A Bow-tie Model for Analyzing Explosion and Fire
Accidents Induced by Unloading Operation in
Petrochemical Enterprises
Mengmeng Chen a,b and Kai Wanga,b,c
a
Beijing Key Laboratory for Precise Mining of Intergrown Energy and Resources, China University of Mining and Technology
(Beijing), Beijing, 10083, China
b
School of Resource & Safety Engineering, China University of Mining & Technology (Beijing), Beijing, 10083, China
c
Hebei State Key Laboratory of Mine Disaster Prevention, North China Institute of Science and Technology, Beijing, 101601, China
Published online 00 Month 2018 in Wiley Online Library (wileyonlinelibrary.com). DOI 10.1002/prs.11990
Explosion and fire accidents happen frequently in petro-
chemical enterprises. For improving risk management, Bow-
tie method is applied to analyze causes, consequences, and
control methods of such disasters. Based on fault tree analysis,
42 combination scenarios of primary events leading to explo-
sion and fire accident are achieved. Important order of pri-
mary events is determined. Event tree is developed where four
consequences, with different occurrence probability and loss
degree, are obtained considering of success or failure of emer-
gency evacuation and automatic fire extinguishing system.
Structure of Bow-tie model is established where three accident
sources, including limit concentration of liquefied petroleum
gas, equipment fault or operation error and fire source, are
taken into account. After identification of accident causes
and consequences, precautionary and loss-reducing measures
are proposed. The model was applied to analyze explosion
and fire accident occurring in Jinyu group of China, demon-
strating poor connection between the pipe and oil tank truck
and non-explosion-proof equipment resulted in the accident.
The delayed emergency excavation and failure of automatic
fire extinguishing system led to fully developed fire and heavy
casualties. To reduce such disasters, controlling suggestions in
terms of educational training, intelligent monitoring, equip-
ment management, and safety management were provided
for Jinyu group. © 2018 American Institute of Chemical Engineers
Process Saf Prog 2018
Keywords: bow-tie model; explosion and fire accident;
unloading operation; petrochemical enterprises
INTRODUCTION
Explosion and fire accidents occur frequently in petrochem-
ical enterprises, resulting in heavy casualties and considerable
economic losses. For instance, the explosion of Tianjin port in
China brought about economic losses of 6.866 billion yuan (¥)
directly in 2016 [1]; an explosion off the coast of Brazil led to
nine deaths in 2015 [2]; the explosion happening in an oil
refinery of England caused 15 deaths, 180 injuries and
© 2018 American Institute of Chemical Engineers
Process Safety Progress
economic losses of 15 billion dollars ($) [3]. A set of explosion
and fire accidents of China and corresponding casualties are
listed in Table 1. That implies petrochemical enterprises are
extensively influenced by explosion and fire accidents world-
wide. There are so many causes of such accidents that it is
impossible to completely avoid explosion and fire accidents in
petrochemical enterprises. However, numerous researches
have been carried out in order to reduce the frequency and
associated damage. There are three broad approaches, widely
used in risk assessment and accident analysis involved in pet-
rochemical enterprises, including event tree analysis (ETA),
fault tree analysis (FTA) and bow-tie model (BT).
ETA connects an abnormal event to all its potential conse-
quences. Safety barriers are installed between the initial and
end states of the event. According to the state of various safety
systems (success or failure), specific consequence resulted
from the abnormal event can be determined [4]. Event tree
have been extensively used for risk evaluation of nuclear plant
and that of offshore drilling system [5,6]. Occurring probability
of the unwanted event can be deduced from FTA, which is a
graphic model using logic gates (and/or) to analyze develop-
ing process of the critical (top) event. The logical gate is
installed between different bottom events, including equip-
ment failures, human errors, and natural factors. Specific com-
bination scenario of the bottom events results in occurrence of
the top event [7,8]. With FTA method, Zhang [9] improved the
analytic hierarchy process (AHP), which is used for assessing
the risk of fire and explosion accidents.
In order to analyze both causes and consequences of the
accident simultaneously, BT method was put forward by
combing ETA and FTA. That means BT consists of a fault tree
and an event tree, which are connected to each other via the
critical event. Yuan [10,11] assessed the risk of dust explosions
based on BT diagram. Moore [12] proposed a robust security
risk assessment (SRA) methodology for the petroleum and pet-
rochemical industries and the key elements of SRA process
were examined. Bilal et al. [13] developed a new method for
the evaluation of risks of fire and explosion of pipelines based
on Bayesian network and BT diagram. Using computational
fluid dynamics codes, an integrated approach for fire and
explosion consequence modeling in oil and gas processing
Month 2018 1
Table 1. Accident statistics of chemical enterprises with over 10 deaths between 2000 and 2017 in China.

Time Name Cause Deaths

February 19, 2000 2
19 blast of Sanli industrial company in Fire of combustible gas in a Cable trench 15
Shandong province
July 2, 2000 7
2 oil tank blast of Hongrun petrochemical Improper operation 10
company in Weifang city of China
July 28, 2006 7
28 chlorination tower blast of Fuyuan Material decomposition Explosion 22
chemical company Linhai branch in Jiangsu
province
August 7, 2006 8
7 blast of Yikun chemical company in Tianjin Reactor explosion 10
August 26, 2008 8
26 blast of Guangwei chemical company in Explosion mixed gas in oil Tank overflows 21
Hechi city of China
November 19, 2011 11
19 deflagration of Xintai united chemical Improper operation 15
company in Shandong province
February 28, 2012 2
28 blast of chemical company in Zhao Leakage of thermal oil at the Bottom of the 29
country, Shang province reactor
November 22, 2013 11
22 Donghuang pipeline leakage and blast Pipe rupture 62
of Sinopec in Qingdao of China
July 31, 2014 7
31 pipe rupture and blast of Huayun storage Pipe rupture 30
company in Gaoxiong of Tanwan
August 31, 2015 8
31 blast of Binyuan chemical company in Improper operation 13
Dongying city of China
August 12, 2015 2015Tianjin Port fire and explosion Hazardous chemical leaks 165
June 5, 2017 6
5 fire and explosion of Jinyu petrochemical Hose leakage at the connection 10
company in Linyi of China
Note: The data are from work safety websites of China, including Tangshan Administration of Work Safety, Zhejiang Administra-
tion of Work Safety, Fuzhou Administration of Work Safety and Shangdong Province Administration of Work Safety.

