- 1 -

QRA’s for Dutch Installations II. Overview of risk tool SAFETI-NL selected by the Dutch Government Henk Witlox (henk.witlox@dnv.com) and David Worthington (david.worthington@dnv.com)

DNV, London, United Kingdom

ABSTRACT The Dutch government has selected the Dutch version SAFETI-NL of the risk tool SAFETI from DNV Software as the tool to be used within the Netherlands for the next five years for QRA studies for installations. The companion paper (Part I) includes details on the new risk regulations and methodology prescribed by the New Dutch Purple Book. The current paper (Part II) provides an overview of the associated software tool SAFETI-NL.

Keywords: QRA, risk analysis, consequence modelling, New Dutch Purple Book, BEVI, SAFETI-NL

1. INTRODUCTION

A new Dutch law, known as the BEVI legislation, has been introduced which prescribes the maximum allowable individual risk. Therefore, unique results for QRA studies for installations in the Netherlands are desirable. However, a previous Dutch study revealed that different QRA software packages often give very different results. In conjunction with this an EU tender was issued by the Dutch government, and the Dutch version SAFETI-NL of the risk tool SAFETI from DNV Software was selected as the tool for the next five years.

The risk tool SAFETI calculates the individual risk (risk at specific location) and societal risk (risk to overall population) of accidental releases of toxic or flammable chemicals to the atmosphere. This calculation includes consequence modelling (discharge and atmospheric dispersion, toxic effects, flammable effects) and subsequent risk modelling. A significant number of modifications have been applied to the Dutch version SAFETI-NL in order to fully comply with the New Dutch Purple Book including risk methodology as prescribed by the BEVI law and other requirements from the Dutch Government.

The current paper presents a brief overview of the above consequence and risk methodology including its verification and validation. It also includes an overview of the main steps to be carried out by the user in a QRA using SAFETI-NL (data input, consequence and risk calculations, reporting/graphs).

2. OVERVIEW OF SAFETI-NL ANALYSIS

Figure 1 includes a schematic diagram of a SAFETI-NL analysis, and the steps in this analysis (some of which are optional) are described in the paragraphs below.

The user first imports a map into the new SAFETI-NL study file, which covers the area of concern for his QRA. Subsequently he selects the nearest Dutch weather station and the surface roughness. From this input SAFETI-NL automatically picks up all relevant weather categories applicable for both day and night including a range of stability classes and wind speeds. Unlike SAFETI, SAFETI-NL does not allow the user to add or edit weathers himself.

For each release scenario, the user specifies the accident frequency and release data such as storage conditions (type of material, temperature, pressure and inventory), scenario type (catastrophic vessel rupture, leak from hole in vessel, line rupture, long pipeline; indoor or outdoor release) and associated scenario input data. Based on these the program carries out consequence calculations (discharge, dispersion, flammable and toxic effects). The user can examine the consequence output (reports and graphs including dynamic plots), which includes concentration, radiation and overpressure data. It also includes probabilities of death for each flammable and toxic event. SAFETI-NL only permits those release scenarios required by the New Dutch Purple Book, while SAFETI includes a wider range of scenarios.

- 2 -

Subsequently the user needs to specify population data and ignition sources. SAFETI-NL calculates the individual risk contours and societal risk (F/N curve) based on these data, consequence results and meteorological data (wind-direction probabilities etc.). The contribution of each release scenario to the overall individual risk is listed in risk-ranking tables at user-specified risk ranking points. The contribution of each scenario to the overall societal risk is listed in an F/N pair ranking table

SAFETI-NL only includes those materials of which data (such as probit coefficients for toxic materials) have been approved by the Dutch government. No materials can be added or edited by the user himself with the exception of mixtures of materials included in the database. Also most parameters are hidden and cannot be edited by the user in order to ensure full compliance of SAFETI-NL with the new Dutch Purple Book. SAFETI does not include the above restrictions and allows much more freedom to the user.

