DOI: 10.3303/CET2290095 Paper Received: 30 November 2021; Revised: 7 March 2022; Accepted: 27 April 2022 Please cite this article as: Xu Y., Reniers G., Yang M., Yuan S., Chen C., 2022, An exploratory study on uncertainty analysis in quantitative risk assessment of domino effects, Chemical Engineering Transactions, 90, 565-570 DOI:10.3303/CET2290095 CHEMICAL ENGINEERING TRANSACTIONS VOL. 90, 2022 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Aleš Bernatík, Bruno Fabiano Copyright © 2022, AIDIC Servizi S.r.l. ISBN 978-88-95608-88-4; ISSN 2283-9216 An Exploratory Study on Uncertainty Analysis in Quantitative Risk Assessment of Domino Effects Yuanyuan Xua, Genserik Reniersa,b,c,*, Ming Yanga, Shuaiqi Yuana, Chao Chena a Safety and Security Science Section, Faculty of Technology, Policy and Management, TU Delft, Delft, The Netherlands b Faculty of Applied Economics, Antwerp Research Group on Safety and Security (ARGoSS), Universiteit Antwerpen, B- 2000 Antwerp, Belgium. c CEDON, KULeuven, B-1000 Brussels, Belgium G.L.L.M.E.Reniers@tudelft.nl Data uncertainties caused by the lack of knowledge and nature variation or randomness present vital challenges to domino effects modelling. To improve the assessment of the propagation probabilities and consequences of the domino-effect accidents, the influence of various types of uncertainties on risk assessment results needs to be investigated. However, a systematic identification of data uncertainties in domino effects has not been studied yet. In the current study, the data uncertainties in different categories (accidental, Natech, and intentional) of domino events are identified thoroughly based on historical data and literature. Meanwhile, the possible sources of the identified uncertainties are analysed by considering the environment, safety management, and operation factors. Finally, we discuss possible solutions to model uncertainties in risk assessments of domino effects. This study is a pilot study for uncertainty analysis and helps to identify the critical uncertainties that are of necessity to be considered in the domino effect risk assessments. 1. Introduction Domino effects is a phenomenon in which a primary event propagates to other equipment, triggering one or more secondary events, resulting in more severe overall consequences than primary events (Reniers and Cozzani, 2013). However, the risk of domino effects is not widely recognized until the Seveso Directive III (Council Directive 2012/18/EU) urged chemical facilities to include the risk of domino scenario in their safety assessment and emergency response planning. Currently, there are many methods have been developed ton risk assessment of domino effects (Chao et al., 2020). Quantitative risk assessment (QRA) is an analytical analysis method which has been widely applied in process industries to provide quantitative information on the risks of 'major accidents’. To assess the likelihoods, consequence of domino effects and sequence modelling, many QRA software and tools have been developed. The systematic procedure for QRA of risk caused by domino effect was first proposed by Cozzani et al. (2005). However, the QRA of domino effects is still very challenging due to the rarity of scenarios together with the large uncertainties involved in the analytical process. Few articles discuss about the uncertainty sources in QRA of domino effects in detail. To provide a better understanding of what brings about the uncertainties in domino modelling, exploratory study on uncertainty analysis was conducted. Uncertainties focused on data, assumptions and knowledge in QRA of domino effects are discussed. This present study aiming at exploring the dominant sources of uncertainty at each stage in QRA of domino effects. 565 2. Uncertainty in QRA of domino effects Figure 1: uncertainty in QRA of domino effects Due to our lack of knowledge and randomness, there exists a great deal of uncertainty in domino effect analysis. After identification of the primary events, questions are what types of potential consequence of the subsequent units and likelihoods? which unit would be involved in domino effects? As shown in Figure 1, uncertainty lies in identifying the primary events, predicting escalation probability, subsequent units and consequences. There are several classification methods for the uncertainties according to different needs. Khakzad et al. (2018) classified uncertainty in domino effect analysis into two main categories: data uncertainty and model uncertainty. Data and theoretical models play very important role in QRA of domino effects. Risk analysis requires a large amount of data, such as failure rate, ignition