Safety

Use Maximum-Credible Accident

Scenarios for Realistic and
Reliable Risk Assessment

Faisal I. Khan,
Memorial Univ. Posing various possible incidents — rather than just
of Newfoundland
the worst-case one — illuminates those that are really
important and are most likely. Such knowledge can
enhance safety and planning for emergencies.

T here have been many methodologies proposed

for the risk assessment in the chemical process
industries (CPI). Among them, the most notable
ones are quantitative risk analysis, probabilistic
safety analysis, worst-case methodology for
risk assessment and optimal risk analysis. A critical re-
view of these methodologies is available (1). The key
points of these methods are:
Quantitative risk analysis (QRA) — This method
is comprised of four steps: hazard identification, fre-
quency estimation, consequence analysis and mea-
sure of risk.
The first step answers the question: What can go
wrong? This is the most important step because hazards
that are not identified will not be quantified, leading to
an underestimated risk (2, 3). The techniques used for
hazard identification include hazard indices, hazard and
operability (HAZOP) studies, failure mode and effect
analysis (FMEA), what-if analysis and checklists. After
the hazards are identified, the scope of a QRA is de-
fined. The second step asks: How likely is the occur-
rence of each accident? Answering this question means
quantifying of the probability of each accident scenario.
The third step aims to quantify the negative impacts
of the envisaged accident scenario. The consequences
are normally measured in terms of the number of fatal-
ities, although they can also be determined by the
number of injuries or value of the property lost. The
last step of a QRA is to calculate the actual risk.
Probabilistic safety analysis (PSA) — Different tech-
niques can be combined to carry out PSA (4, 5, 6). PSA
provides a framework for a systematic analysis of haz-
ards and quantification of the corresponding risks. It
also establishes a basis for supporting safety-related de-
cision-making. The methodology and the procedures
followed for the PSA of a typical chemical installation
handling a hazardous substance can be outlined in seven
major steps: (1) hazard identification; (2) accident-se-
quence modeling; (3) data acquisition and parameter es-
timation; (4) accident-sequence quantification; (5) haz-
ardous substance-release-categories assessment; (6)
consequence assessment; and (7) integration of results.
Worst-case methodology for risk assessment — An
excellent work on hazard and risk screening based on
worst-case methodology is presented by Hirst and
Carter (7). The method does not discuss use of worst-
case scenarios in detailed risk assessment, but rather
outlines the development of ready-made and easy-to-
use risk indices, such as the risk integral, scaled risk in-
tegral and approximate risk integral, for early planning

