Criterion 3.5 "The safety report should provide details to demonstrate that suitable and sufficient consequence assessment for each major accident scenario has been carried out with respect to people and the environment."
The principal hazards from warehouses are fires and explosions. There is little point in a safety report for an agrochemical or general warehouse discussing small fires that do not envelope the whole warehouse.
Assessors can test compliance with Criterion 3.5 by asking the following questions:-
The impact of warehouse fires on local populations depends greatly on:-
The consequence analysis should address all of these parameters and show how they affect the severity or hazard range. Justification should be provided for use of survival fractions less than 10%.
The steps in the consequence analysis that an Assessor should expect to see are:-
Present the results of thermal radiation calculations to demonstrate that the fire will not have knock-on effects.
All of the above steps should be clearly documented in the report. However, omission of one or more of them is not a significant failing if overall the consequence analysis is satisfactory.
A minimum accident set for an agrochemical warehouse site would be:-
Organic peroxides hazards including explosion, fireball and intense fire.
It is likely that the hazard analysis will need to address fires occurring at different times of the year when inventories are very different.
The safety report should also consider the environmental impact of run-off of contaminated fire-fighting water.
If the warehouse contains very eco-toxic substances in powder form, the consequences analysis should consider dispersion and deposition of particulate and its impact on environmentally sensitive locations such as SSSIs, SBIs and shallow lakes etc.
The number of fatalities from inhalation of toxic substances and individuals with severe burns from fires and explosions should be determined. The effect of blast should also be quantified in terms of the number of buildings in each of several damage categories. The effect of wind direction on the number of casualties should be addressed, and the accident analysis should take into account the effect of other variables such as time of year, time of day, day of the week and rain if they have a significant effect on the off-site consequences. A limited analysis that neglects variability in accident consequences does not meet the assessment criteria.
A safety report should include a brief description of the essential features and assumptions of the mathematical models used by the Operator to determine the consequences of major accidents. If the models are part of a well-known software package, then only the name of the software is required, but full details of the input should be provided. In-house models and any validation studies that have been carried out to support them should be described in detail. The main equations of a model should be given in an appendix if they have not been published elsewhere.
The fact that an Operator has used a well-validated model to determine the consequences of an accident does not guarantee that the results are reliable. Assessors should recognise that the predictions of consequence analysis are more important than the means by which they were obtained. Assessors may feel that a safety report that fails to provide input data details for predictions, which appear optimistic, fails to meet the criteria.
The level of detail that should be provided on the calculation of the consequences of an accident that do not extend off-site is less than if the hazard range encompassed a large number of people. It is not possible to be prescriptive on this issue and Assessors are expected to use professional judgement when deciding if the Operator has provided sufficient information on his consequence analysis. However, the following examples may help Assessors make a judgement on this issue.
If the level of thermal radiation at the site boundary from the flame pillar of a burning warehouse, as calculated assuming a point source radiator, is not hazardous to people, the safety report does not need to describe the thermal radiation modelling in great detail.
If the warehouse is in a rural location and no one beyond the site boundary is predicted to be significantly affected by the smoke plume, assuming passive, non- buoyant dispersion, then sparse details of the fire and dispersion modelling are adequate.
The safety report should determine the consequences of fires starting in different locations in different warehouses at different times of the year. In order to do this typical inventory variations over the year for each warehouse must be provided, and the assumptions about the inventory used in the analysis clearly listed.
If a warehouse stores paraquat, the safety report should examine the off-site risk caused by a fire adjacent to the paraquat drums on the basis that toppling of the drums around the edge of the fire could release droplets into the smoke plume.
Some agrochemicals that are not very toxic contain large amounts of chlorine or sulphur. The safety report should consider combustion of these substances assuming 100% conversion of the chlorine to HCl and 100% conversion of the sulphur to SO2 at a rate that depends on the rate of combustion of the parent substances by the fire.
