Paltrinieri Nicola tesi

Paltrinieri Nicola tesi
Alma Mater Studiorum – Università di Bologna
DOTTORATO DI RICERCA IN
Ingegneria Chimica dell’Ambiente e della Sicurezza
Ciclo XXIV
Settore Concorsuale di afferenza: 09/D3 – Impianti e processi industriali chimici
Settore Scientifico disciplinare: ING-IND/25 – Impianti Chimici
DEVELOPMENT OF ADVANCED TOOLS AND METHODS
FOR THE ASSESSMENT AND MANAGEMENT OF RISK
DUE TO ATYPICAL MAJOR ACCIDENT SCENARIOS
Presentata da:
Nicola Paltrinieri
Coordinatore Dottorato
Relatore
Prof. Ing. Serena Bandini
Prof. Ing. Valerio Cozzani
Esame finale anno 2012
2
Contents
Abstract ................................................................................................................................................... 7
Section 1. General introduction .............................................................................................................. 9
1.1 Atypical accident scenarios: limits of current HazId methodologies .......................................... 10
1.2 The need of a new methodology for the identification of atypical accident scenarios .............. 11
1.2.1 Application of DyPASI to new and alternative technologies for LNG regasification ............ 11
1.2.2 Application of DyPASI to Carbon Capture and Sequestration technologies and comparison
with the “top-down” approach ..................................................................................................... 11
1.3 Development of suitable indicators ............................................................................................ 12
1.4 Organization of the present report ............................................................................................. 12
Section 2. Atypical accident scenarios: analysis and lessons learned ................................................... 15
2.1 Introduction................................................................................................................................. 16
2.2 Definition and examples of atypical accident scenario ............................................................... 16
2.2.1 Defining “Atypical” scenarios ............................................................................................... 16
2.2.2 The atypical major accidents at Toulouse and Buncefield ................................................... 19
2.2.3 Repetition of unheard atypical accidents............................................................................. 21
2.3 Approach to information management ...................................................................................... 21
2.3.1 Systematic approach to atypical accident analysis .............................................................. 21
2.3.2 In-depth analysis of atypical accidents................................................................................. 22
2.3.3 Bow-tie analysis of atypical accidents .................................................................................. 23
2.4 Results ......................................................................................................................................... 24
2.4.1 Failures in risk management and governance...................................................................... 24
2.4.2 Early warnings ...................................................................................................................... 26
2.4.3 Bow-tie diagrams.................................................................................................................. 27
2.5 Discussion .................................................................................................................................... 30
2.5.1 Importance of the risk perception issue .............................................................................. 30
2.5.2 Common failures of atypical scenarios ................................................................................ 30
2.5.3 Enhancement of knowledge management for a more complete risk appraisal .................. 33
2.6 Conclusions.................................................................................................................................. 34
3
Section 3. Dynamic Procedure for Atypical Accident Scenarios – DyPASI: ........................................... 37
description and application ................................................................................................................... 37
3.1 Introduction................................................................................................................................. 38
3.2 Dynamic Procedure for Atypical Accident Scenarios – DyPASI ................................................... 39
3.2.1 General features ................................................................................................................... 39
3.2.2 Pre-analysis........................................................................................................................... 42
3.2.3 Review of hazardous characteristics of substances handled ............................................... 43
3.2.4 Integration of atypical scenario elements ............................................................................ 44
3.2.5 Identification of appropriate safety barriers ........................................................................ 44
3.2.6 General issues tackled by DyPASI ......................................................................................... 45
3.2.7 Specific attributes of DyPASI ................................................................................................ 47
3.2.8 DyPASI role in the Emerging Risk Management ................................................................... 47
3.3 Case-Study 1: application of DyPASI to LNG regasification technologies ................................... 49
3.3.1 Overview of the LNG chain ................................................................................................... 50
3.3.2 LNG regasification terminals ................................................................................................ 51
3.3.3 Alternative lay-outs of LNG regasification terminals ........................................................... 52
3.3.4 Representative case selected ............................................................................................... 53
3.3.5 Results from the application of the MIMAH methodology .................................................. 54
3.3.6 Results from the application of DyPASI ................................................................................ 56
3.3.7 Discussion of results ............................................................................................................. 63
3.4 Case-Study 2: application of DyPASI to the analysis of surface installations intended for Carbon
Capture and Sequestration ............................................................................................................... 64
3.4.1 The CCS chain ....................................................................................................................... 64
3.4.2 CCS surface installations....................................................................................................... 66
3.4.3 Application of the two methodologies ................................................................................. 69
3.4.4 Results of the two methods ................................................................................................. 73
3.4.5 Discussion of results ............................................................................................................. 77
3.5 Conclusions.................................................................................................................................. 80
Section 4. Development of indicators for prevention of atypical accident scenarios .......................... 81
4.1 Introduction................................................................................................................................. 82
4.2 Methodologies for the development of early warning indicators .............................................. 82
4.3 The REWI method........................................................................................................................ 85
4.4 The Dual Assurance method ....................................................................................................... 86
4.5 The ER KPI method ...................................................................................................................... 87
4.6 Results ......................................................................................................................................... 87
4
4.7 Discussion .................................................................................................................................... 97
4.7.1 Comparison of REWI and DA indicators with actual accident failures ................................. 97
4.7.2 Emerging Risk Key Performance Indicators.......................................................................... 99
4.7.3 Synergy between the three methods and DyPASI ............................................................. 100
4.8 Conclusions................................................................................................................................ 102
Section 5. General conclusions............................................................................................................ 105
5.1 Characteristics of atypical accident scenarios ........................................................................... 106
5.2 Approach to “Unknown Knowns” ............................................................................................. 106
5.3 Approach to “Unknown Unknowns” ......................................................................................... 107
5.4 Holistic approach to atypical accident scenarios ...................................................................... 108
References ........................................................................................................................................... 109
Annex I. Detailed analysis of atypical accident scenario ..................................................................... 121
I.I Introduction................................................................................................................................. 122
I.II Vapour Cloud Explosion at Buncefield, UK - 11th December 2005 ............................................. 125
I.III Explosion at Toulouse, France - 21st September 2001 .............................................................. 141
I.IV Vapour Cloud Explosion at Newark, US - 7th January 1983 ....................................................... 154
I.V Vapour Cloud Explosion and Fire at Naples, Italy - 21st January 1985 ....................................... 162
I.VI Vapour Cloud Explosion at St Herblain, France - 7th October 1991 .......................................... 174
I.VII Comparison of Major Accidents: Vapour Cloud Explosions at Buncefield (UK, 2005), San Juan
Bay (Puerto Rico, 2009), Jaipur (India, 2009) .................................................................................. 194
Annex II. urvey of available technologies for LNG regasification ........................................................ 197
II.I Introduction................................................................................................................................ 198
II.II On-shore LNG regasification terminal ....................................................................................... 199
II.III Off-shore GBS LNG regasification terminal .............................................................................. 205
II.IV Off-shore FSRU LNG regasification terminal ............................................................................ 211
II.V Off-shore TRV LNG regasification terminal ............................................................................... 217
II.VI Specific data of alternative equipments – LNG storage ........................................................... 224
II.VII Specific data of alternative equipments – LNG vaporization.................................................. 232
Annex III. Survey of available technologies for CCS surface installations ........................................... 239
III.I Introduction............................................................................................................................... 240
III.II Post-combustion capture ......................................................................................................... 241
5
III.III Alternative technologies for post combustion capture .......................................................... 251
III.IV Pre-combustion capture ......................................................................................................... 254
III.V Alternative technologies for pre-combustion capture ............................................................ 262
III.VI Oxy-fuel combustion ............................................................................................................... 264
III.VII Alternative technologies similar to the oxyfuel combustion ................................................. 270
III.VIII Carbon dioxide compression................................................................................................. 271
III.IX CO2 transport ........................................................................................................................... 274
III.X References ................................................................................................................................ 283
Acknowledgements ............................................................................................................................. 285
6
Abstract
Proper hazard identification has become progressively more difficult to achieve, in particular when
routine activities as safety reporting for well known technologies are carried out. This is witnessed by
several major accidents that took place in Europe in recent years, such as the Ammonium Nitrate
explosion at Toulouse in 2001 and the vapour cloud explosion at Buncefield in 2005. The actual
scenarios that took place were not considered by the site safety case because deviating from normal
expectations of unwanted events or worst case reference scenarios, despite several similar past
events were present in literature. Furthermore, the consideration of atypical accident scenarios is
complicated by the rapid renewal in the industrial technology, which has brought about the need to
upgrade hazard identification methodologies. In fact, accident scenarios of new and emerging
technologies, which are not still properly identified, may remain unidentified until they take place for
the first time. Examples of new and emerging technologies can be found in Liquefied Natural Gas
regasification and Carbon Capture and Storage, where a lack of substantial operational experience
may lead to difficulties in the hazard identification. The consideration of atypical scenarios is thus
extremely challenging and non-identified scenarios constitute an unknown risk. For these reasons, a
specific method named Dynamic Procedure for Atypical Scenarios Identification (DyPASI), was
developed as a complementary tool to bow-tie identification techniques. The main aim of the
methodology is to provide an easier but comprehensive hazard identification of the industrial
process analysed. DyPASI is a method for the systematization of information from early signals of risk
related to past events, near misses and inherent studies. This allows defining and taking into account
atypical accident scenarios related to the substances, the equipment and the industrial process
considered. DyPASI features as a tool to support emerging risk management process, having the
potentiality to break “vicious circles” and triggering a gradual process of assimilation and integration
of previously unrecognized atypical scenarios in the risk management process. DyPASI was validated
on the two examples of new and emerging technologies previously mentioned: Liquefied Natural Gas
regasification and Carbon Capture and Storage. By collecting and analysing relevant early warnings,
such as scientific and technical reports, past accidents and growing social concern issues, the study
broadened the knowledge on the related emerging risks. At the same time, it was demonstrated that
DyPASI is a valuable tool to obtain a more complete and updated overview of potential hazards than
what could be obtained by a conventional HAZID technique. The HAZID analysis of CCS technologies
was performed in parallel with another methodology: the “Top-down” approach. This allowed use of
different perspectives and to carry out a comparison of the two methods in order to find in which
conditions one is more suitable than the other. Finally, three methods for the development of early
warning indicators were assessed in order to tackle underlying accident causes for a more complete
action of prevention of atypical events. The Resilience-based Early Warning Indicator (REWI) method
and the Dual Assurance (DA) method were applied to the Buncefield oil depot, while the Emerging
Risk Key Performance Indicator (ER KPI) method was applied to the LNG regasification technologies.
The indicators developed by REWI demonstrated a general capacity to cover underlying
organizational causes, showing a better ability to address the prevention of never previously
experienced events compared with the others. However, the main difference reported in the
comparison between the three methods concerns their possible dependence or complementarity
with DyPASI. In fact, the REWI method was found to be the most complementary and effective of the
three, demonstrating that the synergy of the two methods (REWI and DyPASI) would be an adequate
strategy to improve hazard identification methodologies towards the capture of atypical accident
scenarios.
7
8
Section 1
General introduction
9
1.1 Atypical accident scenarios: limits of current HazId methodologies
Since 1976, when the major accident of Seveso (Italy) occurred and a completely unexpected
runaway reaction caused the highest known exposure of resident population to 2,3,7,8tetrachlorodibenzo-p-dioxin (an extremely toxic and carcinogenic dioxin (US NLM 2012, HSD 2012))
(Eskenazi et al. 2004), it was clear how complete and effective activities of appraisal and assessment
of potential hazards in the process industry are of primary importance for the prevention of such
accident scenarios. In fact, what remains unidentified cannot be prevented or mitigated and a latent
risk is more dangerous than a recognized one due to the relative lack of emergency preparedness.
This type of scenarios can be classified as “atypical” because they can not be captured by standard
risk analysis processes and common HAZard IDentification (HAZID) techniques due to their deviation
from normal expectations of unwanted events or worst case reference scenarios.
In response to several European Directives, considerable investment were made by industry towards
the development and the extended use of structured HAZID techniques e.g. as Hazard and
Operability Analysis (HazOp). Actually, the “Seveso” Directives (Directives 82/501/EEC, 96/82/EC, and
2003/105/EC (Council Directive 1982, Council Directive 1996, Directive 2003)) concerning the control
of major-accident hazards involving dangerous substances, require issuing a comprehensive “safety
report” for all installations falling under the obligations of the Directives. Within the safety report,
the systematic identification and assessment of possible accident scenarios is required. These safety
cases should provide worst-case scenarios and safety measures that are used for the operations
licensing and for the design of safety perimeters (Land Use Planning), as well as for emergency
response planning (Papadakis and Amendola 1997). However, despite the measures taken, atypical
accidents are still occurring. Two significant examples of “atypical” accident scenarios are those
occurred at Toulouse (France) and Buncefield (United Kingdom), respectively in 2001 and 2005. The
explosion at the “off-specifications” Ammonium Nitrate (AN) warehouse of the nitrogen fertiliser
factory AZF (Grande Paroisse) at Toulouse caused 30 fatalities and €1.5 billion in damages, but worst
scenario considered by safety reports was an AN storage fire (Dechy and Mouilleau 2004). At the oil
depot of Buncefield a Vapour Cloud Explosion caused £1 billion of damage but fortunately no
fatalities (MIIB 2008). In this case the worst-case scenario identified in the HAZID process was a much
less severe gasoline pool fire (MIIB 2008). Thus, in both cases, the accident scenarios that took place
were not considered by the safety report of the site.
Other similar past accidents anticipated the atypical events at Toulouse and Buncefield. In fact, many
severe AN explosions occurred between 90 to 60 years ago, and VCEs involving gasoline and light
hydrocarbon fuels occurred on average every 5 years since mid 1960 in oil depots (MIIB 2008).
Furthermore, after 2005 other similar VCE explosions took place (CNN 2009, Indian Oil Corporation
2009). This highlights that all the lessons coming from early warnings (which in this case are major
accidents, but that can be also near misses, mishaps or specific studies) are not always effectively
learned and put into practice.
Another latent risk can be represented by the accident scenarios related to new and emerging
technologies, which are not still properly identified, and that may remain unidentified until they take
place for the first time. Examples of new and emerging technologies can be found within the fields of
Liquefied Natural Gas (LNG) regasification (Uguccioni 2010) and Carbon Capture and Storage
(Paltrinieri 2010), where new and alternative technologies are being defined and the scale and extent
of both the substances (LNG and CO2) handling is set to increase dramatically. Thus, a lack of
substantial operational experience may lead to difficulties in identifying accurately the hazards
associated with the process. Hence, these new and emerging hazards may comply with the definition
of “atypical” scenarios previously discussed.
Thus, the phenomenon of atypical accident scenarios (described further in section 2) highlights an
emerging need of a revision of the current HAZID techniques with the purpose to develop a
10
methodology capable of comprehensively identifying atypical accident scenarios by learning from
early warnings and capturing evidence of new hazards to consider as soon as they come to light. For
this reason a new and advanced methodology was developed and validated on topical and urgent
cases within this study.
1.2 The need of a new methodology for the identification of atypical accident
scenarios
A preliminary application of a well-established HAZID methodology, such as the bow-tie analysis, to
the oil depot at Buncefield and the AN warehouse of the nitrogen fertiliser factory at Toulouse
(section 2) demonstrated its inability to properly capture the actual accident scenarios. This was
detected despite the MIMAH (Methodology for the Identification of Major Accident Hazards)
methodology was used, a systematic and advanced HAZID technique developed within the European
Commission FP5 ARAMIS research project (Delvosalle et al. 2004) in order to answer a growing
concern on the effectiveness of such methodologies.
MIMAH was taken as a basis to build a new procedure for the identification of Atypical Scenarios,
which was named Dynamic Procedure for Atypical Scenarios Identification (DyPASI). The new
technique (described in detail in section 3) was developed in the framework of the European
Commission FP7 iNTeg-Risk project, a European Commission 7th Framework Programme dedicated
to the Early Recognition, Monitoring and Integrated Management of Emerging, New Technology
Related Risks (Paltrinieri and Wardman 2010). In fact, it aims at a more complete and comprehensive
identification of emerging and atypical hazards by systematizing information from early signals of risk
related to past incident events, near misses and inherent safety studies.
Once developed, DyPASI was validated on the two topical and emerging industrial fields previously
mentioned, whose relative lack of experience in related risks can potentially give rise to atypical
accident scenarios: Liquefied Natural Gas (LNG) regasification and Carbon Capture and Storage.
1.2.1 Application of DyPASI to new and alternative technologies for LNG regasification
World consumption of natural gas is rising and is still expected to rise in the next future (IEO 2010).
Nevertheless most of the western countries, first of all EU countries, rely upon imports in order to
meet their energy needs (EUROSTAT 2011), despite almost three-quarters of the world’s natural gas
reserves are located in the Middle East and in Eurasia (IEO 2010). This means a dramatic
development of LNG transport chain, which has inevitably led to the development of new
technologies, mainly related to advanced floating and off-shore LNG terminals (Uguccioni 2010),
which are not exempt from risks related to the hazardous substance handled, the equipment and the
industrial process.
These emerging risks posed by innovations in transport vessels and regasification units were
preliminarily investigated in the iNTeg-Risk Project, where solutions based on qualified and
standardized approaches for risk assessment and management were developed. Then, results were
further processed within the present study, where available knowledge was complemented and
organized and rare potential accident scenarios were identified by means of DyPASI.
1.2.2 Application of DyPASI to Carbon Capture and Sequestration technologies and
comparison with the “top-down” approach
A sadly famous example of the harmfulness of concentrated CO2 is the limnic eruption at the volcanic
lake Nyos in Cameroon, which released approximately 1.24 MT of CO2 in a few hours killing 1700
people (IEA GHG 2011). This and other events can raise issues relating to the safety of equipment
and operations throughout the new technology of Carbon Capture and Sequestration (CCS), where
the scale and extent of CO2 handling is set to increase dramatically. Identification of atypical
scenarios related to CCS is therefore a great challenge, considering also the public concern and the
11
controversy that this technology raises (Bradbury et al. 2011, CCJ 2011a, CCJ 2011b, CCJ 2011c, CCJ
2011d, CCJ 2011e, Citizens 2011, EREC 2008).
In this case a HAZID process on CCS surface facilities was performed by means of two different
approaches to the problem: the DyPASI and “top-down” HAZID methodologies (section 2). The
results and techniques themselves were assessed and compared. This provided opportunity to
outline a series of atypical accident scenarios that are characteristic of the technology considered
and suggest a path to follow in CCS HAZID processes by identifying the best conditions in which the
two approaches should be employed.
1.3 Development of suitable indicators
HAZID processes are obviously unable to identify unexpected events that have never occurred and
for which there is no suitable information (“Unknown Unknown” events), even if they were improved
by means of DyPASI. A proactive approach acting on background conditions promoting atypical
scenarios is needed. A possible strategy is the continuous vigilance through the use of indicators,
which can unveil early warnings of major accidents. Three examples of methodologies for the
development of early warning indicators are the Resilience based Early Warning Indicator (REWI)
method by SINTEF (research institute in Norway) (Øien et al. 2010a, Øien et al. 2010b), the Dual
Assurance (DA) method by HSE (Health and Safety Executive in UK) (HSE 2006) and the Emerging Risk
Key Performance Indicator (ER KPI) method developed within the framework of iNTeg-Risk (FriisHansen et al. 2010). These methods were considered for their application in the identification of
early warnings of atypical events in synergy with DyPASI (section 4).
The REWI and the DA methods were applied to a representative case (a Buncefield-like site), in order
to obtain indicators to compare with the actual causes of atypical accidents such as Buncefield and
similar ones. Thus, an assessment was made whether any of the indicator sets could have identified
early warnings enabling the site operators to prevent the accidents from happening. Moreover,
within the framework of the iNTeg-Risk project a system of ER KPI indicators were developed to
manage emerging risks related to the new and alternative technologies of LNG regasification (FriisHansen et al. 2010, Øien et al. 2010b).
An assessment of the possible synergies of the three methods with the DyPASI technique was carried
out to determine whether an integrated approach may be obtained to provide a more extended
ability to “cope with the unexpected” (Woods 2006).
1.4 Organization of the present report
The present thesis was divided in 5 sections:

a general introduction to the problem (section 1);

section 2 is dedicated to the issue of the identification and prevention of atypical accident
scenarios;

an improved HAZID methodology to tackle the problem is proposed and its validation is
described in section 3;

indicator-based methodologies to support the HAZID process are presented in section 4, and

general conclusions are given in section 5.
Annexes I, II and III report all the background activities performed, concerning literature research and
data analysis, on which the present work was based.
An accurate definition of the concept of atypical event is given in section 2, borrowing the idea of
“Known/Unknown” events from the statement of Donald Rumsfeld relating to the absence of
12
evidence linking the government of Iraq with the supply of weapons of mass destruction to terrorist
groups (US DoD 2002). Moreover, management of atypical events is described by a modified version
of the Risk management cycle by M. Merad (Merad 2010).
Section 2 gives also a comprehensive description of two atypical major accidents (Buncefield 2005
(MIIB 2008) and Toulouse 2001 (Dechy and Mouilleau 2004)), which are taken as examples to
illustrate some peculiar characteristics of atypical scenarios. Causes, consequences and occurrence
mechanisms are widely studied by following a systematic approach to atypical accident analysis in
order to isolate general failures of risk assessment, management and governance and thus define
targeted recommendations. The original detailed analysis of the two mentioned atypical major
accidents, together with the analysis of the atypical major accidents occurred at Newark (1983),
Naples (1985) and Saint Herblain (1991), which were performed for the EC project iNTeg-Risk, are
reported in annex I.
The accident analysis in section 2 includes also an assessment of a well known HAZID technique such
as MIMAH (Delvosalle et al. 2004), which was applied to the two cases in order to identify the
accident scenarios occurred. Once demonstrated the inability of the technique to catch atypical
scenarios, an approach for future risk assessment processes is proposed on the basis of lessons
learned from past accidents.
Section 3 describes general features and steps of the new methodology developed on the basis of
the findings from the analysis of atypical accidents: the DyPASI methodology. Issues tackled and its
role in management of emerging risks is explained in order to better comprehend the HAZID process
by means of this new technique on two topical subjects, such as LNG regasification and CCS
technologies.
Thus, in section 3, after a general overview (based on a preliminary survey of the available
technologies present in both the industrial fields, entirely reported in annexes II and III) and a
description of the application process, potential atypical accident scenarios inferred from the
available early warnings collected for the two technologies are shown in the form of bow-tie
diagrams. This demonstrates how to broaden the knowledge concerning the risks related to these
technologies and, at the same time, the effectiveness of the DyPASI methodology in identifying
atypical accident scenarios that otherwise would be not considered by common HAZID techniques.
Moreover, in the second case-study (CCS technologies), DyPASI was compared to an analogous
technique (the “top-down” approach) in order to double check the results obtained and assess the
best conditions in which one or the other method should be employed.
Section 4 addresses the issue of remaining potential accident events, uncovered by DyPASI because
never experienced and about which there are no available early warnings (“Unknown Unknown”
events). An alternative approach aiming to reduce their occurrence probability is proposed by
showing 3 methodologies for the development of early warning indicators: the Resilience Based Early
warning Indicator (REWI) method, developed by SINTEF (Øien et al. 2010a, Øien et al. 2010b), the
Dual Assurance (DA) method, developed by HSE (Health and Safety Executive) (HSE 2006), and the
Emerging Risk Key Performance Indicator (ER KPI) method, developed within the framework of
iNTeg-Risk (Friis-Hansen et al. 2010).
After a brief description of the methods, the indicators developed by the REWI and DA methods for a
Buncefield-like oil depot and the indicators developed by the ER KPI method for LNG regasification
technologies are presented and discussed. In particular, indicators obtained for the oil depot were
compared with the direct and indirect causes identified by the analysis of the Buncefield accident in
order to demonstrate their capability to cover the causes of an atypical accident scenario. Moreover
the complementarity and the dependence of the three techniques were assessed in order to identify
a valid support to DyPASI for the identification and prevention of atypical accident scenarios.
13
Finally section 5 gives general conclusions to this work. An overview of lessons learned and results
are presented, on the basis of which a general approach to the important issue of atypical accident
scenarios is outlined for a more holistic and effective action of prevention.
14
Section 2
Atypical accident scenarios: analysis and lessons learned
15
2.1 Introduction
The recent occurrence in Europe of several major accidents, whose scenario was not considered by
their site safety report, has brought to light the critical issue of atypical accident scenarios. Atypical
accident scenarios are articulated phenomena, whose identification and prevention can be obtained
only after a deep understanding of their direct and underlying causes by means of a holistic approach
of analysis. This is greatly challenging and not only would help to identify this kind of scenario in
HAZID processes, but the rewards would be high in public safety, environmental damage and loss
prevention.
For this reason, the concept of atypical event is defined in detail in this section and the two atypical
accidents occurred at Toulouse in 2001 and Buncefield in 2005 are discussed to illustrate some of the
characteristics of atypical events. Causes, consequences and occurrence mechanisms are studied in
order to identify general failures of risk assessment, management and governance and thus define
targeted recommendations. This in-depth analysis paves the way to an assessment of a well known
HAZID technique such as the bow-tie analysis, through which an attempt is made to identify atypical
scenarios. Also this phase of analysis finally contributes to recommendations that should support
future risk assessment processes on the basis of lessons learned from past accidents.
Thus, in the present section a new methodology for the identification of atypical scenarios is not
suggested, rather a specific approach is introduced, coordinating a more effective use of knowledge
and available information, in order to suggest that the experience learned from past accidents can be
effectively translated into actions of prevention and give rise to general practices of good risk
management.
2.2 Definition and examples of atypical accident scenario
2.2.1 Defining “Atypical” scenarios
An accident scenario can be classified as “atypical” when it can not be captured by standard risk
analysis processes and common HAZard IDentification (HAZID) techniques because of deviations
from normal expectations of unwanted events or worst case reference scenarios. As recent
experience witnesses, atypical scenarios can have a large magnitude and their low probability has
facilitated their possible occurrence to be neglected, inferring that they were outside the model of
possible realistic outcomes (Dechy et al. 2004, MIIB 2008). Moreover, atypical accident scenarios can
be related to new and emerging technologies, which are not still properly identified, and that may
remain unidentified until they take place for the first time.
The inclination to consider events that have occurred more predictably than they were before they
took place is a common social behaviour named “hindsight bias”. This human attitude can be
explained by the fact that an event that has occurred is generally stronger in one’s mind than a
possible outcome that has not (Bradfield and Wells 2005).
Nevertheless the accidents analyzed in this work show that sometimes atypical events are
anticipated by signals or even similar past events, but lessons to be learned are not learned or simply
forgotten (Dechy et al. 2008, ESReDA 2009). Thus, the problem was real and present, but lack of
knowledge management impeded its identification.
This is an example of a “black swan”, which was a metaphor of impossibility in the past, because all
historical records of swans reported that they had white plumage. From Juvenal's Satires: “rara avis
in terris nigroque simillima cycno” (a rare bird in the lands and very like a black swan) (Juvenal,
Satires VI, 165). This belief lasted until a specimen of a black swan was found in Western Australia at
the end of the 17th century and the term became the symbol of disproved impossibility (Taleb 2007).
The example shows that what is unknown does not coincide with what is impossible.
16
On the basis of available information, atypical accidents can be classified in two separate groups,
which are included in Table 1 and marked in red:

events which we are not aware we do not know, because they have never occurred or there
are no records. These events can be defined as “Unknown Unknowns”.

events which we are not aware we know, because they have already occurred in the past
and/or there are records of them. These events can be defined “Unknown Knowns”.
Knowledge
Lack of Knowledge
Awareness
Known Known
Known Unknown
Unawareness
Table 1 “Known/Unknown” table from the statement of Donald Rumsfeld relating to the absence of
evidence linking the government of Iraq with the supply of weapons of mass destruction to terrorist
groups (US DoD 2002)
Unknown Known
Unknown Unknown
Awareness is an important basic learning factor to properly manage the aspect of atypical accidents
and this study aims to act on this factor by means of a better use and interpretation of available
information. An effective knowledge management would make possible the transfer from “Unknown
Known” events to “Known Known” ones (Table 1), i.e. to events that have been studied, analyzed
and completely assimilated into the process of risk appraisal. “Known Known” accident scenarios are
scenarios which have become “typical” and experts are confident to be able to identify and to have
an effect on their level of risk.
Nevertheless, there will always be some potential events that have never been experienced or about
which there is no information or knowledge (limits to conceive and imagine some scenarios). If we
are not aware of this limit, the occurrence of an “Unknown Unknown” event is more probable. In
fact, in order to tackle this kind of events we shift from prevention issues to precaution principles.
Since we can not identify and prevent all the possible scenarios, we should consciously face our limits
of overcoming the feeling of hindsight bias and recognize, and to some extent, define what it is we
do not know. We can make assumptions as to the nature of the risk, which may be open to debate,
and may need to be refined as more information becomes available, but we can make a start in
assessing the risks (Atkinson et al. 2010). Moreover, as Patrick Lagadec affirms in “La gestion des
crises” (Lagadec 1994), we should prepare for crisis management in the case of inevitable occurrence
of accidents. In this way in Table 1 we could shift from the red area of “Unknown Unknown” events
to the yellow area of “Known Unknown” events.
17
No uncertainty
of the event
Precaution
Prevention
Suspected
(known unknown)
risk
Recognized risk
Failure
in
KM
and
Unknown known risk
Reasonable doubt
Exoneration
IM
Compensation
Occurred risk
Case 1
Unknown unknown risk
Total uncertainty
of the event
Historical events
Atypical event
Atypical event risk
Figure 1 Risk management cycle by M. Merad (Merad 2010) modified to describe management of atypical
event risk. Line colours refer to table I. KM = Knowledge Management; IM = Information Management.
A clear description of what has been affirmed can be given by Figure 1. If the level of risk awareness
is excessively low, the risk management will develop with total doubt of an atypical event risk (case 1
line). Moreover, if historical events are not considered the only chance to take into account the
latent risk is the occurrence of an atypical event, which will then lead to a phase of compensation in
risk management. Whereas risk management described by case 2 line is the one analysed by this
contribution. In fact, awareness of potential latent risks together with a proper action of precaution
and prevention, through an effective knowledge management, would allow better tackling the
problem of atypical events without necessarily experiencing it or losing memory of it.
18
2.2.2 The atypical major accidents at Toulouse and Buncefield
In the last decade two major accidents of great relevance for damage extension and casualties
caused have been witnessed in European process industries. The actual scenarios occurred were not
considered as credible scenarios by their respective safety reports. Safety report, Land Use Planning
procedures and emergency response measures basically took into account different and relatively
milder cases. The two accidents at issue occurred at Toulouse on 21st September 2001 and at
Buncefield on 11th December 2005 (Table 2).
Table 2 Atypical accident scenarios occurred at Toulouse and Buncefield (Dechy and Mouilleau 2004,
MIIB 2008). For more details about the accidents see Annex I.
Place
Toulouse
Buncefield
Date
September 21 2001
December 11 2005
Industrial system
Ammonium Nitrate factory
Oil storage depot
Short description
Explosion in a warehouse where
“off-specifications”
Ammonium
Nitrate (AN) was stored.
Overfilling of an unleaded petrol
storage tank leading to a dispersion
of
flammable
vapour
and
subsequent Vapour Cloud Explosion
(VCE).
Worst scenario considered by
safety report
AN storage fire
Large pool-fire
Fatalities
30
None
Injuries
10,000 physical injuries (estimate)
43 minor injuries
st
th
Other plant worst case scenarios
(ammonia, chlorine)
14,000 post-traumatic acute stress
Damages
€1.5 to 2.5 billion
£1 billion
27,000 houses damaged
At Toulouse an explosion took place in a warehouse, located among process, storage and packaging
areas of the plant which mainly produced technical grade ammonium nitrate (AN), ammonium
nitrate-based fertilisers and other chemicals including chlorinated compounds. Due to the vicinity of
the plant to the city of Toulouse, the effects to people and the damage were catastrophic (Dechy and
Mouilleau 2004).
The warehouse was used as a temporary storage of “off-specifications” AN and AN based fertilisers
that would later be recycled in other fertiliser plants. This explosion scenario was neither considered
in the safety studies, nor in the Land Use Planning (LUP) safety perimeters, and neither in the
emergency response plans, which were based on the worst case of an AN fire (Dechy et al. 2004).
The explosion scenario was excluded by the fertiliser industry guideline and the LUP and emergency
response plans relied on toxic release scenarios (ammonia, chlorine) which were considered as the
19
worst case scenarios. In addition, the Seveso II directive did not explicitly address the risk posed by
“off-specification” AN (Dechy et al. 2005). Today this kind of material with inadequately defined
properties is classified in Directive 2003/105/E (Directive, 2003) at a risk level similar to technical
grade AN manufactured for explosive purposes.
An overfilling of unleaded petrol in one of the storage tanks occurred at the Buncefield oil depot
caused a release that led to the formation of a flammable vapour cloud, which dispersed inside the
plant and among the surrounding facilities. As soon as the vapour cloud came into contact with an
ignition source (it is believed to have been in the fire pump house, in the generator cabin or from a
car engine), a VCE (Vapour Cloud Explosion) of unexpected strength was generated. Large parts of
the depot were destroyed, damage to surrounding property, and disruption to local communities
were recorded (MIIB 2008).
The compulsory Seveso II safety reports drawn up for the Buncefield site did not foresee any scenario
of this kind. Formation of a vapour cloud as result of a tank overfilling and a consequent powerful
blast with domino effects was not considered sufficiently probable or reasonably realistic, both by
the industry and the competent authorities, to be taken into account. In fact the worst credible
scenarios for this site were believed to be a major liquid fuel pool fire. A vapour cloud explosion was
only initially considered, but arising from tanker loading operations and not tank storage.
Both the accidents have been considered the result of atypical scenarios, whose actual risk was not
consciously assessed. In fact, risk is defined as the product of “probability and consequence"
according to Kaplan and Garrick (1981), but consequence for Toulouse and both the elements for
Buncefield are proved to have been disregarded, as shown in Table 3.
Table 3 Remarks on the assessment of risk of atypical scenarios for the cases of Buncefield and Toulouse
(Dechy and Mouilleau 2004, Dechy et al. 2004, Dechy et al. 2005, MIIB 2008).
Risk of atypical scenarios
Probability
Consequence
Consequences of VCE were not assessed because
it was not known that:
Toulouse
Buncefield
Probability was assumed low but:
- VCEs caused by a LOC of gasoline occurred on
average every 5 years since mid 60s (Table 7),
-
the tank design could cause a mechanism
improving evaporation
- LOC from fuel storage tanks are relatively
frequent (8 events from 1993 to 2005 and an
estimation of 1 overfilling every 3300 filling
operations).
-
such large open-air flammable clouds could
lead to a VCE instead than to a flash fire.
- Probability for AN not to be in normal
conditions (unpolluted, unconfined) in a
warehouse storage was considered very low
Actual consequences were not assessed because:
Consequence could have been worse but it was
early Sunday morning and commercial properties
in the vicinity were almost empty.
-
it was not considered that off-spec AN could
explode in unconfined storage conditions.
-
was
Seveso II regulation did not consider the risk
raising from off-spec AN. Today, off-spec AN
is considered as sensitive as technical grade.
- Disasters that could have changed the
knowledge base occurred during transportation
with high confinement and pollution.
Consequence could have been worse because
considerable amounts of other hazardous
substances (e.g. ammonia and chlorine) were
stored in the site.
- Quality procedures with non-detonability test
would further reduce the latent risk
- Probability to initiate an explosion
considered low even with fire source
20
2.2.3 Repetition of unheard atypical accidents
The atypical events have the potential to reoccur until they are identified by HAZID processes and
avoided, prevented or mitigated by proper safety measures. For instance, the “Known Unknown”
event of a VCE in an oil depot generated by the ignition of a flammable vapour cloud has
unfortunately occurred again less than 4 years after the accident at Buncefield (Table 4).
Table 4 Comparison between the accident at Buncefield, San Juan Bay and Jaipur (MIIB 2008, CNN
2009, Indian Oil Corporation 2009). For more details about the comparison of the three accidents see
Annex I.
Buncefield
Accident scenario
San Juan bay
Jaipur
VCE and severe multi-tank fires
Substance involved
Gasoline
Loss Of Containment Overfilling. Vaporization
(LOC)
in cascade.
Suspicions of overfilling
and vaporization in
cascade.
Open valve. Upward
spray for tank head
pressure.
Source of ignition
Wastewater treatment
plant
Pump house
Pump house
Two accidents within a few days from each other took place at the Caribbean Petroleum Corporation
of San Juan Bay – Puerto Rico (23rd October 2009) and at M/S Indian Oil Corporation of Jaipur – India
(29th October 2009). In these accidents the entire installations were totally destroyed and buildings in
the immediate neighbourhood were also heavily damaged. Moreover at Jaipur 11 persons were
killed and 45 injured (CNN 2009, Indian Oil Corporation 2009).
Table 4 shows a comparison between the accidents at Buncefield, San Juan Bay and Jaipur,
highlighting the several aspects they have in common. An important correspondence can be found in
the features of the loss of containment (LOC), that in the San Juan Bay accident are believed to be
the same as in the Buncefield accident, where the tank overfilling caused a cascade of droplets at
elevation, promoting the evaporation of lighter compounds of petrol (CNN 2009). A similar
mechanism of evaporation occurred at Jaipur, where a vertical spray of petrol due to head pressure
of the tank flowed from a valve left open (Indian Oil Corporation 2009).
The occurrence of these two accidents is a demonstration that the early warning and not weak signal
of Buncefield disaster remained unheard and no efforts were made to learn and progress by means
of the experience from past events. In addition, as we will see later, Buncefield was not the first
accident of this kind.
2.3 Approach to information management
2.3.1 Systematic approach to atypical accident analysis
In order to obtain general lessons on identification and prevention of atypical accident scenarios, a
detailed study of particular cases has been carried out. The two major accidents previously described
have been analyzed following a systematic approach, which is represented by Figure 2.
21
Level of information processing
General details
Level of information deepening
Past accidents
Application of MIMAH
Identification and
collection of early
warnings
Consequences
Integration of atypical events
in the event trees
Event management and
aftermath actions
Definition of defective and
effective safety barriers in the
event trees
Timeline of events
Classification
according to the
iNTeg-Risk
framework
Causes
Integration of atypical events
and definition of defective
and effective safety barriers
in the fault trees
Suggestion for new safety
barriers
Lessons learnt
Bow-tie analysis
Incident analysis
Figure 2 Representation of the analysis carried out in relation to management of available information
The in-depth analysis, according to a common specific scheme, has produced mutually comparable
results. Moreover, the application of a widely used HAZID methodology such as MIMAH
(Methodology for the Identification of Major Accident Hazards) (Delvosalle et al. 2004), allowing for
the information gathered in the analysis, has brought to light deficiencies and flaws of the
identification process of atypical accident scenarios.
Figure 2 also shows how the methodology aims to reach adequate levels of information deepening,
in order to obtain a global view of the problem and to assimilate, learn and generalize the lessons
obtained.
This approach may be considered as an example to follow in order to find any evidence of atypical
accident scenarios, but also to have a deep, complete and holistic approach to the important process
of hazard identification and more generally to risk assessment.
2.3.2 In-depth analysis of atypical accidents
The process of accident analysis is presented in Figure 2 with light orange rectangles and its parts are
in order of ascending level of information deepening.
Starting from more superficial information concerning the general details concerning event and site,
the analysis goes deeper into the matter and addresses the early warnings occurred prior to the
22
event. The early warnings can be defined as signals showing a potential risk and in this case can be
found in past similar accidents (IRGC 2009).
The atypical scenario is then reconstructed and the various accident phases examined. It should be
noticed that on Figure 2, to comply with the axis, the accident reconstruction is apparently carried
out backward through time, from consequences to causes. However this is due to the need of higher
information deepening in identifying causes and triggering events, which are often guesswork and
can be the subject of legal action (e.g. Toulouse and Buncefield). In addition, causes are also object of
a further analysis because grouped and classified as failures of the iNTeg-Risk framework (iNTeg-Risk
2009) based on the International Risk Governance Council risk governance framework (Renn 2005)
(see Table 5). Basically, the framework is a combination of the different levels of risk management
and the phases of risk governance, and allows a comprehensive approach to the issue.
Finally official lessons and recommendations from the investigations of those accidents are
extremely useful for this kind of study, because they help us in the HAZID process, the safety barrier
identification and other root causes identification with related countermeasures.
The sources of information are mainly the official investigation reports drawn for each accident, the
accident databases to collect early warnings and expert knowledge.
2.3.3 Bow-tie analysis of atypical accidents
The application of MIMAH has allowed us to tackle some of the weakness of HAZID techniques to
capture atypical scenarios. MIMAH is a well-known methodology created for the EC project ARAMIS
(Delvosalle et al. 2004), whose results are bow-tie diagrams referring to different typologies of Loss
of Containment (LOC). The diagrams are obtained from generic fault and event trees obtained on the
basis of equipment and substances considered.
As shown in Figure 1, the bow-tie analysis may be applied at higher level of information processing in
relation to the previous accident analysis. It can be summarized with 3 main steps:

Step 1 consists in the actual construction of the bow-tie diagrams observing the MIMAH
methodology and considering the equipment and the substance involved in the accident. The
general details of the accident previously gathered are the only information needed in the
first step (Figure 2).

Step 2 aims at adding those missing bow-tie branches that refer to actual scenario that
occurred in the accidents considered. This step does not actually follow any methodology,
but it has become necessary because atypical scenarios, by definition, are hard to identify.
This step is split in two in Figure 2, where firstly the integration of atypical events to the
event tree is considered, then the integration of the fault tree is afforded. The necessary
information to fulfil this step comes from the definition of causes, consequences and
timeline of events within the previous analysis.

In step 3 safety barriers are integrated into the diagrams. “Safety barriers can be physical and
engineered systems or human actions based on specific procedures or administrative
controls” (Delvosalle et al. 2004). Their purpose is to avoid, to prevent, to control or to limit
an accident event. For their addition a second ARAMIS methodology, called Methodology for
the Identification of Reference Accident Scenarios (MIRAS) (Delvosalle et al. 2004) was
selected and applied. Moreover a differentiation of safety barriers is carried out to
distinguish effective from defective ones and the introduction of new safety barriers is
considered. In Figure 2 this last step is split in three because there are three different sources
of information in the previous analysis:
o
the section about “event management and aftermath actions” allows the definition
of safety barriers in the event tree;
23
o
the section on “causes and timeline of events” allows the definition of safety
barriers in the fault tree;
o
recommendations allow the outlining of new and more effective safety barriers to
block atypical events and system changes to address root causes.
2.4 Results
Annex I reports the analysis of the atypical accidents at Toulouse and Buncefield and other
Buncefield-like accidents occurred in history before 2005. The study allowed evidencing a wide series
of failures in many aspects of the risk management and governance process. The principal
deficiencies were localized at the basis of the process of risk analysis performed for the two cases
considered, i.e. in the information management and in the hazard identification phase.
2.4.1 Failures in risk management and governance
The detailed analysis of the two atypical accidents considered (Toulouse and Buncefield – Annex I)
has brought to light direct and root causes of atypical accidents, which have been classified using the
iNTeg-Risk framework, developed within the FP7 project iNTeg-Risk (iNTeg-Risk 2009).
24
Table 5 Representative examples of failures of the iNTeg-Risk framework aspects gathered in the analysis
of atypical accidents.
RISK GOVERNANCE
Pre-assessment
Technology,
technical
Risk Appraisal
VCE in oil depots not
deemed a credible
Past VCEs in oil depots event (oil depot
not considered in risk accidents).
assessment processes
Risks of “off-spec” AN
(oil depot accidents).
not fully understood
(Toulouse).
Tolerability,
acceptability,
judgement
VCE presumed to need
exclusively high level of
containment
(Buncefield)
Large variation in worst
case scenarios selection
(ammonia leaks) and
consequences ranges in
the assessment of
comparable AN plants
(Toulouse).
Risk Management
High level alarms on
tank not working
(Buncefield and Naples)
Failure of a pipe rubber
joint not specified for
use with gasoline (St
Herblain).
Explosion risk of AN
without confinement
considered unlikely
No adequate
supervision to ensure
that stipulated
operations were
actually being followed,
nor for ensuring
operators properly
trained (Newark).
Governance,
communication
Ineffective risk
Insufficient
communication
understanding of
between management
process issues by
and workforce
management
(Buncefield, Naples,
(Buncefield, Toulouse)
Newark).
Risk levels considered
under control by
management (St
Herblain, Newark).
Human,
management
Subcontracting of some
activities meant that
experience and risk
awareness was lost
(Toulouse).
Negligence from the
Risk levels considered
workers maybe due to
low amongst personnel
low risk perception
(Newark, Naples)
(Newark, Naples).
AN fertilizers’ latent
explosive risks not
Policies,
adequately considered
regulation
and
in policies and
standardisation
regulation of some
storages (Toulouse).
Frontline staff not
trained to diagnose
potential accidents
(Buncefield)
No Seveso II regulation
of “off-spec” AN.
No requirements for
VCE analysis except in
fixed roof tanks (St
Herblain).
AN explosion not
Deviations from
required for worst case prescribed procedures
scenario (fire)
occurred (Newark,
Naples).
Inadequacy of LUP
processes (Buncefield,
Toulouse and Naples).
Table 5 shows representative failure examples for each aspect of the framework, highlighting that
atypical accident scenarios are a product and a combination of failures from different levels of sociotechnical system (Rasmussen 1997). Thus, any prevention plan, to be efficient and thorough, should
address all the levels of risk management and governance where needed. In fact, an atypical accident
25
scenario is a complex phenomenon constituted by a chain of events and a web of relationships with
human, organisational and societal factors that cannot all be classified as atypical themselves1. Some
of them may be defined as common deficiencies, whose probability is often relatively high. Examples
of this kind of events are the pipe leak occurred at St. Herblain or the “general negligence” (as
reported in the official report) from the workers at Newark and Naples.
2.4.2 Early warnings
The analysis of the past accidents has also demonstrated that for both the accidents of Buncefield
and Toulouse early warnings showing potential atypical hazards were present but were not
considered or recognized Thus, both the events can be classified as “Unknown Knowns”.
Table 6 Major explosions involving ammonium nitrate prior to the Toulouse accident (Marlair and
Kordek 2005)
Location
Date
Comments
Oppau, Germany
21 September 1921
Attempt at loosen (with explosives) a fertilizer
mix (Ammonium sulphate and nitrate). 450
fatalities
Texas City, Texas, USA
16 April 1947
Fire on a cargo ship loaded with 2600 tonnes
of ammonium nitrate. The consequent
explosion killed hundreds of people
Brest, France
28 July 1947
Fire on a cargo ship loaded with 3300 tonnes
of ammonium nitrate and various inflammable
products. The consequent explosion caused 29
deaths
Red Sea, on the Italian cargo
ship Tirrenia
23 January 1954
Fire on a cargo ship loaded with 4000 tonnes
of ammonium nitrate. The ship was abandoned
before the explosion
Table 6 shows that several severe AN explosions occurred 90 to 60 years ago. These accidents are
sadly remembered for the destruction and the fatalities they caused, but with quality driven
standards, regulation frameworks and better anti-caking agents, no remarkable explosions occurred
since the middle of 1950’s (Marlair and Kordek 2005). One should acknowledge that those explosions
occurred in different underlying conditions (in particular with respect to confinement and
contamination) but a general belief built up that such issues were solved and that explosion without
confinement, or without a strong ignition source was hardly possible. In normal operations such
underlying conditions were not expected if preventive measures were in place. Thus, despite the
warnings about the extreme reactivity of AN and its sensitivity to abnormal operating or storage
conditions (that we often meet in accidents), the latent risk was underestimated and due precautions
were not taken to prevent in any circumstances the event of an explosion. In this case, no new
severe accident was understood as a proof that the latent risk was sufficiently under control.
Afterwards, the Toulouse accident (off-specification AN in that case) became a severe reminder. The
latent risk of AN fertiliser explosion is today addressed, and inherently safe content levels of AN in
fertiliser are considered in particular for security reasons (Marlair and Kordek 2005).
1
In-depth analyses of accidents, accidents and crises clearly showed that any event is generated by
direct and/or immediate causes (technical failure and/or ―human error). Nevertheless their
26
occurrence and/or their development are considered
to be induced, facilitated or accelerated by
The fact that early warnings have remained unheard is even more obvious for the accident at
Buncefield. In fact Table 7 shows that VCEs in oil depots occur approximately every 5 years since the
middle of 1960’s. For this reason some of the accidents listed in Table 7 have been studied following
the same scheme previously explained and the results are reported in Annex I. This has allowed us to
find much correspondence of these past accidents with that of Buncefield.
Table 7 Vapour cloud explosions in oil depots caused by LOC of gasoline prior to the Buncefield accident
(MIIB 2008)
Location
Date
LOC
Houston, Texas, USA
April 1962
Leak from a gasoline tank
Baytown, Texas, USA
27 January 1977
Overfilling of a ship with gasoline
Newark, New Jersey, USA
7 January 1983
Overfilling of an unleaded gasoline tank
Naples, Italy
21 December 1985
Overfilling of an unleaded gasoline tank
St Herblain, France
7 October 1991
Leak of gasoline from a transfer line
Jacksonville, Florida, USA
2 January 1993
Overfilling of an unleaded gasoline tank
Laem Chabang, Thailand
2 December 1999
Overfilling of a gasoline tank
2.4.3 Bow-tie diagrams
The important information gathered by the previous analysis was used to compensate the
deficiencies encountered in the application of the HAZID methodology MIMAH, whose results are
shown in Figure 3 and Figure 4.
27
Undesiderable
Event
Necessary and
Sufficient Cause
Avoid
Detect
Prevent
Prevent
VCE
Major
Event
THERMAL
RADIATION
OVERPRESSURE
MISSILES
Detect
Limit
GAS
DISPERSION
Prevent
Obstruction
POOL
FORMATION
Prevent
Ignition
P
INSUFFICIENT
MECHANICAL
PROPERTIES OF
STRUCTURE
Prevent
GAS
DISPERSION
Gas Detection
P
EXCESSIVE
MECHANICAL
STRESS FOR
EXTERNAL CAUSES
Limit
Secondary
Containment
INTERNAL
OVERPRESSURE
Liquid
Detection
P
LIQUID FLOW
FRAGMENTATION
Prevent
Obstruction
LARGE LEAK
Dangerous
Phenomenon
Prevent
Ignition
OR
Tertiary Critical
Event
Gas Detection
LIQUID
OVERFLOWS
THROUGH
VENTS
Secondary
Critical Event
Tank Design
LIQUID RISES
TO FLOATING
ROOF
Critical
Event
Emergency
Procedures
Control
OVERFILLING
Direct
Cause
Overflow Pipe
Prevent
CAPACITY
MISJUDGED
BY OPERATOR
Level Gauges
Emergency
Stop
Training
p
Detailed Direct
Cause
Detect
Prevent
Prevent
FLASH
FIRE
THERMAL
RADIATION
VCE
THERMAL
RADIATION
OVERPRESSURE
MISSILES
POOL
IGNITED
POOL NOT
IGNITED
POOL
DISPERSION
FLASH
FIRE
THERMAL
RADIATION
POOL FIRE
THERMAL
RADIATION
ENVIRONMENTAL
DAMAGE
TOXIC
EFFECTS
ENVIRONMENTAL
DAMAGE
TOXIC
EFFECTS
Safety barrier present at the moment of the incident and acting as expected
Branches describing the incident
Safety barrier present at the moment of the incident but not acting as expected
Branches describing the incident added on the basis of the analysis
Safety barrier suggested and not present at the moment of the incident
Figure 3 Bow-tie diagram referring to a large leak from an oil depot storage tank and considering the accident scenario occurred at Buncefield
28
Undesiderable
Event
Detailed Direct
Cause
Direct
Cause
Control
ABNORMAL
STORAGE
USE OF A
HIGHLY
REACTIVE
SUBSTANCE
Limit Quantities
Detect
OR
Control
Remove
Incompatible
Product
Detect
WRONG
PRODUCT
DELIVERED
Control
Authority
Inspections
Clear Codes &
Labelling
Prevent
Sampling &
Analysis of
Product
Training
Prevent
p
OR
Visual
Inspection
ERROR
ORDERING
PRODUCT
Knowledge of
Substance
Properties
NORMAL
STORAGE
Necessary and
Sufficient Cause
AND
Critical
Event
Dangerous
Phenomenon
Major
Event
EXPLOSION
MISSILES
EJECTION
MISSILES
OVERPRESSURE
GENERATION
OVERPRESSURE
Limit
CONTACT WITH
INCOMPATIBLE
REAGENT
OR
Prevent
DELIVERY
ERROR
WILFUL
DISOBEDIENCE
MALICIOUS
INTERVENTION
HUMAN ERROR
OR
INAPPROPRIATE
LABELLING OF
PRODUCT
INAPPROPRIATE
LABELLING OF
STORAGE PLACE
MANUFACTURING
ERROR
DEFECTIVE
MAINTENANCE
OR CLEANING
OR
INAPPROPRIATE
CHOICE OF
STORAGE PLACE
MATERIAL PRESENT
IN STORAGE PLACE
INCOMPATIBLE WITH
STORED SOLID
OTHER HUMAN
ERROR
FIRE (DOMINO
EFFECT)
ENERGY
SOURCE
Branches describing the incident
Safety barrier present at the moment of the incident but not acting as expected
Branches describing the incident added on the basis of the analysis
Safety barrier suggested and not present at the moment of the incident
Figure 4 Bow-tie diagram referring to an explosion in a warehouse tank and considering the accident scenario occurred at Toulouse
29
Figure 3 shows a bow-tie diagram referred to an AN explosion in a warehouse. It was built on the
basis of the most credible accident scenario reconstructed by experts of the French justice litigation.
Investigations showed that the origin of the explosion was neither a fire nor a first explosion followed
by the main one. Chlorinated compounds for swimming pools were manufactured on the southern
part of the site and may have been brought in the off-spec AN warehouse by error. Thus a
contamination may have caused off-spec AN decomposition and the subsequent explosion (see
Annex I). Since the diagram obtained by the direct application of MIMAH was not able to properly
describe the actual atypical accident occurred, it was integrated and corrected by appropriate
elements (highlighted in Figure 3 by a specific branch). Moreover, the safety measures contained in
safety barriers were introduced on the basis of the official recommendations of investigators and
mainly focus on safety controls and procedures to be performed by personnel.
Figure 4 shows a bow-tie diagram referring to the event of large leak of gasoline in an oil depot. In
this case the overall scenario was not captured by MIMAH. Thus, also in this case, a specific branch
was added to the bow-tie. A noteworthy atypical event considered in the branch is the “liquid flow
fragmentation”, which refers to the promotion mechanism of petrol compounds evaporation given
by a cascade of droplets at elevation after an overfilling (occurred at Buncefield) or an upward spray
from a pipe leak due to tank head pressure (occurred at St Herblain, see Annex I). Finally a good
example of suggested safety barrier is the overflow pipe to apply at the tank top, in order to avoid
that the fuel rises to the roof and spills over (Paltrinieri and Wardman 2010).
2.5 Discussion
2.5.1 Importance of the risk perception issue
The results obtained in this stage of the study identify various specific issues which need to be
tackled to contrast the occurrence of an atypical event. These issues are widely discussed in the
following paragraphs. However a basic failure affecting the whole risk analysis processes considered
has been demonstrated to be located in the general perception of risk connected to atypical accident
scenarios. Perception (of risk) is a fundamental concept for the overall safety culture of an
organization and the term is directly exploited in several definitions of safety culture given by experts
(Cox and Cox 1991, Pidgeon and O'Leary 2000, ACSNI 1993, Hale 2000, Guldenmund 2010), such as
Hale’s one in “Culture’s Confusions” (Hale 2000): a safety culture is defined by the attitudes, beliefs,
and perceptions shared by natural groups as defining norms and values, which determine how they
act and react in relation to risks and risk control systems. Whereas low perception or unawareness of
risk is a concept inherently framed into the definition of atypical scenarios, as expressed by Table 1
and Figure 1, and an action on it would certainly improve the activity of prevention of atypical
scenarios.
2.5.2 Common failures of atypical scenarios
The analysis of the causes of atypical accidents considered, carried out by means of the iNTeg-Risk
framework (Table 5), has brought to light the noticeable complexity of the phenomenon of atypical
accident scenarios. An atypical scenario cannot be described by a linear chain of events, but is a
result of a system deficiency, where various failures concur in its occurrence. An atypical scenario is
also characterized by a relatively low probability of occurrence and an important extent of
consequences. For these reasons this kind of scenarios can be graphically described as an alignment
of planets (Figure 5), which is a rare event considered ominous in antiquity.
30
Failure
of
ATG
Fatigue
of
operator
Lack in
SILs
COMAH
needed
review
AC
T
EN
D
I
C
Figure 5 Representation of the atypical accident scenario occurred at Buncefield. Planets represent
failures of the 4 levels of risk management (planets’ orbits) according to the Emerging Risk Management
Framework (iNTeg-Risk 2009). The green, pink, orange and blue planets represent, in order, the failure of
the Automatic Tank Gauging (ATG), fatigue of operator, lack of Safety Integrity Levels (SILs) and the
need to review the British regulations of Control of Major Accident Hazards (COMAH). Their alignment
represents the rare occurrence of an atypical accident.
In Figure 5 all the failures contributing to the scenario can be represented by planets and the 4
different level of risk management by the orbits where planets revolve. Each orbit in this
representation can have more than a planet, increasing in this way the probability of an alignment.
This model is similar to the James Reason’s Swiss Cheese model (Reason 1990), but the rotation of
planets can give a better description of the partly fortuitous character of the accidental
phenomenon. In fact, more failures can co-exist in a common system without causing any harm, until
one day a fortuitous combination leads to an accident, such as planets in their rotation movement
can align at a certain point.
From the analysis of accidents it can be also inferred that the causal events, which in series lead to an
atypical scenario, cannot be all classified as atypical themselves. Indeed, pure technical or
organizational failures can be identified, such as the failure of pipe rubber joint, or common failures
in the general management of the industrial system, such as no adequate supervision and training to
personnel, or finally a general negligence by workforce, such as that registered at the deposits of
Newark and Naples.
31
POOR SUPERVISION
& CONTROL
NEGLIGENCE
COMMUNITY
KNOWLEDGE
MANAGEMENT
Workforce
RISK
AWARENESS
Senior
management
Contractors
Figure 6 Representation of the pivotal organizational failures identified within the analysis of the
Buncefield accident
Figure 6 gives a graphic representation of the underlying organizational failures identified within the
analysis of the Buncefield accident (Annex I). To better picture a dynamic system such as an
organization, a simplified scheme of the anatomy of an animal cell, which is itself an organism in
constant/dynamic development, was used. The oil depot is represented as the nucleus of the cell,
while the other organelles in the cytoplasm are the surrounding community hinging on it. Inside the
nucleus three main actors of the storage farm are represented as nucleoli: senior management,
contractors and workforce. The cell membrane, representing the risk awareness, and the nuclear
membrane, representing the knowledge management, protect the cell and the nucleus from harmful
external agents, such as poor supervision and control or negligence at work. A lysis of membranes,
that is a lack of protection, would respectively expose senior management and workforce to these
two organizational failures. Both the failures were, in fact, detected within the analysis of the
accident, but it must be specified that the workforce negligence was also a result of the excessive
workload (Annex I). Good communication would allow the actors to share information on the system
and its related risks and, thus, to compensate lacks and strengthen the two membranes (Figure 6).
Communication between senior management and contractors (represented overlapping) should be
effective and constant, because the terminal considered is a joint venture. In fact, participation by
multiple parties in information sharing often amplifies the benefits derived from the information,
especially when the parties face common risks (Phimister et al. 2004).
However, poor communication was registered at different levels of the system between its main
actors. For instance, inappropriate communication between the oil supplier and the oil depot
supervisors undermined their ability to plan and control the management of fuel. For historical
32
reasons some lines of incoming fuel, such as that involved in the accident, were not controlled by the
Buncefield supervisors, which had no access to the Supervisory Control and Data Acquisition (SCADA)
system to tell them, independently of the ATG system, whether the lines were on or off and, if
online, the value of the flow rate (often subject to changes) (HSE 2011a). Needless to say, this lack of
control was unpopular with the supervisors.
A clear example of the organizational issues introduced by Figure 6 is the failure to operate the IHLS
system. This system had been designed, manufactured and supplied by “TAV Engineering Ltd.” and
installed by “Motherwell Control Services 2003 Ltd.”, two of the several contractor companies on the
site. Unfortunately, despite TAV should have been aware its switch was used in high-hazard
installations and therefore was likely to be safety critical, provided an inappropriately designed
system for that purpose (low risk awareness) (HSE 2011a). Furthermore, TAV did not give sufficient
clarity about the key aspects of the IHLS design and use to Motherwell, which misunderstood the
way it worked and did not install it correctly. However, Motherwell was not excused, because its staff
were supposed to be highly experienced in this field and should have obtained all the necessary data
from the manufacturer (lack of communication and poor knowledge management) (HSE 2011a). It
follows that HOSL was not provided with such data and had a false sense of security following a
periodic test, which actually left the system inactive (misleading control) (HSE 2011a).
It is evident that the interaction and organization of contractors played an important role in the
development of background conditions that favoured the accident occurrence. This was also
exacerbated by the increase in throughput of product at the tank farm, which caused a subsequent
increase in the number of tanker drivers and contractors on site. At the time of the accident there
were three operating companies at the oil depot, two of which were joint ventures (as shown in
Annex I), and there were also several subcontractors present. The organizational complexity was also
demonstrated during the trials to determine the accident responsibility. Contracts were found to be
unclear, including unclear responsibility. Eventually, after almost 5 years of trials, five different
contractor companies were charged with offences based on the investigation of the Buncefield
accident (HSE and EA 2011).
In conclusion, finding common flaws among direct and root causes of atypical accidents suggests a
way of contrasting completely unknown events, previously defined as “Unknown Unknown” (Table
1). As soon as a certain awareness of their likelihood is present and precautions are taken, they cease
to be “Unknown Unknown” and shift into the yellow area of “Known Unknown” events (Table 1).
Improving general risk and organisation management would decrease probabilities of a new atypical
event, because it would decrease the number of planets on the orbits of Figure 5 or holes in Reason’s
Swiss Cheese, and thus would lower the probabilities of an alignment.
2.5.3 Enhancement of knowledge management for a more complete risk appraisal
The operational question of determining when knowledge management is inadequate must now be
answered considering the results. A general issue emerged is the need for a better and
comprehensive process of identification of accident scenarios for a risk analysis that considers a
complete series of likely hazards and properly calibrated tolerability levels. The identification of
several past accidents similar to the two ones analyzed further strengthened the idea that a
thorough process of learning from early warnings needs to be introduced or enhanced in risk
assessment methodologies. Indeed, firstly, risk analysts usually collect accidents data through
international and national databases or directly asking for the experience base of the system
operators, which are limited in scope. However, although the number of events gathered is limited,
and their details too (mainly technical causes), the second problem is the low available time spent in
the data collection step for the risk analysis phase. Thirdly, to check if the overview is complete
would require too many resources. Consequently, analysts tend to refer to similar process safety
studies (made by colleagues on similar plants, or the former plant documents that have been on the
shelves for years) and stay within the basic experience.
33
On the contrary organizations that are able to learn from others’ and their own experience, collecting
and analyzing serious events and/or weaker signals (such as near misses) can improve their safety
performance in the long run (Guldenmund 2010). There are some examples of this kind of
organizations in several industrial fields, such as in the aviation, in the nuclear power and rail
industry (Phimister et al. 2004). Search and diffusion of information on early warnings has the
capacity to improve awareness of safety problems. In fact the dissemination of this kind of
information may encourage dialogues about safety in an organization, resulting in greater awareness
of what can go wrong and greater willingness to discuss potential risks and safety hazards by analysts
(Phimister et al. 2004). This can change their risk perception in favour of a risk assessment more
close to reality and then further improve the safety culture of an organization.
In this section the first part of the work, which represents the process of information management,
has been essential to find the right direction to move on and glimpse those aspects considered
atypical with relation to the accidents. Nevertheless it is not always sufficient for an effective action
of prevention, because HAZID methodologies, such as that one used in this study, generally tend to
disregard atypical scenarios. Thus, once an atypical accident scenario is identified by processing the
available information, in general an assimilation of new knowledge into a process of hazard
identification should be performed. This can be obtained only through an effective learning process
requiring to process the available information into the necessary tools for HAZID methodologies and
its outcome can be represented in a risk model such as the bow-tie analysis carried out in this
contribution. Figure 2 shows how the different phases of the work are related and follow a clear
process of elaboration of knowledge, in order to manage “Unknown known” events such as the
atypical accidents studied, and assimilate them as “Known Known” ones.
2.6 Conclusions
The study performed analysing the major atypical accidents of Toulouse (2001) and Buncefield (2005)
has revealed that an atypical accident scenario is an articulated phenomenon, which cannot be fully
explained even after investigations. It is a rather low probable combination of events but it remains
facilitated by a series of factors (technical, human, organisational, societal) that cannot be all defined
as atypical themselves. Thus, a prevention of atypical accidents can be effectively carried out only
through a holistic approach to the risk control issue, addressing different aspects of risk assessment,
management and governance, aiming at avoiding common system and organisation failures.
Moreover, an enhancement of such general aspects is not only a worthy goal to pursue but would
also lay the foundation for a prevention of what have been defined as “Unknown Unknown” events.
In fact, the results obtained have highlighted strong similarities between direct and root causes of
the various accidents considered, and the identification of transversal failures allows a generalization
of the results obtained, leading to the identification of proper methodologies, as described in the
next sections.
The presence of widespread common failures can also be a symptom of deficiency in a more relevant
aspect of the safety culture of an organization such as risk perception. This is especially
demonstrated by the exclusion from safety reports of the actual accident scenarios occurred at
Toulouse and Buncefield. Nevertheless this section identifies that the hazard factors that lead to the
major accidents could have been identified by experts and inspectors if early warnings had been
heard and considered in the HAZID process. Several similar accidents and notions concerning the
specific hazards of the substances handled and the processes operated had been recorded, but an
inadequate learning, monitoring and research has hampered the inclusion of “unexpected” or
“atypical” accident scenarios into the HAZID process. Thus, the two accidents may be defined as
“Unknown Known” events and not as “Unknown Unknowns”. Furthermore, the application of bowtie method has highlighted that a systematic HAZID methodology such as MIMAH could present
generic deficiencies in identifying atypical accident scenarios and may not give complete and
comprehensive results if not supported by adequate expertise and controls. However, an attentive
34
study of early warnings, such as past similar accidents, may lead to include atypical scenarios in the
analysis and get past lessons really learned. This process of knowledge integration can be carried out
by the advanced methodology described in the following section, which demonstrates that a better
knowledge management is possible and highly beneficial for perception and appraisal of risk related
to atypical accident scenarios.
35
36
Section 3
Dynamic Procedure for Atypical Accident Scenarios – DyPASI:
description and application
37
3.1 Introduction
The phenomenon of atypical accident scenarios, whose features were analysed and described in
section 2, is an articulated issue, which needs a holistic approach on various levels. In particular the
risk management cycle by M. Merad (2010) highlights two main aspects to tackle. One is related to
the need of prevention of underlying causes of atypical accident scenarios, in order to lower the
occurrence probability of “Unknown Unknowns”. The other is related to the need of identification of
“Unknown Known” atypical scenarios by learning from early warnings and capturing evidence of new
hazards to consider as soon as they come to light. The latter aspect would allow to have a more
complete and reliable overview of potential accident scenarios from HAZID processes and concerns
also the processes of risk assessment of new and emerging technologies, whose relative lack of
experience can potentially lead to atypical events.
The HAZID process is an important part of risk management, as no action can be made to avoid, or
mitigate, the effects of unidentified hazards. The HAZID process also has a large potential of error
with little or no feedback pertaining to those errors and the accident examples represent severe
feedbacks of errors made. There are a large number of techniques that can be used for HAZID at
various stages during the life cycle of a process. Several extensive reviews on HAZID techniques are
available in the literature (Mannan 2005, Crawley and Tyler 2003, Khan and Abbasi 1998, Glossop et
al. 2005). Although more than 40 proposed HAZID methods are described, none of them seems to
meet the requirements needed for the identification of atypical scenarios.
Furthermore, European Directives already pressed industry towards the development and the
extended use of structured HAZID techniques e.g. as hazard operability analysis (HazOp). In
particular, the “Seveso” Directives (Directives 82/501/EEC, 96/82/EC, and 2003/105/EC (Council
Directive 1982, Council Directive 1996, Directive 2003)) require issuing a comprehensive “safety
report” for all installations falling under the obligations of the Directives. Within the safety report,
the systematic identification and assessment of possible accident scenarios is required (Papadakis
and Amendola 1997). However, despite the measures taken, atypical accidents are still occurring, as
witnessed by the Toulouse and Buncefield accidents.
Thus, a well-established HAZID methodology, such as the bow-tie analysis, was taken here as a basis
to build a new procedure for the identification of Atypical Scenarios (ASs). In particular the bow-tie
methodology in MIMAH (Methodology for the Identification of Major Accident Hazards) was
considered. MIMAH was developed within the European Commission FP5 ARAMIS research project
(Delvosalle et al. 2004), in order to answer a growing concern on the effectiveness of HAZID
techniques.
Since MIMAH showed to be unable to properly capture atypical scenarios (section 2), a specific
method named Dynamic Procedure for Atypical Scenarios Identification (DyPASI), was developed as a
tool complementary to MIMAH aiming at a more complete and comprehensive hazard identification.
The DyPASI methodology was developed also in the framework of the European Commission FP7
iNTeg-Risk project, which addresses the management of emerging risks, identified as one of the
major problems for the competitiveness of industry. The availability of a hazard identification
methodology based on early warnings is a crucial factor in the identification of emerging risks (iNTegRisk 2010, CONPRICI 2010). DyPASI is a method for the systematization of information from early
signals of risk related to past accident events, near misses and inherent studies. This allows the
identification and the assessment of uncommon potential accident scenarios related to the
substances, the equipment and the industrial process considered.
In this section, the DyPASI methodology is presented and applied for a HAZard IDentification (HAZID)
process of new and alternative technologies for LNG regasification and CO2 capture and transport.
The results of DyPASI application are compared with those obtained by the application of other
techniques, such as the MIMAH methodology (Delvosalle et al. 2004) and the Top-down approach
38
(Wilday et al. 2009). This broadens the knowledge concerning the risks related to these technologies,
at the same time, demonstrating the effectiveness of the DyPASI methodology in identifying atypical
accident scenarios that otherwise would not be considered by the other techniques. Furthermore,
the comparison of the methods allows understanding in which conditions a technique is more
suitable than the others.
3.2 Dynamic Procedure for Atypical Accident Scenarios – DyPASI
3.2.1 General features
As previously mentioned, DyPASI was built as a procedure to support the MIMAH HAZID
methodology, developed within the EC ARAMIS project (Delvosalle et al. 2004). MIMAH aims at the
identification of all the potential major accident scenarios which may occur in a process industry.
Bow tie diagrams describing the potential scenarios that may occur in the installation considered are
obtained by MIMAH application. The bow-tie diagrams are created by the development of generic
fault and event trees based on a taxonomy of equipment and on the hazardous properties of
different substance categories. The fault tree (in orange in Figure 7) and the event tree (in green in
Figure 7) are then merged together, in order to share a common element called Critical Event (CE,
Table 8 and Figure 7). The definitions of the other elements in the diagram are reported in table I and
are crucial to build a pattern of the accident scenario that is consistent with the MIMAH bow-tie
diagram.
DDC
DC
NSC
CE
SCE
TCE
DP
ME
CONSEQUENCES
CAUSES
UE
FAULT TREE
EVENT TREE
Figure 7 General scheme of a bow-tie diagram used in the MIMAH procedure. Acronyms of bow-tie
elements are explained in table I
39
Table 8 Definition of bow-tie elements (Delvosalle et al. 2004)
Name
Acronym
Definition
Undesiderable
Event
UE
The UE designates the deepest level of cause in fault
trees. The UE is most of the time a generic event which
concerns the organisation or the human behaviour, which
can always be ultimately considered as a cause of the
critical event.
Detailed
Cause
Direct DDC
Direct Cause
DC
The DDC is either the event that can provoke the DC or,
when the labelling of the DC is too generic, the DDC
provides a precision on the exact nature of the DC.
The DC is the immediate cause of the NSC.
Necessary
and NSC
Sufficient Cause
The Necessary and Sufficient Cause designates the
immediate cause that can provoke a CE.
Critical Event
The CE is the central element of a bow-tie diagram and
represents a typology of loss of containment for fluids or
loss of physical integrity for solids.
CE
Secondary Critical SCE
Event
The SCE is the most direct consequence of the CE (for
example “pool formation”, “jet”, “cloud”, etc.).
Tertiary
Event
The TCE for flammable substances consider the factor of
ignition (for example “pool ignited” or “pool not
ignited”, “gas jet ignited”). For non-flammable
substances can be “gas dispersion”, “dust dispersion”,
etc.
Critical TCE
Dangerous
Phenomenon
DP
13 DPs are defined in MIMAH: Poolfire, Tankfire,
Jetfire, VCE, Flashfire, Toxic cloud, Fire, Missiles
ejection,
Overpressure
generation,
Fireball,
Environmental damage, Dust explosion, Boilover and
resulting poolfire.
Major Event
ME
The MEs are defined as the significant effects from the
identified DPs on targets (human beings, structures,
environment,...).
An atypical accident scenario is a complex phenomenon resulting from a sequence of events that not
necessarily are all uncommon, new or unlikely. In fact, even common failures may trigger unexpected
and severe consequences as a result of a complex chain of events. Thus, in order to fully describe an
atypical accident scenario in the MIMAH bow-tie diagram, each event, from the most likely to the
most unusual, should be added or identified step by step in the bow-tie construction. This gradual
40
process for atypical scenario identification, based on bow-tie development and final integration into
the HAZID process, may be summarized in six main steps (Figure 8), described more fully in the
following paragraphs.
Step 0
Step 1
Step 2
Step 3
Step 4
Step 5
• Pre-analysis
• Substance hazards review
• Integration of atypical scenario CE
• Integration of event tree elements
• Integration of fault tree elements
• Definition of safety barriers
Figure 8 Steps of the DyPASI procedure
41
3.2.2 Pre-analysis
The first step of DyPASI is the most important in terms of identification of atypical scenarios. In this
step the potential scenario is isolated from the information gathered and a representation based on
a cause-consequence chain consistent with the bow-tie diagram is developed (Figure 9a).
a)
b)
Early
warnings
Atypical
accident
scenario
recognition
Material Safety
Data Sheet
Early
warnings
Do the MSDS
risk phrases
describe all
the material
hazards?
NO
Choose additional
representative
MIMAH risk
phrases (if any)
YES
Reduction to
chain of
accidental
events
Built bow-tie diag.
on the basis of
add. risk phrases
Material hazards
already defined
c)
Does AtyS
element
match the
diagram
element?
NO
Does AtyS
element
match any
MIMAH
element?
YES
NO
Addition of AtyS
element to the
diagram
YES
Addition of MIMAH element to the diag.
Build MIMAH diagram around this element
Atypical Scenario element considered in the diagram
Start
Document
Figure 9 Flow-sheets of steps 0 (a), 1 (b) and 2, 3, 4 (c) of the DyPASI procedure. AtyS = Atypical
Scenario.
This step is actually a “Pre-analysis” or “Step 0”, because the above process does not come into
contact with the HAZID methodology supported, but has the function of preparing the ground and
42
providing all the necessary elements to carry out an effective process of assimilation of the atypical
events.
3.2.2.1 Recognition of atypical scenarios from early warnings
From a search of learning opportunities, that on the basis of recommendations in Table 9 is always
advisable to carry out as complementary work or validation of HAZID, early warnings may be
obtained. The search will concern available information on the industrial process considered, the
equipment used and the substances handled. This will aim at an enhanced knowledge about hazards,
probabilities of events and associated human health, environmental and societal consequences. This
will also aim to find signs of potential unrecognised risks in:
-
past accidents and near misses
-
related scientific studies
Risk perception and social concern issues should also be considered while reviewing the available
information.
It will be a task of the user of DyPASI to extrapolate a potential accident scenario from an early
warning and to discard too sensitive data. In particular, false negatives causing a risk to evolve
unnoticed and false positives leading to mistrust should be identified (IRGC 2009). Potential causes,
consequences and occurrence mechanisms need to be studied and defined for a good overview of
the atypical scenario.
3.2.2.2 Cause-consequence chain analysis
Once an atypical scenario to be included into the HAZID process is identified, its reduction to a
pattern consistent to the diagram characteristics should be carried out. The pattern will be a causeconsequence chain, whose elements should respond to the definitions of MIMAH elements shown in
Table 8. There are many well known methodologies for past accident analysis that can be applied in
order to obtain an exhaustive analysis of the case. Some examples of these methodologies are:

the classical model developed by lawyers and insurers which focuses attention on the
“proximate cause” (Houston 1971),

the Fault and Event Tree Analysis models (FTA and ETA) themselves (Mannan 2005),

the “Events and Causal Factors Charting” (ECFC) (US DOE 1999),

the “Systematic Cause Analysis Technique” (SCAT) (CCPS 1992) or

the more complete models (but rather too broad for this specific task) “Sequential Timed
Events Plotting” (STEP) (Hendrick and Benner 1987) and “Root Cause Analysis” (US DOE
1999).
The Fault and Event Tree Analysis models are obviously the most suitable techniques for this task
because allow to obtain results in the proper format and have been preferred in the case-studies
tackled. However also the “proximity case” model and the more systematic ECFC are advisable for
their flexibility and adaptability to various purposes.
3.2.3 Review of hazardous characteristics of substances handled
The main purpose of this step is a review of the hazardous characteristics of the substances involved
in the process analyzed, in order to determine whether all the substance-related potential hazards
have been considered in the bow-tie diagram. In fact, the construction of a MIMAH bow-tie diagram
is based on the specific risk phrases of the substances considered (as defined in the 67/548/EC
Directive (Council Directive 1967) and following updates, including the Globally Harmonized System
43
of Classification and Labelling of Chemicals – GHS (United Nations 2009)) and the addition of a new
risk phrase may trigger the construction of new branches in the diagram (Delvosalle et al. 2004).
Assuming that the MIMAH diagram has already taken into account risk phrases collected within
common Material Safety Data Sheets (MSDS), if new hazardous characteristics are defined on the
basis of early warnings collected and suitable risk phrases can be attributed to the substance (Council
Directive 1967, United Nations 2009), an atypical accident scenario can be integrated in the diagram
by means of the original HAZID methodology (MIMAH). If no new hazardous characteristics are
suggested by early warnings or no risk phrases can describe these characteristics, no credible atypical
scenarios are identified due to substance-related hazards and no modification to the MIMAH bow-tie
diagram is introduced. This step is described by the flow-sheet in Figure 9b.
3.2.4 Integration of atypical scenario elements
The process of integration of an atypical scenario in the MIMAH approach, based on the results of
the “pre-analysis” step is fulfilled in steps 2, 3, and 4 of the DyPASI methodology (Figure 8). The
integration should be carried out gradually and accurately, in order to ensure the DyPASI attributes
of “completeness and conciseness”.
Step 2 deals with the integration of the MIMAH original bow-tie diagram with Critical Events (CE Table 8) mirroring what outlined in step 0. Alternatively, CEs already present in the original bow-tie
diagram may also be selected for integration. This step should be carried out following the procedure
indicated in the flow-chart showed in Figure 9c. The CEs related to atypical scenarios obtained on the
basis of the results of pre-analysis (step 0) should be compared with the other CEs defined by the
original MIMAH bow-tie diagrams.
If a match is present, no further CE is added and steps 3 and 4 will focus respectively on the event
and fault tree branches of the matching CE in order to comply with their respective relations of
continuity.
If no match is present, it should be checked if any CE of the MIMAH methodology can describe the
scenario, in order to integrate the original MIMAH diagram. Again steps 3 and 4 will be applied, and
event and fault tree branches will be developed on the basis of the pre-defined MIMAH general
event and fault trees. General procedures for fault and event tree development may be applied
(Mannan 2005, CCPS 1989).
Step 3 of the procedure aims at the modification of the event tree branches in the bow-tie diagrams
in order to fully describe the potential consequences of the atypical scenario identified in step 0.
Thus, the event tree elements already present in the diagrams and connected to the CEs identified in
step 2 are compared to those defined in step 0. The application of the flow-chart procedure in figure
3c will lead to the integration of new elements. In order to avoid redundancy, these new events
should be added to the diagrams only if strictly necessary for the description of the scenario.
Finally, the modification process of the fault tree branches (step 4) applies to fault trees the
procedure carried out for event trees in the previous step. In both the steps 3 and 4 the relation of
continuity should be complied and the actions indicated in Figure 9c should be applied on contiguous
elements along the respective branches.
3.2.5 Identification of appropriate safety barriers
The identification of safety barriers to apply to the elements of bow-tie diagrams should be then
carried out in step 5 of the DyPASI procedure. The activity may be carried out by a partial application
of MIRAS (Methodology for the Identification of Reference Accident Scenarios outlined in the EC
ARAMIS project) (Delvosalle et al. 2004), which, in turn, is inspired by the LOPA method (CCPS 2001).
Thus, in addition to the safety barriers, the related generic safety functions are also identified, as
44
suggested by MIRAS. The generic safety functions can be expressed by actions to be achieved. Four
main verbs of action are defined:
-
to avoid: safety function acting upstream of the bow-tie diagram event aiming to suppress
the inherent conditions that cause it
-
to prevent: safety function acting upstream of the bow-tie diagram event aiming to reduce its
occurrence
-
to control: safety function acting upstream of the fault tree event in response to a drift which
may lead to the event and safety function acting downstream of the event-tree event aiming
to stop it.
-
to limit: safety function acting downstream of the bow-tie diagram event aiming to mitigate
it.
The safety barriers can be physical and engineered systems or human actions based on specific
procedures, or administrative controls which can directly implement the safety functions described
(Delvosalle et al. 2004).
The object of this step is, thus, to identify safety functions/barriers on the bow-tie diagrams and in
particular on those branches referring to atypical scenarios.
Safety Barrier
Safety Barrier
Safety Barrier
If the atypical scenario took place in past accidents or near misses, a further distinction between
safety barriers may be introduced as shown in Figure 10, provided that sufficient data are available.
SAFETY
FUNCTION
SAFETY
FUNCTION
SAFETY
FUNCTION
Properly
acting
Deficient
Suggested
Figure 10 Symbols representing safety functions/barriers applied to the bow-tie diagram elements
Safety barriers properly acting at the moment of past accidents may be marked in green. Green
colour may also be applied to effective safety barriers in the case of near-misses. Safety barriers that
showed deficiencies in at least one past accident may be marked in orange. New, hopefully more
effective, safety barriers identified may be represented using the red colour.
3.2.6 General issues tackled by DyPASI
The in-depth analysis of atypical major accidents such as the accidents at Toulouse in 2001 and at
Buncefield in 2005 (Section 2 and Annex I) has shown examples of general deficiencies in the risk
governance of these two sites. Such deficiencies were, at least in part, located in the phase of risk
appraisal, since their respective safety reports failed to identify the accident scenarios that actually
occurred. The inadequacy of current HAZID techniques to perform a complete overview of all the
potential accident scenarios related to the industrial processes under consideration is highlighted in
45
Section 2. In a preliminary phase, the common failures of HAZID techniques detected for the cases at
Toulouse and Buncefield led to the definition of recommendations aiming to correct and help the
action of HAZID methodologies. These recommendations, summarized in Table 9, focus the attention
on five main necessary issues crucial to foresee the hazard due to the occurrence of atypical events:
-
broader knowledge management than just knowing how the plant works
-
identification of atypical accident scenarios
-
integration of atypical accident scenarios into HAZID process
-
definition of proper safety measures for the identified scenarios
Table 9 Recommendations for the identification of atypical scenarios in the risk appraisal process defined
in
Recommendations
1
Search of learning opportunities represented by past major accidents, experimental tests
or modelling estimation referring to accident scenarios involving the substances, the
equipment or the industrial process considered, should be performed as complementary
work or confirmation of HAZID.
2
Experts from the above issues should be brought in during risk analysis process.
3
Potential accident scenarios, whose magnitude is relatively high, should be generally
taken into account to outline real worst cases for common safety procedures.
4
Once identified the high-risk accident scenarios not considered in safety procedures
(atypical scenarios), a process of assimilation should be performed.
5
Both present and missing risk reduction measures, aiming to avoid, prevent, control or
limit atypical events of an atypical scenario, should be identified for the case analysed.
However the enhancement of the HAZID process abiding to the recommendations outlined leans on
the experience of the experts involved and may result in high costs in terms of time spent and people
involved. This is confirmed by the detailed description of the exercise of hazard identification carried
out on the Buncefield oil depot and shown in Annex I, where the results obtained from the
application of MIMAH were modified on the basis of the data gathered after the major accident had
occurred. As shown in the previous sections, the DyPASI methodology potentially tackles most of the
above problems. In particular, the knowledge management and the consecutive identification of
atypical accident scenarios from early warnings is covered by step 0 of DyPASI, which also aims to
define a proper cause-consequence chain scheme describing the scenario. This scheme has to be
consistent to the bow-tie diagram structure because its elements are gradually integrated in steps 2,
3 and 4. Thus, these three steps deal with the issue of integration of atypical accident scenarios into
the HAZID process. Finally step 5 fulfils the need of a definition of safety measures for the identified
scenarios and identifies deficient safety barriers in past inherent accidents.
46
3.2.7 Specific attributes of DyPASI
As evident from the above discussion, the specific attributes of DyPASI can be summarized in 3
points: i) systematic nature; ii) enhanced knowledge management; and iii) completeness and
conciseness.
The DyPASI methodology was developed in order to make easier and systematic the inclusion of
atypical scenarios in the HAZID processes. As shown above, the procedure supports the MIMAH bowtie diagram methodology in the identification of atypical accident scenarios (steps 3-5), but can also
give the opportunity to perform a double check of the HAZID process and to reiterate the HAZID
process whenever any evidence of a new and unidentified accident scenario emerges (steps 1-2).
In response to the need of an improved knowledge management expressed by the first
recommendation in Table 9, DyPASI aims at a systematization of information from early warnings in
order to bring to light uncommon potential accident scenarios related to the substances, the
equipment and the industrial process considered. Thus, the specific accident chains are identified
and more general patterns (causes, top-events, final outcomes, role of the mitigation barriers) are
inferred to be consistently integrated into the MIMAH bow-tie diagrams.
Furthermore, completeness and conciseness are both two fundamental characteristics that DyPASI
pursues. In fact, within the bow-tie diagrams each element is linked to the other by a close relation
of causality/consequentiality. An element in a fault tree branch is defined by all the possible causes
that are graphically related and lead to it. An element in an event tree branch is connected to all the
possible consequences it could lead to. Thus, a mere addition of a diagram branch could easily create
harmful repetitions and, for this reason, each element of the chain of events describing the atypical
scenario is integrated by the DyPASI methodology.
3.2.8 DyPASI role in the Emerging Risk Management
The management of risk due to “atypical scenarios” was defined and investigated in detail within the
EC FP7 iNTeg-Risk research project (iNTeg-Risk 2009). Within this project the specific issues posed by
the management of emerging risk have been recognized and a framework for emerging risk
management (ERMF – Emerging Risk Management Framework) was developed (CONPRICI 2010),
based on both the International Risk Governance Council (IRGC) (IRGC 2009) and the ISO 31000 (IOS
2009) risk management approaches. As shown in Table 10, the ERMF includes 10 main steps, divided
in 4 groups (CONPRICI 2010). Figure 11 shows a modified version of the framework that evidences its
interaction with the DyPASI methodology. As shown in Table 10 and Figure 11, ERMF explicitly poses
the issue of capturing early warnings as the first step, followed by the assessment of public concern
and the identification of hazards and emerging risks. The DyPASI methodology stands within these
first steps since it was built to infer atypical accident scenarios from early warnings and integrate
them into the HAZID process without disregarding possible public concern. DyPASI represents a tool
to metabolise information considered outside of the common consensus and, thus, is graphically
conveyed as an input in a risk management process (and in particular to the steps 1, 2, and 3) closed
on itself and self-sustained in a cyclic movement, as shown in Figure 11. Moreover ERMF step 10
(Monitoring, Review and Continuous Improvement) represents a “continuous activity” of risk
management improvement, to which DyPASI is tightly related. In fact, its ability to be reiterated and
to easily update and integrate the HAZID process makes it an effective tool contributing to the
practical implementation of this phase.
47
2. CONTEXT &
CONCERNS
1. Early
Warnings NOTION
3. SCENARIOS &
ER Identification
4. PREASSESSMENT
5. ANALYSIS
(APPRAISAL /
ASSESSMENT)
8.
MANAGEMENT
& DECISION
(TREATMENT)
7. EVALUATION /
TOLERABILITY &
ACCEPTABILITY
6.
CHARACTERIZATION
Figure 11 Relations among the iNTeg-Risk Emerging Risk Management Framework (CONPRICI 2010)
and the DyPASI methodology
48
Table 10 Main steps of the ERMF procedure (CONPRICI 2010)
No.
Group
1
Horizon screening
2
3
Step
Early warnings - NOTIONS
CONTEXT establishment and CONCERN assessment
Pre-Assessment
Identification of emerging risk SCENARIOS
4
PRE-ASSESSMENT of selected risks scenarios (screening)
5
Emerging Risk APPRAISAL / ASSESSMENT
6
Emerging Risk CHARACTERIZATION, Risk categorization /
classification
Appraisal /
Assessment
7
Emerging risk
assessment
8
MANAGEMENT & DECISION
9
Emerging risk COMMUNICATION
Continuous activities
10
TOLERABILITY
&
ACCEPTABILITY
Emerging risk MONITORING, REVIEW & CONTINUOUS
IMPROVEMENT
DyPASI is structured to create an opening in the risk management cycle, to capture early warnings
and new scenarios and to assimilate them into the first steps of ERMF. Nevertheless, even if not
directly involved, the last phases of ERMF are still affected by the application of the methodology. In
fact, the severity assessment of atypical scenarios, newly considered on the basis of past major
events, but deemed as scarcely credible, should be carried out in step 7 (Table 10) following
recommendation 3 in Table 9. Furthermore, as previously stated, one of the aims of DyPASI is to
outline proper and effective safety measures for the atypical accident scenarios in order to translate
the recommendation 5 of Table 9, concerning safety barrier implementation, into a methodical
procedure during the development of step 8 (Table 10).
3.3 Case-Study 1: application of DyPASI to LNG regasification technologies
The HAZID process concerning the main lay-outs of LNG regasification terminals described in Table
11 was first performed applying the MIMAH methodology (Delvosalle et al. 2004), which is
considered representative of the current state-of-the-art HAZID techniques. The DyPASI procedure
was then applied as a complementary process to identify atypical accident scenarios not captured by
the standard MIMAH methodology. However, before any analysis, a preliminary survey of equipment
and technologies was carried out and can be found in Annex II.
49
3.3.1 Overview of the LNG chain
Liquefied natural gas (LNG) is expected to play an increasingly important role in the natural gas
industry and global energy markets in the next several years. In fact, worldwide, total consumption
of natural gas is predicted to rise by an average of 1.3 percent per year, from 3.2 trillion cubic meters
in 2010 to 4.4 trillion cubic meters in 2035 (IEO 2010). In 2008 the natural gas dependency rate of the
European Union, which shows the extent to which EU relies upon imports in order to meet its energy
needs (net imports divided by the sum of gross inland consumption and bunkers), was more than
60% and it had grown on average 1.7 percentage points in the previous 10 years (EUROSTAT 2011).
Nevertheless almost three-quarters of the world’s natural gas reserves are located in the Middle East
and in Eurasia. Russia, Iran, and Qatar together accounted for about 57 percent of the world’s
natural gas reserves (IEO 2010).
The LNG technology allows the transportation of large amounts of natural gas for long distances, in
areas where pipeline transport of non-liquefied is generally not feasible. Worldwide, there are 60
existing import, or regasification, marine terminals spread across 18 different countries (Jensen
Associates 2007). Both on- and off-shore technologies are adopted. In addition to these existing
terminals, there are approximately 180 regasification terminal projects (Jensen Associates 2007) that
have been either proposed or are under construction all around the world. The dramatic
development of LNG transport chain has induced the development of new technologies, mainly
related to advanced floating and off-shore LNG terminals (Uguccioni 2010). Due to the growing
likelihood of population exposure to the risk and to the change in public perception, risk caused by
LNG terminals may be considered an emerging risk applying the OSHA definition (EU-OSHA 2005).
Due to innovations in transport vessels and regasification units, previously unidentified accident
scenarios may be possible in LNG regasification terminals. Thus, ongoing in-depth assessments of
potential hazards are needed to assess the actual risk posed by such installations.
50
3.3.2 LNG regasification terminals
a)
LNG
EXPLORATION &
PRODUCTION
LNG
TRANSPORTATION
LIQUEFACTION
PROCESS
NG
UNLOADING
LNG
STORAGE
REGASIFICATION
PROCESS
BOIL-OFF
HANDLING
&
RECOVERY
b)
LNG
STORAGE
LNG
VAPORIZATION
&
COMPRESSION
NG
QUALITY
&
QUANTITY
MEASURES
NG
Figure 12 a) scheme of LNG chain; b) scheme of LNG regasification process
The liquefied natural gas supply chain may be divided in 5 main steps, as shown in Figure 12. These
are:
1. Production
2. Liquefaction
3. Transportation
4. Storage
5. Regasification
The last 2 phases of the LNG chain take place in regasification terminals, which are usually the final
destination of LNG carriers (Figure 12). The basic features of the regasification process are essentially
the same, independently of the specific technologies and lay-out adopted. As shown in Figure 12, at
the regasification terminal LNG is offloaded from the carrier and transferred to storage tanks. In
some configurations (e.g. in Transport and Regasification Vessels (TRV) terminals) the storage is not
present and LNG is vaporised onboard and offloaded as compressed natural gas by a sealine. In the
other cases, LNG is transferred via the unloading arms from the moored carrier to the LNG storage
tanks by cryogenic pipelines. Cool-down of the unloading arms is started by introducing a small LNG
flow. The pressure in the LNG carrier during unloading is maintained through a system that allows
vapour to flow back from the storage tanks to the carrier.
51
In the vaporization stage, LNG is compressed to the desired final delivery pressure and vaporized by
dedicated heat exchangers (i.e. vaporizers). Alternative configurations use different heat sources (hot
combustion gases, seawater, ambient air, waste heat, etc.) and different heating media (propane,
water, water/glycol mixtures, air, etc.).
In the correction and measurement sections of the process, the quality of the gas is brought to the
specification of the national grid. The correction usually consists in introducing dosed quantities of air
or nitrogen-enriched air in the natural gas. In this section, the quantity of gas delivered to the
national grid is also measured. This operation is usually located on-shore, but installation in floating
units is technically feasible.
3.3.3 Alternative lay-outs of LNG regasification terminals
Nowadays LNG regasification terminals may be grouped in 4 main categories (Table 11), which
basically mirror the available regasification terminal lay-outs:
-
On-shore
-
Off-shore gravity based structure (GBS)
-
Off-shore floating storage and regasification unit (FSRU)
-
Off-shore transport and regasification vessel (TRV)
The current trend toward the application of offshore layouts is justified by some advantages. Offshore installations keep considerable safety distances between the process and the populated areas,
positively contributing to cope the aversion of the population to regasification and storage terminals.
The use of deepwater ports easies mooring operation, generally allowing for larger class carriers.
Moreover, some offshore layouts (e.g. TRV) are better suitable to meet peak demands of natural gas
on the national grid.
52
Table 11 Description of LNG regasification terminal lay-outs (Uguccioni 2010)
Lay-out
On-shore
State
of
Operative
technology
Off-shore GBS
Off-shore FSRU
Off-shore TRV
In-construction
Planned
Operative
/
Potentiality
(Nm3/year)
3*109 - 20*109
8*109 - 14*109
4*109 – 5*109
(affected
journeys
by
18*106 Nm3/day)
Storage
capability
(m3)
100,000 - 800,000
250,000 - 330,000
Rovigo
terminal
Panigaglia terminal (Italy)
Examples of (Italy)
Port
Pelican
real terminals Sabine
Pass terminal (Lousiana
or projects
terminal (Lousiana – USA)
– USA)
Baja
California
(Mexico)
Description
Plant build near
sea, which consists
of a docking area,
provided with a
jetty
and
loading/unloading
arms and a BOG
handling
and
recovery section.
Designed around a
large
concrete
structure, housing
two modular selfsupporting
prismatic storage
tanks, specifically
designed for this
lay-out typology.
125,000 - 170,000
138,000 - 150,900
Planned
FSRU
terminal in Livorno Excelerate Energy
fleet, examples:
(Italy)
Planned
of Vessel “Excelsior”
“Tritone-Offshore
Vessel “Explorer”
Marche” (Italy)
This
kind
of
terminal
is
obtained
from
converting a LNG
carrier
into
a
floating platform
permanently
moored in a sideby-side
configuration.
Lay-out typology
similar to the FSRU
terminal. However
it
is
not
permanently
moored
but
maintains
its
function of LNG
transport.
3.3.4 Representative case selected
For each lay-out the main categories of equipment have been analysed (e.g. storage tanks,
compressors, pumps, columns, exchangers and pipework). Moreover for each category of equipment
several types of Loss Of Containment events (LOCs) were identified (e.g. breach of shell in vapour
and liquid phase, leak from gas and liquid pipe, catastrophic rupture and vessel collapse).
The activity resulted in the creation of more than 120 specific bow-tie diagrams. The results obtained
are presented in detail elsewhere (Uguccioni 2010). Only a representative case is here shown,
concerning the Moss-sphere storage tanks of a FSRU. This example actually is sufficiently
representative to allow the discussion of all the more important atypical accident scenarios identified
in LNG handling at regasification terminals and well explains the process of bow-tie integration by
DyPASI application.
53
3.3.5 Results from the application of the MIMAH methodology
The HAZID analysis performed through MIMAH gave an overview of the main hazards related to the
type of equipment considered. Both equipment category and the hazards related to material
flammability were easily captured by the method. The main critical events identified are reported in
the first column of Table 13. Bow-tie diagrams were obtained for each critical event, also considering
different release intensities (e.g. large breach, medium breach, etc.). As an example, the black lines in
Figure 13 outline the main structure of the bow-tie obtained in the case of a large breach on the
vessel shell in the liquid phase.
54
Undesiderable
Event
Detailed Direct
Cause
Direct Cause
Necessary and
Sufficient
Cause
Critical Event
Terrorist attack
Malicious
intervention
External
impact
Excessive
external stress
Large breach
of shell
Secondary
Critical Event
Tertiary
Critical Event
Dangerous
Phenomenon
Pool formation
Pool ignited
Pool fire
Thermal
radiation
Gas dispersion
VCE
Thermal
radiation
Overloading
Low
temp.
Low temp.
design
Leak of cryog.
liquid (domino)
Brittle
structure - and
Brittle rupture
Major Event
Overpressure
Avoid
Embrittlement
Hammering
Missiles
Impact
Thermal
radiation
Flash-fire
Insuf. mech.
prop.
Control
Limit
Rapid heat
exchange
RPT
Release of
cryog. liq.
Release of
cryog. liq.
Limit
Terrorist Attack
Cryogenic burns
Cryogenic damages
Rapid Phase Transition
Asphyx.
Overpressure
Protective
clothing
Containment
system
Release of
cryog. liq.
Ventilation
High conc.
of gas
Detect gas
dispersion
Internal
overpressure
Cryogenic
burns
Prevent
Asphyxiation
Figure 13 Bow-tie diagram concerning a large breach of shell in the liquid phase of LNG tank with safety barriers. Several fault tree branches have been omitted
and they are represented by dotted lines.
55
3.3.6 Results from the application of DyPASI
In this section the results obtained by the application of the 6 steps of DyPASI to the HAZID analysis
of the FSRU storage tanks are reported and explained in detail, in order to describe the systematic
integration process of atypical accident scenarios in the set of results obtained from MIMAH
methodology.
3.3.6.1 Step 0: pre-analysis
This first step addresses the problem of identifying potential atypical accident scenarios and
translating them in a cause-consequence chain of events suitable for the integration into a bow-tie
diagram. Figure 14 shows the cause-consequence chains defined for each atypical scenario
identified. Each element in the chain is defined consistently with bow-tie categories of the MIMAH
method.
MIMAH bowtie elements
Rapid Phase
Transition
Terrorist
Attack
Cryogenic
burns
Cryogenic
damages
Asphyxiation
Major Event
(ME)
Overpressure
Cryogenic
burns
Asphyxiation
Dangerous
Phenomenon
(DP)
Rapid Phase
Transition
Release of
cryogenic
liquid
High
concentration
of gas
Rapid heat
exchange (e.g.
Water
contact)
Release of
cryogenic
liquid
Gas
dispersion
Pool
formation
Release of
cryogenic
liquid
Pool
formation or
gas jet
Tertiary Critical
Event (TCE)
Secondary
Critical Event
(SCE)
Critical Event
(CE)
Necessary and
Sufficient
Cause (NSC)
Direct Cause
(DC)
Detailed Direct
Cause (DDC)
Undesirable
Event (UE)
LNG leak
Large breach
or catastr.
rupture
LNG leak
Breach of
shell or
catastrophic
rupture
Excessive
mechanical
stress
Brittle rupture
External
impact
Brittle
structure and
impact
Malicious
intervention
Low
temperature
Terrorist
attack
Leak of cryog.
liquid
(domino eff.)
NG/LNG leak
Figure 14 Cause-consequence chains describing the atypical accident scenarios identified. Chain elements
relate to MIMAH bow-tie diagram elements.
56
The identification of atypical accident scenarios was the result of a detailed search of early warnings
available for the substances handled, the equipment used or the industrial process considered in the
specific case. Early warnings are represented by past accidents or near misses, scientific studies or
growing social concern.
In the following the potential atypical accident events identified are described in detail.
Rapid Phase Transition
A rapid phase transition (RPT) is a phenomenon occurring when the temperature difference between
a hot liquid and a cold liquid is sufficiently large to drive the cold liquid rapidly to its superheat limit,
resulting in spontaneous and explosive boiling of the cold liquid (Reid 1983). If a cryogenic liquid such
as LNG is suddenly heated due to the contact with a warm liquid, as water, explosive boiling of the
LNG may occur, resulting in the generation of a localized overpressure and of a blast wave (SNL
2004). On a FSRU terminal this event could be the effect of a spill of LNG coming into contact with
seawater. Similar effects may affect berths in onshore installations.
Evidence of the possibility of this accident scenario is reported in specific studies, reporting a
theoretical analysis of the phenomenon (SNL 2004, Bubbico and Salzano 2009). RPT is also
mentioned in European standards, such as the standard EN1160 “Installations and equipment for
liquefied natural gas - General characteristics of liquefied natural gas” (CEN 1996), which gives
guidance on the characteristics and hazards of LNG. Moreover, past accident data analysis evidenced
that at least five RPT events were experienced from mid 1960 to mid 1990 (CH·IV International 2006,
US EPA 2007). As shown in Table 12, no fatalities were experienced in such events, but only damage
to the equipment. All these data represent early warnings concerning the possibility of RPT as an
“atypical” or specific accident scenario that may affect LNG regasification terminals. The analysis of
the early warnings collected allowed reducing the scenario to the generic pattern showed in Figure
14. All the elements obtained belong to the right-hand part of the diagram (the event tree), since RPT
may take place only after a loss of containment. The left-hand part of the diagram (the fault tree)
thus is not affected.
Table 12 Past events of RPT (early warnings) (CH·IV International 2006, US EPA 2007)
Date
Country
Location
Operation
1965
UK
LNG
Terminal
Import Storage
Accidental leak
1973
UK
LNG
Terminal
Import Unloading
Accidental leak
1977
Algeria
LNG
facility
export Storage
Accidental leak
1993
Indonesia
LNG
facility
export Piping
Accidental leak
57
LOC scenario
Boling Liquid Expanding Vapour Explosion
A BLEVE may occur if a vessel containing a pressurized liquid above its boiling point undergoes a
nearly instantaneous failure, releasing its content explosively (CCPS 1994, Reid 1979, Abbasi and
Abbasi 2008). LNG is cryogenically liquefied and is generally stored at a temperature of -160 C and
at a pressure slightly above atmospheric. However, the spherical tanks of a floating regasification
unit considered here are self-supporting and can withstand a significant internal pressure, possibly
3–4 bar if the aluminium shell in the unwetted portion is not weakened by external causes, such as a
fire. Thus, if process and emergency venting fail, the internal pressure and temperature of an LNG
tank may rise to values high enough to cause a BLEVE in the case of a near instantaneous failure of
the containment, as demonstrated by R. Pitblado (2007). A BLEVE of LNG is recorded in the
literature. On June 22nd, 2002, near Tivissa (Catalonia, Spain), an LNG road tanker rolled over onto its
side and flames appeared immediately between the driver cab and the trailer tank. The BLEVE took
place 20 min after the start of the fire (Planas-Cuchi et al. 2004).
The MIMAH technique identifies the possibility of a BLEVE for LNG as a consequence of a domino
effect (CCPS 2000, Lees 1996). Domino effects are not explicitly conveyed on the bow-tie diagrams,
but escalation resulting from a dangerous phenomenon may be captured in a second bow-tie. For
example, a pool fire (a dangerous phenomenon) may be the cause of the catastrophic rupture
(BLEVE) of a pressure vessel.
Hence, on the basis of the early warning collected, a double check to assess if BLEVE hazard is
identified and properly described on the bow-tie diagrams obtained has been performed in step 0 of
the procedure.
Terrorist attack
LNG facilities, shipyards, vessels (including conventional LNG carriers and FSRUs), pipelines and gas
fields could be targets of piracy or future terrorist attacks. After the terrorist acts in the United States
on 11th September 2001, the growing concern on this issue can not be left unheard and represents an
early warning with respect to related potential accident scenarios. In recent years several studies on
risks connected to LNG took into account these scenarios (FAS 2007, Husick and Gale 2005, US GAO
2007): e.g. see the Guidance on Risk Analysis and Safety Implications of a Large Liquefied Natural Gas
(LNG) Spill Over Water (SNL 2004).
A terrorist attack may be bombing, the use of explosives or, in the case of FSRU, a collision with
another ship (Beal 2007, SNL 2004). Such actions would easily be the cause of a large breach or even
of a catastrophic rupture of target equipment items. A fault tree branch has been outlined in Figure
14 in order to take into account these events. The event tree branch has been intentionally omitted
from the figure since consequences present common elements already associated to large-scale
releases in MIMAH.
Cryogenic burns, cryogenic damage and asphyxiation
Further hazards identified in the pre-assessment step for LNG and not always taken into account by
HAZID techniques result from the specific properties of LNG: cryogenic temperature and high density
of vapours in the immediate surroundings of the release point (due to low temperature).
Cryogenic burns caused by spills are reported in past accidents concerning LNG. An example occurred
in 1977 at Arzew, Algeria, where an accidental leak of LNG caused extended cryogenic burns to an
operator (Woodward and Pitbaldo 2010).
Cryogenic damage is usually considered in LNG hazard identification, although is not specifically
addressed by general-purpose techniques as MIMAH. A Sandia report on LNG risk analysis and safety
implications extensively addresses the issue (SNL 2004).
58
Figure 14 shows the specific chain of events developed to capture hazards related to cryogenic burns
and to cryogenic damage in bow-tie analysis. In the case of cryogenic burns the fault tree branch is
omitted since the conventional cut-sets may well describe all the possible causes. In the case of
cryogenic damage, for similar reasons, the event tree branch is omitted.
It is well known that immediately after the release of LNG, a dense vapour cloud forms around the
area of the spill close to the ground. Among the hazards due to the formation of this dense cold
vapour cloud is asphyxiation. Asphyxiation due to LNG leaks is extensively treated in specific
assessments of LNG hazards (SNL 2004). Figure 14 shows the chains of event describing the accident
scenario leading to asphyxiation. Repetition of elements is necessary to obtain a chain of events
consistent to MIMAH bow-tie diagrams.
3.3.6.2 Step 1: review of hazardous properties of substances
In this step the hazardous properties identified for LNG that generally are not considered by Material
Safety Data Sheets (MSDS) and consequently are not included in general bow-tie analysis were
identified.
If generic MSDSs of natural gas are considered (Eni 2004, Shell 2011), it is evident that the specific
hazards due to cryogenic temperatures at which LNG is stored and its tendency to form a dense cold
vapour cloud after a release are not considered. This should be expected, since these hazards are not
related to the inherent properties of the substance but are arising from the specific process
conditions used in LNG regasification terminals. Nevertheless, as shown above, these characteristics
may lead critical events (CEs) resulting in cryogenic burns, damage and asphyxiation. These scenarios
need to be considered during the construction of bow-tie diagrams.
However, the creation of new diagram branches through the MIMAH methodology is not possible for
these hazards, since the procedure is based on the material risk categories and sentences defined by
the 67/548/EC Directive (Council 1967) and following updates (United Nations 2009). Thus, only the
following steps of DyPASI will allow the integration of these process-specific “atypical” accident
scenarios into the HAZID process of LNG regasification technologies.
3.3.6.3 Step 2: definition of critical events related to atypical scenarios
In order to obtain a complete but concise outcome, the CEs of the atypical scenarios defined in step 0
have been compared to the existing CEs in the MIMAH bow-tie diagrams, by the procedure
previously discussed. In this case, all the step-0 CEs can be related to already existing CEs and no new
CEs should be introduced in bow-tie diagrams to describe the “atypical” scenarios identified. Table
13 summarizes all the correlations.
59
Table 13 Correlations between the critical events of atypical scenarios and the critical events of bow-tie
diagrams
Critical events of atypical scenarios
Terrorist
attack
Critical events of RPT
bow-tie
diagrams
LNG leak
Large breach of
shell (liquid)
X
Medium breach
of shell (liquid)
X
Cryogenic
burns
Large breach,
catastrophic LNG leak
rupture
X
X
Small breach of
shell (liquid)
Large breach of
shell (gas)
Cryogenic
damages
Asphyxiation
LNG leak
Breach,
catastrophic
rupture
X
X
X
X
X
X
X
X
X
Medium breach
of shell (gas)
X
Small breach of
shell (gas)
X
Catastrophic
rupture
X
X
X
X
X
The RPT critical event has been associated to large and medium LNG leaks (large and medium breach
of shell – liquid) and to catastrophic rupture. Small LNG leaks were not considered as credible CEs
leading to RPT.
Since bombing or intentional collision with another ship could easily result in large damage to the
equipment, the critical event related to terrorist attack has been associated to large breach (liquid
and gas phase) and catastrophic rupture. The CE connected to cryogenic burns has been associated
to CEs involving a liquid phase, i.e. large, medium and small breaches of shell and catastrophic
rupture. Assuming the use of special materials, the CE related to cryogenic damage (resulting from a
domino effect) has been associated only to large releases, thus to large breach of shell (liquid and gas
phase) and catastrophic rupture. Finally, asphyxiation was related to all the critical events identified
in MIMAH bow-tie diagrams.
3.3.6.4 Step 3: integration of event tree elements
Figure 14 shows the event tree branches developed to integrate into the existing bow-tie diagrams.
The elements already present in the diagrams and connected to the CEs identified in step 2 of DyPASI
60
have been compared to those identified in step 0. In order to avoid redundancy, new events have
been added to the diagrams only if strictly necessary for the scenario description.
Figure 13 shows the event tree branches integrated into the bow-tie diagram of a large shell breach
of a FSRU LNG storage tank. The atypical scenario elements integrated into the diagram are
highlighted with the same colours of Figure 14. Where possible, the elements already present in the
diagram have been exploited to describe “atypical” accident scenarios. For instance, to properly
define the atypical accident scenario leading to asphyxiation, only the new elements of “high
concentration of gas” and “asphyxiation” have been added to the diagram.
3.3.6.5 Step 4: integration of fault tree elements
Figure 14 also shows the cut-sets introduced into the existing bow-tie diagrams in order to consider
the accident scenarios dealing with terrorist attack and cryogenic damage. Again the elements
already present in the diagrams and connected to the CEs identified in step 2 of DyPASI have been
integrated with those defined in step 0 (Figure 13) in order to avoid repetition of events in the
diagrams.
3.3.6.6 Step 5: safety barriers
The aim of this step is mainly to identify the appropriate safety barriers on the additional bow-tie
branches developed in the previous steps and referring to atypical scenarios. The study performed in
step 0 of DyPASI allowed the identification of specific safety measures for the “atypical” or specific
events included within the HAZID analysis (e.g. those proposed by the Sandia report (SNL 2004)).
The safety measures identified have been translated into graphic barriers that were positioned on
the diagrams. According to barrier classification in the ARAMIS project (Delvosalle et al. 2004), safety
barriers were classified as actions to avoid, prevent, control or limit their reference event. Examples
of safety barriers are shown in Figure 13. These are possible suggestions performed according to
DyPASI and there is not a direct connection to previous accident events where these barriers where
present. In fact these barriers are related to the risk control measures identified through the preanalysis performed in step 0 and come from the same source of information of the early warnings
collected. This is a confirmation that step 0 has an indubitable importance and that a correct a
detailed knowledge and information management is fundamental for the process of risk analysis. A
more complete list of the identified safety barriers for the new diagram branches is reported in Table
14.
61
Terrorist attack
Table 14 Complete list of the identified safety barriers for the new diagram branches integrated through
DyPASI
Hazardous Event
Diagram element
Position
Safety
function
Safety Barrier
Terrorist attack
Undesirable Event
Upstream
To
prevent
Surveillance
Malicious
intervention
Detailed
Cause
Upstream
To
prevent
Security zones
Upstream
To
prevent
Control of ship
Downstream
To limit
Absorbing barriers
Upstream
To avoid
Plant design (distances
between equipment)
Upstream
To
prevent
Upstream
To
control
Downstream
To limit
Upstream
To
prevent
Inspection
External impact
Direct
Direct Cause
liquid
effect)
(domino
Undesirable Event
Detailed
Cause
Brittle structure
Direct Cause
Upstream
To avoid
Low temperature design
Impact
Direct Cause
Downstream
To limit
Protect the structure
Upstream
To
prevent
of
Secondary
Event
Cryogenic burns
Major Event
RPT
Release
cryogenic liquid
Rapid
exchange
Tertiary
Event
High concentration
of gas
heat
Dangerous
Phenomenon
Direct
General leak prevention,
control
and
limit
measures
Low temperature
Asphyx.
Cryog. burns
Cryogenic damages
Leak of cryogenic
Critical
Critical
General leak prevention,
control
and
limit
measures
(e.g.
containment system)
Downstream
To
control
Downstream
To limit
Upstream
To
prevent
Protective clothing
Upstream
To
prevent
Containment system to
prevent water contact
Downstream
To
control
Detection
dispersion
Upstream
To Limit
Ventilation
62
of
gas
3.3.7 Discussion of results
The HAZID analysis performed for the FSRU lay-out produced a wide set of bow-tie diagrams
describing the possible hazards connected to them. In fact, 7 diagrams have been built for the 7
different CEs mentioned in Table 14.
The early warnings gathered in step 0 have been effectively and systematically translated into
generic patterns and were consistently assimilated into the existing bow-tie diagrams obtained by
MIMAH. A main outcome of the DyPASI methodology is actually the inclusion of early warnings and
risk notions in the conventional hazard identification by a systematic procedure, in particular when
related to substance hazards. Figure 15 shows the number of hazardous events (divided on the basis
of the bow-tie diagram elements) identified by means of MIMAH and of DyPASI methodologies in the
FSRU terminal considered. The results in the figure clearly highlight the importance of a systematic
methodology to support the identification of system-specific and/or “atypical” events within a HAZID
process. In fact, Figure 15 shows that several events not identified by MIMAH were captured and
easily integrated in the bow-tie by DyPASI.
100 %
101
101
134
90 %
101
195
114
80 %
81
195
70 %
60 %
50 %
7150
2612
81
1132
40 %
233
445
178
30 %
89
267
20 %
10 %
0%
MIMAH
DyPASI
Figure 15 Percentages of hazardous events identified by the 2 HAZID techniques in a FSRU terminal. The
events are divided on the basis of the typology (Undesirable Event, Detailed Direct Cause, Direct Cause,
etc.) and, for each of them, the actual number of events identified by one and the other technique is
indicated on the column.
63
The results reported have demonstrated that following the DyPASI procedure step by step a
complete and concise outcome represented by integrated and more comprehensive bow-tie
diagrams can be obtained. In fact, the integration of atypical accident scenarios has not been
performed as a mere addition of new entire diagram branches, but rather through grafting new
single elements only where the existing ones were not able to describe the atypical scenario. Step 1
is of fundamental importance to obtain a concise and consistent diagram, because it allows the
exploitation of the results of the primary bow-tie methodology (MIMAH) application to build new
bow-tie elements for the new scenarios identified in step 0.
The DyPASI procedure also allows the integration of the bow-ties obtained by the MIMAH procedure,
based on substance hazards defined in the 67/548/EC Directive (Council Directive 1967), adding bowties related to substance hazards in the specific process conditions.
The atypical scenarios identified by the DyPASI procedure in step 0 have been entirely integrated
through steps 2, 3 and 4. Step 5 has allowed outlining safety barriers for the specific and/or
“atypical” scenarios identified and figure 2 shows some examples of barriers. The barriers identified
are mainly related to the risk control measures identified through the pre-analysis performed in step
0 and come from the same source of information of the early warnings collected. This is a
confirmation that step 0 has a fundamental importance, calling for a systematic and detailed
knowledge and information management in the risk analysis process.
3.4 Case-Study 2: application of DyPASI to the analysis of surface installations
intended for Carbon Capture and Sequestration
A HAZID process on CCS surface facilities was performed by means of two different approaches to
the problem: the DyPASI and “top-down” HAZID methodologies. This allowed for a double check of
the results obtained and, at the same time, a comparative assessment of the techniques used. The
results provided the opportunity to outline a set of atypical accident scenarios that are characteristic
of these technologies and that should be taken into account within future risk assessment studies.
3.4.1 The CCS chain
Emissions of CO2 arise from a large number of sources, but some of them are more predominant
than others. This is the case in the industrial sector, where 5 main types of activity above 100 million
tonnes of CO2 emissions per year constitute 99% of the global industrial CO2 emissions (IEA GHG
2002), as shown by Figure 16.
64
5%
3%1
%
Power - 10,539 MtCO2/y
6%
Cement production - 932 MtCO2/y
7%
Refineries - 798 MtCO2/y
Iron and steel industry - 646 MtCO2/y
Petrochemical industry - 379 MtCO2/y
78 %
Other sources - 174 MtCO2/y
Figure 16 Contribution to CO2 emissions of worldwide processes or industrial activities with more than
100 million tonnes of CO2 emissions per year (IEA GHG 2002).
The CO2 emissions produced by the 5 main activities highlighted in Figure 16 all result from the use of
fossil fuels, but not always from its combustion. Carbon dioxide not related to combustion can be
emitted from the use of fuels as feedstock in petrochemical processes (Chauvel and Lefebvre 1989,
Christensen and Primdahl 1994), from the use of carbon as a reducing agent in the commercial
production of metals from ores (IEA GHG 2000, IPCC 2001) and from the thermal decomposition of
limestone and dolomite in cement or lime production (IEA GHG 1999, IPCC 2001). However, the
majority of emissions are associated with fossil fuel combustion in oil refineries and, most of all,
power plants, which emit more than one-third of the CO2 emissions worldwide (IEA GHG 2002). This
last source is often considered as the main example to which a CCS system may be successfully
applied (DOE/NETL 2007, IEA GHG 2002, IPCC 2005, Herzog 2004) in order to achieve a sensible
reduction of atmospheric greenhouse gas concentration.
Hence, in the present study the CCS systems considered mainly focus on the removal of CO2 from
coal or natural gas fired power plants and subsequently moving and storing it into secure reservoirs.
This chain can be broken down into two main components, as shown by Figure 17: the surface
component represented by the process of capture, and the underground component represented by
the process of sequestration.
65
CAPTURE
Production of a CO2 stream ready for storage,
which is compressed and moved from the
capture site to the storage site.
SEQUESTRATION
Injection and storage of CO2 into a reservoir.
Monitoring and verification fall under this
phase.
Figure 17 Scheme of the Carbon Capture and Sequestration chain.
Capture is the production of a CO2 stream ready for storage, which is then compressed and moved
from the capture site to the storage site. In general, the CO2 is separated as a nearly pure stream (9099% pure) (DOE/NETL 2007, Herzog 2004) and is then compressed to a pressure between 85 and 150
bar (WRI 2008). Some CO2 capture technologies are commercially available today and have been in
operation for decades in the natural gas processing industry and in fertilizer and hydrogen
production (Dooley et al. 2009, IPCC 2005). In order to move large amounts of CO2 for distances up to
around 1,000 km, pipeline transport is almost always the preferred transport mode. Pipeline
transport of CO2 already operates as a mature market technology in the USA (IPCC 2005).
Nevertheless, the extent of CO2 handled is bound to dramatically increase with the advent of CCS
technology. For this reason, in this study, other means of transport feasible for smaller amounts,
such as ships, rail and road tankers are not taken into account.
Sequestration is the injection and storage of the captured CO2 into a reservoir, including its
monitoring and verification. The reservoir may be represented by an onshore or offshore geological
formation, which uses many of the same technologies that have been developed by the oil and gas
industry (IPCC 2005). In fact, anthropogenic CO2 has been injected into the deep subsurface for more
than 35 years in the U.S. There are over 6,000 deep CO2 injection wells currently in operation across
10 states of the U.S. for the purpose of CO2-driven enhanced oil recovery (Dooley et al. 2009). Other
options for CO2 storage are ocean storage and reaction with metal oxides to produce inorganic
carbonates. These last two options are still at the research stage (IPCC 2005).
3.4.2 CCS surface installations
This analysis focuses on CCS surface installations, i.e. on the different technology options for CO2
capture and the subsequent CO2 transport by pipeline to the injection site. A detailed survey of
equipment and technologies has been carried out and can be found in Annex III.
There are basically three possible technology options for the capture of CO2 from industrial sources
such as power plants. These are:
•
post-combustion capture;
•
pre-combustion capture; and
•
oxy-fuel combustion.
66
N2
O2
1)
Fuel
combustion
CO2
separation
Air
Syngas
2)
3)
from coal
gasific. or nat.
gas reform.
Shift reaction
N2
O2
CO2
CO2
CO2
separation
H2
Fuel
combustion
Air
Fuel
combustion
Coal or
Natural gas
O2
Air
CO2
CO2 compression and transport
Coal or
Natural gas
N2
Air Separation
Figure 18 Overview of the technology options for the capture of CO 2: 1) Post combustion capture; 2) Pre
combustion capture; 3) Oxyfuel combustion.
Post-combustion capture involves the removal of CO2 from, as the name implies, flue gases produced
by fuel combustion (Figure 18). A variety of techniques can be used for this separation, such as the
carbonate-based system, the aqueous ammonia system or separation membranes (Figueroa 2008),
but the most proven technique at present is to scrub the flue gas with an amine solution (Davison
and Thambimuthu 2004, DNV 2009, DOE/NETL 2007, IPCC 2005). The capture method is compatible
with Pulverized Coal (PC) and Natural Gas Combined Cycle (NGCC) power plants (Kanniche et al.
2009). These types of power plant typically use air for combustion and generate a flue gas with a CO 2
concentration between 5% (for the NGCC system) and 15% (for the PC system), with nitrogen being
the dominant diluent (Figueroa et al. 2008). Currently, post-combustion capture is already practiced
for small CO2 volumes in various industrial and commercial processes (e.g. the production of urea,
foam blowing, carbonated beverages, and dry ice production (Herzog 2004)) and some pilot plants
have been built recently, such as the EU CASTOR pilot plant at the Esbjerg PC power station in
Denmark (Knudsen et al. 2009). Nevertheless, there are not yet large scale examples of postcombustion capture in PC or NGCC power plants mainly due to the high energy costs associated (up
to 80 % of the total energy of the process) (Davison 2007, Wall 2007).
In pre-combustion capture, the fossil fuel is used to produce syngas and the carbon, in the shape of
CO2, is separated out after a shift reaction, but before the combustion takes place (Figure 18). There
are different versions of this technique, such as the physical wash by Rectisol or Selexol solvents
(Kohl and Nielsen 1997, Korens et al. 2002), the sorption enhanced reaction process (SER) or the
removal of hydrogen with membranes (Nord et al. 2009). The combustion fuel used in this precombustion capture mainly consists of hydrogen mixed with a diluent, such as nitrogen or steam.
This capture method is compatible with integrated gasification combined cycle (IGCC) and natural gas
combined cycle (NGCC) power plants (DOE/NETL 2007, Nord et al. 2009). In the first case, syngas is
the product of a coal gasification process, in the second case a product of natural gas reforming
(partial oxidation and steam reforming). Currently no large-scale pre-combustion capture plants are
running, but there are several pre-combustion capture and storage projects planned worldwide, such
as the ZeroGen project in Australia and the Appalachian Power project in USA (WRI 2008).
Oxy-fuel combustion concepts for both natural gas and coal feedstock have been proposed (Croiset
and Thambimuthu 2000, Tan et al. 2002). This technology involves a modification of the combustion
process and can be defined as combustion in nearly pure oxygen (greater than 95%) rather than air,
67
resulting in a flue gas that is mainly CO2 and H2O (Figure 18). Since by this process the flame
temperature grows up to excessively high temperatures, CO2 and/or H2O-rich flue gas are generally
recycled to the combustor to moderate this (DOE/NETL 2007). Oxygen is usually produced by low
temperature (cryogenic) air separation and novel techniques to supply oxygen to the fuel, such as
membranes and chemical looping cycles are being developed (IPCC 2005). There are no operative
large-scale oxy-fuel combustion plants, but in order to study the technology and its feasibility, several
pilot plants have been built in recent years. Notably the principal pilot plants are at Schwarze Pumpe
(Germany) (Hultqvis et al. 2009), at Lacq (France) (Aimard et al. 2009) and at Callide valley (Australia)
(Spero 2009).
Once captured, CO2 is subject to a process of dehydration and compression in order to be
transported by pipeline to the injection site. There are a number of different compressor types that
can be used for carbon dioxide compression for bulk transport. The most efficient physical status to
transport CO2 is in the supercritical phase. CO2 critical point is at 73 bar and 31°C. Nevertheless, CO2
is generally transported at temperature and pressure ranges between 13 and 43°C and 85 and 150
bar due to economic and design limits (KM 2006, Mohitpour et al. 2009).
CO2 pipelines have operated in North America since the early 1970s (WRI 2008), feeding
predominantly naturally occurring carbon dioxide to EOR (Enhanced Oil Recovery) facilities. Thus, the
process of CO2 pipeline transport, whilst less common in terms of both distance and number of
operational years experience than other fluids, is reasonably established (2500 km and 50 MtCO 2/y
only in the western U.S. from natural sources to EOR projects (IPCC 2005)). The oldest long-distance
CO2 pipeline in the U.S. is the 352-km Canyon Reef Carriers pipeline, which began its service in 1972
for EOR in regional Texas oil fields. The longest CO2 pipeline, the 803-km Cortez pipeline, has been
delivering about 24 MtCO2/y to the CO2 hub in Denver City, Texas, since 1984 (IPCC 2005). Many of
these pipelines are above ground (rather than buried) and through largely unpopulated regions. The
short length of pipe on the Sleipner project and the Snøhvit carbon dioxide pipeline in the North and
Barents Sea are currently the only examples of offshore carbon dioxide transport (WRI 2008).
68
3.4.3 Application of the two methodologies
Table 15 Main features of the methodologies applied for the Hazard Identification of CCS surface
installations.
Top-down approach
1. Source
information
DyPASI approach
Experts involved from various industry Available literature information on the
sectors.
industrial processes, the equipment,
of
Information circulated in meetings the substances. Early warnings (past
(flowsheets, block diagrams, and accidents, near misses and scientific
studies).
operating conditions).
Equipment
considered:
Top-down HAZID
study,
broken Keywords used:
down into the 4  fire;
 explosion;
2. Identification surface
of
general technologies
 toxicity;
hazards
considered
to  electrical
brainstorm
mechanical;
relevant
top  other issues
events.
MIMAH to identify
general
major
accidents likely to
occur on the basis
of
equipment
considered
and
properties
of
substances
handled.
• Post and pre
comb.
CO2
absorber
• Air
unit
separation
• Oxyfuel comb.
boiler/furnace
and recycle pipe
• Compressor
and
transport
pipeline
Similar
HAZID
Keywords used:
session
to
 layout;
3. Integration of brainstorm
 interfaces;
atypical elements changes
 organizational
introduced
by
factors
CCS.
Application of DyPASI for the
systematic
and
comprehensive
inclusion
of atypical scenarios
(otherwise
not
considered
by
conventional techniques) inferred
from the early warnings collected.
following
Safety
barriers The
hierarchy
was
brainstormed
using database of used:
risk
reduction  elimination;
4. Definition of
 protection;
measures
safety barriers
developed to aid  reduction;
assessors
of  separation;
Seveso II safety  emergency
reports.
response.
Identification of
safety barriers for
the
(atypical)
scenarios
identified
by
means of the
check-list
proposed
by
MIRAS.
5. Results
Four main verbs
of action used to
define
the
barriers:
 to avoid;
 to prevent;
 to control;
 to limit
Bow-tie diagrams referring to CO2 LOC,
Bow-tie diagrams referring to the
O2 LOC, fire and explosion.
equipment and LOC typologies
Some
comments
about
toxics analyzed.
scenarios.
69
3.4.3.1 Top-down HAZID approach
The top-down HAZID approach is an analysis which essentially breaks down the system to identify
hazards of its compositional sub-systems. Table 15 describes the main features of this HAZID
method, such as the source of information, how the general hazards and the atypical elements are
identified, how the safety barriers are defined and how the results are presented. A more detailed
description of the method can be found elsewhere (Wilday et al. 2011c).
The top-down HAZID approach is generally based on the development of HAZID brainstorming
meetings with experts from several industry sectors (Wilday et al. 2009, Wilday et al. 2011c). Initially
an overview of the system is formulated, specifying but not detailing any subsystem. Thus, the first of
the meetings aims to confirm the information previously gathered for the analysis and to identify
substances involved, equipment and processes, which is crucial for a correct identification of atypical
scenarios. For the identification of general hazards (Table 15), a structured approach is used and top
events relevant to CCS are identified in brainstorming sessions. The following keywords that
represent possible top events and/or consequences help the experts in the process:
•
fire;
•
explosion;
•
toxicity;
•
electrical mechanical;
•
other issues
Preliminary draft bow-tie diagrams are then drawn.
The integration of atypical elements previously disregarded within the analysis is also allowed
through a further specific brainstorming session, where the subsystems are studied more in detail. In
particular, this phase focuses on the changes introduced by the new technologies, such as the CCS
technologies, particularly in terms of layout, interfaces and organisation. These terms are used as
keywords (Table 15).
Finally, in the last meeting, the draft bow-tie diagrams previously outlined are refined, their
structures are analysed and possible barriers preventing the top events are identified by the last
specific brainstorming session, which follows the hierarchy shown in Table 15.
In this particular case 18 experts from the petroleum, industrial gases, clean energy, consulting
companies, universities, safety regulatory authorities and the IEA Greenhouse Gas R&D programme
(who commissioned the work) were involved (Wilday et al. 2009, Wilday et al. 2011c) in the analysis.
The top-down HAZID was carried out at an early stage in the development of CCS with the aim of
identifying the hazards which could impact on the deployment of CCS. Thus, due to the paucity of
open information available about the details of CCS systems at the time, the participants were
initially requested to provide inherent information which, prior to each meeting, was circulated in
terms of flowsheets / block diagrams of parts of CCS surface installations and related operating
conditions. Figure 19 represents an example of the information provided and shows the block
diagram of an IGCC plant with pre-combustion capture.
70
Figure 19 Schematic representation of IGCC with pre-combustion capture (Courtesy Mr. Andy Brown,
Progressive energy). (Wilday et al. 2009).
During the meetings for the identification of general hazards and the integration of atypical
elements, opportunity was also taken to consider prevention, control and mitigation of the
hazardous events identified, which helped the definition of the safety barriers. Finally, in addition to
the results presented as bow-ties diagrams referring to CO2 LOC, O2 LOC, fire and explosion,
comments about likely scenarios involving toxic dispersions were formulated.
71
3.4.3.2 DyPASI approach
In this particular case, for the sake of brevity and due to the complexity of carbon capture plants (see
Figure 20), only representative equipment handling hazardous substances were analyzed by means
of the DyPASI methodology.
Figure 20 Two-stage Selexol process flow diagram for pre-combustion capture (DOE/NETL 2007).
Equipment considered comprised:

post and pre combustion capture CO2 absorber (Figure 20);

