This action might not be possible to undo. Are you sure you want to continue?

**Quantitative risk analysis of oil storage facilities in seismic areas
**

Giovanni Fabbrocino

a

, Iunio Iervolino

a

, Francesca Orlando

b

, Ernesto Salzano

c,∗

a

Dipartimento di Analisi e Progettazione Strutturale, Universit ` a di Napoli “Federico II”, Via Claudio 21, Napoli 80125, Italy

b

Dipartimento di Ingegneria Chimica, Universit ` a di Napoli “Federico II”, P.le Tecchio 80, Napoli 80125, Italy

c

Istituto di Ricerche sulla Combustione, Consiglio Nazionale delle Ricerche, Via Diocleziano 328, Napoli 80124, Italy

Received 22 October 2004; received in revised form 23 April 2005; accepted 25 April 2005

Available online 23 May 2005

Abstract

Quantitative risk analysis (QRA) of industrial facilities has to take into account multiple hazards threatening critical equipment. Nevertheless,

engineering procedures able to evaluate quantitatively the effect of seismic action are not well established. Indeed, relevant industrial accidents

may be triggered by loss of containment following ground shaking or other relevant natural hazards, either directly or through cascade effects

(‘domino effects’).

The issue of integrating structural seismic risk into quantitative probabilistic seismic risk analysis (QpsRA) is addressed in this paper

by a representative study case regarding an oil storage plant with a number of atmospheric steel tanks containing ﬂammable substances.

Empirical seismic fragility curves and probit functions, properly deﬁned both for building-like and non building-like industrial components,

have been crossed with outcomes of probabilistic seismic hazard analysis (PSHA) for a test site located in south Italy. Once the seismic

failure probabilities have been quantiﬁed, consequence analysis has been performed for those events which may be triggered by the loss of

containment following seismic action. Results are combined by means of a speciﬁc developed code in terms of local risk contour plots, i.e. the

contour line for the probability of fatal injures at any point (x, y) in the analysed area. Finally, a comparison with QRAobtained by considering

only process-related top events is reported for reference.

© 2005 Elsevier B.V. All rights reserved.

Keywords: Earthquake; Seismic risk; Industrial risk; Quantitative risk analysis; Multi-hazard

1. Introduction

Large part of European territory is affected by signiﬁcant

seismic hazard. On the other hand, industrial installations

require mandatory risk assessment and development of

preventive and protective actions [1]. Nevertheless, when

industrial facilities and in particular chemical, petrochemical

and oil processing industries are concerned, interaction

of the earthquake with equipment may trigger relevant

accidents resulting in release of hazardous materials (ﬁres,

explosions), injuring people and increasing the overall

damage to nearby area, either directly or through cascade

effects (‘domino effects’).

As a consequence, quantitative risk analysis (QRA) of

industrial facilities has to take properly account of multiple

∗

Corresponding author. Tel.: +39 081 7621922; fax: +39 081 7622915.

E-mail address: salzano@irc.cnr.it (E. Salzano).

hazards threatening critical equipments, which can possibly

lead to catastrophic accidents.

Despite these considerations, engineering procedures

to evaluate quantitatively the effects of seismic action

on equipment are not well established, even if a large

research effort has been undertaken to develop effective

and sustainable, at least from a computational viewpoint,

seismic reliability procedures [2] and qualitative aspects of

the relationship between natural and technological disaster

have been recently analysed by joint activities by European

Commission DG Joint Research Centre, Institute for the

Protection and Security of the Citizen (DG JRC) and United

Nations International Strategy for Disaster Reduction

(ISDR) [3].

In this paper, empirical seismic fragility curves and probit

functions deﬁned for both building-like and non building-

like industrial equipment, have been crossed with outcomes

of probabilistic seismic hazard analysis for a test site located

0304-3894/$ – see front matter © 2005 Elsevier B.V. All rights reserved.

doi:10.1016/j.jhazmat.2005.04.015

62 G. Fabbrocino et al. / Journal of Hazardous Materials A123 (2005) 61–69

in south Italy. Once the seismic failure probabilities have

been quantiﬁed, consequence analysis has been performed

for those events which may be triggered by the loss of con-

tainment following seismic action. Results have been then

combined by means of a speciﬁc developed code in terms of

local risk contour plots, i.e. the probability of fatal injures at

any point (x, y) in the analysed area. In order to better point

out the role of seismic hazard in industrial risk, the sole earth-

quake is then ﬁrst assumed as triggering event. Hence, purely

process-related “top events” are ﬁrst excluded. Acomparison

with classical process-related quantitative risk analysis out-

comes is then reported for reference, in order to show the

relevance of seismic effects on risk indexes.

2. Seismic risk analysis of industrial components

Quantitative probabilistic seismic risk analysis (QpsRA)

requires the evaluation of collapse probability of critical com-

ponents and, subsequently, the analysis of phenomena trig-

gered by loss of hazardous materials.

On the structural side, convolution of site’s seismic haz-

ard and vulnerability of each component leads to the collapse

probability P

f

(failure probability), which is the probability

of the seismic capacity C being exceeded by the seismic de-

mand D, integrated over all the possible values of the ground

motion intensity measure (IM) (i.e. peak ground acceleration

or PGA) [4].

P

f

=

∞

0

d (Pr[D > C]) =

∞

0

[1 −F

D

(u)]f

C

(u) du (1)

In Eq. (1), F

D

is the cumulative probability distribution of

the seismic performance demand for a given ground motion

intensity, and f

C

is the probabilistic density function of the

seismic capacity of the structure/component. More explicitly,

by probability algebra: the event of collapsing due to seismic

action may be represented as the union of mutually exclusive

events each of those representing component’s collapse when

a given level of seismic intensity occurs.

Collapse =

∞

¸

i=1

{Collapse ∩ IM

i

} (2)

Events in Eq. (2) are mutually exclusive since collapse cannot

take place for a givenIM=IM

i

if another value alreadyhas led

the system to failure, therefore failure probability is given by

the sum of the probabilities of the elementary events deﬁned.

In other terms, by total probability theorem, P

f

is given by

the probability of the system failing for all possible values of

seismic intensity (IM) combined with the probability of the

latter occurring, therefore one can write:

P

f

=

¸

All im

∗

P

¸

D > C|IM = im

∗

¸

P

¸

IM = im

∗

¸

(3)

Finally, structural seismic risk is the convolution of

P[D>C|IM=im

∗

] (commonly referred as fragility curve,

function of im

∗

) and P[IM=im

∗

] which is the seismic hazard

curve, the outcome of probabilistic seismic hazard analysis

[5,6].

Here it is worth noticing that the structural failure

P[C>D|IM] in Eq. (3) does not depend on other earthquake

characteristic such as magnitude or source-to-site distance,

as this happens when IM is “sufﬁcient”, e.g. has a exhaustive

explanatory power on the structural response. The topic of

sufﬁcient intensity measures for seismic risk assessment of

structures is wide and is detailed elsewhere. For reviews, see

[7,8].

According to this procedure, seismic risk has been carried

out for all structures in the plant, therefore seismic hazard

analysis has been required to get the occurrence probability

P[IM=im

∗

] in terms of the same intensity measure used to

describe the seismic vulnerability of the component in ques-

tion. Peak ground acceleration (PGA) has been considered

as the ground motion intensity measure (IM) due to the na-

ture of the damage database used. Further details may be

found elsewhere [9]. In the following sub-sections, proba-

bilistic seismic hazard analysis and vulnerability review are

presented.

2.1. Seismic hazard

Measured ground motions refer to seismic waves radiat-

ing from the earthquake focus to the site and can be related

to three types of mechanisms that interact to generate the

actual signal: source, path and site. Efﬁcient ground motion

intensity measures for engineering applications should be

strongly correlated with structural seismic response. These

parameters summarize all the random features of earth-

quakes, including energy, frequency contents, phases and

others which may affect the structural response of structures.

Currently, the problem of deﬁnition of good predictors for

inelastic seismic behaviour of structures is one of the main

topics of earthquake engineering. However, empirical vulner-

ability analyses are often carried out in terms of peak ground

acceleration, mainly because it is relatively easy to infer (i.e.

by earthquake intensity conversion) while others intensity

measures (as ﬁrst-mode spectral acceleration) may not be

available at the site for post-earthquake damage observation.

Probabilistic seismic hazard analysis is represented by Eq.

(4) where the integral, computed for each possible realization

(pga

∗

) of PGAgives a point of the hazard curve. For the study

case discussed herein PSHA has been then carried out by a

speciﬁcally developed code [10], referring to the Sabetta and

Pugliese [11] ground motion attenuation relationship, for the

site of Altavilla Irpinia (AV—southern Italy) where the plant

is assumed to be located (Fig. 2).

P[PGA > pga

∗

]

=

m,r,ε

P [PGA > pga

∗

|M = m, R = r, E = ε]

×f

M,R,E

(m, r, ε) dmdr dε (4)

G. Fabbrocino et al. / Journal of Hazardous Materials A123 (2005) 61–69 63

In Eq. (4), according to PSHA, IM (e.g. PGA) exceedance

probability is given by integration of probability contribution

of magnitude (M), distance (R) and attenuation relationship

“residuals” (E). The term f

M,R,E

(m, r, ) is their joint proba-

bility density function (PDF).