Criterion 3.5.1 "Source terms used should be appropriate and need to have been used correctly for each relevant major accident."
The source term for an accident sequence expresses 'how much', 'for how long' and in 'what form'. The source term for a warehouse fire defines two parameters - the rate of release of dangerous substances into the smoke plume as a function of time and the buoyancy of the plume. These in turn depend on the rate of combustion, the rate of seeding of parent compounds and the rate of heat released to the atmosphere. All are difficult to calculate and should be based on conservative assumptions. Assessors can use the following questions to test the adequacy of the source terms used in the consequence analysis.
Worse case fires occur under "worst conditions", which are when the amount of toxic material in a warehouse is at its maximum level, when the fire starts in the in the most toxic substances and when the heat lost from the smoke plume is a maximum. An analysis based on an average inventory taking no account of the location of the seat of the fire may be overly optimistic, unless the smoke is assumed to disperse passively.
Plume seeding rates and the rate of production of toxic combustion products is almost impossible to calculate reliably. The accident analysis should be based on the assumption that 10% of the toxic inventory is seeded into the smoke plume and that the conversion of chlorine and sulphur to HCl and SO2 is quantitative. Conversion of nitrogen to HCN and NO2 should be set at about 5% and the conversion of carbon to CO should be 5%. A safety report should justify use of more optimistic assumptions.
The other factor greatly affecting ground level concentrations of toxic substances down wind of a burning warehouse is the heat content of the smoke plume. Fire analysis for a COMAH safety report should assume that no more than 0.4 of the heat of combustion is retained. Accident consequences based on a buoyant plume dispersion model in which more than 40% of the heat of combustion remains in the smoke released to the atmosphere may be considered optimistic.
Criterion 3.5.2 "The material transport models used should be appropriate and need to have been used correctly for each relevant MAH."
Dispersion and deposition are the transport mechanisms that determine the consequences of major fires. Assessors are likely to see a wide variety of different approaches used in safety reports and it is impossible to provide prescriptive guidance on each of them. However, three general approaches can be identified: -
An important part of the consequence assessment is the calculation of ground deposition from the smoke plume. Ground contamination is the product of ground level concentration of particulate, the deposition velocity and the duration. Assessors are likely to encounter a range of deposition velocities in safety reports, but a value less than the settling velocity is likely to yield an optimistic estimate of ground deposition.
Assessor can test compliance with this criterion with the aid of the following questions: -
Its buoyancy number, the windspeed, the atmospheric stability class and the height of any inversion layer govern the rise of a smoke plume. Plume buoyancy increases as the fire spreads through the warehouse while the other parameters are constants. Some Operators may use a model that incorporates time dependency, while other may adopt a more simpler approach and assume the smoke plume quickly rises to a certain height and then disperses passively. In either case there is scope for optimism in the assumptions and the safety report should provide full details of the model and its assumptions. Failure to do so is may be regarded as a failure to comply with the criteria.
A safety report that bases the consequence assessment on an average burning rate and a constant plume buoyancy and predicts that dangerous substances are carried high into the air, fails to meet the assessment criteria because its predictions are likely to be overly optimistic.
A safety report should identify any dangerous substances in powder form that can be seeded into the smoke plume during a fire and determine the consequence of its uplift and dispersion in the smoke plume. When the particle size range is not known, or extends over a wide range, two calculations may be required. The first based on the assumption that toxic particles have an aerodynamic diameter of 1-2mm and disperse as a gas, and the second assuming that the aerodynamic.
The dispersion model should be able to account for the settling and deposition, but again several models have been developed. The "tilted plume" approach, which assumes uniform depletion of the plume, is as good as any other.
A safety report that does not discuss hazards from particulates is likely to underestimate the potential impact of a warehouse fire on local populations and the environment and consequently may be deemed to fail to meet the assessment criteria.
