Journal of Loss Prevention in the Process Industries 17 (2004) 271278

www.elsevier.com/locate/jlp

Loss prevention in heavy industry: risk assessment of large

gasholders
A. Bernatik
, M. Libisova
Faculty of Safety Engineering, VSB-Technical University of Ostrava, Lumirova 13, 700 30 Ostrava-Vyskovice, Czech Republic
Received 6 February 2004; received in revised form 22 April 2004; accepted 22 April 2004

Abstract
The article summarises results of quantitative risk assessment for the operation of six large gasholders in the area of great
industrial agglomeration in the Czech Republic. Gasholders for storing combustion gases contain signicant amounts of dangerous substances, especially of carbon monoxide and hydrogen. That is why safety reports on these gasholders were prepared in the
framework of implementation of the SEVESO II Directive. Although gasholders have gradually been shut down in the world,
they still bring the heavy industry in the area of the city of Ostrava a considerable nancial saving. Chosen industrial plants actually combust cheap waste gases, i.e. coking, converter and blast-furnace gases instead of natural gas. As a consequence, the
gasholders are not expected to be closed in the near future either.
With regard to the age (the oldest gasholder is more than 60 years old) and a high population density in the area concerned, it
was necessary to do a detailed risk analysis. Many methods, from simple screening and indexing methods (Selection Method from
Purple Book CPR 18E, IAEA-TECDOC-727 method, method based on the Dows Fire and Explosion Index), through the systematic HAZOP method, modelling of the dispersion of toxic gas releases up to the determination of risk probability and societal
acceptability were employed for the assessment of risks of the gasholders.
The goal of the article is to present results of the assessment of risks connected with the operation of the large gasholders, to
furnish information about possible operational problems and to verify the applicability of recognised methods of risk analysis for
these specic serious sources of risks.
# 2004 Elsevier Ltd. All rights reserved.
Keywords: Gasholder; Heavy industry; SEVESO II; Risk assessment; HAZOP; Carbon monoxide

1. Introduction
The Ostrava area is characterised by a high concentration of heavy industries. Coking plants, blast furnaces and steelworks producing waste gases are
situated here. These combustion gases, i.e. coking,
blast-furnace and converter gases have high energy
values and thus may be recombusted in treatment
facilities again. To secure the continuous supply of the
combustion gases into combustion furnacesm, it is
necessary to store the gases in gasholders. Owing to
nancial savings resulting from this system, six large
gasholders in four industrial establishments were
gradually built in the area of the city of Ostrava.


Corresponding author. Tel.: +420-597-322-833; fax: +420-597322-982.
E-mail address: ales.bernatik@vsb.cz (A. Bernatik).

0950-4230/$ - see front matter # 2004 Elsevier Ltd. All rights reserved.
doi:10.1016/j.jlp.2004.04.004

In the year 2000, the Act No. 353/1999 Coll. on prevention of major industrial hazards implementing the
SEVESO II Directive came into eect in the Czech
Republic. Therefore, a legislative requirement arose to
prepare safety reports on these gasholders and thus to
evaluate major accident risks. With regard to a close
interconnection between industrial sites and residential
development areas in past years, an increased risk for
the surrounding population could be expected. For this
reason, the main goal of the article is to present results
of risk assessment for these specic installations. Other
goals are to verify the applicability of chosen methods
of risk assessment (e.g. IAEA-TECDOC-727 method)
and to draw attention to some operational problems
that could lead to major accidents.
The article starts from present works done to submit
safety reports of enterprises operating these gasholders.
Another previous detailed major-risk assessment of

272

A. Bernatik, M. Libisova / Journal of Loss Prevention in the Process Industries 17 (2004) 271278

these installations is not known. That is why the following approach to risk assessment was chosen. From
the methods available and recognised in the Czech
Republic, indexing and screening methods (Selection
Method from Purple Book CPR 18E, IAEA-TECDOC-727 method, method based on the Dows Fire
and Explosion Index) were chosen rst of all with the
aim to obtain preliminary results of risk assessment,
and thus to make a decision on applications of other
detailed methods. After that the HAZOP method was
employed and the fault and event trees were used for
the estimation of accident probability. Results of application of these methods led to the determination of
risk acceptability according to the procedure recommended by Purple Book CPR 18E methodology.