In Fig. 2, two time intervals are reported: 1 year, which

has been utilized in the present study because the resulting

risk indexes are calculated over 1 year, and 50 years basis,

which is the reference curve for structural design purposes

(Technical Service Life, TSL).

On this subject, it is worth noting that from a structural

standpoint, many industrial and tertiary installations are char-

acterized by speciﬁc design requirements and can become

suddenly obsolete. Thus in many cases, the design reference

period is called functional service life (FSL), which is gen-

erally lower than TSL [12].

Quite obviously, any other application should proceed in

the same way by changing only the probabilistic characteri-

zation of the seismicity of the site of interest.

2.2. Vulnerability: statistical inference of earthquake

damage

All typical accidental scenarios in the process industry

(vapour cloud explosions, ﬂash ﬁres, tank and pool ﬁres or

toxic dispersions) depend on the total amount of released

dangerous substance [13–15]. Accordingly, a quantitative

probabilistic seismic risk analysis should deﬁne seismic

vulnerability in terms of structural limit states of interest for

content release. Therefore, existing data concerning post-

earthquake damage observations for steel tanks have been

reviewed in order to optimize the limit state classiﬁcations of

equipment response [16]. In fact, according to HAZUS dam-

age state list [17], the effects of seismic actions have been

related to structural damage and its reparability (DS, damage

state). When QpsRA (or QRA) are concerned, this concept

is less signiﬁcant than “loss of containment”; the latter is

related to DS, but can be actually considered as a different

and speciﬁc limit state. More in detail, ﬁve degrees of me-

chanical damage DS [18,19] have been reviewed to set three

levels of intensity of loss of containment, deﬁned as RS (risk

state): no loss—RS1; moderate loss—RS2; extensive loss of

containment—RS3.

The RS states have been deﬁned in order to describe the

seismic behaviour of storage tank with reference to the acci-

dental scenarios which can possibly followthe seismic struc-

tural damage of the tank. Because of incomplete descriptions

of the actual damage to some tanks into empirical database

considered, the deﬁnition of damage state DS and/or RS is

somehow left to judgment.

The probability of occurrence of any limit state has been

then assessed by means of fragility curves, starting from a

consistent historical data set describing the behaviour of tank

subjected to earthquakes:

Fragility = Pr [material release|PGA]

= Pr [RS|PGA] = f(PGA) (5)

Table 1

Seismic fragility and probit coefﬁcients for anchored atmospheric steel tanks

Limit state (RS) Fill level µ (g) β (g) k

1

k

2

≥2 Near full 0.30 0.60 7.00 1.67

3 Near full 1.25 0.65 4.65 1.54

≥2 ≥50% 0.71 0.80 5.43 1.25

3 ≥50% 3.72 0.80 3.33 1.25

In Eq. (5), PGA is the realization of the seismic intensity

(IM) that is assumed to trigger the failure corresponding to

the pre-assigned limit state.

Experimental log-normal fragility curves for steel storage

tanks can be easily converted in the linear probit function Y,

commonly used as input for the QRA consequence analysis

and codes. The probit function allows simple recognition of

hazard by means of the following equation

Y = k

1

+k

2

ln(PGA) (6)

where PGA is expressed in terms of g, the gravity accelera-

tion. The function Y is correlated to the classical probability

of occurrence by means of the following integral function

[20]:

P

RS,DS

=

Y

RS

−∞

[exp (−0.5u

2

)] du (7)

Numerical or graphical solution of this integral is reported

in the literature. Details of the entire statistical procedure

are reported elsewhere [13,16,21]. Tables 1 and 2 report

the coefﬁcient for fragility and probit for every RS level,

for different tank levels, for either unanchored atmospheric

storage tank or anchored storage tank, as resulted from a

speciﬁc statistical analysis based on consistent number of

data reported in the literature (see [16] for more details and

for the deﬁnition of probit function for DS limit states).

The minimum threshold value of PGA for loss of contain-

ment differs greatly from the anchored and unanchored and

changes with ﬁll level. The absolute minimum is reached for

50% ﬁlled unanchored storage tank, which can be consid-

ered as the safe side option for QpsRA when few informa-

tion on the type of foundation of tank or on the ﬁll level,

which possibly varies with time, are available. Probit co-

efﬁcients have been used for the quantitative risk analysis

of fuel storage plant reported in Fig. 1. Speciﬁcally, likeli-

hood of RS2 and RS3 occurring have been obtained calculat-

ing, for any PGA of the hazard curve reported in Fig. 2, the

Table 2

Seismic fragility and probit coefﬁcients for unanchored atmospheric steel

tanks

Limit state (RS) Fill level µ (g) β (g) k

1

k

2

≥2 Near full 0.15 0.70 7.83 1.43

3 Near full 0.68 0.75 5.53 1.34

≥2 ≥50% 0.15 0.12 20.82 8.35

3 ≥50% 1.06 0.80 4.93 1.25

64 G. Fabbrocino et al. / Journal of Hazardous Materials A123 (2005) 61–69

Fig. 1. The analysed storage tank. Total surface: 30,000 m

2

. Total fuel capacity 60,000 m

3

.

corresponding probability of loss of containment (by means

of data reported in Tables 1 and 2). Results for the combi-

nation of fragility curves and RS probability, are reported in

Fig. 3.

Furthermore, as mentioned in previous sections, other than

non building-like structures (tanks), the buildings in the stor-

age area have been considered in the analysis because their

collapse may lead to catastrophic consequences as well if

there is occupancy at the time of the earthquake. Consistently

to what is done for tanks, fragility and probit functions for

buildings have been obtained on empirical basis. In Table 4

probit coefﬁcients derived from Rossetto and Elnashai [22]

vulnerability data are reported, as expressed in terms of PGA,

the latest expressed in g.

It is worth noting that seismic vulnerability of building in

QpsRAshould also considered whether automatic safety sys-

tems are sheltered in ordinary structure, since their collapse

affects the response of the system to the industrial accident.

3. The storage installation

The risk analysis reported in this work refers to a storage

facility composed by a number of atmospheric steel tanks

containing ﬂammable substances (Fig. 1). The plant is as-

sumedtobe locatedinthe Irpinia area, southernItaly, whichis

characterizedbyconsiderable seismic hazardaccordingtothe

national classiﬁcation issued by Italian Seismic Survey [23].

Fig. 2. Hazard curves at the test site. Time interval: () 50 years; (×) 1 year.

G. Fabbrocino et al. / Journal of Hazardous Materials A123 (2005) 61–69 65

Fig. 3. Fragility curves used in this study for anchored storage tanks. ()

RS≥2, near full; () RS=3, near full; () RS≥2, ﬁll ≥50%; (♦) RS=3, ﬁll

level ≥50%. Failure probability is expressed in terms of annual probability.

Table 3

Legend and description of the main buildings and fuels stored in the oil plant

Legend Item Roof Total tank

capacity (m

3

)

A Gasoline, light gasoline,

T

fp

<21

◦

C

Floating 20,000

B Kerosene, fuel oil,

21

◦

C<T

fp

<65

◦

C

Fixed 30,000

C Diesel oil, fuel oil, T

fp

>65

◦

C Fixed 13,000

D Loading point, tank truck –

E Loading point, rail tank –

F Ofﬁce building –

G Ofﬁce building –

H Building –

T

fp

is the ﬂash point.

The layout, the separation distances and the classiﬁca-

tion of storage tanks are designed in agreement with main

Italian and International guidelines [24–28]. Control room

is installed in the basement of building identiﬁed by letter

“F” in Fig. 1A national road and a railway track are close to

the border of the installations. The surroundings are basically

unpopulated, since the plant is located in a rural area.

All storage tanks are assumed as anchored, since it is the

most common solution adopted for this kind of structures

located in seismic areas [19]. Seismic design of tanks was

based on international construction standards adopted both

for water and oil storage on-grade steel tanks [29,30]. Table 3

reports further details on the stored fuel and constructions.

Building-like structures in the plant are reinforced con-

crete, low-rise constructions. Their seismic vulnerabilities

have also been taken into account, since collapse may be

not negligible in computing risk of death or injuries.

4. Quantitative probabilistic seismic risk analysis

Quantitative risk analysis supports risk management and

decision-making by identifying accidental scenarios and by

ranking these scenarios according to their probability of oc-

currence [31]. Speciﬁcally, QRA analyses the system as an

integrated socio-technical system: hundreds of sequences

are analysed in contrast with the relatively small number of

design-basis accident in conventional analysis. As a conse-

quence, several simplifying assumptions are often necessary,

and comparisons with levels of risk acceptability are only

possible if consolidated choices for evaluation of scenarios

and consequence analyses are used.

Typical measures for probabilistic analysis of industrial

risks include “local risk” assessment and “societal risk” as-

sessment, i.e. the relationship between the number of fatali-

ties Nand the cumulative frequency F at which the number N

or more fatalities are predicted to occur [32–34]. Here, local

risk is intended as the annual probability of fatal injuries at

any point (x, y) within the analysed area, without taking into

account the probability of presence of human in the same

area. For the aims of the paper we have shown local risk in

terms of iso-contour. Details about consequence analysis car-

ried out in the proposed test case are reported in the following

sections.

