Paper Received: 18 January 2022; Revised: 2 March 2022; Accepted: 26 April 2022 Please cite this article as: Jabłoński D., Buhn J.B., 2022, A deterministic approach for modeling of plausible accident scenarios according to the German Major Accident Ordinance, Chemical Engineering Transactions, 90, 109-114 DOI:10.3303/CET2290019 CHEMICAL ENGINEERING TRANSACTIONS VOL. 90, 2022 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Aleš Bernatík, Bruno Fabiano Copyright © 2022, AIDIC Servizi S.r.l. ISBN 978-88-95608-88-4; ISSN 2283-9216 A Deterministic Approach for Modeling of Plausible Accident Scenarios According to the German Major Accident Ordinance Dariusz Jabłońskia, Jörn Bernhard Buhnb a Bayer AG, Leverkusen b Covestro Deutschland AG, Leverkusen dariusz.jablonski@bayer.com Unlike some of its neighboring European countries, in Germany the definition of plausible accident scenarios primarily follows a purely deterministic concept. This applies, in particular, to dispersion calculations according to the Major Accident Ordinance (Störfall-Verordnung) and the Federal Immission Control Act (Bundes- Immissionsschutzgesetz, BImSchG), which must be carried out for accidental release scenarios in order to obtain the license-to-operate for chemical plants. The fundamental dilemma of the deterministic concept is the need to commit to specific, predefined release scenarios in order to achieve acceptance by all stakeholders (e.g. regulatory authorities, asset owners, residents, emergency responders, society). Different stakeholders might not necessarily agree on predefined model assumptions for the dispersion calculation. The intention of this paper is to present a deterministic and well-established approach for dispersion calculations, which has been used in many chemical companies throughout Germany for more than three decades. By outlining the multitude of conservative assumptions taken, we aim to show why this is a conservative and viable approach, offering a solid basis for decision-making and hazard assessment. 1. Introduction The relevant legal bases for carrying out dispersion calculations of accidental material release scenarios in Germany are the Major Accidents Ordinance (i.e. Störfall-Verordnung, German implementation of the SEVESO-III-Directive) and the Federal Immission Control Act (Bundes-Immissionsschutzgesetz, BImSchG), which regulates the permitting procedures for plants in the chemical industry. According to both regulations, it must be demonstrated to authorities that the hazards that may lead to major accidents are identified and that all necessary measures have been taken to prevent such incidents. In addition, and where legally required, the effects of major accidents on human health and the environment must be limited by effective mitigation provisions. To this end, plausible accidental material release scenarios must be investigated and presented to the authorities to obtain the license-to-operate. The evaluation of accidents is done by modeling leak scenarios and computing the effects of these releases on human health and the environment. As airborne dispersion of toxic gases can have far-effects on the general population outside of industrial sites, they will be the main focus of this paper. 1.1 Concept of different failure types in Germany When defining plausible release scenarios, three failure types are distinguished in accordance with the concept as described in the German Major Accidents Ordinance. Please note, that failures in this concept are defined as initiating events which have the potential to result in a major accident: 1. Failures that cannot be reasonably excluded, 2. Failures that can be reasonably excluded, and 3. Exceptional failures. This differentiation is briefly explained below, as it is significant for the modeling of plausible accidental material release scenarios in a deterministic framework. For more details, see final report SFK-GS-26. 109 DOI: 10.3303/CET2290019 Figure 1: Prevention and Mitigation Concept according to German Major Accident Ordinance According to the German Major Accidents Ordinance, "Failures that cannot be reasonably excluded" can lead to accidents that must be prevented with adequate safety measures. Typically, those failures may include the failure of an operational control system or a human error during the execution of an operational procedure. The range of safety measures that prevent major accidents triggered by non-excludable failures (or initiating events in that sense) belong to the prevention concept. In general, the prevention concept includes active safety measures such as pressure safety valves or SIS interlock devices (safety instrumented system). Although the concept of non-excludable failures is subjective and not further explained in German regulations (and in particular not determined by expected frequency values), there is general consensus among regulators (who grant a permit) and chemical asset owners (who apply for a production permit) on its interpretation. On the other hand, “reasonably excludable failures”, the occurrence of which is less likely, can lead to so-called "reasonably excludable accidents" (“Dennoch-Störfall”, a concept that is used in several German regulations and is widely known in the expert community). The “reasonably excludable failures” do