The wind speed, the atmospheric stability and the height of an inversion layer affect the rise of a buoyant plume. The safety report should identify the conditions that maximise the hazard range. These could be D15 or D5 with a low inversion height. Under F2 weather conditions, the positive vertical temperature gradient inhibits the rise of marginally buoyant plumes, but the smoke plume from a warehouse fire, even in the early stages rises to a height of several tens of metres. Hence hazard ranges for warehouse fires under F2 conditions rarely extend off-site.
A very buoyant plume will fail to rise under D15 conditions. Instead it will disperse rapidly at low level and produce high concentrations in the near field. Under D5 conditions a buoyant plume rises quickly, but if there is an impenetrable inversion layer at a height of 200m, ground concentrations of dangerous substances could be relatively high at large distance.
A safety report that fails to consider a wide range of weather conditions may fail to meet the criteria.
The behaviour of a buoyant plume released from a burning warehouse is affected by wind direction with respect to the axis of the warehouse (see Figure 1). Plumes that are released into a wind blowing along the ridge of a warehouse produce smaller ground level concentrations than those produced by a wind blowing at right angles to the ridge.
A safety report that only calculates hazard ranges for a wind blowing along the ridge is likely to under estimate the consequences of fires.
The rougher the ground over which a flammable gas is dispersing the more rapid is the rate of air entrainment and the shorter is the flammable hazard range. A ground roughness value of 0.1 corresponding to elements on the ground about 0.5-1 metre high is recommended for dispersion over agricultural land. A roughness value of 0.3 should be used for dispersion over a suburban area. Although higher roughness values may be assigned to some industrial sites, their use results in a reduced hazard range that could, under certain circumstances, be optimistic. An Operator should make a special case for use of a ground roughness value of more than 0.3. A value of less than 0.1 may be considered appropriate for dispersion over water i.e. at estuary or coastal sites.
Due to the variability of atmospheric conditions a dispersing gas plume meanders and the concentration at a fixed point down wind of a release fluctuates. Most dispersion models account for this phenomena by introducing an averaging period. The longer this is, the more allowance is made for the variations in wind direction and the smaller is the predicted concentration.
There is not a consensus on the most appropriate averaging period for dispersion calculations, but widespread support exists for use of 600 seconds and 10 seconds for continuous and instantaneous releases. In some passive dispersion models the standard deviations are linked to specific averaging times.
Since criteria 3.5.2 is concerned with the appropriateness of transport modelling assumptions, and averaging time can have a significant affect on the predicted hazard range, it is important that the Operators state the values used in the dispersion analysis. This requirement is not restricted to averaging time; Operators are obliged under criterion 3.5 to provide details of all important modelling assumptions and input.
Fires that are not controlled spread through a chemical warehouse in about in about 20 minutes. During this period both the burning rate and hence the rate of release of heat increase, but so does the rate of plume seeding with vaporised substances and combustion products. Down wind concentrations of dangerous substances that individuals are exposed to reach a peak after about 10 minutes.
A time independent model is likely to underestimate the dose received by individuals down wind of the fire, unless it is based on several pessimistic assumptions. If these are not described in detail in the safety report, Assessors must conclude that the predictions are optimistic.
Figure 1: Effect of fire location on down wind concentration
Criterion 3.5.3 "Other consequence models (eg BLEVE, warehouse fire, etc), used should be appropriate and need to have been used correctly for each relevant major accident."
Aside from vapour transport models, the consequence analysis for a chemicals warehouse needs to include models for thermal radiation from different types of fire and for the over pressure produced by explosions. It is important that these models do not under estimate the hazard range, but it is difficult for an Assessor to make judgements about the level of pessimism in a calculation if full details of the model are not supplied. Toxic effects and toxic combustion products should also be included in the report, but their assessment presents problems. The following questions may help Assessors judge if the consequence analysis is based on appropriate assumptions:-
The flame pillar from a burning warehouse becomes tilted in a high wind and the thermal radiation flux falling on downwind objects increases. Under these conditions the risk of the fire spreading to an adjacent warehouse or igniting a nearby diesel or LPG tank increases. A safety report should therefore determine the consequences of a warehouse fire in a high wind, otherwise the accident analysis may be deemed optimistic - see Table 5.