4.1. Consequence analysis

For the aims of quantitative risk analysis, the evaluation

of scenarios are carried out depending on assumptions made

in compliance with well-established methodologies and/or

guidelines [13–15,35–37].

Dispersion analysis has been carried out starting from

extensive loss (RS3) or moderate leak (RS2) from any of

the storage tanks. Typical atmospheric conditions, keeping

into account the climate of south Italy, have been considered

(T

amb

=20

◦

C). Gasoline, kerosene, diesel oil and fuel oil also

have typical chemical composition [38]. Gasoline gives the

main contribution to ﬂash ﬁre and vapour cloud explosion

(VCE) risks, for the relatively higher volatility, even if VCE

is unlikely, also for the geometric characteristic of industrial

area which is relatively un-congested. The uniﬁed dispersion

model (UDM) implemented in the PHAST [39] package has

been adopted. The package includes the prediction of the

time-varying releases from tanks, to be used as source term

for dispersion analysis, i.e. the temporal evolution of the leak

from the damaged tanks, the subsequent formation of pool

(for the RS2 case a leak surface with a diameter of 0.1 m

has been assumed) and the evaporation rate from the surface

of pool which is formed in the catch basin. The dispersion

analysis has been performed for two atmospheric stability

classes (F2 and D5), assumed to be representative. Also, a

four-sector wind rose assuming equal probability either for

sectors or for the two atmospheric classes has been used.

For the aims of this analysis, only loss of life has been

evaluated and reported, for any scenario, but the risk of any

kind of damage (to the human being, e.g. irreversible damage)

can be easily assessed by introducing speciﬁc vulnerability

functions.

The evaluation of consequences of ﬂash ﬁre, vapour cloud

explosion and ﬁres has been performed assuming the max-

imum predicted amount of vapour within the ﬂammability

66 G. Fabbrocino et al. / Journal of Hazardous Materials A123 (2005) 61–69

limits, for the entire history of dispersion. To this regard, it is

assumed that QRA has to be always as conservative as pos-

sible, whatever the ﬁnality of the assessment: “worst case”

should always be considered when uncertainties are faced,

aiming at deterministic assessment even in the framework of

probabilistic safety assessment. This approach is particularly

effective when late or early ignition assumption has to be

considered. Indeed, it strongly affects the results of QRA be-

cause the amount of ﬂammable vapour can possibly increase

as the time before ignition is longer, at least for continuous

release of vapour frompools. Moreover, intensity of loss (the

RS2 and RS3 limit states) certainly inﬂuences the pool for-

mation and the subsequent vapour dispersion. Eventually, it

has been assumed that late ignition occurs in any case, i.e. the

maximum amount of ﬂammable vapour is considered, thus

working on the “safe side”. Conversely, ignition probabilities

for ﬂash ﬁre or vapour cloud explosion has been set, respec-

tively, to 0.03 and 0.08 of the total probability of RS2 or RS3

occurrences, after Cox et al. [40]. However, a very low prob-

ability of ignition (1 ×10

−6

per loss) has been used for the

ignition probability of diesel oil and heavy fuel oil (class C

fuels), considering their high ﬂash point and the presence of

emergency interventions.

The mass of ﬂammable vapour between the lower and up-

per ﬂammability limits (LFL, UFL) has been used for evaluat-

ing the ﬁeld of overpressure due to vapour cloud explosion by

means of the multi-energy method (MEM) [41,42], through

the total combustion energy. An “average” strength factor

(F=5) has been used even if low congestion environment

characterizes the storage plant (with typical strength factor

between 2 and 5), again aiming at retaining the safe side.

Finally, the PHAST code has been used for the prediction

of evolution of smoky pool ﬁres, which relates on the well-

assessed model of Thomas [43], Burgess and Hertzberg [44],

Mudan and Croce [45] and Cook et al. [46], for the pool ﬁre

burn rate, for the ﬂame shape frompool and for the evaluation

of radiation from pool ﬂames, respectively.

For the evaluation of consequences of ﬂash ﬁre, the typ-

ical cut-off criterion of lower ﬂammability limit (LFL) has

been used: any person within the cloud identiﬁed by the LFL

border is in fact dead. In the other cases, the vulnerability of

individuals exposed to explosion or pool ﬁre, has been evalu-

ated by probit functions, respectively, for the peak overpres-

sure and heat exposure, as given in Lees [13] and Crowl and

Louvar [47]. For what concerns the time of exposure to heat

t

h

, a total duration of 60 s is considered. For the sake of sim-

plicity, for each source (i.e. failure of tank in catch basin),

the effects of explosions, ﬂash ﬁres or pool ﬁres on human

being have been considered mutually exclusive at any point:

the maximum effect addresses also the probability of occur-

rence of the accidental scenario. This assumption is valid for

the effects of ﬂash ﬁre, which are certainly superimposed

to other effects over the LFL threshold distance; on the other

hand, beyond LFL distance, i.e. in the far ﬁeld, it is likely that

blast wave is the only effect. Finally, if ﬂash ﬁre or vapour

cloud are not possible for the low volatility of components,

the only possible scenario is the pool ﬁre, which is then pre-

ponderant in the near ﬁeld. The assumption of exclusivity

should be obviously to be re-considered in the case of toxic

dispersion, which is not the case of this study. Domino effects

have been considered only for tanks located in the same catch

basin.

Fig. 4. Local risk RI (year

−1

) for the fuel storage plant as obtained by QpsRA.

G. Fabbrocino et al. / Journal of Hazardous Materials A123 (2005) 61–69 67

Table 4

Seismic fragility and probit coefﬁcients for buildings located in the plant

area

Limit state Collapse

Building F, G, H

k

1

35.20

k

2

3.98

The collapse of buildings due to earthquake has also been

assessed in this analysis, by using probit models reported

in Table 4. In the case of individuals located in the interior

of buildings, the effects of ﬂash ﬁre, pool ﬁre or explosion

are null unless the blast overpressure is able to damage the

building itself (peak overpressure greater than 0.3 bar).

4.2. Results: seismic risk indexes

For the purpose of the quantitative seismic risk analysis, a

speciﬁc ANSI C code has been developed, starting from the

statistic functions and plant information given above. The

numerical layout covers 400 m×400 m and it has been dis-

cretized by 1 m

2

cells.

The local risk has been calculated by using the classical

relation:

RI(x, y) =

¸

i

¸

¸

RS

¸

P

f|RS,i

p(e|i)p(c|e)p

i

¸

¸

(8)

In Eq. (8), index i refers to the accidental scenarios derived for

the interaction of any earthquake with its related probability

with the storage tank resulting in any intensity of loss of

containment deﬁned by RS(P

f|RS

), p(e|i) is the probability

that the ith scenario propagates from the catch basin to the

location x, y in terms of physical effect (e), i.e. overpressure

(vapour cloud explosion) or heat radiation (pool ﬁre, ﬂash

ﬁre), for the toxic dispersion being excluded in the case of fuel

storage areas here analysed. The same term p(e|i) contains

also all the information on the environmental condition (wind

sector probability, atmospheric stability class), and on the

ignition probability. The term p(c|e) refers to the probability

that the physical effect (e) produces the effect (c), mortality

in the case of this analysis, assuming the constant presence of

the individuals in the x, y location. Finally, the term p

i

refers

to the mitigation provided by the mitigation effects provided

by indoor location of individuals.

Results of the calculation obtained by the entire set of

assumption are reported in Fig. 4 in terms of map of local risk

RI as previously deﬁned, but only related to the accidental

scenarios following earthquakes. Fig. 4 shows that local risk

is relatively high only at the upper border wall of the storage

plant, even if the analysis has been performed according

to conservative assumptions for consequence analysis,

with limited use of “event tree”. To this regard, the main

contribution to the high level of risk is due to ﬂash ﬁre, which

is mainly related to the conservative assumption of late

ignition.

Results of Fig. 4 have to be compared with acceptance

criteria. To this aim, several thresholds values have been

identiﬁed in many countries but, quite obviously, no one

represents a universal rule. Here, we only report the reference

given by HSE in UK [48,49], which reports a threshold value

of 10

−3

/year for workers and 10

−4

/year for public (see also

ALARP, As Low As Reasonable Practical, limits). These

values are essentially not overtaken in the industrial area

if pool basin (which are very rarely travelled by workers))

are excluded. It is also worth mentioning the very high

seismicity of the industrial location.

4.3. Results: process-related risk indexes

The effectiveness of seismic action can be pointed out if

above results are compared with QRA performed by con-

sidering typical top events related to plant operation, thus

excluding earthquakes. Quite obviously, the accidental phe-

nomena are related to loss of containment also in the case of

process-related top events. Hence, the consequence analysis

and the related choices (e.g. ignition probabilities), and mod-

elling of accidental scenarios are analogous and not reported

here for the sake of brevity. The main differences are on the

typology of top event and related annual probability of occur-

rence. To this regard, the set of industrial accidents and failure

rate as listed or reported in Control of Major Accident Haz-

ards Regulations (COMAH, HSE, UK) [50], the well known

Yellow and Purple Books [36,37], Rijnmond Public Author-

ity [48], Lees [13], have been used for the process-related

QRA. Table 5 reports the most important events considered

in the QRA for storage tanks. Rare events (<10

−7

) or events

which are very unlikely to develop relevant accidental sce-

narios (e.g. leakage in small diameter or buried pipelines),

have been discarded.

