CET vol 99 DOI: 10.3303/CET2399058 Paper Received: 17 January 2023; Revised: 13 March 2023; Accepted: 22 April 2023 Please cite this article as: Di Girolamo C., Carra S., Monica L., Tonti A., 2023, Risks in Loading and Unloading LPG at Storage Sites: Analysis of a set of Quasi-accidental Events, Chemical Engineering Transactions, 99, 343-348 DOI:10.3303/CET2399058 CHEMICAL ENGINEERING TRANSACTIONS VOL. 99, 2023 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Sauro Pierucci, Flavio Manenti Copyright © 2023, AIDIC Servizi S.r.l. ISBN 978-88-95608-98-3; ISSN 2283-9216 Risks in Loading and Unloading LPG at Storage Sites: Analysis of a Set of Quasi-Accidental Events Casto Di Girolamoa, Silvia Carrab,*, Luigi Monicab, Andrea Tontib aINAIL, Unità Operativa Territoriale di certificazione, verifica e ricerca di Piacenza, Via Rodolfo Boselli 59/63, 29122 Piacenza bINAIL, Dipartimento Innovazione Tecnologica e Sicurezza degli Impianti, Prodotti e Insediamenti Antropici, Via Roberto Ferruzzi, 38, 00143 Roma, Italy si.carra@inail.it In Europe, several industrial plants present significant quantities of dangerous substances that can potentially cause major accidents with catastrophic consequences and domino effects on the surrounding areas. LPG storage sites belong to that category of installations and they are subject to the Directive 2012/18/EU. In such high-risk contexts, near-misses associated to LPG transfer and handling can represent a possible precursor of catastrophic events in the long term, therefore suggesting corrective and improvement actions. In the present study, the sequence of quasi-accidental events that occurred between 2012 and 2021 in an Italian LPG storage site, whose main activity consists of receiving, storing, bottling and shipping LPG, is analysed. Data are extracted from the company accidents database in the form of operative experience sheets for Seveso audits, as well as from other internal technical documents. The focus is on LPG transfer operations and the multiple factors (technical, organizational and human ones) that may have contributed to the occurrence of the undesired events, with a particular attention to maintenance procedures and machinery management. Results are expected to contribute to the understanding of the relationships between precursor events and possible major accidents in critical industrial sites. 1. Introduction Several European industrial plants are subject to Directive 2012/18/EU (Seveso III), since they present significant quantities of dangerous substances that can potentially produce devastating consequences in case of an accident. In such contexts, any event that could have caused serious consequences, but which have been avoided due to fortuitous circumstances (as the failure to ignite flammable substances), is considered as a “quasi-accident” or “near-miss”. It represents a possible precursor of catastrophic events in the long term, but it needs to be triggered by adverse conditions that, fortunately, do not always occur. Storage sites for Liquefied Petroleum Gas (LPG) belong to such category of industrial plants, since they present significant risks associated to LPG transfer from/to tanks and rail tanks, e.g. the risk of product losses, with exposure of workers, and even explosive events. As an example, the major accident described by Bubbico and Marchini (2008) was exactly related to the specific operation of transferring LPG from a source road tank car to a receiving fixed storage vessel. Moreover, scientific research has also started to be interested in risk assessment models for LPG in the course of loading and unloading (Cao, 2014). Anyway, the official literature on that topic still appears relatively limited if compared to the amount of technical documentation available in grey literature. This means that new scientific contributions on the specific topic of LPG transfer risks can help to spread a structured and unambiguous knowledge on the subject. In Italy, specific safe operating sequences have to be adopted for transferring dangerous goods, depending on whether they are carried on by road, rail or sea. In particular, the safety procedures for (i) carrying out the transfer activities in LPG tankers and rail tankers, (ii) operating with LPG storages in fixed tanks and mobile containers and (iii) carrying out work activities in railway freight yards are defined by specific National Decrees 343 (INAIL, 2012). The entire LPG supply chain may also present different degrees of risk depending on how it is organized, as in terms of decentralization, with further effects even on sustainability (Pourhejazy et al., 2019). Data about quasi-accidents, coming from inspections and interviews, can help the company management in putting into practice corrective and improvement actions, both provisionally and definitively. Recent literature reports studies based on deep analysis of the historical sequence of accidents and potentially dangerous events in process plants with risk of high-impact low-probability disasters (Vallerotonda et al., 2022), but also in scenarios subject to low-impact high-probability accidents, as constructions. While manipulating past accidents and near-misses through systematic review, it is in fact possible to