facilities was developed, which can be used in minimizing the

Safety barriers
adverse impacts of such accidents [14]. Due to the feature of Pre-accident Post-accident
the components, BT is limited to static safety analysis and the precautions controls
conditional dependency is not taken into account. This draw-

CONSEQUENCES
back was recently addressed by Kalantarnia et al. [15,16] and
HAZARD

Khakzad et al. [17–19] by incorporating Bayesian network.

Then the modified BT approach was used for dynamic safety
risk analysis of offshore drilling, well integrity operations, and
dust explosion scenarios [20–22]. Numerous researches indi-
cate Bayesian updating is effective in characterizing evolving
feature of the failure probability of safety systems within event
tree [15,23]. Through mapping BT into bayesian networks
(BN) event dependency regarding primary events and safety
barriers can be taken into consideration [24]. Thus, BT technol-
ogy is extended to be utilized in dynamic safety analysis asso-
ciated with explosion and fire accidents.
Unsafe behaviors of operators and unsafe conditions of equip-
ment can easily lead to leakage of liquid gas during unloading
operations of petrochemical enterprises, resulting in explosion
and fire accident and economic losses. Zhou et al. [25] analyzed
Tianjin Port 8.12 fire and explosion accident induced by the leak-
age. Causes and responsibility of the accident as well as corre-
sponding suggestions were unfolded. After accurate analysis
conducted on 435 explosion and fire accidents of oil depots in
China, Zhou [26] concluded that the unloading area is the most
dangerous area, and the equipment and facilities of the oil tank
are the elements most vulnerable to external influences.
In the present study, a BT model is established to analyze
the causes of explosion and fire accident in the unloading
operations. The model is further applied to analyzing the
explosion and fire accident occurring in Jinyu group of China.
The main aim of this study is to reveal causes of the accident
and to give effective suggestions to corresponding petrochemi-
cal enterprises for controlling such accidents. Dynamic evolu-
tion of the probability of primary events and safety barriers
CRITICAL
EVENT
Fault tree Event tree
Figure 1. Generic example of BT model.
involved in BT diagram is not taken into account. Herein, the
BT method is utilized in the context of static risk analysis.
BOW-TIE THEORY
BT diagram combined a fault tree on the left with an event
tree on the right [17,27,28]. Two trees are closely related
through a critical event as shown in Figure 1. The diagram is
mainly composed of hazard sources potentially leading to the
critical event, safety precautions corresponding to different
hazard sources, critical event of the accident generally defined
as losses of containment and physical integrity of industrial
systems, control measures in respect to the critical event, and
various hazard consequences including casualties, economic
losses and environmental damage. In the BT diagram, safety
precautions included in the fault tree and control measures
involved in the event tree are classified as safety barriers with
different safety functions. The safety barriers are physical and
engineered systems or personnel actions in line with specific
procedures and regulations. The barrier determines the way to
implement safety functions. As the safety barrier has been