The thermal radiation emitted by a fire is attenuated by water vapour in the atmosphere, therefore the flux at a target is inversely proportional to the humidity. In the UK, humidity varies considerably, but an average value of 60% is often assumed for hazard calculations. This figure is probably overly pessimistic for F2 weather conditions, but an Operator should justify the use of significantly higher values that could result in optimistic predictions.
Chemical warehouses generally hold a large range of compounds hence it is difficult to specify the most appropriate emissive power for the flame pillar. Hydrocarbon pool fires have a peak emissive power in the range 90-200kW/m2 therefore a safety report should justify any figure that is less than this upper figure - see Table 5.
There are several methods of calculating blast over pressure from flammable gas explosions.
The consequences of explosions in warehouses containing sodium chlorate and organic peroxides can be determined on the basis of an equivalent mass of TNT. Data on equivalent explosive power and efficiency is sparse, but the following data are recommended:-
Table 4: TNT Equivalence for some explosive substances
| Substance | TNT Equivalence |
|---|---|
| Sodium chlorate |
0.04 |
| Ammonium nitrate |
0.14 |
| High strength hydrogen peroxide | |
| Dibenzoyl peroxide |
0.09 |
| t-butyl-peroxyacetate |
0.17 |
| t-butyl-peroxypivalate |
0.14 |
| t-butyl-peroxy maleate |
0.14 |
| Methyl-ethyl-keytone 60% |
0.26 |
| Peroxyacetic acid (40%) |
0.05 |
| Teriary butyl peroxybenzoate |
0.4 |
| Dibezoyl-peroxy benzoate |
0.25 |
| Di-tert-butyl peroxide |
0.38 |
It is reasonable to set the mass of TNT to twice the mass of gas in the confined or congested volume. The TNT equivalent of most hydrocarbons is 0.42 M, where M is the mass of vapour in the cloud and major deviations from this require a good explanation.
Assessors should be aware that the TNT model is considered over simplistic because gas explosions have different characteristics to TNT explosions. The multi-energy method based on lines 2 and 7 is preferred.
Table 5 : Effect of input parameters on predicted accident consequences
| Parameter | Accident type/phenomena | Acceptable value | Direction to reduce severity of consequences |
|---|---|---|---|
| Wind speed. | Passive
dispersion
Buoyant plume |
2m/s F
stability
5m/s D stability 10 - 15m/s D stability 2m/s F stability |
+
+ - |
| Ground roughness. | Passive dispersion. | 0.3m
(suburban environment). 0.1m (open countryside) |
+
+ |
| Averaging period. | Passive dispersion. | 600s
plume
10s puff |
+
+ |
| Humidity. | Fires and fireballs | 60% or less | + |
| Surface emissive power. | Fireball.
Warehouse fire flame pillar |
200kW/m2
200 kW/m2 |
-
- |
| Inversion height | Buoyant plume | 400m | + |
Criterion 3.5.4 "The harm criteria or vulnerability models used to assess the impact of each MAH on people and the environment should be appropriate and have been used correctly for each relevant major accident."
A safety report should calculate hazard ranges for exposure to toxic smoke, thermal radiation and explosion over pressure. The hazard range for the smoke plume should be based on the concept of Dangerous Dose assuming that the dangerous dose fractions from a variety of toxic substances are additive. These include:-
Vaporised parent compounds and particulates:-
Combustion products:-
Toxic gas exposure estimates for indoor and out of doors should be based on the dangerous toxic load Cn t = A (ppmn min) relationship where concentration is raised to a power "n" depending on the hazardous substance. A "dangerous toxic load" typically represents, a dose that would result in:-
However the "A" value can be modified to account for populations of different sensitivity. A lower value of "A" may be appropriate for predicting the effects of a release into an old persons home. Toxicity relationships for the above light gases can be found in the hazards section of this SRAG.