hypothesize possible future critical scenarios and guarantee safety with a resilient attitude and appropriate reactions. The first step is to identify the conceptual categories that could be used in order to classify and analyse such accidental data. For example, Fabiano and Currò (2012) realized a review of the story of oil industry in order to identify factors related to plant/process (e.g. failure to equipment), environment (e.g. natural event) and organization (e.g. maintenance or worker error), with an additional schematization of causes, as well as consequences, of each event. More recently, Baldissone et al. (2019) have classified unsafe human behaviours as well as preconditions for such unsafe acts (i.e working conditions, unsafe supervision and organisational influences) even in the manufacturing field, while adopting a dedicated classification system including the human component. In the present study, the sequence of quasi-accidental events that occurred in an Italian industrial site, whose main activity consists of receiving, storing, bottling and shipping LPG, is analysed. LPG is unloaded from rail tankers by compressors, transferred to mounded vessels and then pumped into tankers for subsequent distribution, for combustion or transport use. The maintenance activity, which mainly concerns pumps, compressors and pipes, is preferably carried out externally, in order to limit the access of third parties. In any case, notwithstanding the automation of many processes, the human operation is still present in the site. In high-hazard contexts, the role of human reliability (Di Nardo and Murino, 2021) cannot be ignored. In particularly complex transport contexts, as LPG maritime transport, it has been assessed through second generation human reliability assessment methods (Akyuz and Celik, 2015). Moreover, in the considered site, different dangerous activities (bottling, loading) are performed at the same time in close proximity, so even more attention is required (Baybutt, 2017). In particular, the present work analyses quasi-accidental events that occurred in the last decade in the considered industrial site. The analysis is based on data extracted from the company accidents database, i.e. mainly the official operative experience sheets as provided during Seveso audits, but also additional internal documents and reports for further confirmation and deepening. Data mainly refer to machinery failures, instrumentation failures, human errors and maintenance issues related to LPG loading and unloading. The study aims to identify and analyse multiple factors (technical, organizational and human ones) that may have contributed to the occurrence of the undesired events, with a particular attention to maintenance procedures and machinery management. Even the corrective actions implemented and programmed in the site are intended as an opportunity to understand the approach to safety in the company and, more generally, in the sites of LPG storage and distribution. 2. Data collection and analysis At AGN site in Fontevivo (Parma area, in Italy) the activity consists of receiving, storing, bottling and shipping LPG, which is unloaded from rail tankers by compressors, then transferred to mounded vessels and finally pumped into tankers for subsequent distribution and combustion or transport use. The storage site falls within the scope of Legislative Decree 105/2015 (Italian transposition of Seveso III Directive), with a total storage capacity of almost 4000 m3. A part of the received LPG - that intended for combustion use - is firstly denatured, by adding a marker substance in adequate quantities, and then stored in six mounded cylindrical vessels with horizontal axis. Denaturing is required for taxation and customs traceability purposes, as it allows to easily distinguish LPG for combustion use from non-denatured LPG for automotive use. Denatured LPG does not only come out in tankers; it is also bottled in cylinders that are carried by trucks and sent, for example, to stores serving private individuals. In the bottling area, a semi-automatic system includes several hand weighing scales, with gross weight setting. Both denatured and not-denatured LPG are also subjected to odorisation, that is a process which consists in adding tert-butyl mercaptan (TBM) in adequate quantities to LPG - which is naturally odorless and colourless - so that its presence may be perceptible in case of release into the atmosphere. The area where the denatured LPG is handled is called “Red Department”, while the area for the handling of not-denatured LPG is called “White Area”. Each of them is equipped with a room for pumps and compressors. Compressors are used for unloading activities; each one of them is placed on the gas line that joins the two tanks interested in the transfer, sucking gas from the one to be filled and compressing it in the one to be emptied. 