56 www.cepmagazine.org November 2001 CEP


and decision-making. It is recommended that
if the values of computed risk indices are
above acceptance criteria, then a detailed
risk assessment be made. Although this
methodology computes these indices based
on the worst-case of an accident in a unit, it
makes the computation more realistic by
considering many parameters, such as condi-
tional plume probability, the population dis-
tribution factor, and weather and directional
probabilities. This method does not actually
Quantitative Hazard Assessment/Consequence Assessment
assess the hazard/risk in a unit, since the
worst-case scenario remains almost constant
for different units; it just depends upon the
type/quantity of the chemical in the unit (8).
Optimal risk analysis (ORA) — This is a
fairly new means for risk analysis (1, 9).
ORA involves four steps: (1) hazard identifi-
cation and screening; (2) hazard assessment
(both qualitative and probabilistic); (3) quan-
tification of hazards or consequence analysis;
and (4) risk estimation (Figure 1). This pro- ■ Figure 1.
cedure is named ORA as it is swifter, less ex- Steps and methods used
pensive to implement, less time-consuming to conduct an optimal risk
and more-precise than alternative analyses analysis (ORA).
(1, 10). Central to all of these methods is
predicting accident scenarios; a set of scenar-
ios is developed and subsequently analyzed
for detailed consequences.
Significant advancement has been made
in developing newer means for hazard and risk assessment,
consequence modeling, and user-friendly computer-aided
tools. However, while foreseeing worst-case scenarios is
common, little attention is paid in envisioning credible sce-
narios. Moreover, the scenarios developed by safety engi-
neers often describe just one type of release, without giving
much detail about its mode and further escalation. This point
is cited in the magnum opus on loss prevention by Lees (11):
“For a potential release, it is necessary not
only to identify a source but also to decide on the
nature of the release which could occur … The
identification process should not stop at the point
where a release occurs, but in principle should be
continued to embrace the consequences of the re-
lease and the failures and other events, which may
allow these consequences to escalate. In practice,
this aspect is usually treated as part of the hazard
assessment. Whilst this is a reasonable approach,
there is a danger that, unless the identification of
the escalation modes is treated with a thorough-
ness matching that applied to the identification of
the release modes, features which permit escala-
tion and against which measure might be taken
will be missed. The identification of the modes of
escalation appears to be a rather neglected topic.”
Modularization of Complete
Plant into Manageable Units
Hazard Identification
• HIRA Technique
Aid to Develop
Accident Scenario
Qualitative Hazard Assessment
• optHAZOP procedure
Aid to Develop
Accident Scenario
• TOPHAZOP tool
• MOSEC for fire and explosions
• HAZDIG for toxic release and dispersion
• DOMIFFECT for cascading effects
Probabilistic Hazard Assessment
• PROFAT tool
Risk Estimation
Stop
There is a wide variation in the risk-assessment studies
conducted by different groups. Foremost in this is the dif-
ference in the envisaged accident scenarios. For the same
unit, one group foresees a small leak from the joints and
estimates risk based on that, while another group imagines
an explosive release of all vessel contents. Moreover, it has
also been observed that only one or two scenarios are de-
veloped for a possible accident in a unit, and these may not
reflect the true important possible incidents. This is due to
the absence of any homogeneous system for accident-sce-
nario envisaging and credibility assessment.
A credible accident is one within the realm of possibili-
ty and is likely to be severe enough to cause significant
damage. However, what constitutes reasonable probability
and significance of credibility are mostly qualitative, based
on the subjective judgment of the analyst. A small error or
a bit of ignorance in these subjective judgments (in particu-
lar, the development of accident scenarios) can yield erro-
neous results or make the study meaningless. The more re-
alistic the accident scenario, the more accurate the fore-
casting will be for this type of accident, its consequences
and associated risks. This would help in developing more
appropriate and effective strategies for crisis prevention
and management (12).
Thus, it is necessary to have some systematic procedure
CEP November 2001 www.cepmagazine.org 57
Safety

Accidental Release of Chemical Operational Data

Temperature
Release under high pressure Pressure
Normal continuous release Capacity of the unit
Normal instantaneous release Chemical characteristics, etc.

Safe Non-operational Parameters

Chemical properties
Toxicity
No Atmospheric conditions
Quantity released
Site characteristics
Yes Is the chemical No Is the chemical Yes
flammable/reactive? toxic?

Yes

Fire Explosion
Fireball CVCE Dispersion of
Flash fire BLEVE Toxic Chemical
Pool fire VCE Toxic load
Jet fire Vented explosion

Non-operational Parameters ■ Figure 2.

Chemical characteristics The logistics of
Ignition source generating an
Quantity of chemical released accident scenario.
Atmospheric conditions
Degree of confinement
Site characteristics

Accident Scenario:
Sequence of events

or guidelines to envisage all probable accident scenarios,
and, further, to decide which are the most credible. Also, a
scenario should describe the complete situation (right from
release mode to the subsequent events).
Accident scenario
This is a description of an expected situation. It may
contain a single event or a combination of them. In most
of the past risk-assessment reports, accident scenarios
have been proposed as single events, which is not a valid
way of imagining an incident. Past case studies show that
an accident occurs as a sequence or combination of
events. Creating a scenario does not mean that it will
occur, only that there is a reasonable probability that it
could. A scenario is neither a specific situation nor a spe-
cific event, but a description of a typical situation that
covers a set of possible events or situations (Figure 2). It
is the basis of the risk study; it tells us what may happen
so that we can devise ways and means of preventing or
minimizing the possibility.
An accident scenario forms a focal point of a heuristic
process. It enables use of the wisdom of hindsight and
state-of-the-art knowledge to evaluate its impact in fore-
casting accident situations. The scenario is a reference
point, as well as a link between the past, present and fu-
ture. Such scenarios are generated based on the properties
of chemicals handled by industry, physical conditions
under which reactions occur or reactants/products are
stored, as well as geometries/material strengths of vessels
and conduits, in-built valves and safety arrangements, etc.
External factors, such as site characteristics (topography,
presence of trees, ponds, rivers in the vicinity, proximity to
other industries or neighborhoods, etc.) and meteorological
conditions, need also be considered.
Worst-case accident scenario
The Emergency Planning and Community Right to
Know Act (EPCRA) was passed in 1986, in the wake of
the tragic chemical accident in Bhopal, India. EPCRA es-
tablished some systems to cope with chemical emergencies
including Local Emergency Planning Committees
(LEPCs). LEPCs must prepare comprehensive emergency
plans outlining local chemical hazards and emergency re-
sponse procedures. For these plans, the U.S. Environmen-
tal Protection Agency (EPA) recommends that LEPCs ei-
ther prepare themselves or request facilities to prepare
emergency plans based on worst-case scenarios (8, 13).
Worst-case accident scenarios indicate the geographic

