Safety Science 64 (2014) 50–59

Contents lists available at ScienceDirect

Safety Science

journal homepage: www.elsevier .com/locate /ssc i

Model for quantitative risk assessment on naturally ventilatedmetering-regulation stations for natural gas

0925-7535/$ - see front matter � 2014 Published by Elsevier Ltd.http://dx.doi.org/10.1016/j.ssci.2013.11.028

⇑ Corresponding author. Tel.: +386 1 47 71 422; fax: +386 1 25 18 567.E-mail address: tom.bajcar@fs.uni-lj.si (T. Bajcar).

Tom Bajcar a,⇑, Franc Cimerman b, Brane Širok a

a University of Ljubljana, Faculty of Mechanical Engineering, Aškerceva 6, 1000 Ljubljana, Sloveniab Plinovodi d.o.o., Cesta Ljubljanske brigade 11b, 1000 Ljubljana, Slovenia

a r t i c l e i n f o a b s t r a c t

Article history:Received 5 April 2013Received in revised form 14 November 2013Accepted 26 November 2013Available online 14 December 2013

Keywords:Natural gasMetering-regulation stationRisk assessmentExplosionJet fire

The paper presents a model for quantitative risk assessment on metering stations and metering-regula-tion stations for natural gas with natural ventilation. The model enables the assessment of risk for peoplewho live in the vicinity of these stations and complements the existing models for risk assessment on nat-ural gas pipelines. It is based on risk assessment methods suggested in relevant guides, recommendationsand standards. Explosion and jet fire are considered as major hazardous events and are modelled accord-ing to analytical models and empirical data. Local or other accessible databases are used for modelling ofevent frequencies and ignition probabilities. A case study on a sample station is carried out. For each haz-ardous event, fault tree and event tree analysis is performed. Results show influence of each hazardousevent on the whole risk relative to the distance from the hazardous source. Ventilation is found to bea significant factor in determination of risk magnitude; its influence on individual risk is presented ina quantitative way. The model should be of use for pipeline operators as well as for environmental-and urban planners.

� 2014 Published by Elsevier Ltd.

1. Introduction

A metering-regulation station (MRS) for natural gas is a facilityfor measurement and regulation of mass flow, pressure and tem-perature of natural gas that is transported through pipelines.MRS objects are thus technologically connected to the transmis-sion pipeline for natural gas and are located at regular intervalsalong the transmission line. Apart from monitoring the gas flowin the transmission pipeline, MRS serves as a gas preparation facil-ity for the distribution pipeline network. In the latter case the gaspressure is reduced and the gas is odourised in MRS before itreaches the end user. Stations where only measurement of gasparameters is carried out are referred to as metering stations (MS).

A pipeline operator manages MRS in accordance with relevantsafety codes and standards.

The presence of natural gas as well as potential ignition sourcesin MS and MRS area represent risk for people and material prop-erty. A hazardous event (i.e. gas leakage and its ignition) on buriedpipeline usually results in jet fire; the latter is a form of fire thatevolves from combustion of gas emerging from an orifice with asignificant momentum (CPR 18E). Other effects such as fireball orflash fire are also possible, but are rare due to the buoyant natureof natural gas and are usually included in the calculation of heat

radiation from a sustained jet fire, which has a predominant reach(Jo and Ahn, 2005). The same event inside MS or MRS building canprovoke explosion of gas–air mixture due to the confinement ofthe flammable cloud. It is the explosion inside the confined MSor MRS object that poses the main risk to the (potentially inhabitedor populated) surroundings of that object.

Risk is generally defined as a measure of severity and likelihoodof damage due to unwanted hazardous events. It is usually ex-pressed in the form of the following equation (CSChE, 2004):

Hazardous event risk ¼ Hazardous event frequency

�Hazardous event consequence ð1Þ

The hazardous event frequency denotes the annual probabilityof the event occurrence, while the hazardous event consequencesdenote the magnitude of damage to the receptors should thatevent occur.

Hazardous event risk is usually expressed in terms of individualrisk. The latter is defined as the probability that in 1 year a personwill become a victim of an accident (hazardous event) if the personremains permanently and unprotected in a certain location (CPR18E, 1999). Assessment of individual risk requires the applicationof quantitative risk assessment (QRA) methods. This is especiallyimportant for determination of proximity distances between MS/MRS objects and residential buildings in order to ensure allowablerisk level for people living in these buildings. Allowable limit risklevel is generally determined by relevant legislation; in Europe,

T. Bajcar et al. / Safety Science 64 (2014) 50–59 51

the generally acceptable value for allowable individual risk level isequal to 1.0 � 10�6/year, which usually applies also for hazardsother than events on natural gas pipelines (Duijm, 2009; Jonkmanet al., 2010). Pipeline operators should therefore assess and man-age individual risk when planning and operating the pipeline andits facilities in order to comply with the legislation. On the otherhand, the acceptable level of societal risk, i.e. the frequency peryear that a group of at least a certain size will at one time becomevictims of an accident (CPR 18E, 1999), is not always prescribed bylegislation. However, the same methods can be applied to evaluateboth types of risk if required.

Despite of the low frequency of hazardous events (i.e. theuncontrolled leak of gas and its subsequent ignition), the pipelineoperator should focus on continuous improvement of safety condi-tions in MS and MRS. The operator is also obliged to carry into ef-fect the operational procedures that enhance the protection ofpeople (employees and third persons) and environment. For thispurpose, it is important for the operator to be capable of assessingthe level of risk in order to deal with it appropriately.

