DOI: 10.3303/CET23104022 Paper Received: 16 May 2023; Revised: 20 June 2023; Accepted: 22 October 2023 Please cite this article as: Giannelli G., Grillone G., Muratore A., Nastasi V., 2023, Risk Assessment of Lpg Release Scenarios, Chemical Engineering Transactions, 104, 127-132 DOI:10.3303/CET23104022 CHEMICAL ENGINEERING TRANSACTIONS VOL. 104, 2023 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Sabrina Copelli, Ernesto Salzano Copyright © 2023, AIDIC Servizi S.r.l. ISBN 979-12-81206-06-9; ISSN 2283-9216 Risk Assessment of LPG Release Scenarios Giuseppe Giannellia, Giovanni Grilloneb, Antonino Muratorea,*, Vincenzo Nastasib aInail, UOT Como, Via Petrarca 4 - 22100 Como, Italy bInail, UOT Palermo, Via dei Cantieri 120 - 90142 Palermo, Italy a.muratore@inail.it Accidents involving accidental release of liquefied petroleum gas (LPG) can cause very serious damage to people and structures. Such as, for example, the derailment of a freight train carrying LPG, which occurred in Viareggio (Italy) on 29 June 2009 or the accident involving the fixed tank installed at the end user, which occurred in Gravedona (Italy) on 11 July 2019. The danger of LPG derives from its flammability and its tendency to form a dense cloud of vapour which is dispersed in atmosphere, even at a significant distance from the release, which if ignited can explode. In the present work, authors give indications for risk assessment of LPG release scenarios. The evaluation is obtained by combining the probability of the occurrence of the scenarios with the relative class of consequences of the dangerous phenomena (effects on the human target and effects on the environment target). The combination obtained through a risk matrix has the purpose of identifying the accident scenarios with the greatest impact. From matrix scenarios, we can deduce: - Phenomena with a low frequency and/or consequence that probably have no concrete effect on the damage; - Phenomena which will certainly lead to the development of real damage (these will have to be re-analysed in order to insert additional safety systems); -Phenomena of medium effect, which will probably have real effects on the damage and will be selected for further study. These scenarios for LPG depots, which fall under the activities at risk of major accident, are the basis of correct territorial planning and internal and external emergency planning; also consider the Italian Directive of the Presidency of the Council of Ministers - Civil Protection Department of 7 December 2022. (Guidelines for the preparation of the external emergency plan, guidelines for informing the population and guidelines for testing external emergency plans (Italian Official Gazette no. 31 of 7 February 2023)). 1. Evolution of LPG release In the chronological sequence represented in Figure 1, authors schematize the succession of possible phenomena resulting from the release of LPG due to any cause, such as a leak from a tank valve, an error during the transfer phase, the formation of a leak on the tank due to an impact or an overturning, etc. Figure 1: Tree of events following the release of LPG Following the loss of liquid LPG, part of it evaporates by isoenthalpic flash, while the subcooled LPG fraction forms a pool, from which further evaporation takes place. Two factors determine the dilution of a cloud of LPG vapour: • Wind (direction and speed): determines the distance of the cloud from the source of dispersion; • Turbulence: determines the dilution of the cloud and its mixing with the air. 127 In general, conditions of instability occur when the sun warms the ground causing turbulent convective motions; conditions of atmospheric stability are instead at night. The most common Dangerous Phenomena for LPG are: Poolfire: The combustion of material evaporating from a layer of liquid (a pool). The occurrence of the layer of liquid results from the failure of equipment containing a flammable liquid. Jet fire: The handling of pressurised flammable liquid or gas can lead to a jet fire in case of a leak on a pipe or on a vessel. The fluid ignition lead to form a jet flame characterised by a high radiant energy (largely higher than pool fire radiation) and by a noticeable kinetic energy. Flash fire, VCE, UVCE: When a leakage occurs on an equipment item, a gaseous release can occur, either directly, or following the gradual vaporization of a pool on the ground close to the leakage. This event leads to the formation of a cloud that drifts and disperses with the wind. If the substance is flammable, there is an intermediate zone in which the vapour concentrations in the air are between the flammability limits of the substance. A sufficiently energetic ignition source, on the trajectory of the flammable zone of the cloud, may ignite this