58 www.cepmagazine.org November 2001 CEP

area (the vulnerable zone) affected by the worst-possible
accident at a facility in which people would be at risk of
life and health. These scenarios typically consider the near-
instantaneous release of the entire amount of a chemical
stored at a facility and assume the failure of mitigation and
safety systems. EPA and other regulatory agencies have
been canvassing the worst-case scenarios for emergency
planning; these scenarios are also critical for pollution pre-
vention. The Clean Air Act Amendments (CAAA) of 1990
require companies to prepare risk management programs,
including worst-case accident scenarios, and make them
available to the public. Many companies are questioning
the significance of the worst-case accident scenario con-
cept and opposing the national and public data systems that
include the risk management plan (RMP) on the Internet
(8). Although, the author agrees with CAAA and Right to
Know Act, the worst-case accident scenario may not be the
best approach. This author feels that RMPs and other
emergency plans should be based on the maximum-credi-
ble accident scenarios. Maximum credibility should be set
by regulatory agencies, depending upon the vulnerability
of a site. This would overcome the following major limita-
tions of the worst-case-accident-scenario approach:
• In the worst-case method, emergency or risk-manage-
ment planning is done mostly based on the release and dis-
persion of toxics as they cover maximum distances and
may cause a large number of fatalities by a short exposure,
as in Bhopal. However, it is not always true that a release
of toxic chemical would be the most disastrous one, partic-
ularly if the domino effect were considered (12, 14, 15).
The 1984 incident in Mexico and one in Vishakhapatnam,
India (1997) are clear evidence of this (15, 16).
• In using the worst-case scenario, only one-parameter
damage potential is considered, and the probability of its
occurrence is generally ignored. However, the probability
of an accident is also equally important. Past accident anal-
ysis reveals that frequent, but less-damage-causing acci-
dents can create large financial losses and, often, can esca-
late to catastrophic proportions due to negligence. A de-
tailed description of the maximum-credible-accident-sce-
nario approach is now presented.
Maximum-credible accident scenarios
In using maximum-credible accident scenarios
(MCAS), the central criterion is what constitutes a credible
accident. A credible accident is defined as: an accident that
is within the realm of possibility (i.e., probability higher
than 1 × 10–6/yr) and has a propensity to cause significant
damage (at least one fatality). This concept (11, 17, 18, 19)
comprises both parameters — probable damage caused by
an accident and its probability of occurrence. There may be
types of accidents that may occur frequently, but would
cause very little damage. And there may be others that may
cause great damage, but would have a very low probability
of occurrence. Both would be considered accidents.
A credible accident scenario should contain two sets of
information: a description of the situation and its probabili-
ty of occurrence. The description must not reduce the free-
dom of finding solutions and must not restrict the means
available for solution. A good accident scenario should de-
scribe the most prime cause of an event. An example: De-
fine a leak rate instead of an explosion pressure, because
here, one could go further and describe the cause of the
leak as well.
There may be number of accidents that occur quite fre-
quently, but due to proper control measures or lesser quan-
tities of chemicals released, they are controlled effectively.
A few examples are a leak from a gasket, pump or valve,
release of a chemical from a vent or relief valve, and fire in
a pump due to overheating. These accidents generally are
controlled before they escalate by using control systems
and monitoring devices — used because such piping and
equipment are known to sometimes fail or malfunction,
leading to problems. On the other hand, there are less prob-
lematic areas/units that are generally ignored or not given
due attention. This is because few or even no accidents
have been reported. In such situations, even a small leak
may lead to a disastrous accident. Past accident analysis re-
veals that most of the catastrophic accidents occurred in ig-
norance (the accident was not foreseen) and either in areas
marked yellow (not highly hazardous) or where the control
arrangements were inadequate (control measures based on
less credible scenarios). The disaster at Vishakhapatnam
proves that most of the risk and hazard studies are lacking
in envisaging the credible accident scenarios, therefore, the
control measures or emergency plans are not so effective.
Methodology for MCAS
The first step of the MCAS methodology develops all
plausible accident scenarios in the unit (Figure 3). In the
second step, damage radii are calculated for each scenario.
This can be done using quantitative hazard indices. There
are two options available — one is to use Dow’s Fire and
Explosion Index (for fire and explosion scenarios) and the
Mond Toxic Index (for toxic and corrosive releases and
dispersions) (9, 11, 20). The other is to employ the indices
proposed by Khan and Abbasi (1, 21); a fire and explosion
damage index (FEDI), and toxic damage index (TDI) for
flammable and toxic chemicals, respectively.
In the next step, the probability of each accident sce-
nario is estimated. This can be done using either industry-
specific data (failure rates of various components used in a
process unit) or the data available in the literature (frequen-
cies of occurrence of the same event under similar condi-
tions). The later process of probability estimation is easy,
but a little crude, and has been subject to criticism. How-
ever, this author feels that this procedure is adequate, as the
objective is to get a rough estimate of probability. If the ac-
cident is found to be credible, more accurate estimation of
its probability would be done in the subsequent step of de-
CEP November 2001 www.cepmagazine.org 59
Safety