344 Pumps are used for loading tankers, bottling cylinders and for transferring LPG from storage tanks in the White Area to the ones in Red Area. Each pump itself gives the liquid LPG the prevalence necessary for the transfer from one tank to another. Figure 1 gives a schematic representation of LPG flux all along such site areas. Figure 1: Schematization of LPG flux within the site. The present work analyses 65 quasi-accidental events that touched the plant from 2012 to 2021. Data are taken from operative sheets for Seveso audits and safety internal reports. The company has established procedures to regulate the report of accidents, near-misses, anomalies and injuries, while trying to identify causes and adopting corrective actions. In accordance with company reports, near-misses are here considered extraordinary events that could have caused consequences such as those of an accident (damage to people, environment or company assets), finally avoided due to fortuitous circumstances. Anomalies are deviations from normal operating conditions, i.e. failures, or from normal procedural and organizational arrangements. 2.1 Analysis criteria and methodology A previous historical analysis of accidents in similar high-risk plants (for LPG, propane, butane), realized by the company based on international databases, tried to pre-identify accidents that could occur during loading and unloading, storage and handling phases, considering types of generating causes (e.g. mechanical failures, human errors), accidental consequences (e.g. release, fire, explosion) and types of ignition. The analysis reached the conclusion that the following events were non-excludable a priori at Fontevivo site: • mechanical failures on pumps, compressors, lines and valves; • mechanical failures on valve/tap in cylinders; • releases caused by human errors while connecting moving parts in loading and unloading operations. Anyway, in such previous study based on international data, the causes related to the specific activity of LPG loading/unloading resulted mostly (58%) unexpectedly "undefined": this fact further justified the opportunity to carry out the present research in order to deepen the topic. The selected events were therefore inserted into a general spreadsheet, where specific attributes, as detailed in Table 1, have been used to classify them. It was not necessary to specify the severity of the events because neither workers’ injuries nor major structural damages to the plants were reported. Critical “top events” are quasi-accident typologies including both LPG releases and other kinds of anomalies. Even small releases can be precursors of major accidents. In addition, unwanted events related to machinery (pumps and compressors) represent a not-negligible aspect, together with all anomalies on bottling lines for LPG cylinders. During the bottling operations, any losses must be promptly eliminated and, after bottling, each cylinder should be checked to make sure that there are no leaks from shut-off devices (INAIL, 2012). All top events can be thought as distributed between different “Logic units”, representing the distinction between the effective loading/unloading phases from the pure storage function in vessels and other plant components. 345 The analysis continues with the identification of possible human, technological and organizational causes of unwanted events, together with the correspondent actions, taken and programmed, for managing and preventing similar quasi-accidents. Table 1: Attributes for classification of quasi-accidental events Attribute Description Year Year of event occurrence Brief event description Short title used to quickly identify and understand the event Critical top event Release in loading; Release in unloading; Release from a compressor; Release from a pump; Other anomaly; Anomaly in cylinders; Anomaly on compressors or pumps. Logic unit Process phase involving the unexpected event. Loading/unloading; Storage; Other (e.g. handling lines, alarm systems). Presence of a human cause component Eventual behaviours of workers that can be considered the cause (or one of the causes) of the unwanted event Presence of a technological cause component Eventual characteristics of the plant/equipment that can be considered the cause (or one of the causes) of the unwanted event Presence of an organizational cause component Eventual organizational procedures and regulations that can be considered the cause (or one of the causes) of the unwanted event Actions taken and programmed Interventions based on work organization (e.g. workers’ training, control procedures) and improved technical systems (maintenance). 2.2 Analysis results All quasi-accidental events have been analyzed and classified by applying the abovementioned attributes. It has been observed that 41 of them (63%) was related to LPG loading/unloading logic units, while 18 events (28%) were strictly related to anomalies in storage vessels (Figure 2). The latter consist mainly in malfunctioning of level indicators with consequent false alarms, due for example to their misalignment or to problems at the intrinsic safety barriers, as well as discrepancies between the values in the field and those sent back remotely to the synoptic panels. It must be always checked in fact that the fixed or mobile receiving tank does not come filled beyond the safe level. Category “Other” includes 6 other cases, as malfunctioning of fire protection pumps. Figure 2: Number of identified unwanted events for each logic unit in the site. It was finally chosen to process only the 41 events at the loading and unloading