Air Separation Unit (ASU) considered as a unique distillation column;

oxyfuel combustion boiler/furnace and recycle pipe; and

compressor and transport pipeline.
For the application of the MIMAH methodology, the identification of the general hazards and the
most common failure modes was performed and double checked with the help of the UK Health and
Safety Executive (HSE) guidance on Control of Major Accident Hazards (COMAH) (HSE 2011c).
The resulting bow-tie diagrams were obtained for several typologies of Loss Of Containment (LOCs)
events concerning the equipment previously mentioned.
72
3.4.4 Results of the two methods
3.4.4.1 Early warnings related to the CCS surface technologies
The application of DyPASI allowed the collection of several early warnings related to the CCS surface
technologies, which were subsequently processed in order to optimize the hazard identification of
these new technologies.
Past incidents involving CO2
Table 16 Incidents involving CO2
CO2 as fire suppressant
Time
Before
1975
1975
2000
Pipeline incidents
- 1986
2001
- 2002
2008
Natural CO2 releases
-
1979
1984
1986
Lake
Monoun,
Cameroo
n
Lake
Nyos,
Cameroo
n
Location
Worldwid
e
Worldwid
e
USA
USA
Dieng
Volcano,
Indonesia
Incidents
11
51
11
18
1
1
1
Deaths
47
72
1
0
149
37
1700
Injuries
7
145
2
0
Not given
Not given
Not given
Source
US
EPA US
EPA
OPS 2010
2000
2000
OPS 2010
IEA GHG IEA GHG IEA GHG
2010
2010
2010
CCS introduces new processes for the capture of CO2 characterised by some critical points and their
feasibility is currently being assessed by many ongoing projects. Only a few cases of small-scale
power plant applications are operating worldwide, so there is a general lack of experience about
their risk assessment and management. In fact there are no past incidents for capture plant on which
to rely, and the only examples of events in a plant found by the historical analysis are represented by
incidents with CO2 as a fire suppressant (Table 16). The fatalities listed in Table 16 (CO2 as fire
suppressant part) have been registered as cases of asphyxiation in a fire mitigating system
atmosphere or accidental releases (US EPA 2000). In fact, the gas is heavier than air and may
accumulate in confined spaces causing deficiency of oxygen. Nevertheless, capture technologies also
involve use of different hazardous substances, such as toxic solvents (e.g. amines), oxygen and
hydrogen, which must be taken into proper account in the process of risk assessment.
From a first assessment, the risk related to CO2 pipeline transport seems relatively well known due to
the U.S. experience previously mentioned. Table 16 shows the number of past incidents which have
occurred in the U.S., from which useful lessons can be drawn. A km-by-km comparison is made by
Gale and Davidson (Gale and Davidson 2004) and, according to their study, CO2 pipelines have a
frequency of incident of 0.32 per 1000 km per year, whereas natural gas and hazardous liquid
pipelines have an incident frequency of 0.17 and 0.82, respectively. However these data can be
deceptive, because current CO2 transmission lines in North America mainly go through sparsely
populated areas, and the impact of an incident may be limited as the released CO2 eventually
dissipates with little chance of affecting human populations. Dense phase CCS pipelines will contain
73
tens or even hundreds of thousands of tonnes of CO2 which, if containment is lost, could create a
CO2-rich cloud that could potentially threaten large geographical areas (DNV 2009). Severe reminders
of this are the natural CO2 releases of volcanic origin which occurred in Indonesia and Cameroon
reported in Table 16, which, all together, caused about 1900 fatalities. However the volume of CO2
involved in natural releases such as these can significantly exceed that in a CO2 pipeline system.
Hazardous characteristics of CO2
In addition to the tendency to displace oxygen causing asphyxiation, other kinds of hazard related to
CO2 are reported by studies (US EPA 2000, Wickham Assoc. 2003), guidance (HSE 2011b) and safety
data sheets (Air Liquide 2010, Linde 2010). Inhalation of high concentrations of CO2 can increase the
acidity of the blood, triggering adverse effects on the respiratory, cardiovascular and central nervous
systems. Hence, people would be at severe threat from increasing CO2 concentrations well before
they were from the reducing oxygen concentrations. Due to the rapid depressurisation in
combination with the phase change, venting of dense phase CO2 to atmosphere may result in a very
cold two phase CO2 flow, able to cause cryogenic burns to anyone caught in it. Additionally, a
catastrophic rupture of a storage tank containing pressurised liquid CO2 can lead to a BLEVE (Boiling
Liquid Expanding Vapour Explosion), i.e. a very sudden depressurisation of the substance creating a
superheated liquid phase that suddenly vaporizes in an explosive manner. Few publications (e.g. (Kim
and Reid 1983, Pettersen 2002)) and a past incident occurred at a plant in Worms, Germany in 1988
(Clayton and Griffin 1994) evidence the possibility of a “cold” CO2 BLEVE (to distinguish it from the
“hot” BLEVE of flammable substances, such as LPG, which often is caused by fire and followed by
ignition of the flammable release).
74
3.4.4.2 Bow-tie diagrams
Undesiderable
Event
Detailed Direct
Cause
Direct Cause
Necessary and
Suffi. Cause
Secondary
Critical Event
Critical Event
Tertiary
Critical Event
Dangerous
Phenomenon
Major Event
PRE COMBUSTION ABSORBER
Combustion /
explosion - int.
Flammable &
Combustion /
explosion
Internal
Overpressure
Breach of shell
6 Pool form.
7 Pool ignited
Poolfire
Thermal
radiation
VCE
Thermal
radiation
1 Ignition
H2 cracking
sensitive mat.
Brittle
H2 embrittlem. 2 structure &
Brittle rupture
Gas jet
8
Gas dispersion
9
Impact
Corrosive
product
3 Contaminat.
Overpressure
4 Corrosion 5
Degrad. of
mech.
properties
Missiles
Gas jet ignited
Flash fire
Thermal
radiation
Toxic cloud
Toxic effects
Thermal
radiation
Jetfire
TRANSPORT PIPELINE
10
Free water
inside
Hydrate
formation
Ice due to leak
Defective
under the pipe 12 support
Depress. of
CO2
Low
temperature
11
Blockage
Internal
Overpressure
Shear stress
Mechanical
stress - ext.
Leak from pipe
17 Gas jet
High conc. of
18 CO2
Toxic effects
Asphyxiation
Brittle
13 structure &
19 Toxic cloud
Depress. of
CO2
Brittle rupture
Low
temperature 20
Slumping / low
High conc. of
22 Toxic cloud
vel. release 21 CO2
Impact
Aqueous
Accelerating
15
environment & 14 corrosion
Cryogenic
burns
Toxic effects
General
corrosion
Asphyxiation
Small leak
Wrong
Wrong hot
tapping
16 procedure
Cause
Cause
Centre Event
Final
Consequence
Consequence
LOSS OF CONTAINMENT OF OXYGEN
Cryogenic
storage failure
Oper. probl.
on external O2
supply
Enhanced
combustion
25
26
Scale and
unfamiliar
technology
23
Oxygen
pipeline failure
27
LOC of O2
29
Detonation
30
Escalation
28
Ingress of
flammables to 24
ASU
Organization /
interfaces
Fire
Detonation of
ASU
Explosion
32
31
Harm to
people
Enhanced
combustion in
ASU
Figure 21 Bow-tie diagrams obtained through the application of the two different approaches. The bow-tie
diagrams referring to the equipment of pre-combustion absorber and transport pipeline are results of the
DyPASI approach. The bow-tie diagram referring to the loss of containment of oxygen is a result of the
75
Top Down approach. The numbered black dots indicate the position of the safety barriers listed in Table
17.
Table 17 List of the safety barriers in the bow-tie diagrams of figure 6 and position on the diagram.
Safety barrier
Position
Avoid ignition
1, 7, 8, 9, 29
Material selection
2, 4, 14
Detection
2, 5, 6, 7, 8, 9, 11, 12, 13, 15, 17,
18, 19, 22
Product purification
3, 10
Stop the feeding
6, 24, 25, 26, 27
Secondary containment
7
Improve operators knowledge
16, 23, 28
Protective clothing
20
Avoid bowls, wells or tunnels
21
Layout
21, 24, 30, 31, 32
Figure 21 shows some examples of results obtained by the application of the two methods previously
described. Three representative diagrams were chosen. Two resulted from the DyPASI approach and
refer to a breach in the pre-combustion absorber shell and a leak from the transport pipeline, and
one resulted from the Top-Down approach and refers to a loss of containment of oxygen. For the
sake of brevity, some of the branches of the DyPASI diagrams have been omitted (dotted lines in
Figure 21). Moreover, the numbered black dots on the diagrams mean that one or more of the safety
barriers listed in Table 17 are located in that position. In order to synthetically group all the safety
barriers, in Table 17 no classification or hierarchy has been indicated. More detailed results are
reported elsewhere (Paltrinieri 2010; Wilday et al. 2009).
3.4.4.3 Pre combustion absorber
The bow-tie diagram referring to the pre combustion absorber mirrors almost exactly the diagram
obtained for the post combustion absorber (Paltrinieri 2010). The only specific elements of this
diagram are the possible brittle rupture due to hydrogen embrittlement and the elements related to
the presence of flammable substances. In fact, this equipment, in addition to CO2 and the solvent
(Selexol or Rectisol), handles hydrogen and traces of H2S (DOE/NETL 2007), which are extremely
flammable according to their safety data sheets (PTCL 2011a, PTCL 2011b). Thus, in Figure 21 the
event of an internal combustion/explosion is shown as leading to a breach of the shell. Dangerous
phenomena as Poolfire, Vapour Cloud Explosion (VCE), Flashfire and Jetfire are taken into account as
potential final consequences.
Mechanical stress due to external causes, insufficient material properties or degradation of
mechanical properties due, for instance, to corrosion, are common causes of a breach of the shell
(Paltrinieri 2010) (some of them have been omitted on Figure 21). In particular, it is well known that
CO2 forms an acid solution in aqueous phase, which can give corrosion issues. Also impurities, such as
mercury, are corrosive. Nevertheless, the corrosion rate depends on the temperature, so a relatively
low corrosion will take part in the colder parts of the plant. For instance, a higher corrosion rate is
76
expected at the inlet and outlet of the stripper where higher temperatures occur (Shao and
Stangeland 2009).
Finally, it must be specified that the consequence of a toxic cloud in this first bow-tie diagram is not
only due to the presence of hydrogen sulphide, which is very toxic by inhalation (PTCL 2011a), but
also to the high concentration of CO2, whose toxic effect at high concentrations were indicated by
the early warnings collected.
3.4.4.4 Transport pipeline
Several elements specifically connected to CO2 pipeline transport are noteworthy in the second bowtie diagram of Figure 21, such as the hydrate formation and corrosion caused by free water content.
These events may lead to pipeline blockage or to the release of CO2 with pipeline rapid
depressurisation, potentially causing embrittlement, on one side, and cryogenic burns to exposed
personnel, on the other side. These aspects have been considered due to the collection of
information in the first phase of the DyPASI application. Also the toxicity of concentrated CO2 and its
slumping/low velocity release were added to the diagram as secondary critical events on the basis of
the early warnings collected. The latter element has been considered as a release alternative to a gas
jet, because CO2 is heavier than air and will tend to accumulate at ground level. In the other diagrams
this is not considered because of the higher temperatures of CO2 gas.
3.4.4.5 Loss of containment of oxygen
The third bow-tie diagram is the result of the top-down approach and, as shown in Figure 21, is not
explicitly referring to a specific equipment, but rather to a particular top event. Thus, the loss of
containment of oxygen here analyzed could occur in any part of the ASU or in the connection line
between the ASU and the gasifier or the boiler in a pre-combustion capture system or an oxyfuel
combustion system respectively.
In this case the diagram is more concise, but the more articulated connections between the elements
compensate for the lower level of detail. Some references to human / organizational causes are also
given (“scale and unfamiliar technology” and “organization / interfaces”), together with a proper
organizational safety barrier, such as “Improve operators’ knowledge” (Table 17).
The potential consequences of a loss of containment here considered mainly refer to oxygen’s
capacity to strongly support combustion (PTCL, 2011c).
3.4.5 Discussion of results
3.4.5.1 Atypical accident scenarios identified
The results previously described are inferred mostly from the early warnings collected. In fact, the
results shown are the most interesting and peculiar for the new technologies analyzed. More
common accident scenarios, also identified by the two techniques, were intentionally not reported,
but are present in the more detailed version of results reported elsewhere (Paltrinieri 2010, Wilday
et al. 2009). These accident scenarios might have not been identified by other HAZID techniques that
do not take into proper account early warnings. For this reason these accident scenarios can be
defined as “atypical”.
The first type of accident scenarios that is worth highlighting is that related to the presence of new
hazardous substances in the plants considered. The presence of hydrogen can cause embrittlement
and its loss of containment can lead to VCE, flash-fire or jet-fire. Similarly, oxygen strongly supports
combustion and its loss of containment can lead to fire or explosion. Nowadays the identification of
these scenarios does not involve particular issues thanks to a consolidated past experience.
Nevertheless there are two important factors that, to some degree, can be defined as atypical and
must be carefully considered in the HAZID process: the lack of familiarity of operators with the new
77
equipment and its larger scale in relation to similar existing facilities. These two elements were
considered by the bow-tie diagram concerning the loss of containment of oxygen, but are valid for all
the equipment considered (Figure 21). To respond to these issues an improvement of general
knowledge on the process is needed, not only on the side of operators (as specified in Figure 21 and
Table 17), but also on the side of managers, in order to verify that the selected technology meets all
health, safety and environmental requirements, and to avoid controversies such as those recently
raised on the planned carbon capture plant at Mongstad (Norway) (CCJ 2011a, CCJ 2011b, CCJ 2011c,
CCJ 2011d, CCJ 2011e).
This study has also pointed out the possibility of atypical accident scenarios related to commonly
disregarded carbon dioxide properties, which are evident in the bow-tie diagram for transport
pipelines in Figure 21. The potential of CO2 to form hydrate with freewater causing the blockage of
the pipeline and, thus, a possible leak due to overpressure is reported. Another important cause of
leakage reported is corrosion. The cryogenic properties of CO2 while depressurizing may cause
various effects, such as brittle rupture or formation of ice under the pipe, causing mechanical stress
to a defective support.
One of the most unrecognised hazardous characteristics of carbon dioxide is its toxicity at high
concentration, which, together with its tendency to accumulate at ground level because it is heavier
than air (its molecular weight is higher and a depressurization can lead to a lower cloud
temperature), is a very important aspect and must be always considered in the HAZID process.
Furthermore, even if the event of a BLEVE has not been mentioned in bow-tie diagrams, because it is
not related to the equipment items analyzed, it should be noted that the occurrence of a BLEVE
(Boiling Liquid Expanding Vapour Explosion) is possible in the case of catastrophic rupture of a
storage tank containing dense phase CO2. The outcome would thus be an overpressure wave and the
projection of missiles.
Finally it must be remarked that the atypical scenarios here described were generally identified by
both the methods, but differently presented. While the bow-tie diagrams obtained from the topdown approach simply refer to the main top events identified, such as fire, explosion and oxygen and
carbon dioxide LOCs, the bow-tie diagrams obtained from the DyPASI approach refer to both the
equipment and LOC typology (Table 15). Thus, in the first case the diagrams are more generic but can
give a better overall view of the problem. In the last case the number of diagrams and the level of
detail are higher because for each equipment all the possible LOCs are analyzed and the potential
causes and consequences of LOCs are identified.
3.4.5.2 Qualitative comparison of the two methods
The aspect of knowledge management is crucial in the process of identification of atypical accident
scenarios. In fact, when there is no solid experience in terms of past events because of new or
emerging technologies such as in CCS technologies, a wider and more detailed analysis based on
proper and specific methodologies is the best option to pursue. In the present study, two different
approaches were considered in order to compare and validate the results obtained, but also in order
to identify and suggest a proper strategy for the HAZID of CCS atypical scenarios.
The application of the top-down approach was performed a few months in advance (Wilday et al.
2009) of the DyPASI application (Paltrinieri 2010). It was not a long period of time, but enough to
affect the availability of literature information in such an evolving research field. On one hand, when
the Top-Down analysis was developed, little information was available, thus experts were identified
and requested to provide data and/or to take part in the analysis (Wilday et al. 2009, Wilday et al.
2011c). On the other hand, the DYPASI approach was able to directly avail a detailed set of early
warnings (Paltrinieri 2010). Thus, the availability of literature information or the possibility to obtain
experts’ opinions are criterions that strongly affect the choice of one methodology approach or the
other.
78
Systematic analysis
Brainstorming
Another important selection criterion is the level of guidance needed from the methodology. If a
fixed procedure is what is needed, because it aims to facilitate the user in the retrieval of available
information and its consideration in the hazard identification, when it is applied by a single analyst,
then the DyPASI approach should be preferred. On the contrary, if a team of experts can be gathered
to perform sessions of brainstorming, where brainstorming is defined as a group creativity technique
aiming to find a problem solution by gathering ideas spontaneously contributed by group members
(Osborn 1963), then the top-down approach is more suitable.
Top-down
approach
DyPASI
approach
Available literature
information
Experts’ experience
Figure 22 Comparison between the DyPASI and the Top-down approaches.
Figure 22 illustrates these selection criteria. Black indicates where the DyPASI approach is more
convenient. The area where black is predominant is in correspondence on the availability of
literature information (on the x-axis) and need of a systematic analysis (on the y-axis). On the
contrary, white indicates where the top-down approach is more convenient. The area where white is
predominant is in correspondence with the availability of experts’ experience (on the x-axis) and
brainstorming (on the y-axis). Between these two homogeneous areas there is a shaded region,
where there is no complete predominance of a technique on the other and both the techniques can
be suitable. This overlap is also mirrored by the features of the two approaches, which can not be
rigidly classified. In fact, despite systematicity is one of the main features of the DyPASI
methodology, arbitrariness is used to model results for specific applications, in order to consider, for
instance, risk perception and social concern issues. On the other side, results of the top-down
approach are not obtained only by means of user’s creativity and each meeting is well structured and
deals with predefined subjects and keywords.
The two approaches are not actually alternative, rather some of their characteristics are contrasting,
as Figure 22 shows. Hence, even if the DyPASI results are undoubtedly more detailed, the method
79
must not be confused with a bottom-up approach, because it basically follows the same structure of
gradual addition of details to a first phase of identification of general hazards (Table 15). To conclude,
one method should be preferred to the other on the basis of the initial information availability (from
experts or literature) concerning the subject analyzed. Moreover the capacity of the user to perform
a step-by-step analysis or to organize a series of brainstorm meetings is another important point.
DyPASI has a higher potential to obtain comprehensive results even when performed by a single
analyst rather than by a team of experts. Nevertheless, this study shows how both the approaches
can lead to effective results able to take into account atypical accident scenarios related to CCS
surface installations.
3.5 Conclusions
The DyPASI methodology was built in the effort of mitigating a recognized deficiency of the current
HAZID techniques in the identification of unexpected potential hazards related to atypical scenarios.
The technique is based on the results of the in-depth analysis previously performed and represents a
translation of the lessons outlined from past atypical accidents. The main aim of the methodology is
to provide an easier but comprehensive hazard identification of the industrial process analysed. The
main features of DyPASI are its systematic nature, the enhancement of the knowledge management
and its ability to obtain complete and concise results. Even if the DyPASI technique was built to allow
a further extension of the potentialities of the MIMAH approach, the tool can be easily adapted and
applied to other bow-tie methodologies. DyPASI features as a tool to support emerging risk
management process, having the potentiality to break “vicious circles” and triggering a gradual
process of assimilation and integration of previously unrecognized atypical scenarios in the risk
management process.
The DyPASI methodology was then applied to a complex process of hazard identification performed
on alternative technologies for LNG regasification and Carbon Capture and Transport. A HAZID
analysis was carried out on new substances, equipment and activities and the hazards related to
these new and emerging technologies were investigated. By means of the integration of the results, a
general overview of accident scenarios connected to these technologies was given and some possible
barriers were identified as a starting point in this process.
Even though both the LNG regasification and CCS technologies have given rise to much current
debate, it was demonstrated that:

DyPASI is a valuable tool to obtain a more complete and updated overview of potential
hazards, because allows the investigation of emerging risks that tend to be disregarded by
common HAZID techniques.

DyPASI is able to make more easy and systematic the process of learning from different
categories of early warning, such as scientific and technical reports, past accidents or
growing social concern issues and for this reason is preferable when there is availability of
literature information.

DyPASI has a higher potential to obtain comprehensive results even when performed by a
single analyst rather than by a team of experts.
80
Section 4
Development of indicators for prevention
of atypical accident scenarios
81
4.1 Introduction
Risk awareness is a fundamental factor to tackle the issue of atypical accident scenarios and,
together with an effective knowledge management, would make possible the achievement of a
complete and effective process of risk management. To graphically express this approach, the curve
of the Buncefield case discussed in section 2 (see Figure 1) should be "pushed up" towards the ideal
case curve and leave the red zone of atypical accident scenarios. There may be two different but
complementary approaches to obtain this result, consisting in tackling separately the risk of
“Unknown Known” and “Unknown Unknown” events through different methodologies.
The more technical and reactive approach aims at reducing the occurrence of “Unknown Known”
events by improving current HAZID methods. This approach was widely discussed in sections 2 and 3,
and consists in the introduction of more structured HAZID techniques, e.g. as the DyPASI method,
that result is a more complete overview of potential hazards, which can give rise to a more effective
risk assessment process.
An alternative approach may aim to reduce the possibility of remaining unforeseen events
(“Unknown Unknowns”) leading to an accident. Since there has not been any information or
knowledge about such events (limits to conceive and image some scenarios), we could prepare for
crisis management in the case of inevitable occurrence of accidents and put into practice actions of
precaution, as stated by Lagadec (1994). Furthermore, we could focus on the underlying causes
defined by the accident analysis in annex I, as described in section 2, which in most cases have been
found to have a direct effect on risk management and can turn into a fertile ground for the
occurrence of atypical accident scenarios. One way to deal with this problem is to improve early
detection of deviations early in the causal chain, in order to make the appropriate adjustments
before the accident occurs. Collection of errors potentially capable of escalation into a catastrophe
would enable organizations to experience what March et al. (1991) define as “small histories”, i.e.
fragments of the chain of events leading to an (atypical) accident, and provide evidence of improving
or deteriorating safety trends and hence decreasing or increasing likelihoods of accident (Phimister
et al. 2004). Most of all, in a perspective of prevention of atypical accident scenarios, detection of
early warnings could improve organizational awareness (mindfulness) of safety problems (Weick et
al. 1999) and reduce complacency in organizations where major accidents are possible but rare. This
result could be obtained by developing proactive indicators (early warning indicators) to constantly
monitoring the system, followed by implementation of corrective actions – if needed.
This section addresses the latter approach by applying and assessing 3 methodologies for the
development of early warning indicators: the Resilience Based Early warning Indicator (REWI)
method, developed by SINTEF (Øien et al. 2010a, Øien et al. 2010b), the Dual Assurance (DA)
method, developed by HSE (Health and Safety Executive) (HSE 2006), and the Emerging Risk Key
Performance Indicator (ER KPI) method, developed within the framework of iNTeg-Risk (Friis-Hansen
et al. 2010). The REWI and DA methods are applied to a Buncefield-like oil depot and the ER KPI
method to LNG regasification technologies. The effectiveness of indicators in preventing underlying
causes of atypical accidents is discussed. In particular, the indicators developed for the oil depot are
compared with the direct and indirect causes identified by the analysis of the Buncefield accident in
order to demonstrate their capability to cover them. Finally, complementarity and dependence
between the techniques and DyPASI are evaluated in the perspective of prevention of atypical
accident scenarios.
4.2 Methodologies for the development of early warning indicators
Three different methods for the development of early warning indicators were considered in this
study with the purpose to test their effectiveness in coping with the unexpected and to assess
82
whether there is any complementarity with the DyPASI technique in the perspective of prevention of
atypical accident scenarios.
The methods assessed are:

the Resilience Based Early warning Indicator (REWI) method, developed by SINTEF (Øien et
al. 2010a, Øien et al. 2010b) (Figure 23a)

the Dual Assurance method, developed by HSE (Health and Safety Executive) (HSE 2006)
(Figure 23b)

the Emerging Risk Key Performance Indicator (ER KPI) method, developed within the
framework of iNTeg-Risk (Friis-Hansen et al. 2010) (Figure 23c)
83
a)
4.
Selected list of
important general
issues and
related
6.
candidate
Selection of a
indicators
5. manageable
set of
Review &
indictrs
integration of
candidate
indictrs
7.
Selected set of
indicators
Specification
of
9.
selected Implement.
indictrs
& use of
8.
indictrs
3. Assessment of
1.
Predefined
list of
general
issues
importance of
general issues
2. Review and
addition of issues
if req.
b)
11. Regular
10.
review &
update of
indicators
Implemntd
set of
indicators
3. Identification of risk control systems
for major accident prevention. Definition
of outcomes & relative lagging indicators
1. Establishment of organizational
arrangements to implement indicators
4. Identification of RCS critical elements
2. Decision on measurement system
5. Establishment of data collection &
scope. What can go wrong and where?
reporting system
& definition of leading indicators
Set of
lagging &
leading
indicators
6. Review (performance, scope and
tolerances)
c)
1.
Identifyi
ng and
mapping
process
es
5. Proposal of places and the
method of data
collection
2. Description of the identified
process
4.
Proposal
of KPI
structure
3. Analyses of the current
status of process
performance measurement
6. Proposal of process
evaluation data
7. Suitability Review
of the measurement system
Figure 23 a) Method steps of the REWI method. b) method steps of the DA method. c) Method steps of the
ER KPI method.
84
The first two the methods were applied to a Buncefield-like oil depot, whose characteristics respond
to the description given in Section 2 and (MIIB 2008). However, the application of the methods could
not be carried out without being affected by past events (the major accident at Buncefield and
similar accidents), thus the analysis was divided in two distinct phases:
1. Definition of a first set of indicators exclusively based on candidate indicators, suggestions
and examples reported within the official descriptions and guidance of the two
methodologies (HSE 2006, Øien et al. 2010a, Øien et al. 2010b) in order to limit influence
from past events
2. Comparison with the actual failures that led to the accident at Buncefield and other similar
accidents (Table 7) in order to identify any lack and to further refine the results obtained.
Any modification and addition was highlighted.
The definition of these new indicators was carried out also with reference to the quality
characteristics for safety performance indicators outlined by the International Atomic Energy Agency
(IAEA 1999), mainly focusing on usefulness and convenience of indicators.
The ER KPI method was applied to the technologies of LNG regasification (Uguccioni 2010) within the
framework of iNTeg-Risk. The purpose of the indicators developed was to manage the emerging risk
raised by the advent and diffusion of new and alternative technologies.
4.3 The REWI method
This method aims to develop early warning indicators based on the concepts of resilience and
Resilience Engineering. A classic definition of resilience is given by Woods, which describes resilience
as “the capability of recognizing, adapting to, and coping with the unexpected” (Woods 2006).
Resilience Engineering is a specific approach to manage risk in a proactive manner by providing
methods, tools and management approaches that help to cope with complexity under pressure to
achieve success (Hollnagel and Woods 2006).
The REWI approach uses an operationalization of the concept of resilience as a starting-point, and is
based to some extent on a method developed by U.S. Electric Power Research Institute (EPRI) known
as Leading Indicators of Organizational Health (LIOH) (US EPRI 2000, US EPRI and US DOE 2001).
The main parts of the REWI method, also representing the different tiers of the approach, are the
following:
1. Contributing Success Factors
2. General Issues
3. Indicators
The REWI method consists of eight Contributing Success Factors (CSFs) representing an
operationalization of the concept of resilience. They were developed starting from some key
literature sources (Tierney 2003, Woods and Wreathall 2003, Woods 2006) and an empirical study on
successful recovery in high-risk incidents (for this reason the term Contributing Success Factor)
within the research project named “Building Safety in Petroleum Exploration and Production in the
Northern Regions” (SINTEF 2011, Størseth 2010).
For each CSF there is a predefined set of general issues contributing to the fulfilment of the CSF
goals, joined to proposals for early warning indicators. The general issues and proposals for
candidate indicators were developed based on the results of several workshops with scientists and
domain experts (Øien 2010a). They represent a starting point on which the establishment of
indicators should be made, as illustrated in Figure 23a. In fact, from the review and selection of
important general issues (steps 1-3), a detailed list of suggested indicators is initially obtained. Then a
second level of review and selection allows the definition of a manageable set of indicators (steps 4-
85
6), which are then specified in detail and applied to the system (steps 7-9). Since the indicator
performance will most likely change over time, the last steps of the methodology (steps 10 and 11)
explicitly point to regular review and update of the system of indicators.
It should be noted that, even though the REWI method is based on a predefined set of general issues
and indicators, it is still a contributory-based method, and new elements may be added during
workshops dedicated to the identification of indicators (steps 2 and 5). The initial suggestions are
first of all a foundation to trigger the creation of suitable indicators, which may not be present in the
initial set considered.
However, as already mentioned above, the first phase of the application of REWI in this study was
carried out exclusively by means of the predefined set of general issues and candidate indicators, in
order to limit influence from past events. Then, in the second phase, the comparison of results with
the actual causes of the accidents considered allowed a further refinement of indicators.
A more detailed description of the method can be found in previous publications (Øien et al. 2010a,
Øien et al. 2010b).
4.4 The Dual Assurance method
The Dual Assurance (DA) method is a safety performance based method that aims at establishing
safety indicators to describe the safety level within an organization, activity, or work unit. The
method analyses the process safety management system in place to prevent major incidents that
may arise from of the production, storage and handling of dangerous substances. Both leading
(proactive) and lagging (reactive) indicators are set in a structured and systematic modality for each
key Risk Control System (RCS)2 in order to confirm that it is operating as intended or provides a
warning that problems are starting.
Leading indicators are a form of active monitoring focused on a few critical risk control systems to
ensure their continued effectiveness. Leading indicators require a routine systematic check that key
actions or activities are undertaken as intended. They can be considered as measures of process or
inputs essential to deliver the desired safety outcome (HSE 2006).
Lagging indicators are a form of reactive monitoring requiring the reporting and investigation of
specific incidents and events to discover weaknesses in that system. These incidents or events do not
have to result in major damage or injury or even in a loss of containment, providing that they guard
against or limit the consequences of a major incident. Lagging indicators show when a desired safety
outcome has failed, or has not been achieved (HSE 2006).
The use of both leading and lagging indicators provide a "dual assurance" in the way that the results
from both type of indicators should be consistent. If leading indicators show a negative trend and
this is not shown by the lagging indicators (or vice versa), this is an indication of inappropriate
indicators (either the leading or the lagging).
The method is constituted by a six-step procedure for the establishment and the implementation of
performance indicators, as illustrated in Figure 23b. After establishing the organizational
arrangements to implement the indicators (step 1), the scope of the indicators must be defined, and
the potential hazard scenarios of the system should be identified (step 2). In the case of potential
atypical accident scenarios, this last step is fundamental and must be carefully carried out. Then, for
each scenario the RCS in place to prevent or mitigate the consequences of these events must be
identified (step 3). It follows that RCS safety desired outcomes and related lagging indicators, to
directly show whether or not these outcomes are achieved, can be inferred. They represent the
2
RCS - constituent part of a process safety management system that focuses on a specific risk or activity, e.g.,
plant and process change, permit to work, inspection and maintenance etc. (HSE 2006)
86
reactive aspect of this technique. Step 4 aims to define the actual early warning indicators, but only
after having determined the most important RCS aspects that must be covered, i.e. the most critical
and liable to deterioration activities and operations. With these premises, leading indicators, to show
that critical parts of each RCS are working as intended, can be obtained. Finally a data collection and
reporting system must be established (step 5) and a review of performance, scope and tolerances
should be guaranteed (step 6).
A more detailed description of the method can be found in a previous publication (HSE 2006), where
an example of application to a generic oil depot is also described. In this study, the example has been
used as a model and its suggestions have helped to limit influence from past events in the first phase
of the method application, as already mentioned above. In the second phase, the indicators obtained
were improved by means of the following comparison with the actual causes of the accidents
considered.
4.5 The ER KPI method
This method aims to develop a system of Key Performance Indicators (KPIs) related to emerging risks,
aiming to detect an emerging risk, decide when there is a risk issue to be dealt with and monitor the
results of risk reduction actions. Moreover, in the iNTeg-Risk project this system of KPIs is a feature
for the comparison and rating of emerging risks, and a condition for their “integrated” management.
Since the iNTeg-Risk project is ongoing and other outcomes regarding the definition of a shared
methodology are still expected, a preliminary algorithm for the procedure for the identification of
KPIs and for establishing a group of indicators which can be representative in measuring the value of
a process was illustrated in Figure 23c. A more detailed description of the method can be found
elsewhere (Friis-Hansen et al. 2010).
Since the character of the KPI indicator depends on the uniqueness of the process addressed (FriisHansen et al. 2010), the first steps (steps 1-3) of the methodology deal with the study of the process.
Thus, after its identification (step 1), the process is described (step 2) and the current status of
performance measurement is defined. On the basis of the information gathered a structure for KPI
indicators (step 4), application targets, a method of data collection (step 5), and process evaluation
data (step 6) are proposed. Finally a review of the suitability of the indicator system is carried out in
order to correct and refine the indicators outlined.
The key performance indicators are defined for the Emerging Risk Issues (ERIs) related to LNG
regasification technologies and grouped on the basis of the four dimensions of the Emerging Risk
Management Framework (iNTeg-Risk 2009) (Technology/Technical, Governance/Communication,
Human management, Policies/Regulation/Standardization) of iNTeg-Risk, ensuring the holistic
approach to performance assessment, thus preventing risk shift to other receptors or to other
process life steps.
The ER KPI method was applied to a LNG regasification plant (Uguccioni 2010) and some
representative examples of indicators obtained are reported and discussed in Section 4.
4.6 Results
Figure 24 illustrates the list of important general issues defined for a Buncefield-like oil depot, on the
basis of which a set of 33 indicators was produced. The Tables 18-21 show the Resilience-based Early
Warning Indicators grouped on the basis of the related CSFs and general issues. Since risk awareness
is a fundamental aspect for the prevention of atypical accident scenarios, a larger number of
indicators aiming at the improvement of this resilience attribute were obtained. From the
comparison with the actual failures that led to the Buncefield accident (and to similar ones) new
indicators were added to the candidate ones. These are shown in italic.
87
Resilience
attributes
Risk
Awareness
Response
Capacity
Support
Risk understanding
Anticipation
Attention
Response
Robustness
Resourcefullness
/rapidity
Decision
support
Redundancy
System
knowledge
Risk /
hazard ID
Process
disturbances
Training
Comm.
between
actors
Resource
allocation &
staffing
Decision
support
staffing
Info.
Processing
redundancy
Information
about risk
Learn from
own
experience
Bypass of
control
Decision
ability
Reporting
of incidents
Learn from
other’s
experience
Simult.
operations
Info about
quality of
barriers
Criteria for
safe
operation
Changes
Safety
performance
matters
Comm. risk /
resilience
Figure 24 List of important general issues defined for a Buncefield-like oil depot
88
Table 18 List of Resilience based Early Warning Indicators related to risk awareness / risk understanding
obtained for a Buncefield-like case
Risk Awareness
Contributing
Success factor
General issue
Indicator
1. Average no. of years experience with such
systems
System knowledge
2. Average no. of years experience with this
particular system
3. Portion of operating personnel receiving system
training last 3 months
Information
about
risk through e.g.
Courses
&
doc.
(HAZOP, QRA,...)
4. Portion of operating personnel taking risk courses
last 12 months
5. No. of violations to assumptions/limitations in the
risk analysis (QRA)
6. No. of accidents last 12 months
Risk Understanding
Reporting
of
incidents, near misses
and accidents
7. No. of incidents last 12 months
8. No. of near misses last 12 months
Information
about
the quality of barriers
9. No. of internal audits/inspections covering
technical safety last 6 months
10. No. of internal audits/inspections covering
operational safety last 6 months
Safety performance
matters requested by
senior management
11. No. of HSE initiatives taken by senior
management
Communicating
risk/resilience at all
levels
of
the
organization
12. Portion of company actively using the risk
register
89
Table 19 List of Resilience based Early Warning Indicators related to risk awareness / anticipation and
attention obtained for a Buncefield-like case
Risk Awareness
Contributing
Success factor
Contributing Success
factor
Contributing Success factor
13. Portion of operating personnel participated in
HAZID
Risk/hazard
identification
14. Fraction of operational procedures that have
been risk assessed
(HAZID, ...)
15. No. of reviews of safety reports in the last 5 years
Anticipation
Learn from
experience
accidents
own
&
Learn from other’s
experience
&
accidents
Process disturbances;
control and safety
system actuations
16. Fraction of internal past events considered in
safety report review
17. Fraction of external past events considered in
safety report review
18.
No.
of
alarms
disabled
acknowledgment) during last month
(without
19. Fraction of sensible data related to a unique
process line controlled by one supervisor
Bypass of control and
safety functions
20. No. of unauthorized bypasses/overrides during
last 3 months
Activity
level
simultaneous
operations
21. Maximum no. of simultaneous operations last
month
Attention
/
Changes: technical,
process,
organizational,
external
22. No. of changes/modification of technical
equipment last month
23. No. of organizational changes last 3 months
90
Table 20 List of Resilience based Early Warning Indicators related to Response Capacity obtained for a
Buncefield-like case
Response capacity
Contributing
Success factor
Contributing Success
factor
Training (simulators,
table-top,
preparedness,...)
Response
Robustness
response)
(of
Resourcefulness /
rapidity
Contributing Success factor
24. No. of emergency preparedness exercises last 3
months
25. No. of different accident scenarios included in
exercises last month
Ability
to
make
(correct) decisions
26. Average no. of available support functions /
contacts during critical decisions
Communication
between
actors
(interface control)
27. No. of cases in which communication between
actors has been inadequate
Adequate resource
allocation
and
staffing (incl. buffer
capacity)
28. Amount of overtime worked
29. No. of cases where responses / actions have
been transferred to next shift
91
Table 21 List of Resilience based Early Warning Indicators related to Support obtained for a Buncefieldlike case
Support
Contributing
Success factor
Contributing Success
factor
Contributing Success factor
Adequate
decision
support
staffing
(availability
&
knowledge
/
experience)
30. No. of cases with inadequate decision support
last 9 months
Decision support
Criteria
for
safe
pipeline
operation
well defined and
understood
Redundancy
support)
(for
Redundancy
information
processing
in
31. No. of simulations where criteria for safe
operation have been exceeded
32. Fraction of simulations where operators have
tolerated exceedance of criteria
33. Portion of support decisions checked / verified
by independent experts
92
From the application of the Dual Assurance method a set of 26 indicators was defined, 11 of which
are lagging indicators and 15 are leading indicators. Eleven different RCSs were considered. The
comparison with the actual failures that led to the Buncefield accident (and similar ones) resulted
only in a few changes of the definition of indicators. These changes are shown in italic in the Tables
22 and 23, which list the Dual Assurance indicators obtained.
Table 22 List of Dual Assurance indicators obtained for a Buncefield-like case
Lagging indicator
Leading indicator
1. No. of unexpected LOCs due to failure of
flexi hoses, couplings, pumps, valves, flanges,
fixed pipes, bulk tanks or instrumentation
4. No. of times product transfer does not
proceed as planned due to errors made by
staff without the necessary understanding,
knowledge or experience to take correct
actions
5. No. of incidents occurred within (or
consequently to) maintenance actions or
inspections due to lack of understanding,
knowledge or experience to take correct
actions
Instrumentation
and alarms
7. No. of times product transfer does not
occur as planned due to incorrect/unclear
operational procedures
9. No. of safety critical instruments/ alarms
that fail to operate as designed, either in use
or during testing
Plant change
Operating
procedures
Staff competence
Inspection &
maintenance
RCS
12. No. of incidents involving loss of
containment of hazardous material or fire/
explosion due to failure of flexi hoses,
couplings, valves, pumps, fixed pipes, bulk
tanks, where plant change was found to be a
contributory factor
93
2. Percentage of safety critical plant/
equipment that performs within specification
when inspected
3. Percentage of maintenance actions
identified that are completed to the specified
timescale
6. Percentage of staff involved in successful
high-competence tasks
8. Percentage of procedures that are
reviewed and revised within the designated
period
10. Percentage of functional tests of safety
critical instruments and alarms completed to
schedule
11. Percentage of maintenance actions to
rectify faults to safety critical instruments
and alarms completed to schedule
13. Percentage of plant change actions
undertaken where an adequate risk
assessment was carried out before change
14. Percentage of plant change actions
undertaken where changes/ outcomes were
documented
Leading indicator
Plant design
RCS
15. No. of plant breakdowns or incidents
involving loss of containment of hazardous
material or failure of safety critical plant/
equipment where deficiency in plant design
was found to be a contributory factor
16. On a periodic basis: percentage of safety
critical items of plant or equipment which
comply with current design standards, codes
and best technology option
17. No. of times overfilling occurs due to a
breakdown in communication systems
19. Percentage of product transfers where
confirmation of start and rate of transfer
were successfully completed before
commenced
18. No. of times accidental releases occur due
to breakdown in communication systems
20. Percentage of post-transfer checks
undertaken to confirm that pumps have
stopped and valves are isolated or closed
Emergency
arrangements
Permit to work
Lagging indicator
Communication
Table 23 List of Dual Assurance indicators obtained for a Buncefield-like case
21. Number of incidents where plant/
equipment could be damaged due to failure
to control high-risk maintenance activity
22. Percentage of permits to work issued
where the hazards, risks and control
measures were adequately specified
23. Percentage of work conducted in
accordance with permit conditions and where
completion of work has been demonstrated
25. Percentage of shutdown/ isolation
systems that functioned to the desired
performance standard when tested
24. No. of elements of the emergency
procedure that fail to function to the
designed performance standard
26. Percentage of staff/ contractors trained in
emergency arrangements
94
From the application of the ER KPI method a set of 49 indicators was defined. The indicators are
listed in the Tables 24-26 and grouped on the basis of 3 main ERIs of LNG regasification technologies
(identified elsewhere (Uguccioni 2010)):

Lack of understanding of atypical risk scenarios for LNG terminals

External Hazards

Lack of common criteria across the countries
Moreover each table refers to an ERMF dimension. The Human Management dimension is not
present because it was not considered relevant in the context in which the analysis was initially
carried out (iNTeg-Risk project).
Table 24 List of Emerging Risk Key Performance Indicators related to the ERMF dimension of
“Technology/technical” obtained for new and alternative technologies for LNG regasification
ERI
Indicator
1. No. of qualified scenarios per item/hazard
2. No. of potential scenarios (or threats) per item
3. No. of qualified specific frequency data sets per item
4. No. of qualified standardized frequency data sets per item
Lack of understanding of
atypical risk scenarios for
LNG terminals
5. No. of qualified specific models per category of accidental scenarios
needing a qualified model
6. Ratio: No. of qualified scenarios per item over No. of potential
scenarios (or threats) per item
7. Ratio: No. of qualified standardized frequency data sets per item over
No. of qualified standardized frequency data sets per item in reference
non-emerging sector
8. No. of qualified specific models per category of accidental scenarios
9. Fraction of “perceived” potential scenarios for by the average
population covered by qualified scenarios
10. No. of qualified external hazards per item/plant
11. No. of qualified external hazards per category of hazard (natural
events, malicious acts and domino effects, etc.).
12. No. of qualified assessment models per each type of external hazard
13. No. of qualified scenarios per each type of external hazard
External Hazards
14. Ratio: No. of qualified external hazards per item/plant over No. of
potential external hazards per item/plant
15. Ratio: No. of qualified scenarios for external hazards over No. of
potential external scenarios for external hazard
16. Ratio: No. of qualified assessment models per each type of external
hazard over No. of generic models proposed
95
Table 25 List of Emerging Risk Key Performance Indicators related to the ERMF dimension of
“Governance/Communication” obtained for new and alternative technologies for LNG regasification
ERI
Indicator
17. No. of qualified external hazards per item/plant
18. No. of qualified assessment models per each type of external hazard
19. International standards concerning external hazards
20. Availability of standard criteria for external hazards
21. Existence of relevant regulation for external hazards
External Hazards
22. Ratio: No. of qualified external hazards per item/plant over No. of
potential external hazards per item/plant
23. Ratio: No. of qualified assessment models per each type of external
hazard over No. of generic models proposed
24. Issues/items not covered by existent relevant standards
25. Issues/items not covered by existent relevant regulation
26. No. of specific hazard/risk assessment techniques per type of
installation
27. Existence of relevant standards
28. Existence of relevant regulation
Lack of common criteria
across the countries
29. Relevant issues not covered by current relevant standards
30. Relevant issues not covered by current relevant regulation
31. Ratio: No. of relevant regulations per type of installation over total
No. of relevant regulations
32. Ratio: No. of relevant standards per type of installation over total No.
of relevant standards
96
Table 26 List of Emerging Risk Key Performance Indicators related to the ERMF dimension of “Policies/
Regulation/Standardization” obtained for new and alternative technologies for LNG regasification
ERI
Indicator
33. No. of qualified scenarios per item/hazard
34. No. of potential scenarios (or threats) per item
35. No. of qualified specific models per category of accidental scenarios
needing a qualified model
36. No. of specific hazard/risk assessment techniques per type of
installation
Lack of understanding of
atypical risk scenarios for
LNG terminals
37. No. of “perceived” potential scenarios for by the average population
38. No. of qualified media entries on the topic
39. No. of “unfair” and/or “alarmist” media entries on the topic
40. No. of relevant standards per type of installation
41. Ratio: No. of qualified scenarios per item over No. of potential
scenarios (or threats) per item
42. No. of “perceived potential scenarios” by the average population that
are not qualified scenarios
43. No. of qualified external hazards per item/plant
44. No. of qualified external hazards per category of hazard (natural
events, malicious acts and domino effects, etc.).
45. No. of qualified assessment models per each type of external hazard
External Hazards
46. No. of relevant standards
47. No. of relevant regulations
48. No. of relevant regulations per type of installation
49. Fraction of standardized or regulated external hazards that are
qualified external hazards
4.7 Discussion
4.7.1 Comparison of REWI and DA indicators with actual accident failures
While the application of the ER KPI method produced results that seem to effectively cover the
emerging risks analysed, but have no direct confirmation, the application of the first two methods to
a Buncefield-like case demonstrates that they have a good capacity to tackle most of the failures
which led to an atypical accident such as the one at Buncefield (or the similar ones considered).
97
4.7.1.1 Resilience based Early Warning Indicators
The REWI general issues considered in this study are directly related to the underlying organizational
aspects illustrated in Figure 6, whose failure has favoured the occurrence of the Buncefield accident.
In fact risk awareness is one of the resilience contributing factors, which are in turn the cornerstones
of the method. All the indicators listed in the Table 18 directly or indirectly aim to increase risk
awareness in the company as a way to obtain a resilient organization.
Many features of knowledge management are dealt with, such as the general issue of system
knowledge, which was lacking both by the senior management and the workforce. A clear example is
that the actual IHLS functioning was ignored within the tank farm (HSE 2011a). Indicators 1, 2 and 3
(Table 18) were defined to consider this general issue. Indicator 2 should specifically address
specialized workers (or contractor companies) assigned to a particular task, such as the Motherwell
Control Systems company, in charge of the IHLS installation at Buncefield (HSE 2011a).
Information about risk is fundamental to enhance knowledge management in the perspective of
prevention of atypical scenarios. For this reason indicators 4 and 5 (Table 18) were chosen.
Information about the quality of barriers, changes introduced (technical, process, organizational,
external) and process disturbances (control and safety system actuation) help to tackle latent and
unidentified or disregarded risks. For instance, the ATG system had been stuck 14 times between
August 31, 2005 and December 11, 2005. Sometimes this was logged as a fault by the supervisors
and other times it was not. Moreover, Motherwell staff never considered that the gauge should be
investigated, even if they had been frequently called to rectify the matter (HSE 2011a). This
demonstrates the importance of audit and inspections of both technical and operational safety and
for this reason indicators 9 and 10 (Table 18) were selected. Indicator 19 (Table 19) was added to the
set of candidate indicators in the second phase of the analysis to address the capability of
supervisors to have a general overview of data of single process lines. It refers to the impossibility of
Buncefield supervisors to have access to the SCADA monitoring system of some depot pipelines due
to historical reasons, forcing them to exclusively rely on ATG controls (HSE 2011a). Similarly the
indicator 22 (Table 19) is proposed to cover one of the causes of the Saint Herblain accident (1991) in
Table 7, where a rubber joint guaranteed by the manufacturers to aromatic concentrations of a
maximum of 30 % ruptured the first day of an operational change to unleaded gasoline containing 55
% of aromatics (Lechaudel and Mouilleau 1995).
However, the indicators address factors not only contributing to the occurrence of “Unknown
Unknown” events, but also to “Unknown Known” events, aiming to achieve a better and
comprehensive process of identification of accident scenarios. Reporting of incidents, near misses
and accidents and learning from own and other’s experience should help to deal with the process of
learning from past experience. For this reason, indicators 6, 7, 8 (Table 18) and 17 (Table 19) were
added to the set of candidate indicators in the second phase of the analysis. Risk/hazard
identification (HAZID, ...), specifically refers to the improvement of HAZID processes, which is the
basic issue on which the DyPASI methodology is based. The indicators 13, 14 and 15 (Table 19)) in
this case focus on the presence of a concerted HAZID process, on its completeness and on its
updating, considered as effective elements of enhancing this fundamental aspect of risk
management. Regarding the aspect of updating, the Seveso-II Directive (Council Directive 1996)
imposes to review and update the mandatory safety reports, including hazard identification, at least
every 5 years. For this reason indicator 15 was added to the set of candidate indicators.
Finally the aspect of communication is monitored by indicator 12 (Table 18), which is related to the
organizational issue of “communicating risk/resilience at all levels of the organization”. This indicator
should help to strengthen risk awareness and knowledge management in a company.
98
4.7.1.2 Dual Assurance Indicators
The Dual Assurance method basically focuses on operability failures related to some relevant Risk
Control Systems (RCSs). The RCSs considered had a primary role in the accidents at Buncefield (and in
similar others - see Table 7). For instance, effective inspection and maintenance could have
prevented events leading to an atypical accident in a Buncefield-like depot, such as the LOCs that
occurred in Houston (1962) and St Herblain (1991) (Table 7) (Lechaudel and Mouilleau 1995, MIIB
2008). Indicator 1 (Table 22) would be able to register the possibility of this kind of LOCs and, above
all, indicator 2 could have been an early warning for them. This method is able to address failures of
instrumentation and alarms, such as the ATG and IHLS systems, which were the direct causes of the
loss of primary containment at Buncefield. In fact, a lagging indicator monitoring this kind of failures
(indicator 9 Table 22) and a leading indicator (indicator 11 Table 22) monitoring maintenance actions
were defined by this method and could have been potentially able to cover the ATG cases of
malfunctioning with no appropriate investigation (HSE 2011a).
Other technical aspects are coped with by indicators related to plant design. The tank design had an
important role in the accident at Buncefield, leading to the formation of a large flammable cloud.
This would be an event registered by indicator 15 (Table 23). Indicator 16 (adapted in the second
phase of the analysis) would have given an early warning before the occurrence of the accident at
Newark (1983) (Table 7), where storage tanks were not equipped with automatic level controls, but
just checked by sight. Thus, the safety system, even if complying with the design standards, had not
adopted the best technological option available at the time (OSHA 1983).
Indicators 5 and 6 (Table 22) address one of the several sides of the general concept of knowledge
management, which is the staff competence, whose lack mainly caused the failure of IHLS. Indicators
7 and 8 (Table 22) about operating procedures could effectively help to compensate potential lack of
knowledge of personnel.
Good communication is essential in every aspect of site management. In this particular case indicator
19 (Table 23) could have covered the difficulties encountered by the Buncefield supervisors to know
data related to product transfer (HSE 2011a), while indicator 20 (Table 23) might have prevented a
valve to be left open at the Jaipur oil depot (Table 7), from which the accidental release of gasoline
developed (Indian Oil Corporation, 2009).
Finally indicators 21 and 23 (Table 23) about the permit to work allow keeping the conditions of work
under control and at the same time may give an early warning concerning the cases of negligence at
work, such as those related to handling flammable substances encountered at Naples and Newark
before the accidents (see annex I).
The only underlying failure shown in Figure 6 and not directly tackled by this method is risk
awareness. Nevertheless, as demonstrated by Weick and Sutcliffe (1999), collection of early warnings
and an appropriate dissemination of information may encourage an ongoing dialogue about safety in
an organization, even out of the formal prevention activities, resulting in a greater awareness of
what can go wrong and in a greater willingness to discuss potential risks.
4.7.2 Emerging Risk Key Performance Indicators
None of the indicators developed through the ER KPI method and shown in the Tables 24-26 monitor
past events, but they all have a proactive approach to the issue of emerging risks related to LNG
regasification technologies. For instance, they address the ERI of “lack of understanding of atypical
risk scenarios for LNG terminals” monitoring the number of qualified and potential accident
scenarios per item (indicators 1 and 2 Table 24) and their ratio (indicator 6 Table 24), which can have
the role of early warning for the identification of accident scenarios commonly not considered in
safety reports (atypical scenarios). The aspect of the availability of specific and standardized
frequency data sets is not disregarded (indicators 3 and 4 Table 24) and a thorny factor like the
99
perception of potential accident scenarios by the average population is highlighted by indicator 9
(Table 24). The approach to this ERI well agrees with the action of prevention of “Unknown Known”
events previously described.
The approach to the other two ERIs (“External Hazards” and “Lack of common criteria”) is itself a
prevention of phenomena indirectly related to atypical scenarios and can instil the appropriate safety
culture within an organization. In particular the lack of common criteria can act on the organization
preparedness by showing a lack of official standards and regulations (indicators 27-32 Table 26) and
urging the organization to take due precautions.
However, despite the ER KPI method should in principle develop indicators for the integrated
management of emerging risks (iNTeg-Risk 2009), including the societal, cultural and governance
aspects defined within the iNTeg-Risk Framework, this particular application has partially disregarded
the underlying conditions described in section 2, whose prevention would lower the occurrence
probability of “Unknown Unknown” events. In fact, the human and organizational factors were not
directly addressed and the ERMF dimension of “Human management” itself was omitted. This is
maybe due to different aims in the iNTeg-Risk task (iNTeg-Risk 2009) referring to the analysis of
emerging risks in LNG regasification technologies and to the fact that these are preliminary results
and the study is still ongoing.
4.7.3 Synergy between the three methods and DyPASI
Sets of indicators which are directly relevant as early warning can be obtained from all the three
methods. This allows a more proactive approach in risk management independently of the actual
occurrence of events. A positive influence on the organization may thus be obtained, opening a
discussion on potential risks and increasing general risk awareness. In particular the REWI method
focused on positive signals (what went right) by means of an analysis of contributing success factors
and the ER KPI method focused on emerging risks as a diagnostic tool for accident prevention.
Nevertheless, the reactive approach is not completely disregarded and some indicators can help to
monitor and learn from previous events.
Inherent differences in scope and in the detail of the analysis of the methods became evident in the
application. The Dual Assurance method narrows the scope to operability failures related to some
systems/activities and not to a complete installation, while the resilience based approach mainly
addresses organizational aspects related to the entire installation and to all its risks. In this last case
the deficiencies to search for occur early in the accident casual chain, at a point where human,
organizational and cultural factors play a significant role. Hence, in order to prevent the occurrence
of unexpected atypical scenarios, the REWI method aims to “destabilize the less desirable patterns
and stabilize the more desirable ones by seeding the space” (Kurtz and Snowden 2003) in a proactive
way of operation, similar to the approach of prevention of “Unknown Unknown” events previously
described. Similarly the ER KPI method should act on different levels of risk management, without
disregarding both the technical (“Technology/ technical” dimension) and the human/ organizational
(“Human management” and “Governance/ Communication” dimensions) factors.
100
5
REWI
Dependence to DyPASI
4
3
DA
REWI
DA
2
KPI
1
KPI
0
UA4
RA
OF8
0
12
0
1
2
3to DyPASI
4
Complementarity
5
Figure 25 a) Comparison between the REWI, Dual Assurance (DA) and ER KPI methodologies on the
basis of their Updating Ability (UA), focus on Risk Awareness (RA) and Organizational Factors (OF). b)
Assessment of Dependence and Complementarity to DyPASI of the safety indicator methodologies
considered.
Figure 25a illustrates some features of the methodologies assessed, which are fundamental for a
proper prevention of atypical events, in particular of “Unknown-Unknown” events. For this reason
Figure 25a describes the Updating Ability (UA) of each safety indicator methodology. The ability of
being up-to-date reduces the possibilities that early warnings are not taken into account and
positively affect the Risk Awareness (RA - in Figure 25a) of workforce and management. Risk
awareness affects in turn the general organization and tends to avoid most of the organizational
conditions (Organizational Factors - OF in Figure 25a) that indirectly promote atypical accident
scenarios.
All the methodologies have a good updating ability (Figure 25a) because they all consider a process
of review in their procedures Figure 23, but REWI is the only methodology which can develop an
indicator explicitly addressing the review of the HAZID process (REWI indicator 15 Table 19). Both the
REWI and ER KPI methodologies properly cover the aspect of risk awareness: the first because it
considers risk awareness as a cornerstone of resilience (Øien et al. 2010a, Øien et al. 2010b) and the
REWI indicators 1-23 (Tables 18 and 19) should lead to it by accomplishing their respective CSFs (Risk
understanding, Anticipation, Attention); the latter because it employs several indicators in measuring
HAZID-related aspects in order to address the ERI of “Lack of understanding of atypical risk scenarios
for LNG terminals”, which should directly increase risk awareness within the organization. The Dual
Assurance methodology, even though it produces leading indicators, can not properly address the
aspect of risk awareness and, more in general, all the underlying organizational factors that lead to
an atypical scenario. The ER KPI methodology can potentially cover organizational factors, because it
was created to comprehensively manage emerging risks and refers to the four different dimensions
of ERMF (Friis-Hansen et al. 2010), but in this case, as already shown, the indicators obtained
partially overlook this aspect by disregarding the ERMF dimensions of Human management. The
REWI methodology proves to be the best methodology to tackle organizational factors.
Finally, in a perspective of prevention of atypical scenarios, the relation between DyPASI and the
safety indicator methodologies must be discussed. In fact, one of the most relevant differences
between the Dual Assurance method and the other two methods is the complete dependence of the
first and the synergy of the others with respect to DyPASI, as described by Figure 25b, where only DA
101
and REWI are shown. When applying the Dual Assurance method, accident scenarios and their
immediate causes have to be defined in order to identify the most important RCSs. For Seveso sites,
this can be carried out by means of the information contained in the official safety reports, as
explicitly affirmed also in the official HSE guidance (HSE 2006). Thus, despite the results of this study
demonstrate that the Dual Assurance method could improve the prevention of atypical accident
scenarios by the identification of early warnings, its actual effectiveness ultimately depends on the
HAZID technique's ability to identify and capture the relevant accident scenarios.
On the contrary, the ER KPI method and, most of all, the REWI method aim to early identify poor
knowledge management or deficient hazard identification, in order to awake risk awareness in the
company and implement corrective actions. This may trigger the application of a tool to improve and
update knowledge management and the HAZID processes, such as DyPASI. The relation between the
DA and the REWI methods can be better described by Figure 26. Figure 26a shows the
complementarity but also the dependence on DyPASI demonstrated by the DA method. Figure 26b
mirrors the complementarity to DyPASI associated with the characteristics of reiterability and
dynamicity shared by both REWI and DyPASI.
a)
Dual
Assurance
indicators
DyPASI
b)
DyPASI
REWI
Figure 26 a) Method steps of the REWI method. b) method steps of the Dual Assurance method
4.8 Conclusions
Three methods for the development of early warning indicators were successfully applied to cases
where atypical accident scenarios were registered (Buncefield-like oil depot) or deemed probable
(new and alternative technologies for LNG regasification).
102
The development of indicators for a Buncefield-like oil depot was carried out in two distinct steps. In
a first step the actual definition of indicators, and in a second step a comparison with past atypical
events were carried out. This allowed limiting the influence and showing additions and changes due
to past experience of atypical scenarios. The indicators obtained demonstrated a general capacity to
cover direct and underlying causes of the atypical major accidents considered. They appeared to be
generally able to prevent this kind of accidents from happening, if in use. The methods do not strictly
depend on the occurrence of events, thus are also able to address the prevention of never previously
experienced events, the so-called “Unknown Unknown” events.
The development of indicators for new and alternative LNG regasification technologies mirrored an
effective approach to the issue of emerging risks, partially following the guidelines outlined within
the preliminary description of the method. In fact, the indicators obtained especially focused on the
identification of atypical scenarios and could lead to proactive actions of prevention by the
organization. However, due to the specific application within the iNTeg-Risk task the comprehensive
approach was partially disenchanted and the human and organizational dimension remained slightly
uncovered.
The three methodologies demonstrated different scopes and address different aspects of risk
management. The indicators defined using the Dual Assurance method mainly cover operability
failures of specific Risk Control Systems. The ER KPI method should comprehensively address the
process of emerging risk management in all of its dimensions. Whereas the REWI method, by
definition, focuses on the organizational level, monitoring failures and promoting acts aiming to a
resilient system. The main difference is between the Dual Assurance method and the REWI method
and concerns the issue of hazard identification, which is fundamental for the prevention of atypical
accident scenarios. Despite its proven effectiveness, the Dual Assurance method was found to strictly
depend on results from the HAZID process. A lack or flaw in the HAZID process would affect all the
subsequent analyses, and an unrecognised (atypical) scenario would not be properly tackled by
indicators.
The REWI method showed a good capacity in focusing on underlying organizational aspects, which
creates a fertile ground for any atypical accident scenario to develop, such as risk knowledge and
awareness. REWI indicators allow keeping these factors under surveillance, to identify potential
deviations and to undertake appropriate corrective actions. The application and reiteration of DyPASI
(or of other improved HAZID techniques) could be one of the corrective actions aiming to enhance
risk knowledge management in general, and hazard identification in particular. REWI is not
dependent on the specific HAZID outcome. It is complementary to the result of HAZID and supports
risk appraisal through a parallel and comprehensive action of organizational improvement. A mutual
activity of prevention using these two methods (REWI and DyPASI) would be an effective strategy in
which human, organizational, cultural and technical factors are addressed by an integrated approach.
103
104
Section 5
General conclusions
105
5.1 Characteristics of atypical accident scenarios
The accident analysis carried out on two representative examples of major atypical accidents such as
the accidents at Toulouse (2001) and Buncefield (2005) allowed outlining the main characteristics of
an atypical accident scenario:

An atypical accident scenario is by definition a scenario not captured by standard risk analysis
processes and common HAZard IDentification (HAZID) techniques because deviating from
normal expectations of unwanted events or worst case reference scenarios. In fact, the
accident scenarios occurred at Toulouse and Buncefield were not considered by the site
safety reports and the application of a well-known methodology such as MIMAH
demonstrated the inability of current HAZID techniques to capture the actual scenarios.
Atypical accident scenarios may be also related to new and emerging technologies, whose
scenarios are still not properly identified, and that may remain unidentified until they take
place for the first time. Examples of new and emerging technologies were found within the
fields of Liquefied Natural Gas (LNG) regasification and Carbon Capture and Storage, where a
lack of substantial operational experience leads to difficulties in identifying accurately the
potential hazards.

Atypical accident scenarios can be inferred by means of past events, experimental tests,
models or other specific tools such as monitoring indicators. These signals are called “early
warnings” and their interpretation and integration into HAZID analysis is a critic process, not
exempt from errors and misreading, and with very little feedback available. This was
demonstrated by the integration of the actual chain of events occurred at Toulouse and
Buncefield into MIMAH bow-tie diagrams, previously performed. Atypical events, about
which early warnings are available and collectable, were denominated “Unknown Known”
events, i.e. events we are not aware we (can) know.

An atypical accident is an articulated phenomenon not easily explainable event after its
occurrence. It consists in a rather low probable combination of events, which are in turn
facilitated by a set of factors (technical, human, organisational, societal) that cannot be all
defined as atypical themselves. However the identification of strong similarities between
direct and root causes of the various accidents considered, and the identification of
transversal failures, such as the organizational ones, allowed glancing a path to follow for
prevention of what have been defined as “Unknown Unknown” events, i.e. events we are
not aware we do not know. General actions of precaution and tackling underlying conditions
would reduce their occurrence probability.
The risk management cycle by M. Merad (2010) gave a valuable contribution within the assessment
of an approach to tackle the critical issue of atypical accident scenarios. In fact, the key element of
risk awareness was highlighted and identified as a fundamental factor in the learning process from
past lessons and early warnings in order to address “Unknown Knowns” and in the actions of
prevention of underlying causes in order to lower the occurrence probability of “Unknown
Unknowns”. For this reason several different methodologies were studied and assessed, in order to
identify the best options for a holistic approach to a multifaceted issue such as atypical accident
scenarios.
5.2 Approach to “Unknown Knowns”
On the basis of the results of the in-depth analysis performed, a new and advanced methodology
denominated DyPASI was built in the effort of mitigating the recognized deficiency of the current
HAZID techniques in the identification of atypical accident scenarios. The new technique aims at
providing a comprehensive overview of potential accident scenarios of the industrial process
106
analysed by a systematic collection and analysis of related early warnings. Thus, the main features of
DyPASI are its systematic nature, the enhancement of the knowledge management and its ability to
obtain complete and concise results. DyPASI features as a tool to support emerging risk management
process, having the potentiality to break “vicious circles” and triggering a gradual process of
assimilation and integration of “Unknown Known” atypical scenarios in the risk management
process. DyPASI was initially designed to support a well-known methodology, such as MIMAH.
However, it can be easily adapted and applied to integrate other bow-tie methodologies.
The new methodology was tested on complex processes of hazard identification applied to new and
alternative technologies for LNG regasification and Carbon Capture and Storage. Through this
application it was demonstrated that DyPASI is a valuable tool for a more complete and updated
overview of potential hazards compared to a conventional HAZID technique such as MIMAH. The
identification and investigation of emerging risks that tend to be disregarded by common HAZID
techniques was allowed by means of a systematic learning process from different categories of early
warning, such as scientific and technical reports, past accidents or growing social concern issues.
A representative example of atypical event related to LNG regasification and identified through the
application of DyPASI is the Rapid Phase Transition, which can lead to a physical explosion if LNG
comes into contact with water. This event was inferred from past events (CH·IV International 2006,
US EPA 2007), processed and fully reported within the bow-tie diagrams obtained as result of DyPASI
application. Moreover, an example of an atypical event related to CCS technology and inferred from
related studies by DyPASI is dispersion of high-concentration CO2, which can lead to important toxic
effects (and not exclusively to asphyxiation) (DNV 2009).
The HAZID analysis of CCS technologies was performed in parallel with another methodology: the
“Top-down” approach. This allowed the use of different perspectives and to carry out a comparison
of the two methods in order to find in which conditions one is more suitable than the other. In fact,
DyPASI should be preferred to the “Top-down” approach if early warnings are directly available in
literature, rather than suggested by experts. In fact, DyPASI has a higher potential to obtain
comprehensive results even when performed by a single analyst rather than by a team of experts.
5.3 Approach to “Unknown Unknowns”
Three methods for the development of early warning indicators were assessed in order to tackle the
issue of “Unknown Unknown” atypical events. The techniques have a proactive approach and should
address the general conditions that promote the occurrence of atypical accident scenarios.
Preventing the underlying causes of an atypical event would possibly lower the occurrence
probability of “Unknown Unknowns”. These methods are the REWI method, the DA method and the
ER KPI method and were applied to representative cases where atypical accident scenarios are
possible, as demonstrated by past events and by the analysis previously carried out.
In particular, the REWI and DA were applied to the Buncefield oil depot, while the ER KPI method was
applied to the LNG regasification technologies. The indicators developed by REWI demonstrated a
general capacity to cover underlying organizational causes of the atypical major accidents
considered, showing a better ability to address the prevention of never previously experienced
events compared with the others. In fact, the indicators developed by DA addressed more direct and
operational causes and partially disregarded background conditions, such as the organizational
dimension. Finally, the ER KPI method was applied to the LNG regasification technologies, with good
results in terms of prevention of atypical scenarios, because the indicators were developed to
specifically address the lack of understanding of atypical scenarios, but once again they were partially
lacking on the human/organizational level.
Finally, the main difference reported in the comparison between the three methods concerns their
possible dependence or complementarity with DyPASI. In particular DA and REWI are the
107
methodologies which most differ in their relation with DyPASI. The Dual Assurance method was
found to be strictly dependent on the HAZID process, which is not foolproof and could affect all the
subsequent analysis. On the contrary, the REWI method did not demonstrate to be particularly
dependent on the specific HAZID outcome, but complementary to the result of HAZID by supporting
risk appraisal through a parallel and comprehensive action of organizational improvement.
5.4 Holistic approach to atypical accident scenarios
This study allowed outlining an innovative approach to tackle atypical accident scenarios on more
levels in order to obtain a structured and complete prevention action.
A new and advanced technique for the identification of atypical accident scenarios (DyPASI) was
developed in order to be used as support to standard and widely applied HAZID methods, such as
bow-tie analysis. By means of this technique, comprehensive but concise overviews of potential
hazards related to the substance, the equipment or the process considered can be obtained. The
method allows considering and systematizing early warnings and past lessons and learning from
them, in order to integrate also the accident scenarios that are deviating from common expectations,
but can be classified as “Unknown Knowns”, into HAZID processes.
Moreover, a methodology complementary of the newly developed DyPASI was identified in order to
address the transversal and indirect causes identified by the accident analysis and which can be
mainly detected on the organizational level. By definition this methodology (REWI) addresses the
resilience capacity of an organization through the development of specific early warning indicators. It
allows keeping high the level of risk awareness, the response capacity and the general support in an
organization. The methodology also positively affects the HAZID process by monitoring its reliability
and updating its status. Thus, not only it lowers the occurrence probability of “Unknown Unknowns”
by tackling underlying organizational causes, but also it triggers the use of DyPASI requiring a more
reliable and updated HAZID analysis.
To conclude, the synergy of the REWI and DyPASI methods would be an effective strategy against
atypical accident scenarios in which human, organizational, cultural and technical factors are
addressed by an integrated approach.
108
References
109
Abbasi T, Abbasi SA, 2008. The boiling liquid expanding vapour explosion (BLEVE) is fifty and lives on!,
J. Loss Prev. Proc. Ind. 21 (4), pp. 485–487.
ACSNI, 1993. Human Factors Study Group, Third Report: Organising for Safety. Advisory Committee
on the Safety of Nuclear Installations, Health and Safety Commission.
Aimard N, Prebende C, Cieutat D, Sanchez-Molinero I, Tsiava R, 2009. The CO2 Pilot at Lacq - CO2
Capture, Transportation, Injection and Storage Ready for Start Up. 1st Oxyfuel Combustion
Conference. Cottbus, Germany.
Air Liquide, 2010. Safety data sheet – Carbon Dioxide. Air Liquide UK. First revised edition, Date 5
November 2010.
Atkinson G, Buston J, Salzano E, Dechy N, Van Wijk L, Joyce B, Cope M, Paltrinieri N, 2010. Atypical
Vapour Cloud Explosion type events, Deliverable D1.4.4.2 of EC project iNTeg-Risk, 7th FP, Grant:
CP-IP 213345-2.
Beal JP, 2007. The Facts about LNG, CH·IV International, Internal document RPT-06903-01, Hanover,
USA.
Bowden AR, Rigg A, 2005. Assessing Reservoir Performance Risk in CO2 Storage Projects. In: Rubin,
E.S., Keith, D.W., Gilboy, C.F.. (Eds.) Greenhouse Gas Control Technologies 7 Vol. I, pp. 683–691.
Elsevier Ltd.
Bradbury, J., Greenberg, S., Wade, S., 2011. Communicating the Risks of CCS. Global CCS Institute.
http://www.globalccsinstitute.com/publications/communicating-risks-ccs (04/09/2011).
Bradfield A, Wells GL, 2005. Not the same old hindsight bias: Outcome information distorts a broad
range of retrospective judgments. Memory & Cognition, 33: 120–130.
Bubbico R, Salzano E, 2009. Acoustic analysis of blast waves produced by rapid phase transition of
LNG released on water, Safety Science, vol.47, n. 4, pp 515-521.
Buston J, Van Wijk L, Dechy N, Joyce B, Watkins P, Cope M, Milner A, 2010. Description and analysis
of events leading to major atypical accidents. Deliverable D1.4.4.1, EC project iNTeg-Risk, 7th FP,
Grant: CP-IP 213345-2.
CCJ, 2011a. Statoil advice to ministry on Mongstad. Carbon Capture Journal.
http://www.carboncapturejournal.com/displaynews.php?NewsID=746&PHPSESSID=fc7s8abmjk0l
d7u1qe1ufvach6 (04/03/2011).
CCJ, 2011b. Statoil calls Bellona’s claims ’unacceptable’, Carbon Capture Journal.
http://www.carboncapturejournal.com/displaynews.php?NewsID=749&PHPSESSID=fc7s8abmjk0l
d7u1qe1ufvach6 (08/03/2011).
CCJ, 2011c. Bellona - needless postponement at Mongstad, Carbon Capture Journal.
http://www.carboncapturejournal.com/displaynews.php?NewsID=754&PHPSESSID=fc7s8abmjk0l
d7u1qe1ufvach6 (11/03/2011).
CCJ, 2011d. Aker and Kvaerner complete Mongstad amine plant, Carbon Capture Journal.
http://www.carboncapturejournal.com/displaynews.php?NewsID=801&PHPSESSID=93q47pj2vdr
0up0lehma2089t1 (21/03/2011).
CCJ, 2011e. Statoil starts technology qualification at Mongstad, Carbon Capture Journal.
http://www.carboncapturejournal.com/displaynews.php?NewsID=810&PHPSESSID=93q47pj2vdr
0up0lehma2089t1 (04/07/2011).
CCPS, 1989. Center for Chemical Process Safety, Guidelines for Chemical Process Quantitative Risk
Analysis, AIChE, New York.
110
CCPS, 1992. Center for Chemical Process Safety, Guidelines for Investigating Chemical Process
Incidents, AIChE, New York.
CCPS, 1994. Center for Chemical Process Safety, Guidelines for Evaluating the Characteristics of
Vapor Cloud Explosions, Flash Fires and BLEVEs, AIChE, New York.
CCPS, 2000. Center for Chemical Process Safety, Guidelines for Chemical Process Quantitative Risk
Analysis (second edition), AIChE, New York.
CCPS, 2001. Center for Chemical Process Safety, Layer of Protection Analysis: Simplified Process Risk
Assessment. American Institute of Chemical Engineers, AIChE, New York.
CEN 1996. European Commission for Standardization, EN1160, Installations and equipment for
liquefied natural gas - General characteristics of liquefied natural gas.
CH·IV International, 2006. Safety History of International LNG Operations – Technical Document,
Hanover, USA.
Chauvel A, Lefebvre G, 1989. Petrochemical Processes, Technical and Economic Characteristics, 1
Synthesis-Gas Derivatives and Major Hydrocarbons. Éditions Technip, Paris.
ChemIDplus, 2012. ChemIDplus, U.S. National Library of Medicine,
Tetrachlorodibenzodioxin, http://chem.sis.nlm.nih.gov/chemidplus/ (10/02/2012).
-
2,3,7,8-
Christensen TS, Primdahl II, 1994. Improve synthesis gas production using auto thermal reforming.
Hydrocarbon Processing, 39-46.
Citizens
2011.
Citizens
against
CO2
http://citizensagainstco2sequestration.blogspot.com/ (04/09/2011).
sequestration.
Clayton WE, Griffin ML, 1994. Catastrophic Failure of a Liquid Carbon Dioxide. Storage Vessel, Process
Safety Progress, 13, 202-209.
CNN, 2009. Puerto Rico firefighters work to contain massive fuel blaze,
http://edition.cnn.com/2009/WORLD/americas/10/23/puerto.rico.explosion/ (14/01/2011).
CONPRICI, 2010. Definition of the new iNTeg-Risk paradigm: description of the different risks,
emerging risks and the way of dealing with emerging risks including the interaction with relevant
stakeholders (T-H-C-R), Deliverable D.2.1.1.1 of EC project iNTeg-Risk, 7th FP, Grant: CP-IP
213345-2.
Council Directive, 1967. Council Directive 67/548/EEC of 27 June 1967 on the approximation of laws,
regulations and administrative provisions relating to the classification, packaging and labelling of
dangerous substances, Official Journal of the European Communities, L 196, Brussels, 16/8/1967,
pp 1–98
Council Directive, 1982. Council Directive 82/501/EEC of 24 June 1982 on the major-accident hazards
of certain industrial activities. Official Journal of the European Communities, L230, Brussels
05/08/82, pp 0001 - 0018.
Council Directive, 1996. Council Directive (EC) 96/82/EC of 9 December 1996 on the control of majoraccident hazards involving dangerous substances. Official Journal of the European Communities, L
010, Brussels 14/01/1997, pp 0013 - 0033.
Cox S, Cox T, 1991. The structure of employee attitudes to safety - a European example. Work and
Stress, 5:93-106.
Crawley F, Tyler B, 2003. Hazard Identification Methods, IchemE, Rugby.
111
Crawley F, Tyler B, 2003. Hazard identification methods. European Process Safety Centre. IChemE,
Rugby.
Croiset E, Thambimuthu K, 2000. Coal combustion in O2/CO2 mixtures compared with air. Canadian
Journal of Engineering, 78, 402-407.
Davison J, 2007. Performance and costs of power plants with capture and storage of CO2. Energy 32,
1163-1176.
Davison J, Thambimuthu K, 2004. Technologies for capture carbon dioxide. 7th International
Conference on Greenhouse Gas Control Technologies, Vancouver,. Canada.
Dechy N, Bourdeaux T, Ayrault N, Kordek MA, Le Coze JC, 2004. First lessons of the Toulouse
ammonium nitrate disaster, 21st September 2001, AZF Plant, France. Jounal of Hazardous
Materials, 111: 131-138.
Dechy N, Descourrières S, Salvi O, 2005. The 21st september 2001 disaster in Toulouse : an historical
overview of the Land Use Planning. In: Proceedings of the 28th ESReDA, Seminar on the
Geographical Component of Safety Management: Combining Risk, Planning and Stakeholder
Perspectives. Karlstad University, Sweden.
Dechy N, Dien Y, Llory M, 2008. Les échecs du retour d‘expérience : problématiques de la
formalisation et de la communication des enseignements tirés. In: Papiers de la conférence
Lambda-Mu 16 de l‘ImdR. Avignon.
Dechy N, Mouilleau Y, 2004. Damages of the Toulouse disaster, 21st september 2001, Proceedings of
the 11th International Symposium Loss Prevention 2004, Praha, 31 May - 3 June 2004. - RePublished in the Loss Prevention Bulletin n°179 of October 2004 (Icheme).
Delvosalle C, Fiévez C, Pipart A, 2004. Deliverable D.1.C, WP 1. EC project ARAMIS, 6th FP, Contract
number: EVG1 – CT – 2001 – 00036.
Directive, 2003. Directive 2003/105/EC of the European Parliament and of the Council of 16
December 2003 amending Council Directive 96/82/EC on the control of major-accident hazards
involving dangerous substances. Official Journal of the European Communities, L 345, Brussels
31/12/2003, pp 0097 - 0105.
DNV, 2009. Mapping of potential HSE issues related to large-scale capture, transport and storage of
CO2, Report No: 2009-1993. Det Norske Veritas AS, Høvik, Norway.
DOE/NETL, 2007. Cost and Performance Baseline for Fossil Energy Plants, Volume 1: Bituminous Coal
and Natural Gas to Electricity, Final report. DOE-National Energy Technology Laboratory,
Pittsburgh, USA.
Dooley JJ, Davidson CL, Dahowski RT, 2009. An Assessment of the Commercial Availability of Carbon
Dioxide Capture and Storage Technologies as of June 2009, prepared for the US Department of
Energy under Contract DE-AC05-76RL01830. Richland, Washington.
Eni 2004. Scheda dati di sicurezza – Gas Naturale, Eni S.p.A. Divisione Gas & Power, Revisione 04.
EREC, 2008. Energy (r)evolution. Greenpeace International, European Renewable Energy Council.
http://www.greenpeace.org/international/Global/international/planet-2/report/2005/10/energyrevolution-a-sustainab.pdf (04/09/2011).
Eskenazi B, Mocarelli P, Warner M, Needham L, Patterson DG, Samuels S, Turner W, Gerthoux PM,
Brambilla P, 2004. Relationship of Serum TCDD Concentrations and Age at Exposure of Female
Residents of Seveso, Italy, Environmental Health Perspectives, 112 (1).
112
ESReDA 2009. Guidelines for Safety Investigation of Accidents. Oslo, ESReDA - European Safety
Reliability and Data Association.
EU-OSHA, 2005. The European Agency for Safety
http://riskobservatory.osha.eu.int/risks/ (11/02/2012).
and
Health,
Risks
Observatory
EUROSTAT, 2011. Energy, transport and environment indicators, 2010 Edition, Publications Office of
the European Union, Luxemburg, ISBN 978-92-79-16303-6
FAS, 2007. Federation of America Scientists, Report for Congress, Maritime Security: Potential
Terrorist Attacks and Protection Priorities, USA.
Figueroa JD, Fout T, Plasynski S, McIlvried H, Srivastava RD, 2008. Advances in CO2 capture
technology. International Journal of Greenhouse Gas Control, 9-20.
Friis-Hansen P, Chin B, Tugnoli A, Cozzani V, Landucci G, Stramigioli C, Santarelli F, Van Wijk L,
Chalkidou A, Papadakis G, Pacaiova H, Nagyova A, Mazri C, Jovanovic A, Löscher M, Balos D, 2010.
Final Type A report for ERRA D1 – T1.5.1, Deliverable D1.5.1.1 of EC project iNTeg-Risk, 7th FP,
Grant: CP-IP 213345-2.
Gale J, Davidson J, 2004. Transmission of CO2—safety and economic considerations. Energy, 29,
1319-1328.
Glossop M, Ioannides A, Gould J, 2005. Review of hazard identification techniques, Health and Safety
Laboratory, Buxton.
Guldenmund FW, 2010. (Mis)understanding Safety Culture and Its Role in Safety Management. Risk
Analysis, 30: 1466-1480.
Hale AR, 2000. Culture’s confusions. Safety Science, 34:1-14.
Hendrick K, Benner L, 1987. Investigating Accidents with STEP, Marcel Dekker, New York, ISBN 08247-7510-4.
Herzog HJ, 2004. CO2 capture and storage: costs and market potential. 7th International Conference
on Greenhouse Gas Control Technologies. Vancouver,. Canada.
Hollnagel E, Woods DD, 2006. Epilogue: Resilience Engineering Precepts. In: Leveson N, Hollnagel E,
Woods DD. Resilience engineering: concepts and precepts. Aldershot: Ashgate, pp. 347 – 358.
Houston DEL, 1971. New approaches to the safety problem, in Major Loss Prevention in the Process
Industries, Symposium Series No. 34, Institution of Chemical Engineers, Rugby, UK, p. 210.
HSD, 2012. Hazardous Substances Databank, U.S. National Library of Medicine,– 2,3,7,8Tetrachlorodibenzodioxin, website: http://toxnet.nlm.nih.gov/cgi-bin/sis/search/ (10/02/2012).
HSE 2006. Developing Process Safety Indicators. HSE Guidance Series, HSG254. HSE, UK, ISBN
0717661806, http://www.hse.gov.uk/pubns/priced/hsg254.pdf (10/02/2012).
HSE 2011a. COMAH Competent Authority, Buncefield: Why did it happen?, HSE Books,
http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (11/02/2012).
HSE,
2011b.
General
hazards
of
Carbon
Dioxide,
http://www.hse.gov.uk/carboncapture/carbondioxide.htm (26/07/2011).
HSE
HSE,
2011c.
Technical
aspects
of
COMAH
http://www.hse.gov.uk/comah/sragtech/systemsindex.htm (03/08/2011).
guidance.
guidance.
HSE, EA, 2011. Health and Safety Executive and Environment Agency, Prosecution resulting from
Buncefield explosion, http://www.hse.gov.uk/news/buncefield/index.htm (18/10/2011).
113
Hultqvist D, Glausch M, Meyer H, Radunsky D, Witter T, 2009. Vattenfall Oxyfuel Power Plant
Development -Engineering of a Coal Fired Power Plant with Oxyfuel Technology. 1st Oxyfuel
Combustion Conference. Cottbus, Germany.
Husick LA, Gale S, 2005. Planning a Sea-borne Terrorist Attack, Foreign Policy Research Institute
(FPRI), USA.
IAEA, 1999. International Atomic Energy Agency, Management of Operational Safety in Nuclear
Power Plant. INSAG -13, International Nuclear Safety Advisory Group, International Atomic Energy
Agency, Vienna.
IEA GHG, 1999. The Reduction of Greenhouse Gas Emissions from the Cement Industry, PH3/7. IEA
Greenhouse Gas R&D Programme, Cheltenham, UK.
IEA GHG, 2000. Greenhouse Gas Emissions from Major Industrial Sources - IV, the Aluminium
Industry, PH3/23. IEA Greenhouse Gas R&D Programme, Cheltenham, UK.
IEA GHG, 2002. Opportunities for early application of CO2 sequestration technology. Report Ph4/10.
IEA Greenhouse Gas R&D Programme, Cheltenham, UK.
IEA GHG, 2010. Summary report of the IEAGHG workshop “Natural releases of CO2: building
knowledge for CO2 storage environmental impact assessments”. Maria Laach, Germany.
IEA GHG, 2011. Natural Releases of CO2. IEA greenhouse Gas R&D Programme. Cheltenham, UK.
www.ieaghg.org/docs/general_publications/naturalreleases.pdf (03/09/2011).
IEO, 2010. International Energy Outlook, Energy Information Administration, Office of Integrated
Analysis and Forecasting, U.S. Department of Energy, Report #:DOE/EIA-0484, Washington DC,
www.eia.doe.gov/oiaf/ieo/index.html (10/02/2012).
Indian Oil Corporation, 2009. Independent Inquiry Committee Report on Indian Oil Terminal Fire at
Jaipur, http://oisd.nic.in/uniquepage.asp?id_pk=22 (14/01/2011).
iNTeg-Risk, 2009. FP7 Project iNTeg-Risk Early Recognition, Monitoring and Integrated Management
of Emerging, New Technology Related Risks. Annex I (Description of Work) to Grant agreement
no. CP-IP 213345-2.
IOS, 2009. International Organization for Standardization, ISO 31000: Risk management - Principles
and guidelines, Geneva, Switzerland
IPCC, 2001. Mitigation, Contribution of Working Group III to the Third Assessment Report of the
Intergovernmental Panel on Climate Change. Cambridge University Press, Cambridge, UK.
IPCC, 2005. Special Report on Carbon Dioxide Capture and Storage. Cambridge University Press, New
York.
IRGC, 2009. International Risk Governance Council, Risk Governance Deficits. Geneva.
Jefferson M, Chung PWH, Rushton AG, 1995. Automated hazard identification by emulation of hazard
and operability studies. Proceedings of 8th International Conference on Industrial and Engineering
Applications of Artificial Intelligence and Expert Systems, Melbourne.
Jensen Associates, 2007. The outlook for global trade in liquefied natural gas projections to the year
2020, prepared for the California Energy Commission, CEC-200-2007-017.
Juvenal. Satires (VI, 165)
114
Kanniche M, Gros-Bonnivard R, Jaud P, Valle-Marcos J, 2009. Comparative Study of CO2 Capture in
the French Context. GHGT –9, Energy Procedia, 4103-4110.
Kaplan S, Garrick BJ, 1981. On The Quantitative Definition of Risk. Risk Analysis, 1:11-27.
Khan FI, Abbasi SA, 1998. Techniques and methodologies for risk analysis in chemical process
industries, Journal of Loss Prevention in the Process Industries 11, pp 261-277.
Kim ME, Reid RC, 1983. The Rapid Depressurisation of Hot, High-Pressure Liquids or Supercritical
Fluids. In: Paulaitis, M.E., (Ed.), Chemical engineering at supercritical fluid conditions. Ann Arbor
Science.
KM, 2006. Presentation to Canadian Association of Petroleum Producers (CAPP). Kinder Morgan.
Investment Symposium. http://www.capp.ca/raw.asp?x=1&dt=PDF&dn=104965 (22/08/2011).
Knudsen JN, Jensen JN, Vilhelmsen PJ, Biede O, 2009. Experience with CO2 capture from coal flue gas
in pilot-scale: testing of different amine solvents. Energy Procedia 1, 783-790.
Kohl AL, Nielsen RB, 1997. Gas purification. Gulf Publishing Co., Houston, Texas, USA.
Korens N, Simbeck DR, Wilhelm DJ, 2002. Process Screening Analysis of Alternative Gas Treating and
Sulphur Removal for Gasification. Revised Final Report. SFA Pacific, Inc., Mountain View,
California, USA.
Kurtz CF, Snowden DJ, 2003. The new dynamics of strategy: Sense-making in a complex and
complicated world. IBM Systems Journal, vol. 42, no. 3.
Lagadec P, 1994. La gestion des crises. Ediscience international, Paris.
Lechaudel JF, Mouilleau Y, 1995. Assessment of an accidental vapour cloud explosion, a case study :
Saint-Herblain, October, the 07th 1991, France, Proceedings of the 8th International Symposium
on Loss Prevention and Safety Promotion in the Process Industries, Anvers.
Lees FP, 1996. Loss Prevention in the Process Industries (second ed.), Butterworth-Heinemann,
Oxford, UK.
Linde, 2010. Safety data sheet – Carbon Dioxide. The Linde Group. Revision Date 25 August 2010.
Mannan MS, 2005. Lees’s loss prevention for the process industries Vols. I–III, Third Edition, Elsevier
Butterworth-Heinemann, Burlington, Massachusetts.
March JG, Sproull LS, Tamuz M, 1991. Learning from samples of one or fewer. Organization Science,
2(1): 1-13.
Marlair G, Kordek MA, 2005. Safety and security issues relating to low capacity storage of AN-based
fertilizers. Journal of Hazardous Materials, 123: 13-28.
McCoy SA, Crawley F, Chung PWH, 2004. An Expert User's Trail of the Hazid System for ComputerAided HAZOP Emulation. Proceedings of HAZARDS XVIII Symposium, IChemE, Manchester.
Merad M, 2010. Aide `a la decision et expertise en gestion des risques. Pans: Editions Tec&Doc,
Lavoisier, Paris.
MIIB 2008. Buncefield Major Incident Investigation Board, The Buncefield Incident 11 December
2005: The Final Report of the Major Incident Investigation Board: v. 1, HSE Books, ISBN-13: 978-07176-6270-8, http://www.buncefieldinvestigation.gov.uk/reports/volume1.pdf (10/02/2012).
Mohitpour M, Golshan H, Murray A, 2009. Pipeline Design & Construction: A Practical Approach.
ASME Press, New York, USA.
115
Nord LO, Anantharaman R, Bolland O, 2009. Design and off-design of a pre-combustion CO2 capture
process in a natural gas combined cycle power plant. International Journal of Greenhouse Gas
Control 3, 385-392.
Øien K, Massaiu S, Tinmannsvik RK, Størseth F, 2010a. Development of Early Warning Indicators
based on Resilience Engineering. PSAM 10, June 7-11 2010, Seattle, USA.
Øien K, Tinmannsvik RK, Haugen G, Keane L, Nielsen L, Buston J, Lisbona D, Wardman M, Wilday J,
2010b. Case specific early warning indicators, Deliverable D1.4.2.1, EC project iNTeg-Risk, 7th FP,
Grant: CP-IP 213345-2
Oldenburg CM, 2005. HSE Screening Risk Assessment for Geologic CO2 Storage Sites. Fourth Annual
Conference on Carbon Capture and Sequestration, Alexandra, Virginia, USA.
OPS, 2010. Pipeline and Hazardous Materials Safety Administration. Office of Pipeline Safety (OPS)
within the U.S. Department of Transportation. http://ops.dot.gov/stats/IA98.htm (Aug. 10, 2010).
Osborn AF, 1963. Applied imagination: Principles and procedures of creative problem solving. Charles
Scribner’s Sons, New York.
OSHA 1983. Texaco tank facility, Newark, N.J., Fire and explosion on January 7, 1983, Hearings before
the subcommittee on health and safety of the Committee on education and labor house of
representatives (XIIX congress).
Paltrinieri N, 2010. Generic risk analysis of the CCS chain – surface installations. Deliverable D1.2.1.1
of EC project iNTeg-Risk, 7th FP, Grant: CP-IP 213345-2.
Paltrinieri N, Wardman M. 2010. Hazard identification review and assessment of unknown risks.
Deliverable D1.4.4.3, EC project iNTeg-Risk, 7th FP, Grant: CP-IP 213345–2.
Paltrinieri, N., 2010. Generic risk analysis of the CCS chain – surface installations. Deliverable D1.2.1.1
of EC project iNTeg-Risk, 7th FP, Grant: CP-IP 213345-2.
Papadakis GA, Amendola A, 1997. Guidance on the Preparation of a Safety Report to meet the
requirements of Council Directive 96/82/EC (Seveso II), European Commission - Joint Research
Centre, Institute for Systems Informatics and Safety, Major Accident Hazards Bureau,
Luxembourg: Office for Official Publications of the European Communities.
Pettersen J, 2002. Experimental study on boiling liquid expansion in a CO2 vessel. 5th IIR Gustav
Lorentzen Conference on Natural Working Fluids, Guangzhou, China.
Phimister JR, Bier VM, Kunreuther HC, 2004. National Academy of Engineering, Accident Precursor
Analysis and Management: Reducing Technological Risk Through Diligence, The National
Academies Press, Washington DC.
Phimister JR, Bier VM, Kunreuther HC, 2004. National Academy of Engineering, Accident Precursor
Analysis and Management: Reducing Technological Risk Through Diligence. The National
Academies Press, Washington, DC.
Pidgeon N, O'Leary M, 2000. Man-Made Disasters: why technology and organizations (sometimes)
fail. Safety Science, 34:15-30.
Pitblado R, 2007. Potential for BLEVE associated with marine LNG vessel fires, Journal of Hazardous
Materials 140, pp. 527–534.
Planas-Cuchi E, Gasulla N, Ventosa A, Casal J, 2004. Explosion of a road taker containing liquefied
natural gas, J. Loss Prev. Process Ind. 17, 315–321.
116
Pliny the Younger. VI.16 To Tacitus. Letters.
PTCL, 2011a. Material safety Data Sheet for hydrogen sulfide, The Physical and Theoretical Chemistry
Laboratory Oxford University.
PTCL, 2011b. Material safety Data Sheet for hydrogen. The Physical and Theoretical Chemistry
Laboratory Oxford University.
PTCL, 2011c. Material safety Data Sheet for Oxygen, The Physical and Theoretical Chemistry
Laboratory Oxford University.
Rasmussen J, 1997. Risk management in a dynamic society: A modeling problem. Safety Science,
27(2/3):183–213.
Reason J, 1990. The contribution of latent human failures to the breakdown of complex systems.
Philosophical Transactions of the Royal Society (London), Series B, 327:475–484.
Reid RC, 1979. Possible mechanism for pressurized-liquid tank explosions or BLEVE's, Science 203, pp.
1263–1265.
Reid RC, 1983. Rapid Phase Transitions from Liquid to Vapor, Advances in Chemical Engineering,
Volume 12, Pages 105-208, ISBN: 9780120085125.
Renn O, 2005. White Paper on Risk Governance : towards an integrative approach. Geneve, IRGC –
International Risk Governance Council.
Shao R, Stangeland A, 2009. Amine used in CO2 capture, health and environmental impacts. The
Bellona Foundation.
Shell 2011. Material Safety Data Sheet – Natural Gas, Shell Chemicals, Version 1.7.
SINTEF, 2011. Building Safety in Petroleum Exploration and Production in the Northern Regions,
http://www.sintef.no/buildingsafety (15/07/2011).
SNL, 2004. Sandia National Laboratories, Guidance on Risk Analysis and Safety Implications of a Large
Liquefied Natural Gas (LNG) Spill Over Water, SAND2004-6258, Albuquerque NM, USA.
Spero C, 2009. Present Status of Callide: An Oxyfuel Project. 1st Oxyfuel Combustion Conference.
Cottbus, Germany.
Størseth F, Albrechtsen E, Eitrheim MHR, 2010. Resilient recovery factors: explorative study. Safety
Science Monitor, Vol. 14, Issue 2, Article 6
Symonds RB, Rose WI, Bluth GJS, Gerlach TM, 1994. Volcanic gas studies—methods, results, and
applications. Rev. Mineral, 30, 1–66.
Taleb NN, 2007. The Black Swan: The Impact of the Highly Improbable. Random House.
Tan Y, Douglas MA, Croiset E, Thambimuthu K, 2002. CO2 capture using oxygen enhanced combustion
strategies for natural gas power plants. Fuel, 81, 1007-1016.
Tierney JJ, 2003. Conceptualizing and Measuring Organizational and Community Resilience: Lessons
from the Emergency Response Following the September 11, 2001, Attack on the World Trade
Center, Disaster Research Center, Preliminary Papers, Nr. 329.
Uguccioni G, 2010. Package of: Reference solution containing documents, methods and tools, for the
assessment and management of emerging risks related to new and intensified technologies
available for LNG regasification terminals, Deliverable D1.2.4.1 of EC project iNTeg-Risk, 7th FP,
Grant: CP-IP 213345-2
117
United Nations, 2009. Globally Harmonized System of Classification and Labelling of Chemicals (GHS),
Third revised edition, New York and Geneva, ISBN: 92-1-117006-1.
US DoD, 2002. U.S. Department of Defense, Office of the Assistant Secretary of Defense (Public
Affairs).
News
Transcript,
February
12,
2002,
http://www.defense.gov/transcripts/transcript.aspx?transcriptid=2636 (10/02/2012).
US DOE, 1999. U.S. Department of Energy, Conducting Accident Investigations, Revision 2, DOE
Workbook, Washington DC, USA.
US EPA, 2000. Carbon Dioxide as a Fire Suppressant: examining the Risks. EPA430-R-00-002.
http://www.epa.gov/ozone/snap/fire/co2/co2report.pdf (23/08/2011).
US EPA, 2007. U.S. Environmental Protection Agency Region IX, Cabrillo Port Liquefied Natural Gas
Deepwater Port Final EIS/EIR – Appendix C3-1, San Francisco.
US EPRI 2000. U.S. Electric Power Research Institute, Guidelines for Trial Use of Leading Indicators of
Human Performance: The Human Performance Assistance Package, Palo Alto, CA, 2000
US EPRI, US DOE 2001. U.S. Electric Power Research Institute and the U.S. Department of Energy.
Final report on Leading Indicators of Human Performance, Palo Alto, CA, 2001
US GAO, 2007. U.S. Government Accountability Office, Maritime Security: Public Safety
Consequences of a Terrorist Attack on a Tanker Carrying Liquefied Natural Gas Need Clarification,
GAO-07-316.
Vaidhyanathan R, Venkatasubramanian V, 1995. Digraph-based models for automated HAZOP
analysis. Reliab. Eng. System Safety, 50:33.
Wall TF, 2007. Combustion processes for carbon capture. Proceedings of the Combustion Institute,
doi:10.1016/j.proci.2006.08.123.
Weick KE, Sutcliffe KM, Obstfeld D, 1999. Organizing for high reliability. Pp. 81–123 in Research in
Organization Behavior 21, Sutton RS, Staw BM. Eds. Stamford, Conn.: JAI Press.
Wickham Assoc., 2003. Review of the Use of CO2 Total Flooding Fire Extinguishing Systems, for U.S.
Environmental Protection Agency by. http://www.epa.gov/ozone/snap/fire/co2/co2report2.pdf
(Jul. 25, 2011).
Wilday J, Moonis M, Wardman M, Johnson M, 2009. Safety in Carbon Dioxide Capture, Transport and
Storage. Technical Report No 2009/6. IEA Greenhouse Gas R&D Programme, Cheltenham, UK.
Wilday J, Paltrinieri N, Farret R, Hebrard J, Breedveld L, 2011a. Addressing emerging risks using
carbon capture and storage as an example. Process Safety and Environmental Protection, 38, 482491.
Wilday J, Paltrinieri N, Farret R, Hebrard J, Breedveld L, 2011b. Carbon capture and storage: a case
study of emerging risk issues in the iNTeg-Risk project. Hazards XXII conference, Liverpool.
Wilday J, Wardman M, Johnson M, Haines M, 2011c. Hazards from carbon dioxide capture, transport
and storage. Process Safety and Environmental Protection, 38, 463-471.
Wildenborg T, Leijnse T, Kreft E, Nepveu M, Obdam A, 2005. Long-Term Safety Assessment of CO2
Storage: The Scenario Approach. In: Wilson, M., Morris, T., Gale, J., Thambimuthu, K. (Eds.),
Greenhouse Gas Control Technologies 7 Vol. II, pp. 1283–1287. Elsevier Ltd.
118
Woods D, Wreathall J, 2003. Managing Risk Proactively: The Emergence of Resilience Engineering,
Columbus. Ohio University.
Woods DD, 2006. Essential Characteristics of Resilience. In: Leveson N, Hollnagel E, Woods DD.
Resilience engineering: concepts and precepts. Aldershot, Ashgate, pp. 21-34.
Woodward JL, Pitbaldo R, 2010. LNG Risk Based Safety: Modelling and Consequence Analysis, John
Wiley & Sons, New Jersey, USA.
WRI, 2008. CCS guidelines, Guidelines for Carbon Dioxide Capture, Transport and Storage. World
Resource Institute, Washington, USA.
119
120
Annex I
Detailed analysis of atypical accident scenario
121
I.I Introduction
This annex shows the in-depth analysis of 5 atypical major accidents and the comparison of one of
them (Buncefield 2005) with similar and more recent accidents. All these studies were performed for
the case-study “Atypical major hazards/scenarios (post-Buncefield implications) and their inclusion in
the normal HSSE practice” within the framework of the EC project iNTeg-Risk and reported in the
following iNTeg-Risk deliverables:

Buston J, Van Wijk L, Dechy N, Joyce B, Watkins P, Cope M, Milner A, 2010. Description and
analysis of events leading to major atypical accidents, Deliverable D1.4.4.1, EC project iNTegRisk, 7th FP, Grant: CP-IP 213345-2.

Atkinson G, Buston J, Salzano E, Dechy N, Van Wijk L, Joyce B, Cope M, Paltrinieri N, 2010.
Atypical Vapour Cloud Explosion type events, Deliverable D1.4.4.2 of EC project iNTeg-Risk,
7th FP, Grant: CP-IP 213345-2.
In order to perform the analysis, information from official investigations and relevant articles was
collected in a common scheme, which allowed to obtain mutually comparable results. Authors and
main information sources are here shown for each study carried out.
Atypical major accident: Buncefield (United Kingdom) 11/12/2005
Author of the analysis: Nicola Paltrinieri
Main sources of information:

Buncefield Major Incident Investigation Board, 2008. The Buncefield Incident 11 December
2005: The Final Report of the Major Incident Investigation Board: v. 1, HSE Books, ISBN-13:
978-0-7176-6270-8,
http://www.buncefieldinvestigation.gov.uk/reports/volume1.pdf
(10/02/2012)

Johnson DM, 2010. The potential for vapour cloud explosions – Lessons from the Buncefield
accident, Journal of Loss Prevention in the Process Industries, Volume 23, Issue 6, November
Pages 921-927.

Atkinson G, Cusco L, 2011. Buncefield: A violent, episodic vapour cloud explosion, Process
Safety and Environmental Protection, Volume 89, Issue 6, Pages 360-370.

Herbert I, 2010. The UK Buncefield incident – The view from a UK risk assessment engineer,
Journal of Loss Prevention in the Process Industries, Volume 23, Issue 6, Pages 913-920.

Gant SE, Atkinson GT, 2011. Dispersion of the vapour cloud in the Buncefield Incident,
Process Safety and Environmental Protection, Volume 89, Issue 6, Pages 391-403.
Atypical major accident: Toulouse (France) 21/09/2001
Author of the analysis: Nicolas Dechy
Main sources of information:

INSPECTION GENERALE DE L’ENVIRONNEMENT : François Barthelemy (Ingénieur Général des
Mines), Henri Hornus (Ingénieur en chef des ponts et chaussées), Jacques Roussot
(Contrôleur général des armées en second), membre de l’IGE, et Jean-Paul Hufschmitt
(Ingénieur en chef de l’armement, Inspection des Poudres), Jean-François Raffoux (Directeur
scientifique de l’INERIS).
122

Usine de la société Grande Paroisse à Toulouse, Accident du 21 septembre 2001, rapport de
l’Inspection Générale de l’Environnement conjoint avec l’inspection des poudres et avec le
concours de l’INERIS, 24 Octobre 2001, affaire n°IGE/01/034 , IGE Main Report to download
on : http://www.ecologie.gouv.fr/

Loos F, Le Déaut JY, et al., 2002. Rapport N°3559 fait au nom de la commission d’enquête sur
la sûreté des installations industrielles et des centres de recherche et sur la protection des
personnes et de l’environnement en cas d’accident industriel majeur, enregistré le 29 janvier
2002 à l’Assemblée Nationale, Constitution du 4 Octobre 1958, onzième législature

Total internal investigation report : Macé de Lépinay A., Peudpièce J-B., Fournet H., Motte JC. , Py J-L. Domenech J., Lanelongue F., 2002. Commission d’enquête interne sur l’explosion
survenue le 21 septembre 2001 à l’Usine Grande Paroisse de Toulouse, point de situation de
travaux en cours à la date du 18 mars 2002, named in this paper the TotalFinaElf internal
investigation report.

Essig P, 2002. Débat National sur les Risques Industriels, Octobre-Décembre 2001, Report to
the Prime Minister.

Several report by the InVs (French National Institute on Health Monitoring),
http://www.invs.sante.fr.

Report of FFSA : Un an après la catastrophe de Toulouse, l’expérience et les propositions de
la FFSA
Atypical major accident: Newark (USA) 07/01/1983
Author of the analysis: Nicola Paltrinieri
Main sources of information:

Caufield JP, Kossup J, 1983. Report on the incident at the Texaco Company’s Newark storage
Facility 7th January 1983, Loss Prevention Bulletin.

Bouchard JK, 1983. Gasoline Storage Tank Explosion and Fire, Newark, New Jersey,
07/01/1983, 1 fatality, Summary Investigation Report, National Fire Protection Association.

OSHA 1983. Texaco tank facility, Newark, N.J., Fire and explosion on January 7, 1983,
Hearings before the subcommittee on health and safety of the Committee on education and
labor house of representatives (XIIX congress).

Bouchard JK, 1983. Overfill causes N.J. tank explosion, Fire Service Today.

Norman M, 1983. Tank Overflow Led to Newark Blast, Official Say, The New York Times,
11/01/1983.
Atypical major accident: Naples (Italy) 21/12/1985
Author of the analysis: Ernesto Salzano
Main sources of information:

Final Judgment Report of the Court of Napoli on the accident occurred in the fuel storage
area of Naples on December 21st, 1985.

Maremonti M, Russo G, Salzano E, Tufano V, 1999. Post-accident analysis of vapour cloud
explosions in fuel storage areas, Process Safety and Environmental Protection, Trans IChemE,
77, 360-365.
123

Russo G, Maremonti M, Salzano E, Tufano V, Ditali S, 1998. Vapor Cloud Explosion in a fuel
storage area: a case study, Proceedings of the 9th International Symposium on Loss
Prevention and Safety Promotion in the Process Industries, vol. 3, 1100-1110.

Tufano V, Maremonti M, Salzano E, Russo G, 1998. Simulation of VCEs by CFD Modelling: an
Analysis of Sensitivity, Journal of Loss Prevention in the Process Industries, 11, 169-175
Atypical major accident: Saint Herblain (France) 07/10/1991
Author of the analysis: Nicolas Dechy
Main sources of information:

INERIS accident investigation report for FINA France in 1992 : Analyse de l’accident du 7
Octobre 1991 à Saint-Herblain (44) dans l’enceinte du dépôt pétrolier de la société GPN
(Groupement Pétrolier de Nantes), 10 Juillet 1992, INERIS/EXP-JLc z3/10 78-6782 by J-F
Lechaudel and J-P. Pineau.

INERIS and FINA case study report presented in a French conference on learning from
experience in oil storages, at Lyon, the 30th of January 1996, Saint-Herblain, le 07 Octobre
1991, Déroulement de l’accident, analyse des effets, by J-F. Lechaudel, Y. Mouilleau (INERIS)
and G. Russeil (FINA)

Lechaudel JF, Mouilleau Y, 1995. Assessment of an accidental vapour cloud explosion, a case
study : Saint-Herblain, October, the 7th 1991, France, Proceedings of the 8th International
Symposium on Loss Prevention and Safety Promotion in the Process Industries, Anvers, 6-9
June 1995.

Dechy N, Descourrières S, Salvi O, 2005. The 21st september 2001 disaster in Toulouse : an
historical overview of the Land Use Planning, Proceedings of the 28th ESReDA Seminar on
the Geographical Component of Safety Management: Combining Risk, Planning and
Stakeholder Perspectives, Karlstad University, Sweden, 14-15 June 2005.

Mouilleau Y, Dechy N, 2002. Initial analysis of the damage observed in Toulouse after the
accident that occured on 21st of september on the AZF site of the Grande Paroisse company,
International ESMG Symposium, Nürnberg, Germany 8-10 October 2002, on Process safety
and industrial explosion protection.

BARPI, ARIA database file n°2 914.
Atypical major accidents: Comparison between Buncefield (United Kingdom 11/12/2005), San Juan
Bay (Puerto Rico 23/10/2009) and Jaipur (India 29/10/2009)
Author of the analysis: Nicola Paltrinieri
Main sources of information:

MIIB 2008. Buncefield Major Incident Investigation Board, The Buncefield Incident 11
December 2005: The Final Report of the Major Incident Investigation Board: v. 1, HSE Books,
ISBN-13:
978-0-7176-6270-8,
http://www.buncefieldinvestigation.gov.uk/reports/volume1.pdf (10/02/2012).

CNN, 2009. Puerto Rico firefighters work to contain massive fuel blaze,
http://edition.cnn.com/2009/WORLD/americas/10/23/puerto.rico.explosion/ (14/01/2011).