cloud. According to the front flame speed, the accident will lead to a flash fire or a VCE (Vapour Cloud Explosion). The latter event causes an overpressure – under pressure wave. A devastating effect is associated with the peak overpressure as well as with the wave shape. The probability that a cloud of LPG determines its explosion, known in the literature as UVCE (Unconfined Vapour Cloud Explosion) instead of a flash fire, essentially depends on the geometry of the place where the cloud extends. BLEVE, Fireball: The term BLEVE is an acronym for Boiling Liquid Expanding Vapour Explosion. The BLEVE is one type of phenomena that may result from a catastrophic rupture. A BLEVE may occur when a vessel, containing a liquid highly superheated above its normal atmospheric boiling point, fails catastrophically. The risk of a BLEVE is typically associated with pressurized liquefied gas storage or pressurized liquids. The first consequence of a BLEVE is a blast effect due to vapour expansion when the vessel fails and to the explosive vaporisation of the vessel liquid content. This effect is generally followed by missiles ejection. If the substance is flammable, the air-substance aerosol can ignite immediately. The flame front rapidly moves away from the ignition point, generating a fireball. Its temperature is extremely high and it causes an important thermal radiation. Missiles ejection: Various equipment items can be concerned by an explosion or by a pressure increase causing their burst with missiles ejection: The BLEVE of a pressure vessel can generate missiles. Overpressure generation: A rapidly propagating pressure or shock-wave in atmosphere with high pressure, high density and high velocity. 2. Bow-tie diagram A scenario describes the conditions that might lead to a major accident and the potential consequences, which in most cases is the loss of containment (LOC) also known as the critical event (CE) of LPG, or the change of state of liquid LPG, combined with particular conditions that eventually lead to a fire, explosion, and/or release. In the EU Seveso Land-Use Planning Guidelines a “scenario” to be used for LUP risk analysis is defined as: Scenario = “Top Event” (usually/mostly Loss of Containment) & Dangerous Phenomenon (fire, explosion, gas cloud). This definition means that two elements generally analysed separately are merged in order to simplify the assessment. It is represented below using the bow-tie diagram (Gyenes Z. et al.): Figure 2: A scenario as depicted in a bow-tie diagram As indicated on the left side of the bow-tie, a reference scenario typically starts with an initiating event (IE) that leads to the critical event (CE), usually the loss of containment. The right side of the bow-tie depicts the development of scenario (SCE) after the “critical event” leading to the realization of a dangerous phenomenon (DP) or phenomena that produce undesirable consequences. On the left is the fault tree, which identifies the 128 possible causes of the critical event, while on the right, the event tree, which identifies the possible consequences of the critical event (Giannelli G. et al.). Table 1 below shows typical examples of each of these categories. Table 1: Some examples of elements of a typical accident scenario Initiating Event (IE) Critical Event (CE) Dangerous Phenomena (DP) Undesirable Consequence Overpressure Catastrophic vessel failure BLEVE Employees killed or injured Property damage, Employees injured, Property damage Corrosion Hole in vessel wall Pool fire Loose flange Pipe leak Flash fire, Pool Fire, Jet fire Employees injured, Environmental damage Self-refrigeration Catastrophic vessel failure BLEVE Employees killed or injured, property damage Earthquake, Flood Pipe leak, Catastrophic vessel failure Flash fire, Pool Fire, Jet fire, BLEVE Employees killed or injured, Property damage, Environmental damage When selecting accident scenarios for land-use planning, in theory the user would initially derive a number of generic accident scenarios, based only on the substance (LPG) and the type of installation (e.g. pressurised, pipeline, loading/unloading, etc.). These scenarios could be evaluated in a probabilistic or deterministic way using the relevant data and compatibility with existing land uses. If incompatibility between the site and the land- use are found, the user could then review the events leading to the final undesirable outcome of the scenario, to identify opportunities for preventing the critical event or for reducing the impact of events following the critical event. As such, the consequence analysis process is useful tool for not only estimating risk but identifying additional technical measures that could eliminate or reduce the likelihood or consequences of a potential accident scenario (Muratore A. et al.). The most common scenario trees for Liquefied Petroleum Gas are: - LPG above ground pressurised storage tank; LPG pump/compressor; LPG pipework; LPG loading/unloading arm/hose; LPG road tanker/rail tanker. 