2 Month 2018 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress
installed, the safety functions served by the barrier should be
figured out. Instead of physical systems, the safety functions
are technical or organizational actions.
With BT diagram, centered on a critical event, all causes
and consequences of an accident can be identified. In addi-
tion, the diagram is adaptable to different accident scenarios
threatening the industrial safety. In the diagram, occurring fre-
quency of initial accident causes and success or failure proba-
bility of installed safety barriers can be given. Then, the
frequency of mediate critical event and accident consequences
at the last level of the BT can be analyzed quantitatively. Oth-
erwise, qualitative analysis can also be performed with respect
to various industrial accidents using the diagram. Due to the
multi-functional and user-friendly features, BT concept finds its
popularity in various industrial fields, particularly in petro-
chemical enterprises [29–34] where the diagram is commonly
used to analyze occurring probability and risk extent of explo-
sion and fire accidents. After potential dangers, associating
causes and consequences have been identified, vulnerable
points of risk management, and organizational control can be
clearly unfolded by taking into account functions of associated
safety barriers. Then, physical measures of risk management
and loss reduction can be enhanced and improved. So that
enterprise management level can be greatly promoted for
ensuring industrial safety in production.
BT MODEL FOR UNLOADING OPERATION-INDUCED EXPLOSION AND
FIRE ACCIDENTS
Workflows of Unloading Operation
Unloading workflows of petrochemical enterprises are pre-
sented in Figure 2. A warning board should be placed in the
unloading area before oil tank truck has entered in for unload-
ing operations. As the truck stopped, a gimbal joint between
the truck and oil tanker is installed and the oil valve is acti-
vated. Then, inside pressure of the truck is increased with the
unloading compressor. As the pressure of the truck exceeds
that of the tank, the liquefied petroleum gas (LPG) is trans-
ported into the tank. The oil valve must be inactivated after
the LPG has been unloaded completely.
During the unloading process, it is necessary to ensure that
the unloading pipeline is connected correctly. The grounding
system must be remained in good situation. The oil trucks,
unloading pipes and oil valves have to be inspected carefully
for preventing leakage. Besides, the unloading tools should be
used in strict accordance with the instructions to avoid fric-
tional sparks. Any external fire source should be prohibited
from occurring in the unloading area. Otherwise, explosion
and fire accident can be easily triggered in such area.
Accident Cause Identification
Fault Tree for Explosion and Fire Accidents
In order to identify the main causes of explosion and fire
accident, fault tree analysis is first carried out. There are four
important components composing a fault tree, including the
risk event, conditional event, intermediate event, and basic
event. In order to establish the fault tree for explosion and fire
accident induced by unloading operation, these four elements
should be identified, respectively. The fault tree usually starts
with the top event, denoted by T, and works backward to
Gas-phase pipeline
Oil tank Oil tank truck
Liquid-phase pipeline
Figure 2. Unloading workflows.
Process Safety Progress Published on behalf of the AIChE
different conditions causing the top risk event as shown in
Figure 3. The intermediate events, denoted by Ei in Figure 3,
are middle nodes connecting basic events (Xi) and top event.
Besides, the conditional event (a) should also be matched to
trigger the risk event.
In this study, explosion and fire of oil tank truck occurring
during unloading operation are taken as the risk event. Condi-
tional event is the concentration of oil vapour in the air. The
concentration has to reach the explosion limit to result in a risk
event. There are eight intermediate events existing in the fault
tree, including leakage of liquid gas, fire source, equipment
failure, operational error, open fire, electric spark, static elec-
tric spark, static electric spark generated by equipment. At the
last level of the tree, 14 basic events are taken into consider-
ation, that is, connection fault (X1), pipeline damage (X2),
relief valve failure (or shutdown) (X3), tank is not tightly sealed
(X4), operating procedure error(X5), operating tool error (X6),
smoking(X7), fire in danger zone (X8), non-explosion-proof
equipment (X9), explosion-proof electrical fault (X10), static
spark of clothes (X11), lightning strike (X12), electrostatic
accumulation(X13), and poor grounding (X14). Different events
are linked by logic gates. At the “and” gate, all events down-
stream have to be matched to trigger upstream event. At the
“or” gate, any event downstream is sufficient to generate the
upstream event.
Structural Analysis of the Fault Tree
According to the logic relationship between different events
in the fault tree, structural function relating top event with
intermediate and basic events can be expressed as:
T=aE1E2=a(E3+E4) (E5+E6+E7+X12) =a(X1+X2+X3+X4+X5+X6)
(X7+X8+X9+X10+X13X14+X11+X12)
Based on the structural function, 42 minimum cut sets
can be derived. They are {aX1X7},{aX1X8},{aX1X9},{aX1X10},
{aX1X13X14},{aX1X11},{aX1X12},{aX2X7},{aX2X8},{aX2X9},{aX2X10},
{aX2X13X14},{aX2X11},{aX2X12},{aX3X7},{aX3X8},{aX3X9},{aX3X10},
{aX3X13X14},{aX3X11},{aX3X12},{aX4X7},{aX4X8},{aX4X9},{aX4X10},
{aX4X13X14},{aX4X11},{aX4X12},{aX5X7},{aX5X8},{aX5X9},{aX5X10},
{aX5X13X14},{aX5X11},{aX5X12},{aX6X7},{aX6X8},{aX6X9},{aX6X10},
{aX6X13X14},{aX6X11},{aX6X12}. Each cut set can guarantee
occurrence of the risk event.
Structural importance coefficient of each basic event is
yielded by
X 1
IΦðiÞ ¼ nj −1 ð1Þ
xi ϵKj 2
Where, I;(i)is structural importance of ith basic event; Kj is
jth minimum cut set; nj is number of basic events included in
minimum cut set Kj; Xi is ith basic event.
Using Eq. 1, the following results can be achieved.
Iϕ(1) =Iϕ(2) =Iϕ(3) =Iϕ(4) =Iϕ(5) = Iϕ(6) = 6/23-1+1/24-1 = 13/8
Iϕ(7) =Iϕ(8) =Iϕ(9) =Iϕ(10) =Iϕ(11) =Iϕ(12) = 6/23-1 = 12/8
Iϕ(13) =Iϕ(14) = 6/24-1= 6/8
Similarly, structural importance of the conditional event is
calculated by
Iϕ(a) = 36/23-1+6/24-1 = 78/8
Therefore, the order of structural importance coefficient of
the conditional event and 14 basic events in the fault tree is
given as: Iϕ(a)>Iϕ(1) = Iϕ(2) = Iϕ(3) = Iϕ(4) = Iϕ(5) = Iϕ(6)>Iϕ(7) =
Iϕ(8) = Iϕ(9) = Iϕ(10) = Iϕ(11) = Iϕ(12)>Iϕ(13) = Iϕ(14).
Sensitivity Analysis of the Fault Tree
There are four minimal path sets of the fault tree
presented in Figure 3, including {a}, {X1X2X3X4X5X6},
{X7X8X9X10X13X11X12} and {X7X8X9X10X14X11X12}. That means
the sensitivity of top event to X1–X6; X7–X12 or X13–X14 is
equal. Therefore, evolution of the top event occurrence
DOI 10.1002/prs Month 2018 3
 Explosion and fire of oil tank
truck during unloading operation
(T)

and
Oil vapour concentration reaches
explosion limit (a)

Liquid gas leak (E1) Fire source (E2)

or or

Equipment failure (E3) Operation error (E4) Open fire (E5) Electric spark (E6) Static spark (E7)
X12
or or or or or

Lightning strike
X1 X2 X3 X4 X5 X6 X7 X8 X9 X10 Static electric X11
spark generated
Operating procedure error

Operating tool error

Explosion-proof device damaged

(or shutdown)
Relief valve failure

Non-explosion-proof equipment
Seal bad
Pipeline damaged

Fire work

Clothes static spark

Smoking
Connection fault

by equipment(E8)
and

X13 X14

accumulation

Grounding bad
Electrostatic
Figure 3. A fault tree for explosion and fire accidents induced during unloading operation.

