cleaning or remediation of polluted soil is good, but preventing soil getting polluted is better. In 1997 the Ministry of Housing, Spatial Planning and the Environment issued the Dutch guideline on soil protection. The guideline, although not obligatory, gives a rudimentary risk analysis method to determine whether constructions for soil protection are needed and what technical measures should be taken. This is called the “Decision Model soil protection industrial sites”. The guideline aims to improve the level of soil protection within industrial plants. In 1999 IWACO and TNO started a project called “Incident management” [l]. The project aims to determine why still soil pollution occurs, even if adequate soil protection measures have been implemented. Four large Dutch companies (petrochemical plant, oil refinery, oil production, storage facility) have participated in the project and were interviewed. The results are being processed now (October 2000). The results so far, are described in this paper.

1466

2.

BACKGROUNDS AND PRINCIPLES OF THE GUIDELINE

At first the background of the legislation on soil protection is explained briefly. The heart of the guideline is formed by the “Decision Model soil protection industrial sites” (the model). The model requires that industrial activities be divided into activities and sub-activities. These (sub) activities are: Table 1: (sub)Activitiesdistinguished in the Guideline Soil Protection [2] I. Storage of bulk liquids: Underground tank or tank covered with soil; 1.1 Aboveground tank vertical with bottom plate; 1.2 Aboveground tank installed fiee of the ground (horizontal/vertical); 1.3 1.4 Pit or basin; 2. Transhipment and internal transport of bulk liquids: Loading and unloading platforms/filling point above ground; 2.1 2.2 Pipelines; 2.3 Pumps; Transport on industrial site in open barrels et cetera; 2.4 3. Storage and shipment bulk goods and mixed cargo: 3.1 Storage bulk goods; 3.2 Shipment bulk goods; Storage and load solid substances (including viscous liquids) in 3.3 packaging (drums, containers, et cetera); 4. Process installations: 4.1 Closed process; 4.2 (half) Open process; 5. Other activities: 5.1 Sewerage; 5.2 Calamity collecting tank; 5.3 Workshop; 5.4 Wastewater purification. The most important steps of the model are [2]: 0

Step 1: Determine basic emission score: determine the basic emission score of each sub-activity. This score is determined by process related factors like: o Industrial activity; o Chance of an emission; o Quantity and nature of the substance released.

1467

Step 2: Inventory of facilities and measures: soil protection facilities and measures already present, reduce the basic emission score to the final emission score. Step 3: Determine the final emission score: A simple reduction from the basis emission score with the score from step 2, results in the final emission score. o Final emission score = 1: negligible risk, no further measures needed; o Final emission score = 2: monitoring is needed for reducing risk; o Final emission score ranging for 3 to 5 : no adequate soil protection. Further measures must be taken. TNO developed a method to determine the risk of soil pollution for industrial activities [3]. The model is based upon this document. Soil protection according to the model is based on the principle that there are technical measures for catching spills and that organisational measures are necessary for preventing that soil pollution occurs. All this must lead to an final emission score of 1. 3.

USE OF THE GUIDELINE

The guideline is used since 1997 by plants, consultants and enforcers and is use as a bases for permits. Research in 2000 by IWACO and TNO [ 13 showed that the situation in most of the plants doesn’t meet the minimum standard required by the guideline yet. This is caused by a combination of: 0 little insight in the costs of accidental releases and soil pollution; unfamiliarity with the guideline; large investments needed to improve the situation to the required level; little pressure by enforcers; a risk analysis method that isn’t flexible enough to deal with situations that are not described in the guideline. Reality is often quite different then described in the guideline; insufficient enforcement. The current level of soil protection isn’t satisfactory according to the Guideline. Most situations at industrial sites don’t meet the final emission score of 1. Most situations meet 3 , 4 or 5 . Nevertheless was concluded that the awareness of authorities and industries has increased. At least at the companies that were interviewed, programs started

1468

to improve the situation. The speed of improvement is determined by economical (e.g. depreciation) and technical aspects. Difficult is that the current situations are different from the situations in the Guideline. The main difference is that the Guideline focuses on technical facilities. For brownfield situations, it’s difficult to adapt the situation towards the demands of the Guideline. It’s common to apply more organisational measures. The results can be the same: a minimum risk for soil pollution to occur. 4.