2. Description of gasholders
The agglomeration of industries in the city of
Ostrava is historically connected with heavy industries. The original enterprise was established as early
as 1828; at present two large metallurgical and engineering complexes employing about 8000 and 10,000
persons exist there. Furthermore, two coking plants,
each operating a large gasholder for storing coking
gas, were included in the assessment. The principal
activity of the above-mentioned metallurgical complexes is the production of pig iron and steel. Converter steel plants are linked to continuous casting
plants for slab and bloom casting; partially, steel is
also cast into ingots. Other centres produce heavy
plates and proles and are tied to related engineering
plants.
In the area under evaluation, the following lowpressure gasholders for storing combustion gases are in
operation:

the concrete bed. Inside the holder, a piston sealed with

sealing strips, cloth and oil and closing the gas space
slides up and down. When lling the gasholder, the piston moves upwards and when emptying, it moves
downwards. The total piston weight is 728,805 kg. The
average gas pressure in the gasholder is 3.14 kPa; the
converted maximum gas amount is about 80 t.
For converter gas storage, the water-sealed low-pressure holder of volume of about 30,000 m3 is used. It has a
cylindrical shape (diameter 50 m, height 35 m) and its
lower part is formed by a water-lled tank with a steel
bottom. Space required for gas is made by a belt that
forms the upper part of the holder. In the course of gas
supplying via the inlet pipeline DN 1600, the belt rises,
in the course of gas consumption via the holder pipeline
DN 1200, the belt drops. The operation overpressure of
gas is 2.5 kPa; the converted maximum amount of gas is
approximately 35 t (Bernatik, Babinec, & Ivanek, 2002).
A view of representative gasholders in the area of the
city of Ostrava is given in Fig. 1.
The main hazardous components of these combustion gases are carbon monoxide (CO), hydrogen (H2)
and methane (CH4). With reference to a possible extent
of consequences of potential accidents, the most hazardous component is toxic CO forming about 8%, 25%
and up to 60% of coking gas, blast-furnace gas and
converter gas, respectively.

3. Description of safety measures

In Figs. 2 and 3, the principle of gas storage in the
waterless and the water-sealed gasholder is explained
briey (Novak, 1998).
As for the gasholders, many safety measures have
been adopted to diminish the risks. For example, for

. four waterless gasholders for storing coking gas

(3  150; 000, 1  120; 000m3);
. one waterless gasholder for storing blast-furnace gas
(150,000 m3);
. one water-sealed gasholder for storing converter gas
(30,000 m3).
A brief technical description of the gasholders is presented for two representatives of the above-mentioned
gasholdersone waterless and one water-sealed. The
waterless gasholder of MAN construction (Maschinenfabrik Augsburg Nurnberg, German company) having a capacity of 150,000 m3 was designed for the
storage of pure coking gas and the compensation of
dierences between coking gas production and consumer consumption. The gasholder MAN is a 24-sided
polyhedron of diameter 53.6 m and a height of 84 m.
The edge length is 7 m. The holder bottom is put on

Fig. 1. View of the water-sealed gasholder and a waterless gasholder

(behind).

A. Bernatik, M. Libisova / Journal of Loss Prevention in the Process Industries 17 (2004) 271278

273

. the measurement of pressure in the gasholder; pressure sensors are located en route (the acoustic alarm
brought out to the dispatching);
. the measurement of the angle of piston tilting and
the check of the oil level of the pistonsensors with
transmission to the dispatching;
. the bell emergency valve on the two-way pipeline
(before the input into/output from the gasholder)
and the automatic valve on the pipeline in the regulation station (400 m from the gasholder);
. six CO detectors placed in the space above the piston.

Fig. 2. Principle of the water-sealed gasholder (Awater tank,

Bbell, Cinlet pipeline, Dguide structure, Eoutlet pipeline).

