Вы находитесь на странице: 1из 33
HHAANNDDBBOOOOKK FFAAIILLUURREE FFRREEQQUUEENNCCIIEESS 22000099 for drawing up a SAFETY REPORT 05/05/2009
HHAANNDDBBOOOOKK FFAAIILLUURREE
FFRREEQQUUEENNCCIIEESS
22000099
for drawing up a
SAFETY REPORT
05/05/2009
22000099 for drawing up a SAFETY REPORT 05/05/2009 Flemish Government LNE Department Environment, Nature and

Flemish Government LNE Department Environment, Nature and Energy Policy Unit Safety Reporting Division

HHAANNDDBBOOOOKK FFAAIILLUURREE FFRREEQQUUEENNCCIIEESS

22000099

for drawing up a

SAFETY REPORT

C I I E E S S 2 2 0 0 0 0 9 9 for

05/05/2009

Flemish Government LNE Department Environment, Nature and Energy Policy Unit Safety Reporting Division

Table of Contents

CHAPTER 1:

INTRODUCTION

9

CHAPTER 2:

PRESSURE TANKS

12

CHAPTER 3:

MOBILE PRESSURE CONTAINERS

13

CHAPTER 4:

ATMOSPHERIC TANKS

14

CHAPTER 5:

HEAT EXCHANGERS

17

CHAPTER 6:

PUMPS AND COMPRESSORS

19

CHAPTER 7:

PIPE SYSTEMS

20

CHAPTER 8:

LOADING AND UNLOADING ACTIVITIES

21

CHAPTER 9:

FIRE IN WAREHOUSES

22

CHAPTER 10:

PACKAGING UNITS

23

CHAPTER 11:

REPRESSION SYSTEMS

24

CHAPTER 12:

CONSEQUENTIAL EVENTS

28

CHAPTER 13:

REFERENCES

31

Preface

In 1994 a directive entitled ‘Handboek Kanscijfers’ [HBKC1994] was issued. This directive described the failure frequencies for the different installation parts to be used by safety reporting experts when drawing up safety reports.

In 2002 the directive ‘Actualisatie van de AMINAL-richtlijn voor het gebruik van faalkansen bij het opstellen van veiligheidsrapporten’ was published. This directive only listed the new failure frequencies for a limited number of installation parts. For the failure frequencies which were maintained reference was made to the respective remaining chapters of ‘Handboek Kanscijfers’.

In 2004 the 1994 Handboek Kanscijfers and the 2002 directive were joined into one document, namely the coordinated version ‘Handboek Kanscijfers 2004’

[HBKC2004].

In 2007 the TWOL project ‘Actualisering van de faalkansen in de risicoberekeningen van Sevesobedrijven’ [SGS] was delivered. The purpose of this project was to obtain more up-to-date failure frequencies for several installation parts. Based on the end report of the TWOL project and after consultation with the accredited safety reporting experts and the Seveso establishments, this ‘Handbook on Failure Frequencies 2009’ was drawn up.

All background information on the failure frequencies listed here can be found in the accompanying document with background information [AI2009].

CChhaapptteerr 11::

IInnttrroodduuccttiioonn

In the following chapters the types of failure and the generic failure frequencies per installation (part) within an establishment will be discussed. In the quantitative risk analysis all these types of failure must be taken into account and the given generic failure frequencies must be used. The failure frequencies given in this handbook have priority over all other failure frequencies available in the literature. If other installations than those included here should turn out to be relevant to external safety, these should be included in the quantitative risk analysis with a well-founded failure frequency.

Frequently used symbols

d

D

D

eq

max

10

D L, max

Equivalent leak diameter (mm) Maximum connection diameter (mm) Leak diameter which gives rise to a release in 10 minutes Maximum leak diameter (= min (D max , D 10 ))

11

11

PPRREESSSSUURREE TTAANNKKSS AANNDD AATTMMOOSSPPHHEERRIICC TTAANNKKSS

For pressure tanks (Chapter 2) and atmospheric tanks (Chapter 4) the handbook describes instantaneous failure and leakage. What follows is an explanation of how these types of failure should be included in the risk analysis.