Several codes and standards emphasise the need for risk assess-ment on transmission pipelines with natural gas as well as on pipe-line facilities, such as MS and MSR (ASME, 2004; CSChE, 2004; EN1594, 2000). However, they do not provide sufficient informationor guidelines to calculate or assess the actual risk level, which isparticularly true in the case of QRA. Pipeline operator should there-fore make use of commercial risk models (if available) or developtheir own according to relevant recommendations and guidelinesfor QRA (i.e. CPR 18E, 1999). While basic principles to develop aQRA model for natural gas pipelines are frequently dealt with inrelevant literature (Mather et al., 2001; Jo and Ahn, 2005; Jo andCrowl, 2008; Han and Weng, 2011), it is not so with the modelsfor MS or MRS objects, even though the individual risk in theirvicinity can be considerably higher than those from the buriedpipeline. The operator is left with some guidelines that usually re-sult in qualitative risk assessment only. Ones of the most notableand widely used guidelines of this kind are the IGEM recommenda-tions (IGEM, 2010). They enable the classification of the confinedspace of MS or MRS object into one of several explosion zones;the latter are characterised by the probability of occurrence ofexplosive atmosphere inside the confined MS or MRS object. TheIGEM guidelines are therefore useful for qualitative risk assess-ment for people within the explosive atmosphere (i.e. employeesand workers who are present in MS and MRS objects only atinspection intervals for a few hours), but they cannot be sufficientto predict the distribution of risk levels outside the MR or MRSbuilding for residents in the vicinity of such a facility. While IGEMrecommendations could still be applicable for the determination ofthe hazardous event frequency (Eq. (1)), other parameters, neededfor QRA procedure (i.e. event consequences, ignition probabilitiesetc.), must be modelled or derived from other sources or processes.

The paper focuses on a simple QRA model for MS and MRS thatenables the basic assessment and monitoring of risk levels imposedby hazardous events in MS and MRS objects to the residentsoutside the MS/MRS site.

2. QRA model concept for MS and MRS

An MS or MRS object is usually a closed (confined) building,which comprises the required installations for gas measurementsand regulation. Typical elements that are potential sources of gasleakage in the inner space of a MS/MRS object and should be takeninto consideration in the QRA model are:

– ball valves;– manometric valves;

– pressure regulators (in MRS);– safety block valves;– safety release valves;– check valves;– flanges;– screwed joints.

Apart from gas leakages inside the MRS object, a considerableamount of gas can be released through safety release valves tothe outer atmosphere outside the MRS building. Such releasescan occur during normal operation in case of inlet gas pressurefluctuations or in case of the pressure regulator malfunction or fail-ure. Containers of the gas odouriser that are usually stationed out-side of the plant building can represent another source of leakage.Tetrahydrothiophene (THT) is mainly used in Europe as a gas odor-ant (de Wild et al., 2006). THT is flammable, but due to relative lowamounts and the fact that the odouriser is often not present in theplant (particularly in MS), its influence on overall risk is excludedfrom this study.

Fig. 1 shows the schematic algorithm of the proposed individualrisk model for MS and MRS objects with regard to populated build-ings in the vicinity of MS and MRS.

While the major cause for incidents on natural gas pipelines arethird-party interferences (EGIG, 2011), these are virtually negligi-ble in MS/MRS buildings; therefore, vandalism, terrorist actions,and errors of occasional workers are excluded at this stage. Themain reason is that as opposed to buried pipelines the MS/MRS ob-jects are visible to all and their sites are protected by fence and vi-sual warnings. Inside the MS/MRS buildings the installations areabove ground as well and are regularly inspected by authorisedworkers. However, due to large amount of joints and mechanicallyoperating elements, gas leakages are likely to occur. The main haz-ardous event that can be provoked by gas leakage and its subse-quent ignition in the inner confined space of the MRS object isexplosion (CPR 14E, 2005). Due to confinement inside the building,flash fire could occur only in very early stages of gas release, if ig-nited soon enough, when the confined space is not yet filled withflammable mixture (CPR 18E, 1999); this can be harmful to work-ers inside the building (if present), but would have no effect onpeople outside the MS/MRS building due to small amount of re-leased gas prior to ignition and a short duration of the event. Theinstantaneous ignition of gas (i.e. at the beginning of leakage, whenthe inner space is not yet filled with leaking gas) that could pro-voke a jet fire inside the MRS building is neglected here, for theIGEM guidelines (IGEM, 2010) specify/recommend a hole size forgas leakage calculations not greater than 0.25 mm2; heat radiationof a jet fire from such a small hole would be negligible even at gaspressures above 100 bar.

The exhaust pipes for the released gas from safety release valvesare normally mounted on the outside wall surface of the MRS ob-ject. The gas pressure fluctuations during normal operation causeonly small amounts of released gas for very short periods (usuallynot longer than a few seconds) and are therefore excluded fromthis study. On the other hand, the failure of a pressure regulatorcan force large amounts of gas to be released continuously forlonger time period through the safety release valve to the outeratmosphere (comparable to a gas jet from a hole in a gas pipeline).Since the release orifice of a safety release valve has a diameter ofseveral tens of millimetres, a jet fire can occur from the exhaustpipes with a heat radiation that cannot be neglected. Risk assess-ment regarding MRS buildings is therefore required for both,inner- and outer space. An MS object does not have any regulators,so the occurrence of a jet fire on the outer wall of the MS building isexcluded from the study.

Analyses of consequences and frequencies of hazardous eventsfor QRA require the application of relevant relations, equations or

Fig. 1. Flow chart algorithm for QRA model for MS and MRS objects.

52 T. Bajcar et al. / Safety Science 64 (2014) 50–59

models. Note that the majority of the models, including those pre-sented in this paper, are empirical and/or simplified to a certain de-gree in order to facilitate the calculations. These attributes areinevitably connected with potential uncertainties of the resultsthat may affect the risk assessment. However, whenever possible,the presented models tend to overestimate the risk from consid-ered risk sources, rather than underestimate it, so the results canbe regarded as fairly conservative.

2.1. Analysis of consequences

The purpose of the analysis of consequences is to assess theamount of damage to people in the case of a hazardous event(i.e. pressure rise following a blast/explosion or thermal radiationfrom a jet fire). Here, the consequences are modelled using math-ematical models. Input data include physical and chemical proper-ties of natural gas as well as properties of the system that containsnatural gas.