stages, in accordance with the initial work objectives. The analysis showed that the majority of events concerns machines (compressors and pumps), which together are involved in 54% of the events reported in the company operative sheets, whether they include both leakage and other anomalies (e.g. abnormal noise, problems with the electric motor). The hatched area marks such machinery component in Figure 3, where the distribution of all the identified typologies of critical top events between the reported quasi-accidents and anomalies is shown. It is possible to observe that LPG releases (from metallic arms during loading or unloading phases or specifically from pumps and compressors) touches another 54% of the unwanted events. Only a small percentages (three events) is related to various kinds of anomalies regarding LPG cylinders, while 12% of cases presents anomalies other than the release of LPG and that do not concern machinery. The latter include, for example, failures of the gas leak detection system in loading and unloading (three cases). 41 18 6 0 10 20 30 40 50 Loading/Unloading Storage Other 346 The data analysis also showed that in almost all cases (39 events) maintenance is reported by the company as the main action taken successfully for solving the anomalies, while only in two cases workers training and/or an update of operative procedures were required. In addition, in 39% of cases, a long-term monitoring of components similar to those involved in quasi-accidents was also previewed. Figure 3: Number of identified unwanted events for each typology of critical top event. The hatched area globally refers to events involving machinery (pumps, compressors). 3. Results interpretation and discussion The analysis of the operating sheets at the investigated LPG site globally shows an accident recent history free of serious accidents or injuries and also a scrupulous and prudent attitude in the management of any anomaly. Moreover, the company internal documentation shows that several technical solutions are expressly previewed and aimed at trying to prevent the most probable hypothesized unwanted top events (e.g. pressure relief devices, emergency stop systems, anti-overfilling automatic blocking of the loading phase, leak sensors). The analysis carried out on the quasi-incidental events occurred in the LPG loading and unloading phases has highlighted that - as in many high risk contexts - the release of very small quantities of dangerous substances represents one of the most common examples of dangerous situations. They could potentially have catastrophic consequences, which could arise under additional further adverse conditions and in case of no-effectiveness of the envisaged barriers. The large proportion of cases involving anomalies and failures in pumps and compressors also emphasises the importance of keeping a general good functionality of the equipment and of guaranteeing its compliance with the European Product Directives. The most unexpected result is that the contribution of the human factor to the incidental events seems to be minimal. Only in few cases, even in absence of errors by the operators, a necessary update/improvement of the adopted procedures was carried out. On the other hand, maintenance (a technical and organizational component) seems to be the key tool for the resolution of problems. In some cases, maintenance has been also carried out as a further precaution, even on machines with a relatively low number of operating hours. A previous work by some of the authors (Carra et al., 2022) reported historical data from of a different high-risk site (a polyurethane systems production plant): in that case, the human component (mainly distractions and oversights of operators but also human decisions at higher hierarchical levels) seemed instead to have a fundamental role in causing accidents. Even previous international literature studies showed that risks in LPG transfer operations can be strongly influenced by the human factor, as for possible incorrect behaviours of truck drivers and transfer operators (Gallab et al., 2017), for example in following the procedures of transfer operations or in realizing checks and controls (Silvestri et al., 2000). Sheikhalishahi et al. (2016) highlighted that even maintenance can be influenced by critical human factors, but in Fontevivo site the maintenance activity, which mainly concerns pumps, compressors and pipes, is preferably carried out externally, in order to reduce internal human errors. Anyway, the human intervention is still present and significant: for example, in the bottling area there is a semi-automatic system where an operator, after having evaluated the tare of the single cylinder, sets the value of the maximum filling level at which the system must automatically stop. Moreover, the analysis of the other two logic units (LPG storage, LPG handling lines), as realized by the company in the abovementioned preliminary research on international databases, showed that human error seems to affect at least 62% of the analyzed events regarding LPG handling in many industrial sites. The low number of reports involving human error could be linked to the strong standardization of pro-safety technologies and procedures achieved