ENVIRONMENTAL INCIDENT MANAGEMENT

In the project “Incident management” several incidents of pollutant releases, were reviewed by interviewing the industries. For practical reasons, the scope of the project was limited to fixed pipelines. The impression arose that incidents are not just caused by technical aspects but mostly by organisational causes. This first idea was bases upon four general interviews and one extensive interview. Although it was an extensive interview, it still is a small sample survey. Therefore a database with safety incidents was consulted. This database, FACTS developed and maintained by TNO, contains 15.000 safety incidents. The thought behind consulting this database is that the causes of safety incidents and environmental incidents are basically the same: If in an installation or industrial process a safety incident takes place, there are often also unwanted or uncontrolled spills [ 5 ] . I f an unwanted emission occurs, the process cannot be considered to be under control and therefor isn ’t safe.

With this thought the database was consulted. Incidents were selected that fulfil the following criteria: 0 Incident took place in a Western European country (comparable to the Netherlands); 0 Accidents with fixed pipelines; 0 Pollution of soil and/or groundwater took place; This resulted in a list with 5 5 incidents with large and small spills. The FACTS database describes the causes of the incidents. The most important causes are [1][4]:

1469

0

0

0

Corrosion or damage to the pipelines. This is caused by insufficient or inadequate maintenance. Therefore this has an organisational cause as this has to be organised well; Maintenance that lead to damaging the installation. Safety instructions were not or not correct carried out, also an organisational cause; Some very rare causes: vandalism, hurricane, damage caused by a forklift, et cetera. Prevention against such causes is very difficult.

In general, the conclusions drawn from the database are similar to the conclusions drawn from the interviews.

Technical measures and organisational measures After reviewing the interviews and the results of the database, the insight grew that the organisational aspects of soil protection are a very important cause for incidents. In fact, it was concluded that technical facilities for soil protection, always need organisational measures. E.g.: if a concrete sealing is constructed beneath an aboveground storage tank, organisational measures are necessary for inspection and maintenance of the sealing. Even a perfect technical facility needs organisational measures. Soil protection with only organisational measures is impossible. By e.g. just inspection or maintenance, it can never be prevented that pollution reaches the soil. Removing the pollution is also considered to be an organisational measure. There is an optimum balance between organisational measures and technical facilities. Technical facilities can be less, if organisational measures are better. If organisational measures are worse, technical facilities need to be better (more storage capacity, more robust). Together, technical and organisational, must be a 100% (figure 1). With 100% we mean a final emission score of 1 .

1470

100%

0%

0%

I

I *

Optimum for soil protection

*'

100%

Figure 1: Optimum for soil protection This optimum is visualised in the figure above. Soil protection is a combination of organisational measures and technical facilities. Together, they must be 100%. Extremes (towards 100% for technical or organisational) are not the desired situation. As explained, this will not lead to adequate soil protection. 5.

PARALLELS WITH INDUSTRIAL SAFETY APPROACH

Considering industrial safety, organisational measures are also a very common cause for incidents. Parallels can be drawn. There are parallels regarding to: 0

0

0

Design of the installation: both for safety and the environment, the design is aimed at no losses and at maximum availability. If the design isn't adequate, risk and environmental must happen sometime; Balance between technical facilities and organisation measures: a balance is needed between organisation an technique. Perfect facilities without sound organisational measures will finally lead to incidents with safety and environmental consequences; Economical effects are hard to calculate: both industrial safety and soil protection are the result of chance. Before incidents happen, the return of

1471

0

investments for safety and environment are hard to determine. Non investment is often based on an optimistic point of view (it won’t happen at our plant!); Safety and environmental management: management regarding both safety and the environment can be organised in a management system. ISOsystems can be used and can combine both.