Modelling of consequences usually comprises of the followingsteps (CSChE, 2004):

– Modelling of the source: quantity and state of released gas ismodelled as a function of time, the sequence of mitigating mea-sures (if present) as well as the sequence of potential hazardousevents that follow the gas release.

– Modelling of the hazardous level: such a level is modelled withthe dependence of the event duration and/or the location ofthe recipients (i.e. people in the vicinity).

– Modelling of the damage level: this is modelled according to thehazardous level assessed on the location of the recipient.

Each of these steps will be briefly discussed in order to highlightthe essential information and data needed for the proposed QRAmodel.

2.1.1. Modelling of the sourceThe stoichiometric mixture of the natural gas–air mixture is

used in modelling, which is a standard practice assuming maxi-mum amount of gas that is trapped inside the MS or MRS buildingwill ignite and thus contribute to the magnitude of explosion. Inthe stoichiometric mixture, exactly enough air is provided to com-pletely burn all of the trapped natural gas. In this conservativecase, the maximum amount of gas that is trapped inside the MSor MRS building will ignite and thus contribute to the magnitudeof explosion. Mass me of the natural gas involved in the hazardousevent (explosion) can be calculated by the following expression:

me ¼ g � V � qng ; ð2Þ

where g denotes stoichiometric rate of natural gas in the air (invol.%), V is inner volume of the MS/MRS building, and qng denotes

T. Bajcar et al. / Safety Science 64 (2014) 50–59 53

natural gas density at the conditions specified by the MS/MRSbuilding’s inner space.

In the case of the gas jet from the exhaust pipes of safety releasevalves, the approximate natural gas mass outflow rate Q (with theassumption of the gas flow velocity equal to the speed of sound)can be calculated from the following equation (Jo and Ahn, 2005):

Q ¼ p � d2 � a4

ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffij � qo � po

2jþ 1

� �jþ1j�1

s; ð3Þ

where d denotes the diameter of the valve seat, j is the ratio of spe-cific heats of natural gas, qo denotes the natural gas density at oper-ation conditions, po denotes the stagnation pressure at operatingconditions (conservatively in the high-pressure part, i.e. beforethe pressure reduction in the pressure regulator), and a denotesthe coefficient of discharge. Values of a are usually between 0.97and 1 (IGEM, 2010).

2.1.2. Modelling of the hazardous levelEffects of the pressure rise due to explosion on people depend

on the highest pressure level at the location of the recipient. Expo-sure to higher pressure levels can be lethal. However, the explosionoverpressure level can be low enough not to damage a person di-rectly, but it can still damage buildings and this can in turn damagepeople inside them. According to CPR 18E (1999), the duration of ahigh pressure level is not relevant for the calculation of explosioneffects; it is therefore assumed that people, who are exposed tothe explosion overpressure, do not have enough time to seekshelter.

There are two limit values of explosion overpressure for people(CPR 18E, 1999; CPR 14E, 2005): p0.3 = 0.3 bar and p0.1 = 0.1 bar. Atpressure levels above p0.3 the probability of death is estimated tobe 100%, while below p0.1 it is estimated to be 0.

If the quantity of explosive substance (i.e. natural gas) is known,the distances from the centre of explosion to both limit pressurelevels can be calculated using the so-called multienergy method(CPR 14E, 2005):

r0:3 ¼ 1:5 � me � Hc

pa

� �1=3

; ð4Þ

r0:1 ¼ 3 � me � Hc

pa

� �1=3

; ð5Þ

where r0.3 and r0.1 are distances to pressure levels p0.3 and p0.1,respectively. pa denotes the ambient pressure (usually atmosphericpressure), while Hc denotes the heat of combustion of natural gas inthe flammable mass me (Eq. (2)). For MR or MRS buildings, theexplosion is conservatively assumed to be strong enough to crashthe walls; therefore no deflections or mitigation of pressure leveldue to obstacles is considered in this phase.

Effects of heat radiation of jet fire on people depend on heat fluxdensity of jet fire and on duration of exposure to the heat radiation.In order to calculate heat flux from a jet fire, the shape of the lattershould be determined (CPR 14E, 2005). In the simplest and mostconservative form, it can be assumed that the heat flux source froma jet fire concentrates in a point at the ground surface level (Jo andAhn, 2005). Note that such an assumption results in some error(overprediction), but avoids time-consuming calculations and of-fers a readily available equation for end users. Radiation heat fluxdensity I can hence be determined by a simple relation:

I ¼ e � sa � Q � Hc

4 � p � r2 ; ð6Þ

where e denotes the ratio between radiation heat and all the heatthat evolves in the process of combustion; it is determined experi-mentally and amounts e = 0.2 for methane (Jo and Ahn, 2005). Q

denotes the mass flow rate of the leaking gas, Hc is the heat ofcombustion of natural gas and r is the distance from the heat sourceto the location of recipient. sa denotes the atmospheric transmissiv-ity; it depends on the quantity of water vapour in the air (CPR 14E,2005):

sa ¼ 2:02 � ðpv � h � rÞ�0:09

; ð7Þ

where pv denotes the saturation pressure of water vapour, h de-notes the relative humidity and r the distance from the heat source.

2.1.3. Modelling of the damage levelDamage level of a hazardous event to recipients is assessed

through the probability of death P. If a hazardous event is an explo-sion, the overpressure po at the location of the recipient determinesthe probability of death, as was already mentioned in the premises.The following relations should be valid according to CPR 18E(1999):

(a) po > p0.3 : P = 1;(b) p0.3 > po > p0.1 : P = 0 for persons outside buildings and

P = 0.025 for persons inside buildings;(c) po 6 p0.1 : P = 0 for all persons.