probability with a, X1, X7, and X13 is studied and presented in x 10

-4
x 10
-4
x 10
-4
8
Figure 4. It turns out occurrence probability of top event is lin-
early related to all primary events involving in the fault tree. 3.2
3.15 3.15
3.2 7
Note for each straight line, possibility of other events is main-
3.14 3.14
tained (0.02) while only that of the basic event on the horizon- 6
Probability of top event

Probability of top event

Probability of top event

tal axis is changing. Based on such assumption, occurrence 3.13 3.13
3 0.0543 3
probability of top event can be calculated by Eq. (2). Figure 4 5
demonstrates increasing rate of top event probability with
growth of conditional event probability is much greater than X1
4
X7
that with basic events. Besides, rising rate of top event proba- 2.8 2.8
X13
bility with increasing possibility of X1 and X7 is significantly 3
Conditional
larger than that with X13. Discrepancy of straight lines relating event
top event probability to X1 and X7 is slight. But fractionated 2.6 2.6 2
gain of these two lines indicates the slope of the former is
larger than that of the latter. Thus, it can be concluded, accord- 1
0.01 0.02 0.03 0.04 0.05
ing to Figure 4, the sequence of the sensitivity regarding condi- Probability of primary event
tional and basic events are a > X1–X6 > X7–X12 > X13–X14. The Figure 4. Evolution of top event probability with primary
sequence is consistent with that deduced from structural events. [Color figure can be viewed at
analysis. wileyonlinelibrary.com]
Y
n
Q ¼ ΣΦðX Þ qixi ð1−qi Þ1− Xi ð2Þ
i¼1 important condition for the explosion and fire accident. So that
main function of the precautions installed on this branch is to
where Q is occurrence rate of top event, Φ(X) is state value constrain the oil vapour concentration under the critical limit.
(0 or 1) associated with the top event, Xi is state value (0 or 1) There are three and four aspects involving in the direct and
of basic events, qi means happening probability of basic events. indirect precautions, respectively. In term of the direct cate-
gory, the in-situ staff should do well in the following three
aspects: (1) eliminate the oil and gas accumulation by ventila-
Safety Precautions in the Fault Tree tion; (2) install monitoring and alarming equipment; (3) reduce
According to the results of structural and sensitivity ana- cross-operation. As to the indirect situation, the precautions
lyses, different safety precautions are taken into account, include ventilation management system, and standard of moni-
which are classified into two categories, namely, direct (I) and toring and alarming system as well as cross-operation regula-
indirect (II) precautions, to prevent the hazards. The direct are tions. Such systems aim to ensure effectiveness of the direct
related to in situ staff and equipment directly while the indirect measures.
are proposed at the management level. Conditional event is followed by equipment failure or oper-
Based on structural and sensitivity analyzes, importance of ation error. To lower happening probability of such events,
the conditional event stands at the first order, which means oil direct precautions are given as: (1) maintain the equipment
vapour concentration reaching the explosion limit is the most regularly; (2) check the equipment carefully before unloading

4 Month 2018 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress
operation; (3) train and examine associated staff regularly; (4)
use tools correctly. Indirect measures should also be estab-
lished corresponding to X1–X6, such as development of main-
taining and checking systems for equipment, pre-job training
system and operation error-handling procedures.
Fire sources provided by different basic events also exert
great influences on explosion and fire accidents. In order to
prevent occurrence of fire within unloading area, different
safety measures should be implemented corresponding to
branches associated with fire. The direct measures including
five parts:(1) set no smoking sign; (2) select explosion-proof
equipment; (3) exclude chemical fiber work clothes; (4) install
lightning protections; (5) strengthen daily inspection. Besides,
management system should also be developed, such as man-
agement of warning sign, danger equipment, labour suit etc.
(as shown in Figure 6). Note, thunderstruck may lead to fire
but the probability is low, so that it is not taken into account in
the BT diagram established in Figure 6.
Success Local fire
-slight casualty
Accident Consequence Identification
Construction of the Event Tree
The event tree is utilized to analyze accident consequences
after the top event in the fault tree has been triggered. The crit-
ical event is followed by a series of control measures used to
control or stop the evolution of a branch in the event tree.
Depending on the confidence of the safety barriers, accidents
consequences with various damage degrees are resulted in. As
explosion and fire accidents of petrochemical enterprises, the
accident consequence is closely related to emergency evacua-
tion measures and automatic fire extinguishing system. Herein,
these two safety barriers are taken into account in the current
study. As shown in Figure 5, the safety barriers introduce a
type of or gate in the event tree. According to the effective-
ness, response time, and confidence level of safety barriers,
four kinds of accident consequences are taken into consider-
ation. That means the event tree is divided into four branches
at the last level, including fully developed fire-heavy casualty,
fully developed fire-slight casualty, local fire- heavy casualty,
and local fire- slight casualty.

Success Automatic fire Control Measures in the Event Tree

Explosion and fire
of oil tank during
unloading operation
Figure 5. An event tree for explosion and fire induced during
unloading operation.
extinguishing
system In the event tree, two safety barriers, namely, emergency
Failure Fully developed fire
evacuation and automatic fire extinguishing system are taken
-slight casualty into account. There are many influences of the success or fail-
Emergency ure of these two safety functions. Emergency evacuation is
evacuation
mainly influenced by safety behaviors of unloading operators.
Success Local fire
-heavy casualty Unsafe behaviors are resulted from the lack of safety knowl-
edge. Many operators cannot distinguish or understand emer-
Automatic fire
Failure extinguishing gency evacuation signal. They are unfamiliar with emergency
system escapes as well as physical and chemical properties of LPG.
Failure Fully developed fire Some staff even cannot find installing place of the self-rescuer
-heavy casualty or do not know how to use the self-rescuer. Such lack of safe
knowledge leads to many unsafe evacuation behaviors, includ-
ing panic running, creeping forward, retrograde moving,
waiting, and looking. These unsafe behaviors are resulted from
low safety awareness of unloading operators and managers of