SAFETI-NL: input ( ) and output ( )

Weather station

“Models” LOC data:

-Release data

-Release frequency

“Risk” data:

-Population data

-Ignition data

-Risk ranking

Study (case) dataStudy (case) data

Hazard zones

Consequence output

Hazard zones

Consequence output

Societal risk:

-Risk table (F/N curve)

-Rate of death

-F/N pair ranking table

Individual risk:

-Risk array (contours)

-Risk ranking tables

Risk output

Societal risk:

-Risk table (F/N curve)

-Rate of death

-F/N pair ranking table

Individual risk:

-Risk array (contours)

-Risk ranking tables

Risk output

Risk runRisk run

Default data: “Weather”, “Parameters”, “Materials”

“Map”

Consequence runConsequence runConsequence run

Figure 1. Schematic diagram of SAFETI-NL analysis

3. CONSEQUENCE MODELLING

Figure 2 lists the consequence models in SAFETI and SAFETI-NL involving discharge modelling, dispersion modelling and the evaluation of flammable and toxic effects. First discharge calculations are carried out. All release scenarios of relevance for the New Dutch Purple Book may be modelled including releases from vessels (leak or catastrophic rupture), releases from short or long pipes and releases of combustion products following a warehouse fire. Vapour, two-phase, and (sub-cooled, superheated or saturated) liquid releases may all be modelled. Discharge modelling involves first expansion from stagnation to orifice conditions, and subsequent expansion from orifice conditions to ambient conditions. Secondly dispersion calculations are carried out to determine the concentrations of the hazardous chemical when the cloud travels in the downwind direction (see Figure 3). This includes effects of jet, heavy-gas and passive dispersion. Calculations are carried out typically until the lower flammability limit (LFL) is reached for a flammable chemical, or until the probability of death Pd is reduced to 1% for a toxic chemical. In the case of a two-phase release rainout may occur, and pool formation/spreading and re-evaporation is modelled. The two-phase thermodynamics module contained in the dispersion model

- 3 -

contains a homogeneous equilibrium model, a non-equilibrium model, and an equilibrium model specific to HF. Also effects of indoor dispersion (for indoor releases) and building wakes can be accounted for.

flammable

radiation radiation radiation

pressurisedflammable

jet fire pressurisedflammable

jet fire flammable

jet fire re-evaporation

pool spread and evaporation

rainoutre-evaporation

pool spread and evaporation

rainout

pool spread and evaporation

rainout

pool fire flammable rainout pool fire flammable

pool fire flammable rainout

fireball

flammable short duration

fireball

flammable short duration

Discharge:-vessel-short pipe-long pipe-warehouse fire-tank roof collapse-vent from vapour space

Discharge:-vessel-short pipe-long pipe-warehouse fire-tank roof collapse-vent from vapour space

indoor dispersion

indoor

indoor dispersionindoor dispersion

indoor outdoor dispersionoutdoor dispersionoutdoor dispersion

indoor effectindoor concentrationindoor effectindoor concentrationindoor concentration

building wake dispersion

wake effects

building wake dispersion

building wake dispersion

wake effects

toxicstoxic toxicstoxic toxicstoxicstoxic

Flammable flash fire

Flammable flash fire

explosionflammableoverpressureexplosionflammable explosionflammableoverpressure

Models not needed for SAFETI-NL: tank roof collapse, vent from vapour space, indoor concentration

Models not in PHAST: flash fire

Figure 2. Consequence models in SAFETI

Subsequently toxic or flammable calculations are carried out. For flammables, ignition may lead to fireballs (instantaneous releases), jet fires (pressurised flammable releases), pool fires (after rainout) and vapour cloud fires or explosions. Radiation calculations are carried out for fires, while overpressure calculations are carried out for explosions. For each event, the probability of death is determined using toxic or flammable probit functions. Figure 3 illustrates the potential occurrence of the different flammable events. The immediate ignition probability is set using logic prescribed by the New Dutch Purple Book. It results in a jet fire for a continuous release, and a fireball, explosion or flash fire for an instantaneous release. While the cloud is travelling in the downwind direction, delayed ignition occurs if the cloud LFL area moves above a specified ignition source. This results in either a late explosion or a late flash fire. In case of rainout, the early pool fire is included for immediate ignition and a late pool fire with delayed ignition. Each of the consequence models has gone through an extensive quality assessment, including verification against analytical results and/or other software, and validation against experimental data. Full information of this is contained in the technical documentation provided by SAFETI; see e.g. Witlox and Holt (1999) for details on validation of the dispersion model. More recent development work includes more rigorous modelling of multi-component releases (Witlox et. al, 2006) and improved modelling of rainout (Witlox et al., 2007).