not have to be prevented with additional measures that go beyond the existing prevention concept. In fact, there is no legal obligation for the operator to actually prevent “reasonably excludable failures”. However, the effects must be limited by suitable mitigation measures. A “reasonably excludable failure” is, for example, the failure of an SIS interlock or the blockage of a pressure safety valve despite appropriate maintenance and inspection. Finally, there are “exceptional failures” that are beyond all experience and predictability and against whose occurrence no individual plant-specific provisions need to be taken (e.g. exceptional aircraft crashes). However, overall countermeasures must be in place, most and foremost in the form of an emergency preparedness plan. 1.2 Deterministic versus probabilistic approach Unlike some of its neighboring European countries, in Germany the definition of plausible accident scenarios primarily follows a purely deterministic concept. This applies in particular to the computational modeling of material releases and (airborne) dispersion scenarios, and the determination of possible adverse effects in the vicinity of chemical plants. In this deterministic concept, the risk posed by a chemical plant can be calculated from accidental material release scenarios, which are based on commonly accepted dispersion modeling parameters and allow only a limited degree of freedom and variation. This contrasts with so-called probabilistic approaches (Quantitative Risk Assessments), which assign (empirical or theoretical) probability numbers to the initiating failures, the associated causal chains and, ultimately, the effects. The aim of probabilistic methods is to determine the (overall) risk posed by a chemical plant by means of a variety of probability- weighted release and accident scenarios, and to relate the resulting risk values to socially acceptable limits. In this approach, all dispersion modeling parameters can be theoretically weighted with a probability according to their occurrence, starting with leak sizes and ending with the question whether a certain toxic concentration can really harm a person (i.e. probit function). Comparing both approaches, the fundamental dilemma of the deterministic concept is, therefore, that one must commit to one (or at least very few) specific, predefined release scenario(s) that must be accepted by all stakeholders (e.g. regulatory authorities, asset owners, residents, emergency responders, society). Depending on the application (e.g. permitting procedures, land use planning), this can lead to different opinions regarding the appropriate scenario, depending on which leak size, release or dispersion conditions are assumed realistic 110 and plausible, and should therefore be used for the calculation. Particularly in situations where legislation requests the modeling of material releases that are initiated by “failures that cannot be reasonably excluded”, the question of what are plausible leak sizes and reasonable release and dispersion parameters for modeling arises. A simplified overview of the scenarios to be considered as per the German regulations and respective typical leak size assumptions is given in Table 1. Table 1: Overview of scenarios for dispersion modeling according to the German Major Accident Ordinance Cat. Failure/ application Examples Typical leak sizes Considered in Prescribed in Germany Risk Profile 1 Cannot be reasonably excluded Corrosion, flange leak, human error, BPCS failure 5 - 30 mm² Permitting procedures, safety reports Störfall- Verordnung § 3 Abs. 1 2 Can be reasonably excluded Pipe rupture, failures of protection devices (acc. to SFK-GS-26) Loss of biggest inventory Alarm and emergency planning Störfall- Verordnung § 3 Abs. 3 Land-use planning Conventions as defined in KAS-18 80 - 490 mm² Urban planning § 50 BImSchG 3 Exceptional Releases due to: airplane crash, earthquake, terror attack, flood Not predictable Safety reports Störfall- Verordnung § 3 Abs. 2 1.3 Intention of this paper The aim of this paper is to show how the extent and severity of plausible accidental material releases from a chemical plant can be determined conservatively and reliably on the basis of pre-defined accident scenarios. This deterministic concept uses assumptions on leak sizes, release conditions and dispersion parameters that are published in generally accepted and recognized German regulations. In Germany, the social consensus is achieved by developing these regulations in diverse working groups consisting of authorities, environmental NGOs, academia and chemical asset owners, who must agree on a common approach. Among the most well- known are the following working groups: Commission on Process Safety (KAS), Association of German Engineers (VDI), German Platform for Process Engineering, Chemical Engineering and Technical Chemistry (ProcessNet) and various Working Committees of the Federal Ministry of Labour and Social Affairs (BMAS). The procedure as described in this paper is based on the definition and calculation of a few plausible (deterministic) release scenarios that are rated worst-case and therefore conservatively cover all minor release scenarios in terms of material toxicity and release conditions, thus creating a solid basis for decision- making in permitting procedures and hazard assessments. The outlined approach is considered a proven practice for many chemical companies at chemical industry sites in Germany, e.g. in Leverkusen, Dormagen, Wuppertal, Bergkamen, Uerdingen and Brunsbüttel. 2. Selection of representative accidental release scenarios Based on the above, we will focus on scenarios for accidental material release caused by “failures not reasonably excludable”. In this chapter, we will describe a well-established and broadly accepted procedure for the selection of the hazardous toxic substances and release scenarios for dispersion modeling. First, the thermophysical and toxicological properties of chemical substances must be taken into account, since they can essentially influence the consequences of material releases. Therefore, all substances whose releases could lead to hazardous (airborne) consequences, i.e. which have a non-negligible low vapor pressure under process or ambient conditions or can be dispersed in the air must be considered. A systematic procedure with successive selection criteria is used to identify the most critical substances and operating conditions to be calculated. This ensures identification of the substances with the highest hazard potentials amongst the substances handled at the plant. The procedure for selecting the most hazardous substances and the most critical release scenarios is described below. It ensures that the greatest hazards relating to “reasonably non-excludable material releases” are identified, thus conservatively covering all minor release scenarios. P ro b a b ility ty D a m a g e e x te n t 111 Starting point: Listing of all hazardous substances handled at the chemical plant The starting point of the selection process is to request the complete list of all hazardous materials handled at the plant. Step 1: Filtering for substances that are toxic when inhaled In Step 1, the entire list must be reviewed to allow selection of only those substances with a toxic effect on human health when dispersed in air. This condition is met under the GHS (Globally Harmonized System of Classification and Labelling of Chemicals), if substances are classified as belonging to one of the following hazard statements: H330 (danger to life by inhalation), H331 (toxic by inhalation), EUH029 (contact with water liberates toxic gas) and sometimes H332 (harmful by inhalation), especially if the exposure guideline levels are available and broadly accepted. Step 2: Ranking of inhalation-toxic substances with regard to their Hazard Potential In Step 2, the toxic Hazard Potential (HPTox) of each substance identified in Step 1 is determined. The toxic Hazard Potential is an artificial number that characterizes the chemical material and is solely based on the following substance parameters: - volatility, which is mainly influenced by the vapor pressure of the substance and thus depends on aggregate state and temperature, and - inhalation toxicity, which can be expressed using exposure guideline levels. For gases, an atmospheric pressure of 1 bar(a) is to be assumed instead of the vapor pressure, since the hazard is to be assessed for the substances already released. For the determination of inhalation toxicity, the following acute airborne exposure guideline levels for short-term exposure are applied: AEGL-2, ERPG-2, or TEEL-2. The selection of the guideline levels is made according to the presented order. Should none of these common guideline levels be available, equivalent exposure guideline levels can be derived according to recognized methods described in the DOE Handbook (Department of Energy). The Hazard Potential of a chemical substance can be estimated using the following equation Eq(1): 𝐻𝑃𝑇𝑜𝑥 = 𝑣𝑎𝑝𝑜𝑟 𝑝𝑟𝑒𝑠𝑠𝑢𝑟𝑒 [𝑚𝑏𝑎𝑟] 𝑒𝑥𝑝𝑜𝑠𝑢𝑟𝑒 𝑔𝑢𝑖𝑑𝑒𝑙𝑖𝑛𝑒 𝑙𝑒𝑣𝑒𝑙 [𝑝𝑝𝑚] (1) The determination of the toxic Hazard Potentials HPTox in Step 2 leads to a ranking of the most hazardous substances regarding atmospheric dispersion. The substances with the highest Hazard Potential values are expected to have the most far-reaching effects in the event of an accidental release. Assuming the same release conditions and the same distance from the point of reception (e.g. plant boundary), the hazard radius of the highest ranked substance will cover all hazard radii of the lower ranked substances. Step 3: Identification of the most critical release scenarios Based on the top ranked hazardous materials defined in Step 2 (i.e. most volatile in relation to their toxicity) the most critical release scenarios are determined in Step 3. These release scenarios are characterized by resulting in the highest emission rates and thus leading to the highest concentrations of the toxic material at the receptor point. In this step, the critical plant components that process the selected materials and are operated under high process pressures, temperatures, and substance concentrations are identified. When damaged, the most adverse emission rates will be expected at these equipment items. Besides the process parameters (i.e. pressure, temperature and concentration) which directly affect the release mass rates, many more parameters must be considered to identify the most critical release scenarios, such as: • pipe/flange diameter (which directly affects the flange leak size in the “Strohmeier Flange Leak Concept”, see Chapter 3) • release height (because high release spots are less conservative as they result in a larger dilution) • distance to the receptor point (representing for example persons who are exposed to the hazardous substance) • physical state (gas or liquid) and physical properties (e.g. heavy gas behavior) • outdoor releases versus releases in buildings or enclosures • max. release time until the leakage can be stopped by operators or automatic depressurization of the equipment The most unfavorable combination of the abovementioned parameters defines the most critical release scenarios. As these sometimes cannot be predicted due to conflicting release parameters, all options in question must be considered for the subsequent dispersion calculations. Step 4: Dispersion modeling and evaluation of the results After having determined the most critical release scenarios (by considering the top ranked hazardous materials with the highest possible emission rates) gas dispersion calculations are conducted based on 112 the Gaussian dispersion model as described in the VDI 3783 guideline (Part 1). The dispersion calculation model provided by VDI 3783, as well as the way the release scenario is set up introduce a number of conservative assumptions to the evaluation process, which are outlined in the following section. The VDI 3783 guideline (Part 1) distinguishes a so-called “mean” and a “worst atmospheric dispersion situation”. As per standard requirements, the effect of a hazardous material release is evaluated under the worst atmospheric dispersion situation. The worst atmospheric dispersion situation is determined by variation of all meteorological dispersion situations (stable, indifferent and unstable stratification of the atmosphere) and, if necessary, by variation of the wind speed for each receptor point. The highest concentration result of all variations ultimately determines the worst dispersion situation. With low effective release and receptor point heights (which represents approximately 80% of all cases in practice), the worst case occurs with a stable stratification at a wind speed of 1 m/s. As another conservative assumption, an additional barrier layer (inversion layer) is applied on top of the worst dispersion situation. In meteorology, an inversion is a rare deviation from the normal atmospheric condition which creates an impervious barrier at which the hazardous gases are completely reflected. This boundary condition represents a highly unfavorable atmospheric situation, since it severely impedes the free dispersion of gases and leads to high ground level concentrations. According to the VDI 3783 guideline (Part 1) a height of 20 m shall be taken as standard for the barrier layer, provided that the release points are low (this situation accounts for more than 90% of all cases in practice). Due to this special combination of atmospheric stability conditions, wind speed and barrier height, the worst dispersion situation is very unlikely. According to the German Meteorological Service (Deutscher Wetterdienst), for example, an inversion layer can form at a height of less than or equal to 20 meters for a maximum of 88 hours per year on average at the Leverkusen site (mainly occurring in the evening hours). This corresponds to less than 1 % of hours in a year. Conservatively, the immission load (concentration over exposure duration) of a hazardous material release is evaluated at a receptor point that is positioned at the nearest site boundary (i.e. closest distance from emission point to site perimeter). The receptor point is the location where the effect of the toxic gas dispersion is evaluated and, for example, represents a person’s exposure to the hazardous gas plume. This assumption does not take into account the fact that wind may come from various directions based on the wind’s directional distribution and a peak for its prevailing direction. As an example, the prevailing wind direction for the chemical industrial site of Krefeld-Uerdingen (Germany) accounts for less than 20% of the time per year. In addition, the calculated concentration values are temporary and local maximum values to which persons are only exposed when located exactly downwind in the center line of the dispersion plume without having any protection. By moving into buildings or escaping transversely to the wind direction, the immission load can be significantly reduced. Finally, the calculated immission loads are compared against exposure guideline levels (e.g. AEGL, ERPG). Exposure guideline levels set levels of chemical concentration (ppm or mg/m³) that pose a defined level of risk to humans. The various risk levels are generally based on effects representing detection, discomfort, disability, and death. For example, concentrations above the AEGL-2 value (“disability level”) may lead to “irreversible or other serious, long-lasting adverse health effects” or an “impaired ability to escape”. In the approach as described in this paper, the immission loads are evaluated against the “disability level” (i.e. AEGL-2 or ERPG- 2) because any permanent health damage must be prevented. It should be emphasized that exposure guideline levels are determined to be applied to the “general population, including susceptible individuals”, such as older and younger people, or persons with previous illness. The concept of considering effects to susceptible individuals again underlines the prudence of this approach. Please note, that a similar approach is applied for the selection of flammable materials and release conditions to assess representative explosion and fire risk scenarios in a plant (not further outlined in this paper). 3. General deterministic assumptions for leak size estimation Leak sizes directly determine the amount of released material and therefore have a significant effect on the results of the dispersion calculation. For this reason, a dedicated chapter should outline the leak size assumptions that are applied in the deterministic approach. For scenarios that cannot be reasonably excluded, the so-called “Strohmeier Flange Leak Concept” has been used as a standard assumption in many chemical companies throughout Germany for more than three decades. Because it is in line with the leak size range of 5-30 mm2 proposed in KAS-55, and together with the conservative assumptions discussed above, this forms a rounded-off concept. This way, it can be assumed that (even) the largest release rates can be evaluated according to the specifications provided in Table 2. 113 Table 2: Leak size assumptions in the deterministic approach Examples Leak size assumption Flange leaks (1) “Strohmeier Concept” for state-of-the-art sealing systems Flange leaks (2) “Modified Strohmeier Concept” for high- quality sealing systems Small pipes break e.g. thin pipes < DN20 Creeping leaks of metallic container, e.g. drums due to corrosion 1 mm² Puncture by forklift (if not reasonably excluded) 390 mm² (depends on forklift type) Leaks on transport container, e.g. 20-foot container 10 mm² Rupture of flexible hoses (if not reasonably excluded) Defined by cross-section For “Strohmeier flange leaks”, the leak size dependency on the nominal diameter of the pipe was proven in Strohmeier’s calculations. The underlying assumption is that a pipe under pressure is subject to a bending moment which results in an additional load on the flange connection and can lead to a misalignment of the flange body and thus, to a leak. Strohmeier proved that flange leaks according to this method are larger than leaks observed on industrial vessels and containers. On this basis, separate considerations of additional scenarios other than flange leaks (which cannot be reasonably excluded) are not required. As a general rule, leak sizes smaller than 5 mm² may be also assumed in certain conditions, where empirical data is available or additional safety measures apply, such as: constructive measures, material-technical measures or tightness measures. In addition, leak sizes smaller than 1 mm² calculated according to Strohmeier are conservatively rounded up to a leak size of 1 mm², even where one of the above safety measures is implemented. For more information on “Strohmeier flange leaks” and other concepts accepted in the deterministic approach, see the ProcessNet Status Paper. It should also be noted that this method does not take into account the fact that a full, calculated leak cross- section is unlikely to spontaneously occur at the assumed flange leakage, but that this maximum leak size can only be reached over a finite period of time. 4. Conclusions In this article, we describe the deterministic approach for selecting and modeling of plausible accident scenarios according to the Major Accident Ordinance, which is applied for more than three decades by many chemical companies throughout Germany. The multitude of conservative assumptions that are applied for dispersion calculations account for a sufficient safety margin and is a basis for a sound decision-making in permitting procedures and hazard assessment. This approach would not be successful without widely accepted regulations and a social consensus through diverse working groups representing authorities, environmental NGOs, academia, and asset owners, who must agree on this common approach. To support the article's thesis, Hauptmanns' assessment of ZEMA’s accident statistics shows that in the ten years of operation of the 7,800 plants subject to the Major Accidents Ordinance in Germany, there has been no fatal accident involving persons outside of industrial sites. References Hauptmanns U., Process and Plant Safety, eBook ISBN 978-3-642-40954-7, 2015. KAS-18 Leitfaden, Empfehlungen für Abstände zwischen Betriebsbereichen nach der Störfall-Verordnung und schutzbedürftigen Gebieten im Rahmen der Bauleitplanung – Umsetzung § 50 BImSchG, Kommission für Anlagensicherheit, November 2010. KAS-55 Leitfaden, Mindestangaben im Sicherheitsbericht, Kommission für Anlagensicherheit, Bundesministerium für Umwelt, Naturschutz und nukleare Sicherheit, GFI Umwelt, Bonn, 15.04.2021. Status Paper, Auswirkungsbetrachtungen bei störungsbedingten Stoff- und Energiefreisetzungen in der Prozessindustrie, ProcessNet-Fachgemeinschaft Anlagen- und Prozesssicherheit, DECHEMA – Gesellschaft für Chemische Technik und Biotechnologie e.V., Frankfurt am Main, Dritte Auflage, Januar 2017. Strohmeier K., Leckanalyse bei der Anwendung der Störfall-Verordnung, Chem.-Ing.-Tech. 62 Nr. 12, S. 1003-1007, VCH Verlagsgesellschaft mbH, Weinheim, 1990. VDI-Richtlinie 3783, Blatt 1, VDI-Verlag (Association of German Engineers), Düsseldorf, 1987. 114