The most important measure with the water-sealed

gasholder holding the converter gas is computer-aided
process control. The computer regulates operating conditions and records potential operators interventions,
which contributes to a reduction in the occurrence of
human factor failures.
4. Results of risk assessment
4.1. Selection method

Fig. 3. Principle of the waterless gasholder (Aglass, Brunning

board, Cpiston in the upper position, Dmovable piston, Erope
ladder, Fchannel spillway, Gpulleys, Hseal channel, Itar
channel, Jgas supply, Ktar sump).

the gasholder of the MAN type for holding coking gas,

the following chosen measures have been implemented:
. level measurement (signalling the upper and lower
limits);

The result of the selection method (Purple Book,

1999) is a nding that the gasholders require the quantitative risk analysis (QRA), because with regard to
toxic properties of stored gases, consequences may
become evident even outside of the establishment.
Table 1 presents an example of results for one of industrial establishments. From the results it is clear that the
inuence of toxic properties, which may act within larger distances from the gasholders, prevails over that of
gas ammability.
The installation is chosen for QRA assessment, if the
following is valid:
the selection number of the installation at a certain
location on the boundary of the establishment is larger than one and larger than 50% of the maximum
selection number at the location assessed, or
the selection number of the installation is larger than
one at a location in the inhabited area.

Table 1
Results of the selection method for two gasholders in the chosen industrial establishment
Installation

Substance

Kind of substance

Amount (t)

Indication
number Aa

Max.
selection
number Sa

Gasholder MAN
Gasholder MAN
Gasholder
Gasholder
Pipeline
Pipeline

Coking gas
Coking gas
Converter gas
Converter gas
Coking gas
Coking gas

Toxic
Flammable
Toxic
Flammable
Toxic
Flammable

80
80
35
35
0.5
0.5

26.7
8.0
11.7
3.5
1.7
0.5

18.3
4.5
11.7
3.5
1.3
0.3

a
The indication number A expresses the degree of real hazard of the installation and is determined on the basis of the quantity of the substance, operational conditions and properties of dangerous substances. The selection number S expresses the degree of hazard of the installation at
a certain location in relation to other locations assessed, such as locations on the boundary of the establishment and locations in the inhabited
area closest to the installation concerned.

274

A. Bernatik, M. Libisova / Journal of Loss Prevention in the Process Industries 17 (2004) 271278

4.2. Screening and indexing methods

For risk assessment, the IAEA-TECDOC-727
method (IAEA, 1996), which is widely used in the
Czech Republic, and the well-known Dows Fire and
Explosion Index method (Manual F&EI, 1994) were
also employed. The subsidiary goal of the application
of these methods was potential comparison with results
obtained by the selection method.
IAEA-TECDOC-727 published by the International
Atomic Energy Agency in the year 1996 is presented
briey. The great advantage of the method is a simple
assessment of consequences and the frequency of
potential acccidents, which enables the determination
of societal risks. The method makes it possible to classify hazards of xed sources, mobile sources and product pipelines. It is based on a model of 46 type
reference industrial accidents, when a risk to the
population is the relation of the number of fatalities to
the frequency of events. Results are usually presented
graphically in the (x, y) coordinate system, where classes of consequences and classes of probabilities (risk
matrices) are plotted along the x and y axes, respectively. The existing experience shows that this method
may be used in the following cases:
the production of a preliminary general quantitative
overview of various sources of risk in a larger industrial area from the point of view of societal risks,
the determination of priorities with dierent sources
of risk for another detailed analysis.
The outcome is a nding that the IAEA-TECDOC727 method is applicable to the estimation of neither
societal risks of gasholders for storing combustion
gases, nor their relevant pipeline networks with regard
to the pressures of gases in the gasholders and in the
network (about 35 kPa) and pipeline dimensions (e.g.
DN 500). The gasholder as a source of risk can be
assigned to none of the 46 reference accidents.
The highest value of the re and explosion index,
F&EI 91:7, classes the gasholder, with which this
value was acquired, to the second, moderate hazard
degree for operational units. The radius of the area
aected may be estimated at 23.3 m (plus the gasholder
radius of 27 m). The F&EI study has proved that the
gasholders do not represent any signicant source of
re and explosion risks.
The calculation of the Dows Chemical Exposure
Index (AIChE, 1994) was performed as well; e.g. for the
coking gas holder MAN, the index, CEI 32:84, and the
dangerous distance, HD3 274:8 m (for ERPG-3
500 mg=m3 of carbon monoxide) were determined.
Although according to the CEI methodology any other
analysis is not required if the index is smaller than 200,

