ARAMIS project: a comprehensive methodology for the identification of reference accident scenarios in process industries

In the frame of the Accidental Risk Assessment Methodology for Industries (ARAMIS) project, this paper aims at presenting the work carried out in the part of the project devoted to the definition of accident scenarios. This topic is a key-point in risk assessment and serves as basis for the whole risk quantification.

The first result of the work is the building of a methodology for the identification of major accident hazards (MIMAH), which is carried out with the development of generic fault and event trees based on a typology of equipment and substances. The term “major accidents” must be understood as the worst accidents likely to occur on the equipment, assuming that no safety systems are installed.

A second methodology, called methodology for the identification of reference accident scenarios (MIRAS) takes into account the influence of safety systems on both the frequencies and possible consequences of accidents. This methodology leads to identify more realistic accident scenarios. The reference accident scenarios are chosen with the help of a tool called “risk matrix”, crossing the frequency and the consequences of accidents.

This paper presents both methodologies and an application on an ethylene oxide storage.     

ARAMIS project: a more explicit demonstration of risk control through the use of bow-tie diagrams and the evaluation of safety barrier performance

Over the last two decades a growing interest for risk analysis has been noted in the industries. The ARAMIS project has defined a methodology for risk assessment. This methodology has been built to help the industrialist to demonstrate that they have a sufficient risk control on their site.

Risk analysis consists first in the identification of all the major accidents, assuming that safety functions in place are inefficient. This step of identification of the major accidents uses bow–tie diagrams. Secondly, the safety barriers really implemented on the site are taken into account. The barriers are identified on the bow–ties. An evaluation of their performance (response time, efficiency, and level of confidence) is performed to validate that they are relevant for the expected safety function. At last, the evaluation of their probability of failure enables to assess the frequency of occurrence of the accident. The demonstration of the risk control based on a couple gravity/frequency of occurrence is also possible for all the accident scenarios.

During the risk analysis, a practical tool called risk graph is used to assess if the number and the reliability of the safety functions for a given cause are sufficient to reach a good risk control.     

Safety risk assessment and management—the ESA approach

The European Space Agency ESA aims at minimizing the safety risks of their space flight projects. Hazard and risk reduction is supported by hazard analysis and probabilistic risk assessment. In hazard analysis hazardous conditions and accident scenarios are identified. Risk assessment is the probabilistic evaluation of accident scenarios and is the basis for risk management. The risk assessment method involves the determination and propagation of event probability. Expert judgement is used in a structured way. In risk management the risk assessment results are used to prioritize and optimize risk reduction efforts and to support risk acceptance evaluations.     

SCAP: a new methodology for safety management based on feedback from credible accident-probabilistic fault tree analysis system

As it is conventionally done, strategies for incorporating accident--prevention measures in any hazardous chemical process industry are developed on the basis of input from risk assessment. However, the two steps-- risk assessment and hazard reduction (or safety) measures--are not linked interactively in the existing methodologies. This prevents a quantitative assessment of the impacts of safety measures on risk control.We have made an attempt to develop a methodology in which risk assessment steps are interactively linked with implementation of safety measures. The resultant system tells us the extent of reduction of risk by each successive safety measure. It also tells based on sophisticated maximum credible accident analysis (MCAA) and probabilistic fault tree analysis (PFTA) whether a given unit can ever be made 'safe'. The application of the methodology has been illustrated with a case study.     

The assessment of risk caused by domino effect in quantitative area risk analysis

A systematic procedure for the quantitative assessment of the risk caused by domino effect was developed. Escalation vectors, defined as the physical effects responsible of possible accident propagation, were identified for the primary scenarios usually considered in the QRA procedure. Starting from the assessment of the escalation vectors, the methodology allows the identification of credible domino scenarios and the estimation of their expected severity. A simplified technique was introduced for consequence and vulnerability assessment of domino scenarios. The overall contribution of domino effect to individual risk, societal risk and to the potential life loss index was calculated by a specific procedure, taking into account all the credible combinations of secondary events that may be triggered by each primary scenario. The development of a software package allowed the application of the procedure to several case-studies. The results evidenced the relevant modifications of the risk indexes caused by domino effect and the importance of including the quantitative analysis of domino effect in QRA, in order to correctly assess and control the risk caused by escalation scenarios.     