over the years in the LPG storage field, also thanks to stringent regulatory impositions. In any case, this all suggests that a dedicated research in the future could deepen the 11 5 37 4 8 3 Anomaly on compressors or pumps Other anomaly Anomaly in cylinders Release in unloading Release in loading Release from a pump Release from a compressor 347 role of human factor in safety management in LPG storage sites, starting from a comparison with similar plants. This could also allow to verify the reliability of the analyzed data by minimizing the effect of possible biases (e.g. missing reports). In addition, it could be interesting to evaluate possible differences in the human role between different typologies of Seveso plants (e.g. storage sites of dangerous substances, chemical plants, oil refineries). 4. Conclusions The historical sequence of quasi-accidental events that occurred in the last decade in an Italian LPG storage site has been analyzed, in order to identify possible multiple factors (technical, organizational and human ones) that may have contributed to the occurrence of the undesired events during LPG transfer operations. Data have been extracted from the company accidents database. The most common accident typologies in the site have been identified, together with organizational and technological measures used to solve and prevent criticalities. Results show that little more than half of the quasi-accidental events is related to LPG releases; moreover, the conformity and good functioning of loading and unloading machines (pumps and compressors) is essential to ensure safety and to limit possible anomalies as precursors of major accidents. The central role of the maintenance activity (both on machinery and on metallic loading/unloading arms) has appeared evident. The role played by the human factor in the occurrence of undesirable events (in terms of possible operators’ errors or poor management of procedures) has not emerged significantly. It is expected that further investigation on similar industrial sites or on other categories of Seveso plants may help to clarify which factors could determine the greater or lesser weight of the human component in terms of quasi-accidents incidence. Acknowledgments The authors are very grateful to AGN Energia S.p.A. for its support. References Akyuz E., Celik M., 2015, Application of CREAM human reliability model to cargo loading process of LPG tankers, Journal of Loss Prevention in the Process Industries, 34, 39-48. Baldissone G., Demichela M., Comberti L., Murè S., 2019, Occupational accident-precursors data collection and analysis according to Human Factors Analysis and Classification System (HFACS) taxonomy, Data in Brief, 26, article number 104479. Baybutt, P., 2017, Simultaneous Operation (SIMOP) review: an important hazard analysis tool, Process Safety Progress, 36(1), 62-66. Bubbico R., Marchini M., 2008, Assessment of an explosive LPG release accident: a case study, Journal of Hazardous Materials, 155, 558–565. Cao W.Y., 2014, Railway transportation of LPG: a risk assessment of LPG in the course of load-and-unload, Advanced Materials Research, 1030-1032, 2078-2081. Carra S., Monica L., Di Girolamo C., Salerno A., 2022, Accidents and near-misses in the history of a high-risk chemical installation: analysis of the human component, Chemical Engineering Transactions, 91, 133-138. Di Nardo M., Murino T., 2021, The system dynamics in the human reliability analysis through cognitive reliability and error analysis method: a case study of an LPG company, International Review of Civil Engineering, 12(2), 56-68. Fabiano B., Currò F., 2012, From a survey on accidents in the downstream oil industry to the development of a detailed near-miss reporting system, Process Safety and Environmental Protection, 90, 357–367. Gallab M., Bouloiz H. Tkiouat M., Garbolino E., 2017, Conformity checking of LPG transportation trucks by modelling and simulation, MATEC Web of Conferences (IWTSCE 2016), 105, article number 00004. INAIL (Ed), 2012, Dangerous goods handling. Loading, unloading, porterage of goods and materials, printed by INAIL typography, Milan, Italy (in Italian). Pourhejazy P., Kwon O.K., Lim H., 2019, Integrating sustainability into the optimization of fuel logistics networks, KSCE Journal of Civil Engineering, 23(3), 1369-1383. Sheikhalishahi M., Azadeh A., Pintelon L., Chemweno P., 2017, Human factors effects and analysis in maintenance: a power plant case study, Quality and Reliability Engineering International, 33(4), 895-903. Silvestri F., Saccone M.V., Incorvaia C.F., 2000, The risk of release during transfer from mobile tanks: factors related to transport systems, characteristics of the transfer points and human component. Proposals for plant and regulatory interventions, Proceedings of Italian National Conference VGR 2000 (Risk assessment and management in civil and industrial settlements), article number 132, Pisa, Italy (in Italian). Vallerotonda M.R., Ansaldi S., Pirone A., Bragatto T., Bragatto P., 2022, Accident triggered by electrical failures in Seveso sites, Chemical Engineering Transactions, 91, 211-216. 348 316digirolamo.pdf Risks in Loading and Unloading LPG at Storage Sites: Analysis of a Set of Quasi-Accidental Events