1.Eliminate the oil and gas 1.Ventilation management system in

accumulation by ventilation; the unloading area;
2.Install monitoring and alarming 2.Standard of monitoring and
equipment; alarming system;
3.Cross-operation. 3.Cross-operation regulations. 1.Understand the evacuation signs;
2.Familiar with the escape routes; CONSEQUENCES
3.Master the oil properties;
I II 4.Familiar with the storage location of escape
Oil vapour concentration equipment;
reaches explosion limit 5.Use escape equipment properly. Success Local fire
-slight casualty
1.Maintain the equipment regularly;
2.Check the equipment carefully before operation; Success Automatic fire
3.Train and test operators regularly; extinguishing
system
4.Use tools correctly.
Failure Fully developed fire
I Explosion and fire -slight casualty
Equipment f ailure or of oil tank truck Emergency
error operation during unloading evacuation
II
operation Success Local fire
1.Equipment maintaining system; -heavy casualty
2.Equipment checking system;
3.Pre-job training and examination management system; Automatic fire
Failure
4.Operation error-handling procedures. extinguishing
system

Fire sources Failure Fully developed fire

I II
1.Set no smoking sign;
2.Select explosion-proof equipment;
3.Exclude chemical fiber work
clothes;
4.Install lightning protections;
5.Strengthen daily inspection.
-heavy casualty
1.Management of warning sign;
1.Adequate designer knowledge;
2.Equipment selection and quality
management system; 2.Strict design review;
3.Labour suit regulations; 3.Ensure equipment quality;
4.Natural disasters prevention measures; 4.Daily equipment inspection and
5.Key areas inspection system; maintenance.
6.In-situ supervision and management
system.

Figure 6. BT diagram for explosion and fire accidents in unloading area.