A general conclusion is therefore that environmental aspects and industrial safety are strongly related. If an installation runs safe, environmental risks will be limited. Management systems should aim both at safety and at the environment.

6.

INCIDENT PREVENTION AND INCIDENT MANAGEMENT

The exact contents of incident management depend on the design of the installation it is meant for. In this paper we will only regard the aspects of soil protection. As concluded before soil protection has technical aspects and organisational aspects. The technical aspects are directly linked to the design of the installation. Soil protection is only needed at the places where potential pollutants are used. Soil protection can exist of e.g.: Concrete sealings at an area where pollutant are processed or transported; 0 Leak detection at tanks; 0 Overflow protection; 0 Cathodic protection; Etcetera. All these technical facilities need: 0 to be inspected: inspection is necessary to ensure to correct working of the facility; to be maintained: if a failure is found, this must be repaired. Some systems need to be maintained regularly, e.g. drain systems, cathodic protection, valves; to be recuperated: if an incident occurred, the pollution must be removed. Furthermore repair of the installation can be necessary. Causes of the incident may lay in the organisational measures. Of course causes can also be the result of a design of the installation that was improper

1412

Even if the design was proper, the use of the installation can differ from the intended use. Then also incidents can (and often will!) happen. Incident prevention and incident management for soil protection can categorised according to the scheme below. Table 2: Categorisation of incident man qement 4spects that cause Human Organisational ncidents 33 'hase of the nstallation UU 3esign

Quality control at iesign to reduce human error.

Use

Quality control at design to reduce human error.

[ncident

Educatiodtraining : technical aspects as well as awareness

Technical

-

The defining of tasks Apply design is based on the guidelines. technique of the Unambiguous insight installation and in the aimed use of substances used. Use the installation. experiences (internal, Perform risk analysis aimed at soil external like e.g. protection. FACTS). Use risk Use experiences from analysis methods the past (internal, (HAZOP, FMECA) external like e.g. to design soil protection measures FACTS) and technical facilities Use risk analysis Use risk analysis based upon the based upon the experiences with the experiences with the installation. installation. Use the principles of the guideline on soil protection as point of departure Evaluation of the Evaluation of technical aspects: risk procedures: e.g. analysis like HAZOP TRIPOD. or FMECA

Guideline on soil protection The principles described above, are still being checked and discussed with the four companies and authorities involved in the project. A restriction on the conclusion and statements is still necessary at this moment. But assuming our ideas are correct, the guideline on soil protection can be improved by taking the organisational aspects into account, more than was done

1473

before. Then for describing technical facilities for soil protection, the format of the following table can be used in the guideline. Table 3: Outline for the description of technical facilities for soil protection [DESIGN I MANAGEMENT (INCIDENT I Maintenance Regular use Recuperation rechnical facility ... ,. Sub ... ... activity A .. Sub (technical, activity B

I

I

organisational) during and after an incident at

I

.. Sub activity C

...

...

I ...

...

I

...

.L

The tables 2 and 3 give the outline for incident management. Then incident management is based on risk analysis. This means that if industrial (sub)activities are not described in the guideline, risk analysis can also be used to describe the situation at the plant. Objective comparisons can then be made. Implementing incident management is done by assigning the tasks mentioned in the tables 2 and 3 to people in the organisation. This implementing should include the phase of design (see table 2). As every industry and every plant is different, the incident management must be implemented in such a way that the principles are respected but are implemented in a flexible way.

7.

CONCLUSIONS

Although the project isn’t finished yet, some conclusions can be drawn already. The first conclusion is that industrial safety and soil protection (or even wider: environmental aspects) are strongly related. Management systems should consider both aspects. The second conclusion is that the Guideline gives a good basis for soil protection. The project [13 showed that improvements can be made regarding

1474

the balance between technical facilities and organisational measures. That’s being worked out right now. This will improve the Guidelines umambiguousity. The third and final conclusion is that soil protection (and safety) must be incorporated into the care systems of industries. The project showed that the organisational aspects need to be incorporated in such systems.