There has been some discussion regarding the accuracy of theprobabilities of death in CPR 18E (1999), particularly in the regionp0.3 > po > p0.1, where a certain lack of rigorousness is detected incomparison to other proposed pressure models (Cavanagh, 2010).In order to increase the conservativeness of CPR 18E relationships,a linear drop in P (proportional with the distance) between p0.3 andp0.1 is proposed in this paper.

When a hazardous event is in the form of a jet fire, probit func-tions are usually applied for the assessment of the damage level.Probit functions connect the probability of death with the proba-bility unit Pr; the latter comprises the relationship between thedose of heat and consequences on the recipient (death) (CPR 18E,1999; CSChE, 2004). Distribution of the probability of death canthen be assessed with the following equation:

P ¼ 1ffiffiffiffiffiffiffiffiffiffi2 � pp

Z Pr�5

�1e�

x22 dx; ð8Þ

where the argument Pr denotes the probability unit and x equals(Pr � 5)/r with a standard deviation r = 1. The probability unit Prfor heat radiation of a jet fire is determined as (CPR 18E, 1999):

Pr ¼ �14:9þ 2:56 � ln te � I34

104

!; ð9Þ

where I denotes the radiation heat flux at the location of recipientand te the exposure time. The exposure time denotes the expectedamount of time, which in the case of the hazardous event is neededfor people to seek shelter from the direct exposure to the heat radi-ation. Value of te is usually limited to 20 s (CPR 18E, 1999).

2.2. Analysis of frequencies

In order to assess the frequency of a particular hazardous eventinside or outside of MS/MRS buildings the frequency of unwantednatural gas release Fc from particular elements must be knownfirst. Occurrence of a gas jet from the exhaust pipes of safety re-lease valves depends on the pressure regulator failure as describedabove. The frequency of the latter is therefore the frequency of thegas jet and can be determined from relevant historic databases(Lees, 2005).

The frequency of explosions inside the building of MS/MRSdirectly depends on the frequency of the presence of flammablesubstances (i.e. the explosive atmosphere) in the inner space of

Table 1Statistical number of unwanted gas releases per year for particular equipmentelements. (source: IGEM, 2010).

Type of element Release frequency (year�1)

Regulator diaphragm 0.005Rising valve stem 0.005Rotating valve stem 0.001Screwed fitting 0.001Screwed fitting, sealed 0.0008Flanges 0.0005Compression joints 0.00005

Table 2Number of simultaneous releases according to the sum S. (source: IGEM, 2010).

Value of S Number of simultaneous releases for zone 2

S 6 0.001 10.01 P S > 0.001 20.05 P S > 0.01 30.1 P S > 0.05 41.0 P S > 0.1 Enclosed space classified as zone 1S > 1.0 Enclosed space classified as zone 0

54 T. Bajcar et al. / Safety Science 64 (2014) 50–59

MS/MRS building. Calculation of explosion frequencies will be ex-plained here mostly in accordance with IGEM recommendations(IGEM, 2010). However, other applicable and relevant recommen-dations or standards can be used for this purpose with similarresults.

According to references (Marangon and Carcassi, 2006; IGEM,2010), there are three basic explosive zones in enclosed spaces,which can be classified by the annual probability of presence ofthe explosive atmosphere (Fc):

– zone 0: Fc > 0.1 year�1;– zone 1: 0.1/year P Fc > 0.001 year�1;– zone 2: 0.001/year P Fc > 0.00001 year�1;

Zone 0 comprises the areas where the explosive atmosphere asa mixture of flammable gas and air is present constantly or fre-quently for longer periods. The cumulative annual duration ofthe explosive atmosphere exceeds 1 month.

Zone 1 includes the areas where during normal operation theexplosive atmosphere is likely to occur occasionally.

Zone 2 is the areas where during normal operation the explo-sive atmosphere is not likely to occur; if it occurs, it exists for ashort period only (cumulatively less than 10 h/year).

It is obvious that from the risk mitigation point of view thepipeline operator should strive for zone 2 inside MS/MRS buildings.

The probability of presence of the explosive atmosphere (and,consequently, the type of the explosive zone) inside MS/MRS build-ings generally depends on the following factors (IGEM, 2010):

– grades of gas release;– number and frequency of release of a particular element/

source;– level of ventilation.

Sources of release of natural gas inside MS/MRS buildings suchas flange pairs, joints and screwed fittings, regulator diaphragms(in MRS) and valve glands are considered as secondary grade re-leases (IGEM, 2010). That means that gas leaks are expected to oc-cur rarely and only for short time periods. However, this is usuallynot enough to enable zone 2 inside the building, for the establish-ment of zone 2 depends on other factors as well.

2.2.1. Number and frequency of release of a particular sourceEach element in MS or MRS that is involved in natural gas trans-

port, pressure regulation and/or flow rate measurements has itsown statistical probability of leakage. In MS/MRS with large num-ber of such elements the unwanted gas releases are expected tooccur more often than in stations with small number of elements.Apart from that, simultaneous releases from several elements canbe expected. Inspection intervals for a particular element playimportant role in reducing gas release frequency; these intervalsshould not exceed 6 months in order to establish zone 2 insideMS/MRS buildings (IGEM, 2010).

Table 1 shows statistical values for release frequencies ofelements inside MS/MRS buildings.

For assessment of simultaneous gas releases the followingequation should be applied (IGEM, 2010):

S ¼X

i

ðfi � Dti � niÞ; ð10Þ

where i denotes the type of gas releasing element, fi is the releasefrequency of a certain element of type i, Dti is the inspection inter-val for that element (in number of years between two inspections)and ni denotes the number of all elements of type i in the MS/MRSbuilding. The number of simultaneous releases for zone 2 dependson the sum S (Eq. (10)) as shown in Table 2. When the sum S

exceeds the value of 0.1, the enclosed space of the MS/MRS buildingcannot be classified as zone 2.