Scenario analysis of freight vehicle accident risks in Taiwan

This study develops a quantitative risk model by utilizing Generalized Linear Interactive Model (GLIM) to analyze the major freight vehicle accidents in Taiwan. Eight scenarios are established by interacting three categorical variables of driver ages, vehicle types and road types, each of which contains two levels. The database that consists of 2043 major accidents occurring between 1994 and 1998 in Taiwan is utilized to fit and calibrate the model parameters. The empirical results indicate that accident rates of freight vehicles in Taiwan were high in the scenarios involving trucks and non-freeway systems, while; accident consequences were severe in the scenarios involving mature drivers or non-freeway systems. Empirical evidences also show that there is no significant relationship between accident rates and accident consequences. This is to stress that safety studies that describe risk merely as accident rates rather than the combination of accident rates and consequences by definition might lead to biased risk perceptions. Finally, the study recommends using number of vehicle as an alternative of traffic exposure in commercial vehicle risk analysis. The merits of this would be that it is simple and thus reliable; meanwhile, the resulted risk that is termed as fatalities per vehicle could provide clear and direct policy implications for insurance practices and safety regulations.     

Independent accident investigation: a modern safety tool

Historically, safety has been subjected to a fragmented approach. In the past, every department has had its own responsibility towards safety, focusing either on working conditions, internal safety, external safety, rescue and emergency, public order or security. They each issued policy documents, which in their time were leading statements for elaboration and regulation. They also addressed safety issues with tools of various nature, often specifically developed within their domain. Due to a series of major accidents and disasters, the focus of attention is shifting from complying with quantitative risk standards towards intervention in primary operational processes, coping with systemic deficiencies and a more integrated assessment of safety in its societal context. In The Netherlands recognition of the importance of independent investigations has led to an expansion of this philosophy from the transport sector to other sectors. The philosophy now covers transport, industry, defense, natural disaster, environment and health and other major occurrences such as explosions, fires, and collapse of buildings or structures. In 2003 a multi-sector covering law will establish an independent safety board in The Netherlands. At a European level, mandatory investigation agencies are recognized as indispensable safety instruments for aviation, railways and the maritime sector, for which EU Directives are in place or being progressed [Transport accident and incident investigation in the European Union, European Transport Safety Council, ISBN 90-76024-10-3, Brussel, 2001]. Due to a series of major events, attention has been drawn to the consequences of disasters, highlighting the involvement of rescue and emergency services. They also have become subjected to investigative efforts, which in return, puts demands on investigation methodology. This paper comments on an evolutionary development in safety thinking and of safety boards, highlighting some consequences for strategic perspectives in a further development of independent accident investigation.     

Introduction of threat analysis into the land-use planning process

The subject of this paper is a method for introducing risk assessment into the land-use planning (LUP) process. Due to adaptations of the results of risk assessment, which are needed to make the risk assessment usable by land-use planners, we term the overall process threat analysis. The key features of the threat analysis can be summarised as follows. (i) It consists of three main steps. The first is determination of the threat intensity level of an accident, the second is analysis of the environmental vulnerability of the surroundings of an accident, and the third, integrating the previous two, is determination of a threat index in the accident impact zone. All three are presented in GIS based maps, since this is a common expression in LUP. (ii) It can and should be applied in the early stages of the LUP process. The methodology is illustrated by an example in the context of renewal of a land-use plan for the Municipality of Koper in Slovenia. The approach of threat analysis follows directions of the Article 12 of the Directive 96/82/EC of the European Commission (the Seveso II Directive).     