REFERENCES IWACO, TNO-MEP, Beheer incidenten: rapportage fase 1 (in English: Incident management, report phase 1) (in Dutch, interim report) INFOMIL, Netherlands regulation soil protection industrial activities, 1997 (the guideline can be downloaded in English from: www.infomil.nl) TNO, A method for determining the risk on soil pollution by industrial activities, 1989 (in Dutch) TNO, FACTS database, 2000 Tweeddal, Loss prevention and safety promotion in the process industry, 1, 1995,71

1475

Risk analysis on a closed landfill with chemical waste Lex Stax’, The0 Logtenberg’, Nico Klaver3 ’:

TNO, PO Box 342,7300 AH Apeldoom, The Netherlands; Phone: ++31 55 549 3818; Fax: ++ 31 55 549 3390; Email: [email protected]

*:

TNO, PO Box 342,7300 AH Apeldoom, The Netherlands; Phone: ++3 1 55 549 3926; Fax: ++ 3 1 55 549 3390; Email: [email protected]

3:

Projectbureau Diemerzeedijk, PO Box 94884, 1090 GW AMSTERDAM, The Netherlands; Phone: ++3 1 20 4623768; Fax: ++3 1 20 4623 761

1.

INTRODUCTION

The Diemerzeedijk landfill (550.000 m’) in Amsterdam (The Netherlands) is situated near “IJburg”. The municipality of Amsterdam is building this new suburb called “IJburg” in the lake “IJmeer”. 18.000 Houses are being build and 45.000 people will live here within a few years. “IJburg” is less then a km away from the Diemerzeedijk landfill. The Diemerzeedijk landfill is one of the heaviest polluted landfills in the Netherlands. All sorts of chemical waste have been dumped uncontrolled in large quantities in the period between 1961 and 1973. Little is known about the composition of the waste or the chemical and mechanical behaviour of the waste. As IJburg will be a densely populated area, emissions (water, air, soil) from the Diemerzeedijk are not allowed to reach “IJburg”. A risk analysis was done to determine this risk. 2.

INSULATION OF THE DIEMERZEEDIJK

The Diemerzeedijk is currently being insulated to prevent emissions. A vertical cement bentonite wall is constructed in the soil around the waste and a final capping system on the landfill is foreseen. The wall connects to an impermeable clay layer at 20 m beneath the surface.

1476

A geohydrological insulation will be maintained. This means that the water level in the Diemerzeedijk landfill is lower than the water level in the IJmeer. To achieve this, water is pumped out the landfill. Therefore water will not flow out of the Diemerzeedijk but towards the landfill. Then, pollution will also not flow out the landfill, but is stopped by the waterflow towards the landfill. Emissions are then reduced. The water that is pumped out of the Diemerzeedijk is cleaned before discharge. Cement bentonite wall

-

. . . . . . . . . . . . . . .I. . . . . . . . . . .~,.,.,.,.,.,.,. ....... ................................................... . . . . . . .. .. .. .. .. .. .. ..

aoundwater towards the Diemerzeediik due to difference in water level inside and outside

= flow of

-----

= water

level inside/outside the Diemerzeedijk

-

;igure 1 : Principle of the Diemerzeedijk insulation After the insulation is completed, the Diemerzeedijk will be used as a sports and recreational area. The insulation should be preserved for eternity. So, risk analysis should consider long-term risk (in effects and in moment of occurrence). Emissions that can occur are: 0 Gaseous: due to biochemical processes in the landfill, methane and other gasses can be produced. These gasses must be drained in a controlled way to prevent uncontrolled emissions or explosions; 0 Liquid: water leaking from the landfill can contain pollutants; 0 Solid: solid emissions are not expected and were not considered in the risk analysis.

Evaluating design and construction Little was known about the geotechnical and (bio)chemical behaviour of the Diemerzeedijk before the construction of the insulation started.