Here, it is worth mentioning that Rijnmond Report con-

siders an earthquake annual occurrence of 10

−8

events/year.

Recombination of results is reported in Fig. 5 in terms of local

risk, to be compared with Fig. 4.

Comparison of QpsRA with standard QRA shows that,

at least for relatively low risk fuel storage tanks containing

mainlywithlowﬂammable substances suchas oil, andinhigh

seismicity areas, the seismic risks can prevail over the risk de-

rived from simple process and well controlled operations. To

Table 5

Some process and operational events considered for QRA in the storage

plant

Item Event Annual probability

of occurrence

Atmospheric storage

tank

Serious leakage 1.0 ×10

−4

Catastrophic rupture 6.0 ×10

−6

Overﬁlling 2.7 ×10

−6

Pump Catastrophic rupture 1.0 ×10

−4

Loading

arm

Serious leakage 3.0 ×10

−6

Catastrophic rupture 3.0 ×10

−8

Pipework >150 mm

Serious leakage 3.0 ×10

−9

/sector

Catastrophic rupture 1.0 ×10

−10

/sector

68 G. Fabbrocino et al. / Journal of Hazardous Materials A123 (2005) 61–69

Fig. 5. Local risk RI (year

−1

) for the fuel storage plant as obtained by process-related QRA.

this regard it should be noted that seismic action can strongly

affect building integrity, with the related high probability of

collapse. On the other hand, accidental scenarios produced

by loss of containment of low ﬂammable fuels from atmo-

spheric equipment can be destructive on building if vapour

cloud explosions, rather unlikely, occur. This assumption

fails when pressurised equipment or highly reactive fuels are

considered.

5. Conclusions

The case study presented shows how integration of seis-

mic risk assessment into quantitative risk analysis can be

effectively based on easy to manage statistical tools like

fragilities and probit functions. More speciﬁcally, QpsRA

may be successfully carried out if seismic fragility analyses

of critical components are developed in terms of limit states

that may trigger industrial accidents (i.e. hazardous materials

release).

Use of empirical vulnerability functions does not repre-

sent a limitation of the study; in fact, available numerical

procedures able to set reliable fragility functions (and probit

coefﬁcients) for industrial components need further develop-

ment to cover all the relevant failure modes of equipment.

Acknowledgements

Authors gratefully acknowledge the support received

fromthe National Group for the Defence against Earthquakes

(GNDT) within the research project “Reduction of Infras-

tructures and Environment Seismic Vulnerability” (VIA).

Project Coordinator: Prof. G.M. Calvi, Universit` a di Pavia.

Task Coordinator: Prof. G. Manfredi, Universit` a di Napoli

“Federico II”.

References

[1] Council Directive 96/82/EC of 9 December 1996 on the control of

major-accident hazards involving dangerous substances, Off. J. Eur.

Comm., L 10/13, Brussels.

[2] I. Iervolino, G. Fabbrocino, G. Manfredi, Fragility of standard indus-

trial structures by a response surface based method, J. Earth. Eng.

8 (6) (2004) 1–19.

[3] European Commission DG Joint Research Centre, Institute for the

Protection and Security of the Citizen (DG JRC), United Nations

International Strategy for Disaster Reduction (ISDR), On the col-

laboration agreement between the International Strategy for Disas-

ter Reduction of the United Nations and the Directorate General

Joint Research Center of the European Commission, Activities Re-

port 20ISDR, 2003. http://www.unisdr.org.

[4] C.A. Cornell, F. Jalayer, R.O. Hamburger, D.A. Foutch, The prob-

abilistic basis for the 2000 SAC/FEMA steel moment frame guide-

lines, J. Struct. Eng. 128 (4) (2002) 526–533.

[5] C.A. Cornell, Engineering seismic risk analysis, B. Seismol. Soc.

Am. 58 (1968) 1583–1606.

[6] R.K. McGuire, Probabilistic seismic hazard analysis and design

earthquakes: closing the loop, B. Seismol. Soc. Am. 85 (5) (1995)

1275–1284.

[7] C.A. Cornell, Hazard, Ground Motions and Probabilistic Assess-

ments for PBSD, PEER Report series 2004/2005, September 2005.

Berkeley, CA. http://peer.berkeley.edu.

[8] I. Iervolino, C.A. Cornell, Record selection for non-linear seismic

analysis of structures, earthquake spectra, EERI 21 (2005) 3.

G. Fabbrocino et al. / Journal of Hazardous Materials A123 (2005) 61–69 69

[9] I. Iervolino, Quantitative Seismic Risk Analysis in Process Industry,

Department of Structural Analysis and Design, University of Naples

Federico II, Ph.D. thesis in Seismic Risk, 2003.

[10] V. Convertito, Extension of classical attenuation laws: inﬂuence and

implications on the probabilistic seismic hazard analysis, Diparti-

mento di Analisi e Progettazione Strutturale, Universit` a di Napoli

“Federico II”, Ph.D. thesis, 2003.

[11] F. Sabetta, A. Pugliese, Attenuation of peak horizontal acceleration

and velocity from Italian strong-motion records, B. Seismol. Soc.

Am. 77 (1987) 1491–1513.

[12] ISO/TC 59/SC 14, Design life, Buildings and Constructed Assets

Service Life Planning. Part 1. General Principles. ISO 15686-1, 2000.

[13] F.P. Lees, Loss Prevention in the Process Industries, second ed.,

Butterworth-Heinemann, Oxford, 1996.

[14] Center for Chemical Process Safety (CCPS), Guidelines for chemical

process quantitative risk analysis, American Institute of Chemical

Engineers, New York, 2000.

[15] Center for Chemical Process Safety (CCPS), Guidelines for evaluat-

ing the characteristics of VCEs, Flash Fires and BLEVE’s, American

Institute of Chemical Engineers, New York, 1994.

[16] E. Salzano, I. Iervolino, G. Fabbrocino, Seismic risk of atmospheric

storage tanks in the framework of quantitative risk analysis, J. Loss

Prevent. Proc. 16 (2003) 403–409.

[17] HAZUS, Earthquake Loss Estimation Methodology, National Insti-

tute of Building Science, Risk Management Solutions, Menlo Park,

CA, USA, 1997.

[18] J.M. Eidinger, Earthquakeic fragility formulation for water systems,

ASCE-TCLEE (2001).

[19] M.J. O’Rourke, P. So, Seismic Fragility Curves for On-Grade Steel

Tanks, Earthquake Spectra, 16, NY, USA, 2000.

[20] D.J. Finney, Probit Analysis, Cambridge University Press, 1971.

[21] J.A. Vilchez, H. Montiel, J. Casal, J. Arnaldos, Analytical expression

for the calculation of damage percentage using the probit method-

ology, J. Loss Prevent. Proc. 14 (2001) 193–197.

[22] T. Rossetto, A. Elnashai, Derivation of vulnerability functions for

European-type RC structures based on observational data, Eng.

Struct. 25 (1) (2003) 1241–1263.

[23] Drafting of the seismic hazard map given by OPCM 3274 March

20, 2003. Final Report for the Civil Protection Department, INGV,

2004. In Italian.

[24] ER&E Design Practices, Safety in plant design, EXXON Engineer-

ing, 1982.

[25] AES-B-55, Plant layout, ARAMCO Engineering Standards, 1983.

[26] IRInformation IM.2.5.2, Plant layout and spacing for oil and chem-

ical plants, IRI, 1991.

[27] API RP 2001. Fire protection in reﬁneries, API, Washington, 1984.

[28] IP, Fire precautions at petroleum reﬁneries and bulk storage instal-

lations, John Wiley & Sons, 1993.

[29] API Standards 620, 650, and 653 Interpretations, API

850—American Petroleum Institute, Washington D.C., USA,

1997.

[30] AWWA D100-96—Welded Steel Tanks for Water Storage, American

Water Works Association, Denver, CO, USA, 1996.

[31] G.E. Apostolakis, Risk-informed decision making, in: European

Safety and Reliability Conference, plenary lecture, Maastricht (NL),

2003.

[32] R. Wilson, E.A.C. Crouch, Risk assessment and comparisons: an

introduction, Science 237 (1987) 267–290.

[33] D.A. Carter, I.L. Hirst, Worst case methodology for the initial as-

sessment of societal risk from proposed major accident installations,

J. Hazard. Mater. 71 (2000) 117–128.

[34] J.D. Balle, P. Floyd, Societal Risk, HSE Books, UK, 1998.

[35] Health and Safety Executive (HSE), Canvey: an investigation of po-

tential hazards from operations in the Canvey Island/Thurrock Area,

London, UK, 1978.

[36] C.J.H. Van Den Bosh, R.A.P.M. Weterings, Methods for the calcula-

tion of physical effects (Yellow Book), Committee for the Prevention

of Disasters, The Hague (NL), 1997.