3. Frequencies of dangerous phenomenon In order to determine the frequency of occurrence of the dangerous event (DP, right side of the bow-tie diagram), it is necessary to start from the initial events (IE). Once the initial events have been identified, one proceeds with determining their frequency. IE are the first upstream cause of each branch leading to the critical event in the fault tree. There is little information on frequency in the scientific literature, so whenever possible use accurate plant data or try to estimate frequency with plant employees or with data extrapolated from the operational experience of other similar plants. From this point of view, the frequency of occurrence per year can be identified: F< 1.0 E-04, very low frequency, unlikely event; 1.0 E-04 < F < 1.0 E-03, low frequency, event could occur or has occurred at least 1 time in 1000 years; 1.0 E-03 < F < 1.0 E-02, low frequency, event could occur or has occurred at least 1 time in 100 years; 1.0 E-02 < F < 1.0 E-01, high frequency, possible event, has occurred at the site at least once in 10 years; F > 1.0 E-01, very high frequency, probable event, occurred several times within the site. Once the EI frequency values have been found, it is necessary to indicate them on the bow-tie diagram. The next step is to identify the safety functions and systems on the fault tree, evaluating their performance and how these affect the frequency of CE. This methodology starts from the initial events (EI) of the fault tree and proceeds towards the critical events (CE), taking into consideration the prevention safety barriers. If it is not possible to calculate frequency of the critical event based on the fault tree analysis, there is the possibility to evaluate it through generic critical event frequencies. In Appendix 10 of Deliverable D.1.C. (Delvosalle C. et al.) values or frequency ranges of the different critical events are provided, depending on the type of equipment considered. An extract is shown in Figure 3, where the acronym CE indicates the critical event, while EQ the equipment affected by the critical event: 129 Figure 3: Extract of generic critical event frequencies The frequencies indicated in Figure 3 are generic and provided for "standard" prevention safety barriers, even if they are not specified in the literature; therefore, the data must be used carefully. If the prevention safety barriers level is high, the risk analyst should decrease the CE frequency value derived from Figure 3, if the prevention safety barriers level is low, the risk analyst should increase the CE frequency value derived from Figure 3. It is essential to highlight the importance of Safety Management Systems (SMS) for risk control purposes. By introducing actions related to technical, human and organizational factors, a good SMS has the objective of inserting and maintaining the prevention barriers at their maximum level of efficiency, reducing the probability that CE occurs. Once the interval in which the frequency can fall has been identified, a value must be chosen within it, possibly high if there are low levels of safety or, vice versa, if the level of safety is good. The information found in the literature does not allow to provide more precise information regarding the choice of a specific value. Once the frequency of the critical event (CE) has been defined, for the calculation of the frequency of the dangerous phenomenon (DP) it is necessary to proceed step by step in the tree of events, obtaining as output the frequency of each dangerous phenomenon. First, it is necessary to evaluate how the probabilities propagate along the branches of the tree and to take into consideration the safety barriers. Therefore, it is necessary to identify the protective devices to be inserted in the event tree (right side of the "bow-tie" diagram) and quantify their influence. The output of this phase is a list of dangerous phenomena (DP) associated with each critical event. Below are the data on the frequencies of occurrence of a Dangerous Phenomena (DP) associated with a specific "frequency class": F-1 for values of 1.0 E-03; F-2 for values of 1.0 E -04; F-3 for values 1.0 E-05; F-4 for values of 1.0 E-06; F-5 for values 1.0 E-07. These data derive from the authors' operational experience with regard to the institutional activity of inspection, verification and control, both in the context of establishments at risk of a major accident and in ordinary working conditions. 