these preliminary results show the greater importance of

potential accidents in case of a toxic gas cloud release.
4.3. HAZOP method
The carried out HAZOP-studies were concerned with
the identication of non-typical sources of risks
according to specic conditions of gasholder operation.
As the most important causes of potential accidents
were identied, for example, a human factor failure,
the inuence of climatic conditions, sealing oil quality,
failures of measurement and/or signalling transmission, and others. More details about these largely
operational problems that could cause a release of
combustion gases are given in Chapter 5.
4.4. Modelling of toxic cloud dispersion
Consequences of releasing a CO toxic cloud were
evaluated in detail; the cloud being able to reach residential areas under unfavourable meteorological conditions. For modelling, the ALOHA (Areal Locations
of Hazardous Atmospheres) program prepared by the
US Environmental Protection Agency (US EPA, 1999)
was chosen. ALOHA is a computer program designed
especially for use by people responding to chemical
accidents, as well as for emergency planning and training. ALOHA can predict the rates at which chemical
vapours may escape into the atmosphere from broken
gas pipelines, leaking tanks, and evaporating puddles.
It can then predict how a hazardous gas cloud might
disperse in the atmosphere after an accidental chemical
release.
By using the ALOHA program, areas aected were
dened according to various scenarios of potential
gasholder accidents. At rst, the probit function for the
estimation of fatal injuries by carbon monoxide was
used (Purple Book, 1999):
Pr a b  ln C n  t5
7:4 1  ln C 1  30 ) C
8093 mg=m3 7000 ppm

with Pr the probit corresponding to the probability of

fatal injury (); a, b, n the constants describing the toxicity of a substance (); C the concentration (mg/m3)
and t the exposure time (minutes).
The probit makes it possible to determine the concentration that at the given time produces expected
consequences. The ALOHA system will then enable the
determination of the size and the shape of the area
aected. For the determined LC concentrations (by
means of the probit), boundaries of the area with the
corresponding probability of fatal injury may be found.
For the purpose of modelling the consequences of
population exposure to the eects of toxic substances
(societal risk), the LC50 concentration (inhal., 30 min)

A. Bernatik, M. Libisova / Journal of Loss Prevention in the Process Industries 17 (2004) 271278

Fig. 4. Diagram of the modelled plume of converter gas for the

lethal CO concentration of 7000 ppm in case of a rupture of the
gasholder inlet pipeline (DN 1800 pipeline).

for a man may be used as a basis. In accord with the

IAEA-TECDOC-727 method and the Purple Book
methodology (the exposure time is limited to a
maximum of 30 min), consequences fatal for all people
in the area aected are expected. Thus, fatal injuries
are considered that also occur outside of the aected
area where the fatality is lower than 50%.
In the worst case of gasholder accidents, the area of
exposure to a cloud of toxic gases of the lethal concentration was determined to extend for about 150 m from
the gasholder. As an example, the plume of converter
gas for the modelled situation in the stability class D is
shown in Fig. 4; the plume length being 157 m (rupture
of the inlet pipeline, circular opening diameter of
180 cm, average release rate of 34.4 kg/s, total released
amount of 2061 kg).
4.5. Probability determination

275

1800) before the rst ttings of the water-sealed

gasholder for converter gas and a subsequent toxic gas
release from the gasholder (overpressure of 2.4 kPa) is
given. The following development of this scenario is
illustrated by means of the event tree in Fig. 5.
The frequency of gasholder ruptures was
f 5  106 events=year (Purple Book, 1999). From
the presented consequences determined by means of the
event tree, primarily the dispersion of combustion gases
as a toxic substance was assessed in detail, because in
this case the largest aected area was expected outside
of the industrial establishment.
Further, scenarios of other, less serious accidents
were considered and fault trees were created for them.
In Fig. 6 there is an example of the fault tree for a coking gas release from the gasholder MAN.
4.6. Societal risk determination
At the end of risk assessment a societal risk was
determined on the basis of the results presented above.
As an example of the determination of societal
acceptability of risks, a procedure for evaluating the
worst-case scenario of the gasholder accident (pipeline
rupture at the water-sealed gasholder for storing converter gas) is given below.
4.6.1. Estimation of the probability of event occurrence
For considerations about a rupture of the gasholder,
or a full rupture of the inlet pipeline, the frequency
f 5  106 =year was taken as fundamental. Modelling has shown that in the case of the stability class D,
consequences manifest themselves within a distance of
157 m (distance from the residential area is about
150 m). This residential area is expected to be aected
at the south direction of wind:

For the gasholders assessed, accident frequencies

were determined by the fault tree analysis and the
event tree analysis. Input data of the frequency of loss
of containment events (LOCs) were taken from literature (Purple Book, 1999). As an example, a scenario of
a major accident, i.e. a rupture of the inlet piping (DN

Fig. 5. Event tree for a serious gas release from the gasholder for
converter gas.