Safety assessment methodology in management of spent sealed sources

Environmental hazards can be caused from radioactive waste after their disposal. It was therefore important that safety assessment methodologies be developed and established to study and estimate the possible hazards, and institute certain safety methodologies that lead and prevent the evolution of these hazards. Spent sealed sources are specific type of radioactive waste. According to IAEA definition, spent sealed sources are unused sources because of activity decay, damage, misuse, loss, or theft. Accidental exposure of humans from spent sealed sources can occur at the moment they become spent and before their disposal. Because of that reason, safety assessment methodologies were tailored to suit the management of spent sealed sources. To provide understanding and confidence of this study, validation analysis was undertaken by considering the scenario of an accident that occurred in Egypt, June 2000 (the Meet-Halfa accident from an iridium-192 source). The text of this work includes consideration related to the safety assessment approaches of spent sealed sources which constitutes assessment context, processes leading an active source to be spent, accident scenarios, mathematical models for dose calculations, and radiological consequences and regulatory criteria. The text also includes a validation study, which was carried out by evaluating a theoretical scenario compared to the real scenario of Meet-Halfa accident depending on the clinical assessment of affected individuals.     

Formal safety assessment based on relative risks model in ship navigation

Formal safety assessment (FSA) is a structured and systematic methodology aiming at enhancing maritime safety. It has been gradually and broadly used in the shipping industry nowadays around the world. On the basis of analysis and conclusion of FSA approach, this paper discusses quantitative risk assessment and generic risk model in FSA, especially frequency and severity criteria in ship navigation. Then it puts forward a new model based on relative risk assessment (MRRA). The model presents a risk-assessment approach based on fuzzy functions and takes five factors into account, including detailed information about accident characteristics. It has already been used for the assessment of pilotage safety in Shanghai harbor, China. Consequently, it can be proved that MRRA is a useful method to solve the problems in the risk assessment of ship navigation safety in practice.     

Precautions against industrial accidents: experience in applying the Seveso II Directive in central and eastern European countries.

Adopted approaches to safety reports and internal emergency plans are described. Based on the provisions of the Seveso II Directive and on the achieved state of hazard prevention management of the respective enterprises in central and eastern European states, reports and plans were prepared. Although these states are no members of the European Union, the parties recognised the requirements of the Seveso II Directive as a working basis. In detail: Methodical experience in preparing safety reports and emergency plans include a methodology in the three main steps: Analysis of information on hazardous substances, hazard analysis including all plants, more specific hazard analysis for representative plants. Basic ways of forming scenarios are given. According to a procedure, various types of scenarios were usually taken into account. Based on the assessment of effects of a substance release, important conclusions can be drawn regarding the extent of danger prevention. In most cases, the structure of the described internal accident emergency plan turned out to be helpful. The programmed system DISMA (Disaster Management) which is widely used in Germany turned out to be a suitable tool for the internal as well as external emergency planning. An example of information to the population is described.     

The ARIPAR project: analysis of the major accident risks connected with industrial and transportation activities in the Ravenna area

The paper describes the ARIPAR project aimed at the assessment of the major accident risks connected with storage, process and transportation of dangerous substances in the densely populated Ravenna area in Italy, which includes a large complex of chemical and petrochemical plants and minor industries, essentially distributed around an important commercial port. Large quantities of dangerous goods are involved in various transportation forms connected with the industrial and commercial activity of the port. The project started by making a complete inventory of fixed installations and transportation activities capable of provoking major fire, explosion and toxic release events; then relevant accident scenarios were developed for the single hazard sources; probabilities were assigned to the events and consequences were evaluated; finally iso-risk contours and F-N diagrams were evaluated both for the single sources and for the overall area. This required the development of a particular methodology for analysis of area risk and of associated software packages which allowed examination of the relative importance of the different activities and typologies of materials involved. The methodological approach and the results have proved to be very useful for the priority-ranking of risk mitigating interventions and physical planning in a complex area.     