1477

The experiences and insights gained during the construction are used to improve the construction itself and the aftercare plan. This method is called “Evaluating design and construction”. Risk analysis is essential for an objective and systematic analysis of (potential) risks. In the Netherlands, risk analysis is not a technique often used for landfills. However, there was so little known about the Diemerzeedijk that a risk analysis was needed for the environmental risk assessment for IJburg.

3.

THE RISK ANALYSIS

In the risk analysis all aspects relevant for potential emissions were taken into account. The main aspects are visualised in figure 2. These aspects are: 0

0

Cement bentonite wall: the wall outside the polluted area of the landfill. The wall consists of cement bentonite mixture and a lining with HDPE; Final capping system: the final capping system prevents water getting into the landfill. Furthermore, the system drains landfill gases out of the landfill; Pumps: the pumps pump water out of the landfill. Therefore the pumps maintain the difference in water level outside and inside the landfill; Waste water treatment: the water that is pumped out the landfill is treated in the waste water treatment before discharging; Impermeable clay layer: the impermeable clay layer ensures that water does not (or only very limited) infiltrate in the landfill; Landfill gas drainage: if landfill gases are formed, the drainage system in the final capping system takes care of draining the gases; Monitoring: inside and outside the landfill, a monitoring system is installed. The systems monitors water level and water quality.

In the landfill, all these elements influence each other. As there are so many aspects influencing each other, it might lead to an almost endless list of scenarios. TNO used their knowledge of landfill, for a selection of the most important scenarios.

1478

-

-

;igure 2: Technical aspects of the Diemerzeedijk landfill influencing each other TNO performed the risk analyses. Risks were assessed about the design, the construction, the use of the Diemerzeedijk, the insulation (final capping, cement bentonite wall and the layer of clay) and the monitoring. It resulted in a list of weighted risks and in a methodology to monitor the chemical and mechanical behaviour of the Diemerzeedijk. Furthermore the plan for the aftercare of the landfill and the program for monitoring was improved by the information form the risk analysis. The process of risk analysis The aim of the risk analysis was to quantify the risk of emissions. FMECA was used as the method for risk analysis. A team was putted together with experts. In the team the construction company and the designing company were present. This enabled TNO to incorporate the latest information gathered during the construction of the insulation.

4.

QUANTIFICATION AND SCENARIOS

As the Diemerzeedijk insulation was constructed by ways of evaluating design and construction, there was little quantitative information available about failure of the insulation. This made quantification of the risk impossible.

1479

Quantification had to be abandoned. A description of risks was given. An ordinal scale was used: Risks not mentioned in the report: these are risks that can happen in theory. It are risks that are estimated (not calculated!!) to be smaller than 1 * 106/year; Negligible risk: risks are considered to be so small. Nevertheless they can be important in some scenarios. It’s useful to know that these risks exit. The risk is estimated to be 10-4/yearor smaller; Small risk: small risks can occur, even under normal conditions. These risks are often important in scenarios. The risk is estimated to be 2 * lO-’/year or smaller; Realistic risk: a risk that can occur with a frequency of about once every 10 years. So the estimated frequency is about 1 * 1O-’/year. These risks were often linked to a lack of knowledge of the composition of the waste in the Diemerzeedijk. This classification was used to give a classification to a long list of risks that was composed. This long list and its risk classification were discussed with experts. This resulted in a long list with a classification given by the experts. With this list, scenarios were developed. These scenarios were also discussed with the experts. Finally there were classified risks and there were scenarios. Neither of them was quantified. There are realistic risks during: 0 Replacement of parts of the insulation of the landfill. Due to technical or organisational problems, failures can occur; 0 Use of the landfill: due to autonomous effect or due to organisational problems, problems can occur. 5.