Hazard range and casualties from thermal radiation should be based on:-
For over pressure the appropriate hazard ranges correspond to:-
For secondary fires:-
It is very important that the full spectrum of casualties is calculated, not only for risk evaluation, but also for emergency planning purposes. Some safety reports may contain casualty estimates based upon other criteria such as a dose that relates to a value considered immediately dangerous to life and health (IDLH). Assessors should be check that such predictions are not overly optimistic.
The following questions may assist the Assessor to judge the adequacy of the accident consequence analysis:-
Although HSE has published its thermal radiation criteria, some safety reports calculate hazard ranges to different dose and flux levels. One of these is 300 tdu, which is the dose to cause blistering of the skin. It extends beyond the 500 tdu range and may be regarded as pessimistic, but any dose implies an exposure duration and Assessors need to understand the assumptions being made before making judgements about acceptability. In particular significant departures from the following assumptions that lead to shorter hazard ranges should be justified:-
Individuals escaping from a source of thermal radiation reduce the dose they receive on two counts. Firstly they increase the distance between them and the fire,(and thereby reduce the level of received thermal flux) and secondly, they can reduce the exposure period by going indoors.
HSE has two criteria for thermal radiation flux to buildings based on the ignition of American Whitewood (see Consequence Assessment in part 2), and while these are useful for assessing risk to occupants of houses, they provide little information on the hazard flux for a chemical warehouse storage facility. In this context the actions of the local fire service are important because they may be able to keep adjacent items of plant cool with water sprays. However, a safety report should assume that plant in the vicinity of a major fire do not receive water spray protection for 20 minutes. Predictions based on a much shorter response time for the fire brigade are likely to be optimistic. Operators must consider the consequences of late arrival of fire fighting services, but it is permissible for them to make judgements about the probability of such an occurrence.
The effects of blast over pressure on buildings and on people cannot be predicted precisely, but HSE has published tables of the consequences of a range of side-on over pressure. Different over pressures can be used in consequence calculations provided they convey a realistic picture of the scale and extent of the damage from an explosion. To this end, the following data are useful: -
A safety report that presents hazard ranges corresponding to higher over pressures than those above is not providing the full picture of the potential damage caused by explosions.
A safety report that only considers vaporisation of toxic substances in the warehouse may underestimate the real hazard range. Neglecting of combustion products and particulate is a serious shortcoming, but some safety reports will neglect combustion products from substances not classified as dangerous under the COMAH regulations. This is not an acceptable omission as LIII (page 9 of Guide to the Control of Major Accident Hazard Regulations 1999), makes clear that all dangerous substances produced by a fire must be considered.
Many warehouses store agrochemicals that contain low concentrations of toxic substances and are not classified as toxic. However, they can contribute significantly to the total toxic inventory and increase the toxicity of the smoke plume if the warehouse is on fire - see Figure 1. Under COMAH the impact of all substances released by a fire in a warehouse containing dangerous substances must be determined. Therefore, the consequence analysis must take account of toxic combustion products from all substances in the fire, and toxic substances vaporised by the fire from preparations that are not classified as toxic.
It is not acceptable for a safety report to focus only on substances classified as dangerous under COMAH and neglect all others and combustion products that can contribute to the toxicity of the smoke plume.
Virtually all organic substances produce carbon monoxide when burnt and a case can be made for taking account of the production of CO from combustion of all substances/materials in the warehouse. In fact it is acceptable for a safety report to ignore carbon monoxide production from wood, building materials etc. provided the overall approach embodies sufficient pessimist to compensate for this omission.
By comparison with toxic substances stored by a top tier COMAH site, the toxicity of CO is small, therefore its production as a fire spreads throughout a warehouse can be neglected, if the assumptions made about the release of other dangerous substances in the first 30 minutes of the fire are pessimistic.