4. RISK MODELLING

A failure event tree is generated including failure probabilities for all the above toxic and flammable events, and a calculation area is determined containing the hazardous zones for all events. All potential scenarios are integrated over the range of possible weather conditions and wind directions. Subsequent individual and societal risks are calculated. SAFETI allows for a potential wide range of methods for risk calculations. SAFETI-NL is very prescriptive in its risk calculations as illustrated by Figure 4. For individual risk the “free-field method” is prescribed for which the calculated risk is chosen to be independent of the offsite ignition sources (which are beyond the

- 4 -

control of the company itself). Thus the user needs to specify onsite ignition sources only. In case no onsite ignition takes place and the LFL cloud moves beyond the site, delayed ignition is assumed to occur at the time at which the LFL area is maximal (see Figure 4a). For societal risk the users needs to specify offsite population data and both onsite and offsite ignition sources. In case no ignition occurs because of the specified ignition sources, no flammable effects will occur (see Figure 4b).

(a) Continuous release with no rainout

(b) Instantaneous release with no rainout

Figure 3. Downwind cloud dispersion including dro plet evaporation and rainout including potential flammable effects

The risk calculations in SAFETI (and SAFETI-NL) have been extensively verified against analytical solutions and by other means in order to ensure that the theory has been implemented correctly for all possible types of combinations of flammable and toxic outcomes in conjunction with a wide range of ignition and population data. Figure 5 depicts the risk results for the hypothetical case of a chemical plant NW of the town Pannerden. Figure 5a shows individual risk contours accounting for an onsite ignition area and ignoring offsite ignition

- 5 -

caused by cars present on surrounding roads. The 10-7 and 10-8 risk contours reach into the town Pannerden. The F/N curve exceeds the guideline as shown in Figure 5b.

Distance from release to site boundary (parameter: conservative value of 10 m)

Distance from release to site boundary (parameter: conservative value of 10 m)

Only specify onsite ignition

sources

Only specify onsite ignition

sources

1. Immediate ignition (probability from Purple Book)

1. Immediate ignition (probability from Purple Book)

WINDWIND

2. Delayed ignition (probability from specified ignition sources)

2. Delayed ignition (probability from specified ignition sources)

3. Free-field ignition(always ignition)

maximum LFL area

3. Free-field ignition(always ignition)

3. Free-field ignition(always ignition)

maximum LFL area

Terrain

x

release point

Terrain

x

Terrain

x

release point

(a) Dutch free-field method for individual-risk calculations

2. Delayed ignition (probability from specified ignition sources)

2. Delayed ignition (probability from specified ignition sources)

Terrain

x

release point

Terrain

x

Terrain

x

release point

1. Immediate ignition (probability from Purple Book)

1. Immediate ignition (probability from Purple Book)

WINDWIND

2. Delayed ignition (probability from specified ignition and population

sources)

2. Delayed ignition (probability from specified ignition and population

sources)

Specify all ignition sources (onsite and offsite)

Specify all ignition sources (onsite and offsite)

3. No effect3. No effect

(b) Method for societal risk calculations

Figure 4. Individual and societal risk calculatio ns

- 6 -

Onsite ignition

Offsite ignition

Release point

Pannerden population

(a) Individual risk contours

F/N curve

Guideline

(b) F/N curve

Figure 5. Hypothetical example for risk analysis of chemical plant

REFERENCES

Witlox, H.W.M., and Holt, A., 1999, A unified model for jet, heavy and passive dispersion including droplet rainout and re-evaporation, International Conference and Workshop on Modelling the Consequences of Accidental Releases of Hazardous Materials, CCPS, San Francisco, California, September 28 – October 1, pp. 315-344 Witlox, H.W.M., Harper, M., Topalis, P. and Wilkinson, S., 2006, Modelling the consequence of hazardous multi-component two-phase releases to the atmosphere, pp. 250-265, Hazards XIX Conference, Manchester, 27-30 March 2006

Witlox, H.W.M., Harper, M., Bowen, P.J. and Cleary, V.M., 2007, Flashing liquid jets and two-phase dispersion – II. Comparison and validation of droplet size and rainout formulations, Accepted for publication in Journal of Hazardous Materials (2007)