While the failure frequency of a particular element fi usuallycannot be changed (it is statistically determined for a particulartype of element) as well as the number of elements ni in a partic-ular MS/MRS, the sum S can be lowered by decreasing the inspec-tion interval Dti. Note that inspections assume the presence ofauthorised personnel that is properly trained for the required tasksand performs its duties in accordance with relevant regulations.The pipeline operator is usually obliged for adequate personneltraining and to maintain its degree of practice. Otherwise, theauthorised personnel in MS or MRS would represent anothersource of risk due to human factor. The latter is mainly the conse-quence of inadequate training or a drop in quality of performingduties over time, but can also be provoked by emotional or psycho-physical state of a certain person. Such cases are rare in MS/MRSand while they can have their impact on overall risk, it is usuallyof lesser extent than other risk sources mentioned here.

Number of simultaneous releases (Table 2) influences the massflow of leaking natural gas that escapes from the simultaneouslyleaking equipment elements (sources) into the enclosed space ofthe MS/MRS building. The mass flow of gas (Q) from each of thesimultaneously releasing elements can be determined by the fol-lowing equations (IGEM, 2010):

Q ¼ 675 � Cd � A �M0:5 � T�0:5 � ðpþ 1:013Þ1:05

for operating gas pressure � 0:85 bar;ð11Þ

Q ¼ 1500 � Cd � A �M0:5 � T�0:5 � p0:5

for operating gas pressure < 0:85 bar;ð12Þ

where A denotes the area of the gas release orifice, Cd is the dis-charge coefficient; the value Cd can be taken as 0.8 for all elementsexcept the safety release valve orifices (as stated above) (IGEM,2010). M denotes the molar mass of the natural gas, T is the naturalgas temperature and p the operating gas pressure.

The sum of Q of all simultaneous gas releases represents thewhole mass flow of released natural gas, which serves for the cal-culation of the ventilation adequacy. The latter is important for theassessment of the frequency of occurrence of the explosive atmo-sphere in the enclosed space of the MS/MRS building.

2.2.2. Influence of ventilation on event frequencyVentilation represents the movement of air through enclosed

spaces and therefore the exchange of atmosphere with fresh air

Fig. 2. Ignition probabilities for natural gas releases in small and large facilities.(source: RADD, 2010).

T. Bajcar et al. / Safety Science 64 (2014) 50–59 55

in areas such as the inner space of MS/MRS buildings. The airmovement around the elements that release natural gas can sub-stantially impact the classification of the enclosed space in one ofthe explosion zones. Generally, MS and MRS buildings are naturallyventilated. That implies that the air movement in the enclosedspace is caused by buoyancy and/or wind.

Recommendations such as IGEM (2010) divide the adequacy ofventilation into four tiers:

– Poor ventilation: expected bulk concentration of flammable gasin the enclosure exceeds 50% of lower flammable limit (LFL);

– Less-than-adequate ventilation: expected bulk concentration offlammable gas in the enclosure exceeds 25% LFL, but is lowerthan 50% LFL;

– Adequate ventilation: expected bulk concentration of flammablegas in the enclosure is equal to or less than 25% LFL;

– More-than-adequate ventilation: expected bulk concentration offlammable gas in the enclosure is equal to or less than 10% LFL.

In enclosed spaces such as MS or MRS buildings, the poor ventila-tion is referred to as zone 0, the less than adequate ventilation tozone 1, the adequate ventilation to zone 2 and the more than ade-quate ventilation to zone 2NE. The definition of the latter is similarto the definition of zone 2, except that the explosive atmosphere(if it occurs) in zone 2NE is expected to be of negligible extent.

Natural ventilation at relatively low wind speeds dependsmainly on buoyancy. If the ventilation is supplied in at least twowalls of the enclosed space, then the required free ventilation areaAp to achieve zone 2 should be at least as large as the required freeventilation area Ab,25 to achieve adequate ventilation (IGEM, 2010):

Ap P Ab;25 ¼ 1964 � Q � L�0:5h ; ð13Þ

where Q denotes the whole mass flow of released gas from simulta-neous releases and Lh denotes the vertical distance between thecentres of the upper and lower ventilation openings. An upper mar-gin for zone 2 represents the required area for more-than-adequateventilation Ab,10:

Ap P Ab;10 ¼ 7762 � Q � L�0;5h : ð14Þ

A ventilation area equal to or higher than Ab,10 corresponds tozone 2NE. Buoyancy ventilation is less than adequate, but not poor(zone 1), when the ventilation area Ap suits the following expression:

Ab;25 > Ap P Ab;50; ð15Þ

where Ab,50 denotes the lower margin of the ventilation area forzone 1. Below that margin, the ventilation is poor and the enclosedspace with such ventilation is classified as zone 0:

Ap < Ab;50 ¼ 694 � Q � L�0;5h : ð16Þ

Apart from Eq. (16), the following condition is also applicablefor poor ventilation and hence zone 0 (IGEM, 2010):

Ap < 0:02 � AF ; ð17Þ

where AF denotes the floor area of the enclosed space. The conditionfor zone 0 is the lesser of the two Eqs. (16) and (17).

2.3. Ignition probability

Described consequences of an unwanted natural gas release canoccur only if the flammable mixture of natural gas and air is ig-nited. The probability of ignition of such a mixture depends onthe presence of ignition sources and mass flow of the releasedgas (CPR 18E, 1999; RADD, 2010). Although the ignition sourcesare not intentionally foreseen for MS/MRS, one might expect theiroccasional presence due to failures or malfunctions of the equip-

ment (i.e. the malfunction of electrical systems, lightning strikeor even human factor). Fig. 2 shows the ignition probabilities Pv

of released gas in small (area up to 1200 m2) and large facilities(area above 1200 m2) according to the mass flow rate Q of thereleased gas (RADD, 2010).

According to Eq. (1) the individual risk IR for people in thevicinity of MS/MRS objects can then be assessed via the followingexpression:

IR ¼ ðP � Fc � PvÞin þ ðP � Fc � PvÞout; ð18Þ

where indexes in and out refer to the inner (enclosed) space andouter exhaust, respectively, of the MS/MRS building.