PROCES AFTER THE INSULATION

After the insulation is finished, during a period of ten years an optimisation is done [2,3]. The optimisation concerns: 0

Pumping capacity: there are 20 pumps installed and the pumping capacity must be optimised so that the difference in water level inside and outside the Diemerzeedijk is maintained;

1480

Wastewater treatment: the composition of the waste is only generally known and therefore the composition of the water pumped out of the Diemerzeedijk is hard to predict. The water that is pumped out the Diemerzeedijk will be treated in a wastewater treatment. This is a modular system. If necessary, wastewater treatment units are added to the system. The water quality is monitored to optimise wastewater treatment; Final capping: settlement of the waste will happen. This settlement will mostly occur during the first ten years. Maintenance of the final capping is therefore important in this decade. It can be assumed that the period of ten years, is the most dynamic period; Cement bentonite wall: of failures occur, they will be repaired. The repair gives information about the conditions under which damage develops. This period of optimisation gives the bases for the after care of the landfill. Furthermore, this decade gives quantitative information that can be used for the risk analysis.

6.

RISK ANALYSIS IN THREE PHASES

Figure 3 gives an outline of the risk analysis that was done and the analyses to be done in the future. The figure is divided into three phases: Evaluating design and construction: in this phase the risk analysis was done. The insulation of the Diemerzeedijk is build. Quantitative information about failures of the construction is not available yet; Optimisation: in this phase, the insulation is ready. During the optimisation, quantitative information about the performance of the insulation is gathered. Replacements and their circumstances and monitoring supply such information. This information is used for improvement of the after care. A periodic analysis of all the information is necessary as a basis for the after care; After care: during the phase of optimisation, the plan for the after care was developed. During the aftercare measurements are being done. Their results are periodically evaluated. This can lead to continuation or to adaptation. During all the phases, direct threats and risk analysis for the long term, are taken into account.

Figure 3: Risk analysis now and in the future

1481

1482

7.

CONCLUSIONS

Risk analysis has proven to be a useful technique for identifiing risks that are relevant at the Diemerzeedijk landfill. Because there is not so much know about the behaviour of the landfill in the future, a quantitative risk analysis was not possible. The phase of optimisation is necessary for input for the quantitative risk analysis. Also in the phase of after care, risk analysis will be a useful method for optimisation of after care. For remediation and insulation of polluted sites, techniques like risk analysis aimed at loss prevention, are very useful. Application of such techniques should be stimulated and incorporated in the legislation.

8.

REFERENCES

[ 13

TNO, Environmental risk analysis Diemerzeedijk, 1999

[2]

ARCADIS, Plans for the after care of the Diemerzeedijk, 2000 (in concept, in Dutch)

[3]

Klaver N., Kwaliteitsborging bij de bodemsanering van de Diemerzeedijk (Quality control at the remediation of the Diemerzeedijk),in: Bodem, number 3, 1999

I1

Author Index

Adrian, J-C., 1043,1189 Ale, B. J. M., 1429 Altorfer, F., 279 Amendola, A., 371 Amieiro, C., 983 Anderssen, Peer Christian, 253 Angelsen, Sture, 3 Arnaldos, J., 983 Ashton, D., 53

Chatris, J. M., 287 Chen, Jenq-Renn, 1203 Christou, M., 371 Clarke, Ian, 385 Clkment, E., 99 Colenbrander, Gert W., 443 Costa, Christian, 867 Cozzani, Valerio, 1251, 1263 Crawley, Francis K., 53 Currb, F., 955,1407

Babinec, Frantisek, 1373 Balke, Christian, 1005 Barontini, Federica, 1251 Bassett, M. D., 713 Belke, James C., 1275 Bellamy, L. J., 1361 Bender, J., 897 Berghmans, J., 745,785 Bernatii, A., 1373 Beyer, R., 725 Bigot, J.-P., 1043 Bikmursin, A., 301 Blum, Carsten, 947 Bonvicini, S., 1017 Bou-Diab, Leila, 809 Boult, D. M., 307 Brickstad, B., 3 Brodhagen, A., 753 Broeckmann, B., 339 Bubbico, R., 1029 Butler, C. J., 1069