4. Estimate damage class From critical event (CE) are identified dangerous phenomena (DP) due to the release of LPG, Table 2 relates possible major events (ME) of final scenarios. Table 2: Relates dangerous phenomena (DP) to major events (ME) of final scenarios Dangerous Phenomena (DP) Thermal radiation (ME1) Direct flame contact (ME2) Overpressure (ME3) Missiles (ME4) Pool Fire, DP1 (1) X X Flash Fire, DP2 X X VCE, DP3 (2) X X Jet Fire, DP4 (3) X X BLEVE e Fireball, DP5 (4) X X X Missile ejection, DP6 X Over pressure generation, DP7 X (1) Note: Only thermal radiation needs to be considered if the area for direct flame contact is contained by the area for thermal radiation. (2) Note: A vapour cloud explosion may occur in the presence of confined or congested areas. This phenomenon is always accompanied by the flash fire. For flash fire, it is common practice to consider direct flame contact. Thermal radiation contours may be slightly larger than the flame footprint, but are hard to calculate due to the dynamics of the combustion of the cloud. (3) Note: Only thermal radiation needs to be considered if the area for direct flame contact is contained by the area for thermal radiation. (4) Note: A BLEVE may occur for flammable and non-flammable substances. For flammable substances, a fireball often accompanies a BLEVE. 130 The assessment of the consequences of the major events (ME) of the scenarios is mainly based on the application of models that represent the physical phenomena resulting from the loss of containment from a pipe or a LPG tank, which manifests itself as a release of matter and/or power. In order to determine the consequences of major events (ME) of the final scenarios, authors propose to use the Shortcut Method. This method takes into account the qualitative and quantitative types of substances stored and the damage threshold values. This method refers to four corresponding threshold values: - 1, high lethality effects; - 2, lethality initiation effects; - 3, effects involving serious irreversible injuries; 4, effects involving reversible injuries. With regard to the effects of high lethality, it is proposed to distinguish the same, depending on whether it occurs inside the establishment or outside the establishment. The Shortcut method reports the distances (in meters) for the various damage thresholds listed above, with reference to the quantity of substances stored and for certain reference meteorological conditions (D5: neutrality with wind 5 m/s, F2: moderately stable with wind 2 m/s) distinguishing for FLASH FIRE or VCE scenarios. Figure 4 shows an extract for VCE scenario. Quantity stored (tons) < 40 41 - 160 161 - 240 241 - 400 > 400 D5 F2 D5 F2 D5 F2 D5 F2 D5 F2 1 140 230 140 230 155 210 230 330 300 440 2 170 280 170 280 185 280 270 420 360 560 3 210 370 210 370 230 370 340 560 460 740 4 330 620 330 620 360 610 530 930 710 1250 Figure 4: Extract of the distances in meters of the Shortcut method for VCE scenario To make this approach clearer, authors propose the following classification of damage: A, reversible injury effects inside the establishment; B, irreversible injury effects inside the establishment or reversible effects outside the establishment; C, early lethality inside the establishment or irreversible injuries outside the establishment; D, high lethality inside the establishment or early lethality outside the establishment; E, high lethality outside the establishment. These data derive from the authors' operational experience with regard to the institutional activity of inspection, verification and control, both in the context of establishments at risk of a major accident and in ordinary working conditions. 5. Scenarios risk matrix The risk matrix (Figure 5) provides a representation of the dangers deriving from the occurrence of accident scenarios without the need to resort to a quantitative assessment of the associated risk. The matrix is built based on the separate evaluation of the frequency (paragraph 3) and the damage class of each single event (paragraph 4). The matrix is obtained by plotting the expected frequency of occurrence and the severity of the consequences associated with each accident scenario in a Cartesian plane. Therefore, a point in the Cartesian plane represents a scenario. The position of an accident in the matrix constitutes a measure, albeit qualitative, of the risk associated with it and can be used for the purpose of assessing tolerability of the dangers associated with the event in question, making it possible to discriminate among all the most critical scenarios. Figure 5: Scenarios risk matrix We identify three levels of risk: • R1, area of risk tolerable (green area). If a scenario is positioned in this area, the risk associated with it is to be considered tolerable without further interventions (outside maintenance); 131 • R2, intervention area (yellow area). In the case of events located in this area, prevention or mitigation measures must be implemented; • R3, intolerable risk area (red area). For the scenarios that fall into this area, adequate prevention and protection interventions must be foreseen for risk mitigation and the relative follow-up monitoring, as well as the verification of the effectiveness of the corrective actions also on similar installations. All final events must be framed within the matrix and those that fall within the red and yellow bands must be used for further technical and managerial insights. 