3. QRA in MRS – a case study

QRA procedure presented above were used in a case study of asample MRS. The chosen MRS building was naturally ventilated,with three pressure regulation lines for natural gas in the building:

– a single stage regulation line from 50 bar to 29 bar;– a single stage regulation line from 29 bar to 20 bar;– a double stage regulation line from 50 bar to 10 bar and from

10 bar to 1 bar.

Each regulation line is doubled to insure continuous gas supplyin the case of a (single) regulation line malfunction. Exhaust pipesare mounted on the outer wall of the building and conduct releasedgas from safety release valves to the outer atmosphere.

Table 3 shows the dimensions of the MRS building, while Table 4includes types of equipment elements that can release gas alongwith their number inside the building. The inspection interval foreach equipment element is 1 month (Dt = 0.083 year).

Natural gas is mostly composed of methane. Methane proper-ties used in the study as approximated natural gas properties arethe following:

– density (at 293 K and 101.3 kPa): qng = 0.668 kg m�3;– combustion energy: Hc = 5.002.107 J kg�1;– stoichiometric rate for combustion: g = 9.5 vol.% (Bjerketvedt

et al, 1997).

These data were used for assessment of risk due to hazardousevents inside and outside of MRS building, which are theconsequences of gas releases from the equipment that is locatedinside the MRS building.

Table 3MRS building dimensions.

Volume of the inner space 308.00 m3

Floor area of the inner space 70.00 m2

Free area of lower ventilation openings 1.00 m2

Free area of upper ventilation openings 0.74 m2

Distance between centres of lower and upper ventilationopenings

3.60 m

Table 4Type and number of equipment elements that canrelease gas in MRS building.

Type of element No. of elements

Ball valve 75Manometric valve 17Pressure regulator 8Safety block valve (SBV) 8Safety release valve (SRV) 6Check valve 8Flange 100Screwed joint 128

56 T. Bajcar et al. / Safety Science 64 (2014) 50–59

Consequences of gas releases and their potential ignition insidethe enclosed space of MRS building are indicated by the probabilityof death due to explosion. This can be assessed via the limit pres-sure levels (Eqs. (4) and (5)). In the most conservative case, wherethe stoichiometric concentration of natural gas in the enclosedspace is considered, the amount of natural gas involved in anexplosion can be determined via Eq. (2); it amounts to 19.55 kg.Limit pressure levels are then:

r0:3 ¼ 31:9 m;

r0:1 ¼ 63:9 m:

Up to the distance of 31.9 m from the centre of explosion theprobability of death equals P = 1. It then gradually drops until thedistance of 63.9 m is reached, where P = 0.025 (for people insidebuildings in the vicinity of MRS site). Above this value, P = 0 forall people regardless of their shelter. It is evident from Eqs. (2),(4), and (5) that in the case of chosen hazardous substance (i.e. nat-ural gas) the distances r0,3 and r0,1 depend on the volume V of theinner enclosed space of the MRS building, where ½r0:3; r0:1� /

ffiffiffiffiV3p

.The centre of explosion was assumed to be in the centre of the

explosive cloud (CPR 14E, 2005). If the enclosed space of the MRSbuilding is filled with air–natural gas mixture, the distance fromthe centre of the explosion cloud roughly equals the distancefrom the centre of the enclosed space. The other (most conserva-tive) assumption is that the centre of explosion is as close to thepotential recipient as possible; in that case the distance from thecentre of explosion equals the distance from the walls of the MRSobject.

The frequency of explosion inside the MRS building was as-sessed through the classification of enclosed space of the MRSbuilding into one of explosive zones presented in Section 2.2. Toachieve this task, the number of simultaneous gas releases shouldbe determined first. The sum S (Eq. (10) and Table 1) in this caseequals S = 0.039. According to Table 2 this implies 3 simultaneousgas releases. Conservatively and in accordance with recommenda-tions (IGEM, 2010) the simultaneous gas releases should be dividedamongst the highest pressure levels in the system, that is 50 bar,29 bar and 20 bar in this case. The sum of all three gas releases(Eq. (11)) amounts to:

Q sum ¼ Q50bar þ Q29bar þ Q20bar ¼ 3:94� 10�3 kg s�1:

The whole free ventilation area of the MRS building amounts to1.74 m2 (Table 3). With the calculated Qsum the inner space ofthe MRS building is classified as zone 1 (Eqs. (13)–(16)); the

ventilation is therefore less than adequate, but not poor. Usinglinear interpolation for the explosive atmosphere probability Fc

between Ab,50 (Fc = 0.1 year�1) and Ab,25 (Fc = 0.001 year�1), weobtain for the presented MRS object the following value:

Fc ¼ 0:089 year�1:

Fig. 3 shows the fault tree for the occurrence of explosive atmo-sphere inside the MRS building due to the natural gas releases andthe presence of inadequate ventilation.

The mass flow of simultaneous gas releases Qsum is low(<0.1 kg s�1) and so is the probability of ignition (Fig. 2), which inthis case amounts Pv = 0.001. Fig. 4 presents the event tree in caseof the occurrence of explosive atmosphere inside the MRS building.

Outside of the MRS building the jet fire from safety release valveexhausts poses the main risk for people in the vicinity. In the caseof pressure regulator malfunction and simultaneous block valvefailure, the quantity of gas leaving through safety release valvecan be substantial and its mass flow rate much higher than inthe case of expected gas releases inside the MRS building.

Four doubled pressure regulation lines are considered (50 bar/29 bar, 29 bar/20 bar, 50 bar/10 bar and 10 bar/1 bar) with thediameter of safety release valve orifice equal to d = 20 mm. Themass flow rates from safety release valves in each regulation linein the case of pressure regulator and safety block valve failureare according to Eq. (3) the following:

Q50 bar=29 bar ¼ Q 50 bar=10 bar ¼ 2:732 kg s�1;

Q29 bar=20 bar ¼ 1:607 kg s�1;

Q10 bar=1 bar ¼ 0:589 kg s�1:

In each regulation line the highest pressure in the line is consid-ered for the mass flow rate calculation. Application of Eqs. (6)–(9)yields the distribution of probability of death P in the case of jet firealong the distance from the heat source (i.e. at the exhaust pipeorifice) as shown in Fig. 5. It is evident from Fig. 5 that the distancefrom heat source to P = 0 grows with rising natural gas pressure inregulation lines.