Take One Unit

Develop All Plausible Accident Scenarios

Consider One Accident Scenario
Flammable
Flammable or Toxic?
Calculate Factor A
Calculate Factor B
Calculate Factor C
Calculate Credibility Factor L1
of formulating the accident scenario.
According to the characteristics of
the chemical, accident scenarios can be
divided into three main groups: fire
and explosion; release and dispersion
of a toxic or corrosive fluid; and both
fire and explosion, and toxic events. In
real life, many times the third type of
Is the Chemical Toxic
accident occurs. Once damage radii
and probabilities are known for each
damaging event, three factors — A, B
Both Flammable
and Toxic and C — are computed using site-spe-
cific information, such as population
density, asset density of the site, etc.,
Calculate Factor AA to define credibility. The estimating
procedures follow for each of the three
incident groups.
Calculate Factor BB Scenarios involving fires
and explosions
Financial loss: Factor A accounts for
Calculate Credibility Factor L2 the damage to property or assets and may
be estimated for each scenario using:

Calculate Total Credibility Factor L Ai = (AR)i × (PR)i × (AD)i /UFL (1)

A = minimum (1, ΣAi) (2)

Classify Credibility of the Scenario
where i is the number of events (from i
= 1 to n), i.e., fire, explosion. UFL is the
unacceptable financial loss. For exam-
No ple, a loss of $1 million/100 yr may be
Is it Credible?
just tolerable to an organization, so a
loss higher than this unacceptable. We
Yes suggest a value of $10,000/yr for UFL.
Fatalities: Similar to the factor for fi-
List the Scenario nancial loss, the fatality factor, B, is es-
timated for each accident scenario:

No PD1 = PD1 × PDF1 (3)

Are all Units Over?
Bi = (AR)i × (PR)i × (PD1)i/UFR (4)
Yes
B = minimum (1, ΣBi) (5)
Short-list the Most Credible
Accident Scenarios UFR, the unacceptable fatality rate,
has a suggested value = 10–2. PDF1, the
population distribution factor, reflects
■ Figure 3. Steps in the most-credible-accident scenarios (MCAS) method. the heterogeneity of the population dis-
tribution. If the population is uniformly
distributed in the region of study
tailed risk assessment. The use of more reliable methods of (~2,000-m radius), the factor is assigned a value of 1; if the
probability estimation (e.g., fault-tree analysis) not only re- population is localized and away from the point of acci-
quires large sets of data, but also large amounts of compu- dent, the lowest value of 0.2 is assigned. Values for this pa-
tational time. These costs are not justifiable at this stage rameter has been adapted from Ref. 9.