Emergency planning and the Control of Major Accident Hazards (COMAH/Seveso II) Directive: an approach to determine the public safety zone for toxic cloud releases

The EU Control of Major Accidents Hazards Directive (Seveso II) requires an external emergency plan for each top tier site. This paper sets out a method to build the protection of public health into emergency planning for Seveso sites in the EU. The method involves the review of Seveso site details prescribed under the directive. The site safety report sets out the potential accident scenarios. The safety report's worst-case scenario, and chemical involved, is used as the basis for the external emergency plan. A decision was needed on the appropriate threshold value to use as the level of concern to protect public health. The definitions of the regulatory standards (air quality standards and occupational standards) in use were studied, how they are derived and for what purpose. The 10 min acute exposure guideline level (AEGL) for a chemical is recommended as the threshold value to inform decisions taken to protect public health from toxic cloud releases. The area delimited by AEGL 1 defines the population who may be concerned about being exposed. They need information based on comprehensive risk assessment. The area delimited by AEGL 2 defines the population for long-term surveillance when indicated and may include first responders. The area delimited by AEGL 3 defines the population who may present acutely to the medical services. It ensures that the emergency responders site themselves safely. A standard methodology facilitates discussions with plant operators and concerned public. Examples show how the methodology can be adapted to suit explosive risk and response to fire.     

The development of an inherent safety approach to the prevention of domino accidents

The severity of industrial accidents in which a domino effect takes place is well known in the chemical and process industry. The application of an inherent safety approach for the prevention of escalation events leading to domino accidents was explored in the present study. Reference primary scenarios were analyzed and escalation vectors were defined. Inherent safety distances were defined and proposed as a metric to express the intensity of the escalation vectors. Simple rules of thumb were presented for a preliminary screening of these distances. Swift reference indices for layout screening with respect to escalation hazard were also defined. Two case studies derived from existing layouts of oil refineries were selected to understand the potentialities coming from the application in the methodology. The results evidenced that the approach allows a first comparative assessment of the actual domino hazard in a layout, and the identification of critical primary units with respect to escalation events. The methodology developed also represents a useful screening tool to identify were to dedicate major efforts in the design of add-on measures, optimizing conventional passive and active measures for the prevention of severe domino accidents.     

Hazmat transport: a methodological framework for the risk analysis of marshalling yards

A methodological framework was outlined for the comprehensive risk assessment of marshalling yards in the context of quantified area risk analysis. Three accident typologies were considered for yards: (i) "in-transit-accident-induced" releases; (ii) "shunting-accident-induced" spills; and (iii) "non-accident-induced" leaks. A specific methodology was developed for the assessment of expected release frequencies and equivalent release diameters, based on the application of HazOp and Fault Tree techniques to reference schemes defined for the more common types of railcar vessels used for "hazmat" transportation. The approach was applied to the assessment of an extended case-study. The results evidenced that "non-accident-induced" leaks in marshalling yards represent an important contribution to the overall risk associated to these zones. Furthermore, the results confirmed the considerable role of these fixed installations to the overall risk associated to "hazmat" transportation.     

Identification of reference accident scenarios in SEVESO establishments

In the frame of the ESREL special session on ARAMIS project, this paper aims at presenting the work carried out in the first Work Package, devoted to the definition of accident scenarios. This topic is a key-point in risk assessment, and serves as basis for the whole risk quantification. A first part of the work aims at building a Methodology for the Identification of Major Accident Hazards (MIMAH), which is carried out with the development of generic fault and event trees based on a typology of equipment and substances. This work is coupled with an historical analysis of accidents. In a second part, influence of safety devices and policies will be considered, in order to build a Methodology for the Identification of Reference Accident Scenarios (MIRAS). This last one will take into account safety systems and lead to obtain more realistic scenarios.     