Indian Oil Corporation, 2009. Independent Inquiry Committee Report on Indian Oil Terminal
Fire at Jaipur, http://oisd.nic.in/uniquepage.asp?id_pk=22 (14/01/2011).
124
I.II Vapour Cloud Explosion at Buncefield, UK - 11th December 2005
I.II.I GENERAL DETAILS OF EVENT AND SITE
I.II.I.I Accident Location
Hertfordshire Oil Storage Ltd (HOSL), Buncefield Oil Storage depot, 3 miles from Hemel Hempstead
town centre, Hertfordshire.
I.II.I.II Date and Time
11 December 2005, 6.00 am
I.II.I.III Short Description / Industrial Setting Involved
The Buncefield depot is a large tank farm 3 miles (about 4.8 km) from the town centre of Hemel
Hempstead, Hertfordshire. A tank farm stores fuels and other products in tanks before they are
transported to other facilities such as petrol stations or airports. Buncefield was the fifth largest of
108 oil storage sites across the UK.
An overfill of a fuel storage tank resulted in a large loss of containment of 250,000 litres of fuel and
release of flammable vapours, which exploded on meeting an ignition source. No lives were lost, but
the longer-term psychological, emotional and financial damage to many people was considerable.
In December 2005, the depot contained three sites:
1. Hertfordshire Oil Storage Ltd (HOSL): a joint venture between Total UK Ltd and Chevron Ltd.
The HOSL part of the depot was divided into two sections – HOSL East and HOSL West – and
was permitted to store 34,000 tonnes of motor fuel and 15,000 tonnes of heating oil;
2. British Pipeline Agency Ltd (BPA): a joint venture between Shell and BP, though the assets
were owned by UK Oil Pipelines Ltd. The BPA site was also split into two sections – the
‘North’ (or ‘Cherry Tree Farm’) section and the main section. BPA had consent to store
70,000 tonnes of motor and other fuels;
3. BP Oil Ltd: at the southern end of the depot, this site had consent to store 75,000 tonnes of
motor fuel.
125
Figure 27 Map of Buncefiel oil storage depot
I.II.I.IV Context of Event
Geology
The Buncefield Depot and the immediate surrounding area are positioned on a variable layer of clay
with flints over Upper Chalk. The clay with flints layer is classified as a low permeability surface
deposit and is believed to be present at a variable thickness of between 2 m and 10 m. This layer
should inhibit the vertical and lateral migration of contaminants and protect the chalk aquifer below
where present in sufficient depth.
126
The Upper Chalk is classified as a major aquifer, which provides water supplies regionally. The Depot
is located within the catchment of a ground water abstraction point located to the south and east of
the Depot. Ground water is present typically at a depth of 45 metres below ground level and flow is
generally towards the south-east.
Natural holes in the chalk which allow quicker water flow than normal may be present, but none
have been positively identified in the immediate area. 66 Within the Depot site boundary a layer of
made-ground, comprising a sand clay dominated soil mixture, overlies the clay.
Topography
Schematic of topography at Cherry Tree Lane
Figure 28 Topography of the area
Water
A local ground water abstraction point that is used as cooling water is located approximately 500 m
south of the Depot.
The River Gade is located approximately 3 km to the south-west and the River Ver approximately 3.5
km east of the Depot.
During normal operation, surface water from the Depot drains to the Depot effluent treatment plant.
It is then pumped into the public surface water system at Pratts Dell to the north-west of the Depot.
This in turn drains to the surface waterbalancing pond at Redbourne Road and subsequently to the
River Red, a tributary of the River Ver.
Maylands pond is another surface water-balancing pond situated to the southwest of the Depot. It
was used as a source of fire-fighting water during the accident.
127
Weather conditions
Meteorological Office records have been obtained for two sites at Luton Airport (13 km to the eastnorth-east) and Northolt (24 km to the south). These indicate that during the early morning of 11
December 2005 the weather was calm, cold, stable and humid. Atmospheric stability at Northolt was
stable (Pasquill stability category F). The relative humidity was recorded as 99%. The air temperature
was –1.7 C at Northolt and 1 C at Luton. There was no wind recorded at Northolt, while Luton
recorded an average wind speed of 6 knots (approximately 3 metres per second) during the 10
minutes before 06:00 GMT. The average wind direction was recorded as 280 degrees measured from
true north (this is the direction from which the wind was blowing). At Luton there was a light wind
west to east. Further south there was no wind.
I.II.I.V Vulnerabilities of main assets and capabilities
The three companies, HOSL Ltd, BPA and BP Oil Ltd, together had consent to store in the region of
194,000 tonnes of liquid fuels at the depot. The depot received, stored and distributed large
quantities of fuels, and the main vulnerabilities were therefore based around these operations.
The close proximity of businesses and housing to the depot increased their vulnerability to any major
hazards that existed on the site. Since 1968, when the terminal was built, there has been general
encroachment and development of adjacent land. This can be seen on the map in Figure 29. The
majority of this building development took place during the period from the mid-1960s to the early
1980s, comprising the construction or redevelopment of residential properties and a number of
schools and industrial premises to the west of the site, all of which fell within a 3 km radius as shown
on the map. Between 1990 and 2006, a few additional industrial premises were built around the site.
128
Figure 29 Developments within 3 km of the Buncefield site between 1966 and 2005
129
I.II.II EVENT DESCRIPTION
I.II.II.I Main scenario
The overfilling of an unleaded petrol storage tank resulted in a large release of fuel and creation of
flammable vapour which, on meeting an ignition source, resulted in a massive vapour cloud
explosion followed by severe multi-tank fires.
I.II.II.II The explosion event
From analysis of seismic records, the British Geological Survey (BGS) has calculated that the main
explosion occurred at 06.01:32. Eyewitness accounts and media reports refer to a very large
explosion followed by a number of lesser ones. The lesser explosions were not detected seismically,
confirming that they were significantly smaller than the main explosion. It is not possible to say how
many smaller explosions occurred, or much about their timings, because of the lack of seismic record
data. A delay of some minutes between the main and subsequent explosions suggests the latter were
more likely to be due to internal tank explosions or further release of fuel from damaged tanks and
pipework, rather than further explosions of parts of the original vapour cloud.
I.II.II.III Ignition sources for the main explosion
The fire pump house, located on the east side of the lagoon on the HOSL West site, had its left-hand
door blown open, and the top half of its right-hand door folded outwards, providing possible
evidence of an explosion from within the pump house. It is believed that the pumps would have
started when the emergency fire alarm was activated just before the main explosion. There is also
evidence of an internal explosion in the emergency generator cabin located on the south side of the
Northgate Building. It is understood that there were thermostatically controlled heaters in the cabin
and the air intakes for the diesel generator would have allowed vapour to enter the cabin. If the
heaters were switched on, the spark generated at any electrical contacts would have been capable of
igniting a surrounding flammable atmosphere. The venting of an internal explosion within either the
pump house or the generator cabin would have been a very powerful ignition source. A number of
witnesses describe how their cars began to run erratically, and car engines are another potential
ignition source.
I.II.II.IV Development and magnitude of the explosion
Estimates have been made of the overpressures required to cause the observed damage (Figure 30),
based on published data from wartime bomb damage and bomb testing. Due to the very different
characteristics of a blast wave produced by a vapour cloud explosion, there is considerable
uncertainty in the estimated overpressures, and work has been ongoing to resolve these
uncertainties. Subject to these uncertainties, the current best estimates of the overpressures are of
the order of 700–1000 mbar in the Northgate and Fuji car parks, leading to extensive damage to
adjacent buildings, decaying to 7–10 mbar at 2 km distance, causing breakage of some windows in
local homes and premises. From a purely qualitative assessment of the damage, it is clear that the
highest overpressures were generated in the area of the Northgate and Fuji car parks.
130
Figure 30 Map of the area around the Buncefield site showing approximate over-pressure isobars.
I.II.II.V Description of Industrial Process, Substances and Materials Involved
The Buncefield depot’s purpose was to store and then distribute fuels that had been transferred to it
from refineries, and is known as a ‘tank farm’. Substances stored included motor vehicle, aviation,
heating and other fuels. The substance involved in the primary explosion was unleaded petrol and
petrol vapour, released from storage tank 912 as it was being overfilled. Tank 912 was receiving fuel
down the T/K pipeline, under the control of the British Pipeline Agency Limited (BPA Ltd.) who were
present on the Buncefield depot site with HOSL.
131
I.II.II.VI Short Description of Accident and Circumstances
From around 18:50 on Saturday 10 December 2005 a delivery of unleaded petrol was being pumped
down the T/K pipeline from Coryton Oil Refinery into tank 912 (situated within bund ‘A’). The
automatic tank gauging (ATG) system which records and displays the level in the tanks had stopped
indicating any rise in tank 912 fuel level from around 03:00 on Sunday 11 December. At about 05:40
on Sunday morning, tank 912 started to overflow from the top of the tank. The safety systems that
were designed to shut off the supply of petrol to prevent overfilling, failed to operate. Petrol
cascaded down the side of the tank, collecting in bund A. As overfilling continued, the vapour cloud
formed by the mixture of petrol and air flowed over the bund wall, dispersed and flowed west, off
the site and towards the Maylands Industrial Estate. Up to 190 tonnes of petrol escaped from the
tank, about 10% of which turned to vapour that mixed with the cold air eventually reaching
concentrations capable of supporting combustion. The release of fuel and vapour is considered to be
the initiating event for the explosion and subsequent fire.
At 06:01 on Sunday 11 December 2005, the first of a series of explosions took place. The main
explosion was massive and appears to have been centred on the Maylands Estate car parks just west
of the HOSL West site. These explosions caused a huge fire which engulfed more than 20 large
storage tanks over a large part of the Buncefield depot. The fire burned for five days and a plume of
black smoke from the burning fuel rose high into the atmosphere.
I.II.II.VII Timeline of Events
10 December 2005, around 18.50
Tank 912 in Bund A at the Hertfordshire Oil Storage Limited West site started receiving unleaded
motor fuel from the T/K pipeline, pumping at about 550 m3/hour.
11 December 2005, around 00.00 (midnight)
The terminal was closed to tankers and a stock check of products was carried out. When this was
completed at around 01.30, no abnormalities were reported.
Approximately 03.00
The level gauge for Tank 912 recorded an unchanging, static tank level reading. However, filling of
Tank 912 continued at a rate of around 550 m3/hour.
Approximately 05.20
Calculations show that around this time Tank 912 would have been completely full and starting to
overflow. Evidence suggests that a sensor device near the top of the tank which should have
provided protection against overfilling by shutting off the supply of petrol to the tank, did not
operate. From this time onwards, continued pumping caused fuel to cascade down the side of the
tank and to shower through the air when hitting flanges on the side of the tank, leading to the rapid
formation of a rich fuel/air mixture that collected in Bund A.
At 05.38
Vapour from the escaping fuel is first visible in CCTV footage from a camera looking down the
western edge of Bund A. The vapour was flowing out of the northwest corner of Bund A towards the
west.
At around 05.46
The vapour cloud had thickened to a depth of about 2 m and was flowing out of Bund A in all
directions.
132
Around 05.50
The vapour cloud had started flowing off site near the junction of Cherry Tree Lane and Buncefield
Lane, following the ground topography. It spread west into Northgate House and Fuji car parks and
towards Catherine House.
Between 05.50 and 06.00
The pumping rate down the T/K pipeline to Hertfordshire Oil Storage Limited West, and onwards to
Tank 912, gradually rose to around 890 m3/hour.
The vapour cloud extended:
West – almost as far as Boundary Way in the gaps between the 3-Com, Northgate and Fuji buildings;
North – west - as far as the nearest corner of Catherine House;
North – probably as far as Tank 12, operated by BPS Ltd;
South – probably across parts of the HOSL site, but not as far as the tanker filling gantry;
East – as far as the BPA Ltd. site.
Around 06.01
The first explosion occurred, followed by further explosions and a large fire that engulfed over 20
large storage tanks. The main explosion event appears to have been centred on the car parks
between the HOSL West site and the Fuji and Northgate buildings.
06.08
An emergency services major accident was declared and operational command and control was set
up near the accident site within minutes. An extensive plume of smoke from the burning fuel
dispersed over southern England and beyond. The plume could be seen from many kilometres away,
and was also clearly identified in satellite images.
12 December 2005 – 12:00 (Noon)
Peak of the fire. 25 Hertfordshire pumps were on site with 20 support vehicles and 180 fire-fighters.
There was some loss of secondary containment, as the bunds were unable to fully contain the
escaped fuel and water used in fire-fighting (known as ‘firewater’), which ‘overtopped’ (i.e. spilled
over the top of) the bund walls.
14 December 2005
Damage to bunds caused by the intense heat of the fire caused significant loss of secondary
containment on the HOSL West and BPA Ltd. sites. There was also extensive loss of tertiary
containment at the site boundaries and large amounts of contaminated liquids escaped off site. The
fire service recovered as much of the contaminated run off as possible, but was unable to prevent
contamination of groundwater and surface water.
15 December 2005
‘Fire all out’ declared by the Fire Service. 786 000 litres of foam concentrate and 68 million litres of
water (53 million ‘clean’ and 15 million recycled) were used overall to contain the accident during the
period of fire-fighting operations.
I.II.III CAUSES AND CONSEQUENCES
I.II.III.I Initiating Event and Direct Causes (Technical Failure, Human In/Actions)
Evidence shows that the explosion resulted from the ignition of a vapour cloud emanating from
spilled petroleum by overfilling a storage tank in the Hertfordshire Oil Storage Limited West site. The
133
overfill appears to have been caused by a number of technical failures and human actions or
inactions. A level gauge inside tank 912 stopped reading the fuel level. The computer system that is
connected to the tank gauge and used to monitor the tank level in the control room therefore
probably did not correctly display the tank level or produce the expected alarms in response to tank
levels. Operators within the control room were not aware of the situation. A detector at the top of
the tank which was designed to automatically shut off the filling process and sound an alarm, failed
to function.
I.II.III.II Root causes: failures in ERMF (Emerging Risk Management Framework)
Technical, Technological
The Buncefield Major Incident Investigation Board (MIIB) report of the accident describe failure of
the automatic tank gauging system (ATG) and failure of the tank ultimate high level emergency shut
down switch to operate. Both these technical elements of the system were in widespread use within
the tank farm sector, yet failed to work properly on the night of the accident. The MIIB report
describes the need to establish an acceptable level of reliability for the systems used in tank farms,
and a need to have a methodology to determine the reliability level of existing and planned tank
farm systems. The reliability of a system can be stated as it’s probability of failure on demand i.e. the
probability of it not working when it needs to. The measure of reliability of a system can be stated as
its ‘Safety Integrity Level’ (SIL). The report suggests that the ATG systems at Buncefield were not
sufficiently reliable, and the detector at the top of the tank, which should have automatically shut off
the filling process, probably failed because it had been left in an inoperable state after a testing
procedure had been carried out some time prior to the accident. The detector design relied on a
padlock being in place in order for it to function properly, but the padlock was not in place on the
night of the accident. The MIIB report recommends that the industry look for more reliable means of
tank gauging and high-level detection.
There was a lack of gas monitoring systems on the site, which could have alerted the operators to the
fuel leaking from tank 912. The HOSL site had CCTV installed in the control room, allowing operators
to monitor areas of the tank farm, and the flammable vapour from tank 912 was visible on CCTV tape
records, but the CCTV system was not a reliable means of detecting dangerous vapours.
The design of tank 912 itself may have contributed to the extensive formation of highly flammable
vapour/mist. The tank was fitted with a deflector plate around the top edge, designed to direct water
from sprinklers on the tank’s top to its sides to provide cooling in the event of fire. Tests
demonstrated that the deflector plate would have caused the overflowing fuel to cascade through
the air, promoting the formation of flammable vapours. Additionally, tests showed that a wind girder
part way down the side of the tank would have created a second cascade of fuel and further
increased vaporisation of fuel. These effects are illustrated in Figure 31. As the volume of the mixture
grew from the continuing overfilling of the tank, it flowed out of the bund around the tank,
dispersing and flowing off site. Further mixing with the air would have reduced the vapour
concentration to the point where significant volumes of the mixture could support an explosion.
134
Figure 31 The pattern of fuel dispersion
Human & Management factors
Human and organizational factors are recognised as major contributors to accidents, and therefore
recognising and dealing with them contributes to the safe operation of a major hazard site such as a
fuel storage depot. Prior to the accident, a number of human and organizational factors existed
within the operations of the HOSL Buncefield site which had either not been recognised or dealt
with. Some of the factors identified in the MIIB reports include:
Shifwork issues – fatigue of operators due to overtime and shift design;
Maintenance management – to achieve reliable proof testing of critical systems in the tank farm
operations, with effective standardised procedures;
Operator control – tank farms receiving fuel should have ultimate control over the delivery into their
tanks;
135
Communications – the system for delivering fuel safely around the country depends on good
communications between those responsible for delivery and those responsible for receiving the
delivered batches, to ensure sites receiving fuel are able to accept deliveries safely;
Identification and understanding of critical tasks and roles – tasks and roles that will ensure safe
transfer of fuel need to be understood and defined, so that control room operators can be properly
trained to be able to reliably detect, diagnose and respond to potential accidents;
Information and system interfaces – these need to be designed to support operators in achieving a
suitable level of performance in detecting, diagnosing and responding to potential accidents;
Training, experience and competence – a competence assurance system needs to be in place to
ensure competency and performance reliability on critical tasks;
Workload – jobs and tasks need to be properly understood so that front line staff are not dealing
with too many critical tasks at once, either during normal running, abnormal situations or
emergencies;
Contractors - prequalification auditing and operational monitoring of contractors’ capabilities to
supply, support and maintain high SIL equipment – the contracted suppliers and maintainers of the
tank gauging systems at HOSL may not have been performing to a sufficient standard;
Management of change – changes to equipment, staff roles, shift designs, procedures, staff changes
and organisational restructuring need to be managed to prevent such changes having any
detrimental effects on the safety performance of the tank farm operations (all these issues may have
been underlying latent contributors to the poor safety performance at the HOSL tank farm).
Governance, Communication
There was a lack of a formal methodology for industry to determine safety integrity levels required
for overfill protection systems at depots that store and transfer petroleum products on a large scale.
Policies, Regulations, Standards
At Buncefield and similar sites, the risk assessments carried out for land use planning considered the
worst credible scenario to be a major liquid fuel pool fire. Thus, zone boundaries did not take into
account the type of explosion that occurred at Buncefield, or only expected such an explosion where
vapour might form in confined areas.
The COMAH regulatory framework needed to be reviewed and updated, but these changes had been
previously inhibited for resource and other related reasons.
I.II.III.III Specific risk governance activities: failures in IRGC (International Risk Governance
Council) risk governance framework
Pre assessment
The worst credible scenario for this site was thought to be a major liquid fuel pool fire and not the
vapour cloud explosion that actually occurred.
Risk appraisal
On the basis of current scientific understanding of the way in which VCEs occur, the potential for a
VCE at a site like Buncefield would have been limited to those parts of the facility that provided
sufficient confinement or congestion to generate a VCE, such as the tanker loading rack, giving rise to
relatively small hazard ranges.
The magnitude of the overpressures generated in the open areas of the Northgate and Fuji car parks
was not consistent with current understanding of vapour cloud explosions at the time of the
136
accident. For example, a method in current usage would predict overpressures in this sort of
environment of 20–50 mbar. The ignition of the vapour cloud and the explosion propagation in the
relatively uncongested environment of the adjacent car parks that caused significant overpressures
and produced the severe damage to property were unexpected and the reasons for it were not
understood after the accident.
Tolerability and acceptability judgement
The VCE that occurred in Buncefield had an unexplainable and unexpected strength, and the hazard
was expected to be much smaller and therefore judged as acceptable.
Risk management
The protection based assessment was based on other hazards such as large pool fires.
I.II.III.IV Consequences, damages, effects to system, people, environment, economical, social
The following is taken directly from the text of the MIIB reports:
Nobody was killed in the accident, although 43 people suffered minor injuries. As well as destroying
large parts of the depot, there was widespread damage to surrounding property and disruption to
local communities. Some houses closest to the depot were destroyed and others suffered severe
structural damage. Many residents had to move into temporary accommodation while repair work
was carried out, some for long periods. Other buildings in the area, as far as 5 miles (8 km) from the
depot, suffered lesser damage, such as broken windows, and damaged walls and ceilings. Many
residents affected by the blast faced difficulties as they tried to rebuild their lives following the
accident. As well as damage to properties, many people lost personal possessions. Some people were
also greatly affected by the trauma and needed psychological help. There were, however, no serious
health effects reported among the public or the emergency response workers from exposure to the
plume of smoke, which dispersed over southern England. The hot plume rose rapidly and spread out
over a deep inversion layer, which persisted under very stable weather conditions and this pattern
led to very low concentrations of smoke at ground level. The absence of rain for the duration of the
fire meant there was no deposition of fire and combustion products either. Businesses on the
Maylands Industrial Estate were badly disrupted. At the time of the explosion the estate housed 630
businesses and employed about 16,500 people. Some premises were destroyed and others required
significant repair work. A few companies went into liquidation. Some jobs had to be relocated, but
many of these were temporary. Some roads near the depot were closed for several months, as they
had been made unsafe by the accident. The East of England Development Agency estimated that the
accident cost local businesses £70 million. Local councils and other agencies set up several initiatives
to help the recovery of the area and the affected businesses.
Environmental pollution outside the Buncefield depot mainly affected nearby soil and water that was
contaminated by escaped fuel and firefighting foam and water. This contamination was mostly close
to the depot and did not affect drinking water supplies. The threat of pollution remains nonetheless
from products that have migrated into the ground water around Buncefield such as PFOS (from
firefighting foam), BTEX and MTBE (constituents of motor fuels).
Any pollutants from the smoke plume were spread over a wide area and caused little damage to soil
and plants. Overall, the report concluded ‘there are unlikely to have been widespread air quality
impacts at ground level due to pollutants emitted from the Buncefield fires’. The loss of the depot
caused temporary disruption to fuel supplies in the southeast, though fall-back arrangements were
quickly put in place. Ground fuel supplies (for heating and for motor transport) were least disrupted.
The longest severe impact was on Heathrow Airport, which had previously received half its daily fuel
supplies from Buncefield. At the time of completing this report Heathrow Airport’s fuel supply
arrangements were at full stretch and work was in hand to create additional supply capacity.
137
I.II.III.V Event management, emergency rescue measures, crisis management
The following is taken directly from the text of the MIIB reports:
The emergency services (primarily the Fire and Rescue Service and the police) led the initial response
to the accident and its immediate aftermath. As a Category 1 responder under the Civil
Contingencies Act, EA (Environment Agency) worked closely with the Fire and Rescue Service, the
police, the Health Protection Agency (HPA) and the Strategic Health Authority, including advising on
the water pollution aspects of the firefighting activities. HSE is a Category 2 responder, so during the
early phase of the accident stood ready to provide advice and expertise on request in support of the
emergency services and EA.
Hertfordshire Police co-ordinated the emergency response and worked closely with other responders
including the Hertfordshire Fire and Rescue Service, Hertfordshire County Council, Dacorum Borough
Council, EA and HPA. The police set up an exclusion zone around the site which remained in position
for several days. The Hertfordshire Fire and Rescue Service was supported by staff drafted in from
many other brigades and used equipment and foam brought in from around the country. Shortly
before Christmas the police were able to hand back the security of the site to the depot operators
but the fire service retained a presence on site until the New Year as quantities of uncontained fuel
remained on site. At the peak of the accident – on Monday lunchtime, 12 December – there were 26
Hertfordshire pumps on site, 20 support vehicles and 180 firefighters. More than 250 000 litres of
foam concentrate were used, together with 25 million litres of water and 30 km of high-volume hose.
I.II.III.VI After the event, aftermath actions to restore, repair, depollute, compensate
Various operations were performed onsite in order to limit secondary pollution and facilitate site
access, particularly for the purpose of conducting the necessary research:

Fire extinction water and other polluted water that could have been contained onsite was
discharged during the three-week period following the accident and then stored on various
sites. The 12,000 m3 of the most polluted extinction water were treated by the reverse
osmosis process. The less polluted water (4,000 m3) was stored while awaiting an adapted
form of treatment;

The site was cleared to facilitate access. In February 2006, retention zone A, which includes
Tank 912, was made accessible for the first time. The presence of inflammable vapour was
subjected to monitoring;

The southern part of the terminal, which sustained less damage, was renovated during the
month of August to enable discharging stored fuel supplies. The third company based onsite
undertook, in September 2006, transfer operations necessary for continuing with the tank
investigations. It is anticipated that site installations will be fully dismantled by the end of
2007;

The British Ministry of the Environment launched, as a first time initiative, a national
campaign of PFOS analysis in groundwater, with 150 measurement points already selected.
The Ministry is also working on producing a modeling software to predict the evolution of
pollutant flows in aquifers.
I.II.IV Lessons Learned and Corrective Actions
I.II.IV.I Main Findings and official lessons
The formation of a huge vapour cloud as a result of overfilling a tank, and the resulting risk of a
powerful blast with domino effects, was not considered a sufficiently credible scenario for the
purposes of land use planning, licensing or emergency planning.
138
The design of the tank itself may have contributed to the vapour/mist formation.
The Competent Authority, should embark on a review of the purpose, specifications, capacity,
construction and maintenance of the tank park.
Advice shall be sought on the human and organizational factors that contribute to the safe operation
of a major hazard site such as a fuel storage depot. Such factors include, for example, job
organization, management of organizational change, monitoring and supervision, training and
control room layout.
It may prove necessary to consider additional standards for the overall layout of storage sites.
The system for delivering fuel safely around the country depends on good communications between
those responsible for delivery and those responsible for receiving the delivered batches, to ensure
sites receiving fuel are able to accept deliveries safely. The adequacy of existing safety arrangements,
including communications, may also need to be reviewed.
I.II.IV.II Main official recommendations
The official investigation on this accident resulted in several recommendations regarding 3 main
aspects of this accident:
1. Design and operations of a fuel storage site
2. Emergency preparedness for response to and recovery from incidents
3. Land use planning and the control of societal risk around major hazard sites
Recommendations about the first of these aspects deal with:

Technological matters – It emphasizes the need to increase the protection provided by
primary, secondary and tertiary containment systems and their management;

Human and organizational factors;

Sector leadership and culture – Essential to ensure that the benefits of the more detailed
recommendations are fully realized.
Recommendations about the second of aspects deal with:

Identification of all foreseeable major hazard accidents and associated emergency scenarios
by site operators and Competent Authority

Plans and arrangements to contain a developing incident on site

Planning and implementing an emergency response by those concerned

Primary response to major accidents

Recovery from a major accident with Buncefield-like consequences
Recommendations about the third of aspects deal with:

Granting hazardous substances consent

Incorporation of societal risk into land use planning decision making

Economic issues for the continued co-location of major hazard sites with large communities

Needing to replace the simplified, generic approach to risk assessment currently used around
flammable storage sites with a site-specific assessment of risks using QRA methods.
139
I.II.IV.III Feedback on corrective action implementation
A ministerial statement from Lord McKenzie of Luton, DWP Minister, was made to Parliament
November 13th 2008. In particular it announces placing in Parliament’s libraries the Government’s
and Competent Authority’s response to the Buncefield Investigation. This report provides detailed
information on the progress against the recommendations set out by the Board on design and
operation of fuel storage sites and emergency preparedness, response and recovery.
The Statement also explains that the Secretary of state for Communities and Local Government will
lead consideration of the Board’s report Recommendations on land use planning and the control of
societal risk around major hazard sites and will respond substantively in due course.
I.II.IV.IV Diffusion of Information and Knowledge management
Several reports about the official investigation were carried out by the independent Major Incident
Investigation Board.
Also a website was created to provide a convenient and easily accessible way in which all those
involved
and
interested
in
this
investigation
can
access
the
information
(www.Buncefieldinvestigation.co.uk).
140
I.III Explosion at Toulouse, France - 21st September 2001
I.III.I GENERAL DETAILS OF EVENT AND SITE
I.III.I.I Accident and Industrial System Location
A terrible explosion of off-specification ammonium nitrate occurred on 21st September 2001, in
Toulouse in France, in AZF, a chemical and fertilizer plant belonging to Grande Paroisse Company,
now Total group (former TotalFinaElf at the time of the accident).
I.III.I.II Date and time
The explosion occurred on Friday at 10:17 am, 21st of September 2001.
It was 10 days after the 9/11 disaster.
I.III.I.III Short description of industrial setting involved
The manufactured chemicals in the plant were mainly ammonium nitrate, ammonium nitrate-based
fertilisers and other chemicals including chlorinated compounds.
The explosion took place in a warehouse, located between process parts, storage and packaging
areas for AN (ammonium nitrate). It was used as a temporary storage of ‘off-specification’ AN
(‘downgraded’ AN).
The Grande Paroisse company’s factory is situated on a 70 ha site to the south of Toulouse about 3
km from the centre of the city, on the left bank of the Garonne (see Figure 1, next page).
It employed 470 people.
The factory produced fertilisers and a variety of chemical products. From natural gas, the factory
produced:

ammonia (1150 tons/day)

nitric acid (820 t/d)

urea (1,200 t/d)

ammonium nitrate
The production of ammonium nitrate consisted of

850 t/d of granules for fertilisers,

400 t/d of granules for industrial use (mainly for the manufacture of explosive “fioul” nitrate
used in quarries and civil engineering)

nitrogenous solutions (1,000 t/d).
The factory also produced various other chemicals: melamine (70 t/d for the manufacture of resins),
formalin, chlorinated derivatives, adhesives, resins and hardeners.
The factory stored considerable amounts of hazardous substances, the maximum permitted values
being:

ammonia: a tank containing 5,000 t, a 1,000 t sphere in cryogenic form and 315 t stored
under pressure.

chlorine: 2 x 56 t tankers

ammonium nitrate: 15,000 t in bulk, 15,000 t in sacks and 1,200 t of hot solution.
141
On the 21st of September, on the Southern area of the site there were also 4 tankers of chlorine and
20 tankers of ammonia.
Figure 32 The AZF, Grande Paroisse (Total) plant
History of the chemical plants
In the 17th century, there was an explosives (black powder) factory on the île de Tounis that was
then obliged to relocate after a series of accidental explosions (1781, 1816, 1840). In order for the
factory to carry on benefiting from the energy provided by the river, and at the same time moving it
away from the growing city, it was relocated towards the South.
Between 1914 and 1918, the national explosives factory underwent an exceptional period of growth,
spreading along the left bank of the Garonne and swallowing up land as far as the Southern limit of
the Commune of Toulouse.
In 1924, the ONIA (Office National de l‘industrie de l’azote/National Nitrogen Industry Board) was
created, as a result the production of nitrogenous fertilisers was separated from the explosives
department. The ONIA then became APC then CDF Chime-AZF, SCGP and since 1991 Grande Paroisse
which now forms part of ATOCHEM and therefore part of the TOTAL FINA ELF Group.
SNPE was created by a law that was passed on 8th of March 1971, which transformed part of the
Explosives Department and a branch of the Ministry of Defence, into a national company. The
manufacture of gunpowder on the Toulouse site was halted in 1973 and since that time SNPE’s
activities on the site have been directed toward chemicals. Tolochimie was set up in 1961, formed
part of the Rhône Poulenc Group and, since 1996, has been incorporated within the SNPE Group.
I.III.I.IV Context of event and system (General Environment Description, Topography weather
conditions)
The plant was settled on the border of the river Garonne, one of the fifth biggest rivers in France.
On the side of the river the ground was flat and made of silt. The underground alluvia water was a
few meters under the plant (which can be seen in Figure 3, taken a few days after the explosion).
On the other side there was a hill of 50 to 100 meters high, which effected the overpressure
propagation.
At 10:17, 21st of September 2001, the atmospheric conditions were stable.
142
I.III.I.V Area and stakes vulnerability to the system / event
The chemical plant settlement and urban development’s around them had a long history. Finally, the
plant settled at the beginning of the 20th century 3 km south from the center of Toulouse city but
was overwhelmed by the development of urban area in the fifties and sixties when the priority was
to build
flats and schools to follow the economical development of that period.
History of the Land Use Planning (LUP) at Toulouse near the plants
From 1914 to 2000, the Toulouse city population multiplied by factor of five and ten in the Toulouse
urban area (750 000 inhabitants in the urban area in 2000). In the seventieth century an explosive
factory was built close to Toulouse and in 1840, it had a non-aedificandi zone. Three accidental
explosions later and due to the urban pressure, the factory was removed twice out of the inner city
and the latest move occurred at the beginning of the 20th century. In 1928, another aedificandi zone
was proposed but could not cope with the urban development. In 1947, another LUP was approved
but not applied because of the development requirements. The urgency was to build flats,
universities and roads, see Figure 33.
In 1976 a law for the authorisation or declaration of installations on industry was passed. Due to this
law and following the Sevesco shock, the risk from the factory to the Environment and public health
was raised in the EU. In 1983, safety studies were started and LUP was applied for and approved in
1989. The urban development was controlled (no new risk with no new exposure of new buildings or
activities, but no retroactive force) but the situation was understood to be risky. After the Sevesco II
Directive in 1996, the local plan finally took a clear position advocating for a long-term change.
Figure 33 The location of the AZF plant, the crater, the motorway and the city of Toulouse
143
I.III.II EVENT DESCRIPTION
I.III.II.I Main scenario and hazardous phenomena
The explosion produced a seismic wave that was estimated at 3.4 on the Richter scale, but no
analysis had been initiated by the INERIS into this aspect for its investigation.
The explosion produced a crater of about 60 m in diameter and 7 m in depth.
Figure 34 The AZF crater produced by the explosion
From the blast analysis carried out by INERIS, it has been deduced that the TNT equivalent required
to produce the damage observed would have to have been between 20 and 40 tons.
It should be kept in mind that this assessment corresponds to the arithmetic mean of the weight
values calculated from the overpressures estimated respectively on the low side and on the topside.
Furthermore, it should be noticed that:

54% of the estimates are below 20 tons,

whereas 24% of the estimates exceed 40 tons.
Statistical data showed the disparity in the estimates obtained for the TNT equivalent. The disparity
can be explained essentially by the difficulties in interpreting the damage observed within a very
short time.
144
Figure 35 Overpressures estimates (low range)
Figure 36 Overpressures estimates (high range)
The TotalFinaElf investigation commission listed several estimates of TNT equivalent by the following
different companies:

SNPE Environment estimated 165 tons with a range of 140-200t which were mostly based on
window damage observed

Laboratoire de Géophysique estimated 10 to 100 tons using several methodologies with a
maximum of 200t.

Technip estimated 15-25 tons by analysing the effects on the building structures
145

TNO first estimated 30-40 tons but concluded with a range of 15-40t by analysing the effects
on the building structures

INERIS estimated 20-40t by using windows, building structure, roofs, walls etc.
The TotalFinaElf internal investigation commission stated the most relevant estimate to be 15 to 40
tons of TNT equivalent because methodologies used by Technip and TNO seemed more accurate and
it confirmed the orders of magnitude found by INERIS. A few months later, the Justice mentioned an
estimate of 70 to 126 tons for the TNT equivalent mass (the methodology is unknown to us).
I.III.II.II Precise system, substances, process and materials involved in the accident Scenario
Ammonium Nitrate manufacturing
The synthesis of ammonium nitrate (NH4NO3) needs to be performed from two raw materials ammonia (NH3) and nitric acid (HNO3) - through an exothermic reaction.
The hot AN aqueous solution obtained after this first step is concentrated before being cooled in a
prilling tower. By easy modifications of this synthesising and cooling process, several kinds of ANbased products can be obtained, each of them having their own use: the two most well-known are as
fertiliser (called “fertiliser grade” if satisfying to EC criteria) and as a component in explosive
preparations (called “technical grade”). Moreover, AN-based product is also used for the production
of some special chemicals, e.g. N2O. AN is a crystalline white hygroscopic solid and acts as an
oxidising agent. It has a high solubility in water and its molecular weight is 80 g/mol. Its melting point
is 169,6°C and its boiling point is 210°C.
Hazards of Ammonium Nitrate
Pure AN is stable under normal handling and storage conditions. However, as the detonation
properties of AN were so poorly misunderstood before the 1950s, explosions of stored solid ANbases products occurred. Since then there have been a reduced number of explosion accidents as
changes were made to the production process. The major explosion in Toulouse was a severe
reminder of the inherent hazards associated with the handling and storage of AN. The importance of
an appropriate explosion risk assessment methodology for use in Land-Use Planning for the
production of AN is again highlighted.
The off-specification Ammonium Nitrate storage
The materials stored in the temporary storage of ‘off-specifications’ AN (‘downgraded’ AN), were
aimed to be recycled in AN-based binary / ternary fertiliser process.
These materials that do not fulfil the requirements (under-sized, downgraded, start-ups and
shutdowns, return from customers, production tests as new additives) from different process units of
the site (fertiliser and technical grade), did not have clear defined properties.
Dirty products may come from the cleaning of these units.
The investigations of INERIS led to a final estimate of 390 to 450 tons of ‘off-specification’ AN stored
the day before the explosion and were able to retrace the entries before the morning of 21 st
September 2001.
I.III.II.III Short description of accident and circumstances
The building 221 was adjacent to the sack-filling building, 123, 124 and 125, where combustible
products were stored. This group of buildings was not fitted with a fire detection system. Work to
bring the infrastructure of the building up to the required level had been undertaken over the last
few years.
146
Building 221 and 222 did not have any nitrogen oxide detectors and in a note dated 6 th June 2001
about the retention of water for fire fighting sent by Grande Paroisse to the DRIRE (pursuant to the
authorisation order dated 18th
October 2000) it was listed under the heading “improvement”: “The presence of NOx detectors
would help to reduce the time taken to raise the alarm and consequently the time taken to put any
fires out and the amounts of water used to do so.” Such devices were present on other larger storage
facilities on the site. This situation was consistent with the fact that whilst the risk from fire was
contemplated on this type of storage facility, the risk of explosion was considered by the operator to
be negligible.
The running of building 221 and 222 was supervised by Grande Paroisse’s dispatch department and
sub-contracted to outside firms. Handling operations in this building were carried out by personnel
from a sub-contracting company called TMG who also carried out the handling of nitrates in sacks
and on pallets.
The warehouse 221 had no gas supply, no steam pipes and only natural light.
I.III.II.IV Timeline of events
One of the key issues was the nature of the product which was put on top of the AN storage hours
before the explosion at 10h17 am.
The day before the explosion, 15 to 20 t of ammonium nitrate containing an additive that had been
manufactured and was at the qualification stage were brought into this building.
On the morning of the explosion, products resulting from the packing of ammonium nitrate and from
the manufacturing workshops were brought into this room.
The last product having been brought in less than half an hour before the explosion was a skip
coming from another storage area. A Grande Paroisse employee had left the sack-filling building 5
minutes before and had not noticed anything out of the ordinary. Investigations about the nature of
the products stored were then conducted within the Judicial inquiry.
No one was in the storage warehouse at the time of the explosion.
I.III.III CAUSES AND CONSEQUENCES
I.III.III.I Initiating event and direct causes (technical failure, direct human actions)
Several years after the accident, the controversy about the direct causes is still there. The origins of
the accident haven’t found yet an agreement among investigators (company, justice).
At the writing of this case report for the INTEG-RISK, the trial is being held and the conclusions are
not known yet.
The controversial key element is to find the ignition source of the off-specification AN stored.
Investigations showed the origin was neither a fire nor a first explosion followed by the mass
explosion. Investigations of the Justice have therefore focused on reviewing the role of
contamination in AN decomposition, and in particular on the chemical incompatibility. Indeed, some
chlorinated compounds for swimming pools were manufactured on the southern part of the site.
Those materials were supposedly not to have ever been mixed.
The Justice’s main assumption focuses on a reaction between AN and DCCNa (SDIC, sodium
dichloroisocyanurate) or AN and ATCC (trichloroisocyanurate acid) that is strongly incompatible and
releases trichloramine NCl3, that is very sensitive and has explosives properties. This material could
have been brought in by error some minutes before the explosion.
147
The other scenarios were numerous and where mentioned in the press by the Justice or from other
sources: among them:

A huge underground electric arc between a transformer on SNPE’s site (owned by the French
State) and EDF’s electric line.

An unidentified gas leak coming that would have contaminated the storage of off-spec AN,

Other assumptions such as terrorism act, malicious intent or meteorite fall have been
investigated as well, but have not appeared relevant so far.
I.III.III.II Root causes: Failures in ERMF (Emerging Risk Management Framework)
Comment on investigation and trial: disclaimer on root causes
Several investigations launched by several stakeholders, a public investigation, a national debate and
a parliamentary enquiry were launched (see list of references below) that enabled the risk
management system and several stakeholders to identify numerous probable risk factors and generic
lessons to be learnt.
Final Root causes are still under investigation in connection with the outcome of the trial. But, among
root causes, some deficiencies are already identified. Some of the main ones are listed here.
However as the direct causes of the disaster are not yet established, these root causes should be
taken with caution.
Technical, technological
AN Fertiliser grade and moreover technical AN grade are not inherently safe towards the explosion
risk. For economical reasons, those fertilizers have kept an efficient dose of fertilizing capacity,
meaning a sufficient ratio of Nitrogen. This implies that they kept a latent risk of explosion if they are
mixed with some chemicals and combustibles such as fuel. Despite a good knowledge and experience
of some of the pure AN properties, there are still a lot of unknown properties, in particular for
fertilizer grades, with the interactions and sensitivity towards impurities, pollutants, and
combustibles. The certification test of AN has probably decreased the explosion risk perception.
Despite recognizing that the off spec AN had greater sensitivity, research was not undertaken.
Management
Another probable root cause was the subcontracting of some activities with a loss of risk knowledge
and control. It was the beginning of the implementation of Safety Management System (the Seveso II
regulation transposition was made 1 year before) that was not developed enough, formalised or
implemented.
Governance, Communication
Several root causes were acknowledged such as the lack of use of governance tools (communication
and participation of other stakeholders than industry, State and experts; acceptability criteria
unclear). It was pointed that the lack of governance inside the hazardous sites, with the lack of
process safety oversight by internal workers of the Health and Safety Committee were not mandated
on process safety (major hazard) issues, and mostly focusing on health and safety at workplace.
It was noticed that there was a lack of control and lack of inspections from the inspectors of the
control authorities (means that there were a number of inspectors but a lack of expertise).
Policies, Regulation, Standards
A root cause was the lack of Seveso II regulatory oversight on off-specification AN. Only AN that
complies with quality and safety norms were considered by the regulation. Some AN technical grade,
used for explosives and some others were sold as fertilizer grade, with at the time, a low probability
risk of explosion. The position of the industry for risk assessment in safety studies was to evaluate
148
the fire risk scenario. Lessons from historical explosions involving AN materials were considered in
the design of the materials specification, preventive measures and regulations.
The Seveso Directives also had some more general limits in the risk assessment, risk management
and risk control issues. The risk zero faith was down and the belief in the control given with Seveso II
Directives implementation was lost after Enschede, Toulouse and now Buncefield. A Seveso III
Directive is under preparation.
Another root cause was the LUP process, which was inadequate and had no retroactive force. It led
to a high exposure of several stakes (houses, schools, companies, stores, infrastructures) in the safety
perimeters around the plants. The LUP was edited too late after the suburbs of Toulouse had
surrounded the plants.
I.III.III.III Specific risk governance activities: failures in IRGC (International Risk Governance
Council) risk governance framework
The failures are numerous. The focus is here given on failures or findings on the issues relevant to
task C1.4 of the INTEG-RISK.
Pre assessment
At first the explosion scenario of the storage of off-specification AN was not considered in the safety
studies nor in the LUP safety perimeters. Indeed, at that time, the position of the industry for risk
assessment in safety studies was to evaluate the fire risk scenario (in an industry safety guidelines).
Due to the consideration of lessons learnt from previous explosions, the risk of explosion was
thought to be low. However, the Seveso II regulation and other regulations did not consider the
particular risk of ‘off-specification’ of AN. Today, these materials, with badly defined properties, but
higher risks than fertiliser AN that comply with norms, are considered to have a risk level similar to
technical grades of AN.
Secondly, at a more general level, the outcome of the risk assessment process through the
Administrative and parliamentary inquiry showed that a deterministic approach and more detailed
probabilities needed to be included into the risk management process. It insisted on the need of
assessing scenarios with a consideration of a possible failure of the safety devices (the deterministic
approach in France). In other words, “real safety studies” should reveal the hazard potential. This is
also in line with practices in other countries and industries such as nuclear or transportation.
Risk appraisal
Concepts of defence in depth, safety barriers, likelihood, scenario, methodologies of risk assessment
(HAZOP, fault trees) and safety management systems are widely used today. For the probabilities, it
was explicitly mentioned to learn from Dutch and English practices and to seek harmonisation
throughout EU.
Another important lesson is that “the explosion could have had larger human consequences if a
storage container of toxic gases had been damaged or if a chlorine or ammonia wagon was closer to
the location of the explosion”. “The effects would have been larger because the explosion had
damaged windows in a large perimeter” and people would not have been able to protect
themselves. A domino effect did not occur but could have and was not considered for ‘realistic’
‘worst case’ safety perimeters. In addition, the worst-case scenarios were not taken into account in
the safety studies or LUP. In the end, the accident showed the incompatibility between the
hazardous activities and the vicinity of the urban area.
Tolerability and acceptability judgement
In 2001, for different ammonium nitrate manufacturing sites, different ranges of safety distances
regarding lethal or irreversible effects existed that varied with one order of magnitude. They were
mostly based on ammonia release scenarios. This experience of the Toulouse disaster was used by
149
the Administrative and Parliamentary inquiry to ask for a methodology review of the safety studies in
France. There is a need for a better quality and harmonisation of safety studies of any site. E.g., It
was recommended to the Environment Ministry to define the rules on the scenarios to assess
(storage, wagon, trucks, piping system), the external interference (natural hazards like earthquakes,
centennial flooding, domino effects, dam rupture, airplane crashes and malicious intent) and to
define criteria for effects on people.
It was also found also that the inspectors had to do trade-offs (between scenarios, LUP and
acceptability), which they were not supposed to do.
Risk management
The subcontracting of some activities, in particular activities linked to process safety and major
hazard, were lacking oversight. This transfer of activities to external contractors was found to
generate a loss of risk knowledge and control.
It was the beginning of the implementation of Safety Management System (the Seveso II regulation
transposition was made 1 year before) that was not developed, formalised or implemented.
In addition, it was noticed that there was a lack of governance on these hazardous sites and a lack of
process safety oversight by internal workers of the Health and Safety Committee, which was not
mandated on process safety (major hazard) issues. This could have improved debates about risk
management activities.
Consequences, damages, effects to system, people, environment, economical, social
Due to the vicinity of the plant within a 750 000 inhabitants city in 2001, the effects to people and
the damages were very large and evolved from a major accident to a disaster:

The explosion caused 30 fatalities, 21 in the plant and 9 outside (note that according to some
newspapers the figures were higher)

Estimates from the InVS and the local committee for the sanitary watch indicated 3 years
after the explosion, that 10 000 people were wounded (body) and roughly 14 000 people
have asked for medical treatment for post traumatic acute stress in the months after the
explosion.

The damages were very large, for instance 27 000 houses were damaged.

The total cost of damages estimated by insurers was between 1500 million euros to 2500
million euros.
I.III.III.IV Event management and chronology, emergency rescue measures, crisis management
In the following days of the 21st of September, 1570 firemen and militaries, 950 policemen were
involved in the emergency response and housing monitoring.
Twelve hours after the explosion, there were 300 vehicles and 900 firemen.
The problem was that they arrived without any plan or discussion by phone, as the classical phone
lines were partly destroyed and the mobile phone network was saturated. In those kinds of
situations, the experience of forest fires should help to organise the arrival of little groups of
vehicles.
The state emergency plan was however efficient.
The internal and external emergency plans were not prepared for this scenario and its severity.
Indeed, the explosion scenario was not considered. Scenarios of toxic releases of phosgene, chlorine
and ammonia have been used to design the emergency plan for the 3 main plants of the chemical
platform.
150
The INESC (Institut National d’Etudes de la Sécurité Civile) stated that the documents were not of
much use. The previous training helped the firemen and others to have good judgement.
However, the first firemen were not protected with adequate PPE for any toxic clouds and were not
equipped with any devices to detect these toxic gases.
To get information to the public was a problem as the warning buzzer was not working and the
radios were out. Also the instructions given to stay inside their houses due to the toxic cloud made
no sense with broken windows. The communication network should be designed to have a separate
network for crisis management.
I.III.III.V After the event, aftermath actions to restore, repair, de-pollution, compensate
According to the Fédération Française des Sociétés d’Assurance, 75 000 damages (7 000 were from
business activities) were notified to insurers, 10 % of whom were companies that counts for 90 % of
the compensation payments.
Approximately 30 000 dwellings and 5 000 vehicles were damaged.
According to the insurers for TotalFinaElf company, the company Equad, six months after the event,
had treated 70% of the 20 000 notifications made by other insurers. There was still 60 000 cases to
analyse.
One year after, the insurers had compensated 50 000 cases with 25 000 without any expertise (if
damages were under 1500 euros).
4 000 cases of injured people have been registered after the first year.
Some class actions are running at the time for better compensation of injuries.
Notice that in this case, TotalFinaElf accepted (and was able) to compensate damages before the
trial.
I.III.IV LESSONS LEARNED AND CORRECTIVE ACTIONS
I.III.IV.I Main Findings and official lessons – general and ERMF, IRGC classification
A major lesson was the lack of Seveso II regulatory oversight on off-specification AN. The regulation
was updated with new categories on off-specification AN.
The Seveso Directives also had some limitations. The risk zero faith was down and the belief in the
control given with Seveso II Directives implementation was lost after Enschede, Toulouse and now
Buncefield. A Seveso III Directive is therefore under preparation.
The LUP procedures have been initiated too late and had little or no retroactive force. As a
consequence, typical high-risk situations of the 20th century of industries and urban areas could not
be reduced. LUP procedures were constrained by this situation. The chosen scenarios and safety
perimeters for LUP and emergency perimeters were too small compared to the hazardous potential
or worst cases. They reflected the pressure of the urban area.
Indeed, one of the main conclusions is that controlling major accident hazards by reducing the risk
on-site is not sufficient enough to promote a sustainable development for both industry and urban
areas without Land Use Planning in the next decades. This conclusion was shared by the European
Parliament, which has asked for regulation and policy changes within EU member states.
Other main lessons were drawn upon governance tools (communication and participation of
stakeholders other than industry, State and experts and acceptability criteria unclear), safety
oversight by internal workers of the Health and Safety Committee and external inspectors from the
control authorities.
151
Another lesson was the subcontracting of some activities resulted in a loss of risk knowledge and
control.
I.III.IV.II Main official recommendations - – general and ERMF, IRGC classification
The main recommendations were:

to update French and Seveso II regulation, about off-specification AN

to update Seveso II Directive (Seveso III),

to change risk assessment procedures, to keep deterministic approach insights but integrate
probabilities,

to harmonise risk assessment and safety study procedures and control, between sites,
hazardous goods, fixed plants and between chemical and pyrotechnic plants

to review LUP procedures,

to review public information and consultation procedures for LUP,

to integrate employees in decision-making processes and review processes of safety
management,

to control subcontracting and interim work with regard to hazardous activities,

to improve compensation of victims,

to increase the control authorities means : number of inspectors, expertise

to increase budget for third-party expertise such as INERIS, IRSN.
I.III.IV.III Feedback on corrective action implementation - general and ERMF, IRGC classification
The findings, the lessons and the proposal for new prevention measures, were used by the French
Authorities to implement a new law issued the 30th of July 2003. The Decrees and methodological
tools came later after 2005.
Some lessons were implemented also at the European Union level within Seveso II Directive (in
particular off-specification AN were not covered by regulations such as fertiliser and technical grade
that stick to some standards and norms). The updating of the Seveso II Directive was adopted in view
of classifying two new categories: "off-spec." materials (unclassified AN), taking into account one of
the lessons of Toulouse's explosion and AN based composite fertiliser because of other accidents in
EU with self-sustaining decomposition.
The new French law 2003-699, focuses on several key points to prevent major accidents on Seveso II
sites (high threshold):

Improving regulation by information and governance principles: law measures to enable
involvement in the decision making process of public, employees and subcontractors,

Defining new land use planning rules that deal in particular with potential hazardous
situations: in addition to restrictions for future construction, it introduces retroactivity
principle and defines 3 safety perimeters around sites (area where buildings would be
expropriated, areas where owners will be given to force the city to buy real estate, areas
where city as priority to buy when owners want to sell).

Improving financial compensation for victims after major accidents

Harmonise regulation requirements in the transport of hazardous goods and areas such as
ports and marshalling yards.
152
The aim of these measures was therefore not to change Seveso II Directive transposed in France, but
rather to strengthen it on complementary dimensions of prevention layers or defence in depth
principles.
I.III.IV.IV Diffusion of Information and Knowledge management – general and ERMF, IRGC
classification
Several stakeholders prepared several reports.
As a reminder, five authorities carried out 5 separate inquiries with different perspectives:

The Inspection Générale de l’Environnement (IGE) issued a public report (in which, some
technical investigations were led by INERIS) on 24th October 2001 ordered by the French
Ministry of Environment, Yves Cochet,

The Labour Inspection (Labour Ministry) made an investigation (march 2002),

The TotalFinaElf Group also carried out an investigation and reported in march 2002,

The Police and Justice gave a preliminary press report on June 2002,

The CHSCT (health, safety and working conditions committee) of the employees of the site
subcontracted an investigation to Cidecos-conseil (June 2002)
Also parallel actions were launched by the authorities:

A Parliament Commission (Loos, Le Déaut et al) that led a large number of visits and
interviews at a national level issued a public report in February 2002,

The Environment Ministry organised a national debate on industrial safety after Toulouse,
led by Philippe Essig who issued a public report (February 2002),

The Institut National de Veille Sanitaire (InVS) was mandated to conduct an epidemiological
survey and to monitor the health effects of the disaster (acute, and long term)
153
I.IV Vapour Cloud Explosion at Newark, US - 7th January 1983
I.IV.I GENERAL DETAILS OF EVENT AND SITE
I.IV.I.I Accident Location
Texaco company’s Newark (New Jersey, USA) storage facility
I.IV.I.II Date and time
7th January 1983, About 00:10
I.IV.I.III Short description of industrial setting involved
The complex consisted of 26 storage tanks for various petroleum products, including gasoline. In
addition, many flammable, pressurized gas storage tanks were in the area and other oil companies
also maintained storage facilities nearby.
The fuel handling depot also had various support structures, such as truck stations and building
housing supervisory personnel, gauge equipment and pump controls.
Located apart from the concentrated storage areas were three large covered floating roof-type
storage tanks constructed in the early 1960s, and numbered in Table 27 as 67, 65 and 64. The
dimensions of these tanks, which at the time of the fire contained various grades of gasoline, are as
follows:
Table 27 Dimensions of tanks 67, 65 and 64 at the Newark oil deposit
Tank No.
Diameter (m)
Height (m)
Capacity (m3)
67
24
15
6662
65
37
17
17034
64
57
17
41223
As shown in Figure 37, the tanks were spaced apart, 15 m between tanks 67 and 65 and 24 m
between tanks 65 and 64. This compares with the minimum spacing of 10 m and 23, respectively,
required in NFPA 30, Flammable and combustible Liquids Code by the U.S. National Fire Protection
Association, for these tanks.
These 3 tanks were contained in a single diked area in the western corner of the yard, adjacent to
several railroad track spurs. The earthen and crushed-rock dike was irregular in shape, but the long
side was approximately 275 m and the height was approximately 2 m. The impoundment area could
hold approximately 45000 m3, thus containing the largest spill releasable from the largest tank (64),
as required by NFPA 30.
Each tank was equipped with a vertical riser intended for use with a portable foam pump/generator
that reportedly was stored on the premises of the storage facility. In addition, the perimeter of the
diked area had private hydrants.
Underground pipelines were used to load and unload these tanks. Underground pipelines were used
to load and unload these tanks. Underground piping from a pipeline company at a remote location in
Woodbridge, New Jersey, was used to supply gasoline to this storage area.
154
One of the adjacent facilities is a metal drum refinishing plant, part of which utilized an incinerator to
burn off residues in the barrels. The incinerator was fired continuously even when not in use for
energy saving reasons. A railway yard and tracks also ran alongside the western boundary.
Figure 37 Texaco storage facility in Newark, New Jersey
I.IV.I.IV Context of event (general environment description, topography, weather conditions)
Analysis of the terrain showed that the tank was on slightly higher ground than the drum refinishing
operation. The vapours would be heavier than air; therefore they would have the tendency to hang
low and travel towards lower levels. At midnight the wind speed was listed as negligible, although
prior to that it was listed as variable from the southeast at 5.6 km/h. These factors placed the
incinerator of the refinishing operation in the path of any drifting vapour cloud.
I.IV.I.V Area and stakes vulnerability to the system/event
The facility is located in the Doremus Avenue industrial plant, in a densely populated area. It borders
on other industrial facilities in the north and west. One of the adjacent facilities is a metal drum
refinishing plant, part of which utilized an incinerator to burn off residues in the barrels. In the
south/southwest there is a railroad yard (100 m away from the tanks 64, 65 and 67) and tracks ran
alongside the western boundary on the Doremus Avenue. Furthermore it is 2.5 km away from builtup area and 4 km away from Newark Liberty International Airport.
I.IV.II EVENT DESCRIPTION
I.IV.II.I Main scenario and hazardous phenomena
What appeared to occur in this accident was a vapour cloud explosion followed by severe multi-tank
fires.
155
The blasts, especially the last (and largest) one, appeared to have had a great deal of force, in that a
remote and empty storage tank No. 9 (450 m away) was also damaged.
Other reported damage included flattened railroad freight cars and destruction and fires at the drum
refinishing plant. At the truck terminal building, large tank trucks were tossed about, several
automobiles were incinerated, and numerous fires ignited in the general area. In addition, the impact
of the blast damaged several structures within surrounding industrial areas.
I.IV.II.II Description of industrial process, substances and materials involved
The storage facility consists of a number of petroleum storage tanks which we use for the storage of
gasoline, No 6 fuel oil, No 2 furnace oil and diesel fuel. This material is delivered into the terminal
primarily by pipeline or barge. It is stored temporarily in large tanks before shipment out in smaller
quantities to customers (usually by barge or tank truck).
I.IV.II.III Short description of accident and circumstances
The serious accident at the Texaco storage facility in Newark, on the morning of January 7, was
caused by the overfilling of a gasoline storage tank receiving a shipment via pipeline. Approximately
570 m3 spilled into the common dike enclosure and vapours drifted approximately 300 m to an
incinerator in an industrial facility which provided the source of ignition. A vapour cloud explosion
occurred, followed by severe multi-tank fires. One person was killed, 24 injured and many millions of
dollars of property damage occurred.
I.IV.II.IV Timeline of events
The following is a list of events immediately preceding the blast and subsequent fires.
A previous delivery of fuel oil receipt into the Newark facility ended at 06.50 on January 6th.
Super unleaded gasoline was received via pipeline starting at 06.50 on January 6th, into tank 67;
with a delivery of 6050 m3 scheduled.
This shipment had an expected completion time of 00.10 on January 7th 1983. These figures are
based upon the estimate of the Colonial Pipeline Company
The transfer of super unleaded gasoline from tank 67 into tank 5 commenced at 19.20 on January
6th. Texaco had scheduled a 4140 m3 transfer to make room for the incoming shipment.
Approximately 2070 m3 were actually transferred.
During the course of the evening, the truck loading rack at the facility was operational. The company
indicated that the last load was processed and completed by 23.30 on January 6th.
The company indicated that clerical work was being performed in the terminal office.
It was initially reported that at 23.50 (January 6th), during a check of the pipeline receipt, the
terminal operation discovered that tank 67 was overflowing through its vents.
Subsequently, the time was changed to sometime after midnight.
The company’s emergency procedures were implemented and the Colonial Pipeline dispatcher was
notified by telephone call to stop delivery of product through the pipeline.
Evacuation of the site was then ordered.
Exact timings of the events in the next few minutes appear somewhat jumbled, but at some time
between 00.02 and 00.16 (first calls to Newark Fire Department) a large explosion occurred,
followed by several sever tank fires.
156
I.IV.III Causes and consequences
I.IV.III.I Initiating event and direct causes (technical failure, direct human actions)
The human element appears to have played a key role in the cause of this accident.
The principal factor contributing to the fatality and destruction in this explosion and consequent fire
was the failure to check closely the rising level of the gasoline being pumped into the storage tank.
This brought to an overfilling of tank and then to a subsequent vapour dispersion. Ignition of vapour
caused a vapour cloud explosion.
In fact the code NFPA 30 at that time in force required that a tank receiving transfer of Class I liquids
(eg. Gasoline) was either gauged at frequent intervals during transfer, equipped with high level
alarms to signal on-duty personnel, or equipped with high level alarm system to automatically shut
down or divert the flow. The system for monitoring the level of tanks in the Newark storage facility
was a completely manual one in consideration of first option above. Although the standard operating
procedures of the tank storage facility stipulated this kind of gauging, no data was available
documenting gauging activities prior to the accident.
In addition, some error was probably made in calculating available space and pumping rates.
I.IV.III.II Root causes: failures in ERMF (Emerging Risk Management Framework)
Technical, technological
None of the tanks were equipped with automatic high-level alarms, which could have alerted the
terminal operators to the overflow conditions. Local firefighting equipment was available (designed
to be used in conjunction with the Newark Fire Department and Texaco personnel), but for a fire this
magnitude was useless.
Human, management
Prior to the notification of overfill, time and height readings were reportedly taken on tank 5 at
21.30, 22.30, 23.30 hours. No written proof of this exists. A further investigation indicates that no
documentation of any testing can be found for the times and tanks involved in the accident after
17.00 hours, on January 6th. Company procedures call for the receiving lines to be physically checked
hourly for leaks; as well as setting requirements for hourly testing of the depth and temperature of
the products in the tanks. No record of any of these organizational requirements exists. What little
written proof exists appears to be incomplete and quite slipshod in nature. Moreover, Texaco
authorities indicated that it was not a standard procedure to record the communications, which
occur between the incoming and outgoing terminal operators at the change of shift. Therefore it is
not known exactly what was discussed on the evening of January 6th 1983, between the men
charged with insuring the continuity of safe operations during the receipt and transfer of Super
Unleaded gasoline at Port Newark.
Governance, communication
OSHA (Occupational Safety and Health Administration), after an investigation on the accident, issued
a serious safety citation to Texaco. The citation stated that employees of Texaco USA were exposed
to hazards associated with fire and explosion that resulted from the overfilling and consequent
overflow of a gasoline storage tank or tanks. The citation further stated that these hazards existed
for two reasons. First, the employer had failed to provide adequate supervision to ensure that the
operating procedures and safeguards prescribed in the company’s Operating Manual were being
followed during the receipt of gasoline at the terminal pipeline and in-plant transfer operations. And,
second, the employer had not provided a program for all employees involved in these tank-fill
operations to assure that they were familiar with, and followed, the procedures for safe operations
outlined in the Operational Manual.
157
Policies, regulations, standards
The absence of automatic high level alarm or shutoff for tanks at the Texaco storage facility was in
compliance with the accepted practices of the National Fire Protection Association (NFPA). The
Flammable Liquid Code of the NFPA (standard 30) in force in 1983 specified a number of alternative
methods for guarding against the dangers of overflow. For instance, section 2.9 states: tanks
receiving transfer of Class I liquids from mainline pipelines or marine vessels and located where
overfilling may endanger a place of habitation shall be either: (a) gauged at frequent intervals while
receiving transfer of product, and communications maintained with mainline pipeline or marine
personnel so that flow can be promptly shut down or diverted, or (b) equipped with an independent
high level alarm located where people are on duty during the transfer and can promptly arrange for
flow stoppage or diversion, or (c) equipped with an independent high-level alarm system that will
automatically shut down or divert flow.
I.IV.III.III Specific risk governance activities: failures in IRGC (International Risk Governance
Council) risk governance framework
Pre assessment
No information available. However the perception of risk was low among the personnel, this is
confirmed by personnel behaviour during shipping operations, and the management, which had
equipped the facility with a foam apparatus against fire considered useless for a fire of that
magnitude by Newark Fire Department.
Risk appraisal
No information available
Tolerability and acceptability judgement
At the moment of the accident, the tanks of Newark were not equipped with automatic high-level
alarms but it was in compliance with the Code of the NFPA (standard 30) in force in 1983. Texaco
started installing such devices in 1978 but the Newark facility was not one of the first priorities, so at
that time it was still waiting for the installation.
Risk management
At the moment of accident Newark storage tanks were scheduled for the installation of high-level
alarms.
I.IV.III.IV Consequences, damages, effects to system, people, environment
The blasts, especially the last (and largest) one, appeared to have a great deal of force, in that a
remote and empty storage tank No. 9 some 1200 feet away was flattened by the impact, and tank
No. 4 some 1500 feet away was also damaged.
Other reported damage included flattened railroad freight cars and destruction and fires at the drum
refinishing plant. At the truck terminal building, large tank trucks were tossed about, several
automobiles were incinerated and numerous fires ignited in the general area. In addition, the impact
of the blast damaged several structures of surrounding industrial concerns. Losses have been
estimated in the millions.
While apparently leaving the premises because of the emergency, one employee was caught in the
open at the moment of the blast and killed. The burned body was found near the charred
automobiles at the truck terminal area. Eventually, 24 persons were treated for various injuries
resulting from the accident. Those injured included railroad, tank storage facility and drum
refinishing company employees. There were no fire fighter or police injures.
158
I.IV.III.V Event management, emergency rescue measures, crisis management
Interviews held in the wake of the accident revealed that two of the three employees on site knew of
no other emergency procedure than to call their supervisor.
A review of the company’s emergency operations procedures indicates that, in fact, certain parts of
the plan were implemented. The plan called for tripping emergency switches and notifying the
Colonial Pipeline Company; or the marine operating personnel, whichever was the case. In this
accident, the Colonial dispatcher was notified to shut off the flow, and one of the terminal operators
did activate an emergency switch to shut down the pumping system at Texaco. However, no one
notified the Newark Fire Department, as outlined in the instructions.
At 12:16 AM the Newark Fire Alarm Headquarters received a telephone call from the police relaying
a radio communication that there had been a large explosion in the vicinity of the Doremus Avenue
industrial plant. At about the same time, the fire alarm operators began to receive numerous reports
– ranging from a supposed airplane crash to an exploding vehicle on the highway. The first alarm
response included four Engine Companies, two Ladder Companies, a Battalion Chief, a Deputy Chief
and a Rescue Unit. Before the accident was over, a total of four alarms were sounded with a
response of 15 engines, four ladders, several rescue units and some 90 fire fighters.
At approximately 12:18 AM, the first arriving companies reported numerous spot fires, burning
automobiles and soon discovered the body of the single fatality. Approach was made down the
access road to the diked area, where two of the three tanks involved were found in a collapsed
condition, buckled inwards and burning. The third tank (No. 67 in the diagram) was still relatively
intact and full of gasoline. The remaining contents of all three tanks were burning furiously. Within 5
minutes of the initial alarm, a second alarm was sounded, bringing in four more additional engines, a
ladder company and battalion chief. At 12:28 AM, the third alarm was sounded, calling for an
additional three engine and one ladder companies.
An immediate request was made for the assistance of foam/crash truck from the New Jersey Port
Authority (Newark Airport). Two units were dispatched; however, the unit attempting an approach
from the south of the railroad tracks became stuck on the unfinished access road. The other foam
unit dispensed its agent load on and into tank No. 67; however, little effect was noted. The attempt
was made from a foam monitor nozzle some distance from the tank and it is uncertain how much of
the AFFF solution was successfully directed into the tank. The rate of burning and distance involved
were factors preventing an adequate layer of foam solution to extinguish the blaze.
There were hydrants surrounding the diked area of the fire, but their proximity to the burning tanks
necessitated relaying water with two 3 inch supply lines from hydrants on Delancey Street down the
access road for firefighting efforts at the tanks, the truck terminal, the drum refinishing plant and the
numerous spot fires throughout the general area.
The Newark Fire Department Fireboat was called at 12:40 AM to operate on the bay side of the fire
area. This was more of a precautionary move and the fireboat did not actually become involved in
the fire fighting operation.
A command post was established at the corner of Delancey Street and Doremus Avenue. At 1:00 PM
a fourth alarm was issued, which brought in three additional engine companies.
Approaches from the south were attempted and access was eventually gained by crossing the man
railroad tracks adjacent to the fire scene, which allowed efforts to be directed at protection of the
small “transmix” tank (No. 66 in the diagram) near the pipeline valve and meter station. This small
tank, which suffered some damage to the upper portion of the tank, was alternately reported as
being empty and then full during the accident. Subsequently, some 330 m3 were reported to be
actually in the tank. The contents of the tank did not become involved, due largely to fire department
efforts to keep the tank cool with hose streams.
159
The accident was declared under control at 4:28 PM on Saturday afternoon, January 8. However, the
gasoline in tank No.67 continued to burn for over 24 additional hours, reportedly burning itself out
late Sunday night, January 9, 1983.
I.IV.III.VI After the event, aftermath actions to restore, repair, depollute, compensate
No information available
I.IV.IV LESSONS LEARNED AND CORRECTIVE ACTIONS
I.IV.IV.I Main findings and official lessons
The human element appears to have played a key role in the cause of this accident. Failure to
physically check the tanks at prescribed intervals and properly record the information, along with
error in computing the amount of product going into and coming out of various tanks, led to the
overflow of tank 67.
Furthermore, although notification of the Newark Fire Department is part of the tank storage
facility’s standard emergency operating procedures, it appears that during the initial emergency
operations at the storage facility, the Fire Department was not notified. It is unlikely that immediate
notification of the fire service would have prevented the eventual ignition and explosions.
I.IV.IV.II Main official recommendations
The Newark Fire Department made the following recommendation with regard to protection against
storage tank overfill situations.
We feel that Standard 30 of the National Fire Protection (the Flammable Liquid Code) should be
amended to read as follows.
Section 2-9.1 Prevention of Overfilling Tanks
Tanks receiving transfer of Class I liquids from mainline pipelines or marine vessels shall be:
a) Gauged at frequent intervals while receiving transfer of product, and communications
maintained with mainline pipeline or marine personnel so that the flow can be promptly shut
down or diverted back, and
b) Equipped with an independent high-level alarm located where personnel are on duty during
the transfer and can promptly arrange for flow stoppage or diversion,
c) Equipped with an independent high-level alarm that will automatically shut down or divert
flow
I.IV.IV.III Feedback on corrective action implementation
Standard 30 of the National Fire Protection was not amended as proposed by the Newark Fire
Department. At least until 2000 NFPA 30 stated as follows.
Section 2-6.1 Prevention of Overfilling Tanks
Aboveground tanks at terminals that receive and transfer Class I liquids from mainline pipelines or
marine vessels shall follow formal written procedures to prevent overfilling of tanks utilizing one of
the following methods of protection:
a) Tanks gauged at frequent intervals by personnel continuously on the premise during product
receipt with frequent acknowledged communication maintained with the supplier so flow can
be promptly shut down or diverted.
160
b) Tanks equipped with a high-level detection device that is independent of any gauging
equipment. Alarm shall be located where personnel who are on duty throughout product
transfer can promptly arrange for flow stoppage or diversion.
c) Tanks equipped with an independent high-level detection system that will automatically shut
down or divert flow.
d) Alternatives to instrumentation described in (b) and
e) Where approved by the authority having jurisdiction as affording equivalent protection.
It can be appreciated that there is a clear reference to written procedures, which was previously
lacking, but the independent high-level detection device was not compulsory yet in spite of the
occurrence of the Newark accident.
I.IV.IV.IV Diffusion of information and knowledge management
Several reports were written about the accident:

“Report on the accident at the Texaco Company’s Newark storage Facility 7th January 1983”,
by John P. Caufield, Director and J. Kossup, Fire Chief, published on “Loss Prevention
Bulletin”

Summary Investigation Report, “Gasoline Storage Tank Explosion and Fire, Newark, New
Jersey, 07/01/1983, 1 fatality”, by J. K. Bouchard, Fire Protection Specialist, National Fire
Protection Association
Moreover, hearings before the subcommittee on health and safety of the committee on education
and labour house of representatives were reported by OSHA.
161
I.V Vapour Cloud Explosion and Fire at Naples, Italy – 21st January 1985
I.V.I GENERAL DETAILS OF EVENT AND SITE
I.V.I.I Accident Location
Agip Oil Storage coastal depot, Napoli (Italy).
I.V.I.II Date and Time
21st December 1985, 5.00 am
I.V.I.III Short Description of Industrial Setting Involved
In the night of December 21st 1985, a VCE occurred in the fuel storage area during loading operation
from an oil ship anchored in the close petrol harbour of Napoli. Intense tank fires lasted one week
after the explosion.
The Agip coastal fuel depot was a large tank farm located in the industrial area of Napoli (Italy). The
plant stored fuels in tanks before they were transported to other facilities such as petrol stations or
the near international airport. The plant was directly connected with the petrol harbour through oil
pipeline and was close to larger industrial installation as former Mobil refinery, LPG storage plants
and many other manufacturing industries.
The installation was located inside an urbanised part of Napoli, with very crowded suburbs in the
radius of 1 km, including the main railway station. The whole industrial area was highly confined by
walls, buildings (both commercial and residential) and by an embankment with a mean height of
about 8 m, where local trains and motorways pass. Figure 38 shows a simplified map of the storage
installation, where the main equipment and units involved in the explosion are showed.
Figure 38 Map of Agip oil storage depot in Napoli (Italy) before the accident.
162
I.V.I.IV Context of Event (General Environment Description, Topography, Weather Conditions)
Geology
The area interested by the explosion is close to the coastal side, oriental zone of the town of Napoli.
The geology of the entire region is dominated by the presence of volcano Vesuvius, which along
centuries has completely characterised the coastal morphology by frequent explosion (the last
occurred in 1944). For this reason, the area is among the most hazardous region in the world. On the
other hand, the volcanic effects have produced a decrease of the local seismicity, which is
consistently lower than the close Apennines area of the Campania region where Napoli is located.
However, low-magnitude earthquakes may be the consequences of the volcanic activity, which may
anticipate, or follow eruption.
Water
The storage plant is located near the port of Napoli, which insists in the gulf of Napoli, in the
Tyrrenium sea. Close to the storage area there was a small creek (actually a small stream adopted
also as emergency sewage system by industries). No relevant superficial watercourse or basin, nor
important underground watercourses are present.
Topography
The area surrounding is totally industrialised and urbanised. For the specific issues regarding the
vapour explosion and more specifically for the analysis of dispersion of gasoline vapours, it is
important to note that and that the terrain of AGIP was completely flat with the exception of
industry border walls and large embankment which in some way enclosed totally the area. That is
demonstrated by the following Figure 39-Figure 41.
Figure 39 Pictures from the inside of industrial installation showing completely urbanised area in the very
close surroundings of plant, just before the explosion.
163
Figure 40 The view of industrial installation plant just before the explosion in 1985. Embankment and fire
protection wall are clearly visible.
Figure 41 The view of industrial installation and area as it is in Aug 2009. Google Maps ®
Weather conditions
The explosion occurred during the night at 5:00 a.m. The weather was clear, with low speed wind (ca.
1 ms-1) towards NW direction (see Figure 38) and the temperature was about 8°C. Those conditions
strongly facilitate the formation of vapour cloud. Relative humidity was 70%.
I.V.I.V Vulnerabilities of main assets and capabilities
The industrial area where the storage plant was located is the oriental industrial site of Napoli. The
town suburb (circoscrizioni) is known as Barra, Ponticelli and San Giovanni, and is characterised by an
elevated concentration of population, the presence of the industrial harbour and several industrial
activities. The specific location were the explosion occurred is Barra, which extends over 781,9 ha2 ,
164
with an elevation of 44 m over sea level, 47 inhabitants/ha and total population of 36000 (2001).
Most of the area was (and still is) characterised by the presence of large oil and LPG industries (Q8,
Esso, AGIP, IP) but also by a number of small production plants, and artisans of iron and metals, food
industry and gross markets.
I.V.II EVENT DESCRIPTION
I.V.II.I Main Scenario
What occurred in this accident was a Vapour Cloud Explosion (VCE) followed by severe tank fires,
which lasted one week. The accident occurred during the loading phase from the oil ship berthed in
the close petrol harbour, and the formation of a large vapour cloud after the overfilling of one tank.
The explosion caused 5 causalities, the complete destruction of the storage area and minor damage
up to 5 km from the ignition point.
The explosion
The main explosion occurred at about 5:00 a.m. Eyewitness accounts and media reports refer to a
very large explosion followed by a number of lesser ones, possibly due to local explosion and internal
tank explosion.
A single large explosion though with complex time-history is confirmed by seismic signals located
either in the close surrounding of the storage plant or far away (Figure 42). An explosion duration of
about 3 seconds is observable from seismograms.
Figure 42 Seismic signals recorded at different distances from the explosion epicentre:
a) 82 km – soil blast wave; b) 29 km – soil blast wave;
c) 29 km - air blast wave; d) 9 km – soil blast wave.
Calculation of the total mechanical energy of explosion from earthquake has been also performed
and, through mechanical and seismic yield coefficient for on-ground unconfined explosion. A total
explosion energy of about 2.0.104 MJ was calculated, which corresponds to 4.2 tons of TNT.
165
Ignition sources
Several hypotheses have been assumed for the ignition of the vapour cloud. There was an
eyewitness: the train driver passing over the embankment just before the explosion, but it is likely
that he did not caught the timing of ignition but the initial laminar phase of the explosion, within the
tank. One worker was found dead in the clean (“white”) oil pumping station n.2, north of storage
installation, while trying to use fire extinguisher. It is important that all workers in the site were
found dead with the exception of one (the chemist or more specifically the technician who was
checking taking samples of oil being loaded), which however escaped just before the explosion, thus
confirming the presence of large vapour cloud.
The main evidence of ignition regards the pumping station n.2. Indeed, the cloud has been probably
moving and enlarging through the direction of wind from the tank 17, in almost free-dispersing
conditions, where spark was unlikely, towards the pumping station which was in function at the
moment of the explosion.
Development and magnitude
The accident occurred the night of 21st Dec 1985 at about 5:00 a.m., during the loading of storage
from the oil ship GELA berthed in the close harbour, through pipeline. There are several evidences
and witness that that the overfilling of TK 17 started about one hour and half before, thus producing
a large pool in the correspondent catch basin and the following invasion of pump station n.1 through
rupture in the catch basin wall. The flow rate from pumping ship was about 700 m3/h.
The fuel from the ship was the “winter gasoline”, so larger fractions of lighter hydrocarbons were
present. Hence, the vapour cloud was then started to form fed by pool evaporation and spray
formed from the fall of gasoline from the top of the tank. The particular conditions of weather
allowed very large cloud of C5-C6 hydrocarbons, which spread in the direction of wind until ignition
was found (likely the working pumping station).
I.V.II.II Description of Industrial Process, Substances and Materials Involved
The fuel storage area under analysis was managed by AGIP and extended over about 74,000m 2 and
was divided by a private street into two zones, respectively the SIF area (customs duty area) and the
Nazionale area (for the storage of fuels ready for distribution to home market).
The AGIP installation involved in the explosion was the SIF which covered about 49,000 m 2 and
contained 37 tanks used for the storage of gasoline, diesel fuel and fuel oil, with a total capacity of
about 100,000 m3.
The fuel tanks were essentially distributed in three parallel rows along the E-W axis, and were
surrounded by catch basins of proper volume, at 2 m under the ground level and separated by walls
extending 0.6 m over the ground level. The tanks were connected by 8” pipes.
Two buildings, loading units both for road tankers and rail tanks were also present.
The fuel from the ship at the moment of explosion was “winter gasoline”, so larger fractions of
lighter hydrocarbons were present.
I.V.II.III Short Description of Accident and Circumstances
In the late afternoon of Friday, December 20th 1985, the oil tanker Gela, berthed at the oil deck in
the harbour of Naples, started to pump 750 m3 h-1 of gasoline to the SIF area, through a 1km long,
10” pipeline. At 1:20 a.m. of Dec 21st, tank no. 16 was completely filled and the gasoline flow was
diverted to tank no. 17. At 3 a.m., the incoming gasoline should have been diverted to tank no. 18.
But it did not occur mainly due to negligence of operator and overfilling lasted for more than one
hour, thus producing a pool, which formed a large vapour cloud and, after ignition, an explosion.
166
The blast wave destroyed the main building and a shanty residential building located near the border
wall of plant. Also it damaged many tanks, rail tanks and pipelines in the close surrounding of tank
no.17. 5 people died.
A large fire lasted over one week, ma domino effects were relatively small as the large intervention
of fire brigade.
I.V.II.IV Timeline of Events
20 December 1985
Late afternoon
In the afternoon of Dec. 20th 1985 an oil tanker started to pump “winter” gasoline to SIF area.
3:00 a.m.
The tank 17 was filled and the flow should have been diverted to tank 18. This operation was not
correctly done and the gasoline flowed out the tank 17 for more than 1.5 hour.
4:30.a.m.
A total amount of 700 tons of gasoline spilled over, forming a large pool..
The high ambient temperature (8°C),,the absence of wind, and the high level of confinement
promoted the formation of a homogeneous vapour cloud (150000 m3).
5:00 a.m.
A fire was seen near the pumping station n°2 by a driver of a train which was passing over the
embankment (South side). A worker was found died in that area while trying to fight the fire by a
portable extinguisher.
Few minutes later a strong explosion occurred. 5 people died and the explosion and the following fire
destroyed almost completely the storage area. The fire lasted one week.
About one week after
The fire was extinguished. Emergency was considered finished.
I.V.III CAUSES AND CONSEQUENCES
I.V.III.I Initiating Event and Direct Causes (Technical Failure, Direct Human Actions)
The Vapour Cloud Explosion resulted from the ignition of a vapour cloud emanating from spilled
gasoline due to the overfilling of storage tank no.17 in the Agip Oil Storage site during the loading
operation from a petrol ship harboured in the nearby industrial port.
The main causes of damage within the plant and in the close surrounding of the plant were:
a) the blast wave produced by the VCE
b) the pool fire for the domino effects on adjacent tanks
c) the tank fires (due to domino effects) which lasted many days
The blast wave produced was produced by the Vapour Cloud Explosion of a large cloud composed by
the lighter fraction and droplets of winter gasoline.
The vapour were dispersed in a relatively (partially) confined environment due to the geometrical
and layout of the industrial area and also for the weather conditions (light gust of wind, night).
But the calculated energy of explosion can only be related to large amount of vapour, which in turns
can be explained with:
167

duration of evaporation, which lasted more than one hour and half;

the evaporation rate, which was more intense than normal gasoline due to the winter
composition but also due to the technical construction of tank (see Buncefield report);

area (the pool area), which has been demonstrated to be larger than the single catch basin of
Tank no. 17
The long duration of the overfilling was mainly caused by lack of control of operation,
miscommunication between ship and industrial installation, culpable negligence of workers and tank
operators, and lack of technical control for the prevention of accidents.
The area of pool was due to poor maintenance of catch basin wall, which was demonstrated to have
connections (holes) with the close pumping station and possibly with another catch basin.
The trial enquire demonstrated also that the poor maintenance would however hindered any
prevention measure after the overfilling as the pipeline to emergency tank and sewage systems were
isolated.
The pool fire produced domino effects on adjacent tanks but the fire brigades allowed the control of
the escalation of accident, thus affecting the total economical aspect of damages.
I.V.III.II Root causes: failures in ERMF (Emerging Risk Management Framework)
Technical, Technological
At the time of explosion, the high level alarms and system did not worked at all. All emergency action
were manual. However, the main reason for the formation of large vapour cloud was the bad
conditions of catch basin wall of TK 17. It has been showed that a hole between the concrete wall of
basin and the pumping station n.1 left the oil to flow in the station, thus producing a very large pool,
which in turns enhanced the evaporation flow rateAnother technical issue was the malfunctioning of the pumping system towards the “black” water
tank and to the near sewage, which was intended to be used in extreme emergency for emptying the
tank. Indeed, the connection was closed and the water tank was full after cleaning of tanks the days
before.
The freefall of droplets leads to entrainment of air and mixing between the air and fuel vapour, and
the formation of a rich fuel/air mixture, thus promoting the evaporation of lighter components of
gasoline, eg butanes, pentanes and hexanes. The contribution of spray/droplet has been taken into
account in the source model by Maremonti et al., 1996.
Human, Management
It was accepted that the carelessness of workers on the night of explosion had caused the explosion,
by failing to notice that the overfilling was going on and allowing the continued pumping of the
petrol into the tank from the ship for over 1:30 hour. Sleeping of most of workers was possibly the
main cause. That hypothesis has been confirmed by the position of some workers which died within
the collapsed main building. One of the workers saved his life because as he run away through the
main entrance, possibly after watching and smelling the vapour cloud. The worker was going to
check the quality of pumped oil in a very trivial (the court writes about a simple plastic bottle
adapted for the sampling).
The front line staff was not trained to be able to reliably detect, diagnose and respond to potential
accidents.
It is worth saying that the safety management system, organisation of human resources, and plant
management was addressed by the internal mandatory guidelines of AGIP (now ENI Group), which is
undoubtedly among the largest oil company in the world, and respectful of law.
168
Governance, Communication
The system for delivering fuel safely around the country depends on good communications between
those responsible for delivery and those responsible for receiving the delivered batches, to ensure
sites receiving fuel are able to accept deliveries safely. Existing safety arrangements, including
communications, might be inadequate and need to be reviewed.
Policies, Regulations, Standards
At the time of the explosion, the Seveso Directive was not mandatory and the industrial procedures
did not take into account the analysis of risks or land use planning. However, an internal safety
management system and the organisation of human resources was existing and respectful of the law.
I.V.III.III Specific risk governance activities: failures in IRGC (International Risk Governance
Council) risk governance framework
Pre assessment
The worst credible scenario for the site is the major liquid fuel pool fire and the tank fire. Vapour
cloud explosions (VCE) are rarely considered for gasoline as the combination of overfilling annual
frequency, the probability of ignition, the probability of failure of emergency system, and finally the
intrinsic chemical characteristic of gasoline leave the assessment to decide for VCE as not credible
event. On the other hand this type of scenario occurs however in a periodic behaviour worldwide
with very large devastation.
Risk levels were considered low amongst personnel in the case of Napoli accident. This aspect is
however essential for plants where low hazardous fuels as gasoline or diesel oil are stored.
Eventually, IRGC should address the respect of sound risk engineering procedure, which considers
mandatory the inclusion of very catastrophic scenario even if the likelihood of accident is relatively
low.
With respect to Napoli, it should be however noted that Seveso regulations were not in force at the
time.
Risk appraisal
It is very important to include the loading unit (the ship, in the case of VCE) in the risk appraisal as
integral part of the plant.
VCE was not deemed a credible event in Napoli and more in general in plants where low hazardous
fuels are stored.
Increased likelihood of vapour cloud formation by gasoline cascade from tank overfilling is often
neglected.
Tolerability and acceptability judgement
Industrial area containing fuel storage plants are generally considered acceptable for the population.
For the specific case of VCE exposed in this text, the vicinity of other more hazardous installations as
the petro-chemical refinery helped the acceptability of the installation.
In the case of IRGC, tolerability threshold values and acceptability judgement should refer not only to
the plant installation but also to the loading units linked with normal activities.
For the case of Napoli accident, relying on manual changeover between tanks whilst filling was
deemed as acceptable.
169
Risk management
The protection system of fuel storage plant is typically based on large pool fires. However risk
management and IRGC should take into account the accidental scenario whose effects are
catastrophic even if the credibility of accident is very low.
In the case of Napoli, risk management would have operated positively if noting that high level
alarms were fitted but not working properly. Furthermore, bad maintenance of the bund walls
allowed the gasoline pool to spread in the pump area.
No adequate supervision to ensure that stipulated operations were actually being followed, nor for
ensuring operators properly trained.
I.V.III.IV Consequences, effects to system, people, environment, economical, social
Consequences
The consequences of VCE to the industrial system, to people, environment, social, are so large that
any failure in the risk management activities for the “prevention” of VCE in gasoline fuel storage
plant is a main responsibility. To this regard, it should taken into account that domino effects (within
and outside the plants) and fires typically follow the primary explosion. These aspect should be
included in IRGC as they are mentioned (also in the EU normative) but rarely considered. The
cooperative intervention in order to prevent domino effects and spreading of damage among other
installation located nearby is essential.
In the case of VCE in Napoli, however, it should be noted that no domino effects have been observed
in the surrounding installation, even if the industrial, coastal area where the VCE occurred was, and is
nowadays, characterised by an elevate density of LPG and Petrol storage areas, especially in the
nearby former refinery. Most of damages were indeed found within the plant border. However, a
low grade civilian building located just close to the border of the plant collapsed, an elder inhabitant
died.
All buildings of the storage plant were destroyed or heavily damaged. The workers which were inside
the plant at the moment of the explosion died for the collapse of buildings. Another was found dead
near the pumping area with fire extinguishing bottle in hands. Just one worked survived, as he
escaped from the plant just before the explosion.
The fire after the explosion lasted for almost one week, destroying many of the remaining tanks.
The plant was completely closed and the remaining equipment and buildings dismantled. The area is
now flat.
Effects to system
The entire production plant was completely destroyed. The installation was totally dismantled after
the explosion. A flat terrain is now present in the fuel storage area.
Effects to people
The window glass of many buildings in the near suburbs were shattered up to 1 km away from the
explosion point, however with no injuries. A low grade civilian building located just in the proximity
of one border collapsed, with one dead..
Effect to environment
The large fire produced dense black smoke for long time. No other environmental pollution was
observed.
170
Economical effects
The oriental coastal part of the town, where the industrial harbour is active, was completely blocked
for one week due to the very intense fire of tanks. Local trains were also stopped. Massive
intervention of fire brigade led to minimum damages to nearby industrial plants.
The fuel storage plant was completely dismantled after the accident.
The VCE has occurred just together with large economical crisis of those years, which limited the
activity of petrol harbour of Napoli.
Social effects
The people living in the coastal industrial area of Napoli are included in a very hazardous area which
includes the volcanic hazard for the Mt. Vesuvius. Just after the VCE, a Civil Protection prevention
and mitigation plan included the harbour of Napoli in the so-called yellow zone, where some
damages due to ash and lapillus are expected and massive evacuation of population is likely. The
inclusion of industrial area in the Vesuvius Civil Protection Plan was undoubtedly pushed also by the
VCE accident occurred in the same area.
I.V.III.V Event management, emergency rescue measures, crisis management
The explosion and the possible following fires may affect not only the industrial installation but also
the entire urban system. Indeed, fuel storage areas are often considered at low risk and, also for
economical reason, are often installed near towns, residential units, office areas. That is an
important issue for IRGC.
The cooperative intervention in order to reduce domino effects and spreading of damage among
other installation located nearby is essential and should be included in IRGC recommendations.
In the case of the accident in Napoli, the emergency rescue measures and the crisis management
were positively faced by the local fire brigade, which was well equipped and instructed for large fires
due to the several fuel storage plants and the former Mobil refinery located in the same coastal
industrial area of the town. It should be noted that this area is still a petrol harbour, even if with
more limited activities. On the other hand, LPG arms has been installed in the harbour.
As cited previously, the people living in the coastal industrial area of Napoli are included in a very
hazardous area which includes the volcanic hazard for the Mt. Vesuvius. A Civil Protection prevention
and mitigation plan is now in force if volcanic early warning and alarms occur. The plan includes the
industrial harbour of Napoli, where some damages due to ash and lapillus are expected and massive
evacuation of population of local suburbs is likely but not mandatory, depending on the eruption
evolution. The inclusion of industrial area in the Vesuvius Civil Protection Plan was undoubtedly
pushed also by the VCE accident occurred in the same area. This plan is strictly correlated and
parallel with the introduction of Seveso Directives in Italy. A co-joint effort of industry, fire brigade,
local authorities, Civil Protection and CNR have produced a specific industrial prevention and
mitigation plant which is included in the general volcanic emergency plan.
The new plan includes joint operation for crisis management, loading operation and other harbour
operations. E.g. the ships berthed in the harbour are now directly connected by pipeline with one
storage plant only, which afterward distribute the fuel to other commercial installations.
I.V.III.VI After the event, aftermath actions to restore, repair, depollute, compensate
The VCE is typically a very catastrophic event which leads to a strong downsizing of activities.
Restoring and repairing is typically very expensive for the large destruction and also the public
opinion pushes towards the total closure of the storage plant.
171
Pollution was not a real issue at that time, but however – in the case of fuel storage area - it is limited
by the intrinsic storage characterisation (presence of catch basin, pumping system, general
mitigation system, polluted water clean system).
The plant in Napoli was totally dismantled after the VCE and the following fire. No industrial activities
are running on the area interested by the accident.
I.V.IV LESSONS LEARNED AND CORRECTIVE ACTIONS
I.V.IV.I Main Findings and official lessons
The accident presented a very complex behavior, whose main aspects are the fuel evaporation, the
cloud dispersion, the explosive combustion of the gaseous mixture, and the following fire.
At the time of VCE, detonation of vapour was generally considered as the main cause of such
extended damage. The structural analysis, however, clarified that even low pressure deflagrations,
though involving large amount of combustion energy, are able to produce explosion waves with total
destruction of tanks, concrete structures and buildings, piping detachment and failure, unless
specifically reinforced.
On the basis of current scientific understanding of the way in which VCEs occur, the potential for a
VCE at a site like Napoli would have been limited to those parts of the facility that provided sufficient
confinement or congestion to generate a VCE, giving rise to relatively small risks in other part.
It’s important noting that the formation of large vapour cloud as a result of overfilling a tank and the
entailing risk of powerful blast with domino effects is still not considered a sufficiently credible
scenario for purposes of land use planning, licensing or emergency planning.
The design of the tank itself contributed to the vapor/mist formation.
The VCE described was caused by serious human errors and, in particular, by the culpable negligence
of the tank operators.
I.V.IV.II Main official recommendations
The official investigation on this accident resulted in severe comments on the behaviour of workers
and management. None of them were even simply respecting any of the procedures, most were
sleeping.
No comments on the design and operations of the fuel storage site was given in the official report,
even if the enquiring groups did a large job for the reconstruction of accidents and for the analysis of
Vapour Cloud Explosion.
Shortly after the accident (but not only for it), an industrial emergency plan was concerted between
public authorities, private industrial owners and population. It is worth mentioning that the area is
under the strong volcanic hazard and several hard recommendations for industrial owners, together
with Seveso Directive, are now mandatory.
The new plan includes joint operation for crisis management, loading operation and other harbour
operations. E.g. the ships berthed in the harbour are now directly connected by pipeline with one
storage plant only, which afterward distribute the fuel to other commercial installations.
I.V.IV.III Feedback on corrective action implementation
The installations does not exist anymore in the present days but however lesson learned for the
accident have addressed large variation in the management of petrol harbour and coastal depots,
even if important economical and industrial modifications of the area and, later, the introduction of
Seveso law have had large weight on political decisions.
172
Few years after the accident, the refinery has been completely closed and Q8 has now the entire
ownership of the large storage tank of the same refinery. The storage plant of Q8 is still working and
actually behaves as collector of oil from the close harbour for most of the still existing tank farms
located in the vicinity. That was considered the right option for the control of loading operation from
oil tanker ships.
In order to avoid damage to the population, following Seveso directive, each plant has produced the
Safety Report, and a consortium has been created for the management and safety operation of
petrol harbour.
I.V.IV.IV Diffusion of Information and Knowledge management
The official investigation were carried out by the Court of Napoli. It is actually un-available unless
long official procedure.
The Institute of Research on Combustion of the Italian National Research Council started few years
after to analyze the opportunities of Computation Fluid Dynamics for the evaluation of Vapour Cloud
Explosion, under the guide of his former Director, which at that time was also involved in the
allegation. That produced a small research group dedicated to industrial safety, which is still working
on the industrial emergency plan of the town and developing safety culture in the country.
The fire brigade published a paper on its internal journal, in Italian.
173
I.VI Vapour Cloud Explosion at St Herblain, France, 7th October 1991
I.VI.I GENERAL DETAILS OF EVENT AND SITE
I.VI.I.I Accident Location
The oil storage depot is located in the city of Saint-Herblain, near and West of Nantes (a populated
and urban area within the 10 biggest of France), in Western France, close to the Loire river (one of
the 5 biggest river of France), department N° 44.
There was in 1987 at 1 or 2 km away a big fire of NPK fertilisers that produced toxic fumes which
forced the evacuation of 37 000 people of Nantes Suburbs.
The irony, is that the bus stop is called “the burnt factory” in the memory of a coffee facility fire last
century.
I.VI.I.II Date and Time
The Monday morning, the 07th October 1991, around 4:20 am occurred the Vapor Cloud Explosion, a
pool fire lasted several hours afterwards.
There were severe damages, 6 injured the day of the accident, one of them later died from its burns
at hospital.
I.VI.I.III Short Description of Industrial Setting Involved
The accident occurred in an oil storage depot of a company called Groupement Pétrolier de Nantes
(GPN), meaning that the storage was owned and shared by several companies :

Fina, a Belgium petroleum company that was later merged with Total,

Esso, the French subsidiary of the American petroleum company Exxon,

And a subsidiary (Dépôt Pétrolier de Bretagne) of the two French petroleum companies,
Total and Elf, later marged.
It was operated since 1978.
The oil depot was fed by boats on a wharf by the river Loire that was located at 125 m. The various
oil came from different refineries.
The distribution of the gasoline to stations is then made by road tankers on 4 stations. Nearby there
was a separate car park used by numerous petroleum trucks.
There were 6 people working at the depot. A night guardian is doing security and safety rounds when
the site is closed.
Usually, the depot starts at 4 am. 2 employees operates the petroleum storage depot. The first roadtankers arrives right before time at the parking waiting for loading with their motor engine on. This
parking is equipped with a locker, and washing trucks system.
This petroleum depot was composed of a fuel storage capacity of approximately 80 000 m3 of petrol
unleaded or not, gasoil and domestic fuel. It was 500 m long.
There were 11 storage tanks, with 4 floating internal roofs and 7 fixed roofs. They could store
between 1 425 m3 to 15 000 m3.
The tank n°31 that was implied in the failure could contain 6500 m3 and was filled at 70% (4500 to
4750 m3) with unleaded petrol (octane indicator at 98) at the time of the accident. It was a floating
roof tank.
174
The tank n°30 at 10 to 15 meters, had a storage capacity of 10 710 m3 and was filled with 5500 m3 of
domestic fuel oil the day of the accident. It had a fixed roof. After the event, there remain 3600 m3.
The Road Tankers could store 38 000 litres of various oils, usually divided in 11 compartments.
They are required to park empty on the parking of the depot when waiting for oil. By regulation they
are required not to park in cities.
Figure 43 Aerial view of the oil depot.
175
Figure 43 shows the oil storage depot GPN, which is on the left of the street. The Tank 30 and 31 are
at the top of the picture. The parking for road tankers in by those tanks before the street.
On the other side of the street, there is another oil storage. On the right of the picture, but not
visible, there is the river Loire.
I.VI.I.IV Context of Event (General Environment Description, Topography, Weather Conditions)
Geology
The oil depot was initially on marsh (swampy area). They were later filled with fill to develop some
industrial activities which were closer about 400 m.
Water
The river Loire was at around 400 m from tank n°30 and 31.
The tide of the sea which was not very far too, a few km towards west, was not exceptional that day.
Topography
The oil depot was about 2 km large.
The oil depot area is globally flat.
However, a gaseous release, heavier than air, would expand from the retention walls to the truck
parking.
Weather conditions
At the time of the accident (around 4 am), the atmospheric conditions were as follows :

Temperature of 5°C,

Wind speed inferior to 1 m per second,

Stable atmosphere, class E (Pasquill), low diffusion

Humidity of approximately 100 %,

The atmospheric pressure was about 1020 Pa at 4 am.
From the meteorological conditions, it is probable than from the ground to 200 m height, the
stability was high. From 200 m to 1500 m, there was a convective instability. There were two
inversion layers, the first one at 200m and the second one between 1500 m to 2000m. These
inversion layers might partly explain some of the reflexions of the pressure waves.
The air temperature was lower than the unleaded gasoline temperature of 17°C.
Vulnerabilities of main assets and capabilities
The city of Nantes was at 8 km and the first houses of the nearby villages were mostly about 1 km.
The railtrack Nantes-Saint-Nazaire is located at 300 m from the depot.
The oil storage depot is one of those located on 2 km long on the Loire river before Nantes city. The
closest are another bigger petroleum depot, a chemical products depot and a storage of materials for
road construction.
At that time, within a few kilometres down the river Loire to the seaport Saint-Nazaire, there were
several industrial facilities, among them 7 Seveso I Directive sites. It was the 7 of the department out
of the 12 of the region. There were a refinery, 2 fertiliser plants, one chemical plant, a gas depot, the
port terminal for gas and petrol. There were 7 oil storage depots in the department and 30 in the
region.
176
I.VI.II EVENT DESCRIPTION
I.VI.II.I Main Scenario
After a leak of an unleaded gasoline on a transfer line that occurred on a rubber joint just after a
valve opening automatic and remote procedure was completed, there was a VCE followed by tank
and pool fires.
The dirty water network of the site was overfilled of gasoline and had explosions too.
The pool fires lasted several hours.
The leak
Testimonies enabled to say that after the remote opening of the bottom valve of depot tanks, there
was a white opaque mist smelling unleaded gasoline that was coming from the tank n°30 and 31.
The leak occurred at the rubber joint of the a pipe fitting of the 12 inches pipe after the bottom valve
of the unleaded gasoline SP98 tank storing 4 525 m3.
The release poured out in a retention basin, that is common to a tank of domestic fuel of 4500 m3,
with vaporisation and mist formation. The mist formation was facilitated by a 100% of humidity. It
was noticed that part of this cloud was made of aerosols.
The explosion
The vapour/mist cloud (of approximately 1.5 meter height) estimated to 23 000 m3 extended outside
the retention basin (overfilling a wall of 2 meters), covering a road and trucks parking, and 20
minutes later was ignited and lead to an VCE in nearby premises where lorry drivers were present,
one of whom being killed.
Nearby buildings and tanks suffered structural damage, some road tankers were overturned by the
explosion and a pool fire was present for hours; window panes were broken within a 2 km radius
from the VCE.
Some explosion occurred in the network of rain of the depot. The petrol-rainwater separator was
implied and the isolating valve of the retention basin for the rainwater remain open, and could not
be closed due to the damage to the closing device.
The fire
After the explosion, the fire expands to the 2 parts of the retention basin, the 2 tanks, to the
roadtankers on the parking and threatens other tanks. Some flames of the fire were 60 m high
(Figure 44). To get the full emergency water means was long and the fire lasted until 12 am. The fire
expanded to an area of 6 560 m² will finally be extinguished 72 minutes after the attack started.
177
Figure 44 Some flames were at 60 m of height during pool fires
Ignition sources
Many potential sources of ignition were present and investigated : hot truck motors, electrical
material, trailer, washing truck system, water heater in the locker room.
Relying on testimonies and other evidence, the most probable ignition source was proposed to be
heater in the confined washing hall, which increased the ignition energy and flame velocity provided
to the main cloud.
It is probable that the trucks motors have continued to run without igniting hydrocarbons vapours.
Overview of the damage
In order to illustrate the damage, pictures of road-tankers after the accident are shown in Figure 45.
178
Figure 45 The road-tankers damaged were close from each other
The pictures in Figure 45 show also that tankers were parked closed to each others. Tanks were
damaged and road-tankers were turned over and burned. The road tankers were at 35 m from the
179
closest tank. All those road tankers could contain 38 000 liters of gasoline but were empty as
required on the parking.
The initial explosion severely damaged the structures in the first 200 meters (see e.g. in Figure 46),
and were limited afterwards. Windows were broken until 2 km (50% at 700 m, 75% at 320 m) and
even 4 km for one known case.
Figure 46 Example of damages of municipal building at 50 m
I.VI.II.II Description of Industrial Process, Substances and Materials Involved
The oil depot involved several material : gasoline, unleaded gasoline and fuel oil. Trucks were empty.
Another assumption was made with underground methane coming from organic decomposition in
the area. Some studies were made by other experts (BRGM) and showed the possibility to reach the
flammability limit but not to sustain such an explosion.
The composition of the unleaded gasoline in liquid phase was :

Butane : 3%,

MTBE (Methyl-Tertio-Buthyl-Ether) : 10%,

Light gasoline : 14%,

Iso-pentane : 18 %,

Heavy Reformate : 55%.
At 17°C, the temperature of the materials stored, the vapour in equilibrium is composed of
(calculated by Raoult Law, and in brackets the density of the vapours :

Butane : 26% (with a 2 kg/m3 vapor density),
180

Iso-pentane : 53 %, (with a 2,5 kg/m3 vapor density),

Others : 21%, (with a 3 kg/m3 vapor density).
It shows the importance of aromatics, in particular iso-pentane for the cloud-vapor composition and
reactivitiy. In addition aerosols were mechanically formed. The average density means that the
behaviour of the cloud is like a heavy gas which was confirmed by testimonies.
Also a possibility to explain the white color of the mist, is the possible condensation of a part of the
iso-pentane vapors within the atmosphere at 5°C.
I.VI.II.III Short Description of Accident and Circumstances
After a bottom valve of the a tank was automatically and remotely opened, a leak from an unleaded
gasoline tank under hydrostatic pressure occurred, most probably at the level of a rubber joint of a
pipe fitting creating a cloud of vapour and aerosols.
The VCE occurred the Monday morning at 4:20 when the activity was starting at the oil storage
depot.
The explosion was followed by a fire of retention basin and tanks. Both were extinguished hours
after.
I.VI.II.IV Timeline of Events
The sequence of events is based on evidence and testimonies collected by FINA, but also statements
made by the Police.
Monday, the 07th October 1991, in the morning,

2:50 : the guardian, night employee arrives at the oil depot to open the doors of the parking
and has nothing to report.

3:05 : A FINA driver arrives to take its truck.

3:45 : The driver leaves the depot parking. He does not notice anything unusual (lights on,
clear weather, no suspicious odours).

3:50 : the night guardian is back. He starts its last security guard round.

3:55 or 4:00 : arrival of the first employee and by a second one right after. One road-tanker is
started to warm it.

4:00 : security guard round, nothing to report, no leakage from unleaded high-octane petrol
tanks. He checks a monitoring device near the tank n°31 (to prove its guard round, he has 5
devices to check around the depot).

4:00 to 4:05 : The automated system is started. Opening of the 5 valves at the bottom of the
tanks that are remote electrically controlled opening of valves. Among them the tanks n°30
and 31.

3.50 to 4:20 : Successive arrival of drivers in the adjacent parking. Development of a white
cloud over the road. 4 road-tankers in the area of the cloud have their motor running.

4:10 : a car is stopped in the cloud. He pushes its car towards its truck to start its truck. He
smells the odour and goes to locker room to change himself and leave.

4:10 : A driver warns the depot employees of the presence of a fog or white cloud smelling of
unleaded high-octane petrol.

4:10 to 4:20 : the two operators try to identify the origin of the cloud formation. They stated
that the white mist has overwhelmed the road along the river Loire. They went by car and
181
stopped it at 50 m from the parking due to the fog. Then, they climb to observe from the
eastern ground wall of the retention pool of the tank n°22, a white cloud on the parking and
at the level of tank n°30 and 31 only.

4:20 : Explosion. Some employees try to close the valve but it is destroyed.

4:25 : The fire develops to tank n°30 and 31 and to the retention pool.

4:33 : arrival of the depot manager.

4:38 : Arrival of fire brigades from Saint-Herblain and Nantes-Chantenay.

12:17 : The fire is finally estinguished.
NB : The times noted are approximate to within a few minutes.
All this information made it possible to determine the initial conditions before the ignition. In
particular, the fact that the cloud was covering all the parking.
I.VI.III CAUSES AND CONSEQUENCES
I.VI.III.I Initiating Event and Direct Causes (Technical Failure, Direct Human Actions)
Analysis of the plausibility of the leak and cloud scenarios
Several direct witnesses made it possible to establish the most probable chain of events and to
understand the development of the phenomena.
These are a number of elements that could be considered as certain or very probable:

At about 4 am, at the retention basin a white cloud formed and spread toward the roadtankers park. Its advance was, nearly 15 minutes to extend 50 meters and to reach the road.
Simultaneously, its depth was increasing in size to reach approximately 1.5 meters height;

Heated motor vehicles, cars and road-tankers, were in the opaque white cloud ;

The cloud smelt unleaded high octane petrol.
Other following elements, although observed by only one witness, could be considered as reliable :

The disaster had began in the south-east end of the car park ;

Flammable liquid marks were observed at ground level after the explosion ;
We should point out that the white cloud was not necessary representative of a combustible cloud.
Nevertheless, some observed damage is the result of the cloud explosion. Consequently, part of this
white cloud was within the explosive limits. The explosive cloud could have been formed according 2
hypotheses :

A massive leak due to a pipe rupture creating a liquid pool which evaporation would have
created a mist due to the cold and the high humidity, in addition with the lack of wind, the
dispersion is limited.

A leak under pressure at the level of the rubber joint of a pipe of 12 inches (30,48cm).
182
Figure 47 Tank n°31, after the valve, the pipe fitting is dismantled
Assessment of the 2 hypotheses for the cloud generation
The calculation made for the first scenario showed that a rate between 0.8 kg/s to 5.5 kg/s was not
achieved by the pool to get a 25 000 m3 cloud in 20 minutes. This hypothesis does not in addition to
the observation of witnesses about the mist formation and the retention basin not totally wet of
petrol.
The other hypothesis with a rubber joint rupture enabled to get a rate higher (almost one magnitude
order : 28 kg/s) under the hydrostatic pressures (there was 9 or 10m of liquid level), considering that
10% of the jet is instantaneously vaporised. The high vapour tension of this material (0,6 bar) makes
this assumption possible. Simulations have shown that the composition of unleaded gas, with isopentane is particularly important for the rainout ratio and in the vapour composition. In addition, it is
183
probable that leak configuration with a possible jet-break could have created mechanically lots of
aerosols.
In addition other similar accidents, in particular the Vallaurie (26, France) accident, the 04th of
January 1989, with a hole of a pipe, showed the capacity of this gasoline to generate an aerosol mist
with a turbulent jet. In those conditions, the risks become very similar to the ones of gas and aerosols
ones.
Still, there were some doubts despite the hypotheses proposed about the precise origin of the leak
and the dispersion of cloud.
I.VI.III.II Root causes: failures in ERMF (Emerging Risk Management Framework)
Technical, Technological
The rubber joint resistance was guaranteed by the manufacturers to aromatic concentrations of a
maximum of 30%. The rubber joint Viking Johnson (nitril joint) of the a pipe fitting (of the 12 inches
pipe after the bottom valve of the unleaded gasoline SP98 tank storing 4 525 m3), was in fact being
used for 15 years, and was at the time of the accident facing an unleaded gasoline with 98 octane
indices, containing 55% of aromatics. It was the first days of operation with unleaded gasoline.
In order to prepare the change of materials stored, some works on the tank and pipes were made in
July and August 1991. The works were made according to the depot manager on the basis of
standard industry specifications. It was controlled and approved before start the 24th of September
1991, only 2 weeks before the accident.
Figure 48 location of the failing rubber joint at the pipe fitting
184
Human, Management
No specific analysis was reported in the available documentation.
However, there were no direct human error that initiated the accident. The initiating event is a
technical failure.
However, one can state that there were several organisational deficiencies that put the employees
running the depot and the drivers in difficult position facing such worst case scenarios which were
not expected or assessed in safety studies and emergency procedures (for the cloud explosion
scenario). The employees did not have the means (detectors) to be alerted in due time nor the
means to take appropriate emergency actions to mitigate the leak (remote closure of the valve,
closure of electrical equipment and engines). When they tried, it was after the explosion, without
success.
Their behaviour and testimonies showed however an inadequate risk perception, in trying to see
where the leak came from, or driving their engine... It shows however their professional commitment
that conducted them to try to resolve the problem rather than save their lives.
Governance, Communication
No specific analysis was reported in the investigation reports.
However, in 1991, the communication framework and governance procedures were started with
Seveso I transposition (e.g. 1987 Law for LUP, see Dechy et al 2005) The site was not under Seveso I
Directive but under French regulations for hazardous sites. There were other Seveso I sites in a few
kilometres of the Loire river. The oil depot was mostly located in a former industrial area with no
inhabitants close. The development of Nantes suburbs since the fifties had however brought
inhabitants closer to the site.
But at several hundred meters, there was a little quarter called Roche-Maurice. They had the
experience of a very close (1 km) huge NPK fertiliser fire in 1987 that produced toxic fumes which
forced the authorities to evacuate 37 000 people from the suburbs of Nantes city. At that time they
were forgotten to be evacuated. So when the explosion occurred, they remember well the former
event and feared it. The police closed the area of the oil depot but no evacuation was mentioned in
the newspapers. Inhabitants from Nantes suburbs were awaken by the explosion at 4:20, were more
or less informed by the radio and could see in the morning the fumes which enabled to locate the
accident.
Policies, Regulations, Standards
After some accidents abroad (in particular in UK with Milford Haven in 1983) and in France in Port
Edouard Heriot of Lyon in 1987, with boil over and other pool fires, a French regulation for those oil
storage depot was established the 09th of November 1989. Those oil depots were for most of them
not concerned by Seveso I Directive but should store more than 10 000 m3. It was required Land Use
Planning procedures (PIG) to be established by the end of 1992 with information of the public parties
of risk reduction measures. This was applicable to all existing oil depots. By the end of 1990, a
feedback was expected by the Ministry from the inspection for potential difficulties met. In particular
the regulation asked for safety studies to assess several scenarios and especially tank explosion and
boil over scenarios. At that time, the safety distances would then be calculated on the basis of pool
fires in retention basin which was not a requirement in 1972 regulation. The explosion risk was
required to be assessed only for fixed roof tanks.
So at that time, the VCE risk was not considered in the worst case scenarios that were compulsory to
assess in a safety studies that would be used for LUP procedure around oil depot. It does not mean
VCE were not assessed in some safety studies, in particular for more confined zones that were more
185
found in refineries rather than in oil storage depots. It is however clear that the VCE scenario
assessment for a oil depot was not a widespread practice.
In addition, the safety distances were only specifically required for new projects of storage. There
were also several safety measures required by the regulation, among them the fire water network,
and in particular some fixed water systems on the top of tanks to cool them in case of fire, some
positive safety valves for bottom valve tanks. In addition, the risk of more polar gasoline with the
introduction of materials such as MTBE was pointed for the extinguishing parameters. The learning
from experience was clearly mentioned in particular the need for those positive safety valves to
avoid pool fires that are fed by continuous leaks.
According the oil depot manager, the oil storage depot was complying to regulation. The control
authorities had inspected the oil depot few months before the accident. Improvements were
expected (with preventive and protective measures, such an ATEX detector which was not
implemented before the accident.
In June 1991, there was another severe oil depot fire in Saint-Ouen which involved 472 firemen. After
the event, the Environment Ministry mentioned that those safety measures were not implemented
and could have reduced the effects. At that time, the Industry Ministry, mentioned that the priority
was to reduce the consequence of those events. This was the main philosophy in France at that time
in coherence with the deterministic approach.
I.VI.III.III Specific risk governance activities: failures in IRGC (International Risk Governance
Council) risk governance framework
Pre assessment
The worst credible scenario in the emergency plan (what was in the safety studies is not known to us)
for this site was thought to be a major pool fire and not the VCE that actually occurred. The recent
(1989) regulation required risks to be assessed an especially pool fires, boil over and fixed roof tank
explosion.
Risk appraisal
It is not known to us if in the safety studies, a VCE was considered. The specific regulation of oil
storage depots did not identify it specifically as a worst case scenario to be mandatorily assessed for
LUP procedures. But general safety regulations would require any explosion risks to be assessed. At
that time, despite some accidents and some scientific knowledge about it with experiments and
methodologies developments in seventies and eighties, the VCE in a relatively Unconfined area of a
oil depot compared to refineries was not identified in industrial standards nor regulations. Major
risks, with more deterministic, worst case and envelope approaches, were pool fires, tank explosion
and boil over due to eighties accidents.
Tolerability and acceptability judgement
The oil depot was installed before most of inhabited areas that settled at several hundred meters. It
is an industrial area, with several warehouses and oil storages, so there were not much LUP concerns
before the event. It was not a Seveso I site.
However, after the event, the LUP issue was raised in the newspapers when the Industry Minister
came on the site the day after. The need to have those oil storage too close from the urban areas
was raised but not much debated. The industry Minister mentioned that it was a false problem. He
stated that the industrial development required to have those storages close to the consumers, and
that putting them away or in less but bigger storages would multiplicate the risks to bring them to
the consumers (=not reduce the global risks with a transfer on transportation risks). He added that
unfortunately the accidents were still possible and the priority was to reduce the consequence of
those events.
186
Risk management
The protection assessment was based on hazards such as large pool fires and tank explosion. The
explosion risk was known to be possible but VCE with that severity were not expected.
Some monitoring and detection devices are lacking putting at risk a too late emergency action to
control or mitigate a leak or major deviation. Those equipments (such as positive safety valves) were
required by a new regulation (1989) and it was planned to put an ATEX detector which was not done
before the event.
The limited supervision on the site in case of emergency does not enable them to start easily the fire
water systems while trying to escape and alert managers and rescue services. The protection for
large pool fires were not implemented at the time of the accident despite recent regulation (1989).
The foam means and fire water were insufficient and delayed the attack. In addition the fire scenario
(retention basin) in the emergency plan was not the worst or real case that occurred with retention
basin and tank fire.
Despite no evidence analysis in documentation available, one can make assumptions of underlying
conditions, such as organisational deficiencies which have not prevented the accident.
There were probably some deficiencies in change management and design specification about the
operations with unleaded gas and interactions with materials and equipment such as rubber joints.
There were probably some lack of inspection and monitoring of a new operations configuration.
There were probably deficiencies in learning from experiences policies as it was probably not the first
time to operate with unleaded gasoline.
However the retention basins have limited the propagation of the leak.
I.VI.III.IV Consequences, damages, effects to system, people, environment, economical, social
Effects to people

Two employees of the oil depot were severely injured, 3 truck drivers were injured, and
another driver died few days after due to its burns

the explosion was heard more than 10 km and to 50 km according to some newspapers

some air-pollution measures will be made to assess the toxicity of the fumes ; the fumes
went high in the sky, so there was no direct consequences ; at 11 am, the analyses on the
level of the ground were low.
Property/Material damages
The main damages inside the oil depot were the following :

The tank n°31 : containing unleaded gasoline was completely destroyed.

The tank n°30 : containing domestic fuel oil, is partly destroyed, other storage tank nearby
were severely damaged,

The pipes in the retention pool of the tank n°31 and 32 were damaged and the ones of the
gasoline tank were torn at the linkage level.

15 road-tankers were totally or partially destroyed, 4 cars were burned.

The driver locker room was destroyed so as the cleaning station and a construction
bungalow.

The rainwater system for used waters and the hydrocarbon-water separator were damaged
due to explosions.
187

Little damages on the depot offices (windows, glasses, doors,...), located at 250 m from the
depot, were observed.

A neighbouring petroleum depot had 3 tanks damaged.

Important quantities of petrol infiltrated in the ground. It was necessary to install
piezometers and then depollute the soil. The vapours collected have been treated at a
burning station.

The damages were estimated at 16 Million Euros (1991) with 2 tanks, 4 cars, 15 road-tanks,
the washing station, all destroyed. 3 other tanks have been damaged, some offices and some
pipes.
Environment

Damages were observed on the neighbouring houses (mostly windows) between 1 and 2 km
and very few cases of broken windows until 4km : 400 insurance damage compensation files
were filled. In Saint-Herblain, there were damages on some companies, schools, church.

Approximately 500 m3 of gasoline have polluted the ground on an area of 20 000 m² on 7 m
depth and the underground water table (or phreatic layer).

The Loire river was not polluted due to retention basin mostly.
Scale of the disaster
Based on the Seveso Directive, European scale voted in 1994, the disaster is classified by BARPI as
follows :

Hazardous materials releases : level 4, (Q1 = level 4 = 3 600 tons of unleaded fuel and 3 600
tons of domestic fuel / high threshold for petrol material is 25 000 tons ; Q2 = level 3 = the
TNT equivalent of 1.8 to 3.6 tons)

Human and social consequences : level 2 (H3 = level 2 due to one death),

Environmental consequences : level 3 (Env 13 = level 3 with 20 000 m² of polluted soil),

Economical consequences : level 4 (€15 = level 4 with 16 M€ over the 15 M€ threshold).
Social and media
After the event, several newspapers covered the event which was very impressive. The industry
Ministry came to visit the accidental area.
In the newspapers, there was the analysis that the accident could have turned into a catastrophe if
some circumstances were not positive : e.g. if it had occurred during the day with more workers and
traffic, or if the fires were not extinguished and had propagated to other oil storages and the full
depot, no houses nearby, the other oil depot or Gaz de France were not hit, and the weather
conditions were then in favour of rescue services.
I.VI.III.V Event management, emergency rescue measures, crisis management
The chronology of events of emergency actions by fire rescue services is given below :
07th October 1991, in the morning

4:28 : First responders leaves from Nantes. They directly felt the blast.

4:33 : the depot manager arrives.

4:36 : Internal Emergency Plan is launched by the depot manager.

4:38 : Arrival of the rescue services of Saint-Herblain and Nantes.
188

4:49 : The police blocks the streets. The trains are stopped at 5:30

After the explosion, some unleaded gasoline could leak into the rain water drain system. The
valve at the retention basin was still open. The fire expanded with drain systems. The road
tankers were empty.

The fire brigades decide to only attack the fire as soon as conditions of the fire defence plan
are met. The scenario taken for the plan was the largest pool fire of 4 340 m² which would
require foam rate of 5l/m²/mn and a rate of water of 22 000 l/mn which are supposed to
manage to extinguish the fire in 22 mn. But the available fire water network is only if 5 000
l/mn. It is required to have a boat with pumping services, but there will be a tide effect on
the wharf to handle (8 meters in that area).

4:56 : A boat called Hoedic in the Saint-Nazaire port nearby is called because it has large
pumping equipments (12 000 l/mn) designed for the petroleum and methane port. Two
other boats had arrived but with only 2 x 150 m3/h of water capacity.

5:00 : the Fire pumps of the depot are started. The tanks are being protected. Despite the
implementation of a water screen between the 2 tanks, the fire expand to the compartments
of the retention basin, that is common to the unleaded tank implied in the accident and the
other storage of domestic fuel of 10 000 m3.

5:07 : the burned victims are evacuated towards Hospitals.

Some thick smokes are visible at kilometres from there.

5:30 : the flames have propagated to the 2 tanks of unleaded petrol and the domestic fuel,
one is open, and to the road-tankers on the parking are threatening nearby storages. They
cooled a LPG (propane) tank of 1,5m3 that was at 30 m from the wall of the retention basin
and protected with water 2 tanks of 15 000 m3 of gasoline and fuel.

5:45 to 6:00 : More rescue services are called from other departments (85, 29 and 49).

6:30 : the small fires (rainwater system and concrete areas of the depot) are managed.

7:59 : arrival of rescue services from Finistère (29), Ille et Vilaine (35), Maine et Loire (49)

9:55 : Arrival of the boat Hoedic with large pumping equipment.

10:13 arrival of rescue services of Morbihan (56) and Vendée (85).

10:30 : the fire in retention basin n°30 is extinguished. It confirms that this retention basin
was not overwhelmed by liquid gasoline.

11:05 : order of fire attack with 2 000 m3/h with a rate of 5 liter/m²/minute.

12:05 : the tank n°31 of unleaded gasoline is extinguished.

12:17 : the message is communicated about fire extinguished.
The extinguishing challenge :
Approximately 200 Firemen will finally be there for 7 hours. They finally manage to avoid a
propagation, domino effects and extinguished it. Flames were 20 meters high.
80 600 liters of extinguisher foam were gathered (with 17 000 provided by nearby industrials). 50
000 l of extinguisher foam have been used.
The boat had pumping system of 12 000 liter per minutes which was enough.
Pool retention area in fire : 4.340 m².
Part of the fire area of the tank 30 and 31 : 2.200 m².
189
Plans were to apply for 20 minutes with a rate of 22.000 liter/minute and with 5 liter/m²/minute of
application rate. The reality was that it was required to apply it for 72 minutes at a rate of 28.000
liter/minute and with 4,3 liter/m²/minute of application rate. The domestic fuel tank and its
retention basin compartment were extinguished in 35 minutes.
22 fire water lines of 110 mm with a total of 10 km were established.
I.VI.III.VI After the event, aftermath actions to restore, repair, depollute, compensate
To secure the site and the area damaged :

A guardian was mandated 24h/24h,

Investigation of a potential pollution,

Permanent control of the explosive vapour state all over the area,

The extinguisher foam carpet is maintained with the rate of water,

Pumping of the mix of fire waters and petrol, approximately 3 800 m3,

Setting of a temporary fence, approximately 300 meters,

The boat tanker Port-Tudy of 5000 m3 capacity was unloading at 300 m at the time of the
explosion. They decided to move away.
Other actions taken

Press conference,

Some piezometric puits are implemented,

The hole above the decanter is closed with concrete,

A plan to depollute is established. Approximately 500 m3 of gasoline have polluted the
ground on 2 hectares on 7 m depth and the underground water (water table/phreatic). Two
companies made some soil pollutions studies and proposed a soil venting solution.

A complete damage investigation is done,

The causes investigations are launched, with BRGM, INERIS, PETROFINA, Inspectors of control
authorities, experts from other oil companies, and an expert commission.

The judicial inquiry is launched,

A study of a limited restoration and repair of the damaged installation to get the license from
the authorities (the Prefect) to restart the operation, after the Prefect has taken a Law act or
Order the 30th of October 1991. This Order required to stop operations and to depollute the
water table/phreatic.

A study is made by a company of the risk of accidental loss of a rubber joint on pipe fitting.

Restoration of the damaged emergency means,

Update of the electrical plans, materials

The oil storage could restart fully November the 2nd of 1993.
I.VI.IV LESSONS LEARNED AND CORRECTIVE ACTIONS
I.VI.IV.I Main Findings and official lessons
A high severity of the VCE
190
The damage analysis, detailed previously, shows that the main factors increased the violence of the
explosion (at least 30 kPa according damages, possibly 50 kPa according to simulations) :

the nature and reactivity of the materials involved (a high rate of aromatic in particular of
iso-pentane),

the level of aerosols generated by the leak configuration,

The very low wind (inferior to 1m per second), the low difussion and the external
temperature lower than the stored material temperature have limited the dispersion of the
vapors and aerosols that were formed, and increased the probabilty of concentration
gradient,

the fact that there was, close to the leak, in the parking, with the parked trucks (very close), a
reduced space area and partly confined area

and the most probable ignition source that could have been in a utilities building where a
water gas heater in the washing station of the trucks : this initial explosion in a confined
space could have seriously increased the ignition energy of the large unconfined vapour
cloud,
This factors have somehow all accelerated the flame and have increased the overpressures produced
by the explosion propagation. Other factors such as the form of the cloud, the location of the
ignition, the turbulence of the cloud and flames, may have in general an impact and could have had
an impact on this specific case.
This was not the first accident in such a configuration but, probably in France, the one which blast
produced the most extensive damage to the surroundings. For instance, numerous windowpanes
were broken in a 2 kilometer radius. It was at the time an “A-typical” scenario, as far as the effects
were largely more severe and extended than the effects modeled through usual reference scenario
taken into account in safety studies of oil storage depot or for the Land Use Planning around those
sites.
There were several safety measures not implemented but required by the new and recent regulation
(1989) for oil storage depots. It is true, that those requirements were compulsory for new oil depots.
For economical reasons, it is usually not applied to existing sites for some degree. This kind of
regulation had no strong retroactive force for existing sites which hamper the enforcing capacity of
control authorities. These new regulation safety requirement were usually coming from new
knowledge or recent lessons from accidents. This is why, and usually, for existing sites, when a new
regulation came in, the operators had to propose a corrective action plan and negotiate the delays
they could obtain with authorities to fully implement the corrective actions or to debate them if the
measures had drawbacks due to incompatibility with former design for instance or economic
efficiency.
Those safety measures that could have been implemented if the company wanted to take advantage
of lessons learned from external accidents (indeed in June 1991, there was an accident in Saint-Ouen
showing again the value of those safety measures) and the recent (1989) regulation requirements
were :

positive safety valves at the bottom pipes tank,

ATEX detectors,

fixed water systems on top of tanks,

sufficient fire water network and extinguishing foam means.
Despite limited domino effects (on other tanks of the oil depot and/or other industrial sites nearby)
at the exception of the pool fires, it is necessary to address the domino effects risks between
191
neighbouring sites as far as the accident could have been worse, if for instance, the LPG tank of
1,5m3 was not protected by emergency services. The explosion produced missiles that went at
several hundreds of meters away, had also made a hole in a tank of 15 000 m3 of petrol. The hole
position was above the real level of storage that day, and the missiles were blocked by the trucks
parking and destroyed in between.
A better analysis of the interactions between materials used to store and the materials stored with
their concentration of aromatics in unleaded gasoline with octane level is required in the design and
maintenance of such storage systems. Indeed, it was the first time unleaded gasoline was used on
that tank (2 weeks only of operations). The use of unleaded gasoline was in development at the time.
Related organizational factors were therefore deficient (change management, design specifications,
inspection, learning from experience).
The training of operators, which were trained on fire risks, must now focus also on explosion risks
prevention and the safety measures to take in case of aerosols or explosive clouds. The behavior of
employees and road-tankers drivers showed a lack of knowledge about it. But their risk perception
was lowered by the usual gasoline odors on oil storage depot and some frequent mists in the area
close to the river.
In addition to the compliance to generic regulations, the emergency firefighting means must be
designed according to local specificity and emergency plans and procedures should address the
availability and performance of those systems in real life conditions. This is a common responsibility
between industrials and fire brigades.
The firefighting emergency plan mentioned that the attack of a similar scenario should have relied on
a rate of extinguisher foam of 5l/m².min, and with water rate of 22 000 l/min and with a result of a
fire extinguished in 20 minutes. The gaps and differences between the real case and the theoretical
plan showed some lessons :

The firefighting plan did take a most severe pool scenario of 4 340 m² (retention basin) and
not the real one of 6560 m², (retention basin + 2 tank surface),

On the 13 hoses nozzles, 3 were devoted to cooling nearby tanks, so the full water rate
devoted to fire extinction was only 21 600 l/mn.