60 www.cepmagazine.org November 2001 CEP

 1

0.8
Importance Factor

0.6
Nomenclature
0.4
A = factor for damage to property or assets
AD = asset density in the vicinity of the event, up to ~500-m radius), $/m2
0.2 AR = area inside the damage radius, m2
B = factor for fatalities
0 BB = factor for toxic release and dispersion for fatalities
0 1 5 10 50 C = factor for ecosystem damage
CC = factor for toxic release and dispersion for ecosystem damage
Distance of Vulnerable Ecosystem from the Accident Site, km IM = importance factor, from Figure 4, dimensionless
L = total credibility factor, dimensionless
L1 = credibility factor for fire and explosion hazard, dimensionless
■ Figure 4. Importance factor, IM, is a measure of the spread of potential L2 = credibility factor toxic hazard, dimensionless
damage. PD1 = population density in the vicinity of the event (fire and explo-
sion) up to ~2,000-m radius, persons/m2
PD2 = population density in the vicinity of the event (toxic release) up
Ecosystem damage: Factor C signifies ecosystem dam- to ~2,000-m radius, persons/m2
PDF1 = population distribution factor for fire and explosion,
age, which can be estimated as:
dimensionless
PDF2= population distribution factor for toxic release and dispersion,
Ci = (AR)i × (PR)i × (IM)i/UDA (6) dimensionless
PR = probability of occurrence of an event, /yr
C = minimum (1, ΣCi) (7) UDA = unacceptable damage area, m2/yr
UFL = unacceptable financial loss, $/yr
UDA, the unacceptable damage area, has a suggested UFR = unacceptable fatality rate, persons/yr
value of 1,000 m2/yr. IM, the importance factor, is 1 if the WPF = weather probability factor, dimensionless
damage radius is higher than the distance between accident
and location of a sensitive ecosystem, i.e., lake, forest, bird
sanctuary, etc. IM is quantified using Figure 4, developed
with the help of Ref. 22. In this reference, the authors use a study (an area of ~2,000-m radius). The method of quan-
parameter ecosystem damage-penalty for the quantification tification is same as for PDF1. WPF represents the likeli-
of an accident hazard index, AHI. This parameter was hood of the weather condition used in the dispersion esti-
quantified based on a comprehensive Delphi (22). (Delphi mation. Generally, the maximum possible damage area is
is a technique to quantify subjective parameters through an estimated considering a slightly stable or stable condition.
opinion survey of a team of experts. Delphi was used to However, this condition may not prevail at all times, so
quantify some parameters of the AHI.)
These three factors are combined together to yield L1 by:

L1 = [1 – (1 – A)(1 – B)(1 – C)] (8) 0.0

Uncertainty Zone
Scenarios involving toxic
release and dispersion 0.2
Unlike for fire and explosion, two factors are estimated ■ Figure 5.
Classification of
here, BB and CC, for fatality and ecosystem damage, respec- credibility.
tively. These are computed using the following equations: Credibility Zone

PD2 = PD2 × PDF2 (9)

0.5
BBi = (AR)i × (PR) × (PD2) × (WPF)/UFR (10)

BB = minimum (1, maximum of BBi) (11)

Maximum Credibility Zone
where i denotes the particular chemical released. In case of
an accident scenario involving more than one chemical, BB
is computed for each and the highest value is used. PDF2
defines the population distribution factor, which reflects the
1.0
heterogeneity of the population distribution in the region of

CEP November 2001 www.cepmagazine.org 61

Safety

Table 1. Data setting for the ammonia study.