Process Safety Progress Published on behalf of the AIChE DOI 10.1002/prs Month 2018 5
the enterprise. Safety training is neglected and the security
checking work tends to be useless.
In order to improve efficiency of the emergency evacua-
tion, safety of the petrochemical enterprise should be
improved in the following ways. Emergency evacuation signal
should be placed at the conspicuous locations. Both location
and meaning of the signal should be taught to the staff. Safety
training should be organized regularly. Simple and efficient
knowledge should be involved in the training content. It is bet-
ter to impart safe knowledge through concrete accident cases.
Besides, detailed exercise plan of emergency evacuation
should be developed and put into practice, making the staff
keep rational and calm when encountering the explosion and
fire accidents in reality.
Success or failure of automatic fire extinguishing system is
vulnerable to self-stability of the system. Both pre-existing
system fault and the damage induced by explosions may lead
to failure of the system response. System damage is mainly
resulted from insufficient safe distance between fire-fighting
equipment and explosive oil tank truck. The safe distance is
initially designed by designers and the insufficiency implies
the initial designers are unqualified. System fault is attributed
to unqualified quality of fire-fighting equipment. Besides, the
fault also is potentially resulted in by careless equipment
maintenance. Because of the inadequate safety knowledge,
low safety awareness and bad safety habits, some
equipment-checking staff cannot find and fix equipment fault
in time.
For preventing such problems, the enterprise should pur-
chase qualified fire extinguishing equipment. Pre-job training
for equipment inspection and maintenance staff should be
demanded. After that, running stability of the equipment and
working capability of the staff can be guaranteed.
Figure 7. Plant layout and contrast before and after the explosion. [Color figure can be viewed at wileyonlinelibrary.com]
1) Completed the handover of work. Liquefied gas begined to leak and vaporized
2) Continued the unloading work. rapidly.
Jun. 5
0:57:20~0:59:09
Jun. 4
23:00~23:50
1) A liquefied gas truck entered the No.11 unloading
position in the loading and unloading area.
2) The driver carried out the unloading process
connection and unloading operation, and started the
compressor to increase the truck¡s̄ pressure.
3) A worker inspected the truck and placed the taper in
front of the car.
4) More than 10 trucks intensive cross-work in the field.
Figure 8. Timeline of the key events leading to the explosion fire disaster.
6 Month 2018 Published on behalf of the AIChE
BT Model for Explosion and Fire Accidents
Through combing fault tree and event tree presented in Fig-
ures 3 and 5, BT diagram for explosion and fire accidents in
unloading areas is achieved as shown in Figure 6. There are
three kinds of direct accident causes, namely, oil vapour con-
centration reaches explosion limit, fault or error operation of
the equipment and fire sources. In this BT model, safety pre-
cautions are classified into two categories (I and II). Type I
composes safety barriers preventing the critical event directly.
Type II means organizational barriers, which can reduce fre-
quency of the critical event indirectly. The risk event leads to
four kinds of consequences with different damage extent
depending on success or failure of control measures. Emphasis
should be put on failure branches in order to reduce damage
extent of severe consequences. In the BT diagram presented
in Figure 6, five causes of the failure of emergency evacuation
are distinguished and four reasons for failure of fire-fighting
system are distinguished. Control measures in respect to these
influences leading to failure of safety barriers are correspond-
ingly proposed in this study.
PRACTICAL APPLICATION
Background of Jinyu 6.5 Explosion and Fire Accident
In this section, the established model is used for analyzing
the explosion and fire accident occurring in Jinyu Petrochemi-
cal Co., of China. The plant of Jinyu petrochemical company
in Linyi, Shandong province is about 400 meters long and
222 meters wide. There are nine horizontal oil tanks with the
size of 200 m3 (storing propane, isobutane and pentane oil).
The number of spherical tanks with the volume of 1000, 2000,
and 3000 m3, used to store LPG, are six, respectively. Eighteen
horizontal tanks, storing pentane oil, have the capacity of
Explosion occured after a spark appeared on
the north side of the loading and unloading area.
Jun. 5
0:59:11~01:01:19 Time
Jun. 5 Jun. 5
0:59:10 01:01:20
1) One person ducked in the cab.
2) One person knelt to crawl.
3) Four people were blind to rescue after one person
poisoned.
4) Some people were at a loss and some people
watched around.
DOI 10.1002/prs Process Safety Progress
150 m3. Another six tanks with the storage of 2000 m3 is used
for storing isooctane. Besides, four tanks storing sulfuric acid is
5000 m3 in volume [35]. These tanks are installed on the west
side of the unloading area as shown in Figure 7a.
Propagation flow of the explosion and fire accident is
shown in Figure 8. One LPG truck occurred explosion and fire
phenomenon at around 1 AM on June 5, 2017. According to
the surveillance video [35], evolving process of the accident is
described as follows. The truck stopped in 11th unloading
garage at 00:57:20. Then, the external pipe was linked to the
truck and the pressure inside the truck was increased by a
compressor. With ongoing of the unloading operation, the
gimbal joint between the pipe and truck broke up, resulting in
severe LPG leakage and rapid vapour diffusion. Explosive mix-
ture was thus formed and reached the explosion limit quickly.
One hundred and thirty seconds later, explosion and fire acci-
dent was triggered at the unloading truck. The fire spread
quickly, leading to subsequent explosions of 15 trucks in the
unloading area, and one horizontal oil tank with capacity of
200 m3, two cylindrical tanks with volume of 2000 m3 and six
spherical tanks with volume of 1000 m3 in the tank area on the
west of the unloading area, as shown in Figure 7b. The explo-
sion and fire accident leaded to 10 deaths, 9 injuries, direct
loss of 44.68 million RMB and serious environmental damage
around the industrial site.
Accident Analysis
BT model developed in this study is applied to analyze
Jinyu 6.5 explosion and fire accident. The seal of gimbal joint
between the pipe and oil tank truck was poor, leading to the
leakage of LPG at the joint. As the leaking phenomenon
occurred, explosion and fire accident did not happen within
130 seconds. During this process, unloading operation was not
stopped and the joint seal was not strengthened by unloading
staff in time. Continuous leakage increased the concentration
of petroleum gas in the air, which reached the explosion limit
rapidly. Fire source of the first explosion is the electric spark
triggered by non-explosion-proof electrical apparatus in the
duty room [36]. That means the explosion and fire accident
was resulted from unsealed connection and non-explosion-
proof equipment {aX1X9}. Before and after occurrence of the
first explosion, self-saving consciousness and escape capability
of associated staff were so poor that the best escaping time
was not fully utilized. Most of unloading staff failed to evacuate