Fig. 6. Fault tree for a lesser release of gas from the gasholder
MAN for coking gas.

276

A. Bernatik, M. Libisova / Journal of Loss Prevention in the Process Industries 17 (2004) 271278

. as it follows from the wind rose, the probability of

aecting the dwelling houses is 3.38% (P 0:0338).

Table 4
Estimates of numbers of people fatally injured in the area aected (in
town)

At the independence of both the events (converter

gas released from the gasholder and the abovementioned atmospheric conditions obtained), the
probability of intersection of both the events may be
determined as an arithmetic product:

Number

Ninside

Noutside

Total

Day
Night

2.8
2.9

2
1

About 5
About 4

In our case, it is the frequency with the number of

ve fatally injured that is acceptable:

5  106  0:0338 1:6  107 =year

4.6.2. Estimation of the number of fatal injuries
At a plume length of 157 m, the number of persons
in the area aected was about 30. Furthermore, the calculation of the number of factually fatally injured persons was executed in accordance with the methodology
given in Purple Book. It is expected that fractions of
population inside the buildings (fpop, in) and of population outside the buildings (fpop, out) may be estimated.
The situation changes within 24 h being dierent from
day to night. Estimates are given in Table 2.
Moreover, it is assumed that people present in
the area aected by eects of a toxic substance of
the above-mentioned concentration occurring outside
the buildings will be fatally injured with a probability
given by the probit value. Ten percent of people (0.1
factor) present inside buildings will be fatally injured.
Results are presented in Tables 3 and 4.
4.6.3. Assessment of societal risk acceptability
In accordance with the Czech laws (Act No. 353/
1999, Coll.), the acceptable event occurrence frequency
is determined according to the relation given below:
Fp 103 =N2 for an existing establishment or installation
2
Fp 104 =N2 for a new establishment or installation
3
where Fp is the acceptable frequency and N the number
of endangered persons.

Fp 103 =52 4  105 =year

From the comparison of the frequency of event
occurrence and the acceptable frequency it follows that
1:6  107 < 4  105
and thus the societal risk of the unexpected event assessed is acceptable.
4.7. Summary of results from risk assessment
From the point of view of safety in the surroundings
of the gasholders, the following conclusions have been
drawn from the risk assessment of the major accident:
. The largest radius of the area aected, 157 m, was
determined for the accident of the gasholder for
storing converter gas; in this area about ve inhabitants are endangered by fatal injury with the probability of 1:6  107 .
. In the case of the major accident of the coking gas
holder MAN, a radius of the area aected was
determined to be less than 131 m; in this area about
three inhabitants are endangered by fatal injury with
the probability of 2:3  107 .
. In the case of the accident of the coking gas piping
(DN 500) a radius of the area aected of less than
60 m was determined; in this area about two inhabitants are endangered by fatal injury with the probability of 1:5  106 .
. The societal risk of gasholder operation is acceptable for all scenarios evaluated.

Table 2
Population fractions inside and outside of buildings by day and by
night

Day
Night

fpop, in

fpop, out

0.93
0.99

0.07
0.01

Table 3
Estimates of numbers of people inside and outside of buildings (of
the total number of 30 people in the area aected)

Day
Night

Ninside

Noutside

28
29

2
1

5. Operational problems
In the course of risk analysis some operational problems were assessed that could, under certain conditions, lead to major accidents. For instance, the
following items belong to important problems:
. Sealing oil qualitythis special anthracene oil can
gradually lose its properties, primarily viscosity, the
setting point and water separability, which may
result in the penetrating of the gas through the
upper piston channel (see Fig. 7).

