QRA Modelling of Domino Effects for Onshore Process Plants
Updated: Jun 12, 2023
In this article:
SEVESO II Directive states that domino effects shall be considered for the onshore process industry, but the level of required detail has not been specified. the modelling of domino effects is often only discussed qualitatively in risk assessments for onshore process plants. Such an approach leads to subjective assessments that are highly dependent on simplified assumptions, leading to results that may be questionable and difficult for external parties to validate (e.g. authorities).
Often, the focus of QRAs of onshore process plants is to assess the risk to 3rd parties (civilians) located outside the boundary of the process plant, the industrial park, or the area. It is important to note that a plant that may not be categorized as a major accident plant based on SEVESO directive, due to limited hazardous inventories, etc., or may not have any consequence potential of its own that can reach 3rd parties, may still be able to impact 3rd parties through domino effects. This illustrates the importance of considering domino effects in QRA modelling and also for plants that at first sight are not considered a "SEVESO" plant. In many cases, domino effects can become a significant factor or even dominating factor for the overall risk of a plant especially when discussing the risk to 3rd parties.
It would be preferable to model domino effects quantitatively for onshore process plants as part of the general QRA modelling and there is in principle nothing preventing this approach in onshore QRAs. This article aims to outline a procedure including 7 steps for how to evaluate domino effects in relation to a QRA for an onshore process plant.
What is a domino effect?
The initial consequences from a loss of containment (LoC) accident can sometimes escalate into a significantly larger accident with much more severe consequences through so-called domino effects.
After the initial or immediate consequences of a LoC accident have occurred (primary event), there is a risk of surrounding equipment being damaged due to exposure to physical effects of the primary event (e.g. heat radiation or blast pressure), which in turn can cause secondary or tertiary events. This phenomenon is known as a domino effect. If the secondary and tertiary events lead to more severe consequences than the consequences of the primary event alone then an escalation of the accident has occurred. The physical effects of the primary event from an LoC that can cause domino effects are normally:
Heat radiation levels from jet and pool fires;
Blast pressure from an explosion or BLEVE;
Flying fragments from an explosion or BLEVE.
Note: BLEVE is in itself normally a domino effect of an initial fire that again can lead to further domino effects.
Domino effects can be divided into direct and indirect escalation. Direct escalation is caused by immediate exposure to physical effects (e.g. heat radiation or blast pressure). Indirect escalation is more subtle and may occur if for example the control room is damaged leading to the malfunctioning of a system or operators misreading system information, which in turn may lead to a secondary accident.
Modelling the domino effect for onshore plants
For evaluating domino effects in relation to a QRA for an onshore process plant the following scenarios need to be considered:
Primary accident scenarios within the plant which may impact other parts of the plant itself leading to an escalation in consequences;
Primary accident scenarios within the plant which may impact other neighboring plants operated by others (if present) which could lead to an escalation of consequences;
Primary accident scenarios within neighboring plants operated by others (if present) may impact the process plant which could lead to an escalation of consequences.
From the above, it is evident that modelling domino effects correctly can potentially involve multiple stakeholders if e.g. the specific process plant is part of an industrial park or an area with several hazardous plants operated by different parties.
To quantify the risk of domino effects it is in principle necessary to go through the 7 steps discussed below in the general case. However, in many cases a process plant may be isolated from other plants and the procedure becomes more simple.
Step 1
Assuming the focus of the QRA is risk to 3rd parties and risk to 1st and 2nd parties is not part of the QRA, then the first step in assessing the risk of domino effects is to get an overview of all process systems on the industrial site which upon loss of containment can impact 3rd party personnel e.g. an outdoor toxic chemical storage tank on a neighboring site and an LPG storage tank on the plant in question, etc.
A multidiscipline HAZID workshop is a good tool for establishing a list of potential escalation targets and hazardous accident scenarios that potentially can cause the failure of escalation targets. Unfortunately, the recording of many HAZIDs often stops after identifying the primary event. Where domino effects can be of importance the secondary and tertiary events must be captured on the HAZID as well. Another complication is that it may be necessary to involve stakeholders from neighboring plants in the HAZID to capture domino effects between plants.
Step 2
The second step is to determine what accidental loads the critical escalation targets identified in step 1 (escalation targets both within specific plant boundary and in the neighboring surroundings) can withstand both blast loads and heat radiation level/duration.
Step 3
The third step is to determine what consequences (e.g. heat radiation levels and duration, or blast loads) our plant can expose the identified escalation targets in step 1 to. The frequencies of all accidental scenarios potentially causing the failure of critical escalation targets should be established.
Step 4
In Step 4, step 3 should be repeated, but this time it is scenarios from the neighboring plants that can cause the failure of escalation targets in our specific plant that needs to be established.
Step 5
In Step 5, the QRA of the process plant being investigated (our plant), should be updated to include the failure frequency of escalation targets within the plant due to domino effects (both from the plant itself and neighbors) in addition to the normal generic failure frequency of the equipment.
Step 6
In Step 6, QRAs of neighboring plants should be updated to consider the domino effects from our plant in a similar way as done for the specific plant in Step 5. This is only necessary if the domino effect increases the accident frequency of major accident hazards already considered in the QRA in a way that impacts the risk to 3rd party. If the frequency of the domino effect is significantly lower than the original accident frequency before considering the domino effect then the domino effect can't be ignored in the QRA. Domino effect frequencies of <10-8 per year can normally be disregarded but in many cases, the significantly higher frequencies can be used as cut-offs depending on the specific circumstances.
Step 7
In Step 7 the combined risk picture of all of the plants in the area should be calculated to see the combined effect on 3rd parties. This is normally done with Individual Risk (IR) iso contours and F-N curves.
If the risk levels after step 7 are acceptable then everything is fine otherwise it will be required to reduce the risk of scenarios causing the problems. If a high risk is caused by domino effects, risk reduction could involve increasing safety distances, strengthening the design (increasing design accidental loads) of escalation targets, or implementing mitigation in the form of fire and blast walls, etc.
Conclusion
It is clear from the above that it can be very difficult to include domino effects in QRA in a sound and objective way especially as it may involve multiple stakeholders with different interests. However, it also clearly illustrates why it is expected that a qualitative evaluation may fall short in many cases and in these cases, it is recommended to take the above approach.
The situation becomes much simpler if only a single plant is involved or escalation between neighboring plants can be ruled out due to distance or other reasons. Also, domino effects with very low frequencies e.g. <10-8 per year may be disregarded from the analysis as a practical simplification.
The above procedure would still be relevant if assessing risk to 1st and 2nd parties inside the industrial site is the purpose. But in this case, significantly more escalation targets likely become relevant complicating the analysis further.