Parameters Value
Chemical involved Ammonia Delineation of MCAS
Quantity of the chemical involved 500 m.t. The credibility ranking is shown Figure
Phase of the chemical Liquefied 5. Region 0–0.2 signifies the zone of uncer-
tainty, which means that the envisaged sce-
Unit operation Storage
narios do not pose much threat either due to
Operating temperature, T 15˚C very low probability of occurrence or dam-
Operating pressure 6.5 atm age potential. This zone signifies the tolera-
Degree of conjunction at the site 0.40 ble risk zone. Region 0.2–0.5 signifies the
credible scenarios, meaning they are likely
Site population density (within region of 2,000-m radius) 250 persons/km2
to occur and may cause enough damage.
Asset density (within region of 500-m radius) $300/m2 Region 0.5 onwards signifies MCAS,
Population distribution factor 0.3 which means the developed scenarios are
Weather probability factor 0.3 highly vulnerable to cause catastrophes.
Once all of the credible and MCAS
Importance factor 1.0
have been identified, they are further stud-
ied to decide the most credible ones as per
this factor estimates the probability of this atmospheric the analyst criterion. The quantitative value of this credibil-
condition occurrence. This is quantified using the statistical ity criterion is defined considering: the objective of study,
weather data of the local area. For example, if a slightly available time and resources, and the operational con-
stable condition exists 30% of the time during a year, then straints. Therefore, the significance of the term “most cred-
the WPF is considered to be 0.30. ible” varies widely, depending upon the analyst or team of
Similarly, CC is computed as: analysts conducting the study.
This would further short-list important accident scenar-
CCi = (AR)i × (PR) × (IM)/UDA (12) ios. The short-listed scenarios may be further processed for
damage potential estimation, risk estimation, and finally, to
CC =minimum (1, maximum of CCi) (13) develop hazard mitigation/minimization or disaster man-
agement strategies. The proposed approach is now used to
Finally, these two factors are combined to give a credi- study the storage of liquefied ammonia.
bility factor L2 for toxic release and dispersion:
Case study: Ammonia
L2 = [1– (1 – BB)(1 – CC)] (14) A vessel stores 500 metric tons of liquefied ammonia at
of 15°C and 6.5 atm. The vessel is connected with one
Scenarios involving combination of input line, one outflow line, a pressure-relief valve and
fire, explosion and toxic release other conventional safety devices. The vessel is in one cor-
To estimate the credibility of accident scenarios involv- ner of a fertilizer plant where the population density is 250
ing both type of events, L1 and L2 are combined as follows: persons/km2, and asset density around the unit is $300/m2
(Table 1). There is bird sanctuary about 1,000 m away
L = (L12 + L22)1/2 (15) from the site. A total of five different accident scenarios are
envisaged in the unit:

Table 2. Credibility factors for the scenarios in the ammonia study.

Accident Damage Frequency of Fire and Explosion Toxic Load Credibility

Scenario Radius, m Occurrence, (/yr)

A B C L1 BB CC L2 L
Scenario 1 2,500 5.0E–05 1.00 0.98 1.00 1.00
Scenario 2 1,100 4.0E–04 1.00 1.00 1.00 1.00
Scenario 3 250* 7.0E–5 0.41 0.10 0.01 0.47 0.98
1,270 0.79 0.35 0.86
Scenario 4 350† 1.0E–06 0.00 0.00 0.00 0.00 0.01
1,200 0.01 0.00 0.01
Scenario 5 950 8.0E–05 0.51 0.22 0.61 0.61
* Damage radius for BLEVE (boiling liquid/expanding vapor explosion).
† Damage radius for CVCE (confined vapor cloud explosion).

62 www.cepmagazine.org November 2001 CEP

 Table 3. Result of consequence analysis for Scenarios 1, 2, 3 and 5 for ammonia study.

Parameters Scenarios and Their Likely Impacts

Scenario 1: Scenario 2: Scenario 3: Scenario 5:

Continuous Continuous Release BLEVE with Evaporation
Release near Ground Dispersion with Dispersion

Explosion: BLEVE
Total energy released, kJ 1.11E+07
Peak overpressure developed, kPa NA NA 1,556.7 NA
Variation of overpressure in air, kPa/s 575.7
Shock wave velocity, m/s 865.5
Duration of shock wave, ms 14

Missile Characteristics:
Initial velocity of fragment, m/s NA NA 745.6 NA
Kinetic energy of fragment, kJ 6.5E+06

Penetration ability at 50 m:
Concrete structure, m NA NA 0.17 NA
Brick structure, m 0.30
Steel structure, m 0.02

Fire:
Radius of fireball, m
Duration of fireball, s
Energy released by fire ball, kJ NA NA NA NA
Radius of pool fire, m
Burning area, m2
Burning rate, kg/s
Radiation heat flux, kJ/m2

Toxic release and dispersion:

Instantaneous (I)/continuous (C) C C I C
Puff/plume characteristics: Plume Plume Puff Puff
Concentration at center of puff/plume, kg/m3 3.14E–02 4.15E–03 3.78E–04 1.15E–04
Concentration at the edge of puff/plume, kg/m3 3.14E–03 4.15E–04 3.78E–05 1.15E–05
Dia. of puff/plume at end of lethal zone, m 210 170 375 115
Radius of the lethal zone (based on LD50), m 2,500 1,100 1,270 950

Domino checking:
Location of the unit from primary event, m 60 m 60 m 60 m 60 m

Domino effect due to heat load:

Total heat received, kJ NA NA NA NA
Heat intensity, kJ/m2
Probability of domino effect due to fire

Domino effect due to overpressure:

Explosion energy, kJ NA NA 3.15E+05 NA
Peak overpressure, kPa 310
Probability of domino effect due to overpressure 1.0

Domino effect due to missile:

Explosion energy, kJ NA NA 3.15E+05 NA
Missile velocity, m/s 145.4
Probability of domino effect due to missile
after meeting target 0.95

NA = Not applicable.