A "worst case" methodology for obtaining a rough but rapid indication of the societal risk from a major accident hazard installation

This paper describes a methodology developed to provide a rough but rapid indication of the magnitude of the societal risks at and in the vicinity of a major accident hazard installation. It is intended to be used by the UK Health & Safety Executive (HSE) as a first screening tool when examining safety reports submitted under The Control of Major Accident Hazards (COMAH) Regulations 1999. These are the Regulations which implement in the UK the major aspects of Council Directive 96/82/EC, the "Seveso II" Directive. Within the methodology a new weighted risk integral parameter is defined, suitable for comparison with criteria, and its value calculated. The paper includes examples to illustrate the use of the methodology.     

Application of the integrated safety assessment methodology to the emergency procedures of a SGTR of a PWR

This paper describes an application of the Integrated Safety Assessment (ISA) methodology to the safety and reliability assessment of emergency procedures of a nuclear power plant. The concept of ISA has been developed as a result of previous works on safety assessment and dynamic reliability. The method links the physical dynamics of the facility with its operating environment, subject to transitions between different time evolutions due to failures and/or system/operator interventions. For situations dominated by deterministic transitions (i.e. transitions upon deterministic demands as a result, for instance, of exceeding automatic actions or alarm setpoints), the methodology can be considered an extension of PSA and accident analysis techniques that replaces the static event tree with a deterministic dynamic event tree concept (DDET) based on the theory of probabilistic dynamics.In line with current studies carried out jointly by CSN and JRC-Ispra/ISEI, this paper reviews the main features of ISA and describes some of the details of its implementation in the case of a Westinghouse pressurized water reactor (PWR), in particular its application to the assessment of the emergency operating procedure (EOP) to mitigate the steam generator tube rupture (SGTR) initiating event.This application demonstrates the ISA feasibility for risk analysis of operating procedures (OP) by assessing a given set of OPs with a large PWR model of the TRETA-DYLAM-HOI software package, which is able to simulate recovery in a SGTR scenario. Some weak points in the SGTR EOP are identified and suggestions provided for their resolution.     

Plant functional modelling as a basis for assessing the impact of management on plant safety

A major objective of the present work is to provide means for representing a chemical process plant as a socio-technical system, so as to allow hazard identification at a high level in order to identify major targets for safety development. The main phases of the methodology are: (1) preparation of a plant functional model where a set of plant functions describes coherently hardware, software, operations, work organization and other safety related aspects. The basic principle is that any aspect of the plant can be represented by an object based upon an Intent and associated with each Intent are Methods, by which the Intent is realized, and Constraints, which limit the Intent. (2) Plant level hazard identification based on keywords/checklists and the functional model. (3) Development of incident scenarios and selection of hazardous situation with different safety characteristics. (4) Evaluation of the impact of management on plant safety through interviews. (5) Identification of safety critical ways of action in the management system, i.e. identification of possible error- and violation-producing conditions.     

Hazard assessment of substances produced from the accidental heating of chemical compounds

Accidental events concerning process industries can affect not only the staff working in, but also the environment and people living next to the factory. For this reason a regulation is imposed by the European Community to prevent accidents that could represent a risk for the population and the environment. In particular, Directive 96/82/CE, the so-called 'Seveso II directive', requests a risk analysis involving also the hazardous materials generated in accidental events. Therefore, it is necessary to develop simple and economic procedure to foresee the hazardous materials that can be produced in the case of major accidents, among which the accidental heating of a chemical due to a fire or a runaway reaction is one of the most frequent. The procedure proposed in this work is based on evolved gas analysis methodology that consists in coupling two instruments: a thermogravimetric analyzer or a flash pyrolyzer, that are employed to simulate accident conditions, and a FTIR spectrometer that can be used to detect the evolved gas composition. More than 40 materials have been examined in various accident scenarios and the obtained data have been statistically analyzed in order to identify meaningful correlations between the presence of a chemical group in the molecule of a chemical and the presence of a given hazardous species in the fume produced.