A. Bernatik, M. Libisova / Journal of Loss Prevention in the Process Industries 17 (2004) 271278

277

Several operational problems occurred in the assessed gasholders. Fortunately, none of them led to any
major accident. Moreover, on the basis of the historical
overview of accidents in the gas industry all over the
world (Novak, 1998) it is possible to state that considering the number of gasholders operated, the number of major accidents is rather small (e.g. accidents in
Pittsburgh in the year 1927 and Neunkirchen in the
year 1933).

whole city and constitute, from the point of view of

prevention of major accidents in heavy industries, practically the most signicant hazard with regard to the
chemical composition of coking, converter and blastfurnace gases, when the main dangerous components
are carbon monoxide, hydrogen and methane.
It follows from comprehensive results of the risk
analysis that the highest risk is connected with a release
of a large amount of converter gas containing CO (up
to 60%), when the population in the close vicinity may
be endangered. With reference to a historical connection between some gasholders and residential areas, the
gasholder for storing coking gas (8% of CO) and pipelines even several kilometres long were assessed as
sources of risk as well. Some of the gasholders also
represent signicant risks of major accidents to surrounding public transport. In the nearby area of two
gasholders a road with tramlines leads that could be,
under specic conditions, a cause of gas cloud
explosion.
Furthermore, the risk analysis veried the usability
of some recognised methods for risk assessment. On
the one hand, the inapplicability of the IAEA-TECDOC-727 screening method to the assessment of
gasholders was proved in spite of the fact that this
method has been often employed in the Czech Republic. Modelling the dispersion of a released toxic cloud
by means of the ALOHA program also brought problems with regard to specic operational conditions
(especially the low overpressure of gas in the
gasholder). On the other hand, the Dutch methodology, Purple Book, namely both the introductory
selection method and other procedures for the assessment of probability and risk acceptability, proved itself
to be suitable. The systematic method HAZOP
approved itself as an appropriate method for the
detailed analysis of causes of potential accidents and
possible operational problems.
In the conclusion it is possible to state that with the
assessed gasholders, total safety as well as reliability is
rather high; the reliability and the safety may be considered to be societally acceptable. Nevertheless, with
regard to the age of the gasholders, high-quality maintenance and inspection of the conditions of these installations must be done. Furthermore, it is necessary to
assess the reliability of human factor in detail and to
evaluate operational problems arisen, which will lead
to improvement in major accident prevention with the
large gasholders.

6. Conclusion

References

Six large gasholders in the area of one town represent untypical sources of major accident risks. The
gasholders create, thanks to their size, landmarks in the

Act No. 353/1999 Coll., on prevention of major accidents and

Decree of the Ministry of the Environment No. 8/2000 laying
down the principles of major accident risk assessment.

Fig. 7. Scheme of piston sealing in the gasholder MAN (Novak,

1998). Principle of sealingon the lateral surface there is a peripheral
channel connected by means of cloth to a runner. The runner is pressed elastically against the inner smooth wall of the gasholder. When
the piston rises and drops the runner slides on the gasholder wall.

The channel is lled as requested with sealing oil, in

which the whole runner is submerged. The sealing oil
lubricates the wall of gasholder shell as well as the runner
and seals thus a gap between the wall and the runner.
. If the sealing strip of the piston is damaged, the
sealing oil from the upper channel will fall to the
lower channel, and thus the level will drop. If it is
not possible to supply the oil into the upper channel,
the gas will rise above the piston;
. The heating of the gasholder by a heating coilin
winter periods it is necessary to ensure the heating
of the gasholder, especially of the upper channel to
keep the correct viscosity of the sealing oil.
. Piston tilting or jammingproblems associated with
the piston may occur due to incorrect loading, or
intensive sunshine, or impurities frozen on the walls
of the gasholder; the operating sta must observe
the tilt of the piston to prevent the gas from escaping around the piston.

278

A. Bernatik, M. Libisova / Journal of Loss Prevention in the Process Industries 17 (2004) 271278

AIChE technical manual Dows Chemical Exposure Index (1994).

American Institute of Chemical Engineers.
Bernatik, A., Babinec, F., & Ivanek L. (2002). Bezpecnostn zprava
EVi a.s. (Safety Report).
IAEA-TECDOC-727 (1996). Manual for the classication and prioritisation of risks due to major accidents in process and related
industries. Austria: International Atomic Energy Agency.
ManualDows Fire & Explosion Index (1994). Hazard classication
guide (7th ed.).

Novak R. (1998). Nehody a havarie nzkotlakych plynojemu v plynarenske historii, (Accidents of low-pressure gasholders in gas
industry history). Energie, 1, 7782.
Purple Book CPR 18E (1999). Guidelines for quantitative risk assessment. The Hague.
US EPA (1999). CAMEO ALOHA, http://www.epa.gov/ceppo/
cameo/aloha.htm.