Fabiano, Bruno, 771,955,1167,1407 Falope, Gboyega Oyewale, 663 Fath, W., 947 Fatta, D., 239 Fierz, Hans, 809 Friedel, L., 455 Froberg, Maria, 401 Forster, Hans, 823

Cadet, Patrice, 1419 Carlsson, Tomas O., 699 Carol, Sergio, 1349 Casal, J., 287,983,1349 Caumont, M., 1381

Gallot, T., 1419 Giesbrecht, H., 681 Gil, Luis Roberto Pinto, 191 Gitzi, Andreas, 909 Glikin, M. A., 1197

Dahoe, A. E., 917 Dazin, C., 733 Del Borghi, M., 1407 Di Cave, S., 1029 Ditali, S., 631 Duffield, J. Stuart, 1223,1315 Eberz, A., 967 Ellis, Graeme Richard, 1335 Engelhardt, F., 1149 Erlandsson, G m a r , 183

I2 Glor, Martin, 279,799,909,947 Goldmann, G., 967 Goose, Martin H., 591 Goossens, Louis, 609,691,1361 Graf, Holger, 159 Grass, K-H., 339 Grenier, Beatrice, 141 Grollier Baron, R., 321 Grooss Viddal, M., 253 Gruden, M., 455 Guerrieri, A., 1029 Guimranov, F., 1145 Gustin, Jean-Louis, 427,867 Gutte, F., 745 Hale, Andrew R., 691 Harms-Ringdahl, Lars, 361 Harmsen, G. J., 33 Hartwig, S., 1149 Hasegawa, K., 853 Hauptmanns, U., 507 Heijne, M. A. M., 1393 Heller, W., 1005 Heming, B. H. J., 1361 Henschen, Ph., 897 Hieronymus, Hartmut, 897 Hocquet, J., 1043 Hofmann, M., 897 Hossam, A.G., 619 Hub, Ludwig, 273 Hunt, Peter, 561 Hutchison, Robert, 307 Hsiset, Stian, 1059 Iizuka, Y., 835 Jacobsson, A., 141 Jennings, K., 141 Jochum, Christian, 1329 Johansson, Henrik, 19 Johnsson, P., 401 Jonsson, Robert, 227 Karydas, Dimitrios M., 545 Kenny, G. D., 307 Kersten, Ronald J. A., 771

Killich, A., 493 Klais, Odo, 493 Klaver, N., 1475 Klein Entink, R., 1465 Konersmann, R., 1005 Korevaar, G., 33 Korovin, Vadim, 1215 Koshik, Yu., 1215 Kozine, I., 371 Kraus, Alexander, 417 Krueger, H., 331 Kuhr, Christian, 1179 Kupchik, Mikhail P., 283 Kurakin, I., 935 Korvers, P., 1465 Lacoursiere, J-P., 99 Lambert, Paul G., 643 Lauridsen, K., 371 Lemkowitz, Saul M., 33,691,917 Leonelli, P., 1017 Lerena, Pablo, 279 Lerible, R., 1043 Li, X., 853 Linou, N., 239 Lisi, M. F., 1017 Loeffler, U., 331 Logtenberg, M. Th., 1459 Logtenberg, T., 1475 Loupasis, Stylianos, 1315 Loyer, C., 339 Ludwig, J., 1005 Lundin, J., 227 Lundqvist, S., 401 Luttgens, G., 947 Mahgerefteh, H., 663 Mahnken, G., 545 Mandalia, D., 713 Mannan, M. Sam, 117 Marchand, V., 1043 Marchi, M., 71 Markert, Frank, 371 Markowski, Adam S., 411 Maroiio, Marta, 265 Marx, Marcus, 507