Frequency of pressure regulator failure, gathered from local sta-tistical data, equals f = 3.1 � 10�2 year�1. In most such cases thesafety block valve prevents the high-pressure gas to reach thelow-pressure line and safety release valve. Natural gas releasethrough the latter occurs either during normal operation (very rareand of short duration due to pressure fluctuations with insignifi-cant consequences) or when the safety block valve fails to operatein the case of pressure regulator malfunction. According to pub-lished statistical data (Blanton and Eide, 1993; LaChance, 2009),the expected frequency of safety block valve failure isf = 3.0 � 10�3/demand. The expected annual failure frequency ofboth, pressure regulator and safety block valve, is therefore equalto Fc = 9.3 � 10�5 year�1; this is therefore also the frequency oflarger natural gas releases through the safety release valve to theouter atmosphere.

Fig. 6 shows the fault tree for the outside part of MRS object foreach regulator-safety release valve pair.

Ignition probabilities Pv for each mass flow rate are the follow-ing (according to Fig. 2):

Pv;50 bar ¼ 0:0106;

Pv;29 bar ¼ 0:0055;

Pv;10 bar ¼ 0:0020:

The event tree for gas release outside the MRS building is shownin Fig. 7.

Fig. 3. Fault tree in inner enclosed space of MRS building.

Fig. 4. Event tree for explosive atmosphere inside MRS building.

Fig. 5. Probability of death P for jet fire at different natural gas pressures (regulation lines) with distance from heat source.

T. Bajcar et al. / Safety Science 64 (2014) 50–59 57

Individual risk due to inner (explosion) and outer (jet fire) eventfor people in the vicinity of MRS object is shown in Fig. 8a and b,respectively. Combined individual risk for people in the vicinityof the MRS object is the sum of risks due to the events insideand outside of the MRS building (Eq. (18)). Its distribution alongthe distance from the centre of explosion and from the heat source

(exhaust pipe orifices for all regulation lines involved) is shown inFig. 8c. Note that the combined diagram depicted in Fig. 8c repre-sents the worst (i.e. most conservative) scenario, where the centreof explosion is assumed to be at the wall that is the nearest to therecipient and the safety release valve exhaust orifices are mountedon that same wall.

Fig. 6. Fault tree for outside space of MRS building.

Fig. 8. Individual risk due to events at MRS building; (a) – risk due to explosion(inner event); (b) – risk due to jet fire (outer event); (c) – combined risk (inner andouter events).

58 T. Bajcar et al. / Safety Science 64 (2014) 50–59

Based on results presented in Fig. 8 it can be concluded that atgiven properties and operating conditions of the MRS building themain concern is presented by risk due to explosion. It is by farhigher than the risk due to jet fire (Fig. 8b) and has a larger influ-ence area (judged by the distance where the individual risk valuedrops to zero). In the presented case the limit value IR = 1 � 10�6 -year�1 is reached at the distance of about 64 m from the centre ofexplosion. This means that for given MRS conditions the residentialbuildings should not be located closer than this to the MRS build-ing, if the acceptable level of individual risk on residential build-ings is to be maintained. Note again that in accordance with thepreviously addressed accuracies the presented result incorporatesthe potential uncertainties of all the models used and can be con-sidered rather conservative within the limits of incorporated risksources.

Distances to residential buildings can be smaller in the case ofadditional risk mitigation measures taken on the MRS site. Sincethe explosion in the inner enclosed space of the MRS building isthe hazardous event that poses the major part of risk for people inthe vicinity, it is reasonable to consider mitigation measures that re-fer to this event. One of the easiest and most efficient ways to influ-ence the risk of explosion is to change the frequency of occurrence offlammable atmosphere by alteration of ventilation conditions.

The inner enclosed space of the sample MRS building is classi-fied as explosive zone 1 as shown above. To achieve the explosivezone 2 in the building, the whole free ventilation area should be

Fig. 7. Event tree for gas releas

increased from Ap = 1.00 + 0.74 = 1.74 m2 (Table 3) to at leastA0p = Ab,25 = 4.09 m2 (Eq. (13)). The resulting individual risk distri-bution for MRS object with enlarged ventilation area A0p is shownin Fig. 9.

e outside of MRS building.

Fig. 9. Individual risk due to inner and outer events in MRS building with enlargedventilation area to reach explosive zone 2 in inner enclosed space.

T. Bajcar et al. / Safety Science 64 (2014) 50–59 59

Limit risk level IR = 1.0 � 10�6 year�1 is with the enlarged ven-tilation area reached at the distance of 15 m from the heat source.The risk due to explosion can be further mitigated by enhancingthe ventilation. Theoretically, the ventilation can reduce risk tillthe upper margin of zone 2 (i.e. zone 2NE) is reached. In this case,the individual risk due to explosion in the enclosed space of thesample MRS would not exceed the value IR = 1.0 � 10�8 year�1,but the needed free ventilation area would amount at least toA0p = Ab,10 = 16.13 m2.

Note that Fig. 9 shows only the risk level imposed by MRS ob-ject. Actual risk level for the residents in the vicinity may be higherfor the portion of risk due to the natural gas pipelines that trans-port natural gas to and from the MRS site.