Criterion 3.5.5 "Are the assumptions in the accident analysis justified and not unduly optimistic."
The assumptions being referred to here are those made about the response/effectiveness of accident consequence mitigation systems and include such things as the time to detect a fire in a warehouse or an operator will act in a predetermined way. The safety report should determine the consequences of worst accident scenarios on the assumption that all control and mitigation systems fail on demand and operational conditions correspond to worst case. Such a scenario should have a very low probability. The analysis should also consider the effect of various combinations of partial success of the control and mitigation systems in order to determine the risk dominating accidents.
A safety report that minimises accident consequences on the assumption that installed mitigation systems work perfectly is underestimating risk. Assessors can judge this aspect of safety reports by reference to the following questions:-
The safety report for a chemicals warehouse facility should consider an instantaneous release of the whole contents of a storage vessel to an uncontained evaporating pool with and without early ignition and with subsequent dispersion of the vapour and fire.
Various other scenarios that result in a continuous release of several 10s of kg/s and give rise to a variety of fires which may engulf other substances and escalate the accident should also be considered. The conditions that could give rise to a VCE or BLEVE should be identified and the consequences of these events determined. Environmental hazards must also be adequately addressed.
The consequences of many severe accidents depend on the environmental conditions, the state of the plant at the moment of failure and the location and type of failure. Since there are many combinations with roughly equal probability, the safety report must determine the consequences of each accident under a range of conditions that encompass the full severity range.
Both day time and night time conditions should be considered for accidents affected by stability (ie those involving dispersion) and different wind speeds. It is important that a safety report describes the consequences of the worst conceivable accidents at a site, which occur when warehouses are full and toxic inventories are at a maximum number. If the accident analysis in a safety report is based on average inventories, it should be judged as incorporating too much optimism.
A safety report should describe the mathematical models used to predict the consequences of accidents. If the Operator or his consultant used well known software to calculate the consequences of accidents, information on the input data files should be provided so that Assessors can check its appropriateness and degree of conservatism both of which provide an insight into the Operators approach to accident consequence analysis. If doubts remain, entering the Operator's input data into an HSE model can check the predictions in the safety report.
A difference in opinion about the severity of accident consequences may occur from time to time. It does not imply a major failing of the safety report but one which the Assessor should try to resolve by communication with the MSDU topic specialist, and, if necessary, with the Operator.
Criterion 3.5.6 "Estimates of the severity and extent of each major accident consequences are realistic."
COMAH Regulations Schedule 4, Part 2, Section 4(b) requires operators to provide an "assessment of the extent and severity of the consequences of identified major accidents".This is extended by SRAM Criterion 3.5.6 which requires that this assessment is realistic.
Duty holders should provide explicit information (perhaps in tabular form) which links each scenario with the number of people who may be affected (as a minimum) and preferably estimates of the number of fatalities and hospitalisations and those receiving minor injuries for each wind direction (where appropriate). This will provide the assessor with the information needed to determine the significance of each scenario.
We believe it is necessary if we are to be able to make a judgement on "all necessary measures" and the suitability of the information provided for offsite emergency plans (Schedule 4, Part 1, Section 4 and SRAM Part 2, Chapter 1.
Safety reports should determine the consequences of the worst accidents, but the analysis should not be overly conservative. If unrealistic hazard ranges are predicted, the off site emergency plan devised by the Local Authority may be ill conceived and under some circumstances, lives could be put at risk by spreading emergency services too thinly. The Assessor can gauge the degree of conservatism in the calculations by asking the following questions:-
Reasonable values for some of the more important input data for accident consequence modelling are shown in Table 5. Assessors should compare these values with those used by the Operator and make judgements about the realism of the consequence predictions.
The Assessor should check that the results of the predictive analysis are neither optimistically small nor conservatively large. The majority of chemical warehouses will have a hazard range between 100m and 1000m, and values outside this range require careful scrutiny.