I3

Maschio, G., 1017 Mazzarotta, Barbara, 1029 McGowan, M., 401 Meessen, J., 745 Mengolini, A., 239 Metropolo, P. L., 191 Mewes, D., 753 Michel, F., 1153 Milazzo, M. F., 1017 Miyake, A., 835 Moineault, F., 867 Molag, Menso, 1051 Montanarini, Marco, 993 Morbidelli, M., 631 Muller, R. H. G., 1179 Naka, Y., 619 Niederbdumer, G., 993 Nystedt, Fredrik, 1355 Ogawa, T., 835 Oka, Y., 835 Opitz, D., 1179 Opschoor, G., 771 Ott, R., 279 Otten, B., 609 Palazzi, E., 955,1167 Papadakis, G. A., 1315 Papadakis, Georgios, 239 Papadopoulos, A., 239 Pasman, Hans J., 33,321,691,917 Pastorino, Renato, 771,955,1167,1407 Pekalski, Andrzej A., 917 Pefia, J. A., 265 Perbal, R., 713 Perez-Alavedra, F. X., 287 Perez-Alavedra, X., 983 Perret, Christel, 1189 Persaud, Michael A., 1069 Petarca, L., 1251 Phillips, J., 643 Pineau, J-P., 339 Pitblado, R. M., 307 Plewinsky, B., 897 Pliiss, 993

c.,

Polyakov, Vadim, 935 Polyanchukov, Vladimir, 843 Post, J. G., 1429 Powell Price, M., 171,1051 Prats, F., 1381 Preston, R., 401 Puertas, Isabel, 297 Puls, E., 1149 Puttock, Jonathan S., 1107 Radandt, S., 339 Roberts, T. A., 1069 Rogers, Richard L., 339 Rosenberg, Tommy, 215,1239 Rota, Renato, 631 Rundmo, Torbjnrm, 151 Ryaboshapka, S., 1215 Salvi, Oliver, 1381 Santamaria, J., 265 Scarlett, B., 917 Schecker, H-G., 417 Schellekens, C. J., 443 Schmidt, Juergen, 455,681 Schmitz, D., 753 Schoft, H., 159 Schoten, H., 1051 Schulberg, F., 141 Schupp, Bastiaan A., 691 Schwartzbach, C., 339 Schwenzfeuer, K., 279,909 Schonbucher, A., 1179 Shestak, Yu., 1215 Shimada, Yukiyasu, 619 Shirvill, L. C., 1069 Shmatkov, G, 1215 Smit-Rijnhart, B., 1153 Sol&,R., 265 Sole, X., 287 Sommer, Joachim, 273 Spadoni, G., 1017 Staudt, H.-J., 493 Stax, Lex, 1465,1475 Steinbach, J., 725,733,897 Stevens, G. C., 71 Sun, Jinhua, 853

I4

Suter, George W., 171 Suzuki, K., 619 Suzuki, M., 835 Svatos, P., 401 Svensson, P., 401 Svensson, Stefan, 1439 SaAer, O., 1059 Tamanini, Francesco, 1135 Tang, W., 853 Taylor, J. Robert, 1447 Telyakov, E., 301,1145 Treand, G., 867 Tukmanov, D., 301 Tumey, Robin D., 519 Tyulpinov, Alexandr, 1197 Uijt de Haag, Paul A. M., 1429 van 't Oost, E., 745,785,1153 van den Aarssen, A., 745,785,1153 van der Geld, C., 455 van der Schans, Eric, 81,1393 Van Gils, E., 533 van Wingerden, K., 339 Vandebroek, Luc, 745,785 Vansina, Peter, 533

Veenstra, P., 443 Vendichansky, V. N., 281 Verplaetsen, F., 785 Verster, N., 609 Vila, J., 287 Vilchez, J. Antonio, 287,983,1349 Vliegen, Sjir, 1153 Vliegen, G., 745,785 Vuidart, I., 1381 Walther, C.-D., 947 Ward, R. J., 643 Weber, Y., 1447 Wendler, R., 897 Wennersten, R., 361,699 Werner, Arend, 331 Westphal, F., 455,493 Wilday, J., 455 Winter, Herman, 745,785 Winterbone, Desmond E., 713 Worsell, N., 339 Wright, S., 1069 Wiirsig, G.,455 Zanelli, S., 1251,1263 Zevenbergen, J. F., 917 Zika, Ivan, 393