from the explosion site in time due to the lack of the knowl-
edge about physical properties of LPG and ignorance about
the leakage. In the subsequent explosions, mass fire was
induced, and the fire hydrants installed in the unloading area
were damaged heavily. Explosion blasts carried fire sources to
oil tank area due to limited distance between the unloading
and tank areas, causing large explosions and serious damage
in the tank area. According to accident analysis using BT
Leakage of gimbal
joint between the
pipe and truck
Oil vapor reaches Jinyu 6.5
explosion and
explosion limit fire accident
Non-explosion-proof
equipment produce
electric spark in duty
room
Figure 9. BT of Jinyu 6.5 explosion and fire accident.
Process Safety Progress Published on behalf of the AIChE
method, the diagram for the explosion and fire accident in
Jinyu group is achieved and presented in Figure 9.
According to the BT diagram presented in Figure 6, there
are four direct (I1–I4) and four indirect (II1–II4) influences in
terms of equipment failure and error operation. In the explo-
sion and fire accident of Jinyu group, leakage of LPG arose
from unsealed connection at the gimbal joint. That means the
connection has not been carefully checked before unloading
operation. Failure of this direct safety precaution (I2) indicates
equipment checking system (II2) and pre-job training system
(II3) are not well-established in Jinyu group. As a result, error
handling measures (II4) cannot be implemented in time after
the leakage has been realized by the staff. The lack of pre-job
training results in inadequate knowledge of the staff engaging
in the unloading works. Besides, emergency management
capacity of the staff is not well-developed. Because of the lack
of associated knowledge and capability, leakage of LPG has
not been stopped timely.
The leaked LPG was not discharged from unloading area
continuously, leading to quick increase of the LPG concentra-
tion in the air. That means capacity of the ventilation system
(I2) installed in the unloading area is too small to promise the
safety of working environment, and the management of the
ventilation system (II2) is poor. At the same time, the staff did
not receive any alarming signal (I3) during rising process of
the LPG concentration, indicating standards of monitoring and
alarming system put forward by the government for petro-
chemical enterprises was not fulfilled in Jinyu group.
As the LPG concentration reaches the limit value, explosion
was triggered by electric spark provided by non-explosion-
proof equipment (I2). That means the management systems
regarding equipment purchase (II2) and in-situ supervision
(II6) are not well-developed.
After the explosion and fire accident has occurred, the staff
in unloading area failed to evacuate in time due to lack of
emergency escape capability. Such incapability is attributed to
the lack of emergency evacuation drill and the staff unfamiliar-
ity with properties of LPG. The former leads to incomprehen-
sion about the evacuation route, and the latter results in bad
escaping behavior of the staff. Daily inspection and mainte-
nance of automatic fire extinguishing equipment has not been
strictly carried out, so that the equipment cannot function
effectively in the emergency. In addition, inadequate design of
the distance between unloading and tank areas aggravated the
spread of local explosion and fire. Failed evacuation and func-
tionless equipment extinguishing system lead to fully devel-
oped fire and heavy casualties in explosion and fire accident
of Jinyu group.
Suggestions for Accident Control
According to BT analysis, suggestions for accident control
are given as the followings.
Emergency Failure Automatic fire Failure Fully developed fire
evacuation extinguishing
-heavy casualty
system
DOI 10.1002/prs Month 2018 7
1. Educational training. Systematic pre-job training is impera-
tive in petrochemical enterprise. For successfully imparting
prerequisite professional skills to the staff, theoretical edu-
cation, in-situ and practical operation should be included in
the training process. In addition, broadcast of previous acci-
dent cases and installation of safety bulletin board can be
applied to popularize safety regulation-related knowledge.
Thus, it can be enforced that associated staff get the skills of
finding and addressing potential dangers as well as emer-
gency evacuation after losing control of the accident.
2. Intelligent monitoring. The concentration of LPG in the air
should be monitored in real-time. The monitoring equip-
ment should be related to alarming and automatic cutting-
off devices installed on the unloading line. These devices
are activated once the concentration of LPG reaches per-
missible maximum value. At the same time, ventilation
installation in unloading area should be strengthened.
3. Equipment management. Associated equipment should be
examined carefully before unloading operation. Ignition
energy necessitated for the mixture of LPG and air is 0.2 mJ.
The magnitude is so small that the energy limit is easily sat-
isfied by electric spark. Thus, all electrical apparatus in the
unloading area should be explosion proof.
4. Safety management. Workflow discipline of unloading
operation should be completed. The regulation must be fol-
lowed strictly during unloading operation. Unloading emer-
gency plan should be established, and emergency exercises
should be carried out regularly considering accident charac-
teristics within unloading area. Thus, the staff can address
the accident calmly and efficiently in the initial stage.
Besides, the plant design should be accomplished by pro-
fessional group. Safety distance between unloading and oil
tank areas must be guaranteed that the explosion and fire
accident can be constrained within the unloading area, and
the damage of the accident can be minimized.
DISCUSSIONS AND CONCLUSIONS
Petrochemical enterprises are prone to LPG leakage during
unloading operations, and fire source would result in explo-
sion and fire accident when the LPG concentration reaches
explosion limit. It is a credible accident scenario because it
includes appreciable probability of occurrence and significant
damage potential [37]. Vapour cloud explosion and subse-
quent fire accidents have great risk of severe damage [38].
Through literature review, the salient features of this approach
study are:
 It visualizes the detailed information of the potential haz-
ards, root causes and consequences for unloading opera-
tion by using a graphical structure.
 It provides importance order of associated events in trigger-
ing risk event.
 It gives the route to eliminate or relieve the potential
danger.
 It provides safety barriers to reduce the damage extent of
unwanted event.
 It realizes classification of accident consequences according
to responses of safety systems.
 It directs the way to improve the safety management of
enterprises to reduce the accident.
Based on advantages of the BT method, in this article, it
was used to analyze influencing factors and potential destruc-
tions associated with explosion and fire accident, and the fol-
lowing conclusions were put forward.
1. BT model was developed for explosion and fire accident in
petrochemical enterprises, encompassing a fault tree on the
left and an event tree on the right. Based on the structural
analysis conducted on basic events, 42 kinds of composite
8 Month 2018 Published on behalf of the AIChE