[37] P.A.M. Uijt de Haag, B.J.M. Ale, Guidelines for Quantitative Risk

Assessment (Purple Book), Committee for the Prevention of Disas-

ters, The Hague (NL), 1999.

[38] Environmental Protection Agency, EPA, http://www.epa.org.

[39] PHAST code, DNV—Det Norske Veritas Limited, UK, 2004.

http://www.dnv.com.

[40] A.W. Cox, F.P. Lees, M.L. Ang, Classiﬁcation of Hazardous Loca-

tions, Institution of Chemical Engineering, Rugby, 1990.

[41] A.C. Van den Berg, The multi-energy method. A framework for

vapour cloud explosion blast prediction, J. Hazard. Mater. 12 (1985)

1–10.

[42] J.B.M.M. Eggen, GAME: Development of Guidance for the Appli-

cation of the Multi-Energy method, TNO-PML, 1995.

[43] P.H. Thomas, The size of ﬂames from natural ﬁres, in: 9th Proc.

Comb. Inst., The Combustion Institute, Pittsburgh, PA, 1963, pp.

844–859.

[44] D. Burgess, M. Hertzberg, Radiation from pool ﬂames, in: N.H.

Afgan, J.M. Beer (Eds.), Heat Transfer in Flames, 1974, Chapter

27.

[45] K.S. Mudan, P.A. Croce, Handbook of Fire Protection Engineering,

Society of Fire Protection Engineers, 1988.

[46] J. Cook, Z. Bahrami, R.J. Whitehouse, A comprehensive program

for calculation of ﬂame radiation levels, J. Loss Prevent. Proc. 3

(1990) 150–155.

[47] D.A. Crowl, J.F. Louvar, Chemical Process Safety: Fundamentals

with Applications, Prentice Hall, NJ, USA, 1990.

[48] Rijnmond Public Authority, Risk analysis of six potentially haz-

ardous industrial objects in the Rijnmond area, A Pilot Study, Redel,

Dordrecht, 1982.

[49] J.K. Vrijling, W. van Hengel, R.J. Houben, Acceptable risk as

a basis for design, Reliab. Eng. Syst. Safe. 59 (1998) 141–

150.

[50] Health & Safety Executive, A Guide to the Control of Major Acci-

dent Hazard Regulations, L111, HSE Books, 1999.

E = ε] (4) Finally. For the study case discussed herein PSHA has been then carried out by a speciﬁcally developed code [10].e. referring to the Sabetta and Pugliese [11] ground motion attenuation relationship. empirical vulnerability analyses are often carried out in terms of peak ground acceleration. frequency contents. has a exhaustive explanatory power on the structural response. i. 2).8]. Peak ground acceleration (PGA) has been considered as the ground motion intensity measure (IM) due to the nature of the damage database used. Hence. Further details may be found elsewhere [9]. In the following sub-sections. In other terms. including energy. computed for each possible realization (pga∗ ) of PGA gives a point of the hazard curve. P[PGA > pga∗ ] = m. Efﬁcient ground motion intensity measures for engineering applications should be strongly correlated with structural seismic response. probabilistic seismic hazard analysis and vulnerability review are presented. integrated over all the possible values of the ground motion intensity measure (IM) (i. On the structural side. for the site of Altavilla Irpinia (AV—southern Italy) where the plant is assumed to be located (Fig.e. According to this procedure. × fM. (4) where the integral. Fabbrocino et al. In order to better point out the role of seismic hazard in industrial risk. Here it is worth noticing that the structural failure P[C > D|IM] in Eq. 2. see [7. the problem of deﬁnition of good predictors for inelastic seismic behaviour of structures is one of the main topics of earthquake engineering. therefore one can write: Pf = All im∗ P D > C|IM = im∗ P IM = im∗ (3) P [PGA > pga∗ |M = m.g. phases and others which may affect the structural response of structures. therefore failure probability is given by the sum of the probabilities of the elementary events deﬁned. 2. subsequently. consequence analysis has been performed for those events which may be triggered by the loss of containment following seismic action. R = r. Pf is given by the probability of the system failing for all possible values of seismic intensity (IM) combined with the probability of the latter occurring. purely process-related “top events” are ﬁrst excluded.6]. FD is the cumulative probability distribution of the seismic performance demand for a given ground motion intensity. The topic of sufﬁcient intensity measures for seismic risk assessment of structures is wide and is detailed elsewhere.E (m. mainly because it is relatively easy to infer (i. therefore seismic hazard analysis has been required to get the occurrence probability P[IM = im∗ ] in terms of the same intensity measure used to describe the seismic vulnerability of the component in question. / Journal of Hazardous Materials A123 (2005) 61–69 in south Italy. which is the probability of the seismic capacity C being exceeded by the seismic demand D. ∞ Collapse = i=1 {Collapse ∩ IMi } (2) Events in Eq. path and site. r.ε d (Pr[D > C]) = 0 ∞ [1 − FD (u)]fC (u) du (1) In Eq. the outcome of probabilistic seismic hazard analysis [5. Pf = 0 ∞ function of im∗ ) and P[IM = im∗ ] which is the seismic hazard curve. Once the seismic failure probabilities have been quantiﬁed. and fC is the probabilistic density function of the seismic capacity of the structure/component.R. These parameters summarize all the random features of earthquakes. by earthquake intensity conversion) while others intensity measures (as ﬁrst-mode spectral acceleration) may not be available at the site for post-earthquake damage observation. Results have been then combined by means of a speciﬁc developed code in terms of local risk contour plots. seismic risk has been carried out for all structures in the plant. A comparison with classical process-related quantitative risk analysis outcomes is then reported for reference. Seismic risk analysis of industrial components Quantitative probabilistic seismic risk analysis (QpsRA) requires the evaluation of collapse probability of critical components and. ε) dm dr dε .e.r. the sole earthquake is then ﬁrst assumed as triggering event. peak ground acceleration or PGA) [4]. convolution of site’s seismic hazard and vulnerability of each component leads to the collapse probability Pf (failure probability). the probability of fatal injures at any point (x. in order to show the relevance of seismic effects on risk indexes. the analysis of phenomena triggered by loss of hazardous materials. by total probability theorem. by probability algebra: the event of collapsing due to seismic action may be represented as the union of mutually exclusive events each of those representing component’s collapse when a given level of seismic intensity occurs.1. Probabilistic seismic hazard analysis is represented by Eq. y) in the analysed area. e. as this happens when IM is “sufﬁcient”. For reviews. Seismic hazard Measured ground motions refer to seismic waves radiating from the earthquake focus to the site and can be related to three types of mechanisms that interact to generate the actual signal: source. (2) are mutually exclusive since collapse cannot take place for a given IM = IMi if another value already has led the system to failure. (1). However. Currently. More explicitly. structural seismic risk is the convolution of P[D > C|IM = im∗ ] (commonly referred as fragility curve. (3) does not depend on other earthquake characteristic such as magnitude or source-to-site distance.62 G.