Scenario 1: High pressure in the vessel causes the pres-
sure-relief valve (at the top of the vessel) to open, which
leads to a continuous release of ammonia to the atmo-
sphere until 80% of the chemical is released.
Scenario 2: Due to improper maintenance or other
problems, a leak develops in the vessel’s input or output
pipeline. The leaking area is believed to be 40% of the
pipeline’s cross-sectional area. This scenario is modeled
as continuous release of liquid ammonia near ground
level causing subsequent evaporation and dispersion.
Scenario 3: High pressure develops in the vessel either
due to overfilling or to a runaway reaction. The instanta-
neous release of high pressure causes the vessel to fail as a
boiling-liquid, expanding-vapor explosion (BLEVE), and
the released chemical disperses into the atmosphere.
Scenario 4: Excessively high pressure develops in the
vessel beyond the design capacity of the pressure relief
valve. This causes vessel to burst as a confined vapor cloud

CEP November 2001 www.cepmagazine.org 63

Safety
explosion (CVCE). The instantaneously released chemical
disperses into the atmosphere.
Scenario 5: Ammonia is released from the joints, caus-
ing a pool of liquid to form. The released chemical subse-
quently evaporates into the atmosphere and disperses.
Discussion
These five scenarios were assessed for the credibility es-
timations and results are presented in Table 2. It is evident
from the table that Scenarios 1, 2, 3 and 5 come in the range
of maximum credible range. Scenario 4 falls into the uncer-
tainty range, and although it poses a considerably high
damage potential, credibility is nullified due to its very low
probability. However, since Scenario 2 has a high frequency
of occurrence, but does not pose much threat, still, it does
fall in maximum credibility range. The other scenarios have
adequate damage potentials and probabilities of occurrence.
Among MCAS, Scenario 1 engulfs largest damage area.
The short-listed scenarios were processed for detailed con-
sequences and the summary of the results is presented in
Table 3. As per the study, Scenario 1 poses a severe threat
due to a toxic load over an area of more than a 2,500-m ra-
dius. The damage potentials of Scenarios 2 and 5 are limit-
ed to areas of ~1,000-m radius. Note that Scenario 3 is not
only vulnerable for toxic load (over an area of ~1,270-m ra-
Literature Cited
1. Khan, F. I., and S. A. Abbasi, “Techniques for Risk Analysis of
Chemical Process Industries,” J. of Loss Prevention in Proc. Ind., 11
(2), p. 91 (1998).
2. Van Sciver, G. R., “Quantitative Risk Analysis in the Chemical Pro-
cess Industries,” Reliability Eng. & System Safety, 29, p. 55 (1990).
3. “Guidelines for Chemical Process Quantitative Risk Analysis,” Cen-
ter for Chemical Process Safety, AIChE, New York, p. 125 (1989).
4. Popazoglou, I. A., et al., “Probabilistic Safety Analysis in Chemical
Installations,” J. of Loss Prevention Proc. Ind., 5 (3), p. 181 (1992).
5. Kafka, P., “Probabilistic Safety Assessment: Quantitative Process to
Balance Design, Manufacturing and Operation for Safety of Plant
Structures and Systems,” Principal Division Lecture, Trans. SmiRT,
11, p. 23 (1991).
6. Kafka, P., “Important Issues Using PSA Technology for Design of
New Systems and Plants,” GRS mbH, Garchirg, Germany (1993).
7. Hirst, I. L., and D. A. Carter, “A ‘Worst Case’ Methodology for
Risk Assessment of Major Accident Installations,” Proc. Safety
Progress, 19 (2), p. 78 (2000).
8. Laplante, A., “Too Close to Home: A Report on Chemical Accident
Risks in the United States,” U.S. Public Interest Research Group,
Washington, DC (1998).
9. Khan, F. I., and S. A. Abbasi, “Risk Assessment in the Chemical
Process Industries: Advanced Techniques,” Discovery Publishing