6. Case study Consider a LPG tank with stored quantity of 40 tons, located 150 m from the plant boundary, with D5 meteorological conditions during the accident event. Assumes a possible critical event (CE) such as a 10 mm hole in the tank. In the present case study, the frequency of the critical event coincides with the frequency of the dangerous event (DP); this means that we do not take into consideration the protection barriers placed on the right side of the "Bow-tie" diagram. From Figure 3 for the case in question we obtain an occurrence frequency 5 E-06 to which a frequency class F-4 is associated (see paragraph 3). From Figure 4 for the case in question we obtain the four threshold values for the hypothetical VCE scenario: • 1, high lethality effects = 140 m; • 2, lethality initiation effects = 170m; • 3, effects involving serious irreversible injuries = 210 m; • 4, effects involving reversible injuries = 330 m. This means that in our case study there are no high lethality effects outside the plant but only inside it; according to the authors' classification, the class of damage (see paragraph 4) falls under type "D". Having identified the two elements, frequency F-4 and damage class of scenario D, with the matrix in Figure 5 (yellow area) is obtained the R2 value, in this area further prevention and/or mitigation measures must be prepared. 7. Conclusions The authors, based on official documents approved and issued by the Italian competent authorities in recent months, propose a method to identify and evaluate all possible damage scenarios for LPG deposits, measuring the risk (albeit qualitatively) associated with said scenarios , for an assessment of its tolerability. This method can be applied both to establishments at risk of a major accident and to installations excluded from the scope of application of Directive 2012/18/EU (Seveso). These scenarios are the basis of correct territorial planning and internal and external emergency planning. In the context of emergency planning processes, the proposed method can be useful in supporting the authorities in defining the areas of damage, where the minimum data necessary to develop an accident scenario is not available. In the context of urban planning, it can be useful for a first estimate of the consequences of accidents not assessed by the operators. Furthermore, the same method allows to estimate the distances of damage also in case of accidents during the transport of LPG. References Andreis, F., Baldacci, S., Lombardi, A., Marotta, F., 2006, Shortcut method for evaluating accident consequences, Publisher: APAT, ARPAT. ISBN: 88-448-0159-0. Delvosalle, C., Fiévez, C., Pipart, A., 2006. ARAMIS project: Reference accident scenarios definition in SEVESO establishment, Journal of Risk Research, 9:5, 583-600, DOI: 10.1080/13669870500419529 Directive 2012/18/EU of the European Parliament and of the Council, ‘Control of major-accident hazards involving dangerous substances, amending and subsequently repealing Council Directive 96/82/EC’. Directive December 7, 2022, Presidency of the Council of Ministers, Guidelines for the preparation of the external emergency plan, guidelines for informing the population and guidelines for testing external emergency plans, Italian Official Gazette no. 31 of 7 February 2023. Giannelli G., Grillone G., Muratore A., Nastasi V., Sferruzza G., 2020, Earthquake natech risk: Index method for critical plants covered by seveso III directive, Proceedings of the 30th European Safety and Reliability Conference, ESREL2020-PSAM15 Organizers, Published: Research Publishing, Singapore, DOI: 10.3850/978-981-14-8593-0, pp. 3126-3133. Gyenes Z., Wood M. H., Struckl M., 2017, Handbook of Scenarios for Assessing Major Chemical Accident Risks, Joint Research Centre (JRC) technical report, DOI: 10.2760/884152. Muratore A., Giannelli G., Nastasi V., Sferruzza G., Grillone G., 2021, Risk assessment of pressure equipment during use phase, Proceedings of the 31th European Safety and Reliability Conference, ESREL2021 Organizers, Publisher: Research Publishing, Singapore, DOI: 10.3850/978-981-18-2016-8_305-cd. 132 30giannelli.pdf Risk Assessment of LPG Release Scenarios