many industrial and tertiary installations are characterized by speciﬁc design requirements and can become suddenly obsolete. ﬁve degrees of mechanical damage DS [18. the deﬁnition of damage state DS and/or RS is somehow left to judgment. starting from a consistent historical data set describing the behaviour of tank subjected to earthquakes: Fragility = Pr [material release|PGA] = Pr [RS|PGA] = f (PGA) (5) Table 1 Seismic fragility and probit coefﬁcients for anchored atmospheric steel tanks Limit state (RS) ≥2 3 ≥2 3 Fill level Near full Near full ≥50% ≥50% µ (g) 0. More in detail. Details of the entire statistical procedure are reported elsewhere [13.80 k1 7. IM (e.16. extensive loss of containment—RS3.80 k1 7. the effects of seismic actions have been related to structural damage and its reparability (DS.43 1.54 1. PGA is the realization of the seismic intensity (IM) that is assumed to trigger the failure corresponding to the pre-assigned limit state.53 20. Speciﬁcally.80 0.15 1. The minimum threshold value of PGA for loss of containment differs greatly from the anchored and unanchored and changes with ﬁll level. The probit function allows simple recognition of hazard by means of the following equation Y = k1 + k2 ln(PGA) (6) where PGA is expressed in terms of g.34 8.25 0. a quantitative probabilistic seismic risk analysis should deﬁne seismic vulnerability in terms of structural limit states of interest for content release. Vulnerability: statistical inference of earthquake damage All typical accidental scenarios in the process industry (vapour cloud explosions.19] have been reviewed to set three levels of intensity of loss of containment.2. On this subject. are available. 1.71 3.33 k2 1. Experimental log-normal fragility curves for steel storage tanks can be easily converted in the linear probit function Y. (4). Tables 1 and 2 report the coefﬁcient for fragility and probit for every RS level. In fact. which is the reference curve for structural design purposes (Technical Service Life. Therefore.65 0. this concept is less signiﬁcant than “loss of containment”. the gravity acceleration.72 β (g) 0. two time intervals are reported: 1 year.82 4. 2. damage state). which possibly varies with time. The absolute minimum is reached for 50% ﬁlled unanchored storage tank.DS = YRS −∞ [exp (−0. according to PSHA. The term fM. and 50 years basis. the design reference period is called functional service life (FSL).21]. as resulted from a speciﬁc statistical analysis based on consistent number of data reported in the literature (see [16] for more details and for the deﬁnition of probit function for DS limit states). for different tank levels. Probit coefﬁcients have been used for the quantitative risk analysis of fuel storage plant reported in Fig. which has been utilized in the present study because the resulting risk indexes are calculated over 1 year. Thus in many cases. deﬁned as RS (risk state): no loss—RS1.43 3. moderate loss—RS2. any other application should proceed in the same way by changing only the probabilistic characterization of the seismicity of the site of interest. PGA) exceedance probability is given by integration of probability contribution of magnitude (M). which can be considered as the safe side option for QpsRA when few information on the type of foundation of tank or on the ﬁll level. distance (R) and attenuation relationship “residuals” (E).E (m.g. for either unanchored atmospheric storage tank or anchored storage tank.06 β (g) 0.75 0. 2. likelihood of RS2 and RS3 occurring have been obtained calculating. the latter is related to DS. existing data concerning postearthquake damage observations for steel tanks have been reviewed in order to optimize the limit state classiﬁcations of equipment response [16].25 In Eq. tank and pool ﬁres or toxic dispersions) depend on the total amount of released dangerous substance [13–15]. r.67 1.00 4.65 5. which is generally lower than TSL [12].G.83 5. Because of incomplete descriptions of the actual damage to some tanks into empirical database considered.35 1.R. according to HAZUS damage state list [17].70 0. The function Y is correlated to the classical probability of occurrence by means of the following integral function [20]: PRS. it is worth noting that from a structural standpoint.5u2 )] du (7) Numerical or graphical solution of this integral is reported in the literature. The probability of occurrence of any limit state has been then assessed by means of fragility curves.25 1. In Fig.15 0. Fabbrocino et al.93 k2 1. The RS states have been deﬁned in order to describe the seismic behaviour of storage tank with reference to the accidental scenarios which can possibly follow the seismic structural damage of the tank. ﬂash ﬁres. / Journal of Hazardous Materials A123 (2005) 61–69 63 In Eq.12 0. but can be actually considered as a different and speciﬁc limit state.25 . (5). commonly used as input for the QRA consequence analysis and codes.30 1. 2. ) is their joint probability density function (PDF). Quite obviously. When QpsRA (or QRA) are concerned. for any PGA of the hazard curve reported in Fig.68 0. TSL). the Table 2 Seismic fragility and probit coefﬁcients for unanchored atmospheric steel tanks Limit state (RS) ≥2 3 ≥2 3 Fill level Near full Near full ≥50% ≥50% µ (g) 0.60 0. Accordingly.

Fig. other than non building-like structures (tanks).000 m2 . Hazard curves at the test site. southern Italy. fragility and probit functions for buildings have been obtained on empirical basis. 1. as expressed in terms of PGA. 2. . 3. Furthermore. since their collapse affects the response of the system to the industrial accident. The analysed storage tank. The storage installation The risk analysis reported in this work refers to a storage facility composed by a number of atmospheric steel tanks containing ﬂammable substances (Fig. Fabbrocino et al. Results for the combination of fragility curves and RS probability. / Journal of Hazardous Materials A123 (2005) 61–69 Fig. 3. The plant is assumed to be located in the Irpinia area. In Table 4 probit coefﬁcients derived from Rossetto and Elnashai [22] vulnerability data are reported. Consistently to what is done for tanks. Total fuel capacity 60. Time interval: ( ) 50 years.64 G. the latest expressed in g. 1). are reported in Fig. as mentioned in previous sections.000 m3 . the buildings in the storage area have been considered in the analysis because their collapse may lead to catastrophic consequences as well if there is occupancy at the time of the earthquake. It is worth noting that seismic vulnerability of building in QpsRA should also considered whether automatic safety systems are sheltered in ordinary structure. (×) 1 year. which is characterized by considerable seismic hazard according to the national classiﬁcation issued by Italian Seismic Survey [23]. Total surface: 30. corresponding probability of loss of containment (by means of data reported in Tables 1 and 2).

( ) RS = 3. diesel oil and fuel oil also have typical chemical composition [38]. Tfp < 21 ◦ C Kerosene.000 30. ( ) RS ≥ 2. 4. Here. fuel oil. All storage tanks are assumed as anchored. ( ) RS ≥ 2. low-rise constructions. near full. Quantitative probabilistic seismic risk analysis Quantitative risk analysis supports risk management and decision-making by identifying accidental scenarios and by ranking these scenarios according to their probability of occurrence [31]. rail tank Ofﬁce building Ofﬁce building Building Roof Floating Fixed Fixed – – – – – Total tank capacity (m3 ) 20. Consequence analysis For the aims of quantitative risk analysis. Dispersion analysis has been carried out starting from extensive loss (RS3) or moderate leak (RS2) from any of the storage tanks. local risk is intended as the annual probability of fatal injuries at any point (x. Building-like structures in the plant are reinforced concrete. also for the geometric characteristic of industrial area which is relatively un-congested.g.1 m has been assumed) and the evaporation rate from the surface of pool which is formed in the catch basin. ﬁll level ≥50%. For the aims of this analysis. only loss of life has been evaluated and reported. The surroundings are basically unpopulated. to be used as source term for dispersion analysis. Their seismic vulnerabilities have also been taken into account. ﬁll ≥ 50%. The package includes the prediction of the time-varying releases from tanks. vapour cloud explosion and ﬁres has been performed assuming the maximum predicted amount of vapour within the ﬂammability Tfp is the ﬂash point. 21 ◦ C < Tfp < 65 ◦ C Diesel oil. The dispersion analysis has been performed for two atmospheric stability classes (F2 and D5). the separation distances and the classiﬁcation of storage tanks are designed in agreement with main Italian and International guidelines [24–28]. y) within the analysed area. 1A national road and a railway track are close to the border of the installations. Details about consequence analysis carried out in the proposed test case are reported in the following sections. 4. Tfp > 65 ◦ C Loading point. / Journal of Hazardous Materials A123 (2005) 61–69 65 Fig.G. light gasoline. i. assumed to be representative. since the plant is located in a rural area. Table 3 reports further details on the stored fuel and constructions. since it is the most common solution adopted for this kind of structures located in seismic areas [19]. The layout. without taking into account the probability of presence of human in the same area.e. As a consequence. Control room is installed in the basement of building identiﬁed by letter “F” in Fig. The evaluation of consequences of ﬂash ﬁre. Table 3 Legend and description of the main buildings and fuels stored in the oil plant Legend A B C D E F G H Item Gasoline. e. Gasoline gives the main contribution to ﬂash ﬁre and vapour cloud explosion (VCE) risks. keeping into account the climate of south Italy. QRA analyses the system as an . Speciﬁcally. several simplifying assumptions are often necessary. Failure probability is expressed in terms of annual probability. Fabbrocino et al. Gasoline.e. Typical atmospheric conditions. have been considered (Tamb = 20 ◦ C). The uniﬁed dispersion model (UDM) implemented in the PHAST [39] package has been adopted. for any scenario. for the relatively higher volatility.000 13. Also.30]. the temporal evolution of the leak from the damaged tanks. even if VCE is unlikely.35–37]. kerosene. but the risk of any kind of damage (to the human being. the evaluation of scenarios are carried out depending on assumptions made in compliance with well-established methodologies and/or guidelines [13–15. i. the subsequent formation of pool (for the RS2 case a leak surface with a diameter of 0. Typical measures for probabilistic analysis of industrial risks include “local risk” assessment and “societal risk” assessment. and comparisons with levels of risk acceptability are only possible if consolidated choices for evaluation of scenarios and consequence analyses are used. Seismic design of tanks was based on international construction standards adopted both for water and oil storage on-grade steel tanks [29. 3. the relationship between the number of fatalities N and the cumulative frequency F at which the number N or more fatalities are predicted to occur [32–34].000 integrated socio-technical system: hundreds of sequences are analysed in contrast with the relatively small number of design-basis accident in conventional analysis. irreversible damage) can be easily assessed by introducing speciﬁc vulnerability functions. near full. For the aims of the paper we have shown local risk in terms of iso-contour. a four-sector wind rose assuming equal probability either for sectors or for the two atmospheric classes has been used. fuel oil. (♦) RS = 3. tank truck Loading point. since collapse may be not negligible in computing risk of death or injuries. Fragility curves used in this study for anchored storage tanks.1.