4. Conclusions

A simplified model for assessment of individual risk due to haz-ardous events in naturally ventilated MS and MRS buildings forpeople in the vicinity of these objects is proposed and presentedin the study. The applied QRA method is based mainly on relevantEuropean and international guidelines and recommendations aswell as on some local findings and databases. Input parametersfor QRA procedure comprise geometric specifications of MS/MRSbuildings, natural gas parameters, types and number of equipmentelements as well as ventilation properties of MS/MRS buildings.Both inner and outer gas releases from the hazardous event insideMS/MRS building are considered. Consequences of natural gas re-leases are modelled as a probability of death due to pressure risefrom explosion or due to thermal radiation from jet fire. In orderto achieve this, some conservative assumptions are considered.These comprise the speed of sound of the leaking gas at the orifice,the source of heat at the ground level, the ignition of a stoichiom-etric natural gas concentration, the linear drop of the death proba-bility value between the limit pressure levels, and no pressuremitigation due to the building walls. Hazardous event frequenciesand ignition probabilities are derived according to the known fail-ure frequencies, number of leaking elements and amount of re-leased gas. The final result of the presented model is attainedthrough fault tree/event tree analysis and is presented as a spatialdistribution of individual risk along the distance from the hazard-ous event.

The obtained results of the model on a sample MRS buildingshow that the hazardous event outside of the MRS building (jet firefrom safety release valve exhausts) can pose substantial risk onlyin the direct vicinity of the MRS building. Its heat radiation causes

harm only in the relatively close surroundings of the heat source.This fact is due to relatively small safety release valves orifice(seat) diameter that suppresses the amount of released gas. Onthe other hand, the hazardous event inside the MRS building(explosion) can have much broader effective range; the latter isproportional to the cube root of the inner volume of the MRS build-ing. For a certain MS/MRS object, this range cannot be changedwithout geometric alterations of the building. However, the indi-vidual risk magnitude can be substantially lowered by introducingrisk mitigation measures. One of the most effective is the enhance-ment of ventilation.

The proposed model can be further upgraded to include theinfluence of human factors and other risk mitigationmethods (such as MS/MRS building walls and additional barrierwalls). In the present state, used simultaneously with somepipeline risk assessment methods, it should be of use for riskmanagement during the introduction of a new MS/MRS site intothe environment, for modification of existing sites or for urbanplanning.

References

ASME, 2004. Gas transmission and distribution piping systems. ASME B31 (8), 2004.Bjerketvedt, D., Bakke, J.R., van Wingerden, K., 1997. Gas explosion handbook. J.

Hazard. Mater. 52 (1), 1–150.Blanton, C.H., Eide, S.A., 1993. Savannah River Site Generic Data Base Development,

WSRC-TR-93-262. Chemical Process Technology, Savannah River Site, Aiken,South Carolina.

Cavanagh, N.J., 2010. Recent advances in software for modelling the risks associatedwith gas explosions in congested spaces using the Multi Energy Method. In:13th International Symposium on Loss Prevention and Safety Promotion in theProcess Industry, 06/06/2010–09/06/2010, Brugge, Belgium, p. 459.

CPR 14E Yellow Book, 2005. Methods for the Calculation of Physical Effects.Committee for the Prevention of Disasters, The Hague.

CPR 18E Purple Book, 1999. Guidelines for Quantitative Risk Assessment.Committee for the Prevention of Disasters, The Hague.

CSChE, 2004. Risk Assessment – Recommended Practices for Municipalities andIndustry. Canadian Society for Chemical Engineering, Ottawa.

de Wild, P.J., Nyqvist, R.G., de Bruijn, F.A., Stobbe, E.R., 2006. Removal of sulphur-containing odorants from fuel gases for fuel cell-based combined heat andpower applications. J. Power Sources 159 (2), 995–1004.

Duijm, N.J., 2009. Acceptance criteria in Denmark and the EU. Technical Report.Technical University of Denmark, Copenhagen.

EGIG (European Gas Pipeline Incident Data Group), 2011. Gas Pipeline Incidents, 8thReport 1970–2010.

EN 1594 EU Standard, 2000. Gas supply Systems – Pipelines for MaximumOperating Pressure Over 16 Bar – Functional Requirements.

Han, Z.Y., Weng, W.G., 2011. Comparison study on qualitative and quantitative riskassessment methods for urban natural gas pipeline network. J. Hazard. Mater.189 (1–2), 509–518.

IGEM (Institution of Gas Engineers and Managers), 2010. Hazardous AreaClassification of Natural Gas Installations, IGEM/SR/25, Ed. 2, IGEM House,Kegworth.

Jo, Y.-D., Ahn, B.J., 2005. A method of quantitative risk assessment for transmissionpipeline carrying natural gas. J. Hazard. Mater. 123 (1–3), 1–12.

Jo, Y.-D., Crowl, D.A., 2008. Individual risk analysis of high-pressure natural gaspipelines. J. Loss Prev. Process Ind. 21 (6), 589–595.

Jonkman, S.N., Jongejan, R.B., Maaskant, B., 2010. The use of individual and societalrisk criteria within the Dutch flood safety policy – nationwide estimates ofsocietal risk and policy applications. Risk Anal. 31 (2), 282–300.

LaChance, J.L., 2009. Risk-informed separation distances for hydrogen refuelingstations. Int. J. Hydrogen Energy 34 (14), 5838–5845.

Lees, F.P., 2005. Lee’s loss prevention in the process industries: hazardidentification, assessment and control. Elsevier/Butterworth-Heinemann,Amsterdam.

Marangon, A., Carcassi, M.N.M., 2006. ATEX Directives: the new Approach –Classification of hazardous areas for the presence of flammable gas. In: 5thConference on Risk Assessment and Management in the Civil and IndustrialSettlements – VGR 2006, pp. 1–20, Pisa.

Mather J., Blackmore C., Petrie A., Treves C., 2001. An assessment of measures in usefor gas pipelines to mitigate against damage caused by third party activity,Contract Research Report 372/2001, Health and Safety Executive.

RADD (Risk Assessment Data Directory), 2010. Ignition probabilities, Report No.434-6.1. International Association of Oil & Gas Producers, London.