House, New Delhi, India, p. 393 (1998).
10. Khan, F. I., and S. A. Abbasi, “Risk Analysis of a Typical Chemi-
cal Industry Using ORA,” J. of Loss Prevention Proc. Ind., 14 (1), p.
59 (2001).
11. Lees, F. P., “Loss Prevention in the CPI,” Butterworths, London, pp.
26–28 (1996).
64 www.cepmagazine.org November 2001 CEP
dius), but also for the shock wave developed due to the
BLEVE. The damage-causing shock wave would be opera-
tive over an area of ~250-m radius.
It was concluded that current safety measures were not
adequate and needed review in order to reduce the
risk/hazard potential to a tolerable level. It was advised
that safety-related decision-making (planning for disaster
management or emergency planning) should be done, con-
sidering Scenarios 1 and 3. CEP
FAISAL I. KHAN is currently a visiting research professor at the Memorial Univ.
of Newfoundland (MUN) (Faculty of Engineering & Applied Science, MUN,
St John’s, NF, A1B 3X5, Canada; Phone: (709) 737-7652 or 8963; Fax: (709)
737-4042; E-mail: fkhan@engr.mun.ca). Before moving to MUN, he had
served about two years at the Birla Institute of Science and Technology
(BITS) in Pilani, India. He also headed the Computer Aided Environmental
Management unit at the Centre for Pollution Control and Energy
Technology for four years. Khan has over 70 research publications, along
with four books to his credit. He is the coauthor of “Risk Assessment in the
Chemical Process Industries: Advanced Techniques.” He is a cowinner of
the S. K. Mitra Award of 1998. Khan holds BS and ME degrees from Aligarh
Muslim Univ. and the Univ. of Roorkee in chemical engineering and
computer-aided process plant design, and he has secured II and I rank,
respectively, with first-class honors. He has a PhD from Pondicherry Univ.
in environmental systems engineering with special reference to risk
assessment and environmental impact assessment.
12. Khan, F. I., and S. A. Abbasi, “Studies on the Probabilities and
Likely Impacts of Chains of Accidents (Domino Effect) in the Fertil-
izer Industry,” Proc. Safety Progress, 19 (1), p. 45 (Spring 2000).
13. Skelton, B., “Process Safety Analysis: An Introduction,” Gulf Pub-
lishing, Houston, p. 201 (1997).
14. Khan, F. I., and S. A. Abbasi, “Models for Domino Effect Analysis
in the Chemical Process Industries,” Proc. Safety Progress, 17 (1), p.
121 (1998).
15. Khan, F. I., and S. A. Abbasi, “Major Accidents in the Process In-
dustries and Analysis of Their Causes and Consequences,” J. of Loss
Prevention Proc. Industries, 12, p. 361 (1999).
16. Khan, F. I., and S. A. Abbasi, “The Worst Chemical Industry Acci-
dent of the 1990s — What Happened and What Might Have Been: A
Quantitative Study,” Proc. Safety Progress, 18 (1), p. 135 (1999).
17. Hagon, D. O., “Use of Frequency-Consequence Curves to Examine
the Conclusion of Published Risk Analysis and to Define Broad Cri-
teria for Major Hazard Installations,” Chem. Eng. Res. Dev., 62, p.
381 (1984).
18. “The Tolerability of Risk Formation from Nuclear Power Stations,”
Health and Safety Executive, HM Stationary Office, London (1998).
19. Ale, B. J. M., “Risk Analysis and Risk Policy in the Netherlands
and EEC,” J. Loss Prevention Proc. Ind., 4 (1), p. 58 (1991).
20. Scheffler, N. E., “Improved Fire and Explosion Index Hazard Clas-
sification,” Proc. Safety Progress, 13 (4), p. 214 (1994).
21. Khan, F. I., and S. A. Abbasi, “Hazard Identification and Ranking
(HIRA): A Multi-Attribute Technique for Hazard Identification,”
Proc. Safety Progress, 17 (3), p. 16 (1998).
22. Khan, F. I., and S. A. Abbasi, “Accident Hazard Index: A Multi-At-
tribute Scheme for Process Industry Hazard Rating,” Trans. IChemE
(Environmental Protection and Safety), 75B, p. 217 (1997).