the only possible scenario is the pool ﬁre. on the other hand.e. the effects of explosions. To this regard. the typical cut-off criterion of lower ﬂammability limit (LFL) has been used: any person within the cloud identiﬁed by the LFL border is in fact dead. Finally. it has been assumed that late ignition occurs in any case. failure of tank in catch basin). respectively. Eventually. Moreover. 4. a very low probability of ignition (1 × 10−6 per loss) has been used for the ignition probability of diesel oil and heavy fuel oil (class C fuels). for the entire history of dispersion. it is likely that blast wave is the only effect. the maximum amount of ﬂammable vapour is considered.08 of the total probability of RS2 or RS3 occurrences. For what concerns the time of exposure to heat th . i. which is not the case of this study. beyond LFL distance. [40]. This assumption is valid for the effects of ﬂash ﬁre. ﬂash ﬁres or pool ﬁres on human being have been considered mutually exclusive at any point: the maximum effect addresses also the probability of occurrence of the accidental scenario. In the other cases. However. to 0. it is assumed that QRA has to be always as conservative as possible. respectively.66 G. the PHAST code has been used for the prediction of evolution of smoky pool ﬁres. for each source (i.03 and 0. The assumption of exclusivity should be obviously to be re-considered in the case of toxic dispersion. which relates on the wellassessed model of Thomas [43]. thus working on the “safe side”. a total duration of 60 s is considered. For the evaluation of consequences of ﬂash ﬁre. for the ﬂame shape from pool and for the evaluation of radiation from pool ﬂames. Finally. whatever the ﬁnality of the assessment: “worst case” should always be considered when uncertainties are faced. For the sake of simplicity. The mass of ﬂammable vapour between the lower and upper ﬂammability limits (LFL. Local risk RI (year−1 ) for the fuel storage plant as obtained by QpsRA. as given in Lees [13] and Crowl and Louvar [47]. if ﬂash ﬁre or vapour cloud are not possible for the low volatility of components. the vulnerability of individuals exposed to explosion or pool ﬁre. respectively. Mudan and Croce [45] and Cook et al. at least for continuous release of vapour from pools. intensity of loss (the RS2 and RS3 limit states) certainly inﬂuences the pool formation and the subsequent vapour dispersion. for the pool ﬁre burn rate. . for the peak overpressure and heat exposure. has been evaluated by probit functions. which is then preponderant in the near ﬁeld.42]. after Cox et al. Fabbrocino et al. / Journal of Hazardous Materials A123 (2005) 61–69 limits. which are certainly superimposed to other effects over the LFL threshold distance. UFL) has been used for evaluating the ﬁeld of overpressure due to vapour cloud explosion by means of the multi-energy method (MEM) [41. through the total combustion energy. again aiming at retaining the safe side. Burgess and Hertzberg [44]. aiming at deterministic assessment even in the framework of probabilistic safety assessment. An “average” strength factor (F = 5) has been used even if low congestion environment characterizes the storage plant (with typical strength factor between 2 and 5). considering their high ﬂash point and the presence of emergency interventions. ignition probabilities for ﬂash ﬁre or vapour cloud explosion has been set. [46]. Fig. i.e. Domino effects have been considered only for tanks located in the same catch basin. This approach is particularly effective when late or early ignition assumption has to be considered. in the far ﬁeld. it strongly affects the results of QRA because the amount of ﬂammable vapour can possibly increase as the time before ignition is longer. Indeed. Conversely.e.

g.0 × 10−9 /sector 1. Results of Fig. Here. 4. and modelling of accidental scenarios are analogous and not reported here for the sake of brevity. the effects of ﬂash ﬁre.i p(e|i)p(c|e)pi (8) In Eq. 4. To this regard. the accidental phenomena are related to loss of containment also in the case of process-related top events. leakage in small diameter or buried pipelines).20 3. (8). even if the analysis has been performed according to conservative assumptions for consequence analysis. atmospheric stability class). a speciﬁc ANSI C code has been developed. p(e|i) is the probability that the ith scenario propagates from the catch basin to the location x. Fig. but only related to the accidental scenarios following earthquakes. 5 in terms of local risk. 4 shows that local risk is relatively high only at the upper border wall of the storage plant. it is worth mentioning that Rijnmond Report considers an earthquake annual occurrence of 10−8 events/year. Rare events (<10−7 ) or events which are very unlikely to develop relevant accidental scenarios (e. To this regard. As Low As Reasonable Practical. The numerical layout covers 400 m × 400 m and it has been discretized by 1 m2 cells. The same term p(e|i) contains also all the information on the environmental condition (wind sector probability. and on the ignition probability. the term pi refers to the mitigation provided by the mitigation effects provided by indoor location of individuals. H 35. Quite obviously. Finally. several thresholds values have been Atmospheric storage tank Pump Loading arm Pipework > 150 mm . at least for relatively low risk fuel storage tanks containing mainly with low ﬂammable substances such as oil. index i refers to the accidental scenarios derived for the interaction of any earthquake with its related probability with the storage tank resulting in any intensity of loss of containment deﬁned by RS(Pf|RS ). the seismic risks can prevail over the risk derived from simple process and well controlled operations. which reports a threshold value of 10−3 /year for workers and 10−4 /year for public (see also ALARP.g. Here. the well known Yellow and Purple Books [36. the main contribution to the high level of risk is due to ﬂash ﬁre.G. no one represents a universal rule. overpressure (vapour cloud explosion) or heat radiation (pool ﬁre. for the toxic dispersion being excluded in the case of fuel storage areas here analysed. G. with limited use of “event tree”. To Table 5 Some process and operational events considered for QRA in the storage plant Item Event Serious leakage Catastrophic rupture Overﬁlling Catastrophic rupture Serious leakage Catastrophic rupture Serious leakage Catastrophic rupture Annual probability of occurrence 1. Results: seismic risk indexes For the purpose of the quantitative seismic risk analysis. we only report the reference given by HSE in UK [48. have been used for the process-related QRA. which is mainly related to the conservative assumption of late ignition.e.98 67 The collapse of buildings due to earthquake has also been assessed in this analysis. pool ﬁre or explosion are null unless the blast overpressure is able to damage the building itself (peak overpressure greater than 0. assuming the constant presence of the individuals in the x. Fabbrocino et al. by using probit models reported in Table 4.0 × 10−10 /sector Pf|RS. have been discarded. Results: process-related risk indexes The effectiveness of seismic action can be pointed out if above results are compared with QRA performed by considering typical top events related to plant operation. Lees [13]. starting from the statistic functions and plant information given above. i.0 × 10−4 6. mortality in the case of this analysis.2. HSE. limits). the set of industrial accidents and failure rate as listed or reported in Control of Major Accident Hazards Regulations (COMAH.37].49]. y in terms of physical effect (e). 4 have to be compared with acceptance criteria. UK) [50].0 × 10−6 2. Hence. thus excluding earthquakes. quite obviously. These values are essentially not overtaken in the industrial area if pool basin (which are very rarely travelled by workers)) are excluded. Table 5 reports the most important events considered in the QRA for storage tanks. The local risk has been calculated by using the classical relation: RI(x. Rijnmond Public Authority [48].3. y) = i RS identiﬁed in many countries but. 4 in terms of map of local risk RI as previously deﬁned. Results of the calculation obtained by the entire set of assumption are reported in Fig. and in high seismicity areas. It is also worth mentioning the very high seismicity of the industrial location. y location. The term p(c|e) refers to the probability that the physical effect (e) produces the effect (c).3 bar).7 × 10−6 1. ﬂash ﬁre). / Journal of Hazardous Materials A123 (2005) 61–69 Table 4 Seismic fragility and probit coefﬁcients for buildings located in the plant area Limit state Building k1 k2 Collapse F.0 × 10−4 3. Comparison of QpsRA with standard QRA shows that. 4. The main differences are on the typology of top event and related annual probability of occurrence.0 × 10−6 3. Recombination of results is reported in Fig. the consequence analysis and the related choices (e. ignition probabilities). To this aim.0 × 10−8 3. to be compared with Fig. In the case of individuals located in the interior of buildings.

L 10/13. in fact. Brussels. Cornell. occur. Universit` di Napoli a “Federico II”. Manfredi. [4] C. Acknowledgements Authors gratefully acknowledge the support received from the National Group for the Defence against Earthquakes . Soc. Am. Soc. R. G. Earth. [5] C. http://peer.berkeley. with the related high probability of collapse. Probabilistic seismic hazard analysis and design earthquakes: closing the loop. QpsRA may be successfully carried out if seismic fragility analyses of critical components are developed in terms of limit states that may trigger industrial accidents (i. [3] European Commission DG Joint Research Centre.. On the other hand.unisdr. [2] I. 8 (6) (2004) 1–19. CA. Eng. Foutch. More speciﬁcally. Cornell. EERI 21 (2005) 3. Ground Motions and Probabilistic Assessments for PBSD. J. Use of empirical vulnerability functions does not represent a limitation of the study. this regard it should be noted that seismic action can strongly affect building integrity.K. 58 (1968) 1583–1606. Iervolino. September 2005. 5. Conclusions The case study presented shows how integration of seismic risk assessment into quantitative risk analysis can be effectively based on easy to manage statistical tools like fragilities and probit functions.A. Seismol. / Journal of Hazardous Materials A123 (2005) 61–69 Fig. Fabbrocino. United Nations International Strategy for Disaster Reduction (ISDR). PEER Report series 2004/2005. The probabilistic basis for the 2000 SAC/FEMA steel moment frame guidelines. Comm. Berkeley. Fragility of standard industrial structures by a response surface based method. G. Activities Report 20ISDR. rather unlikely. Record selection for non-linear seismic analysis of structures. On the collaboration agreement between the International Strategy for Disaster Reduction of the United Nations and the Directorate General Joint Research Center of the European Commission.edu. Hazard.O. Calvi.M. D. Local risk RI (year−1 ) for the fuel storage plant as obtained by process-related QRA. [7] C. This assumption fails when pressurised equipment or highly reactive fuels are considered. Fabbrocino et al. Project Coordinator: Prof.68 G. Struct. 85 (5) (1995) 1275–1284.A. Hamburger.A. B. Institute for the Protection and Security of the Citizen (DG JRC). Engineering seismic risk analysis. G. McGuire. Seismol. J. 128 (4) (2002) 526–533. http://www. B. G. Off.org.A. available numerical procedures able to set reliable fragility functions (and probit coefﬁcients) for industrial components need further development to cover all the relevant failure modes of equipment. a Task Coordinator: Prof. Jalayer. hazardous materials release). Eur. References [1] Council Directive 96/82/EC of 9 December 1996 on the control of major-accident hazards involving dangerous substances. 5. [8] I. earthquake spectra.e. Cornell. [6] R. Eng. Cornell. Iervolino. (GNDT) within the research project “Reduction of Infrastructures and Environment Seismic Vulnerability” (VIA). C. F. Manfredi. J. 2003. accidental scenarios produced by loss of containment of low ﬂammable fuels from atmospheric equipment can be destructive on building if vapour cloud explosions. Universit` di Pavia. Am.A.