patterns of the basic events leading to occurrence of the
accident were achieved. Importance degree of primary
events was identified and safety precautions were estab-
lished correspondingly according to structural and sensitiv-
ity analyses.
2. There are two categories of safety barriers being introduced
into the event tree, which are emergency evacuation and
automatic fire extinguishing system. According to the effec-
tiveness, response time and confidence level of the safety
measures, the event tree was divided into four branches at
the last level, including fully developed fire-heavy casualty,
fully developed fire-slight casualty, local fire- heavy casualty
and local fire- slight casualty.
3. With the developed BT model, Jinyu 6.5 explosion and fire
accident was analyzed. Poor connection between the pipe
and oil tank truck and non-explosion-proof equipment
{aX1X9} resulted in the accident. The delayed emergency
excavation and failure of automatic fire extinguishing sys-
tem leaded to fully developed fire and heavy casualty. Sug-
gestions for accident prevention, composed of educational
training, intelligent monitoring, equipment, and safety man-
agements, were given after BT analysis.
ACKNOWLEDGEMENT
The authors gratefully acknowledge the support of the State
Key Research Development Program of China (2016YFC0801402).
LITERATURE CITED
1. Fire Department of Ministry of Public Security. (2017-06-15).
http://www.119.gov.cn/xiaofang/hafx/34542.htm.
2. J.E. Vinnem, FPSO Cidade de São Mateus gas explosion –
Lessons learned, Saf Sci 101 (2018), 295–304.
3. J. Isimite and P. Rubini, A dynamic HAZOP case study
using the Texas city refinery explosion, J Loss Prev Process
Ind 40 (2016), 496–501.
4. R. Ferdous, F. Khan, R. Sadiq, P. Amyotte, and B. Veitch,
Handling data uncertainties in event tree analysis, Process
Saf Environ Prot 87 (2009), 283–92.
5. S. Kaplan, Matrix theory formalism for event tree analysis:
Application to nuclear-risk analysis, Risk Anal 2 (2010), 9–18.
6. N. Ramzali, M.R.M. Lavasani, and J. Ghodousi, Safety bar-
riers analysis of offshore drilling system by employing
Fuzzy Event Tree Analysis, Saf Sci 78 (2015), 49–59.
7. R. Ferdous, F. Khan, R. Sadiq, P. Amyotte, and B. Veitch,
Fault and event tree analyses for process systems risk anal-
ysis: Uncertainty handling formulations, Risk Anal 31
(2011), 86–107.
8. A. Deshpande, Fuzzy fault tree analysis: revisited, Int J Syst
Assur Eng Manag 2 (2011), 3–13.
9. M. Zhang, W. Song, Z. Chen, and J. Wang, Risk assessment
for fire and explosion accidents of steel oil tanks using
improved AHP based on FTA, Process Saf Prog 35 (2016),
260–9.
10. Z. Yuan, N. Khakzad, F. Khan, P. Amyotte, and G. Reniers,
Risk-based design of safety measures to prevent and miti-
gate dust explosion hazards, Ind Eng Chem Res 52 (2013),
18095–108.
11. Z. Yuan, N. Khakzad, F. Khan, and P. Amyotte, Risk analy-
sis of dust explosion scenarios using bayesian networks,
Risk Anal 35 (2015), 278–91.
12. D.A. Moore, Security risk assessment methodology for the
petroleum and petrochemical industries, J Loss Prev Pro-
cess Ind 26 (2013), 1685–9.
13. Z. Bilal, K. Mohammed, and H. Brahim, Bayesian network
and bow tie to analyze the risk of fire and explosion of
pipelines, Process Saf Prog 36 (2017), 202–12.
14. M. Dadashzadeh, F. Khan, K. Hawboldt, and P. Amyotte,
An integrated approach for fire and explosion conse-
quence modelling, Fire Saf J 61 (2013), 324–37.
DOI 10.1002/prs Process Safety Progress
15. M. Kalantarnia, F. Khan, and K. Hawboldt, Dynamic risk
assessment using failure assessment and Bayesian theory,
J Loss Prev Process Ind 22 (2009), 600–6. 28.
16. M. Kalantarnia, F. Khan, and K. Hawboldt, Modelling of
BP Texas city refinery accident using dynamic risk assess-
ment approach, Process Saf Environ Prot 88 (2010), 191–9. 29.
17. N. Khakzad, F. Khan, and P. Amyotte, Dynamic risk analysis
using bow-tie approach, Reliab Eng Syst Saf 104 (2012), 36–44.
18. N. Khakzad, F. Khan, and P. Amyotte, Dynamic safety
analysis of process systems by mapping bow-tie into
Bayesian network, Process Saf Environ Prot 91 (2013), 30.
46–53.
19. N. Khakzad, F. Khan, and P. Amyotte, Quantitative risk
analysis of offshore drilling operations: A Bayesian 31.
approach, Saf Sci 57 (2013), 108–17.
20. M. Abimbola, F. Khan, and N. Khakzad, Dynamic safety
risk analysis of offshore drilling, J Loss Prev Process Ind 30
(2014), 74–85. 32.
21. M. Abimbola, F. Khan, and N. Khakzad, Risk-based safety
analysis of well integrity operations, Saf Sci 84 (2016),
149–60.
22. Z. Yuan, N. Khakzad, F. Khan, and P. Amyotte, Risk analy- 33.
sis of dust explosion scenarios using Bayesian networks,
Risk Anal 35 (2015), 278–91.
23. A. Meel and W.D. Seider, Plant specific dynamic failure 34.
assessment using Bayesian theory, Chem Eng Sci 61
(2006), 7036–56.
24. A. Bobbio, L. Portinale, M. Minichino, and E. Ciancamerla,
Improving the analysis of dependable systems by mapping 35.
fault trees into Bayesian networks, Reliab Eng Syst Saf 71
(2001), 249–60. 36.
25. A.T. Zhou and L.P. Fan, A new insight into the accident
investigation: A case study of Tianjin Port fire and
explosion in China, Process Saf Prog 36 (2017), 362–7. 37.
26. Y. Zhou, X.G. Zhao, J.Y. Zhao, and D. Chen, Research on
fire and explosion accidents of oil depots, Chem Eng Trans
51 (2016), 163–8. 38.
27. D.V. De and C. Fiévez, ARAMIS project: A more explicit
demonstration of risk control through the use of bow-tie
Process Safety Progress Published on behalf of the AIChE
diagrams and the evaluation of safety barrier performance,
J Hazard Mater 130 (2006), 220–33.
M. Vileiniskis and R. Remenyte-Prescott, Quantitative risk
prognostics framework based on petri net and bow-tie
models, Reliab Eng Syst Saf 165 (2017), 62–73.
K.V. Thienen-Visser, D. Hendriks, A. Marsman, M. Nepveu,
R. Groenenberg, T. Wildenborg, H. Van Duijne, M.
Den Hartogh, and T. Pinkse, Bow-tie risk assessment com-
bining causes and effects applied to gas oil storage in an
abandoned salt cavern, Eng Geol 168 (2014), 149–66.
F. Aqlan and E.M. Ali, Integrating lean principles and fuzzy
bow-tie analysis for risk assessment in chemical industry, J
Loss Prev Process Ind 29 (2014), 39–48.
R. Ferdous, F. Khan, R. Sadiq, P. Amyotte, and B. Veitch,
Analyzing system safety and risks under uncertainty using
a bow-tie diagram: An innovative approach, Process Saf
Environ Prot 91 (2013), 1–18.
K. Mokhtari, J. Ren, C. Roberts, and J. Wang, Application
of a generic bow-tie based risk analysis framework on risk
management of sea ports and offshore terminals, J Hazard
Mater 192 (2011), 465–75.
C. Zhang, Y. Wei, Z. Li, and Y. Zhao, Hazard-Based
Design of the Bow-Tie Method to Prevent and Mitigate
Mine Accidents, J Fail Anal Prev 18 (2018), 29–40.
L. Purton, R. Clothier, and K. Kourousis, Assessment of
technical airworthiness in military aviation: Implementa-
tion and further advancement of the bow-tie model, Proce-
dia Engineering 80 (2014), 529–44.
Sohu net. (2017-06-19). http://www.sohu.com/a/
150205017_782508.
Shangdong Province Administration of Work Safety [EB/
OL]. (2017-12-08). http://www.sdaj.gov.cn/index.php?
s=/Article/detail/column/31X/articleid/18615.html.
F.I. Khan and S.A. Abbasi, A criterion for developing credi-
ble accident scenarios for risk assessment, J Loss Prev Pro-
cess Ind 15 (2002), 467–75.
F.I. Khan and S.A. Abbasi, Major accidents in process
industries and an analysis of causes and consequences, J
Loss Prev Process Ind 12 (1999), 361–78.
DOI 10.1002/prs Month 2018 9