rate, heat release rate (HRR), probability of natural events, exposure data, weather data. The physical and theoretical models (e.g., fault trees, vulnerability and consequence models) formed the important bases of QRA in domino effects. In the domino model, model uncertainty is often linked with data uncertainty. The data can come from historical accidents database or the research system directly. But the scarcity of data is common and the data provided from database is usually generic and does not apply to specific system. The problem of lacking available data is even more outstanding for the new system. Under this condition, the involvement of experts’ knowledge and assumptions is inevitable. There are two main sources of model uncertainties (Nilsen and Aven, 2003): • Limitations in the analyst’s phenomenon knowledge • Deliberate simplifications introduced by the analyst. Theoretical models used are also tested with real data and adjusted as far as possible. It can be concluded that data uncertainty is associate with data sources, analyst’s knowledge and assumptions, model uncertainty is related to analyst’s knowledge and assumptions. Change in the choosing of database, analyst or assumptions can lead to different analysis results. Therefore, three sources of uncertainties are identified and the relationship between them are manifested in Figure 2. Figure 2: main sources of data and model uncertainties ‘Source’ denotes the database, literatures and other approaches to obtain data. ‘Knowledge’ refers to analyst’s knowledge in choosing, modifying and how to understand the data specifically. ‘Assumption’ denotes the hypothesis made by analysts based on knowledge. 566 3. Uncertainty factors analysis results Depending on the specific parts of analysis, the uncertainty sources at every stage can be different. Systematic uncertainty analysis was conducted based on the assessment procedure from the perspective of data sources, analyst’s knowledge and assumptions. The analysis results are shown in Table1. 3.1 Identification of primary events At the start of QRA of domino effects, identification of primary domino scenarios is the first and most critical procedure. It generally requires a full characterization of possible primary risk scenarios that may induce subsequent events. In order to find primary risk sources, the hazard and operability analysis (HAZOP) is usually required to identify all the possible top-events. The identification results are associated with historical statistics and judgement of experts. In the procedure of risk identification, assumptions are made to tackle the complexity of the system. No matter when the domino effects are accidental, Natech or intentional, the primary events may relate to deficiencies of vessels, leading to loss of containment (LOC) events. As a matter of fact, infinite cases of LOCs may occur. This is because the system is random, the parameters such as the shape and area of leakage hole, the geographical condition of the leak cannot be accurately determined, which brings a large extent of uncertainty. The use of historical data is a useful way to choose rational failure conditions, but the data is usually absent. To reduce the number of cases of release, the size of leakage is mostly divided into three classes (small, medium and catastrophic) in literatures. Hence, assumptions are made using representative cases of leakage to describe all potential LOCs. It inevitably involves certain degree of uncertainties. 3.2 Identification of possible target units After identifying the primary events, the following question is which unit would be involved in domino effects? In order to find the possible secondary events, threshold values are used to identify target units. Many studies assessed the damage to equipment and various threshold values are reported. However, there exists great discrepancies between the data reported. For example, Gledhill and Lines (1998) proposed threshold values that 7kPa for the damage of atmospheric equipment and 38kPa for pressurised vessels. In (Cozzani et al., 2006b), the escalation threshold values are 22kPa and 20kPa respectively. It can be seen that wide uncertainties exist in threshold values. This is resulted from two aspects: 1) the definition of damage is ambiguous. 2) representative cases of structural characteristics are not able to describe all targets. First, people have different understandings of what is mean for equipment damage, analyst’s opinion may vary when relate the physical phenomenon with the description of the damage. On the other hand, those threshold values in literatures are typically derived from special experimental cases. In fact, the vulnerability of installations is not only depended on the escalation vectors, but also on the features of target installations, such as shape and constituent material of target units, the operating conditions, quantities and physical properties of the chemicals involved. Although some authors have grouped the equipment into several types such as pressurized, atmospheric, elongated and auxiliary, it is still a simplified approach because the full details of the target units are not provided. 3.3 Frequency analysis Frequency of the primary event The difficulty in initial frequency analysis mainly comes from the scarcity of appropriate failure data. Normally, the initial frequencies of random leakages are analysed based on statistical leak frequency database and past accidents or may be calculated by fault tree analysis. The former approach should be used as a starting point, analysis taking account of the complexity of systems is required to update the frequency data. This is because the data reported can be derived from oil, nuclear, water and other industries which may not adapted to the context being analysed. Also, the failure frequency is affected by managerial and other factors. Therefore, adopting generic failure rates given by the literature to particular scenes directly without adaption can give rise to poor quality of assessment results. Fault-tree analysis can be used when the specific data is scarce. However, the analysed frequency is still based on values from the literature. The variables and non-specific data resources lead to high degrees of uncertainty. Escalation probabilities A key step in QRA of domino effects is the calculation of escalation probability of the event to higher order event. Probability models specific to escalation vectors are used to evaluate the damage likelihoods to secondary targets. An explosion can produce a blast wave interacted with objects involving complex process. However, the observed damages are mainly related to static overpressure (𝛥𝛥𝛥𝛥), to the positive impulse (𝐼𝐼𝐼𝐼) and to the drag force on bodies (𝛥𝛥𝛥𝛥𝑑𝑑). In QRA, an almost universal hypothesis is to assume that all the accidental phenomena 567 can be idealized and compared to the ideal blast wave produced by an equivalent charge of one or more solid “point” explosions. By this method, peak overpressure and impulse could be easily determined. Many authors simply link peak static overpressure (𝛥𝛥𝑠𝑠) with the probability of damage it may cause to target installations. Obtaining the value of 𝛥𝛥𝑠𝑠 through the principals of mechanisms of material or experiments can be time- consuming and expensive, therefore, the data of 𝛥𝛥𝑠𝑠 is generally obtained from past accident analysis and few experimental data. Eisenberg et al. (1975) first developed probit function of peak overpressure: 𝑌𝑌 = 𝑎𝑎 + 𝑏𝑏𝑏𝑏𝑏𝑏(𝛥𝛥𝑠𝑠) (1) Where 𝛥𝛥𝑠𝑠 is the static peak overpressure (kPa); 𝑌𝑌 is the probit value; 𝑎𝑎 and 𝑏𝑏 are constants. 𝛥𝛥𝑟𝑟 = Φ(Y − 5) (2) The damage probability 𝛥𝛥𝑟𝑟 obtained from the cumulative expression for a normal Gaussian probability distribution function, as shown in Eq. (2). However, there exists a great deal of cognitive uncertainties between the scarce data and the given observed phenomenon and sometimes the data are even contradictory. Besides, to build probability models from such data, qualitative descriptions of damage to process equipment by overpressure has to be linked with a quantitative value-the probability. Thus, different probits equations would be derived due to subjectivity uncertainties. Khan and Abbasi (1998a) proposed a probit function similar to the equantion of Eisenberg, but substituting the static peak overpressure with total peak overpressure. Cozzani and Salzano(2004a) developed probit models for four categories of equipment (atmospheric, pressurized, elongated and small). They made assumptions relating four damage probability values (1%, 10%, 30% and 99%) to the extent of damage to equipment (minor, partial, complete, catastrophic). Mingguang and Juncheng (2008) improved the probit models of Cozzani and Salzano (2004a) by applying more detailed description to the damage state and loss intensity. Mukhim et al. (2017) further modified probits models by categorizing the equipment into 11 types and by using criteria of damage levels to link qualitive description of the damage probabilities to a quantitative value. It can be seen that more categories of probit models have been developed based on more detailed classification of equipment. With regard to heat radiation, the damage process can be more complex compared to overpressure. The installations do not fall down immediately. The time to failure (ttf) is dependent on the resistance of the target equipment. Calculation of ttf requires detailed characteristics of vessel geometry and other design data. It is time-consuming to carry out simulations with characterization of the fire scenarios precisely. Hence, simplified model is developed to give a conservative estimation of time to failure. The vulnerability of installations under the circumstances of fire is also affected greatly by the time to emergency response (tte). However, the emergency response (such as water deluge systems, blowdown systems) may be fail to stop the escalation chain. The time required to start mitigation actions (eg., emergency teams) is related to a number of conditions like lay-out and wind direction, etc. Landucci and Cozzani (2009a) developed a probit model: 𝛥𝛥𝑃𝑃 = 𝑎𝑎 + 𝑏𝑏𝑏𝑏𝑏𝑏(ttf) (3) Where 𝛥𝛥𝑃𝑃 is the probit variable, ttf is the time to failure without any mitigation action, 𝑎𝑎 and 𝑏𝑏 are constants can be derived comparing the ttf to the tte. They assumed that the escalation probability equal to 0.1 when ttf is equal to time to start emergency response and the escalation probability equal to 0.9 when ttf is equal to time to start mitigation operations. The damage impact of fragment to equipment dependent on many fators such as the geometry of targets, the direction and velocity of fragments, the wind speed and direction. Gubinelli et al. (2004) proposed a probabilistic model to assess the damage probability induced by fragments, as shown in Eq. (4). The impact on the centre of mass resulted from wind and the collisions of fragments are neglected. The direction of fragments is dependent on a great many factors. While it is not feasible to yield precise analysis of all the information. Therefore, uniform probability distribution is assumed. The fragment number, shapes and weights are mainly dependent on the characteristics of the vessel. Under the given assumptions, the impact probability is only dependent on the probability of initial direction. 𝑓𝑓𝑑𝑑,𝐹𝐹 = 𝑓𝑓𝑝𝑝 × 𝛥𝛥𝑔𝑔𝑔𝑔𝑔𝑔,𝐹𝐹 × 𝛥𝛥𝑖𝑖𝑖𝑖𝑝𝑝,𝐹𝐹 × 𝛥𝛥𝑑𝑑𝑑𝑑𝑖𝑖,𝐹𝐹 (4) Where 𝑓𝑓𝑑𝑑,𝐹𝐹 denotes the damage probability induced by a fragment; 𝑓𝑓𝑝𝑝 represents the probability of primary event; 𝛥𝛥𝑔𝑔𝑔𝑔𝑔𝑔,𝐹𝐹 represents the probability of the fragment to be generated in the primary event; 𝛥𝛥𝑖𝑖𝑖𝑖𝑝𝑝,𝐹𝐹 denotes the probability of impact between the fragment and a target installation; 𝛥𝛥𝑑𝑑𝑑𝑑𝑖𝑖,𝐹𝐹 represents the probability of target damage given the impact with the fragment. 568 Three input parameters are required in this model: the mass, the shape and the initial velocity. It is hard to accurately calculating these parameters. Hence, Monte-Carlo based probabilistic approaches are used to model the uncertainties in the assessment of fragment projection (Lisi et al., 2015). 3.4 Consequence analysis consequence of the secondary events With regard to the analysis of consequence scenarios, a great many techniques and QRA software are developed to identify the potential damage. In the framework of QRA, the consequence analysis is only restricted to simplified assumptions which would give rise to some extent of uncertainties. Domino scenarios are complex to simulate because it is difficult to outline the boundaries so that the simulation model would simplify the scenarios deliberately. The traditional models used for consequence assessment in QRA framework are not able to deal with the synergetic effects. As a matter of fact, the overall physical effects of primary and secondary events are superimposed to roughly estimate the consequence. Also, the input data such as the leakage characteristics (The amount of released substance, leakage dimensions) are based on the knowledge of experts. We cannot be sure about the real-time wind direction. So prevailing wind direction and probability distribution are often used when setting parameters of weather conditions. Besides, the data (leakage dimensions, wind directions) are assumed to be constant. consequence of domino scenarios In the last step of QRA of domino scenarios, individual and societal risk are the vital index to estimate the overall consequence. Probit models are utilized to evaluate the relation between dose-effect and human response to toxic substances, thermal radiation and overpressure. As was discussed above, synergetic effects are neglected. Table 1: uncertainty analysis results in QRA of domino effects Uncertainty factors Data Knowledge Assumptions Identification of primary events The sizes and shapes of leakage hole The sizes of leakage hole based on engineering judgements Representative cases of leakage describe all potential LOCs Identification of possible target units Threshold of damage Ambiguous definition of damage Representative cases of structural and geometrical characteristics describe all targets Frequency analysis Initial frequency of leakage Taking into account of system complexity and managerial factors Specific insulation and mitigation systems are not considered Probabilities of damage caused by overpressure Cognitive variations between phenomenon and quantitative value Relating qualitive description of damage probabilities to quantitative value Probabilities of damage caused by heat radiation Estimation on tte Relating escalation probability to tte Probabilities of damage caused by fragment The effect of wind and collision are neglected Consequence analysis Boundary parameters Layout and geometrical characterization Simplified scenarios Synergetic effects are neglected Leakage characteristics To define the leakage characteristics Leakage dimensions are constant Emission rates are constant Wind direction Wind direction and speed do not vary Societal and individual risk index Synergetic effects are neglected 569 4. Conclusions In this study, exploratory analysis on uncertainty in QRA of domino effects have been conducted. First, the main sources of uncertainties are identified (data source, analyst’s knowledge, assumptions). Then, the relationship among data uncertainty, model uncertainty and sources are clarified. Based on the premise, uncertainty factors have been identified and discussed in detail. Depending on the specific parts of the analysis, the uncertainty can be different at every stage. This is a preliminary work for further developing methodologies to model the uncertainties in QRA of domino effects. References Chao, C., Reniers, G., Khakzad, N., 2020, A thorough classification and discussion of approaches for modeling and managing domino effects in the process industries, Safety Science, 125. Council Directive., 2012, European Parliament and Council Directive of 4 July 2012 on Control of Major-accident Hazards Involving Dangerous Substances. Official Journal of the European Communities. Cozzani, V., Gubinelli, G., Salzano, E., 2006, Escalation thresholds in the assessment of domino accidental events, Journal of Hazardous Materials, 129, 1-21. Cozzani, V., Salzano, E., 2004, The quantitative assessment of domino effects caused by overpressure: Part I. Probit models, Journal of Hazardous Materials, 107, 67-80. Cozzani, G., Gubinelli, G., Antonioni, G., Spadoni, G., Zanelli, S., 2005, The assessment of risk caused by domino effect in quantitative area risk analysis, Journal of Hazardous Materials, 127, 14-30. Eisenberg, A., Lynch, J., Breeding, J., 1975, Vulnerability model. A simulation system for assessing damage resulting from marine spills. Enviro control inc rockville md. Gledhill, J., Lines, I., 1998, Development of methods to assess the significance of domino effects from major hazard sites, CR Report 183, Health and Safety Executive. Gubinelli, G., Zanelli, S. Cozzani, V., 2004, A simplified model for the assessment of the impact probability of fragments, Journal of Hazardous Materials, 116, 175-187. Reniers, G.,Cozzani, V., 2013, Domino Effects in Process Industry: Modeling, Prevention, and Management, Elsevier, Amsterdam, The Netherlands. Khakzad, N., Amyotte, P., Cozzani, V., Reniers, G., Pasman, H., 2018, How to address model uncertainty in the escalation of domino effects?, Journal of Loss Prevention in the Process Industries, 54, 49-56. Khan, F., Abbasi, A., 1998, Models for domino effect analysis in chemical process industries, Process Safety Progress, 17, 107-123. Landucci, G., Gubinelli, G., Antonioni, G., Cozzani, V., 2009, The assessment of the damage probability of storage tanks in domino events triggered by fire, Accident Analysis & Prevention, 41, 1206-1215. Lisi, R., Consolo, G., Maschio, G., Milazzo, M., 2015, Estimation of the impact probability in domino effects due to the projection of fragments, Process Safety and Environmental Protection, 93, 99-110. Mukhim, E., Abbasi, T., Tauseef, S., Abbasi, S., 2017, Domino effect in chemical process industries triggered by overpressure—Formulation of equipment-specific probits, Process Safety and Environmental Protection, 106, 263-273. Mingguang, Z., Juncheng, J., 2008, An improved probit method for assessment of domino effect to chemical process equipment caused by overpressure, Journal of Hazardous Materials, 158, 280-286. Nilsen, T., Aven, T., 2003, Models and model uncertainty in the context of risk analysis, Reliability Engineering & System Safety, 79, 309-317. 570 lp-2022-abstract-223.pdf An Exploratory Study on Uncertainty Analysis in Quantitative Risk Assessment of Domino Effects