..M. Department of Structural Analysis and Design.J. J. Van den Berg. USA. [32] R. Vilchez. API. Methods for the calculation of physical effects (Yellow Book). Whitehouse. 2004. 2000. Lees. 1998. [13] F. Heat Transfer in Flames. 2003. IRI. ASCE-TCLEE (2001).S. NY. Struct. [31] G.A. General Principles. Croce. [46] J.D. Butterworth-Heinemann. Universit` di Napoli a “Federico II”. P. Safety in plant design. 844–859. Worst case methodology for the initial assessment of societal risk from proposed major accident installations. USA. USA. EPA. Earthquakeic fragility formulation for water systems.5. R. API 850—American Petroleum Institute. [45] K. Houben. Thomas. Acceptable risk as a basis for design. [36] C. A. 650. Chapter 27. USA. A. Wilson.E. E. Denver. Fire protection in reﬁneries. Chemical Process Safety: Fundamentals with Applications. [44] D. Probit Analysis. John Wiley & Sons. B. http://www. HSE Books. Redel. UK. Canvey: an investigation of potential hazards from operations in the Canvey Island/Thurrock Area. J. CO.A. Inst. Committee for the Prevention of Disasters. Mater. Maastricht (NL). Loss Prevention in the Process Industries. Hertzberg. M. Flash Fires and BLEVE’s.J. 1983. 25 (1) (2003) 1241–1263.A. Loss Prevent. Sabetta. B. 1982. Guidelines for Quantitative Risk Assessment (Purple Book). in: N. P. 1971. J.). National Institute of Building Science. PA. The Hague (NL). Weterings. Proc. [33] D. W. [20] D. Ale. thesis. Afgan. Hazard. Seismic risk of atmospheric storage tanks in the framework of quantitative risk analysis. 1999. Plant layout and spacing for oil and chemical plants. Eggen.M. [19] M. Radiation from pool ﬂames. Risk analysis of six potentially hazardous industrial objects in the Rijnmond area.H. EXXON Engineering.W. A Pilot Study. Bahrami. Reliab. F. J. Mater. [40] A. Beer (Eds. Earthquake Spectra. Fabbrocino et al.A. 59 (1998) 141– 150. Earthquake Loss Estimation Methodology. R. Eng. 12 (1985) 1–10. J. Loss Prevent. [10] V.J.P.com. 1978. Risk-informed decision making.H. [16] E. I. INGV. Guidelines for evaluating the characteristics of VCEs. Derivation of vulnerability functions for European-type RC structures based on observational data.A.M. Crowl. 1993.C. J. [17] HAZUS. 2003. 16.M. University of Naples Federico II. 1996. Institution of Chemical Engineering. Proc. [34] J. GAME: Development of Guidance for the Application of the Multi-Energy method. 1991.K.C. The Hague (NL). Salzano. [48] Rijnmond Public Authority.C. [49] J. http://www. ARAMCO Engineering Standards. Washington D. [22] T. Part 1. [28] IP.D. 1995. Seismic Fragility Curves for On-Grade Steel Tanks. Louvar. Montiel. ISO 15686-1. American Water Works Association. 77 (1987) 1491–1513. Prentice Hall. [21] J.M. Hirst. 1963.P. in: European Safety and Reliability Conference. The multi-energy method. Menlo Park. Burgess.2.L. 1997. 1982. Plant layout. G. Fabbrocino. Soc. London. Pugliese. Fire precautions at petroleum reﬁneries and bulk storage installations. [35] Health and Safety Executive (HSE). Final Report for the Civil Protection Department.D. Quantitative Seismic Risk Analysis in Process Industry.2.P. [29] API Standards 620. 1997. Iervolino. The Combustion Institute. Buildings and Constructed Assets Service Life Planning. 1990. [12] ISO/TC 59/SC 14. In Italian. [11] F. Z. P. Apostolakis. Vrijling. 2004. So. J. 1974. Floyd. Rossetto. [47] D. American Institute of Chemical Engineers. Arnaldos.J. Society of Fire Protection Engineers. 1984. Design life. Washington. Ang. [18] J. TNO-PML. van Hengel.A. Balle. Iervolino. A comprehensive program for calculation of ﬂame radiation levels. 2003. The size of ﬂames from natural ﬁres. Seismol. Societal Risk. J. [23] Drafting of the seismic hazard map given by OPCM 3274 March 20.F. UK. Handbook of Fire Protection Engineering. USA. 1997. [25] AES-B-55. Hazard.M. Crouch. Cambridge University Press. Comb. . Am. [26] IRInformation IM.epa. 1996. thesis in Seismic Risk. A Guide to the Control of Major Accident Hazard Regulations. Committee for the Prevention of Disasters. Dipartimento di Analisi e Progettazione Strutturale. I. 1990. [14] Center for Chemical Process Safety (CCPS). A framework for vapour cloud explosion blast prediction. Loss Prevent.G. CA. Van Den Bosh. Convertito. plenary lecture. [43] P. Safe. Pittsburgh. Risk Management Solutions. [15] Center for Chemical Process Safety (CCPS). Rugby. Elnashai. [38] Environmental Protection Agency. Extension of classical attenuation laws: inﬂuence and implications on the probabilistic seismic hazard analysis. 71 (2000) 117–128. 3 (1990) 150–155. Science 237 (1987) 267–290. and 653 Interpretations. pp. Risk assessment and comparisons: an introduction. 2000. Cox.M. [50] Health & Safety Executive. Analytical expression for the calculation of damage percentage using the probit methodology. Attenuation of peak horizontal acceleration and velocity from Italian strong-motion records. [42] J. 1994. [24] ER&E Design Practices. M. Ph. 2003. [41] A. New York. New York. [27] API RP 2001. [37] P. 16 (2003) 403–409. Casal. / Journal of Hazardous Materials A123 (2005) 61–69 [9] I. R. Cook. Proc. HSE Books. Lees. DNV—Det Norske Veritas Limited. second ed.B. Guidelines for chemical process quantitative risk analysis. Finney. NJ. 14 (2001) 193–197. Classiﬁcation of Hazardous Locations. Oxford. 2000.J. Ph.A. L111. J. [39] PHAST code. H.dnv. Dordrecht.J. Uijt de Haag. Syst. Eng. 69 [30] AWWA D100-96—Welded Steel Tanks for Water Storage. Eidinger.org.L. 1988..H. Mudan. in: 9th Proc. Carter. UK. American Institute of Chemical Engineers. 1999. O’Rourke.

- TNO, CCR 01318 Application of Correlations to Quantify the Source Strength
- 434-05 Human Factors in QRA - OGP
- Guidelines for Quantitative Risk Assessment (Qra) Study
- References QRA
- Risk Assessment in the Offshore Industry
- Onshore Pipeline Quantified Risk Assessment
- E P Forum QRA Data Directory
- Vulnerability methods.pdf
- Gupta at Al 2006 a Probabilistic Seismic Hazard Analysis Of
- SEISMIC RELIABILITY ASSESSMENT OF A BRIDGE GROUND SYSTEM
- 8NCEE-Bruneau Reinhorn Resilience.pdf
- EUR23563EN sismo
- Vulnerability assessment methods
- Earthquake Engineering
- lecture12.pdf
- p
- Response Spectrum Modelling for Regions Lacking Earthquake Records
- 040
- SeismicHazard ITF
- Scenario Korean Nuclear Plants
- Wiemer 2008
- 1968 Paper - Engineering Seismic Risk Analysis
- Seismo Ionospheric
- Bibliography
- 15WCEE Atkinson Paper
- dis12
- Czeck Republic Seismic JRC38187 RanguelovJelinekWoodHervas
- PSHA for Distributed Seismicity-Lapajne
- Erdik 2003 Earthquake Rapid Respone and Early Warning System
- 3d Seismic Tomography at Aswan Lake-libre
- QRA Example

Are you sure?

This action might not be possible to undo. Are you sure you want to continue?

We've moved you to where you read on your other device.

Get the full title to continue

Get the full title to continue reading from where you left off, or restart the preview.

scribd