IInnssttaannttaanneeoouuss ffaaiilluurree

Instantaneous failure of a tank is modelled in two ways, namely as a ‘rupture’ and as a ‘complete outflow in 10 minutes’. The frequency for instantaneous failure is distributed equally over both release scenarios.

If one of the leaks to be modelled gives rise to an outflow of the entire content in 10 minutes or less, the type of failure ‘complete outflow in 10 minutes’ should not be included in the risk assessment, but the failure frequency for this type of failure should be added to the failure frequency for the type of failure ‘rupture’. Consequently, the total failure frequency for instantaneous failure will always be applied, either distributed over the types of failure ‘complete outflow in 10 minutes’ and ‘rupture’, or only under the type of failure ‘rupture’.

LLeeaakkaaggee

The handbook provides for three types of leakage, namely ‘large leak’, ‘medium leak’ and ‘small leak’. The way in which these types of leakage are considered in the risk assessment depends on the maximum leak diameter. To determine the maximum leak diameter the minimum of the maximum connection diameter and the diameter giving rise to an outflow in 10 minutes is taken (D L, max = min (D max , D 10 )).

If the maximum leak diameter is smaller than or equal to 10 mm, only the type of failure ‘small leak’ is taken into account in the risk assessment, with a failure frequency equal to the sum of the failure frequencies for the types of failure ‘large leak’, ‘medium leak’ and ‘small leak’. The equivalent leak diameter is equated with 10 mm.

If the maximum leak diameter is situated in the interval of the medium leak (10–50 mm), the type of failure ‘large leak’ should not be taken into consideration in the risk assessment, but the failure frequency of the type of failure ‘large leak’ should be added to that of the type of failure ‘medium leak’. The equivalent leak diameter for the type of failure ‘medium leak' is equated with the maximum leak diameter. The type of failure ‘small leak’ is still considered separately in the risk assessment, with its own failure frequency and an equivalent leak diameter of 10 mm.

If the maximum leak diameter is bigger than or equal to 50 mm, the types of failure ‘large leak’, ‘medium leak’ and ‘small leak’ are all taken into account in the risk assessment separately, each with its own failure frequency. The equivalent leak diameter for the type of failure ‘large leak' is equated with the maximum leak diameter. The equivalent leak diameter for the type of failure ‘medium leak’ is equated with 25 mm. The equivalent leak diameter for the type of failure ‘small leak’ is equated with 10 mm.

11

22

DDEEVVIIAATTIINNGG FFAAIILLUURREE FFRREEQQUUEENNCCIIEESS

The (generic) failure frequencies included in this handbook must obligatorily be used in the quantitative risk analysis. However, in specific cases deviations from these failure frequencies may be allowed through failure frequency reduction or increase. For failure frequency increases no specific guidelines apply. For failure frequency reductions the guidelines will be explained below. For both, procedure OVR_P10 from the Code OVR must be followed.

Failure frequency reductions are based on special additional preventative safety measures surpassing the standard preventative safety measures.

Failure frequency reductions are based on a detailed analysis of the causes which is publicly available (for instance as included in the document containing background information [AI2009]). This analysis of causes consists of a table summing up the possible (partial) causes which (either individually or consecutively) give rise to the failure of the

installation part in question. To each (partial) cause a relative contribution is linked. For each (partial) cause a safety measure or a package of safety measures is proposed which can lead to a reduction in the relative contribution of this (partial) cause. A safety measure can obviously lead to a reduction in the relative contribution of several (partial) causes.

For the assignment of the reduction factors the following general rules apply:

No.

Situation

Reduction factor

1.

Organisational or policy-based safety measure

0.10

2.

Technical safety measure

0.05

3.

Technical safety measure, implemented redundantly and monitored via a safety circuit which is independent from the process computer

0.01

4.

Safety measure which excludes a partial cause, or partial cause which is not applicable

0

The situations described in the table above are intended as a guideline.

Analyses of causes often include the category ‘cause unknown’. This category comprises failures for which no univocal cause is mentioned in the literature, or which were due to a combination of causes. The relative contribution of this category cannot be reduced.

The safety measures are described in a clear and detailed way. Their availability, operability, effectiveness, efficiency and reliability must be demonstrated in a way which is considered adequate.

A reduced failure frequency must never be lower than 10% of the generic failure frequency.

CChhaapptteerr 22::

PPrreessssuurree ttaannkkss

In Table 1 the generic failure frequencies are given for leaks and instantaneous releases in pressure tanks. This table applies to all pressurised installation parts, with the exception of those mentioned elsewhere in the handbook. This table should be read together with the explanation in paragraph 1.1.

Table 1: Failure frequencies [/tank year] for pressure tanks

   

Failure frequency [/tank year]

 
 

Storage tanks

   

Type of failure

Above ground (incl. road tankers and tankwagons)

 

Underground

Process installations and other

or mounded

   

Small leak

   

0.1 < d 10 mm d eq = 10 mm

 

1.2

10 -5

 

1.2

10 -4

Medium leak

   

10 < d 50 mm d eq = 25 mm

 

1.1

10 -6

 

1.1

10 -5

Large leak

   

50 < d D max

 

1.1

10 -6

 

1.1

10 -5

d eq = D L, max

   

Complete outflow in 10 min.

3.2

10 -7

 

1.0

10 -7

3.2

10 -6

Rupture

3.2

10 -7

 

1.0

10 -7

3.2

10 -6

The installation part ‘pressure tank’ consists of the vessel including the manhole, instrumentation connections and pipe connections up to the first flange. Leaks in the corresponding pipe system are not included here.

If the pipe connection up to the first flange is longer than 10 m, the pipe connection must be regarded as a separate pipe part.

Definitions

Mobile pressure tank Fixed pressure tank

Vessel for hazardous substances of ADR category 2. Vessel with a design pressure of at least 0.5 bar overpressure.

CChhaapptteerr 33::

MMoobbiillee pprreessssuurree ccoonnttaaiinneerrss

As generic failure frequencies the figures mentioned in Table 2 apply. These failure frequencies apply to all mobile pressure containers up to 1,000 litres (gas cylinders and pressure vessels).

Table 2: Failure frequencies for mobile pressure containers up to 1,000 litres

Type of failure

Failure frequency

Gas cylinder [/cylinder.year]

Pressure vessel [/vessel.year]

Leak

d eq = D max

1.1 10 -5

-

Rupture

1.1 10 -6

1.1 10 -6

Definitions

Container with a design pressure of at least 0.5 bar overpressure. Mobile pressure container with a water content of more than 150

Pressure vessel

litres and not exceeding 1,000 litres. Gas cylinder Mobile pressure container with a water content not exceeding 150 litres.

Pressure container

CChhaapptteerr 44::

AAttmmoosspphheerriicc ttaannkkss

In Table 3 the generic failure frequencies are given for leaks and instantaneous releases in atmospheric tanks. For storage tanks the decision tree in Figure 1 must be used to determine from which column the failure frequencies should be taken. This table should be read together with the explanation in paragraph 1.1.

Table 3: Failure frequencies [/tank year] for atmospheric tanks

   

Failure frequency [/tank year]

 
 

Storage tanks

   

Type of

Tank type 1 (incl. road tankers and tankwagons)

       

Process

failure

Tank type

Tank type

Tank type

Underground

installations

2*

3*

4*

or mounded

and other

Small leak

     

0.1 < d 10 mm d eq = 10 mm

 

2.4

10 -3

-

2.4

10 -2

Medium leak

     

10 < d 50 mm d eq = 25 mm

 

2.2

10 -4

-

2.2

10 -3

Large leak

     

50 < d < D max

 

2.2

10 -4

-

2.2

10 -3

d eq = D L, max

   

Complete outflow in 10 min.

5.0

10 -6

5.0

10 -7

1.2

10 -8

1.0

10 -8

1.0

10 -8

5.0

10 -5

Rupture

5.0

10 -6

5.0

10 -7

1.2

10 -8

1.0

10 -8

1.0

10 -8

5.0

10 -5

* For leaks these failure frequencies apply to the first (inner) shell.

The abovementioned failure frequencies must be applied to all separate atmospheric tanks. In case of compartmentalisation the failure frequency should be applied per compartment.

The installation part ‘atmospheric tank’ consists of the tank including the manhole, instrumentation connections and pipe connections up to the first flange. Leaks in the corresponding pipe system are not included here.

If the pipe connection up to the first flange is longer than 10 m, the pipe connection must be regarded as a separate pipe part.

Figure 1: Decision tree for determining the type of storage tank

Does the storage tank have a second self-supporting shell? Yes No Is the second shell
Does the storage
tank have a second
self-supporting
shell?
Yes
No
Is the second shell
resistant to
explosions*, debris
and low
temperatures?
Yes
No
Has the second shell
been designed to
retain vapour if the
first shell fails?
Yes
No
Tank type 2
Tank type 1
Tank type 4
Tank type 3

* Explosion: Static compression stress of 0.3 bar for 300 ms

In Table 4 the failure frequency of a tank fire is displayed for the different types of liquids.

Table 4: Failure frequencies [/tank year] for tank fire in atmospheric tanks

   

Failure frequency [/tank year]

Scenario

Tank type

P1 liquid

P2 liquid

P3 and P4 liquids

 

Tank with external floating roof

2.5

10 -4

7.6

10 -5

2.3

10 -5

Tank

Tank with fixed roof without nitrogen blanket

     

fire

6.9

10 -4

2.1

10 -4

6.2

10 -5

Tank with fixed roof with nitrogen blanket

2.5

10 -4

7.6

10 -5

2.3

10 -5

Definitions

Mobile atmospheric

P2 liquids

Tank for hazardous substances not belonging to ADR category 2.

tank Fixed atmospheric

Tank with a design pressure smaller than 0.5 bar overpressure.

tank P1 liquids

Extremely and highly flammable liquids, in particular liquids with a flashpoint below 21°C. Flammable liquids, in particular liquids with a flashpoint equal

P3 liquids

to or above 21°C and equal to or below 55°C. Flammable liquids with a flashpoint higher than 55 °C and equal

P4 liquids

to or lower than 100 °C. Flammable liquids with a flashpoint higher than 100 °C and equal to or lower than 250 °C.

CChhaapptteerr 55::

HHeateat eexchangersxchangers

55

11

PPIIPPEE HHEEAATT EEXXCCHHAANNGGEERRSS

Table 5 shows the generic failure frequencies for pipe heat exchangers.

Table 5: Failure frequencies (shell) [/heat exchanger.year] for pipe heat exchangers

Type of failure - shell

Failure frequency [/heat exchanger.year]

Small leak 0 < d 25 mm d eq = 10 mm

6.0

10 -3

Medium leak

 

25

< d 50 mm

3.9

10 -3

d eq = 35 mm

 

Large leak

 

50

< d 150

1.6

10 -5

d eq = 100 mm

 

Rupture

1.3

10 -5

Internal pipe rupture will lead to a leak in the shell if the operating pressure in the pipes is higher than the design pressure of the shell, and there is no or insufficient pressure evacuation. Depending on the specific situation, it should be verified what the probability of shell failure (leakage) as a result of pipe rupture is, and this scenario should be taken into account separately. In this case a failure frequency of 7.1 10 -3 /heat exchanger.year is assumed for pipe rupture.

55

22

PPLLAATTEE HHEEAATT EEXXCCHHAANNGGEERRSS

Table 6 shows the generic failure frequencies for plate heat exchangers with a working pressure lower than 5 bar, with a working pressure between 5 and 8 bar and with a working pressure higher than 8 bar.

Table 6: Failure frequencies [/heat exchanger.year] for plate heat exchangers

Type of failure

 

Failure frequency [/heat exchanger.year]

 

P < 5 bar

5 bar P < 8 bar

8 bar P

Small leak 0 < d 25 mm d eq = 10 mm

4.6

10 -3

7.0

10 -3

1.8

10 -2

Medium leak 25 < d 50 mm d eq = 35 mm

2.0

10 -3

3.0

10 -3

7.2

10 -3

Rupture

5.5

10 -6

8.3

10 -6

2.0

10 -5

P = working pressure (bar)

CChhaapptteerr 66::

PPuummppss aanndd ccoommpprreessssoorrss

The generic failure frequencies for pumps and compressors are displayed in Table 7.

Table 7: Failure frequencies for pumps and compressors

Failure frequency [/pump year] or [/compressor year]

Type of failure

Centrifugal pumps

Reciprocating pumps Compressors

With gaskets

Without gaskets

Leak

d eq = 0.1 D max

4.4 10 -3

1.0 10 -4

4.4 10 -3

Rupture

-

-

1.0 10 -4

CChhaapptteerr 77::

PPiippee ssyysstteemmss

In Table 8 the failure frequencies for above ground and underground pipe systems are displayed.

Table 8: Failure frequencies for pipe systems

Above ground pipeline

Underground pipeline

 

Type of failure

Failure frequency [/year]

Type of failure

Failure frequency [/m.year]

Small leak

 

10 -7 L/D

   

d eq = 0.1 D

2.8

Crack

 

10 -8

Medium leak

 

10 -7 L/D

d eq = 10 mm

7.9

d eq = 0.15 D

1.2

 

Large leak

5.0

10 -8 L/D

Hole

6.9

10 -8

d eq = 0.36 D

 

d eq = 0.5 D

 

Rupture

2.2

10 -8 L/D

Rupture

2.8

10 -8

L

= Pipeline length (mm) (at least 10 m)

D

= Inner pipeline diameter (mm)

CChhaapptteerr 88::

LLooaaddiinngg aanndd uunnllooaaddiinngg aaccttiivviittiieess

For leakage or rupture of the loading/unloading hose and the loading/unloading arm during loading and unloading activities with road tankers, tankwagons and ships, the values in Table 9 are used.

Table 9: Failure frequencies for (un)loading arms and hoses

Type of failure

 

Failure frequency (/hour)

 

(Un)loading arm

Hose

Hose for LPG

Leak

     

d eq = 0.1 D (max. 50 mm)

3

10 -7

4

10 -5

5.4

10 -6

Rupture

3

10 -8

4

10 -6

5.4

10 -7

D = (un)loading arm or hose diameter (mm)

CChhaapptteerr 99::

FFiirree iinn wwaarreehhoouusseess

The generic failure frequencies for a fire in warehouses are listed in Table 10 per fire compartment.

Table 10: Failure frequencies for a fire in warehouses

Scenario

Failure frequency [/fire compartment.year]

Fire in warehouse without an automatic fire fighting system

2.5

10 -3

Fire in warehouse with an automatic fire fighting system

6.9

10 -4

Definitions

Automatic fire fighting system

Fire compartment The smallest space within which a fire can be isolated for a

A fire fighting system in which both detection and activation take place automatically, without human intervention.

certain period of time thanks to fire-resistant materials.

CChhaapptteerr 1100::

PPaacckkaaggiinngg uunniittss

The following table gives an overview of the failure frequencies for packaging unit storage and handling within a company. If several packaging units are possible on a pallet, both types of failure for packaging unit handling must be included.

Table 11: Failure frequencies for packaging unit storage and handling

Failure frequency

Type of failure

Packaging unit storage [/packaging unit year]

Packaging unit handling [/packaging unit handling]

One packaging unit fails

2.5 10 -5

2.5 10 -5

All packaging units on a pallet fail

-

2.5 10 -6

In the case of containers containing multiple packaging units, the failure frequencies must be applied to all items in the container in question. The container itself is not considered a packaging unit.

Definitions

Packaging units

Mobile recipient with a content not exceeding 3 m³ and which is

Packaging unit

suitable for the storage of liquids or solids. Any activity involved in moving packaging units. The loading or

handling

unloading of a pallet of packaging units or of one single packaging unit is regarded as one packaging unit handling operation.

CChhaapptteerr 1111::

RReepprreessssiioonn ssyysstteemmss

If active repression systems are taken into consideration in the quantitative risk analysis, the scenario of the failure of these measures should also always be considered.

Guideline values for the probability of failure and for the response time of some repression systems have been gathered in Table 12. The quantitative risk analysis, however, starts from the actual situation. The general procedure from paragraph 11.5 can be applied here to determine the probability of failure and the response time.

It should also be taken into account that the effectiveness of a repression system can depend on the release scenario. Small leaks are often difficult or impossible to detect within a reasonable period of time, which can annul the effectiveness of e.g. a blocking system (at least from a safety reporting point of view).

Table 12: Probabilities of failure and response times of repression systems

 

Probability

Response

time (sec)

 

System

of failure

per demand

Blocking system

Automatic

0.1 - 0.001

120

Semi-automatic

0.1 - 0.01

600

 

Outflow rate set value

1

 

Excess flow valve

Set value < outflow rate 1.2 × set value

0.12

5

Outflow rate > 1.2 × set value

0.06

Non-return valve

Tested regularly

0.06

5

Operator intervention during (un)loading activity

Conditions, see paragraph 11.4

0.1

120

For the modelling one should also take into account the amount of product which is present in the pipelines and installation parts and may still be released after the valves have been closed.

If several active repression systems are in place, the probability of failure of the entire system must be determined. This should be done paying the necessary attention to the possible occurrence of ‘common cause failures’.

Passive repression systems are measures which were already in place before the release took place. Typical passive measures are constructions such as containment systems, bunkers and firewalls. For the quantitative risk analysis it is assumed that these measures do not fail and that the response time is 0 sec.

1111

11

BBLLOOCCKKIINNGG SSYYSSTTEEMMSS

To include the operation of a blocking system in the risk analysis following conditions must be met:

an automatic detection system must be present that results in signalling in the control room or automatic operation of the blocking valves. An example of this is a gas detection system with sufficiently sensitive monitors and adequate detection points. In the case of signalling in the control room this room must be continuously staffed.

the detection system and the shut-off valves must be regularly tested.

A quantitative risk analysis starts from the actual situation (or the planned situation in

case of a new installation). The probability of failure can be determined according to the

internationally recognised standards [IEC1] and [IEC2].

In a first approach the following guideline values for the probability of failure of a fully automatic system can be used:

Simple system: 0.1;

Redundant system (complex system): 0.01;

Diversely redundant system (complex system using different physical or technical modes): 0,001.

If no specific information is available, the upper limit of the given range should be used.

Definitions

Blocking system Suppression system to isolate (part of) an installation to prevent (further) outflow. A blocking system consists of a detection system, for instance gas detection, combined with shut-off valves.

System in which leak detection and the closing of blocking valves is automatic. Action by an operator is not necessary. System in which the detection of the leak takes place automatically and leads to an alarm signal in a continuously staffed control room. After validation of the signal the operator closes the blocking valves by actuating a switch in the control room. The operator has been trained in and regularly practises the emergency procedure.

Automatic blocking system Semi-automatic blocking system

1111

22

EEXXCCEESSSS FFLLOOWW VVAALLVVEE

The operation of the excess flow valve depends on the ratio between the calculated outflow rate and the set value of the excess flow valve.

Definitions

Excess flow valve

Valve which, via a built-in mechanism, automatically closes when the flow rate exceeds a set value.

1111 33

NNOONN--RREETTUURRNN VVAALLVVEE

Generally speaking, non-return valves are not very reliable. If they are not regularly tested, non-return valves are not included in a quantitative risk analysis.

Definitions

Non-return valve

Valve which, via a built-in mechanism, automatically closes when the direction of the flow rate is against the set direction.

1111 44

OOPPEERRAATTOORR IINNTTEERRVVEENNTTIIOONN DDUURRIINNGG LLOOAADDIINNGG AANNDD UUNNLLOOAADDIINNGG AACCTTIIVVIITTIIEESS

During (un)loading operations an operator is often present on-site who supervises the process and can operate a valve by actuating an emergency stop device. The intervention of an operator during (un)loading can be included in the quantitative risk analysis, provided the following conditions are met:

1. From the start to the end of the (un)loading operation the operator present on-site has a view of the (un)loading and the loading/unloading hose or arm. In particular, the operator is not sitting in the cabin of the tanker or inside a building during the (un)loading operation.

2. The on-site presence of the operator is guaranteed by a device such as a dead man’s handle or by a procedure in the safety management system and is checked during inspections.

3. The activation of the emergency stop by the operator present in case of leakage during (un)loading is described in a procedure.

4. The operator present on site is adequately trained and is also familiar with the applicable procedures.

5. The emergency stop is positioned according to the applicable standards, so that it can be activated quickly regardless of the direction of the outflow.

1111

55

OOTTHHEERR RREEPPRREESSSSIIOONN SSYYSSTTEEMMSS

Several other repression systems may be in place in order to limit the consequences of an accidental release as much as possible. These can be rated in the quantitative risk analysis on condition that the effectiveness of the system is demonstrated, for instance via testing.

The effect of a repression system is recorded in the quantitative risk analysis as follows:

1. Determine the response time of the system, t resp .

2. Determine the effectiveness of the system.

3. Set the source term for the time period 0 to t resp equal to the source term when not using the repression system.

4. Adjust the source term in the time period following t resp according to the effectiveness of the repression system.

5. Discount the probability of failure per operation of the repression system. This probability should be calculated using methods such as a fault tree analysis or a code of good practice (e.g. IEC1, IEC2). A default value is 0.1 per demand.

CChhaapptteerr 1122::

CCoonnsseeqquueennttiiaall eevveennttss

The generic event tree is shown in Figure 2. Here, the possible effects are shown which can appear in case of a release of a substance. However, no judgement is made as to the relevance of the effects. It should be noted that the event tree does not take into account repression systems either.

direc t delayed explo sion ignition ignition P E P D P V E1 P
direc t
delayed
explo sion
ignition
ignition
P E
P D
P
V
E1
P D
E0
(1-P D )×P V ×P E
E3
(1-P D )×P V ×(1-P E )
E4
(1-P D )×(1-P V )

Figure 2: Event tree

The hazardous phenomena to be taken into consideration are displayed for the different product types in Table 13 for rupture and in Table 14 for leakage and 10-minute outflow.

Table 13: Hazardous phenomena for rupture

Effect

Non-combustible substances

Group 0

Group 1

Groups 2 and 3

E0

Physical explosion

Physical explosion*

Physical explosion

Physical explosion

   

Fire ball (under

   

pressure)*

E1

-

Pool fire (pressureless)

Pool fire

Pool fire

   

Vapour cloud

Vapour cloud

 

E2

-

explosion

explosion

-

Pool fire

Pool fire

   

Flash fire

Flash fire

Flash fire

E3

-

Pool fire

Pool fire

Pool fire

E4

Toxic vapour cloud

Toxic vapour cloud

Toxic vapour cloud

Toxic vapour cloud

* For the modelling for above ground tanks, in principle a hot BLEVE is assumed, whereas for underground tanks a cold BLEVE is assumed.

Table 14: Hazardous phenomena for leakage and complete outflow in 10 min.

Effect

Non-combustible substances

Group 0

Group 1

Groups 2 and 3

E0

-

-

-

-

   

Jet fire

   

E1

-

Pool fire

Pool fire

Pool fire

   

Vapour cloud

   

E2

-

explosion

Jet fire

Pool fire

Vapour cloud

explosion

Pool fire

-

   

Flash fire

   

E3

-

Jet fire

Pool fire

Flash fire

Pool fire

Flash fire

Pool fire

E4

Toxic vapour cloud

Toxic vapour cloud

Toxic vapour cloud

Toxic vapour cloud

The generic probabilities of failure for direct and delayed ignition for the different product groups are reflected in Table 15. In this table, the probability of explosion is also indicated.

Table 15: Probability of direct and delayed ignition and probability of explosion

Source term Probability P D , P V or Group 0 Continuous Instantaneous Group Group
Source term
Probability
P D ,
P V or
Group 0
Continuous
Instantaneous
Group
Group
Group
Average /
P
[kg/s]
[kg]
E
Low
1
2 3
high
reactivity
reactivity
P
0.2
0.02
0.065
0.02
0.006
D
P
0.06
0.02
0.07
-
-
< 10
< 1,000
L
P E
0.2
0.2
0.2
-
-
P D
0.5
0.04
0.065
0.02
0.006
10 – 100
1,000 – 10,000
P L
0.2
0.04 0.07
-
-
P
0.3
0.3
0.2
-
-
E
P
0.7
0.09
0.065
0.02
0.006
D
> 100
> 10,000
P
0.7
0.1
0.07
-
-
L
P
0.4
0.4
0.2
-
-
E

P D = Probability of direct ignition P V = Probability of delayed ignition P E = Probability of explosion

To determine the probability of delayed ignition P V and the probability of explosion P E alternative methods can be used as well, based on the size of the combustible/explosive cloud [Prugh] or the presence of specific sources of ignition [RIVM].

By default, a probability of ignition for average/high reactivity should be taken into account. Only when it has been demonstrated that the reactivity of the substance is low, ignition probabilities for low reactivity are applied. Combustible gases with low reactivity are methane, methyl chloride and ethyl chloride [RIVM]. Substances both toxic and combustible with low reactivity (ammonia, methyl bromide and carbon monoxide) are assessed as being pure toxic.

Definitions

BLEVE

Boiling Liquid Expanding Vapour Explosion

Group 0

Products which are in a gaseous state. The product is above the

Group 1

atmospheric boiling point or the atmospheric boiling point is lower than or equal to -25°C. Products which are at or above their flashpoint, but below the

Group 2

atmospheric boiling point. E.g. P1 liquids Products which are at a temperature lower than 35°C below the

Group 3

flashpoint. E.g. P2 liquids Products which are at a temperature which is 35°C or more below the flashpoint. E.g. P3 and P4 liquids

CChhaapptteerr 1133::

RReeffeerreenncceess

[AI2009], Background Information - Appendix to Handbook Failure Frequencies 2009 for drawing up a safety report, LNE, Safety Reporting Division, 2009

[HBKC1994], Handboek Kanscijfers ten behoeve van het opstellen van een veiligheidsrapport, Ministry of the Flemish Community, LIN, AMINAL, Hazardous Substances and Risk Management Division, 1994

[HBKC2004], Handboek Kanscijfers voor het opstellen van een veiligheidsrapport, Ministry of the Flemish Community, LIN, AMINAL, Safety Reporting Division, 2004

[IEC1], IEC 61508: Functional Safety of electrical/electronic/programmable electronic safety-related systems

[IEC2], IEC 61511: Functional safety – Safety instrumented systems for the process industry sector

[Prugh], Prugh, R,W, Evaluation of unconfined vapor cloud explosion hazards, Proc. International Conference Vapor Cloud Modelling, AIChE, NY, 1988

[RIVM], RIVM/CEV, Handleiding Risicoberekeningen BEVI, version 3.0, 1 January 2008

[SGS], SGS, TWOL project ‘Actualisatie van de faalfrequenties in risicoberekeningen in Sevesobedrijven’, end report, July 2007

Colophon

This document is a translation in English of the Dutch Handboek Faalfrequenties 2009 voor het opstellen van een veiligheidsrapport. In case of inconsistencies or problems, the original language document shall take precedence over this translation.

Edited by

The Flemish Government Environment, Nature and Energy Department Environment, Nature and Energy Policy Unit Safety Reporting Division Graaf de Ferrarisgebouw Koning Albert II-laan 20 B-1000 Brussels

Published by

J.-P. Heirman, Secretary-General Environment, Nature and Energy Department

Deposit number

D/2009/3241/355

Edition

May 2009