They expected to have the water available, however there were some problems due to the
tide and the lack of water accessibility was restored with high tide,

It was plan a theoretical efficiency of a 100% for the mass area dispersion of the foam, but in
practice, this efficiency ratio is lower (mix of foam, problem of quality and ageing),

The firefighting of unleaded gasoline fire was not really studied. Its behavior is different and
would possibly need some extinguisher foams for polar liquids.
In addition, the fire brigade faced difficulties and needed a long time to get the required means. The
fact of asking nearby industrials, not for a complementary quantity of foam, but for the first attacks
requirements is not acceptable with emergency needs.
There was a limited cost of the emergency actions (of 300 000 € (€ of 1991) with 180 000 € of foam
extinguisher ; the boat with pumping means, the jib crane, and other expenses). They are limited to
0.5% of the value of the assets exposed to the event. Indeed :

The fire brigades coming from 14 fire brigades from 5 departments (a grouping of the fire
brigade management within the department was conducted years later) as mentioned in the
internal emergency plan were efficient,

The industrials had a mutual convention to help each others,

The external emergency plan was helpful too.
192
In France, some regulations and some regulation on oil storage depot (November 09th 1989), and a
regulation of the firefighting means for those oil storage depots (July 06th 1990) were issued in the 2
years before the event and probably had positive effects. They were issued after severe accidents at
Milford Haven in 1983 in UK and in 1987 in France at Port Edouard Heriot.
I.VI.IV.II Main official recommendations
No official recommendations are present in the documentation available.
However, from INERIS investigation, a practical recommendation for petroleum depot is to avoid the
parking of many road-tankers nearby the storage or to have enough space between tankers. At the
time, it was difficult to predict safe distance. The accident at Saint-Herblain proves that the distance
between a possible petrol leak and parking should be greater than 50 m without any other
compensation measure.
After Toulouse disaster (and Buncefield even if its lessons are not implemented yet in the following
guidelines), an industry guidelines for UVCE assessment in oil depot storages was established in May
2007. It mentions in generic terms release scenarios very similar to Buncefield and Saint-Herblain
more or less. It does mention several factors that increase explosion strength. It mentions in
particular some Saint-Herblain lessons in a generic term, mentioning the risks of confinement above
the parking of 5 road tankers for the choice of multi-energy method indices.
I.VI.IV.III Feedback on corrective action implementation
The adopted corrective measures on this depot were the following :

To install gas detectors close to the bottom tank valves and close to gasoline pumps.

To install bottom tank valves that are positive safety,

To strengthen the control procedures at the opening and closing of the oil storage depots,

To remove the parking and install it to a greater distance,

To conduct risk analysis before there are some works to be done,

To analyse the behaviour of the petrol joint with unleaded gasoline that can contain more
than 30% of aromatic hydrocarbons.
I.VI.IV.IV Diffusion of Information and Knowledge management
The Environment Ministry of the time, with the BARPI edited a case file within ARIA database.
INERIS made a joint publication with FINA in a French symposium. Later INERIS made an additional
work on the effect of additional road-tankers on explosion strength.
193
I.VII Comparison of Major Accidents: Vapour Cloud Explosions at Buncefield (UK,
2005), San Juan Bay (Puerto Rico, 2009), Jaipur (India, 2009)
I.VII.I Introduction
Less than 4 years after the accident of Buncefield (11th December 2005, Figure 49) two other vapour
cloud explosions in oil depots occurred within few days of each other. These accidents reproduced
the same accident mechanisms recorded at Buncefield, St Herblain, Naples and Newark, which are
mentioned as examples of atypical scenarios within the Integ-Risk Description of Work.
Figure 49 Fire at the Buncefield oil depot (11/12/2005)
I.VII.II San Juan bay (Puerto Rico), Caribbean Petroleum Corporation, 23rd October 2009
Figure 50 Fire at the San Juan CPC oil depot (23/10/2009)
On October 23rd 2009, a vapour cloud explosion and subsequent fires occurred at the Caribbean
Petroleum Corporation fuel depot at the Luchetti Industrial Park in Bayamon, Puerto Rico. The
company receives and distributes bulk fuel products such as gasoline, diesel, and jet fuel. Minor
194
injuries occurred, but the tank farm was nearly completely destroyed. Extensive offsite damage
occurred including hundreds of broken windows, interior damage, and mild structural steel
deformation.
I.VII.III Jaipur (India), M/S Indian Oil Corporation, 29th October 2009
Figure 51 Fire at the Jaipur IOC oil depot (29/10/2009)
A devastating vapour cloud explosion and subsequent fire accident occurred on October 29th 2009
at about 7.30 pm in the storage depot of M/S Indian Oil Corporation at Sitapura (Sanganer), Jaipur,
Rajasthan killing 11 persons and injuring 45. The product loss of around 60,000 KL has been reported.
In this accident the entire installation was totally destroyed and buildings in the immediate
neighbourhood were also heavily damaged.
At Jaipur, a vertical spray leak of gasoline from a hammer blind valve was allowed to continue for
around 75 minutes, forming the large vapour cloud which was then accidentally ignited.
The original leak was caused by an absence of written site specific operating procedures which
allowed a sequence of valve-opening operations to occur without checks to ensure the status of
other valves. This was compounded by the engineering design which allowed the hammer blind valve
in that location, and the absence of any remotely operated valves. This meant that once the initial
leakage occurred, there was no means of bringing the leak under control. In addition, only half of the
normal operating crew of four were at the scene and became overwhelmed by the fumes.
195
I.VII.IV Comparison of Accidents
Table 28 Comparison of accidents at Buncefield, San Juan bay and Jaipur
Accident
scenario
Substance
involved
Overfilling of
vented fixed roof
tank.
Buncefield
San Juan Bay
Loss of
Containment
VCE and
subsequent large
pool fire
Liquid dispersal
and vaporisation
in cascade.
Source of
Ignition
Pump house
Gasoline
Overfilling
Unknown
Open valve.
Upward spray
caused by tank
head pressure.
Jaipur
Pump house
The two recent accidents have many characteristics in common with Buncefield, but in particular the
accident at Jaipur is nearly the exact reproduction of the English disaster.
I.VII.V Conclusions
The occurrence of these two accidents is a severe reminder that lessons from past accidents are still
unheard, in spite of several early-warnings recorded until now. A way of making sure that this kind of
atypical accidents is considered by common safety procedure is thus a primary need.
196
Annex II
Survey of available technologies for LNG regasification
197
II.I Introduction
This annex shows the survey of current available LNG regasification technologies performed for the
case-study “Liquid Natural Gas (LNG) regasification in sensitive areas on-shore and offshore” within
the framework of the EC project iNTeg-Risk and reported in the following iNTeg-Risk deliverable:

Uguccioni G, 2010. Package of: Reference solution containing documents, methods and tools,
for the assessment and management of emerging risks related to new and intensified
technologies available for LNG regasification terminals, Deliverable D1.2.4.1 of EC project
iNTeg-Risk, 7th FP, Grant: CP-IP 213345-2
A common template is used for technology description, in order to consent a systematic analysis for
the following LNG regasification technologies:

On-shore installation with double containment storage tank technology and submerged
combustion vaporizer technology.

Off-shore Gravity Based Structure (GBS) installation with self-supporting prismatic storage
tank technology, Open Rack Vaporizer (ORV) technology and Waste Heat Recovery Vaporizer
(WHRV) technology.

Off-shore FSRU (Floating Storage Regasification Unit) installation with spherical type storage
tank technology and intermediate fluid vaporizer technology.

Transport and regasification vessel with membrane storage tank technology and shell and
tube vaporizer technology.

Specific data of equipments and alternatives – LNG storage

Specific data of equipments and alternatives – LNG vaporization
Private communication with Saipem Energy Services S.p.A., which was involved itself in the iNTegRisk case-study, was the main source of information for the survey.
198
II.II On-shore LNG regasification terminal
II.II.I Identification (id. number, short name/acronym, full name)
On-shore installation: double containment storage tanks and SCV vaporizers (technology description
based on the Panigaglia Terminal of GNL Italia, Snam Rete Gas).
II.II.II Type of application (on-shore, off-shore GBS, off-shore FSRU, transport and
regasification vessel)
On-shore LNG regasifier
II.II.III Development stage (R&D, design, construction, operational)
Operational
II.II.IV Short description (main features)
The plant comprises the following sections: jetty, storage, vaporization, boil-off recovery, Wobbe
index correction, auxiliary and safety systems.
The jetty is composed by the docking area for methane ships and equipped with 3 unloading arms. A
500 m-long pipeline goes along the jetty to the storage tanks and is used for LNG transfer.
The storage section is composed by 2 double containment tanks and 3 submerged pumps delivering
LPG from the tanks.
The vaporisation section is composed by 4 submerged combustion vaporizers (SCV) (3 running and 1
on stand-by) with primary and booster pumping systems.
The boil-off recovery section is composed by 3 cryogenic compressors and 1 blower. Compressors
recover boil-off gas generated during the normal operation and the unloading phase and transfer it
to the recondenser. A blower transfers the boil-off gas to the ship to compensate the pressure
decrease due to the LNG unloading.
The Wobbe index correction is necessary to adjust the gas with the quality specifications required
before the distribution. For this aim there are 2 compression strings compressing dried air used for
correction operations.
Auxiliary and safety systems. The plant is managed by an automatic control system, whose
commands are in the Control Centralized Room. The section of auxiliary systems includes all the
principal process support activities, such as the principal and emergency electric energy, the fire
control system, the refrigeration system and station of gas quality and quantity control before the
distribution.
II.II.V Potentiality (maximum annual production achieved/foreseeable)
Maximum annual production achieved of NG = 3.5*109 Nm3/year
II.II.VI Limits for application
Modern Italian plants are designed for a maximum annual potentiality achievable of 8*109 - 12*109
Nm3/year of NG depending on the number of storage tanks and vaporizers.
199
II.II.VII Block diagram
BOIL-OFF
RECOVERY
CARRIER SHIP
LNG STORAGE
VAPORIZATION
QUALITY AND
QUANTITY
MEASURES
DISTRIBUTION
CORRECTION
Figure 52 Block diagram of an on-shore LNG regasification terminal
II.II.VIII Process flow diagram
Figure 53 Process flow diagram of an on-shore LNG regasification terminal
II.II.IX List of main equipments

Jetty

Unloading arms

Transfer line

Storage tanks

Submerged pumps

Primary pumps
200

Absorption Tower

Booster pumps

Vaporizers

Compressors

Blower

Wobbe index correction system

Control, safety and monitoring systems

Production and distribution utilities
II.II.X Description/schemes of significant equipment (including geometrical data, e.g.
volumes, if relevant)
II.II.X.I Jetty
500m-long jetty provided with mooring devices for ships up to 65.000 m3
II.II.X.II Unloading arms
3 arms of INOX steel:

2 arms (external position) used for LNG transfer (diameter equal to 12'', flow rate equal to
2,000 m3lng/h) at T = -160°C, P = 3 barg.

1 arm (central position) used for boil off gas return (diameter equal to 8'', flow rate equal
to 12,000 Nm3/h).
II.II.X.III Transfer line
Line between unloading arms and storage tanks. Pipe diameter equal to 24'', maximum flow rate
equal to 4,000 m3lng/h
II.II.X.IV Tanks
VAPOR DRAWOFF 24"
FILL LINE 24"
RISER 4"
PERLITE INSULATION
(WOODEN SUPPORTS)
ROOF PLATFORM
V
S
OUTER TANK ROOF
(CARBON STEEL)
OUTER TANK SHELL
(PRESTRESSED CONCRETE)
SUBMERGED PUMP COLUMN
(N° 3)
COLUMNS
(N° 28)
INNER TANK
(9% Ni STEEL)
PERLITE INSULATION IN N2 ATMOSPHERE
PILE CAP
PERLITE INSULATION
(WOODEN SUPPORTS)
NEW FONDATION
PILES
Figure 54 Scheme of a double containment tank
201
2 double containment tanks
Capacity equal to 50,000 m3 (real capacity equal to 44,000 m3)
Design pressure: 0.050 barg
Working pressure: 0.035 barg
II.II.X.V Submerged pumps
3 submerged pumps collecting LPG inside each tank:

2 with a potentiality equal to 500 m3lng/h (1 running and 1 on stand-by)

1 with a potentiality equal to 170 m3lng/h (used for start-up and lower rates)
II.II.X.VI Primary pumps
4 multi-stage centrifugal pumps (7 stages)
Nominal potentiality equal to 250 m3lng/h
Discharge pressure equal to 23 barg

3 pumps running

1 pump on stand-by
II.II.X.VII Booster pumps
4 multi-stage centrifugal pumps (18 stages)
Nominal potentiality equal to 250 m3lng/h
Discharge pressure equal to 79 barg

3 pumps running

1 pump on stand-by
II.II.X.VIII Recondenser
The recondenser is an absorption tower allowing the recovery of boil-off gas. BOG is compressed up
to the column working pressure (23 barg) by cryogenic compressors and is absorbed by LNG.
Due to safety reasons (preventing overpressure), exceeding boil-off gas is directly ejected to the
atmosphere through a vent at 72m above the ground.
II.II.X.IX Compressors
3 cryogenic compressors
Discharge pressure equal to 23 barg

2 with a potentiality of 8,000 kg/h used during LNG unloading

1 with a potentiality of 2,000 kg/h used for BOG generated in the tanks
202
II.II.X.X Vaporizers
EXHAUST
STACK
PILOT GAS
PROCESS
FLUID
IN
OUT
TUBE BUNDLE
COMBUSTION AIR
WEIR
COOLING
WATER
JACKET
WATER
TANK
WATER RECIRCULATION
DISTRIBUTOR DUCT WITH SPARGE TUBES
FUEL
GAS
Figure 55 Scheme of a Submerged Combustion Vaporiser (SCV)
SCVs are composed of stainless steel tubes that are submerged in a water bath containing a
submerged combustion chamber. The combustion chamber burns a low-pressure natural gas (the
fuel consume is about the 1.5% of regasified natural gas) and is supplied with air via an electric air
blower. The heated exhaust from the combustion chamber is sent to the water bath containing the
stainless steel tubes with the LNG flowing inside and transfers the heat needed to vaporize the LNG.
SCV technology is a closed loop system that does not require water intake and discharge; however,
condensate water is produced from the combustion process.
4 submerged combustion vaporizers (SCV)
Nominal potentiality equal to 250 m3/h
Fuel consume equal to 2100 Nm3/h of natural gas

3 vaporizer running

1 vaporizer on stand-by
II.II.X.XI Blower
It transfers the boil-off vapour to the ship
Maximum flow rate equal to 12,000 Nm3/h
II.II.X.XII Wobbe index correction system
2 compression strings
Nominal potentiality of 4,300 Nm3/h
203
II.II.XI Description of relevant technical solutions
The unloading arms are equipped with a rapid release system, named PERC (Powered Emergency
Release Collar), which releases the connection with the ship manifold.
II.II.XII Description of main positive features and critical points
A well-known critical point of this plant typology may be the phenomenon of rollover, a process
whereby large quantities of gas are emitted from an LNG tank over a short period, causing
overpressurization of the tank unless prevented or designed for. Rollover can occur in absence of a
proper mixing or in case of a remarkable variation in composition (thus in density) of the LNG stored,
which can lead to a stratification of the substance inside the tank. Then, if the densities of two
different layers approach each other, the two layers mix rapidly, and the lower layer, which has been
superheated, gives off large amounts of vapour as it rises to the surface of the tank. In 1971 in the
Panigaglia LNG terminal occurred the first documented LNG Rollover incident.
204
II.III Off-shore GBS LNG regasification terminal
II.III.I Identification (id. number, short name/acronym, full name)
Off-shore GBS installation: self-supporting prismatic storage tanks and ORV vaporizers (technology
description based on the Rovigo Terminal of Adriatic LNG srl)
II.III.II Type of application (on-shore, off-shore GBS, off-shore FSRU, transport and
regasification vessel)
Off-shore GBS (Gravity Based Structure) regasifier
II.III.III Development stage (R&D, design, construction, operational)
Construction
II.III.IV Short description (main features)
The plant comprises the following sections: quay, storage, vaporization, boil-off recovery, Wobbe
index correction, auxiliary and safety systems.
The quay is composed by the docking area for methane ships and equipped with 3 unloading arms
and 1 boil off gas return arm.
The storage section is composed by 2 modular self-supporting prismatic tanks and 4 submerged
pumps delivering LPG from the tanks.
The vaporisation section is composed by 4 open rack vaporizers (ORV) (3 running and 1 on stand-by)
and 1 waste heat recovery vaporizer (WHRV) with high pressure pumping systems.
The boil-off recovery section is composed by 2 cryogenic compressors. The compressors recover
boil-off gas generated during the normal operation and the unloading phase and transfer it to the
recondenser.
The Wobbe index correction is necessary to adjust the gas with the quality specifications required
before the distribution. For this aim there are 2 compression strings and 1 drier for the air used in
correction operations.
Auxiliary and safety systems. The plant is managed by an automatic control system, whose
commands are in the Control Centralized Room. The section of auxiliary systems includes all the
principal process support activities, such as the principal and emergency electric energy, the fire
control system, the refrigeration system and station of gas quality and quantity control before the
distribution.
II.III.V Potentiality (maximum annual production achieved/foreseeable)
Maximum annual production achieved of NG = 7.6*109 Nm3/year
II.III.VI Limits for application
Modern Italian plants are designed for a maximum annual potentiality achievable of 8*10 9 - 12*109
Nm3/year of NG depending on the number of storage tanks and vaporizers.
205
II.III.VII Block diagram
2
LNG
LNG
BOIL-OFF
RECOVERY
CORRECTION
LNG
LNG
CARRIER SHIP
LNG STORAGE
LNG
LNG
3
VAPORIZATION
QUALITY AND
QUANTITY
MEASURES
1
Figure 56 Block diagram of an off-shore GBS LNG regasification terminal
Table 29 Physical state, density, mass and volume rates for each line of the block diagram
Line
State
Density
(kg/m3)
Mass
(kg/y)
1
Liquid
460
6.07*109
1.32*107
2
Gas
1.8
2.41*107
1.34*107
3
Gas
6.04*109
7.91*109
0.763
5 C<T<23 C
II.III.VIII Process flow diagram
No process flow diagrams available
II.III.IX List of main equipments

Quay

Unloading arms

Storage tanks

Submerged pumps

High pressure pumps

Vaporizers

Compressors

Wobbe index correction system

Control, safety and monitoring systems

Distribution utilities
206
rate Volume
(m3/y)
rate
DISTRIBUTION
II.III.X Description/schemes of significant equipment (including geometrical data, e.g.
volumes, if relevant)
II.III.X.I Quay
Quay allows approach and docking to methane ships carrying LNG
II.III.X.II Unloading arms
4 arms:

3 arms used for LNG transfer (diameter equal to 16’’);

1 arm used for boil off gas return (diameter equal to 16’’).
Overall unloading rate: 13,600 m3lng/h
II.III.X.III Tanks
Tanks are contained in the gravity based structure.
Figure 57 Scheme of a self-supporting prismatic modular tanks
The tanks are being fabricated in six modules by HHI (Hyundai Heavy Industry) at Ulsan in South
Korea. The tanks are protected with high-resistance concrete double walls with inert materials (sand)
between the two walls.
2 modular self-supporting prismatic tanks of 9% nickel steel
Capacity equal to 125,000 m3 each one
Design pressure: between -10 and 300 mbarg
207
Dimensions:

length 155 m

width 33 m

max height 28 m
II.III.X.IV Submerged pumps
4 submerged two stage vertical pumps collecting LPG inside the tanks.
Nominal potentiality equal to 530 m3lng/h

3 pumps running

1 pump on stand-by
II.III.X.V High pressure pumps
5 centrifugal pumps
Nominal potentiality equal to 410 m3lng/h

4 pumps running

1 pump on stand-by
II.III.X.VI Vaporizers
Gasification occurs by means of:

3 seawater vaporizers (open rack vaporizer - ORV) running

1 seawater vaporizer (ORV) on stand-by

1 waste heat recovery vaporizer (WHRV) running
The ORV uses seawater as the heating source for vaporizing or heating low-temperature fluids into
gases at atmospheric temperatures. The heat conductor is called a panel. A panel comprises a large
number of heat transfer tubes in a raw like a curtain. The ORV is made of an aluminium alloy for
good mechanical characteristics at low temperature and high thermal conductivity. LNG is vaporized
from the liquid state at -153.5 °C to the gaseous state at 3 °C.
ORV works with a pressure equal to 80 barg and vaporizes about 183 t/h using up to 7,250 m3/h of
seawater with an assessed thermal differential equal to – 4.6 °C.
208
Figure 58 Scheme of an open rack vaporizer.
The waste heat recovery vaporizer (WHRV) is designed to vaporize 176 t/h of LNG from the liquid
state at –153 °C to the gaseous state at 0 °C. The WHR works with a liquid circulating in a closed
circuit as a means of thermal transfer. Once heated at 95 °C by turbine fumes the liquid exchanges
heat with LNG allowing the regasification. The liquid is a glycol-water mixture.
Figure 59 Scheme of a waste heat recovery vaporizer
209
Open rack vaporizer potentiality:
1.9*109 – 2.1*109 Nm3/year
Waste heat recovery vaporizer potentiality:
1.9*109 Nm3/year
Maximum natural gas pressure out of the vaporizer
75 barg
Minimum natural gas temperature out of the vaporiser:
0 °C
II.III.X.VII Compressors
2 alternate compressors with electrical constant velocity engines
II.III.X.VIII Wobbe index correction system

2 multistage centrifugal pumps

1 drier
II.III.X.IX Distribution utilities
40 km-long pipeline to transfer NG to the delivery point (diameter equal to 30’’)
Nominal rate equal to 7.6*109 Nm3/year
The pipeline is composed by 2 different parts:

a 15 km-long part off-shore

a 25 km-long part on-shore
The pipeline is equipped with a shut-down valve to prevent overpressure damages.
II.III.XI Description of relevant technical solutions
The unloading arms are equipped with a rapid release system, named PERC (Powered Emergency
Release Collar) which releases the connection with the ship manifold.
Tanks are equipped with devices to allow filling from the top and the bottom of tank in order to
prevent stratification and roll-over.
The waste heat recovery vaporizer (WHRV) works with a liquid circulating in a closed circuit as a
means of thermal transfer. Once heated by turbine fumes the liquid exchanges heat with LNG
allowing the regasification. The liquid is a glycol-water mixture.
II.III.XII Description of main positive features and critical points
No information about positive features and critical points.
210
II.IV Off-shore FSRU LNG regasification terminal
II.IV.I Identification (id. number, short name/acronym, full name)
Off-shore FSRU installation: spherical type storage tanks from Kvaerner/Moss-Rosenberg and IFV
vaporizers (technology description based on the Livorno off-shore LNG Terminal of OLT Offshore LNG
Toscana Spa)
II.IV.II Type of application (on-shore, off-shore GBS, off-shore FSRU, transport and
regasification vessel)
Off-shore FSRU (Floating Storage Regassification Unit) regasifier
II.IV.III Development stage (R&D, design, construction, operational)
Design
II.IV.IV Short description (main features)
The plant comprises the following sections: unloading arms, storage, vaporization, boil-off recovery,
Wobbe index correction, auxiliary and safety systems.
Unloading arms. 2 unloading arms, 1 boil off gas return arm and 1 hybrid arm (both functions) are
present.
The storage section is composed by 4 spherical tanks from Kvaerner/Moss-Rosenberg
The vaporisation section is composed by 3 intermediate fluid vaporizers (IFV) with booster pumping
system.
The boil-off recovery section is composed by 2 LD (low duty) compressors e 2 HD (high duty), both
pre-existing on the ship, and 1 new BOG compressor
The Wobbe index correction is necessary to adjust the gas with the quality specifications required
before the distribution. For this aim there is a system of nitrogen generation.
Auxiliary and safety systems. Most of auxiliary systems were already present on the ship before the
conversion into a terminal. Safety systems consist of leakage and spillage prevention system, vent
relief system, fire and gas detection system, fire and explosion protection system.
II.IV.V Potentiality (maximum annual production achieved/foreseeable)
Maximum annual production achieved of NG = 3.7*109 Nm3/year
II.IV.VI Limits for application
Modern Italian plants are designed for a maximum annual potentiality achievable of 8*10 9 - 12*109
Nm3/year of LNG depending on the number of storage tanks and vaporizers.
211
II.IV.VII Block diagram
LNG
LNG
BOIL-OFF
RECOVERY
CORRECTION
LNG
LNG
CARRIER SHIP
LNG STORAGE
LNG
LNG
VAPORIZATION
QUALITY AND
QUANTITY
MEASURES
Figure 60 Block diagram of an off-shore FSRU LNG regasification terminal
II.IV.VIII Process flow diagram
Figure 61 Process flow diagram of an off-shore FSRU LNG regasification terminal
212
DISTRIBUTION
Table 30 Physical state, temperature, pressure and diameters for each line of the process flow diagram
Line
State
T (°C)
P (bar)
Diameter (mm)
1
Liquid
-162.6
1.18
406
2
Liquid
-162.6
1.18
356
3
Liquid
-162.6
1.18
356
4
Gas
-122.4
1.04
610
5
Gas
44.03
6.50
610
6
Liquid
-153.2
6.50
508
7
Liquid
-147.6
93.70
406
8
Gas
5.1
84.50
610
II.IV.IX List of main equipments

Unloading arms

Storage tanks

Vaporizers

Wobbe index correction system

Control, safety and monitoring systems

Production and distribution utilities
II.IV.X Description/schemes of significant equipment (including geometrical data, e.g.
volumes, if relevant)
II.IV.X.I Unloading arms
4 arms of inox steel:

2 arms used for LNG transfer (diameter equal to 16’’, flow rate equal to 4,000 m 3lng/h);

1 arm used for boil off gas return (diameter equal 16’’, flow rate equal to 15,000 Nm3/h).

1 hybrid arm used when necessary for one of the previous functions (diameter equal to 16’’).
213
II.IV.X.II Tanks
Figure 62 Moss sphere storage tank
4 Moss® LNG tank
The tanks are generally made from Aluminium and supported around the equatorial ring by a
structural transition joint (STJ), which also acts as a thermal break between steel and aluminium.
The tanks are then insulated with polyurethane foam, which is purged with Nitrogen. A partial barrier
in form of a drip-tray beneath the sphere is fitted. A gas sampling system is fitted to detect and signs
of leakage.
The complete tank and hold space are protected by weatherproof cover. Wall thickness varies
between 28-32mm at Poles and 160mm at equatorial ring and tank weight is about 800 tonnes.
Capacity equal to 34,672 m3 (filled up to 98.55% to prevent leakages)
Design pressure: 250 mbarg
Working pressure: between 40 mbarg and 200 mbarg
Working temperature: -161 C
II.IV.X.III Vaporizers
LNG Vaporizer
LNG Evaporation
NG
Fluid Condensation
Fluid Evaporation
NG Heating
LNG
NG Heater
Fluid Vaporizer
Sea Water
Figure 63 Scheme of an Intermediate Fluid Vaporizer
214
Sea
Water
IFVs are counter current heat exchangers, which use sea water as heat source and propane as
intermediate heating fluid between sea water and LNG. The vaporizer is composed by 3 integrated
sections in a sole shell. These sections are respectively named:

Propane vaporizer: a reboiler where propane, which circulates through the shell-side, is
vaporized by the means of sea water flowing inside tube.

LNG vaporizer: previously generated propane vapour transfers heat to LNG, which flows
through the tube-side and becomes overheated natural gas. Propane condensation provides
the heat needed by the first stage of LNG vaporization. This section is placed on an upper
position in order to allow a drain of condensed propane due to gravity.

Natural gas heater: this section is a heat exchanger where natural gas outgoing from
vaporizer is heated inside shell by means of sea water inside tube. Sea water from NG heater
is conveyed to propane vaporizer trough a pipe.
The circulation of propane is a closed-circuit during normal running, so pumping and restore are not
needed. Furthermore, in order to remove the content of propane inside vaporizer circuit during
maintenance and in an emergency, there is a specific tank for propane.
3 Intermediate Fluid Vaporizer (IFV)
Nominal potentiality equal to 1.3*109 Nm3/year
II.IV.X.IV Wobbe index correction system
A system of nitrogen generation provides nitrogen to adjust the gas with the quality specifications
required.
II.IV.XI Description of relevant technical solutions
Figure 64 Scheme of an unloading arm
Unloading arms are equipped with a Quick Connect Disconnect Coupler system (QC/DC), which
allows a semi-automatic connection with the flanged manifold of carrier ship. The connection is
leaded by a steel cable under stress.
For a safe LNG transfer, unloading arms are equipped with a release system consisting of 2 spherical
valves (Emergency Release System ERS “no spill”) and a rapid release system PERC (Powered
Emergency Release Collar) between the 2 ERS valves.
215
This system allows a quick disconnection of unloading arms from carrier in an emergency avoiding an
excessive LNG loss.
Moreover uloading arms are equipped with a position monitoring system PMS which stops unloading
operations and closes ERS valves if an arm has reach an excessive misalignment.
II.IV.XII Description of main positive features and critical points
A critical point of this plant typology, which is lodged in a ship essentially made of steel, is the
occurrence of leakage and LNG spillage, which makes common steel fragile. To prevent this, welded
piping, top entry valves, stainless steel catch plates and a leakage detection system are used.
216
II.V Off-shore TRV LNG regasification terminal
II.V.I Identification (id. number, short name/acronym, full name)
Transport and regasification vessel with membrane type storage tanks and shell in tube vaporizers.
Technology description based on the Energy Bridge Regasification Vessel (EBRV) and the deepwater
port (receiving facility) Gulf Gateway Energy Bridge of Excelerate Energy LLC located 116 miles
offshore in the Gulf of Mexico.
II.V.II Type of application (on-shore, off-shore GBS, off-shore FSRU, transport and
regasification vessel)
Transport and Regasification Vessels
II.V.III Development stage (R&D, design, construction, operational)
Operational
II.V.IV Short description (main features)
The Transport and Regasification Vessel is both a LNG carrier and a floating, storage and
regasification unit, whose receiving facility is a deepwater port equipped with a STL (Submerged
Turret Loading) buoy providing the mooring and the connection with natural gas pipelines. The
Transport and Regasification Vessel comprises the following sections: storage, vaporization, metering
and offshore mooring system, which also includes the STL Subsea System of deepwater port. The
storage section is composed by 4 membrane storage tanks based on Gaztransport & Technigaz (GTT)
membrane type No. 96. The vaporisation section is composed by 6 sets of shell and tube vaporizers.
The metering section is provided to determine accurately the quantity and quality of the natural gas
offloaded. BOG generated is usually used as combustible in the ship engines. The basis of the
offshore mooring system is a buoy connected to the seabed, which is pulled into and secured in a
mating cone in the bottom of the vessel. It provides the mooring for the Transport and Regasification
Vessel, the transfer connection with the deepwater port and the control and instrumentation
interface connection.
II.V.V Potentiality (maximum annual production achieved/foreseeable)
Maximum daily production achieved of NG = 18*106 Nm3/year
II.V.VI Limits for application
Only the maximum daily natural gas production is here reported as this kind of regasification
terminal has a function of LNG carrier as well, so its annual production is extremely affected by the
number and of journeys per year and their length.
II.V.VII Block diagram
Not available
217
II.V.VIII Process flow diagram
Figure 65 Process flow diagram of an off-shore TRV LNG regasification terminal
II.V.IX List of main equipments

Storage tanks

Feed pumps

High pressure pumps

Vaporizers

Metering unit

High pressure manifold

STL buoy

Meter platform

Subsea connecting pipelines
218
II.V.X Description/schemes of significant equipment (including geometrical data, e.g.
volumes, if relevant)
II.V.X.I Storage tanks
Figure 66 Membrane storage tank
4 membrane storage tanks Based on Gaztransport & Technigaz (GTT) membrane type No. 96
Overall capacity equal to 138,000 m3
A membrane system is formed by installing thermal insulating material into the hull of the ship and
covering the surface with a metallic membrane. The purpose of the membrane is to maintain liquidtightness so as to prevent any leakage of the cargo liquid. This system consists of a double
construction of invar (36% nickel alloy steel) with 0.7 mm thickness as primary and secondary
membranes. The insulation box is also consists of a double layer structure. The total thickness of the
insulation system is approximately 530 mm to ensure a BOR (Boil-Off Rate) of 0.15% per day.
Figure 67 Membrane system of a membrane storage tank
219
II.V.X.II Feed pumps
3 retractable type submerged LNG pumps
Located in a pump well of the pump tower mast within the cargo tanks
Potentiality equal to 620 m3/h each
II.V.X.III High pressure pumps
6 high pressure LNG pumps
Potentiality equal to 205 m3/h each
Pump head equal to 2,370 m
Discharge pressure up to 100 barg
II.V.X.IV Vaporizers
Figure 68 Scheme of a shell and tube vaporizer
6 sets of shell and tube vaporizers
Potentiality equal to 2.6*106 m3/d each
This typology of vaporizers is compact (easy to arrange on deck), simple to operate, energy efficient
(possible use of natural heat sources, i.e. use of sea water) and the process is not affected by ship’s
motions or environmental conditions.
Three modes of LNG vaporization are possible on transport and regasification vessel, Closed-Loop,
Open-Loop, and Combined Mode.
In the Closed-Loop mode, steam from the boilers is piped from the machinery spaces forward to the
heating water steam heaters within the regasification plant, which are used to heat water circulated
through the shell-and-tube vaporizers in the regasification plant. As such, there is no seawater intake
or discharge used specifically for the regasification process in the Closed-Loop mode.
In Open-Loop mode, the basic process is much the same as Closed-Loop with the exception that
seawater is drawn in through the sea chests near the stern of the vessel. This seawater is used as a
heat source and passed through the tubes of the shell-and-tube vaporizers. LNG is fed to the shell
side of the vaporizers where it contacts the outer surface of the tubes and the heat required for
vaporization is transferred. The temperature of the seawater is lowered in this process by
approximately 7 C , and this cooler water is discharged near the bow. For this reason, these vessels
are constrained from operating in the Open-Loop mode when water temperatures are below 7 C to
minimize the risk of icing within the vaporizers.
220
In the Combined Mode of operation, seawater at temperatures between 7 and 14 C can be used and
is further heated using steam from boilers to provide sufficient heat for the vaporization of the LNG.
II.V.X.V Metering unit
A duplicated ultrasonic type flow meter and a gas chromatograph are used to determine accurately
the quantity and quality of the natural gas offloaded.
II.V.X.VI High pressure manifold
As an alternative to discharging natural gas offshore through the STL buoy a high pressure manifold is
provided, located on both sides of the vessel. This provides the possibility to discharge pressurized
NG at a dedicated berth.
II.V.X.VII STL buoy
Figure 69 STL buoy
The STL buoy serves four main purposes:

Provides the mooring for the vessel discharging at the deepwater port;

Enables the vessel to weathervane while connected to the mooring system;

Provides the deepwater port’s portion of the gas transfer connection between the vessel
and the port;

Provides the control and the instrumentation interface connection between the pipeline
end manifold and the vessel.
The essential components of the STL buoy are:

Buoyancy cone, the main body of the STL buoy.

Integrated turret with bearings,

Riser and umbilical connections

Emergency shutdown valve

Acoustic positioning transponders, used to monitor the position of the STL buoy
221
II.V.X.VIII Subsea connecting pipelines
Figure 70 Subsea connecting pipelines
Natural gas is transferred to the meter platform through a flexible gas riser connected by means of a
pipeline end manifold to a subsea pipeline.

The flexible gas riser is the “pipeline” through which gas passes from the STL buoy to the
pipeline end manifold. The riser has an internal diameter of 14 in. and is comprised of a
multilayered construction. It is designed to transport gas at pressures up to 135 bar.

The subsea pipeline is 20 in. in diameter and has a maximum allowable operating
pressure of 135 bar.
II.V.X.IX Meter platform
Figure 71 Meter platform
The meter platform enables the deepwater port to supply gas to two separate pipeline systems (Sea
Robin and Blue Water) and to individually control and measure the flow of gas to the pipeline
systems.
222
II.V.XI Description of relevant technical solutions
The most relevant technical solution of this technology is the submerged turret loading subsea
system, which is comprised of a STL buoy (see above), a mooring system comprised of anchors with
connecting chains, wires and shackles, STL buoy pick-up arrangements, a flexible gas riser (see
above), e control umbilical and a pipeline manifold.
II.V.XII Description of main positive features and critical points
A transport and regasification vessel is a portable, floating, LNG storage, regasification and natural
gas delivery system with through-put capabilities similar to many medium sized shore-based LNG
receiving terminals.
The counterpart is the deep water port (receiving facility) of which there is currently only one in
operation worldwide, Gulf Gateway Energy Bride, located 116 miles offshore in the Gulf of Mexico.
Moreover this plant typology is lodged in a ship essentially made of steel and the occurrence of
leakage and LNG spillage would make common steel fragile. To prevent this, welded piping, top entry
valves, stainless steel catch plates and a leakage detection system are used.
223
II.VI Specific data of alternative equipments – LNG storage
II.VI.I Single containment LNG storage tank
II.VI.I.I Type of employment
LNG storage
II.VI.I.II Field of application
On-shore LNG regasifier
II.VI.I.III Development stage (R&D, design, construction, operational)
Operational
II.VI.I.IV Short description
The tank is constructed of a 9 percent nickel steel inner wall, a carbon steel outer wall, and an
aluminium suspended insulation support deck. The LNG is contained within the inner wall, while the
outer wall would contain product vapours. The storage tank is surrounded by dikes, which provide
secondary containment. The steel inner and outer tank is supported on a common foundation.
Figure 72 Scheme of a single containment LNG storage tank
II.VI.II Double containment LNG storage tank
II.VI.II.I Type of employment
LNG storage
II.VI.II.II Field of application
On-shore LNG regasifier
224
II.VI.II.III Development stage (R&D, design, construction, operational)
Operational
II.VI.II.IV Short description
A conventional double containment LNG storage tank is essentially a single containment tank
surrounded by a close-in, reinforced open top concrete outer container designed to contain any spill
or leak from the inner tank, but not to hold any vapour released during a spill. Like the single
containment tank, the double containment tank consists of a suitable cryogenic metal inner
container (9% nickel steel) designed to hold the LNG, surrounded by a carbon steel outer wall
designed to contain the natural gas vapours at pressures up to 0.050 barg. Insulation surrounds the
inner tank to control heat leak into the tank. The outer carbon steel tank is not designed to contain
LNG in the event of an inner tank leak. In addition to this outer carbon steel wall, the double
containment tank design also includes a concrete outer container which functions as a secondary
means of LNG containment. This outer container is an engineered reinforced concrete cylinder
surrounding the outer carbon steel tank shell and is designed to contain the full tank volume plus
some safety margin (further data in the on-shore LNG terminal survey).
VAPOR DRAWOFF 24"
FILL LINE 24"
RISER 4"
PERLITE INSULATION
(WOODEN SUPPORTS)
ROOF PLATFORM
V
S
OUTER TANK ROOF
(CARBON STEEL)
OUTER TANK SHELL
(PRESTRESSED CONCRETE)
SUBMERGED PUMP COLUMN
(N° 3)
COLUMNS
(N° 28)
INNER TANK
(9% Ni STEEL)
PERLITE INSULATION IN N2 ATMOSPHERE
PILE CAP
PERLITE INSULATION
(WOODEN SUPPORTS)
NEW FONDATION
PILES
Figure 73 Scheme of a double containment LNG storage tank
II.VI.III Full containment LNG storage tank
II.VI.III.I Type of employment
LNG storage
II.VI.III.II Field of application
On-shore LNG regasifier
II.VI.III.III Development stage (R&D, design, construction, operational)
Operational
225
II.VI.III.IV Short description
Full containment tanks have a primary 9 percent nickel-steel inner container and a secondary prestressed concrete outer container wall, a reinforced concrete outer container bottom, a reinforced
concrete domed roof, and an aluminium insulated support deck suspended from the outer container
roof over the inner container. The double-walled tanks are designed so that both the primary
container and the secondary container could independently contain the stored LNG. The primary
container should contain the cryogenic liquid under normal operating conditions. The secondary
container is capable of containing the cryogenic liquid and of controlling vapour resulting from
product release from the inner container. The space between the inner container and the outer
container is insulated to allow the LNG to be stored at a temperature of -160 °C while maintaining
the outer container at near ambient temperature.
Figure 74 Scheme of a full containment storage tank
II.VI.IV In-ground storage tank
II.VI.IV.I Type of employment
LNG storage
II.VI.IV.II Field of application
On-shore LNG regasifier
II.VI.IV.III Development stage (R&D, design, construction, operational)
Operational
226
II.VI.IV.IV Short description
Figure 75 Scheme of an in-ground storage tank
1. Reinforced concrete tank cover
2. Steel roof
3. Suspended deck
4. Glass wool insulation
5. Non-CFC rigid polyurethane form (PUF) insulation
6. 18Cr-8Ni stainless steel membrane
7. Reinforced concrete side wall
8. Reinforced concrete cut-off wall
9. Side heater
10. Reinforced concrete bottom slab
11. Bottom heater
12. Gravel layer
Even though all the above listed storage tank technologies can be built in-ground, only membrane
tanks have been regularly built below grade. The outer wall of an in-ground tank is not pre-stressed.
The outer wall is held in compression by soil pressure that also supports the LNG hydrostatic load.
For in-ground LNG storage systems, electric heating cables are required to eliminate the formation of
ice in the surrounding soil. Ice formation can create huge frost heave loads capable of damaging tank
foundations and walls. These heaters are in continuous operation. Structures that are built into the
ground generally have reduced acceleration loads generated from seismic events. This is because
motions of in-ground storage system follow the seismic ground shaking and are not amplified
227
through the structure of the tank as is the case for an above ground storage system. This is one of
the reasons why in-ground storage systems have been principally constructed in Japan.
II.VI.V Underground storage tank
II.VI.V.I Type of employment
LNG storage
II.VI.V.II Field of application
On-shore LNG regasifier
II.VI.V.III Development stage (R&D, design, construction, operational)
Operational
II.VI.V.IV Short description
Figure 76 Underground storage tank
Underground tanks are totally buried in the ground and the dome roof is covered with over one
meter of earth, making them completely invisible from the surface.
II.VI.VI Self-supporting prismatic modular tanks
II.VI.VI.I Type of employment
LNG storage
II.VI.VI.II Field of application
Off-shore GBS LNG regasifier
II.VI.VI.III Development stage (R&D, design, construction, operational)
Operational
II.VI.VI.IV Short description
Hyundai Heavy Industries (HHI) of South Korea completed the construction of two large LNG storage
tanks for the new Adriatic LNG gravity-based structure in mid-2006.
228
Each of the rectangular tanks, which are made from 9% nickel steel, weighs 4,800 ton and has a
capacity of 250,000m³. The tanks are protected with high-resistance concrete double walls with inert
materials (sand) between the two walls. These tanks are contained in the gravity based structure
(further data in the off-shore GBS LNG terminal survey).
Figure 77 Scheme of a self-supporting prismatic modular tanks
II.VI.VII Moss sphere tank
II.VI.VII.I Type of employment
LNG storage
II.VI.VII.II Field of application
Off-shore FSRU/TRV LNG regasifier
II.VI.VII.III Development stage (R&D, design, construction, operational)
Operational
II.VI.VII.IV Short description
The tanks are generally made from aluminium and supported around the equatorial ring by a
structural transition joint (STJ), which also acts as a thermal break between steel and aluminium.
The tanks are then insulated with polyurethane foam, which is purged with Nitrogen. A partial barrier
in form of a drip-tray beneath the sphere is fitted. A gas sampling system is fitted to detect and signs
of leakage.
The complete tank and hold space are protected by weatherproof cover. Wall thickness varies
between 28-32mm at Poles and 160mm at equatorial ring and tank weight is about 800 tonnes
(further data in the off-shore FSRU LNG terminal survey).
229
Figure 78 Moss sphere storage tank
II.VI.VIII Membrane storage tank
II.VI.VIII.I Type of employment
LNG storage
II.VI.VIII.II Field of application
Off-shore FSRU/TRV LNG regasifier
II.VI.VIII.III Development stage (R&D, design, construction, operational)
Operational
II.VI.VIII.IV Short description
Figure 79 Membrane storage tank
A membrane system is formed by installing thermal insulating material into the hull of the ship and
covering the surface with a metallic membrane. The purpose of the membrane is to maintain liquidtightness so as to prevent any leakage of the cargo liquid. This system consists of a double
construction of invar (36% nickel alloy steel) with 0.7 mm thickness as primary and secondary
230
membranes. The insulation box also consists of a double layer structure. The total thickness of the
insulation system is approximately 530 mm to ensure a BOR (Boil-Off Rate) of 0.15% per day (further
data in the off-shore TRV LNG terminal survey).
Figure 80 Membrane system of a membrane storage tank
231
II.VII Specific data of alternative equipments – LNG vaporization
II.VII.I SCV (submerged combustion vaporizer)
II.VII.I.I Type of employment
LNG vaporization
II.VII.I.II Field of application
On-shore / off-shore LNG regasifier
II.VII.I.III Development stage (R&D, design, construction, operational)
Operational
II.VII.I.IV Short description
SCVs are composed of stainless steel tubes submerged in a water bath. In this water bath a
submerged combustion chamber burns a low-pressure natural gas and is supplied with air via an
electric air blower. The heated exhaust from the combustion chamber is sent to the water bath,
where LNG flows inside the stainless steel tubes, and transfers the heat needed to vaporize the LNG.
SCV technology is a closed loop system that does not require water intake and discharge; however,
condensate water is produced from the combustion process (further data in the on-shore LNG
terminal survey).
The primary advantages of the SCV technology are its compact size, high thermal efficiency, closed
loop water use, and ease of operation and maintenance. Disadvantages are the release of regulated
air emissions generated during the combustion process, and potential discharge of condensate water
if it is not reused.
EXHAUST
STACK
PILOT GAS
PROCESS
FLUID
IN
OUT
TUBE BUNDLE
WEIR
COMBUSTION AIR
COOLING
WATER
JACKET
WATER
TANK
WATER RECIRCULATION
DISTRIBUTOR DUCT WITH SPARGE TUBES
Figure 81 Scheme of a submerged combustion vaporizer
232
FUEL
GAS
II.VII.II ORV (Open Rack Vaporizer)
II.VII.II.I Type of employment
LNG vaporization
II.VII.II.II Field of application
On-shore / off-shore GBS LNG regasifier (not suitable for floating off-shore applications)
II.VII.II.III Development stage (R&D, design, construction, operational)
Operational
II.VII.II.IV Short description
ORVs are widely used where LNG facilities are located in close proximity to a readily available supply
of seawater. They are made of aluminium alloy and use seawater as a sole source of heat. Pumps are
used to move the seawater from an overhead distributor over long-finned aluminium panels with the
LNG flowing inside. Vaporization of the LNG is accomplished by transferring heat from the seawater
to the LNG. As the seawater passes over the aluminium panels, it is cooled and collected in troughs
at the bottom of the ORV before it is discharged back into the water source. Vaporization
effectiveness depends on seawater temperature (further data in the GBS LNG terminal survey).
The primary advantages of ORV technology are its operational flexibility, ease of maintenance, stable
heat transfer, and limited fuel consumption and air emissions. The primary disadvantages of this
technology are the withdrawal and discharge of large volumes of seawater, and potential
impingement and entrainment of organisms during withdrawal and thermal impacts on the receiving
waterbody during discharge.
Figure 82 Scheme of an Open Rack Vaporizer
233
II.VII.III IFV (Intermediate Fluid Vaporizer)
II.VII.III.I Type of employment
LNG vaporization
II.VII.III.II Field of application
On-shore / off-shore LNG regasifier
II.VII.III.III Development stage (R&D, design, construction, operational)
Operational
II.VII.III.IV Short description
IFVs are counter current heat exchangers, which use sea water as heat source and an intermediate
heating fluid, such as propane, between sea water and LNG.
LNG Vaporizer
LNG Evaporation
Fluid Condensation
NG
Fluid Evaporation
NG Heating
LNG
NG Heater
Fluid Vaporizer
Sea
Water
Sea Water
Figure 83 Scheme of an Intermediate Fluid Vaporizer
The vaporizer is composed by 3 integrated sections in a sole shell. These sections are respectively
named:

Propane vaporizer: a reboiler where propane, which circulates through the shell-side, is
vaporized by the means of sea water flowing inside tube.

LNG vaporizer: previously generated propane vapour transfers heat to LNG, which flows
through the tube-side and becomes overheated natural gas. Propane condensation provides
the heat needed by the first stage of LNG vaporization. This section is placed on an upper
position in order to allow a drain of condensed propane due to gravity.

Natural gas heater: this section is a heat exchanger where natural gas outgoing from
vaporizer is heated inside shell by means of sea water inside tube. Sea water from NG heater
is conveyed to propane vaporizer trough a pipe.
The circulation of propane is closed-loop during normal running, so pumping and restore are not
needed. Furthermore, in order to remove the content of propane inside vaporizer circuit during
maintenance and in an emergency, there is a specific tank for propane (further data in the FSRU LNG
terminal survey).
234
II.VII.IV STV (Shell and Tube Vaporizer)
II.VII.IV.I Type of employment
LNG vaporization
II.VII.IV.II Field of application
On-shore / off-shore LNG regasifier
II.VII.IV.III Development stage (R&D, design, construction, operational)
Operational
II.VII.IV.IV Short description
STV system involves a heat exchanger in which tubes containing LNG pass through a shell containing
a counter-current of heat exchange media, which may be a water/glycol mixture (see waste heat
recovery vaporizer in GBS LNG terminal survey) or seawater (see TRV LNG terminal survey). This
typology of vaporizer is remarkably flexible and allows several modes of operation.
Figure 84 Scheme of a Shell and Tube Vaporizer
It may be used in a system of waste heat recovery (GBS LNG terminal survey), where a heat exchange
media transfers heat from hot turbine fumes to LNG, allowing the process of regasification.
235
Figure 85 Scheme of a waste heat recovery system
Other modes of LNG vaporization are possible with seawater as heat exchange media in closed, open
and combined loop.
In the Closed-Loop mode, steam from the boilers is piped from the machinery spaces forward to the
heating water steam heaters within the regasification plant, which are used to heat water circulated
through the shell-and-tube vaporizers in the regasification plant. As such, there is no seawater intake
or discharge used specifically for the regasification process in the Closed-Loop mode.
In Open-Loop mode, the basic process is much the same as Closed-Loop with the exception that
seawater is drawn in through the sea chests near the stern of the vessel. This seawater is used as a
heat source and passed through the tubes of the shell-and-tube vaporizers. LNG is fed to the shell
side of the vaporizers where it contacts the outer surface of the tubes and the heat required for
vaporization is transferred. The temperature of the seawater is lowered in this process by
approximately 7 C , and this cooler water is discharged near the bow. For this reason, these vessels
are constrained from operating in the Open-Loop mode when water temperatures are below 7 C to
minimize the risk of icing within the vaporizers.
In the Combined Mode of operation, seawater at temperatures between 7 and 14 C can be used and
is further heated using steam from boilers to provide sufficient heat for the vaporization of the LNG.
The primary disadvantages of this technology are fouling and maintenance of the shell and tube
exchangers, frequent periods of downtime for maintenance, potential freezing of the shell and tubes,
and impingement and entrainment of marine organisms.
236
II.VII.V HIAAV (Heat Integrated Ambient Air Vaporizers)
II.VII.V.I Type of employment
LNG vaporization
II.VII.V.II Field of application
On-shore / off-shore LNG regasifier
II.VII.V.III Development stage (R&D, design, construction, operational)
Operational
II.VII.V.IV Short description
Figure 86 Heat Integrated Ambient Air Vaporizers
HIAAVs take heat from the surrounding air and transfer it to vaporize LNG as it passes through an
exchanger. The natural convection of air and subsequent heat transfer rate would be enhanced by
the height of the exchanger. A forced circulation of air could be also provided. The primary
advantages of the HIAAV technology are the use of surrounding air in the heating process, little to no
emissions during the warmer months, no noise generation from heating fans, and no use of
intermediate fluids or secondary exchangers. The primary disadvantages with this vaporization
technology are its sensitivity to changes in air temperature, humidity, and wind speed; potential to
create fog on warm days; production and disposal of water; and the need for a backup system during
cooler months.
237
238
Annex III
Survey of available technologies for CCS surface installations
239
III.I Introduction
This annex shows the survey of current available CO2 capture and transport technologies performed
for the case-study “CO2 capture and sequestration, both technical and governance risk” within the
framework of the EC project iNTeg-Risk and reported in the following iNTeg-Risk deliverable:

Paltrinieri, N., 2010. Generic risk analysis of the CCS chain – surface installations. Deliverable
D1.2.1.1 of EC project iNTeg-Risk, 7th FP, Grant: CP-IP 213345-2.
A common template is used for technology description, in order to consent a systematic analysis for
the following CO2 capture and transport technologies:

Post-combustion capture

Alternative technologies for post combustion capture

Pre-combustion capture

Alternative technologies for pre-combustion capture

Oxy-fuel combustion

Alternative technologies similar to the oxyfuel combustion

Carbon dioxide compression

CO2 transport
This section sources of information are reported in the subsection “References”.
240
III.II Post-combustion capture
III.II.I Type of application
Post-combustion capture
III.II.II Development stage (R&D, design, construction, operational)
R&D. In order to study the technology and its feasibility, some pilot plants have been built in these
years, notably the EU CASTOR pilot plant at the Esbjerg Pulverized Coal (PC) power station
(Esbjergværket), Denmark (Knudsen et al. 2009). Moreover there are several other CO2 postcombustion capture and storage projects planned for the future (Table 31).
Table 31 Planned CO2 post-combustion capture and storage projects (WRI 2008)
Project name
Location
Feedstock
Size (MW)
Start-up
date
Williston
USA
Coal
450
2009-15
AEP Alsom Northeastern
USA
Coal
200
2011
Sargas Husnes
Norway
Coal
400
2011
Coal
500
2011-12
Scottish &
Ferrybridge
Southern
Energy UK
Naturkraft Kårstø
Norway
Gas
420
2011-12
WA Parish
USA
Coal
125
2012
RWE npower Tilbury
UK
Coal
1600
2013
Tenaska
USA
Coal
600
2014
UK CCS Project
UK
Coal
300-400
2014
Statoil Mongstad
Norway
Gas
630 CHP
2014
E.ON Karlsham
Sweden
Oil
5
Undecided
CHP = Combined Heat Power
DOE/NETL (DOE/NETL 2007) also established baseline performance and cost estimates for PC
combustion energy plants with CO2 capture and storage.
III.II.III Process description (Figueroa et al. 2008)
Post-combustion capture involves the removal of CO2 mainly from flue gases produced by Pulverized
Coal (PC), which produce about 743 g/kWh, and Natural Gas Combined Cycle (NGCC) power stations,
which produce about 379 g/kWh (IEA GHG 2007). These two thermal power station systems are in
fact compatible with this capture method (Kanniche et al. 2009). The power plants use air, which is
241
almost four-fifths nitrogen, for combustion and generate a flue gas that is at atmospheric pressure
and typically has a CO2 concentration between 5% (for the NGCC system) and 15% (for the PC
system). Thus, the thermodynamic driving force for CO2 capture from flue gas is low, creating a
technical challenge for the development of cost effective advanced capture processes.
Typologies of post-combustion capture (annex 1):









Amine-based systems (here considered)
Carbonate-based systems
Aqueous Ammonia
Chilled Ammonia Process
Membranes
CO2 Capture Sorbents
Metal Organic Frameworks (MOFs)
Enzyme Based systems
Ionic liquids
III.II.IV Potentiality (maximum annual production achieved/foreseeable)
EU CASTOR pilot plant at Esbjergværket captures 24 t/d of CO2 (Knudsen et al. 2009). Another small
plant such as KS-1 plant (MHI’s KS-1 is a process which uses a proprietary sterically hindered amine
solvent) in Malaysia captures about 200 t/d of CO2 from reformer flue gas and plants capturing up to
450 t/d are being built. 150-200 t/d capture units based on the ABB Lummus Global/Kerr McGee
MEA scrubbing process are operating at two coal-fired power plants in the USA (Davison 2007).
A potential 500 MW pulverised coal power plant emits approximately 10,000 – 12,000 t/d and a
natural gas combined cycle plant approximately 4,000 t/d. This implies that a scale-up of 20-50 times
would be necessary to achieve (Steeneveldt et al. 2006). In fact, DOE/NETL (DOE/NETL 2007), which
used the ASPEN Plus modelling program to model a 550 MW PC power plant with CO2 capture,
assessed a potentiality equal to 13,500 – 15,000 t/d (for respectively supercritical and subcritical
boiler). Approximately 90 percent of the CO2 in the flue gas is captured (DOE/NETL 2007).
242
III.II.V Noticeable substances and materials involved
An overview of existing solvents for CO2 absorption processes.
Table 32 CO2 solvents under development (Steeneveldt et al. 2006)
Absorbent Licenser
Absorbent
Fluor Econamine FG Plus
MEA + proprietary inhibitor to recover CO2
Fluor-Daniel Ecoamine
MEA + additives
ABB Lummus-Global
MEA
Mitsubishi
KS-1, KS3
TNO
CORAL
University of Regina
PSR
Praxair
Amine Blends
CANSOLV®
CANSOLV®
243
III.II.VI Block diagram
Subcritical PC boiler power plant is here considered.
Figure 87 Subcritical PC boiler power plant block diagram (DOE/NETL 2007)
244
III.II.VII Process flow diagram
A process flow diagram of an Econamine FG+ CO2 capture plant is here considered.
Figure 88 Fluor Econamine FG Plus Typical Flow Diagram (DOE/NETL 2007)
III.II.VIII Main equipments
Only main equipments in power plants connected to the post-combustion capture technology are
here considered:






SO2 polishing scrubber
CO2 absorber
Rich/lean amine heat exchanger
Solvent stripper
Solvent stripper reclaimer
CO2 compressor
III.II.IX Description/scheme of significant equipment
The report of DOE/NETL (2007) modelled both PC and NGCC power station systems. Nevertheless the
two technologies were supposed to use the same CO2 capture process (Fluor Econamine FG Plus)
with only minor modifications, such as the absence of a SO2 polishing step in the NGCC case. In fact,
if the pipeline natural gas used in this study contained the maximum amount of sulfur allowed per
EPA specifications (0.6 gS/100 scf), the flue gas would contain 0.4 ppmv of SO2, which is well below
the limit where a polishing scrubber would be required (10 ppmv).
Moreover, in DOE/NETL (2007) it was done a further differentiation between PC supercritical and
subcritical boiler power plants, but the only difference regarding CDR facility is a small CO2 rate
variation.
This survey considered the second case (subcritical PC boiler power plant) because of its higher rates.
245
A Carbon Dioxide Recovery (CDR) facility is used in DOE/NETL (2007) to remove 90 percent of the
CO2 in the flue gas exiting the Flue Gas Desulphurization (FGD) unit, purify it, and compress it to a
supercritical condition. The flue gas exiting the FGD unit contains about 1 percent more CO2 than the
raw flue gas because of the CO2 liberated from the limestone in the FGD absorber vessel. The CDR is
comprised of the flue gas supply, SO2 polishing, CO2 absorption, solvent stripping and reclaiming, and
CO2 compression and drying.
The CO2 absorption/stripping/solvent reclaim process in DOE/NETL (2007) is based on the Fluor
Econamine FG Plus technology. This process is designed to recover high-purity CO2 from low-pressure
streams that contain oxygen, such as flue gas from coal-fired power plants, gas turbine exhaust gas,
and other waste gases.
III.II.IX.I SO2 polishing scrubber (DOE/NETL 2007)
To prevent the accumulation of heat stable salts, the incoming flue gas must have an SO2
concentration of 10 ppmv or less. The gas exiting the FGD system passes through an SO2 polishing
step to achieve this objective. The polishing step consists of a non-plugging, lowdifferential-pressure,
spray-baffle-type scrubber using a 20 wt% solution of sodium hydroxide (NaOH). A removal efficiency
of about 75 percent is necessary to reduce SO2 emissions from the FGD outlet to 10 ppmv as
required by the Econamine process. The polishing scrubber proposed for this application has been
demonstrated in numerous industrial applications throughout the world and can achieve removal
efficiencies of over 95 percent if necessary.
The polishing scrubber also serves as the flue gas cooling system. Cooling water from the PC plant is
used to reduce the temperature and hence moisture content of the saturated flue gas exiting the
FGD system. Flue gas is cooled beyond the CO2 absorption process requirements to 32°C to account
for the subsequent flue gas temperature increase of about 17°C in the flue gas blower. Downstream
from the Polishing Scrubber flue gas pressure is boosted in the Flue Gas Blowers by approximately
0.14 bar to overcome pressure drop in the CO2 absorber tower.
III.II.IX.II CO2 absorber (DOE/NETL 2007)
The cooled flue gas enters the bottom of the CO2 absorber and flows up through the tower
countercurrent to a stream of lean MEA-based solvent called Econamine FG Plus. Flue gas
temperature is typically between 40 and 80 C (Steeneveldt 2006), in this case is about 49 C.
Approximately 90 % of the CO2 in the feed gas is absorbed into the lean solvent, and the rest leaves
the top of the absorber section and flows into the water wash section of the tower. The lean solvent
enters the top of the absorber, absorbs the CO2 from the flue gases and leaves the bottom of the
absorber with the absorbed CO2.
The purpose of the water wash section is to minimize solvent losses due to mechanical entrainment
and evaporation. The flue gas from the top of the CO2 absorption section is contacted with a recirculating stream of water for the removal of most of the lean solvent. The scrubbed gases, along
with unrecovered solvent, exit the top of the wash section for discharge to the atmosphere via the
vent stack. The water stream from the bottom of the wash section is collected on a chimney tray. A
portion of the water collected on the chimney tray spills over to the absorber section as water
makeup for the amine with the remainder pumped via the wash water Pump and cooled by the wash
water cooler, and recirculated to the top of the CO2 absorber. The wash water level is maintained by
water makeup from the wash water makeup pump.
Two operating absorbers were considered in this simulation, with the following design inlet
conditions.
246
Table 33 Absorber design inlet conditions considered in DOE/NETL (2007) for simulation of a 550 MW
pulverized coal power plant with CO2 capture
Parameter
Design value
Temperature (ºC)
49
Pressure (bar)
1.14
Flowrate (kg/h)
1,890,575
Concentration (wt % CO2)
20.2
In fact BP Global (2008) states that a power plant of 500 MW capacity should require 2 absorber
columns, each 12 metres in diameter and 35 metres high.
Otherwise a small CO2 absorber tower like that one at the EU CASTOR pilot plant, with a potentiality
equal to 24 t/d of CO2, is 1.1 m in diameter and 20 m in height: four consecutive packed beds for
absorption 4.25 m in height each and filled with IMTP50 random packing and a water wash bed 3 m
in height and filled with structured packing (Knudsen et al. 2009). In this case the following design
inlet conditions are considered.
Table 34 Absorber design inlet conditions considered in (Knudsen et al. 2009) for EU CASTOR pilot plant
Parameter
Design value
Temperature (ºC)
47
Pressure (bar)
“Pressure slightly below ambient”
Flowrate (Nm3/h)
5,000 ~ 0.5% of ESV flue gas flow
Concentration (wt % CO2)
~ 20
Max solvent flow (m3/h)
40
III.II.IX.III Rich/lean amine heat exchanger (DOE/NETL 2007)
The rich solvent from the bottom of the CO2 absorber is preheated by the lean solvent from the
solvent stripper in the rich lean solvent exchanger. The heated rich solvent is routed to the solvent
stripper for removal of the absorbed CO2. The stripped solvent from the bottom of the solvent
stripper is pumped via the hot lean solvent pumps through the rich lean exchanger to the solvent
surge tank. Prior to entering the solvent surge tank, a slipstream of the lean solvent is pumped via
the solvent filter feed pump through the solvent filter package to prevent build-up of contaminants
in the solution. From the solvent surge tank the lean solvent is pumped via the warm lean solvent
pumps to the lean solvent cooler for further cooling, after which the cooled lean solvent is returned
to the CO2 absorber, completing the circulating solvent circuit.
247
III.II.IX.IV Solvent stripper (DOE/NETL 2007)
The purpose of the solvent stripper is to separate the CO2 from the rich solvent feed exiting the
bottom of the CO2 absorber. The rich solvent is collected on a chimney tray below the bottom packed
section of the solvent stripper and routed to the solvent stripper reboilers where the rich solvent is
heated by steam, stripping the CO2 from the solution. Steam is provided from the low-pressure
section of the steam turbine and is between 9-12 bar and 366-396°C. The hot wet vapor from the top
of the stripper containing CO2, steam, and solvent vapor, is partially condensed in the solvent
stripper condenser by cross exchanging the hot wet vapor with cooling water. The partially
condensed stream then flows to the solvent stripper reflux drum where the vapor and liquid are
separated. The uncondensed CO2-rich gas is then delivered to the CO2 product compressor. The
condensed liquid from the solvent stripper reflux drum is pumped via the solvent stripper reflux
pumps where a portion of condensed overhead liquid is used as make-up water for the water wash
section of the CO2 absorber. The rest of the pumped liquid is routed back to the solvent stripper as
reflux, which aids in limiting the amount of solvent vapors entering the stripper overhead system.
No design data are given in DOE/NETL (2007) for the 2 solvent strippers considered in the simulation.
Only some design data are given for the smaller solvent stripper at the EU CASTOR pilot plant.
Table 35 Solvent stripper design conditions considered in (Knudsen et al. 2009) for EU CASTOR pilot
plant
Parameter
Design value
Max stripper pressure (bar)
3
Max solvent flow (m3/h)
40
Max reboiler steam flow (kg/h) at 3.5 bar
2500
Max solvent flow
40
III.II.IX.V Solvent Stripper Reclaimer
A small slipstream of the lean solvent from the solvent stripper bottoms is fed to the solvent stripper
reclaimer for the removal of high-boiling non-volatile impurities (heat stable salts - HSS), volatile
acids and iron products from the circulating solvent solution. The solvent bound in the HSS is
recovered by reaction with caustic and heating with steam. The solvent reclaimer system reduces
corrosion, foaming and fouling in the solvent system. The reclaimed solvent is returned to the
solvent stripper and the spent solvent is pumped via the solvent reclaimer drain pump to the solvent
reclaimer drain tank.
III.II.IX.VI CO2 compressor (DOE/NETL 2007)
In the compression section of simulation, the CO2 is compressed to 153 bar by a six-stage centrifugal
compressor. The discharge pressures of the stages were balanced to give reasonable power
distribution and discharge temperatures across the various stages as shown in Table 36.
248
Table 36 CO2 Compressor interstage pressures (DOE/NETL 2007)
Stage
Outlet pressure (bar)
1
3.6
2
7.8
3
17.1
4
37.6
5
82.7
6
153
During compression to 153 bar in the multiple-stage, intercooled compressor, the CO2 stream is
dehydrated to a dewpoint of -40ºC with triethylene glycol.
III.II.X Description of main positive features and critical points
III.II.X.I Positive features (Figueroa et al. 2008)
-
Applicable to the majority of existing PC and IGCC power plants
-
Retrofit technology option
III.II.X.II Critical points (Wall 2007)
Low CO2 partial pressure:
-
Significantly higher performance or circulation volume required for high capture levels
CO2 produced at low pressure compared to sequestration requirements
Amines-based solvents (MEA, MDEA, DEA) are suited to the lean combustion CO2 concentrations of
flue gas, but require a large amount of energy to regenerate the solvent (in the solvent stripper), this
being as much as 80% of the total energy of the process. A generation efficiency loss results,
requiring the use of additional fuel.
There are also interactions between the CO2 capture system and the control of other emissions such
as SO2 and NO2, which react with MEA to form heat-stable salts that reduce the CO2 absorption
capacity of the solvent.
O2 in the flue gas also causes degradation of the amines and its products can lead to corrosion
problems.
Furthermore, degradation products are highly toxic and a first bibliographic analysis shows that the
only means of eliminating them are incineration or burial (Kanniche et al. 2009).
III.II.XI Description of particularly relevant technical solutions
Fluor’s Econamine FG Plus is a proprietary acid gas removal system that has demonstrated greater
than 95% availability with natural gas fired power plants, specifically on a 350 ton/day CO2 capture
plant in Bellingham, MA. It is currently the state-of-the-art commercial technology baseline and is
used in comparing other CO2 capture technologies.
249
III.II.XI.I R&D requirements (Wall 2007)
-
NOx, SOx, and Hg removal, consistent with solvent tolerance
-
Materials for high efficiency (temperature) steam cycles. CO2 capture by improved chemical
and physical solvents, or by membrane and absorption techniques. Reduced energy for CO 2
capture
250
III.III Alternative technologies for post combustion capture
III.III.I NGCC power plant with post combustion CO2 capture (DOE/NETL 2007)
Figure 89 NGCC power plant with post-combustion CO2 capture block diagram
III.III.II Emerging alternative technologies for post combustion CO2 capture (IEA GHG
2009)
III.III.II.I Carbonate based systems
These are based on the ability of soluble carbonate to react with CO2 to form a bicarbonate which,
when heated, releases CO2 and reverts to a carbonate. Significantly lower energy is required for
regeneration, compared to amines. At the University of Texas, Austin, a K2CO2 based system has
been developed which uses Piperazine, (PZ) as catalyst. A benefit is that oxygen is less soluble in
K2CO3/PZ solvents. This system has adsorption rate 10-30 % faster than a 30 % solution of MEA and
has favourable equilibrium characteristics. PZ is more expensive than MEA so economic impact of
oxidative degradation is about the same. However, higher loading capacity, structured packing and
multi-pressure stripping can give more savings.
III.III.II.II Aqueous Ammonia
Ammonia-based wet scrubbing is similar to amine system in operation. Ammonia and its derivatives
react with CO2 via various mechanisms, one of which is reaction of water, CO2 and Ammonium
Carbonate to form Ammonium bi Carbonate. The reaction has significantly lower heat of reaction
(energy savings) than amine-based systems, provided the adsorption-desorption cycle is limited to
this mechanism. Other advantages are potential of higher CO2 capacity, lack of degradation during
251
absorption/regeneration, tolerance to oxygen in flue gas, low cost, and potential for regeneration at
high pressure. There is also a possibility of reaction with SOx and NOx-components in flue gas to form
fertiliser as saleable by-product. There are concerns related to ammonia’s higher volatility, the need
to be cool to 15–25 °C to enhance CO2 absorptivity and minimise ammonia emissions during
absorption steps. Also, there are concerns about ammonia losses during regeneration, which occurs
at higher temperatures.
III.III.II.III Chilled Ammonia Process
This uses the same Ammonium Carbonate (AC)/Ammonium Bi Carbonate (ABC) absorption chemistry
as the aqueous system described above, but differs in that a slurry of aqueous AC and ABC and solid
ABC is circulated to capture CO2. The process operates at near freezing temperatures (0–10 °C), and
the flue gas is cooled prior to absorption using chilled water and a series of direct contact coolers.
Concerns associated with this process include cooling the flue gas and absorber to maintain
operating temperatures below 10 °C (required to reduce ammonia slip, achieve high CO 2 capacities,
and for AC/ABC cycling), mitigating the ammonia slip during absorption and regeneration, achieving
90 % removal efficiencies in a single stage, and avoiding fouling of heat transfer and other equipment
by ABC deposition as a result of absorber operation with a saturated solution.
III.III.II.IV Membranes
In one concept, flue gas will be passed through a bundle of membrane tubes and amine will flow on
the shell-side. CO2 would pass through and be absorbed in amine while impurities will be blocked. It
should also be possible to achieve high loading differential between rich and lean amine. After
leaving the bundle, amine would be regenerated and recycled in the normal way. Another concept is
use of inorganic membranes.
III.III.II.V CO2 Capture sorbents
These are prepared by treating high surface area substrates with various amine compounds.
Immobilisation of amine groups on high surface area material significantly increases the contact area
between CO2 and amine. The Research Triangle Institute is developing another process ideally suited
for retrofit application in non-power and power generation sectors.
III.III.II.VI Metal Organic Frameworks (MOFs)
Through this method high storage capacity may be possible and heat required for recovery of
adsorbed CO2 is low. Over 600 such frameworks have been developed. UOP is leading DOE efforts in
this area and has developed a screening modelling too
III.III.II.VII Enzyme Based systems
An enzyme-based system, which achieves CO2 capture and release by mimicking the mechanism of
the mammalian respiratory system, is under development by Carbozyme. The process utilises
carbonic anhydrase (CA) enzyme in a hollow fibre contained liquid membrane and has demonstrated
the potential for 90 % CO2 capture in laboratory. The process has shown to have very low heat of
absorption that reduces energy penalty typically associated with absorption process. The rate of CO2
dissolution is limited by the rate of aqueous CO2 hydration and the CO2-carrying capacity limited by
buffering capacity. Adding CA to the solution speeds up the rate of carbonic acid formation. The
ability of CA to make turnover faster (catalyse hydration of 600,000 molecules of CO2 per molecule
of CA per second compared to max rate of 1,400,000). Technical challenges include membrane
boundary layer, pore wetting, surface fouling, loss of enzyme activity, long-term operation and scale
up.
252
III.III.II.VIII Ionic liquids
These can dissolve gaseous CO2 and are stable at temperatures up to several hundred degrees
centigrade. Their good temperature stability offers the possibility of recovering CO2 from flue gas
without having to cool it first. Also, since these are physical solvents, little heat is required for
regeneration. At the same partial pressures they have shown SO2 solubility 8-25 times higher than
that for CO2. Hence they can be used for SO2 step as well. Their high viscosities may be limitation in
application. Capacity still needs to be significantly improved, however, to meet cost targets.
253
III.IV Pre-combustion capture
III.IV.I Type of application
Pre-combustion capture
III.IV.II Development stage (R&D, design, construction, operational)
Design. Currently no pre-combustion CO2 capture plants are running, but there are several pre
combustion capture and storage projects planned all over the world (Table 37).
Table 37 Planned CO2 pre combustion capture and storage projects (WRI 2008)
Project name
Location
Feedstock
Size
(MW, Start-up
except
as date
noted)
Fort Nelson
Canada
Gas
Gas process
2011
ZeroGen
Australia
Coal
100
2012
UAE Project
UAE
Gas
420
2012
Appalachian Power
USA
Coal
629
2012
Wallula Energy Resource Center
USA
Coal
600-700
2013
RWE Zero CO2
Germany
Coal
450
2015
Monash Energy
Australia
Coal
60,000 bdp
2016
Powerfuel Hatfield
UK
Coal
900
Undecided
Polygen project
Canada
Coal/
Petcoke
300
Undecided
bdp = barrels per day
III.IV.III Process description (Nord et al. 2009)
In this technology the fossil fuel is used for producing a syngas and the carbon (as CO2) is separated
out before the combustion takes place. The fuel for the combustion mainly consists of hydrogen
mixed with a diluent, such as, nitrogen or steam. This capture method involves the removal of CO 2 in
integrated gasification combined cycle (IGCC) and natural gas combined cycle (NGCC) power stations,
after the conversion of CO of syngas to CO2 through the shift reactor.
In the first case syngas is the product of coal gasification process, in the second case a product of
natural gas reforming (partial oxidation and steam reforming).
Typologies of pre combustion capture:

Physical wash processes using Rectisol or Selexol solvents

Sorption enhanced reaction process (SER)
254

Removal of hydrogen in dehydrogenation and synthesis gas reactions with membranes
III.IV.IV Potentiality (maximum annual production achieved/foreseeable)
A simulation of a 550 MW IGCC power plant, carried out in the study (DOE/NETL 2007), shows that
CO2 production in this kind of power plant is approximately equal to 12,000 t/d and it is mostly
captured by pre-combustion capture units (99 % of CO2). A similar simulation on a 450 MW NGCC
power plant (Kanniche et a. 2009, Nord et al. 2009) assesses a CO2 capture of 4,000 t/d for this kind
of power plant.
III.IV.V Noticeable substances and materials involved (IEA GHG 2009)
Two widely used physical solvents are:

Selexol. A mixture of the dimethyl ethers of polyethylene glycol. It is widely used presently in
applications as selective removal of H2S and COS in IGCC, refineries or fertilizer industry. The
product specifications achievable depend on the application and can be anywhere from
ppmv up to percent levels of acid gas.

Rectisol. A physical acid gas removal process using an organic solvent (methanol) at sub-zero
temperatures. It can purify synthesis gas down to 0.1 vppm total sulphur (including COS) and
CO2 in ppm range. Rectisol wash units are operated worldwide for the purification of
hydrogen, ammonia, and methanol syngas, and the production of pure carbon monoxide and
oxo-gases.
255
III.IV.VI Block diagram
IGCC power plant is here considered.
Figure 90 General Electric Energy gasifier IGCC power plant block diagram (DOE/NETL 2007)
256
III.IV.VII Process flow diagram
A process flow diagram of a Selexol CO2 capture plant is here considered.
Figure 91 Two-stage Selexol process Flow Diagram
III.IV.VIII Main equipments
Only main equipments in power plants connected to the pre combustion capture technology are
here considered:

Air Separation Unit

H2S absorber

CO2 absorber

Stripper

Re-absorber

H2S concentrator

Hydrogen turbine

CO2 compressor and dehydrator
Two-stage Selexol process
257
III.IV.IX Description/scheme of significant equipment
III.IV.IX.I Air Separation Unit (DOE/NETL 2007)
The air separation plant is designed to produce 95 mole percent O2 for use in the gasifier. The plant is
designed with two production trains, one for each gasifier. Nitrogen is also recovered, compressed,
and used as dilution in the gas turbine combustor. A process schematic of a typical ASU is shown in
Figure 91.
The air feed to the ASU is supplied from a stand-alone compressor. Air to the stand-alone
compressor is first filtered then compressed with intercooling between each stage.
Subsequently an adsorption removes water, carbon dioxide, and C4+ saturated hydrocarbons in the
air.
The air from the pre-purifier is then split into three streams. About 70 percent of the air is fed
directly to the cold box. About 25 percent of the air is compressed in an air booster compressor. This
boosted air is then cooled in an aftercooler against cooling water in the first stage and against chilled
water in the second stage before it is fed to the cold box. The chiller utilizes low pressure process
steam at 0.3 MPa (50 psia). The remaining 5 percent of the air is fed to a turbine-driven, single-stage,
centrifugal booster compressor. This stream is cooled in a shell and tube aftercooler against cooling
water before it is fed to the cold box.
All three air feeds are cooled in the cold box to cryogenic temperatures against returning product
oxygen and nitrogen streams in plate-and-fin heat exchangers. The large air stream is fed directly to
the first distillation column to begin the separation process. The second largest air stream is liquefied
against boiling liquid oxygen before it is fed to the distillation columns. The third, smallest air stream
is fed to the cryogenic expander to produce refrigeration to sustain the cryogenic separation process.
Inside the cold box the air is separated into oxygen and nitrogen products. The oxygen product is
withdrawn from the distillation columns as a liquid and is pressurized by a cryogenic pump.
The pressurized liquid oxygen is then vaporized against the high-pressure air feed before being
warmed to ambient temperature. The gaseous oxygen exits the cold box and is fed to the centrifugal
compressor with intercooling between each stage of compression. The compressed oxygen is then
fed to the gasification unit.
Nitrogen is produced from the cold box at two pressure levels. Low-pressure nitrogen is split into two
streams. The majority of the low-pressure nitrogen is compressed and fed to the gas turbine as
diluent nitrogen. A small portion of the nitrogen is used as the regeneration gas for the pre-purifiers
and recombined with the diluent nitrogen. A high-pressure nitrogen stream is also produced from
the cold box and is further compressed before it is also supplied to the gas turbine.
258
Figure 92 Typical ASU process schematic (DOE/NETL 2007)
III.IV.IX.II Selexol process
A two-stage Selexol process (DOE/NETL 2007) is used for the IGCC capture case considered in this
study. A brief process description follows.
Untreated syngas enters the first of two absorbers where H2S is preferentially removed using loaded
solvent from the CO2 absorber. The gas exiting the H2S absorber passes through the second absorber
where CO2 is removed using first flash regenerated, chilled solvent followed by thermally
regenerated solvent added near the top of the column. The treated gas exits the absorber and is sent
either directly to the combustion turbine or is partially humidified prior to entering the combustion
turbine. A portion of the gas can also be used for coal drying, when required.
The amount of hydrogen recovered from the syngas stream is dependent on the Selexol process
design conditions. In this study, hydrogen recovery is 99.4 percent. The minimal hydrogen slip to the
CO2 sequestration stream maximizes the overall plant efficiency. The Selexol plant cost estimates are
based on a plant designed to recover this high percentage of hydrogen. For model simplification, a
nominal recovery of 100 percent was used with the assumption that the additional 0.6 percent
hydrogen sent to the combustion turbine would have a negligible impact on overall system
performance.
The CO2 loaded solvent exits the CO2 absorber and a portion is sent to the H2S absorber, a portion is
sent to a re-absorber and the remainder is sent to a series of flash drums for regeneration. The CO2
product stream is obtained from the three flash drums, and after flash regeneration the solvent is
chilled and returned to the CO2 absorber.
The rich solvent exiting the H2S absorber is combined with the rich solvent from the re-absorber and
the combined stream is heated using the lean solvent from the stripper. The hot, rich solvent enters
the H2S concentrator and partially flashes. The remaining liquid contacts nitrogen from the ASU and a
portion of the CO2 along with lesser amounts of H2S and COS are stripped from the rich solvent. The
259
stripped gases from the H2S concentrator are sent to the re-absorber where the H2S and COS that
were co-stripped in the concentrator are transferred to a stream of loaded solvent from the CO2
absorber. The clean gas from the re-absorber is combined with the clean gas from the H2S absorber
and sent to the combustion turbine.
The solvent exiting the H2S concentrator is sent to the stripper where the absorbed gases are
liberated by hot gases flowing up the column from the steam heated reboiler. Water in the overhead
vapor from the stripper is condensed and returned as reflux to the stripper or exported as necessary
to maintain the proper water content of the lean solvent. The acid gas from the stripper is sent to the
Claus plant for further processing. The lean solvent exiting the stripper is first cooled by providing
heat to the rich solvent, then further cooled by exchange with the product gas and finally chilled in
the lean chiller before returning to the top of the CO2 absorber.
III.IV.IX.III Hydrogen turbine (Steeneveldt 2006)
The hydrogen turbine is the unit that is common for all pre-combustion technologies for all fuels.
Pure hydrogen presents several complex challenges for flame stability due to its very high flame
speed when premixed, and its high temperatures when non-premixed. The high flame temperatures
resulting from hydrogen combustion are attenuated by the addition of nitrogen and/or steam.
At present, only dilution based on diffusion is commercially available for hydrogen-rich combustion
and increases in hydrogen content increase the required amount of dilution gases. Although steam is
the more effective of the two diluents, steam dilution results in higher metal temperatures of the
hot-gas components that can reduce equipment lifetimes if firing temperatures – and thereby also
engine efficiency – are not reduced. Moreover, steam extraction has a direct negative impact on the
energy efficiency of a combined cycle. So, nitrogen is generally preferred over steam for dilution, but
for high hydrogen content, the large volumetric flow to the combustor presents a design challenge.
Modifications to the combustors and fuel mixing system are the principal requirements when
converting a natural gas turbine to burn hydrogen-rich fuels. Although hydrogen has almost three
times more energy by mass than natural gas, by volume the energy density is much lower. As a
result, hydrogen fuelled gas turbines will require larger delivery piping, manifold, valves and nozzle
sizes than natural gas-burning engines currently need. Compressing hydrogen to a greater operating
pressure than natural gas, to increase its volumetric energy density, would mitigate the increased
size requirements for delivery equipment. The flammability range of hydrogen is quite large
compared to other fuels, so that the fuel/air ratio can be throttled for much leaner combustion.
Although hydrogen combustion turbines are not presently commercially produced, there appears to
be no major technical barriers for gas turbines burning gases with hydrogen contents up to roughly
70%. While immediate efficiency gains could be obtained using hydrogen in place of natural gas,
these would likely be offset by NOx control considerations, such as a lean fuel/air mixture to limit the
combustion temperature. Since efficiency and power roughly can be considered equal between
these fuels, the most significant gain from converting to hydrogen fuelled gas turbines is its nearly
completely clean emissions profile.
III.IV.IX.IV CO2 compressor and dehydrator (DOE/NETL 2007)
CO2 from the acid gas removal process is generated at three pressure levels. The LP stream is
compressed from 0.15 MPa (22 psia) to 1.1 MPa (160 psia) and then combined with the MP stream.
The HP stream is combined between compressor stages at 2.1 MPa (300 psia). The combined stream
is compressed from 2.1 MPa (300 psia) to a supercritical condition at 15.3 MPa (2215 psia) using a
multiple-stage, intercooled compressor. During compression, the CO2 stream is dehydrated to a dew
point of -40ºC with triethylene glycol.
260
III.IV.X Description of main positive features and critical points (Figueroa 2008)
III.IV.X.I Positive features
Synthesis gas is:
-
Concentrated in CO2
-
High Pressure
To the extent that the concentration and pressure of the CO2 containing stream can be increased,
then the size and cost of the capture facilities can be reduced. Moreover there are existing capture
process for concentrated CO2 streams or CO2 containing stream at high pressure.
III.IV.X.II Critical points
-
Applicable mainly to new plants, as few gasification plants are currently in operation
-
Barriers to commercial application of gasification are common to pre-combustion capture
o
Availability
o
Cost of equipment
o
Extensive supporting systems requirements
Safety issues (Kanniche et al. 2009):
-
Use of pure oxygen
-
Control over highly toxic gases (CO and H2S)
-
Control over combustion of hydrogen in combustion turbines (flame stability)
III.IV.XI Description of particularly relevant technical solutions (SFA 2002)
The Selexol process solvent is a mixture of dimethyl ethers of polyethylene glycol, and has the
formulation CH3(CH2CH2O)nCH3, where n is between 3 and 9. The Selexol solvent is chemically and
thermally stable, and has a low vapor pressure that limits its losses to the treated gas. The solvent
has a high solubility for CO2, H2S, and COS. It also has an appreciable selectivity for H2S over CO2.
The Selexol process can be configured in various ways, depending on the requirements for the level
of H2S/CO2 selectivity, the depth of sulfur removal, the need for bulk CO2 removal, and whether the
gas needs to be dehydrated. Where selective H2S removal is required, together with deep CO2
removal, a two-stage Selexol process is generally used.
R&D requirements (Wall 2007):
-
Oxygen production (with higher efficiency and lower cost, perhaps by ion transport and
other novel systems)
-
Longer life refractories
-
System design specific to local conditions and regulatory environment
261
III.V Alternative technologies for pre-combustion capture
III.V.I Rectisol CO2 capture plant
Figure 93 Rectisol process flow diagram
If all carbon is to be removed from synthesis gas, such as for CO2 sequestration, this Rectisol layout
could be used. In such a scheme, separate absorption and solvent regeneration steps would be used,
with a shift conversion step between the two steps. Selective removal of the sulfur compounds
would take place in the first stage, followed by the shift conversion step. Bulk CO2 removal would
take place in the second stage.
III.V.II Other advanced options
The sorption enhanced reaction process (SER) combines catalytic shift conversion (of carbon
monoxide and steam to hydrogen and carbon dioxide) with a high temperature CO2 adsorption
system using a mixture of solid catalyst and adsorbent. The conversion and CO2 removal steps are
carried out in a multi-bed pressure swing adsorption unit which is regenerated using low pressure
steam which is subsequently condensed to leave a relatively pure CO2 stream (Steeneveldt et al.
2006).
The removal of hydrogen in dehydrogenation and synthesis gas reactions with membranes has been
widely studied. Two different approaches have been investigated: integration of a membrane into
the reformer and integration of a membrane into the high temperature shift reactor. Product
removal may occur by H2 permeation through a Pd-alloy or composite Pd-ceramic membrane or a
ceramic porous membrane. The permeation of the sweep gas onto the feed (i.e. retentate) side also
contributes to increasing the conversion.
262
III.V.III NGCC power plant with pre-combustion CO2 capture (Nord et al. 2009)
Figure 94 NGCC power plant with pre-combustion CO2 capture block diagram
263
III.VI Oxy-fuel combustion
III.VI.I Type of application
Oxy-fuel combustion
III.VI.II Development stage (R&D, design, construction, operational)
R&D. In order to study the technology and its feasibility, several pilot plants have been built in these
years. Notably the principal pilot plants are at Vattenfall (Germany), at Lacq (France) and at Callide
valley (Australia). Moreover some other pre combustion capture and storage projects have been
planned all over the world (Table 38).
Table 38 Planned CO2 oxy-fuel combustion capture and storage projects (WRI 2008)
Project name
Location
Feedstock
Size
(MW, Start-up
except
as date
noted)
Kimberlina
USA
Coal
50
2010
ZENG Worsham-Steed
USA
Gas
70
Undecided
ZENG Risavika
Norway
Gas
50-70
Undecided
Several studies have been also carried out on oxy-fuel combustion. In this survey, (Hong et al. 2009)
was taken into account because it simulates an oxy-fuel combustion power cycle with a potentiality
of 260 MW, thus comparable with the previous power plant simulations.
III.VI.III Process description (IEA GHG 2009)
Oxy-fuel concepts for both natural gas and coal feedstock have been proposed (Croiset and
Thambimuthu 2000, Tan et al. 2002). This technology involves a modification of the combustion
process and can be defined as combustion in nearly pure oxygen (greater than 95%) rather than air.
Oxygen is diluted with recycled flue gases to reduce combustion temperature and is also needed to
carry the combustion energy through the convective heat transfer equipment employed in current
first generation technology.
Since nitrogen is the main diluent in the products of air combustion, using pure oxygen readily allows
the generation of chiefly CO2 (80-95%) and water, removing the need for any subsequent separation
stage. Consequently, the oxy-fuel process does not require CO2 capture prior to compression, only a
removal of water by condensation and a purification from contaminants. The idea behind recycling
flue gas prior to combustion in a boiler is to maintain combustion conditions similar to an air-fired
configuration. This is necessary, as currently available material of construction cannot withstand high
temperatures resulting from coal combustion in pure oxygen.
Alternative technologies similar to the oxyfuel combustion:

Ceramic membrane combustor

Chemical loop combustion
264
III.VI.IV Potentiality (maximum annual production achieved/foreseeable)
The simulation of a 260 MW coal fired power plant utilizing an oxy-fuel combustor (Hong 2009)
shows a potentiality of CO2 captured equal to 6,300 t/d. Oxy-fuel combustion potentially allow for
100% CO2 capture, although a small amount of CO2 (around approximately 4 g/kWh) will not be
recovered from oxy-fuel cycles using water condenser(Steeneveldt et al. 2006).
III.VI.V Noticeable substances and materials involved
Noteworthy substances and materials connected to this technology capture:
Oxygen: a combustion with pure oxygen is generally characterised by much higher levels of
temperature in the absence of inert gas. For this reason an external (exhaust gas) or internal
(induced by the high momentum oxygen jets) recycle stream must be provided.
It is necessary to maintain its purity by avoiding internal leakage (Kanniche et al. 2009).
Oxygen is classified on its safety data sheet as a substance that in contact with combustible material
may cause fire (risk phrase R8), so it leads to operation and safety problems.
Impurities of fume CO2: conditioning of the flue gas consists of drying the CO2, removal of O2 (derived
from the oxygen feed, the fuel stream or air leakage into the system) to prevent corrosion in the
pipeline and possibly removal of other contaminants and diluents, such as Ar, N2, SOx, NOx, HCl and
Hg derived from the fuel used (Figueroa et al. 2008). Without removal in the recycle steam, species
(including corrosive sulphur gases) can reach high concentrations in the system (Wall 2007).
Ash: during oxy-fuel combustion, the oxygen concentration in the gas is elevated (around 30% by
volume), which increases particle combustion temperature. This increase in the particle combustion
temperature will affect the associated vaporization of elements. The vaporised elements often serve
as a bonding agent for ash deposits in the boiler and thus could affect boiler operation. The effect of
oxy-fuel combustion on submicron ash formation has been researched, however, no studies have
been found that assess its possible impact on deposit formation and structure (Buhre et al. 2005).
265
III.VI.VI Block diagram
Figure 95 Block diagram of oxy-fuel combustion system with recirculation before the CO 2 purification
process. Mass, heat and electricity streams in the O2/CO2 recycle combustion plant. “+CO2” and “+O2”
symbolizes that the streams may contain more than their main constituents (Jordal et al. 2004)
III.VI.VII Process flow diagram
Figure 96 Flow diagram of oxy fuel combustion system with recirculation after the CO 2 purification
process (Wu et al. 2009)
266
III.VI.VIII Main equipments

Boiler

Air Separation Unit equipments

Particle removal equipments

Flue gas condenser

SO2 removal equipments

CO2 dryer

Non-condensable gases removal equipments

CO2 compressor
III.VI.IX Description/scheme of significant equipment (Jordal et al. 2004)
III.VI.IX.I Boiler
Combustion of coal in pure oxygen gives a high flame temperature, which will cause ash melting and
enhance the formation of NOx. The suggested solution to this in a PF boiler is usually an external
recirculation of flue gas, as shown in Figure 96. Since it is desirable to reduce the external
recirculation rate to reduce the boiler size and increase the efficiency, the challenge is to design a
boiler with internal recirculation of cooled gases inside the boiler to cool down the flame. This is very
much the same as the thousands of existing oxyfuel applications in industry. As long as there is an
external recirculation, it must also be decided at which point in the flue gas stream this recycle
should be extracted. Most likely the recirculated stream should be extracted after a primary particle
removal, to avoid extensive build up of particulates. Usually it is assumed that the stream is extracted
before the flue gas condenser, although this is not obvious. Furthermore, a strategy for adding the
oxygen in the boiler must be developed, so that NOx formation and CO-levels can be kept low.
Another challenge is related to the air leakage into the boiler. It must be determined how the boiler
should be sealed or even work with overpressure to minimize air leakage, or if leakage air should be
dealt with in the downstream gas cleaning process.
III.VI.IX.II Air Separation Unit
In general, studies of the oxyfuel technology for CO2 capture from coal assume that the oxygen is
produced with a cryogenic air-separation unit (Cryo-ASU), although membranes and chemical
looping are sometimes mentioned for future concepts, Cryo-ASU is the only available large-scale
technology for oxygen separation from air at present. It will most likely be the technology employed
in the first generation of O2/CO2 recycle combustion capture of CO2. The Cryo-ASU may be either of
the low-purity kind, producing oxygen with 95% purity (the remaining 5% being mainly argon) or of
the high-purity kind that produces oxygen of more than 99% purity. The high-purity Cryo- ASU is
more expensive and more energy consuming than the low-purity Cryo-ASU. Roughly, the electric
power consumption of a Cryo-ASU may amount to 20% of the plant gross power output for the
O2/CO2 recycle combustion power plant, which of course is very detrimental to plant efficiency.
III.VI.IX.III Particle removal
Particle removal after the boiler is primarily a question of reducing deposits in the recirculation of the
flue gas and what can continue with the flue gas stream from the process. This particle removal will
probably be by cyclones in a primary step within the recirculation loop and with electro-static filters
(ESP) or fabric filters thereafter in the reduced gas stream. The choice depends on system
configuration, operating requirements, energy and economical analyses. Not all particles will be
267
removed in an ESP though, but most of the remaining particles in the stream that is not recycled will
end up in the flue gas condensate.
III.VI.IX.IV Flue gas condenser
Flue gas condensation is a well-known method for heat recovery from moist flue gases to improve
the overall efficiency in combined heat and power plants, and to remove pollutants in the case of
waste incineration. Usually, flue gas condensation technology is focused more on heat recovery than
on efficient removal of moisture and pollutants. Also, there is an issue of scale-up. The fuel thermal
input in a lignite-fired power plant boiler may very well be above 2000 MWth, whereas existing flue
gas condensers are connected to boilers where the fuel thermal input is an order of magnitude
smaller. It should be noted that with the introduction of lignite drying, the water contents of the flue
gas will be reduced, but still significant residual moisture will be condensed and removed from the
CO2-rich flue gas. In addition, the concentration of acid gases in the flue gas from oxyfuel
combustion should be higher than in conventional flue gas. Corrosion-related issues must therefore
be carefully handled for the flue gas path way and for the flue gas condenser.
III.VI.IX.V SO2 removal
SO2 removal from the flue gas is well-known technology for large lignite-fired power plants, but it is
also rather costly. There are two main issues that need to be resolved in the O 2/CO2 recycle
combustion case. The first issue is whether it is possible to co-capture SO2 with CO2 and if the
resulting stream has a composition that is acceptable for transport and storage, and is compliant
with legal demands. If the answer is yes, the expensive desulphurisation system could be omitted.
Theoretically, the critical constants of SO2 lie close to those of CO2, therefore SO2 with the
concentrations found in the flue gas should be easily mixed with CO2 under most operating
conditions of the CO2 processing. The main obstacles for the co-capture of SO2 with CO2 will be
related to corrosion problems in connection to transport and storage, the concerns of safety,
environmental regulation and legal related issues. The second concern is if it is possible to remove
SO2 from the flue gas in a process that is integrated with other gas cleaning processes, for example
flue gas condensation, in a way that is more compatible with the requirements on both SO2 removal
and CO2 recovery. Presently, both issues are open questions.
III.VI.IX.VI CO2 dryer
Dehydration to remove the water still remaining in the flue gas after the flue gas condenser may very
well be necessary to avoid corrosion and hydrate formation, in particular if the SO 2 is not removed
from the CO2-rich stream. The dryer the CO2 stream, the higher the allowance for the corrosive
components in the CO2 stream. The final dehydration of CO2 should be integrated into an
intermediate stage in the CO2 compressor train, exactly where is depending on the water solubility in
the CO2 under various pressures. Based on physicochemical properties of the CO2 stream, including
the choice of the dehydration processes, it will be possible to make an optimisation of primary water
removal and further dehydration.
III.VI.IX.VII Non-condensable gas removal
Removal of non-condensable gases, including N2, Ar, excess O2 and NOx will take place as an
integrated part of the CO2 compression train if necessary. A phase transfer of CO2 to the liquid state
may be performed and thereafter the non-condensable gases are flashed from the liquid CO2. A high
selectivity of the non-condensable gases for the separation is required in order to achieve a high CO2
recovery and avoid that CO2 is emitted to the atmosphere. Connected to this is the lack of knowledge
of physical properties for mixtures of high-pressure CO2 and non-condensable gases. To avoid
emission of NO when releasing the stream of removed non-condensable gases to the atmosphere, it
is important to ensure either that the fuel nitrogen is mainly converted to N2 in the combustion
268
process or that the stream of non-condensable gases is treated to convert the NO to N2 through for
instance ammonia injection at an appropriate gas temperature.
Another issue related to the non-condensable gas content in the flue gas is how much effort should
be made to avoid that these gases enter the power plant. N2 and NO formation from the fuelnitrogen during the combustion cannot be avoided. There may also be some air leakage into the
boiler, in particular with the fuel feed. The excess O2 in the combustion should from this point of
view be kept as low as possible, but some excess O2 will be necessary to ensure complete
combustion. Depending on the oxygen separation method, the oxygen that enters the O2/CO2 recycle
boiler may also very well contain argon and minor fractions of nitrogen. An overall economic and
technical analysis will be necessary combined with boiler and combustion designs in order to decide
whether to avoid as much as possible of the non-condensable gases upstream of the CO2 processing
or to separate them during the CO2 processing.
III.VI.X Description of main positive features and critical points (Figueroa et al. 2008)
III.VI.X.I Main positive features
-
Very high CO2 concentration in flue gas
-
Retrofit and repowering technology option
-
Possibility to reduce the boiler size and cost
III.VI.X.II Critical points
-
Large cryogenic O2 production requirement may be cost prohibitive
-
Cooled CO2 recycle required to maintain temperatures within limits of combustor materials
o
Decreased process efficiency
o
Added auxiliary load
-
The impurities can create a problem for a CO2 transport and lead to corrosion and without
removal in the recycle steam, they can reach high concentrations in the system.
-
It would be necessary to adapt to a new operations culture that imposes strict control over
safety with the use of pure oxygen as an oxidant.
III.VI.XI Description of particularly relevant technical solutions
III.VI.XI.I R&D requirements
-
Radiative heat transfer prediction
-
Corrosion and ash deposition
-
Operability and dynamic behaviour
-
Furnace design for reduced recycle
-
Materials for high efficiency (temperature) steam cycles.
-
Oxygen production (with higher efficiency and lower cost, perhaps by ion transport and
other novel systems).
-
Cycle optimisation and system thermal integration
269
III.VII Alternative technologies similar to the oxyfuel combustion
III.VII.I Ceramic membrane combustor. (Steeneveldt et al. 2006)
A ceramic membrane is integrated into the combustor and allows transport of oxygen and heat, such
that the combustion products, chiefly CO2 and H2O are expanded in one turbine, while the heated
oxygen-depleted air drives the main combined cycle gas turbine.
III.VII.II Chemical looping combustion (Steeneveldt et al. 2006)
Chemical looping combustion divides combustion into intermediate oxidation and reduction
reactions that are performed separately with a solid oxygen carrier circulating between the
separated sections.
Although there are various ways to perform CLC, a fluidized-bed combustion system has some
advantages: good heat transfer and effective transport of the solid oxygen carriers between the two
reactors. At the present stage of development, the mechanical stability and chemical reactivity over
many cycles are the main development issues for this process.
270
III.VIII Carbon dioxide compression
There are a number of different compressor types that can be used for carbon dioxide compression
for bulk transport. The incentive is to transport the carbon dioxide in dense phase, which, for the
pure gas, implies a pressure of above 73,8 bara, although the density of liquid carbon dioxide is very
similar, which could allow pressures as low as 34,85 bara at 0°C.
III.VIII.I Axial compressors
Axial compressors are appropriate for compressing carbon dioxide in the gaseous phase, and are
available from a number of different suppliers. Axial compressors alone are suitable up to about 6
bar and 1,3Mm3/hour. For pressures higher than this an axial/radial compressor would be used, and
pressures of up to 16 bar would be possible. An axial/radial compressor has a number of axial stages
followed by a number of radial stages mounted on a single shaft.
III.VIII.II Centrifugal compressors
Pinion speed of integrally geared compressors can be optimised to maximise stage performance and
hence minimise the overall power requirement. In the following design, the compressor gearbox can
be arranged with up to four pinion shafts (i.e. 8 stages) driven from a single centrally-mounted bull
wheel.
Figure 97 Integrally geared compressor concept (Wacker 2009)
The integrally geared, centrifugal compressor for carbon dioxide is provided with inter-stage cooling
and condensate removal from the wet stages; provision can also be made for dehydration during
compression to meet pipeline material constraints, as well as avoiding hydrate formation in sub-sea
pipelines. The machine shown is one of three MAN Turbo carbon dioxide compressors installed at
the Dakota Gasification facility in Beulah, N. Dakota. The Beulah facility has been operating
continuously since 1997, initially with two compressors and then a third machine was commissioned
in 2007 to increase the EOR injection rate. Each machine is designed for operating pressures up to
215 bar with a motor rating of ~14,7 MW; however due to the increased pipeline pressure-drop with
three compressors operating, a pumping station has been introduced roughly midway in the pipeline
to Weyburn. Suction flow rates of up to 350 000m3/hour are available. This equates to 650
tonnes/hour.
271
Figure 98 Integrally geared compressor for Weyburn Project
Table 39 MAN Turbo references for large-scale CO2 compressors (Wacker 2009)
Location
Type
Mass flow of
Pressure
CO2
(bara)
(tonnes/hour)
North Dakota
RG80-8
126
187
8
Azot Nowomoskowsk (Russia)
RG56-10
46.8
200
10
Duslo (Slovakia)
RG40-8
28.8
150
8
Grodno Azot (Czech Republic)
RG56-8
57.6
150
8
Stages
Siemens also make internally geared compressors up to 480 000 Nm3/hour (890 tonnes/hour) at
pressures up to 100 bar.
III.VIII.III Reciprocating compressors
Reciprocating compressors fall into two types, piston and diaphragm.
III.VIII.IV Piston compressors
Because of its high Joule Thompson coefficient, carbon dioxide is used as a refrigerant gas, where it is
known as R744. Piston compressors are frequently used in refrigerant applications, where the
pressure to which the carbon dioxide has to be compressed is medium (up to about 40 bar). They are
also used in the fertiliser industry, where single unit capacities of up to 30 000 Nm3/hour (55
tonnes/hour) at pressures up 320 bar are available (Shenyang 2010).
272
III.VIII.V Diaphragm compressors
These pumps use diaphragms made from durable metal or a PTFE sandwich, and have the advantage
that they are hermetically tight. The pressure range goes up to 1200 bar with volumes up to
14m3/hour (for liquid carbon dioxide at 40°C this equates to 2,6 kg/hour).
Another advantage is that because of their linear pump characteristics, they can deliver high
metering accuracy, making them suitable for re-injection (in an EOR context) or for boosting
applications.
273
III.IX CO2 transport
III.IX.I Type of application
CO2 pipeline transport
III.IX.II Development stage (R&D, design, construction, operational)
Operational. In the United States, significant CO2 pipeline operating experience exists in the EOR
industry. Since the early 1970s, pipeline companies have been successfully operating a substantial
CO2 pipeline infrastructure, transporting an estimated 2.20*1010 of cubic meters of CO2 per year
through an estimated 6200 km of infrastructure (regulated pipelines as per the US Department of
Transportation records), through pipelines of varying diameters, mainly for use in EOR. The Permian
Basin region of West Texas and New Mexico remains the centre of CO2-based EOR activity. The oldest
long-distance CO2 pipeline in the United States is the 352-km Canyon Reef Carriers pipeline, which
began service in 1972 for EOR in regional Texas oil fields. The longest CO2 pipeline, the 803-km Cortez
pipeline, has been delivering about 24 million of tons of CO2 per year to the CO2 hub in Denver City,
Texas, since 1984 (WRI 2008).
Figure 99 Existing CO2 pipelines in the US (Dooley et al. 2009)
The short length of pipe on the Sleipner project and the Snøhvit carbon dioxide pipeline in the North
and Barents Sea are currently the only examples of offshore carbon dioxide transport (Dooley et al.
2009).
274
Table 40 Major Operational CO2 Pipelines (Dooley et al. 2009)
Location
Operator
Bati Raman
Turkey
Turkish
Petroleum
1983
Dodan field
Bravo
USA
BP Amoco
1984
Bravo Dome
USA
Kinder
Morgan
1972
Gasification
Cortez
USA
Kinder
Morgan
1984
McElmo Dome
Sheep Mountain
USA
BP Amoco
1984
Sheep Mountain
La Barge
USA
Exxon
2003
La Barge gas plant
Val Verde
USA
Petrosource
1998
Val Verde
Plant
North
Dakota
Gasification
Co.
2000
Gasification
Onshore
Canyon
Carriers
Offshore
Year
Pipeline Name
Weyburn
Reef
USA and
Canada
completed
Origin of CO2
Sleipner
Norway
Statoil
1996
Sleipner field
Snøhvit
Norway
Statoil
2008
Snøhvit field
Gas
III.IX.III Description
As already mentioned in the previous paragraphs, the majority of carbon dioxide pipelines are to be
found in North America feeding predominantly naturally occurring carbon dioxide to EOR schemes.
So, the process of transporting both gaseous and dense phase carbon dioxide, whilst less common in
terms of both distance and operational year experience than other fluids, is reasonably established.
III.IX.III.I Operating Temperature and Pressure (WRI 2008)
The most efficient way to transport CO2 is in a supercritical phase. The critical point at which CO2
exists in a supercritical phase is 73 atm and 31oC.
CO2 is generally transported at temperature and pressure ranges between 13oC and 43oC and 85
atm and 150 atm.
The upper pressure limit is mostly due to economic concerns, and is set to the ASME-ANSI 900#
flange rating (the maximum pressures for ANSI 900# flange is material dependent). The lower
pressure limit is set by the phase behaviour of CO2, and should be sufficient to maintain supercritical
275
condition. The upper temperature limit is determined by the compressor-station discharge
temperature and the temperature limits of the external pipeline coating material. The lower
temperature limit is set by winter ground temperature.
It is important for operators to maintain single-phase flow in CO2 pipelines by avoiding abrupt
pressure drops. In a two-phase flow, two physical phases are present in the pipeline simultaneously
(e.g., liquid and gas, or supercritical fluid and gas), which creates problems for compressors and
other transport equipment, increasing the chances of pipeline failure. At pressures very close to the
critical point, a small change in temperature or pressure yields a very large change in the density of
CO2, which could result in a change of phase and fluid velocity, resulting in slug flow. Transmission
pipelines may experience changing temperatures because of both weather and pipeline conditions.
Operators should include a wide margin of safety above the rated critical pressure of CO2 to avoid
complications.
III.IX.III.II Pipeline Design (WRI 2008)
There are existing design and safety criteria to ensure safe and reliable transport of CO2. Pipeline
designers consider the pressure, temperature, and properties of the fluid; the elevation or slope of
the terrain; dynamic effects, such as earthquakes, waves, currents, live and dead loads, and thermal
expansion and contraction; and the relative movement of connected components. The
compressibility and density of CO2 undergo significant nonlinear variation in normal pipeline
operating conditions (within normal pipeline pressure and temperature ranges). For pipeline
construction, selection of pipe diameter, wall thickness, material strength, and toughness depends
on the transmissible fluid’s temperature, pressure, composition, and flow rate.
Table 41 Lengths and diameters of onshore CO2 pipelines (IPCC 2005)
Pipeline Name
Length
Diameter
Bati Raman
90 km
/
Bravo
347 km
508 mm
Canyon Reef Carriers
224 km
406-324 mm
Cortez
803 km
762 mm
Sheep Mountain
772 km
610 mm
La Barge
456 km
/
Val Verde
130 km
/
Weyburn
330 km
305-356 mm
III.IX.III.III Example: Canyon Reef Carrier pipeline characteristics (IPCC 2005)

<48,9°C temperature;

95 atm (gas in dense phase state at all temperatures);

352 km length
276

5.2 MtCO2/year capacity

The main 290 km section is 406.4 mm (16 inch) outside diameter, 9.53 mm wall thickness;

A shorter 60 km section is 323.85 mm (12.75 inch) outside diameter, 8.74 mm wall
thickness
Generally underwater pipelines up to 1422 mm in diameter have been constructed in many different
environments, and pipelines have been laid in depths up to 2200 m. Figure 2 plots the diameters and
maximum depths of major deepwater pipelines constructed up to 2004. The difficulty of construction
is roughly proportional to the depth multiplied by the diameter, and the maximum value of that
product ahs multiplied fourfold since 1980. Still larger and deeper pipelines are technically feasible
with today’s technology (IPCC 2005).
Figure 100 Pipelines in deep water (Dooley et al. 2009)
The majority of onshore CO2 pipelines are buried over most of their length, to a depth of 1-1.2
meters, except at metering or pumping stations, and most offshore lines are also usually buried
below the shallow water seabed. In deeper water, only pipelines with a diameter of less than 400
millimeters (16 inches) are trenched and sometimes buried to protect them against damage by
fishing gear. The exact depth varies based on project-specific needs, and variances can be granted
where appropriate (WRI 2008).
277
III.IX.IV Potentiality (IPCC 2005)
Table 42 Operational CO2 pipeline capacities
Pipeline Name
Estimated Design Capacity
Bati Raman
1.1 MtCO2/year
Bravo
7.3 MtCO2/year
Canyon Reef Carriers
4.4 MtCO2/year
Cortez Pipeline
24 MtCO2/year
Sheep Mountain
9.5 MtCO2/year
La Barge
8 MtCO2/year
Val Verde
2.5 MtCO2/year
Weyburn
2 MtCO2/year
Sleipner
1 MtCO2/year
Snøhvit
0.7 MtCO2/year
In the present context, it must be recalled that one 1000 MW coal-fired power station produces
about 7 MtCO2/year and so one Cortez pipeline could handle the emissions of three of those
stations.
278
III.IX.V Main components
Figure 101 Schematic representation of pipeline transport of dense phase carbon dioxide (IEA GHG 2009)
The main components of a pipeline include valves, compressors, booster pumps, pig launchers and
receivers, batching stations and instrumentation, metering stations, and Supervisory Control and
Data Acquisition (SCADA) systems.
III.IX.V.I Valves
Valves are typically used for control functions around compressor and metering stations and at the
injection sites. One important consideration in pipeline design is the distance between block valves.
Block valves are used to isolate sections of pipe in the event of a leak or for maintenance. Block
valves are spaced every 16–32 kilometers (10–20 miles), depending on the location of the pipe, and
are installed more frequently near critical locations, such as road and river crossings and urban areas.
Installing block valves more frequently increases both the cost of the pipeline and the risk of leakage
from the valves themselves. The farther apart the valves are installed, the greater the volume
contained between the valves, which increases the distance from the pipeline required for the gas to
dissipate to a safe level in the event of a pipeline rupture (WRI 2008). Current pipeline design safety
standards already take into consideration valve spacing as a function of pipeline diameter and
surrounding land use.
III.IX.V.II Compressors
Compressors convert the transmissible gas from atmospheric pressure to supercritical state, the
desired transmissible phase. Moreover, depending on the length and terrain of pipeline,
recompression or decompression of CO2 may be required to maintain supercritical phase CO2. The
CO2 pipeline industry currently uses centrifugal, single-stage, radial-split pumps for recompression,
rather than compressors. These booster-pumping stations are installed as required to maintain
sufficient pressure at high elevation points, in order to ensure a single-phase CO2 flow. For reference,
the compression unit at the Great Plains Synfuel Plant consists of two 8-stage compressors. Feed gas
is taken at 1.2 atm and compressed to 180 atm, which is in the supercritical range for CO2.
279
III.IX.V.III Instrumentation
Instrumentation along the pipeline is typically used to measure the flow rate, pressure, and
temperature of the CO2 and provides sufficient information for the pipeline’s normal operation. The
instrumentation is located at compressor and metering stations and sometimes at the block valves.
SCADA systems are used for remote monitoring and operation of the compressor stations and the
pipeline. These systems are designed to provide operators at a central control centre with sufficient
data on the status of the pipeline to enable them to control the flows through the compressors and
the pipeline as necessary. Metering is used for computational pipeline monitoring (CPM) leakdetection systems for single-phase lines (without gas in the liquid). Currently CO2 pipelines are not
required to have CPM, mainly because it is technically difficult. Other leak-detection methods, such
as pressure point analysis and aerial and visual surveys may be used to ensure safe CO2 transport.
III.IX.VI Noticeable substances and materials involved
III.IX.VI.I Pipeline CO2 Composition (WRI 2008)
Prior to transport, captured CO2 is conditioned to remove impurities and compressed into
supercritical form. The U.S. Department of Transportation’s (DOT’s) Office of Pipeline Safety (OPS)
defines pipeline CO2 as a fluid consisting of more than 90 percent CO2 molecules compressed to a
supercritical state. There are currently no composition requirements (e.g., moisture or coconstituents) for the transport and geologic storage of CO2 (WRI 2008). While there is no established
standard for permitted levels of impurities in CO2 for CCS, the pipeline-quality CO2 compositions
adhered to by the major EOR pipeline operators constitute best practice. Currently, these
requirements are built into contracts between the supplier and the transporter and between the
transporter and the end user.
Captured CO2 may contain impurities like water vapor, H2S, N2, methane (CH4), O2, mercury, and
hydrocarbons that may require specific handling or treatment.
Before transport, the CO2 is dehydrated to levels below 50 ppm of water. Presence of water above
this level is not desirable from an operational standpoint. CO2 reacts with water to form carbonic
acid, which is corrosive. Additionally, under the appropriate thermodynamic conditions, hydrates
(solid ice-like crystals) can form and plug the pipeline.
H2S is toxic, even at low concentrations of 200 ppm. Pipelines containing H2S will require extra due
diligence, particularly near populations. However, it is important to note that it is possible to safely
store H2S with CO2; facilities in Canada have been disposing of H2S through injection in geologic
formations since 1989 (WRI 2008). Injection of acid gas currently occurs at 39 active operations in
Alberta and north-eastern British Columbia. Since surface desulfurization through the Claus process
is generally uneconomical, and the surface storage of the produced sulphur constitutes a liability,
more operators are turning to acid gas disposal by injection into deep geologic formations.
Dehydration is particularly important in these cases, because H2S reacts with water to form sulphuric
acid, which is highly corrosive and may also result in pipeline cracking, increasing the potential for
leaks.
The presence of CH4 affects the exhibited vapour pressure of CO2 and complicates the accurate
prediction of flow (WRI 2008).
In EOR applications, in particular where organic materials are present for bacteria, oxygen is
tolerable only in minute quantities (10 ppm). Even in deep saline formations organics may be
present, and significant quantities of oxygen in the gas stream could allow for formation of bacterial
colonies, affecting the injection operations.
280
Additionally and significantly, mercury is present in coal and is a natural by-product of the
combustion process; it could condense in the pipeline system and create operational issues as well as
implications for storage.
While CO2 composition is not strictly a transport issue, interest in developing a network of
interconnectable pipelines, for maximum utilization of geologic storage sites with or without oil
recovery opportunities, may indicate the need for of a set of CO2 specifications for pipelines similar
to the ones in use today for EOR.
Table 43 CO2 composition for different CCS technologies (Mahgerefteh et al. 2009)
Post-Combustion
Pre Combustion
Oxyfuel
CO2
>99 vol%
>95.6 vol%
>90 vol%
CH4
<100 ppmv
<350 ppmv
-
N2
<0.17 vol%
<0.6 vol%
<7 vol%
H2S
Trace
3.4 vol%
Trace
C2+
<100 ppmv
<0.01 vol%
-
CO
<10 ppmv
<0.4 vol%
Trace
O2
<0.01 vol%
Trace
<3 vol%
NOx
<50 ppmv
-
<0.25 vol%
SOx
<10 ppmv
-
<2.5 vol%
Ar
Trace
<0.05 vol%
<5 vol%
III.IX.VI.II Pipeline Material
The pipelines for CO2 transportation are usually constructed of steel (60,000–80,000 psi yield
strength), such as American Petroleum Institute (API) X60- or X80-grade material. To reduce the
chances of corrosion, CO2 pipelines typically have an external coating of fusion-bonded epoxy or
polyurethane with full cathodic protection; internal pipeline coatings are also available and can be
applied where appropriate (WRI 2008).
III.IX.VI.III Example: Canyon Reef Carrier pipeline CO2 characteristics (IPCC 2005)

95% mol carbon dioxide minimum;

0,489 g/m3 (250ppm wt) water in the vapour phase, no free water;

<1500 ppm (w/w) hydrogen sulphide;

<1450 ppm (w/w) total sulphur;

<4% mole nitrogen;

<5% mole, <-28,9°C dew point for hydrocarbons;
281

<10 ppm (w/w) oxygen;

<4x10-5 l/m3 glycol, no free liquid at pipeline conditions.

Steel pipeline, X65 grade material

304L corrosion-resistant alloy used upstream of the glycol dehydrator
282
III.X References
BP Global, 2008. Report Publication, Capturing Carbon Dioxide, Frontiers.
Buhre BJP, Elliott LK, Sheng CD, Gupta RP, Wall TF, 2005. Oxy-fuel combustion technology for coalfired power generation, Progress in Energy and Combustion Science, Volume 31, Issue 4, Pages
283-307.
Croiset E, Thambimuthu K, 2000. Coal combustion in O2/CO2 mixtures compared with air, Canadian
Journal of Engineering, 78, 402-407.
Davison J, 2007. Performance and costs of power plants with capture and storage of CO2, Energy 32,
1163-1176.
DOE/NETL, 2007. Cost and Performance Baseline for Fossil Energy Plants, Volume 1: Bituminous Coal
and Natural Gas to Electricity, Final report.
Dooley JJ, Davidson CL, Dahowski RT, 2009. An Assessment of the Commercial Availability of Carbon
Dioxide Capture and Storage Technologies as of June 2009, US Department of Energy.
Figueroa JD, Fout T, Plasynski S, McIlvried H, Srivastava RD, 2008. Advences in CO 2 capture
technology-The US Department of Energy’s Carbon Sequestration Program, International Journal
of Greenhouse Gas Control, vol. 2 pt 1, pp. 9-20.
Hong J, Chaudhry G, Brisson JG, Field R, Gazzino M, Ghoniem AF, 2009. Analysis of oxy-fuel
combustion power cycle utilizing a pressurized coal combustor, Energy, 34(9): 1332-1340.
IEA GHG, 2007. Capturing CO2, Report 2007/5.
IEA GHG, 2009. Safety in Carbon Dioxide Capture, Transport and Storage, Report 2009/6
IPCC, 2005. Special Report on Carbon Dioxide Capture and Storage, Cambridge University Press, New
York.
Jordal K, Anheden M, Yan J, Strömberg L, 2004. Oxyfuel Combustion For Coal-Fired Power Generation
With CO2 Capture – Opportunities And Challenges, Proceedings of the 7th International conference
on Greenhouse Gas Control Technologies.
Kanniche M, Gros-Bonnivard R, Jaud P, Valle-Marcos J, 2009. Comparative Study of CO2 Capture in
the French Context, GHGT –9, Energy Procedia 1, pp. 4103-4110.
Knudsen JN, Jensen JN, Vilhelmsen PJ, Biede O, 2009. Experience with CO2 capture from coal flue gas
in pilot-scale: testing of different amine solvents, Energy Procedia 1 783-790.
Mahgerefteh H, Fairweather M, Bilio M, Brown S, 2009. CO2 Pipelines Material and Safety
Considerations, presented at Hazards XXI.
Nord LO, Anantharaman R, Bolland O, 2009. Design and off-design of a pre-combustion CO2 capture
process in a natural gas combined cycle power plant, International Journal of Greenhouse Gas
Control 3, 385-392.
SFA, 2002. Process Screening Analysis of Alternative Gas Treating and Sulfur Removal for Gasification.
Shenyang, 2010. Data from Shenyang High Technical Import & Export Co. Ltd.
Steeneveldt R, Berger B, Torp TA, 2006. CO2 capture and storage, closing the knowing-doing gap,
Chemical Engineering Research and Design, vol 84 pt 9, pp 739-763.
Tan Y, Douglas MA, Croiset E, Thambimuthu K, 2002. CO2 capture using oxygen enhanced combustion
strategies for natural gas power plants, Fuel, 81, 1007-1016.
283
Wacker H, 2009. Innovative and proven CO2 compression technology for CCS and EOR, SOGAT 2009,
Abu Dhabi.
Wall TF, 2007. Combustion processes for carbon capture, Proceedings of the Combustion Institute
31.
WRI, 2008. World resources Institute, CCS guidelines, Guidelines for Carbon Dioxide Capture,
Transport and Storage, www.wri.org (10/02/2012).
Wu S, Kukoski A, Jin P, Tigges KD, Klauke F, Bergins C, Kuhr C, Rehfeldt S, 2009. Development of
Oxyfuel Combustion Technology for Existing Power Plants, Hitachi Power Systems America, Ltd.
284
Acknowledgements
The Author gratefully acknowledges:

Lars Bodsberg, SINTEF Technology and society

Jonathan Buston, Health and Safety Laboratory

Laurence Cusco, Health and Safety Laboratory

Nicolas Dechy, Institut de Radioprotection et de Sûreté Nucléaire

Tor Olav Grøtan, SINTEF Technology and society

Knut Øien, SINTEF Technology and society

Ernesto Salzano, Istituto di Ricerche sulla Combustione, CNR di Napoli

Mike Wardman, Health and Safety Laboratory

Jill Wilday, Health and Safety Laboratory
285
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement