Background Information 2009

BACKGROUND
INFORMATION
APPENDIX TO
HANDBOOK FAILURE
FREQUENCIES 2009
for drawing up a
safety report
05/05/2009
Flemish Government
LNE Department
Environment, Nature and Energy Policy Unit
Safety Reporting Division
BACKGROUND
INFORMATION
APPENDIX TO
HANDBOOK FAILURE
FREQUENCIES 2009
for drawing up a
safety report
Flemish Government
LNE Department
Table of Contents
CHAPTER 1: INTRODUCTION 9
CHAPTER 2: PRESSURE TANKS 15
CHAPTER 3: MOBILE PRESSURE CONTAINERS 22
CHAPTER 4: ATMOSPHERIC TANKS 24
CHAPTER 5: HEAT EXCHANGERS 40
CHAPTER 6: PUMPS AND COMPRESSORS 45
CHAPTER 7: PIPE SYSTEMS 50
CHAPTER 8: LOADING AND UNLOADING ACTIVITIES 60
CHAPTER 9: FIRE IN WAREHOUSES 62
CHAPTER 10: PACKAGING UNITS 64
CHAPTER 11: REPRESSION SYSTEMS 66
CHAPTER 12: CONSEQUENTIAL EVENTS 73
CHAPTER 13: REFERENCES 80
Background Information Handbook on Failure Frequencies 2009 05/05/2009 5

6 Background Information Handbook on Failure Frequencies 2009 05/05/2009
Preface
The Handbook on Failure Frequencies 2009 only contains the failure frequencies for
the different installations. In previous versions the background information was also
included in the handbook itself. For this version, for the sake of simplicity and user-
friendliness, it was decided to limit the Handbook on Failure Frequencies to the
actual failure frequencies.
The background information is therefore provided in a separate document, as this

information must not be lost and should be available at all times in order to know
how the failure frequencies were determined.

Chapter 1: Introduction
In order to determine the types of failure and failure frequencies for atmospheric tanks
and pressure tanks, the information below was used as a basis.
1.1. GENERAL (SERTIUS)
For the choice of the types of failure one should bear in mind the fact that, in practice,
standard dispersion models (2D models) are built up based on two basic models, namely a
model for instantaneous release, on the one hand, and a model for leakage, on the other.
Intermediate situations (short release, with or without a strongly varying flow rate) are
modelled using a ‘trick’, namely by representing the release as a series of consecutive
‘puffs’.
As a result of this way of working the modelling of intermediate situations often leads to
very strange results. This effect is increased by the fact that in the previous modelling of
the release only 2 extremes are known, namely rupture models and free release
(continuous release) models. Important phenomena, such as the initial air mixture, are
treated very differently in each case. For intermediate situations between rupture and
continuous release, the results of the dispersion calculations are highly unreliable.
In order to compensate for this, it was proposed to model instantaneous failure of

containers in two ways: once as ‘rupture’ and once as ‘release of the entire content in 10
minutes’. The frequency for instantaneous failure is then distributed over both release
scenarios (see §1.2). The introduction of the ‘10-minute’ scenario is therefore purely
mathematical.
The calculations are based on two basic principles:

− The failure frequency of a component consists of 2 partial frequencies,
namely the instantaneous failure frequency ‘PI’ and the leakage frequency
‘PL’. Both frequencies are determined based on statistical research.
− ‘Instantaneous failure’ is defined as the failure of a component leading to
the release of the content in a very short period of time. ‘Leakage’ is
defined as the failure of a component leading to the release of the content
over a longer period of time.
The line between ‘a very short period of time’ and ‘a longer period of time’
is drawn at 10 minutes. Receivers tend to interpret releases lasting more
than 10 minutes as continuous releases, and releases lasting less than 10
minutes as instantaneous releases.
The choice of the types of failure and the distribution of the frequencies over the types of
failure starts with determining the leak diameter causing the 10-minute release, D10.
Depending on this diameter and the diameter of the largest connection, Dmax, the following
basic distribution is used (Table 1):

Table 1: Basic distribution for failure frequencies
D10 > Dmax D10 ≤ Dmax
Type of failure Frequency Type of failure Frequency
Rupture PI/2
Rupture PI
Release in 10 min. PI/2
Leakage ≤ DL, max PL Leakage ≤ DL, max PL
DL, max = maximum leak diameter (= min(D10, Dmax))
Generally, 3 types of failure are considered in case of leakage:

− a small leak, representing leaks with d ≤ dS and frequency α.PL;
− a medium leak, representing leaks with dS < d ≤ dM and frequency β.PL;
− a large leak, representing leaks with dM < d ≤ DL,max and frequency γ.PL.
With α + β + γ = 1.
Depending on the size of DL,max, the types of failure for leakage to be taken into
consideration in the quantitative risk analysis are those shown in Table 2.
Table 2: Types of failure and frequency for leakage

DL,max ≤ dS dS < DL,max ≤ dM dM < DL,max
Type of failure Frequency Type of failure Frequency Type of failure Frequency
Small leak α.PL Small leak α.PL
Small leak Medium leak β.PL
(α+β+γ).PL Medium leak
deq = 10 mm (β+γ).PL Large leak
deq = DL,max γ.PL
deq = DL,max
Note that for small leaks, as a general rule, a 10 mm leak diameter is assumed.
1.2. INSTANTANEOUS FAILURE
For the frequency distribution between ‘rupture’ and ‘release of the entire content in 10
minutes’ a 50–50 ratio is assumed. The report of Smith and Warwick (1981) includes two
instantaneous releases. One of these is clearly a rupture; the other should rather be
considered an outflow in 10 minutes. A 50–50 distribution between ‘rupture’ and ‘outflow
in 10 minutes’ therefore seems appropriate.

1.3. LEAKAGE (SGS)
In the ‘Handbook on Failure Frequencies 2009’ certain equivalent leak diameters are
defined for leakages, and a specific distribution over the different leakages is applied.
Both are based on the reasoning below.
For installations which can be regarded as atmospheric tanks or pressure tanks, leakages
must be included in the calculation with a representative leak diameter. Each of these
representative leak diameters is associated with a leak diameter range.
For the further derivation of the equivalent diameters and diameter intervals the following
two conditions are defined:
− The condition that the released amount for the equivalent diameter must be
representative of the released amounts linked to the diameters within the interval
must be fulfilled. The released amount is proportional to the equivalent diameter
squared.
− In addition, the requirement that the sum of the leakage frequencies must equal
the total leakage frequency must be fulfilled.
Based on these conditions and the information in (HSE, 1997) related to the distribution of
the leak diameters for pressure tanks, the equivalent diameter for a diameter interval can
be determined. In this calculation the following symbols are used:
α 0.43
d leak diameter for which F is determined
d0 0.1 mm
d1 minimum diameter of the leak size category
d2 maximum diameter of the leak size category
deq equivalent diameter
F frequency (per year) that leakage occurs with a diameter ≥ d
F’(d) derivative of the distribution function
f0 total leakage frequency
ΔF failure frequency interval for the leak size category [d1;d2]
The distribution function obtained from (HSE, 1997) and included in (DNV), is represented
as follows:
α
⎛d ⎞
F(d) = f 0 ⎜⎜ 0 ⎟⎟
⎝ d ⎠
The fraction of leaks with a leak diameter greater than d is represented by factor (d0/d)α.
This is shown in Figure 1. From this figure it can be seen that 16% of leaks give rise to a
leak diameter greater than 10 mm.

1.0
0.9
0.8
0.7
0.6
0.84
0,86
F(d)
0.5
0.4
0.3
0.2
0.16
0,14
0.1
0.0
0 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000
d(mm)
10mm
Figure 1: Distribution of leak diameters
The equivalent diameter for a leak size category [d1;d2], taking into account the above
distribution and conditions, will then be:
d
2 2
∫ F' (d)d δd
d
d2
eq = −
1
ΔF
The formula above becomes:
2 αf dα d2−α − d2−α
deq = 0 0 2 1
( )
2−α ΔF
The equation above can also be written based on the diameter by substituting ΔF by means
of the distribution function in the interval [d1;d2]. This results in:
d2
α (d22−α − d12−α )
eq =
2−α (d1−α − d2−α )
The total range, from 0.1 mm to the largest connection, is divided into 3 leak size
categories.

The equivalent diameter, which is representative of the leak size categories chosen, is
calculated using the correlations established in the previous paragraph. Moreover, the
large leak is made dependent on the diameter of the largest connection.
Small leak
The diameter interval for small leaks is established at 0.1–10 mm. Taking into account the
previous paragraph, the following failure frequency and equivalent diameter are derived
(see also Figure 1):
F = 84% f0
deq = 2 mm
Taking into consideration the unreliability of the distribution function within the diameter
interval, the equivalent leak diameter for small leaks is equated to the maximum value of
the interval, i.e. 10 mm.
Medium leak
The diameter interval for medium leaks is established at 10–50 mm, as most connections
are larger than 50 mm. Moreover, it is assumed that the failure frequency for medium
leaks amounts to 8% of the leakage frequency (see Figure 1). Taking into account the
previous paragraph, the following failure frequency and equivalent diameter can be
derived:
F = 8% f0
deq = 25 mm
Large leak
Large leaks are modelled with a diameter equal to the maximum leak diameter (DL, max).
Moreover, it is assumed that the failure frequency for large leaks corresponds to the
remaining 8% of the leakage frequency. Taking into account the previous paragraph, the
following failure frequency and equivalent diameter can be derived:
F = 8% f0
deq = DL,max

1.4. CONCLUSION – HBFF2009
The Handbook on Failure Frequencies 2009 is based on the above reasoning, in which the
types of failure and failure frequencies must be determined according to Table 1 and Table
2.
In this calculation the following values – resulting from the above derivation - are used:
− dS = 10 mm and dM = 50 mm;
− α = 0.84, β = 0.08 and γ = 0.08.
PI and PV will be derived in the following chapters.

Chapter 2: Pressure tanks
2.1. BASIC FAILURE DATA ACCORDING TO SMITH & WARWICK

As a lot of data on failure related to pressure vessels are based on the original study of
Smith & Warwick (1981), this will be briefly summarised here.
The research was conducted over the period 1962-1978 (approx. 16 years) and comprised
310,000 vessel years and 20,000 pressure vessels.
It included:
- Steam extractors, receivers, drums, heaters, generators, pipes;
- Hot Gas heat exchangers;
- Super heaters;
- Water tube boiler bottom heaters;
- Jacketed autoclaves;
- Re-heat pipeworks;
- Cylinders;
- Ammonia storage tank;
- Gas cooled reactors;
- Nuclear accelerator tank;
- Cyclo Hexane reactor vessel;
- Evaporator vessel;
- HMT Boiler;
- Chemical reactor vessel.
Smith & Warwick defined two categories of failure:

- Catastrophic failure: this implies leakage from the vessel or component, or failure
which is so serious that a major repair or even replacement are necessary;
- Potentially dangerous failure: a defect which requires remediation and where
maintaining the vessel or component operative (under pressure) could result in a
dangerous spread of the defect.
The installation types selected for the study were:

- Welded or forged, non-fire-heated pressure vessels, boiler shells and vessels/tanks
(drums) which had not been exposed to an enveloping/non-spreading fire. The
thickness of the containment was greater than 9.5 mm (3/8”) with a working pressure
of more than 725 kPa. The vessels were built according to the requirements of a
recognised design code;
- Age range smaller than 40 years;
- Installation for which non-repaired defects remained under control during operation;
- Piping built according to comparable pressure vessel standards, although this was not
representative of all piping of the installation in question.

The distribution of failure by cause was as follows:
Split propagation 216 94%

Defects existing before delivery 5 2%
Corrosion 1 <2%
Malfunction – human error etc. 3 <2%
Creep 3 <2%
Unverified 1 <2%
Total 229 100 %
The most common cause of failure is the appearance of splits (94%) in the installation.
The underlying causes of these splits were:
Material fatigue 52 24%

Corrosion 30 14%
Defects before putting into operation 63 29%
Unverified 61 28%
Miscellaneous (creep, malfunction etc.) 10 5%
Total 216 100%
The distribution of the primary causes of failure for splits was not based on a detailed
metallurgical investigation, but on the judgement of inspectors upon visual inspection.
The investigation also showed, for instance, that the most significant failures occurred
during the first years of operation of the installation: 64% of failures occurred in
components which were less than 10 years old.
Table 3 shows the failure frequencies derived from this investigation.
Table 3: Original failure data for all types of vessels (UK only) from Smith & Warwick (1981)
Events Number* Failure frequencies per vessel year
and 99% reliability intervals
Number of potential failures 159 4.1 10-4 - 5.1 10-4 - 6.3 10-4
Number of failures with leakage 57 1.3 10-4 - 1.8 10-4 - 2.6 10-4
Number of catastrophic failures 13** 1.9 10-5 - 4.2 10-5 - 8.2 10-5
Total number 229 6.2 10-4 - 7.4 10-4 - 8.7 10-4
* The number of events corresponds to 310,000 vessel years.
** 2 out of 13 incidents involved serious damage to the vessel structure leading to a large
outflow; the remaining 11 incidents were caused by serious damage to pipe connections and
fittings.

2.2. FAILURE FREQUENCIES
In Table 4 the recommended failure data are given for leaks smaller than 25 mm up to and
including leaks of 150 mm. The instantaneous failures in the last column include all leaks
larger than 150 mm, including catastrophic failure. These failure data are based on the
data set of Smith & Warwick (1981), modified by Technica (Project F424) (internal DNV
document). The leaks taken into consideration are limited to the pressure vessel, including
the manhole, instrumentation connections and pipe connections up to the first flange.
Leaks in the corresponding pipe system are not included here.
Table 4: Failure frequency for pressure vessels according to leak size (HKC94, ARF99)
Leak size (mm) < 25 25-50 50-150 Instantaneous
Number of failures 25 16 3 2
-5 -5 -6
Failure frequency per vessel year* 8.1 10 5.2 10 9.7 10 6.5 10-6
99 % reliability intervals
Lower limit 4.6 10-5 2.5 10-5 1.4 10-6 4.8 10-7
Upper limit 1.3 10-4 9.5 10-5 3.6 10-5 3.0 10-5
The global leakage frequency amounts to 1.4 10-4 per vessel year with a 99 % reliability
interval of 9.5 10-5 to 2.1 10-4 per vessel year. As a generic failure frequency for
instantaneous failure of pressure vessels a failure frequency of 6.5 10-6 per vessel year is
recommended.
2.3. TYPES AND CAUSES OF FAILURE

The main types of failure for pressure vessels (ARF99) are:
- external leaks (including ruptures) of the wall, welds, flanges or mounting parts;
- ruptures due to heating as a result of an enveloping/non-spreading fire (possibly with
BLEVE as consequential event).
The main causes of failure in pressure vessels are mechanical causes (material and
construction defects, operational overload and material fatigue) and corrosion. For process
vessels and reactors the cause of failure is often linked to the liquid content.
In 94% of cases the failure of pressure vessels is the result of splits appearing in the vessel.
In 71% of cases these splits originate in the welded joints or in an area affected by heating
(Smith, 1986).
Table 5 gives an overview of the distribution of causes of failure in pressure vessels

according to leak size (ARF99, HKC94).

Table 5: Cause of failure for pressure vessels according to leak size (HKC94, ARF99)
Leak size (mm)
Cause of failure < 25 25 - 50 50 - Instantaneous Total Share*
150
Design error 2 1 0 0 3 6.5%
Material and/or construction defect, 5 3 1 0 9 19.5%
probably including brittleness
Wear 1 0 0 0 1 2%
Metal fatigue 6 3 0 0 9 19.5%
Corrosion 1 3 0 0 4 9%
Thermal fatigue 1 0 0 0 1 2%
Creep 2 0 1 0 3 4%
Overload 1 2 0 2 5 11%
Unknown 6 4 1 0 11 24%
Number of failures according to leak 25 16 3 2 46 100%
size
Share in terms of percentage 54% 35% 6.5% 4% 100%
These data are based on the data set of Smith & Warwick (1981), modified by Technica
(Project F424) (internal DNV document) taking into account only the following failure data:
- failures which were described as catastrophic failures or leaks;
- failures which took place in the pressure vessel itself, up to the first flange connection
on the pipes; leaks in other pipes were not taken into consideration;
- the leaks were classified according to an equivalent leak diameter assumed by Smith &
Warwick.
Whereas Smith & Warwick’s original data set comprised 12 catastrophic failures and 76
leaks, the data set screened by DNV - as a result of the elimination of pipe leaks -
comprises 2 catastrophic ruptures and 44 leaks for a total of 20,000 pressure vessels
accumulated over 310,000 vessel years.
2.4. FACTORS THAT INFLUENCE THE LEAKAGE FREQUENCY OF SPECIFIC TANKS

(ARF99)
Effect of operating environment
Comparison of process vessels in the ‘onshore process industry’ (Arulanantham & Reeves
1981) with those in the 'offshore industry’ (OREDA92; HSE, 1997) shows that the leakage
frequencies are more or less the same. Hence, it is assumed that similar pressure vessels in
different industries have more or less similar leakage frequencies.
Effect of vessel material
Here, reference is made to generic leakage frequencies of conventional steel vessels. Due
to vitrification the leakage frequency of vessels with acids is assumed to be twice as high

as that of steel vessels with the same product content (Technica C1151, internal DNV
document).
Effect of vessel content

The disadvantage that some liquids, such as e.g. ammonia, are more corrosive than others
should be counterbalanced by extra inspections of the vessel.
The leakage frequency for vessels in which toxic liquids are stored is 10 times higher than
for process vessels in which other products are stored (Arumalatham & Reeves, 1981).
Experience with reactors and columns shows that the failure frequency is higher for highly
reactive liquids.
Effect of underground tanks
As for most underground storage tanks little or no failure data are available, these are
mostly estimated based on data for above ground tanks. However, this is done abstracting
impact and fire escalations.
The only type of failure of storage tanks that is important for the quantitative risk analysis
is the undesired release of hazardous substances as a result of tank leaks or ruptures
(ARF99).
Possible causes of these types of failure are:

- underground leakage due to corrosion of the tank walls;
- overfilling, causing a leak at the tank surface;
- impact, e.g. as a result of a plane crash, maintenance activities or debris from nearby
accidents;
- earthquakes or landslides;
- damage during excavation works;
- construction error(s), material defect(s) or incorrect operation.
As underground storage tanks are less exposed to impact damage than above ground tanks,
the former will suffer less damage than the latter. Nevertheless, damage may be caused to
the above ground pipes of underground storage tanks. In general, impact damage only has
a small share in the appearance of leaks and ruptures, both for underground and for above
ground tanks.
Although underground tanks are harder to inspect, it is assumed that - thanks to anti-
corrosion and cathodic protection - corrosion does not occur more often than in above
ground tanks.
Mechanical failure as a result of human errors only has a small effect on the global failure
frequency of underground storage tanks.
The elimination of hot BLEVEs is the main reason for placing storage tanks underground.

Effect of passive fire protection
In order to compensate for the difficulties involved in coating, tanks with passive fire
protection must be carefully inspected. In this case, the effect of fire protection is limited
to the reduction of BLEVEs. The main aim of these inspections is to prevent corrosion.
Effect of tank inspection (radiography)
Radiography (10% in the UK and 100% in Hong Kong) is thought to reduce the frequency of
catastrophic ruptures in LPG tanks by 30% (Whittle, 1993).
Effect of stress relief

The reduction in catastrophic rupture frequencies for stress relief is estimated at 25%
(Whittle, 1993). The combination of pressure relief and 100% radiography, as required for
underground tanks in Hong Kong, is thought to reduce the rupture frequency by 50%.
Effects of other company-specific factors
Standards for safety management, inspection, design codes, working pressure and
temperature, low outside temperatures, age and process continuity also have an influence
on the leakage and/or rupture frequency of pressure vessels.
2.5. CONCLUSION – GENERIC FAILURE FREQUENCIES HBFF2009
Process installations
As a basis for the calculation of failure frequencies the data from Smith & Warwick (1981)
were considered. The population on which Smith & Warwick’s study is based mainly
consists of steam vessels. This population was considered to be a population of process
pressure vessels.
The total failure frequency for instantaneous failure of a process pressure vessel was
calculated at 6.5 10-6/vessel year. The total failure frequency for the types of failure was
determined at 1.4 10-4/vessel year.
Storage installations
In the sub-selection method used in Flanders (RIVM) a distinction is made between storage
and process installations. Here, the factor for process conditions for storage installations is
a factor 10 lower than for process installations. To stay in line with this sub-selection
method, it was decided to use a 10 times lower failure frequency for storage installations
compared to process installations for failure frequencies as well.

For underground and mounded pressurised storage tanks it is assumed that no thermally
induced BLEVE can occur. This reduces the failure frequency for instantaneous failure to
30% of the failure frequency for above ground pressurised storage tanks (PB), resulting in a
total failure frequency for instantaneous failure of 2.0 10-7.
Road tankers and tankwagons
For road tankers and tankwagons the same failure frequencies are taken as for storage
installations.

Chapter 3: Mobile pressure containers
3.1. GAS CYLINDERS
The use of cylinders for the trade of liquid gases dates from the years 1870-1880. Cavrois
(Cavrois, 1985) gives a historical overview of the use of cylinders.
There are several design codes (DOT 3AA (US), BS 5045 (UK), ISO 4705, …), but from a
technical risk point of view it could be said that most causes of failure are comparable for
nearly all cylinders.
The cylinders are always made of carbon steel (possibly alloyed with nickel, chromium,
molybdenum and/or manganese) or aluminium, and have no welds. The technological
evolution is such that where material characteristics are concerned, there are big
differences between cylinders manufactured before 1930, between 1930 and 1950 and
after 1950.
Since 1977, all reported accidents have been recorded via the Industrial Gases Committee.
Marchal (Marchal, 1985) discusses the results of a thorough analysis referring to some
10,000,000 cylinders for the period of 1977-1984. In this period 74 accidents involving
cylinder failure were reported.
In 13 cases, the accident was caused by the cylinder itself; in the remaining cases there
was an external influence.
Marchal classified the 74 accidents according to the following causes:
Causes related to the cylinder itself:

− Manufacturing error (3);
− Material error (10).
External causes
− Mechanical stress (6);
− Corrosion (6);
− Overfilling (2);
− Wrong installation (1);
− Disconnection of a non-empty cylinder (4);
− Connection with incompatible material (6);
− Fall (from a lorry) (6);
− Other, mainly human error (30).
Table 6 lists the different causes and indicates the probability of occurrence per cause and
the causes thought to be able to lead to the explosion of the cylinder (E) and/or cylinder
leakage (L).

Table 6: Causes of cylinder failure
Cause Leakage (L) or Probability of occurrence (per cylinder.year)
explosion (E)
Manufacturing error (3) E and L 4.8 10-9 – 4.3 10-8 – 1.6 10-7
Material error (10) E and L 5.3 10-8 – 1.4 10-7 – 3.1 10-7
Mechanical stress (6) E and L 2.2 10-8 – 8.6 10-8 – 2.2 10-7
Corrosion (6) E and L 2.2 10-8 – 8.6 10-8 – 2.2 10-7
Overfilling (2) E and L 1.5 10-9 – 2.9 10-8 – 1.6 10-7
Wrong installation (1) E and L 7.1 10-11 – 1.4 10-8 – 1.1 10-7
Disconnection of a non-empty L 9.6 10-9 – 5.7 10-8 – 1.8 10-7
cylinder (4)
Connection with incompatible L 2.2 10-8 – 8.6 10-8 – 2.2 10-7
material (6)
Fall (6) L 2.2 10-8 – 8.6 10-8 – 2.2 10-7
Other (30) E and L 2.5 10-7 – 4.3 10-7 – 6.7 10-7
Total (74) E and L 7.4 10-7 – 1.1 10-6 – 1.4 10-6
Based on the assumptions in the second column of Table 6, this results in the following
failure data:
− Cylinder leakage: 7.4 10-7 – 1.1 10-6 – 1.4 10-6 per cylinder.year
− Cylinder explosion: 6.1 10-7 – 9.0 10-7 – 1.2 10-6 per cylinder.year
However, these failure frequencies should not be added up, because most causes would
then be counted twice.
3.2. PRESSURE VESSELS
For the rupture of pressure vessels (up to 1000 l) the same failure frequency as for gas
cylinders is assumed. However, for pressure vessels leaks are added as a type of failure. It
is said, arbitrarily, that the failure frequency for leaks is 10 times higher than that for
rupture.
For gas cylinders (up to 150 l) the data from Marchal are taken as a basis, and it is stated
that the failure frequency for gas cylinders is 1.1 10-6 per cylinder.year. This calculation is
based on the complete release of the content.
For the rupture of pressure vessels (up to 1000 l) the same failure frequency is assumed. It
is said, arbitrarily, that the failure frequency for leaks is 10 times higher.

Chapter 4: Atmospheric tanks
4.1. DEFINITIONS
Atmospheric storage tank An atmospheric storage tank has been designed to
function with pressures ranging from atmospheric
pressure to an internal overpressure of 34.47 mbar,
measured from the top of the tank (NFPA30, 1987). These
tanks are often resistant to overpressure of more than 70
mbar, especially when - as is often the case - a nitrogen
blanket is applied. However, the definition of an
atmospheric storage tank depends on the code used. 350
mbar tanks are being used, and for some refrigerated
storage tanks this can be even higher.
Atmospheric tank with a fixed Atmospheric tank with vapour space between the liquid
roof surface and the roof, which can be dome-shaped (∅ up
to 20 m) or conical (∅ up to 76 m) (ARF99). An
atmospheric storage tank with a conical roof has roof
slabs supported by internal rafters, purlins, columns and
the top of the cylinder-shaped tank frame. An
atmospheric storage tank with a dome-shaped roof has
vaulted roof slabs which are supported entirely by the
top of the cylinder-shaped tank frame.
Atmospheric tank with an Atmospheric tank where the roof floats on a liquid
external floating roof surface in order to reduce losses through vapour. The
roof requires a closure system around the edge against
the tank walls. This kind of roof constructions are
classified into three types: pan-shaped, ring-shaped
pontoon roof and double-deck roof (ARF99). Occasionally
an aluminium roof is attached to the top of the tank
frame to protect the stored liquid from the negative
effects of heavy rain and snow.
Single containment Atmospheric tank consisting of a primary container for
atmospheric tank the liquid, surrounded by an outer shell or not. The only
purpose of such a shell is to cover and protect the
insulation. It does not serve as a secondary container
which can contain the liquid within the tank in case of
failure of the primary container.
Atmospheric tank with a Atmospheric tank consisting of a primary liquid
protective outer shell container, surrounded by an outer shell intended to keep
the liquid within the tank in case of failure of the
primary container. However, the shell has not been
designed to retain vapour. It is also not resistant to
explosions (static compression stress of 0.3 bar for 300
ms), falling debris or low temperatures.

Double containment Atmospheric tank with the same function as an
atmospheric tank atmospheric tank with a protective outer shell, and
which is, in addition, resistant to explosions, falling
debris and low temperatures. This type of tank has not
been designed to retain all types of vapour either.
Full containment atmospheric Atmospheric tank consisting of a primary liquid container
tank and a secondary container to keep both liquid and vapour
within the tank in case of failure of the primary
container. These tanks are resistant to explosions, falling
debris and low temperatures. The outer roof is supported
by the secondary containment shell and is resistant to all
kinds of stress, e.g. explosions.
Membrane tank Atmospheric tank which consists of a primary container
and a secondary container. The primary container
consists of a non-self-supporting membrane which
contains liquid and vapour in normal operating
conditions. The secondary container is made of concrete
and supports the primary container. The capacity of the
secondary container is big enough to retain the entire
liquid volume in case of failure of the primary container.
Moreover, the vapours can be released in a controlled
way. The outer roof and the secondary containment shell
form a whole.
Mounded atmospheric tank Atmospheric storage tank covered by a mound.
Underground atmospheric Atmospheric storage tank which is surrounded on all sides
tank by inert material, such as earth, and which does not rise
above ground level.

4.2. FAILURE FREQUENCY FOR TANKS WITH AN EXTERNAL FLOATING ROOF (DNV)
Failure frequencies for leakage
The most recent, most comprehensive and statistically best founded study related to
incidents of leakage and fire in this type of tanks was published in the LASTFIRE project
1997 (LFP97). Table 7 gives an overview of the LFP97 observations related to the outflow
of liquid hydrocarbons (HC) in tanks with an external floating roof, and this for the three
main leakage categories. Table 8 shows the details for release outside the tank shell.
Table 7: Release frequency of stored liquids for external floating roof tanks (LFP97; ARF99)
Type of release Event per Frequency and
33,909 99% reliability intervals
tank years (x10-3/tank year)
Spill on roof 55 1.1 1.6 2.3
Sunken roof 37 0.7 1.1 1.6
(except leg failure) (30) (0.5) (0.9) (1.4)
Release outside tank shell 96 2.1 2.8 3.7
Table 8: Details on release frequencies outside the tank shell for tanks with an external floating
roof (LFP97; ARF99)
Type of release Event per Frequency and
33,909 99% reliability intervals
tank years (x10-3/tank year)
Tank structure leaks (corrosion) 19 0.3 0.56 1.0
Tank structure leaks, including drainage 33 0.6 1.0 1.5
Tank structure leaks and leaks due to
47 0.94 1.4 2.0
operational overfilling
Tank structure leaks, leaks due to operational
50 1.0 1.5 2.1
overfilling and steam coil breakage
Release outside tank shell - all causes (incl.
96 2.1 2.8 3.7
piping and containment equipment)
Given the refined classification and the solid foundation when it comes to sample size
(33,909 tank years) and reliability intervals, the data from Table 7 and Table 8 can be used
by the safety expert as they are. In the global failure data for release outside the tank
shell, both leaks in the tank and leaks in piping and fittings, as well as operational errors,
have been included. Therefore, it is recommended to use the failure frequencies in Table
8, choosing the failure frequency according to the characteristics of each specific
installation. The generic failure frequencies included in Table 8 are basic failure
frequencies for all leaks, ranging from 0.1 mm to catastrophic failure. No incidents for
this last category were included in the LFP97 study.
- If only failures due to corrosion are taken into consideration, this leaves only 19
incidents, resulting in a failure frequency of 5.6 10-4 per tank year.
- If only failures due to tank structure leakage (caused by corrosion or breakage and
failure of the roof drainage system) are taken into consideration, excluding leaks due
to operational errors (overfilling), this results in 33 incidents, or a failure frequency of
1.0 10-3 per tank year.

- If only leaks in the tank are taken into consideration, including steam coil leaks and
operational errors such as overfilling but excluding leaks in piping and fittings and
unknown causes, 50 incidents are counted, resulting in a leakage frequency of 1.5 10-3
per tank year.
- If all leaks within the containment are included, this results in 96 incidents. The
leakage frequency then amounts to 2.8 10-3 per tank year.
These failure frequencies are recommended as generic values for leaks with a leak
diameter greater than 0.1 mm.
Causes of leakage
Table 9 and Table 10 give an overview of the causes of the events mentioned in Table 7
related to the different types of tank release.
Table 9: Causes of release of liquid HC within the roof space (LFP97)

Roof spills Sunken roofs
Cause
Number % Number %
Damaged sealing 1 2 - -
Leg failure - - 7 19
Damaged pontoons - - 2 5.5
Roof cracked near pontoons 3 5.5 - -
Fractured roof 10 18 3 8
Roof drainage failure 7 13 1 3
Product on roof 1 2 1 3
Gas in pipes 4 7 2 5.5
Product under high vapour pressure 3 5.5 - -
Overheated product 1 2 4 11
Overfilling 11 20 - -
Fallen roof with some legs in maintenance
1 2 - -
position
Heavy rainfall 1 2 10 27
Water on roof - - 1 3
Unknown 12 22 6 16
Total 55 100 37 100
-: no data
The main causes of roof spills are, respectively, tank overfilling (20%), roof fractures (18%)
and, to a lesser extent, breakage of rainwater drainage systems (13%).
The most common causes of sunken roofs are heavy rainfall (27%) and leg failure (19%). For
this last cause it should be remarked that all cases of leg failure occurred in the same
company. 16 companies participated in the LFP97 project, so the representativeness of
this cause of failure should be questioned. If we exclude the 7 cases of leg failure the
failure frequency is reduced to 9.0 10-4 per tank year with a 99% reliability interval of 5.0
10-4 and 1.4 10-3 per tank year.

Table 10 provides an overview of the causes of outflow/release of liquid HC out of the tank
shell of open top floating roof tanks.
Table 10: Causes of release of liquid HC out of the tank shell (LFP97)
Cause Number %
Corrosion of the tank bottom 15 16
Breakage of the roof legs 1 1
Corrosion of the ring-shaped sleeper 4 4
Steam coil breakage 3 3
Roof drainage failure 13 14
Leak in mixer 9 9
Leak in piping, flanges or valves 16 17
Overfilling 14 15
Unknown 21 22
Total 96 100
The main causes of product release outside the tank shell are leaks in the piping (17%),
corrosion of the tank bottom (16%) and overfilling of tanks (15%).
The most obvious types of failure for product outflow are of a mechanical or corrosive
nature (sealing or pontoon damage), process or procedure-related problems (e.g.
overfilling of tanks) and/or natural overload problems (heavy rainfall).
Effect of protective measures on leakage frequency
The effect of structural protective measures on the leakage frequency is expressed in

reduction factors. The use of these reduction factors must be evaluated by the safety
expert on a case-by-case basis. In case of leaks in the tank structure the following
reduction factors are recommended. These factors are not based on statistically founded
failure data, but on experts’ judgements (PB99).
− With protective outer shell no leakage outside secondary container

− Double containment no leakage outside secondary container
− Full containment no leakage outside secondary container
− Underground (earth as double containment) 500, release into surrounding soil
− Mounded 500

Failure frequencies for instantaneous failure
If it specifically concerns ruptures of storage tanks with a large capacity (> 159 m³), only
one statistically founded failure frequency is quoted (ARF99, US survey (1970-1997)). The
rupture frequency is based on a population of 33,000 tanks for the period of 1970 to 1997,
i.e. a life of 28 years. During this observation period 3 ruptures were recorded in the
petroleum industry, resulting in a probability of failure of 3.2 10-6 per tank year with a 99%
reliability interval of 5 10-7 and 1.2 10-5 per tank year. A previous study by E&P Forum
(1996) obtained a failure frequency of 6.9 10-6 per tank year by combining important leaks
and tank populations. A study by Davies in the UK (1996) found that no incidents involving
ruptures had occurred over the past 50 years for a tank population of 150,000 tanks,
resulting in a rupture frequency of less than 7 10-6 per tank year.
As LFP97 does not mention any tank ruptures, although these did occur during the LFP97
sample period, but not among LFP members, ARF99 estimates the frequency of tank
ruptures at less than 3 10-5 per tank year.
Based on the above references it is recommended to take the same value for floating roof
tank rupture as that recommended by PB99 for fixed roof tanks, as indicated in Table 13.
The probability of rupture is estimated at 5.0 10-6 per tank year, which corresponds to the
abovementioned estimates. Combined with the probability of release of the tank content
in a short period of time (10 minutes) in case of serious leakage of equally 5.0 10-6 per tank
year, this results in a global probability of failure for large leaks in a tank of 1.0 10-5 per
tank year. Based on the statistics of the US survey, the 99% reliability interval is estimated
at 3.0 10-6-1.0 10-5-2.6 10-5 per tank year.
Effect of protective measures on instantaneous failure frequency
(PB99) assumes that protection has the following effect on the frequency of instantaneous
failure of installations:
- the failure frequency of atmospheric storage tanks with a protective outer shell, also
called secondary containers, is 5 times lower than that of single containment
atmospheric storage tanks, which is 2.0 10-6 per year. Furthermore, it is supposed that
in half of all cases of instantaneous failure the protective outer shell remains
undamaged. The released product is contained in this shell (secondary container); the
failure frequency for this is 1.0 10-6 per year. In the remaining cases of instantaneous
failure the protective outer shell is damaged and the released contents end up directly
in the environment; the failure frequency here is also 1.0 10-6 per year.
- the failure frequency of double containment atmospheric storage tanks is 80 times
lower than that of single containment atmospheric storage tanks, i.e. 1.25 10-7 per
year. Furthermore, it is supposed that in 80% of instantaneous failures the secondary
container remains undamaged, and that the failure frequency of the contents being
thus contained by the secondary container amounts to 1.0 10-7 per year. In the
remaining 20% of instantaneous failures the secondary container is also damaged and
the released contents end up directly in the environment; the failure frequency here is
2.5 10-8 per year.

- the failure frequency of full containment atmospheric storage tanks with instantaneous
failure of the inner and the outer container is estimated at 1.0 10-8 per year. As in case
of exclusive failure of the inner tank the contents are contained entirely by the
secondary tank and are therefore not released into the environment, no failure
frequency is given (estimated) for this. For the continuous release of the contents in 10
minutes the same failure frequency was added as for rupture.
- the failure frequency of underground or mounded atmospheric storage tanks,
respectively, is the same as the failure frequency of full containment atmospheric
storage tanks, i.e. 1.0 10-8 per year. Failure of an underground atmospheric storage
tank only leads to pool evaporation, whereas failure of a mounded atmospheric storage
tank leads to a direct release of the tank contents into the atmosphere. For the
continuous release of the contents in 10 minutes the same failure frequency was added
as for rupture.
In summary, the following reduction factors are recommended for rupture and release of
the tank contents within 10 minutes for atmospheric tanks. These factors are not based on
statistically founded failure data, but on experts’ judgements (PB99).
− With protective outer shell 10

− Double containment 400
− Full containment 500
− Underground (earth as double containment) 500, flash evaporation
− Mounded 500
4.3. FAILURE FREQUENCY FOR TANKS WITH A FIXED ROOF (DNV)
Failure frequencies for leakage

Whereas LFP97 offers a solid foundation for the leakage frequencies of floating roof
atmospheric storage tanks, (PB99) and (ARF99) offer a quite extensive, but statistically
poorly founded compilation of leakage frequencies for fixed roof atmospheric storage
tanks.
For tanks with a fixed roof HSE calculated a leakage frequency of 2.5 10-3 per tank year for
atmospheric storage tanks on offshore platforms; the failure frequency is based on 8 leaks
and hence a population of 3,241 tank years (HSE, 1997). This leakage frequency is
comparable to that of floating roof tanks, if leaks in the containment equipment - the
leakage frequency of which amounts to 2.8 10-3 per tank year (LFP97) - are taken into
consideration as well.
Given the solid statistical foundation, the failure frequencies for fixed roof tanks were
derived from those for external floating roof tanks (LFP97), only taking into account
failures related to the tank structure, operational overfilling and the possible presence of
a steam coil.

Table 11: Release frequencies outside the tank shell for tanks with a fixed roof (LFP97; ARF99)
Type of outflow Event per 33,909 Frequency &
tank years 99% reliability interval
(x10-3/tank year)
Tank structure leaks (corrosion) 19 0.3 0.56 1.0
Tank structure leaks and operational
33 0.6 1.0 1.5
overfilling
Tank structure leaks, operational
36 0.7 1.1 1.6
overfilling and steam coil breakage
Release outside tank shell - all causes
82 1.8 2.4 3.2
(incl. piping and containment equipment)
Effect of protective measures on leakage frequency

For fixed roof tanks the Purple Book (PB99) assumes the same reduction factors as for
tanks with an external floating roof.
Failure frequencies for instantaneous failure

Based on the references quoted under 4.2 for floating roof tank rupture, it is
recommended to take the values recommended by PB99, as displayed in Table 13 (columns
G1 and G2), for fixed roof tanks as well. The probability of rupture is estimated at 5.0 10-6
per tank year. Combined with the probability of release of the tank content in a short
period of time (10 minutes) in case of serious leakage of equally 5.0 10-6 per tank year, this
results in a global probability of failure for large leaks in a tank of 1.0 10-5 per tank year.
According to PB99 the types of failure are classified based on the type of release of the
tank contents (rupture or continuous) and the leak diameter (Table 12).
Table 12: Classification of types of failure according to (PB99)

G.1 Immediate release of the entire contents (rupture)
a) directly into the atmosphere
b) from the primary container into the undamaged secondary container or outer shell
G.2 Continuous release of the entire contents in less than 10 minutes at a constant release rate
G.3 Continuous release via an opening (leak) with an effective diameter of 10 mm
Table 13 summarises the frequency per installation and type of failure.

Table 13: Failure frequency per tank year of fixed roof atmospheric storage tanks (PB99; DNV)
G.1a G.1b G.2a G.2b G.3a G.3b
Rupture Rupture Continuous Continuous Continuous Continuous
10 min. 10 min. ∅ 10 mm ∅ 10 mm
Tank Release Release Release Release Release Release
into into into into into into
atmosphere secondary atmosphere secondary atmosphere secondary
container container container
Single
5.0 10-6 - 5.0 10-6 - 1.0 10-4 -
containment
With protective
outer shell 5.0 10-7 5.0 10-7 5.0 10-7 5.0 10-7 - 1.0 10-4
Double
1.25 10-8 5.0 10-8 1.25 10-8 5.0 10-8 - 1.0 10-4
containment
Full
1.0 10-8 - 1.0 10-8 - - -
containment
Underground - 1.0 10-8 - 1.0 10-8 - -
-8 -8
Mounded 1.0 10 - 1.0 10 - - -
Remarks on Table 13:

- Although a tank or vessel consists of a wall and welded stumps (support pillars),
mounting plates and instrumentation pipes, the frequencies only refer to the
tank/vessels and the associated instrumentation network. The pipes connected to the
tanks/vessels are dealt with separately.
- Tanks can be located inside or outside a building; the frequencies do not depend on an
inside or outside location.
- No classification per stored product is provided. A classification method for frequent
shipping of different products is described in VvoW95.
- No separate frequencies are available for cryogenic tanks 1 .
- Atmospheric storage tanks can have an absolute pressure of a little over 1 bar.
Examples of this are cryogenic tanks and atmospheric storage tanks with a nitrogen
blanket.
- The liquid level within an underground atmospheric storage tank must not rise above
ground level. The surrounding (adjacent) earth is regarded as a secondary container.
For this kind of tanks failure only results in an initial flash followed by evaporation
from the contaminated soil.
Effect of protective measures on instantaneous failure frequency
For fixed roof tanks the Purple Book (PB99) assumes the same reduction factors as for
tanks with an external floating roof.
1
Atmospheric storage tanks with a storage temperature below the ambient temperature.

4.4. TANK FIRES
Tanks with an external floating roof
The most recent, most comprehensive and statistically best founded study related to
incidents of fire with this type of tanks was published in the LASTFIRE project 1997
(LFP97).
The study describes five initial types of fire:
− rim seal fire;
− spill on roof fire;
− full roof surface fire following a sunken roof;
− small bund fire;
− full (or large) bund fire.
The failure data (Table 14) are based on detailed research into the frequency of
outflow/overflow and fires of liquid hydrocarbons (HC) in tanks with a diameter greater
than 40 m. To this end, between 1981 and 1995 a worldwide questionnaire was conducted,
resulting in figures on 2,420 tanks and 33,909 tank years. For class III of combustible
liquids the population consisted of 293 tanks and 4,196 tank years.
Table 14: Fire frequency in floating roof tanks filled with liquid HC (LFPRW97)
Type of fire Number Basic frequency 99% reliability interval
of fires (x10-5/tank year) (x10-5 /tank year)
Rim seal fire
− all causes 55 162 112 - 228
− (caused by a lightning bolt) (52) (153) (104 - 218)
Spill on roof fire 1 3 0.03 - 22
Full roof surface fire following a 1 3 0.03 - 22
sunken roof
Total 57
Causes of fire
1. Rim seal fire
Rim seal fires can occur during maintenance or installation works, as a result of storms
with lightning bolts or due to a number of other unknown causes. However, storms with
lightning bolts are the main cause of rim seal fires.
Rim seal fire during maintenance or installation works

Of the 55 recorded rim seal fires, 2 (5.5%) were caused during maintenance or installation
works on operational tanks.
Relationship between storms and rim seal fires

Storms with lightning bolts are the initial cause of rim seal fires in approximately 95% of
cases (52 out of 55). There is uncertainty about the cause of one rim seal fire.

Based on the data from LFP97 on the number of stormy days occurring per year in different
parts of the world – Saudi Arabia, Northern Europe, Southern Europe, North America,
Venezuela, Thailand and Nigeria – and the corresponding rim seal fires, Vito calculated the
relationship (±95% reliability interval, interrupted curves) between both variables (Figure
2).
25
-3 -3
Y = 0.15.10 X – 0.86.10
20
Rim seal fire (x 10-3)/tank year
15
10
0
Belgium
0 20 40 60 80 100 120 140 160 180
Stormy days per year
Figure 2: Relationship between rim seal fires and the number of stormy days per year
The linear function that best describes the relationship between both variables is defined
as follows:
Y = 1.5 10-4X – 8.6 10-4 (r = 0.93) {1}

where
Y: frequency of rim seal fires (x 10-4) per tank year

X: number of stormy days per year
1.5 10-4 and 8.6 10-4: respectively the gradient coefficient and the intercept
r: the correlation coefficient (-1 < r < +1)
For tanks in the Middle East, North America, Europe, Australia and New Zealand the best
estimate (LFPRW97) of fire incidence caused by storms is defined as follows:
Y = 0.5 10-4X per tank year {2}.
Interpolation of {2} to the Belgian situation – the number of stormy days with lightning
bolts in Belgium amounts to 20 per year (LFP97) - means that the number of rim seal fires
as a result of storms with lightning bolts in Belgium is 1.0 10-3 per tank year.

As a generic fire frequency for rim seal fires caused by lightning bolts 1.0 10-3 per tank
year is recommended (Belgian situation). To this, a fire frequency of 1.0 10-4 per tank year
corresponding to other causes should be added.
The global recommended generic fire frequency for rim seal fires hence amounts to 1.1 10-
3
per tank year. The comparisons made are generic values and apply to tanks with all sorts
of products (crude oil up to class III). If the specific tank content is taken into
consideration, the fire frequencies displayed in Table 15 are recommended.
Effect of tank contents on rim seal fires

A rim seal fire caused by a lightning bolt depends on the flashpoint of the tank contents
(the product stored in the tank): the lower the flashpoint, the more sensitive. In this
context, Table 15 shows the classification used by the IP (Institute of Petroleum). For
instance, for class III products the frequency of rim seal fires is 2 to 3.4 times lower than
for crude oil.
Table 15: Effect of tank contents on rim seal fires caused by lightning bolts in floating roof tanks
filled with liquid HC (LFP97; ARF99)
Fuel Number Frequency (x 10-4) ty and
Fires Tanks Tank years 99% reliability interval
Crude oil (LFP97) 37 1,285 18,210 13 20 31
Crude oil (Belgian storm statistics) (18 1,285 18,210) (5 10 18)
Class I (e.g. naphtha, petrol)a 12 718 9,808 5.4 12 25
Class II (e.g. kerosene)b 1 91 1,266 0.1 8 58
Class III (e.g. diesel, fuel oil) 2 293 4,196 0.35 4.8 22
Other and unknown 0 33 429 0
Total & average (LFP97) 52 2,420 33,909 10 15 22
(Total & average - Belgium) (33 2,420 33,909) (6 10 15)
a: Class I: ± highly flammable with flashpoint < 23 °C
b: Class II: flammable liquid with flashpoint between 23 °C and 66 °C
c: Class III: combustible liquids with flashpoint > 66 °C
The increased fire frequency of crude oil compared to the other fuels in Table 15 is due to
the fact that many export terminals for the storage of crude oil are located in countries
with a relatively high storm frequency, whereas storage tanks for the other products are
distributed more evenly across the regions. Therefore, a correction for the Belgian storm
statistics was performed only on the fire frequencies for crude oil.
Effect of constructional interventions on rim seal fires

LFPRW97 provides estimates for a number of constructional interventions. These reduction
factors are not based on statistically founded data. The following reduction factors for rim
seal fires are proposed:
− double sealing: 0.75
− lightning rod system: 0.25
− geodesic dome: 0.1
The use of these modification factors should be evaluated by the safety expert on a case-
by-case basis.

Escalation of rim seal fires
Of the 55 rim seal fires 1 escalated (probability 0.02) into a full roof surface fire. The
escalation mechanism was as follows:
− an initial lightning bolt caused an explosion, which destroyed a pontoon.
− the tank contained a product with a vapour pressure of 12-15 psi RVP (Reid Vapour
Pressure), which corresponds to 0.83 – 1.03 bar RVP.
− only 3 out of 6 fixed foam extinguishers were operational.
2. Fire in spill on roof
The fire frequency in an outflow on a roof is estimated at 3 10-5 per tank year: 1 fire in an
outflow on a roof of a crude oil tank in 33,909 tank years (LFP97).
As the initial event of this kind of fire is the outflow of HC in the roof area, ‘fire in spill on
roof’ is already an escalation event in itself. The frequency of outflow on a roof is shown in
Table 7 and amounts to 1.6 10-3 per tank year. As a fire only occurred in 1 out of 55 cases
of outflow on a roof, the probability that the HC that flows out ignites is about 0.02
(1/55), which results in a fire frequency of 3 10-5 per tank year.
The probability that a fire in an outflow on a roof escalates into a full roof surface fire is 1.
This estimate is based on one single incident. LFP mentions a second ‘spill on roof’
incident (not included in the statistics), in which the fire could be extinguished very
quickly, but flared up again after 30 minutes, after which the fire destroyed the entire
tank. The real probability of escalation is probably somewhere between 0.5 and 1.
Nevertheless, it is recommended to assume a probability of escalation of 1.
3. Full roof surface fire
Of the 4 full roof surface fires included in LFP97 only 1 can be considered an initial fire 2 .
The other 3 were escalation results of respectively a rim seal fire, a fire in the outflow on
the roof and a bund fire.
According to LFP97, when carrying out a risk analysis the failure frequency of one of the
two types of full roof surface fires can be used:
− 3 10-5/tank year (1/33,909): this is the generic fire frequency, based on one roof
surface fire caused by a sunken roof and ignition by electrostatic discharge, in
which a proportion of only 1 fire in 33,909 tank years is assumed. When applying
this frequency other consequential events and escalation scenarios are not taken
into account.
2
The initial fire occurred in a 41 m diameter tank where it was discovered during the filling with
naphtha that part of the roof was submerged in naphtha. After 10 minutes the naphtha ignited
(probably as a result of an electrostatic discharge) and immediately led to a full roof surface fire.
Two hours later first a rim seal fire and later a full roof surface fire started in an identical adjacent
tank, and 10 hours later a full tank fire started in a third identical tank. The escalation was
probably due to the radiation heat. In the tanks located on the lee side of the first tank naphtha
was stored at a temperature of 27°C (9 degrees below the boiling point). In total, the fire, in which
three tanks were destroyed, lasted for 6 days. No serious injuries occurred and the costs were
estimated at 6 million dollars.

− 1.1 10-4/tank year (4/33,909): here, all roof surface fires are taken into account,
both initial ones and escalation events, and a fire frequency of 4 in 33,909 tank
years is assumed (99% reliability interval: 2.4 10-5 - 3.8 10-4).
To calculate the scenario of a full roof surface fire as a consequential event in the
framework of safety reporting, it is recommended to take the global fire frequency of 1.1
10-4/tank year as basic fire frequency.
Probability of escalation of full roof surface fires

A full roof surface fire can be considered a result of escalation of a sunken roof in the
stored liquid.
According to LFP97 the probability that a ‘sunken roof’ escalates into a full roof surface
fire is about 0.03, or the occurrence of 1 ignition for 37 sunken roofs.
For fuel without a boilover risk the escalation of a full roof surface fire to a nearby tank
filled with fuel with a highly flammable liquid is estimated at 0.25: an LFP97 review
(period 1981–1997) showed that 2 full roof surface fires in 8 tanks filled with highly
flammable fuel escalated to other tanks.
However, for tanks which contained products giving rise to boilover, the probability of
further escalation of a full roof surface fire via boilover is estimated at 1.
4. Boilover
Boilover refers to the forceful expulsion of the entire tank content with the formation of a
column of fire and product overflow. This phenomenon occurs only in tanks containing
burning products.
Typical boilover products are crude petroleum and intermediate petroleum products such
as crude distillates, oil residues, heavy fuel oil and refined products mixed with products
with different boiling points.
For tanks filled with products giving rise to boilover, it is assumed in the risk analysis that
the probability of a full roof surface fire escalating into boilover equals 1 if there is no
(adequate) intervention by the fire brigade after several hours. A review by LASTFIRE on
escalation mechanisms showed that among the 16 recorded incidences of tank fires with
boilover fuels (including fixed roof tanks) there were 7 cases of boilover, 2 with overflow
and 7 tank failures without boilover, but with overflow in the tank. We do not know how
many of those 7 fires would have resulted in boilover if the tank shell had not broken.
Therefore, it is suggested that a probability of boilover equal to 1 should be assumed when
carrying out risk analyses.
The frequency of the escalation fire (lowest level) is the product of the frequency of the
initial fire (highest level) and the corresponding probability (intermediate level) of
escalation.
Fixed roof tanks

Table 16 indicates the most representative estimate for the incidence of fire in fixed roof
atmospheric storage tanks.

Table 16: Fire frequency in fixed roof atmospheric storage tanks (ARF99)
Source Roof type Number Number of tanks Frequency & 99% reliability
of fires & intervals (x10-4/tank year)
period
API data conical 100,000
270 2.5 3.0 3.5
Technica (project C1998) roof (1969-77)
The fire frequency is based on the occurrence of fires spread over 9 years (ARF99, API data
Technica (project C1998, 1990)). In these failure data no fires caused by leaks in pipes and
valves have been included.
The Technica (C1998, 1990) study quoted here makes mention of API Risk Analysis Task
Force Document N°1 of May 1977, in which over a period of 9 years (1969-1977) for
100,000 tanks there were 270 incidents with fixed roof tanks and 69 incidents with floating
roof tanks. Most of the recorded fires were full tank fires. The global fire frequency
mentioned in Table 16 is 3.0 10-4/tank year; this fire frequency is recommended for full
tank fires. This fire frequency is a factor 2.7 higher than that of floating roof tanks. The
increased risk of fire for fixed roof tanks can partly be explained by the presence of
flammable gas mixtures in the tank plenum of fixed roof tanks. For tanks with a nitrogen
blanket this additional risk is less pronounced; here, a fire frequency for floating roof tanks
of 1.1 10-4/tank year can be used. Consequently, this paragraph only applies to fixed roof
tanks without a nitrogen blanket.
Effect of tank contents
An API study showed that the occurrence frequency of a tank fire for a product with a
flashpoint < 37.7 °C (Class I) is 11 times higher than for a product with a flashpoint (FP)
over 93.3 °C (Class III).
If the fire frequency for highly flammable liquids (FP < 21°C) is taken as reference value,
the frequency for combustible liquids (FP > 55°C), obtained by extrapolation of the API
study, is 11 times lower. For flammable liquids of intermediate categories (21°C < FP <
55°C) a fire frequency is assumed which is 3.3 (√11) times lower than that of highly
flammable liquids.
The best known accidents described in the API study were related to highly flammable
liquids (methanol, acrylonitrile). As a result, the population chosen to determine the
occurrence frequency of tank fires was overestimated.
Experience from different studies shows that around 30% of tanks contain a highly
flammable product (flashpoint < 21°C). Hence, the real, representative population of tanks
with a highly flammable liquid is a factor 3.3 lower than the total population. It is assumed
that the tank population with flammable liquids represents 35% and that the remaining 35%
of tanks contains combustible liquids. The liquid-dependent fire frequency for atmospheric
tanks is represented in Table 17. The proportion of the different fuels listed in Table 17
differs from that of floating roof tanks (Table 15) because of the dominant role of lightning
bolts as a cause of fire in floating roof tanks.

Table 17: Failure data for tank fires in atmospheric tanks
Frequency (x 10-4 per tank year)
With floating roof or
Tank Fixed roof without
fixed roof with nitrogen
nitrogen blanket
blanket
Highly flammable liquid (FP < 21 °C) 2.5 6.86
Flammable liquid (21°C < FP < 55°C) 0.76 2.07
Combustible liquid (FP > 55 °C) 0.23 0.62
Average 1.1 3.0
Leakage and instantaneous failure of atmospheric tanks
The decision tree in the handbook was drawn up based on the definitions of the different
kinds of tanks, as described at the beginning of this chapter. Typical examples of these
different tank types are:
− Tank type 1: single containment atmospheric storage tank;
− Tank type 2: atmospheric storage tank with protective outer shell;
− Tank type 3: double containment atmospheric tank;
− Tank type 4: full containment atmospheric tank.
For the failure frequencies of single containment atmospheric storage tanks (tank type 1)
the Last Fire Project is taken as a basis for leakage (2.8 10-3/tank year) and the Purple
Book for instantaneous failure (1 10-5/tank year). For the other types of storage tanks the
reduction factors for instantaneous failure from (PB99) are used for instantaneous failure.
For leakage it was decided to use the same leakage frequency for all tank types for the
first (inner) shell. The second shell is regarded as a containment system (which does not
fail). For mounded and underground tanks it was judged that leaks are not relevant in the
framework of external human risks.
For road tankers and tankwagons the leakage frequencies for tank type 1 are used.
For process installations an arbitrary failure frequency which is 10 times higher is used (cf.
pressure tanks).
Tank fire
For tank fires in tanks with an external floating roof a basic failure frequency of
1.1 10-4/tank year was assumed (LFP97). For tanks with a fixed roof without a nitrogen
blanket a basic failure frequency of 3 10-4/tank year was assumed (ARF99). For fixed roof
tanks with a nitrogen blanket the same failure frequency as for floating roof tanks is used.
The failure frequencies for the different tanks based on their contents are determined as
shown in Table 17.

Chapter 5: Heat exchangers
5.1. PIPE HEAT EXCHANGERS (HBKC1994)
External leakage of a pipe heat exchanger can be caused by:

− Leakage through the shell into the environment;
− Pipe rupture leading to overpressure on the shell, causing the latter to leak.
Outflow via the shell
The shell side of a pipe heat exchanger is essentially a pressure tank. There are
insufficient detailed data available for an accurate classification.
OREDA-92 contains a large amount of failure data for heat exchangers. In total, the data
refer to 531 pipe heat exchangers for an experience period of 1,194 pipe heat exchanger
years. Over this period 61 external failures were observed. This results in an average
probability of occurrence of shell leakage in a pipe heat exchanger of 5.1 10-2/year.
Arulanantham and Lees (Arulanantham et al, 1981) provide general failure data on 4
chemical plants, with a total of 5,950 heat exchanger years of experience. The total
failure frequency is 1.7 10-3/year.
The data for OREDA-92 were gathered from 1978 onwards. Lees and Arulanantham’s
publication dates from 1981. In other words, it is unlikely that there is overlapping
between both studied populations.
The total number of external leaks for both references together amounts to 71 on a total
of 7,144 heat exchanger years. Most leaks of heat exchangers are relatively small leaks in
the sealing. For the determination of the probability of occurrence of leakage in the shell
it has been assumed that the data of OREDA92 and Lees only refer to relatively small leaks
(< 50 mm).
For leaks in the 50–150 mm category and in the category of instantaneous failure the
failure frequencies are based on expert judgement. In the absence of statistical data the
Delphi method can be used. This method can be described as a structured group
communication process. The failure frequencies for heat exchangers were estimated based
on the known failure frequencies for pressure containers.
Taking into account the influencing factors predicted in the literature, it is expected that
if one were to study 310,000 heat exchanger years, the number of failures in the 50–150
mm category would be 5, and for instantaneous failure this would be 4.
Table 18 contains the results.

Table 18: Failure frequency according to leak size for pipe heat exchangers (shell)
Leak size category Equivalent leak size Failure frequency range
(mm) (mm) (/heat exchanger.year)
0-25 10 3.8 10-3 – 6.0 10-3 – 8.6 10-3
25-50 35 2.3 10-3 – 3.9 10-3 – 6.3 10-3
50-150 100 4.1 10-6- -1.6 10-5 – 4.6 10-5
Catastrophic Rupture 2.7 10-6 – 1.3 10-5 – 4.1 10-5
All 7.2 10-3 – 9.9 10-3 – 1.3 10-2
Pipe leakage and pipe rupture
In case of small leaks the pressure will be built up slowly and will often be able to be
evacuated in time.
Internal pipe rupture will lead to leakage through the shell if the working pressure in the
pipes is higher than the design pressure of the shell, and there is no or insufficient
pressure evacuation. Depending on the specific situation, the consequential probability of
shell failure as a result of pipe rupture should be determined, and this scenario should be
taken into account separately. The failure frequency of a safety valve can be determined
using the data from the part ‘repression systems’.
The Electrical Power Research Institute (EPRI, 1981) gives the following failure frequencies
for pipe rupture:
− Closed circuit heat exchanger 2.5 10-3/year;
− Condenser 5.0 10-3/year.
This frequency can also be estimated based on the length of the internal pipes.
Perry (Perry, 1985) proposes 4.88 m as typical pipe length and OREDA estimates the
average number of pipes at 300.
An internal DNV report (classified under DNV Technica code LO56) gives a failure frequency
of 7.87 10-5/m.year for small pipe leaks and 1.77 10-5/m.year for large pipe leaks.
Based on these data the total failure frequency for pipe leaks is estimated at 9.64 10-
5
/m.year.
From the pipe leakage distribution (see below) it is clear that approximately 5% of failures
are pipe ruptures.
With these data the frequency of pipe ruptures can be calculated as:

pipe leak pipe rupture m pipes
Fr = 9.64 10-5 * 0.05 * 4.88 * 300
m.year pipe leak pipe heat exchanger
pipe rupture
= 7.1 10-3
heat exchanger.year
This way, the failure frequency for pipe rupture is estimated at 7.1 10-3 per heat
exchanger.year.
5.2. PLATE HEAT EXCHANGERS (HBKC1994)
Failure frequencies for plate heat exchangers
Plate heat exchangers have been in use in the industry since the mid 1960s.
Svensson and Sjǿrgen (1988) provide an overview of 2,300 years of experience with 474
plate heat exchangers, taking into account the plate configuration, the plate material, the
operating temperature and the working pressure.
The reported annual failure frequency varies between 3.5 10-3 and 2.5 10-2, depending on
the number of calendar days the equipment has been in use. For stainless steel plate heat
exchangers the failure frequency was 1.66 10-2 per item.year, distributed over the
following types of failure:
External leak: 1.0 10-2 (60%)
-3
Internal leak: 5.8 10 (35%)
-4
Obstruction: 8.3 10 (5%)
The article also shows that certain operating conditions have an important influence on the
failure frequency.
Table 19 illustrates the influence of temperature on the frequency for external leaks.
Table 19: Influence of temperature on the frequency for external leaks

Temperature range Failure frequency for external leaks
(°C) (per year)
10 - 30 5.3 10-4
30 - 70 3.2 10-3
70 - 110 2.1 10-2
> 110 0.22
All 1.0 10-2
Table 20 illustrates the influence of working pressure on the frequency for external leaks.

Table 20: Influence of working pressure on the frequency for external leaks
Working pressure Failure frequency for external leaks
(bar) (per year)
<5 6.6 10-3
5-8 1.0 10-2
>8 2.4 10-2
All 1.0 10-2
Apparently, the influence of temperature is more pronounced than that of pressure. In

practice, pressure and temperature usually go together. A classification according to a
higher working pressure often entails a higher working temperature.
The quoted failure data do not comprise data on the distribution according to leak
diameter. A supposed representative distribution is provided in Table 21.
Table 21: Failure frequency distribution for plate heat exchangers

Leak diameter Equivalent leak diameter Probability distribution
(mm) (mm) (%)
0 - 25 10 0.7
25 – 50 35 0.3
> 50 rupture 8.3 10-4
The distribution in Table 21 is based on the following assumptions:

− The intervention of the operator serves as the basis for the estimation of the
‘assumable leak size’. If direct intervention was necessary, it is supposed
that the leak diameter falls into the 25 mm category.
For power plants with nuclear and fossil fuels - taking into account the hours
of operation considered - direct operator intervention was required, on
average, in 30% of cases.
− No catastrophic ruptures of plate heat exchangers were reported. The
failure frequency for obstruction and a conditional probability of failure of
0.01 for pressure release result in a failure ratio for rupture of 8.3 10-6,
which is close to the ratio for pressure tanks.
− The remaining external leaks are supposed to belong to the category with an
average leak diameter of 5 mm and a leakage frequency of 7.0 10-3.
Causes of failure
The most common type of failure of plate heat exchangers is external leakage caused by a
gasket, e.g. due to wrong material use, insufficient attachment of the gasket to the plate,
excess internal pressure, mechanical damage, ageing of the gasket or the attachment
material, etc. Bad connections to pipes can also cause external leakage.
Internal leakage, usually due to the perforation of a plate as a result of corrosion, can
develop further into an external leak if the gasket breaks.

Obstructions in the connections to the pipes or in the plate channels can cause
overpressure and lead to a leak or rupture if they are not detected and brought under
control.
For outflow via the shell of pipe heat exchangers failure frequencies based on a
combination of statistical data and expert judgement are used. If the working pressure in
the pipes is higher than the design pressure of the shell, failure of the shell as a result of
pipe rupture - for which failure frequencies are proposed as well - should also be taken
into account.
The failure frequencies for plate heat exchangers take into account the working pressure
of the heat exchanger and are a combination of Table 20 and Table 21.

Chapter 6: Pumps and compressors
6.1. PUMPS
The large amount of pumps can be classified into one of the categories in Table 22 (Lauriks
et al, 1983).
Table 22: Overview of pump types

Category Movement Type
Single-acting reciprocating pump
Double-acting reciprocating pump
Two-way
Single-acting piston pump
movement
Double-acting piston pump
Membrane pump
Radial piston pump
Volumetric
Vane pump
pumps
Rotating movement Liquid ring pump
around an axis Mono pump
Progressing cavity pump
Axial piston pump
Rotating movement Gear pump
around several axes Worm pump
Centrifugal pump (radial)
Flow pumps Rotating movement Turbine pump (semi-axial)
Propeller pump (axial)
(Lees F.P., 1980) gives the following main types of failure for process pumps:
− Failure of an oil seal ring;
− Failure of a gasket;
− Operational damage (cavitation, drying out,…)
A study by Electricité de France (Dorey, 1979) provides the following statistic for 465
failures on a population of 536 pumps and 4.5 million hours:
Cause of failure %
Gaskets 36
Oil seal rings 21
Other leaks 16
Engine 11
Lubrication 8
Miscellaneous 9
The most extensive database on pumps is NRDPS (1981), which comprises 3,252 pump years
of operational experience. Table 23 summarises these data.

Table 23: Distribution of pump failure in the nuclear industry
Type of failure Operational time
Pump type Total (years)
Leak Crack Split Dent Rupture Other
Axial 1 2 3 66
Centrifugal 158 18 3 2 10 143 334 2,139
Diaphragm 2 6 8 35
Gear 1 1 70
Piston 259 11 1 1 26 40 338 196
Radial 2 2 14
Lobe 7 1 20 28 138
Screw 8 8 28
Jet 4 4 492
Other 4 4 74
Total 428 29 4 3 37 229 730 3,252
Most pump failures (63%) occurred during operation; below only this group is taken into
account.
As multiple gaskets have only been commonly used from 1980 onwards, it is supposed that
the NPDRS population only had single gaskets.
On the distribution of leak sizes no further data are available, which is why the following
hypotheses are used:
− The types of failure ‘leak’ and ‘crack’ give rise to a leak with an average equivalent
leak diameter smaller than 10 mm;
− The types of failure ‘split’, ‘dent’ and ‘rupture’ give rise to a leak with an average
equivalent leak diameter in the range of 10 to 50 mm;
− Catastrophic rupture of a pump was not observed in the aforementioned study.
Lees F.P. (Lees, 1980) gives a value of 10-4 per pump year for catastrophic rupture.
In principle, all relevant types of leakage failure fall into 2 categories, namely problems
with gaskets or the pump housing.
With the help of Table 23 and the above assumptions the probability of occurrence of leaks
in pumps can be determined. The pumps most commonly used in the process industry are
probably centrifugal pumps. That is why the exercise has been carried out for centrifugal
pumps (single gasket) in Table 24.
Table 24: Failure frequencies for centrifugal pumps with single gaskets
Leak size [mm] Equivalent leak diameter Failure frequency range [/pump.year]
[mm]
0 – 10 5 3.9 10-2 – 5.2 10-2 - 6.5 10-2
10 – 50 25 1.5 10-3 – 4.4 10-3 - 9.4 10-3
rupture largest pipe 1.0 10-5 - 1.0 10-4 - 2.0 10-4

For centrifugal pumps with twin gaskets the probability of external leakage will be lower.
An estimate of a leakage frequency for twin gaskets should be made based on the
frequency of 5 mm leaks, because larger leaks refer to damage to the pump housing.
If we suppose one same leakage frequency for inside and outside gaskets and consider
cracks a ‘common mode failure’, the failure frequency for centrifugal pumps with twin
gaskets will be:
λ(twin gasket ) = ((158/2,139 ) * 0.63 ) + 18/2,139 = 7.5 10 −3 per pump year

2
For the frequency of leaks in the 10–50 mm category it is assumed that the causes are of
such a nature that the probability of failure for twin gasket pumps does not differ from
single gasket pumps. In other words, twin gaskets are only effective in case of smaller
leaks.
Table 25 contains failure data for centrifugal pumps with twin gaskets.
Table 25: Failure frequencies for centrifugal pumps with twin gaskets
Leak size [mm] Equivalent leak diameter Failure frequency range [/pump.year]
[mm]
0 – 10 5 5.6 10-3 - 7.5 10-3 - 9.4 10-3
10 – 50 25 1.5 10-3 - 4.4 10-3 - 9.4 10-3
rupture largest pipe 1.0 10-5 - 1.0 10-4 - 2.0 10-4
In the case of centrifugal pumps without gaskets the following reasoning can be applied.
For the ‘external leakage’ scenario OREDA-97 gives the relative contribution of the
different parts of the pump system (pump, engine, cooling, lubrication, connected pipe
system, etc.). Where the pump itself is concerned, the pump housing seems to contribute
to external leakage by 2 to 3%. As pumps without gaskets do not have shaft seals, and
other components (shaft, bearers, etc.) are also located inside the actual pump housing, it
can be said that the probability of leakage for a pump without gaskets is 2 to 3% of that of
a pump with gaskets. Assuming a leakage frequency of 4.4 10-3 per year for pumps with
gaskets, this results in a probability of leakage of approx. 10-4/year for pumps without
gaskets.
In the case of reciprocating pumps a similar reasoning can be applied as for centrifugal
pumps. Table 23 shows that the number of smaller leaks is a factor 17 higher than for
centrifugal pumps. 270 smaller leaks were observed (leak and crack) compared to 176 for
centrifugal pumps, but the population is a factor 10 smaller.
However, this discrepancy is not confirmed by other literature sources. Davidson

(Davidson, 1988) gives comparable failure frequencies for centrifugal pumps and
reciprocating pumps (the latter are given a failure frequency which is at most a factor 3
higher).

Handboek Kanscijfers 2004 (HBKC2004) recommends using a failure frequency for
reciprocating pumps which is a factor 10 higher than that of centrifugal pumps.
Other references for pump failure data are, for instance, OREDA-92 and the ENI handbook
and Blything (Blything et al, 1988), Smith (Smith, 1988) and Davidson (Davidson, 1988).
6.2. COMPRESSORS
Just like for pumps, the different types of failure can lead to the release of the product
into the environment. The main ones are:
− Leak in the shaft seal;
− Leak in the compressor housing.
Failure data for external leakage in compressors are scarce. In the PERD guidelines of
AIChE only the general figures for instantaneous failure have been included, without
distinguishing between whether external leakage occurs or not:
− Lower limit: 2.7 10-2/compressor.year;
− Average: 12 /compressor.year;
− Upper limit: 49 /compressor.year.
Johnson and Welker (1981) elaborated an improved database for LNG installations for the
Gas Research Institute. For compressor systems, 116 significant failures were observed for
2.256 million operating hours, which means a failure frequency of 0.45/compressor.year
with a 99% reliability interval of 0.34 – 0.56/compressor.year.
Based on analysis of a confidential report by a chemical group the following data have
been gathered:
Centrifugal compressors
− 16 leaks were observed for a population of 1,157 compressors;
− 15 with a leak diameter between 0 and 10 mm;
− 1 in the category of 25 to 50 mm leaks;
Reciprocating compressors
− 102 leaks were reported for 156 compressor years;
− 97 ‘minor’ ones, not taken into consideration;
− 3 used for the 25 mm (10–50 mm category) leakage frequency;
− 2 smaller than 25 mm diameter, not used.
The database catalogued the leaks as ‘minor’ (95%) and ‘major’ (5%); from the latter
category half of the leaks were included as 25 mm leaks.
For both compressor types it is further assumed that the probability of a leak in the 50–150
mm category is 1/10 of the probability of a leak in the 10–50 mm category.

The data above result in the failure frequencies displayed in Table 26.
Table 26: Failure frequencies (per year of operation) for centrifugal compressors
Failure frequency range
Leak size Equivalent leak diameter
[/compressor.year]
[mm] [mm]
Centrifugal compressors Reciprocating compressors
10 – 50 25 4.3 10-6 - 8.6 10-4 - 6.4 10-3 2.2 10-6 - 1.9 10-2 - 7.0 10-2
> 50 100 4.3 10-7 - 8.6 10-5 - 6.4 10-4 2.2 10-7 - 1.9 10-3 - 7.0 10-4
For centrifugal pumps it was decided to only take into consideration the larger leaks (4.4
10-3/pump year for pumps with gaskets and 10-4/pump year for pumps without gaskets).
Rupture was not observed and is unlikely for this kind of pumps. For reciprocating pumps
this type of failure is likely and is therefore included (10-4/pump year). For leaks in
reciprocating pumps the same frequency was assumed as for centrifugal pumps.
For centrifugal and reciprocating compressors the same failure frequencies are used as for
reciprocating pumps. Thus, rupture is taken into consideration here as a type of failure for
all compressors due to the specific risks involved in fast-running machines (e.g.
detachment of turbine blades) (Sertius).
As equivalent leak diameter 10% of the pipe diameter is taken, like in (RIVM) and
supported by a study by (Westinghouse).

Chapter 7: Pipe systems
7.1. PROCESS PIPES (DNV)
Definitions
Area of failure
In analogy with ARF99, in this section only failures referring to the main body of the pipes
(Figure 3) will be considered.
Flange Valve Main body
Figure 3: Diagram of a pipeline (ARF99)
However, in process pipelines more failures occur related to flanges, valves and small
drillings than to the main body of the pipeline.
Process pipes
These are the pipes in a process plant which transport the process fluids between the
different process vessels.
Inter-Unit and Transport pipes

This type of pipes refers to the pipes which constitute the connection between different
sections (inter-unit) or those which take care of transport (transport pipes) between a unit
and a storage tank. This kind of inter-unit pipes is usually located at ground level in pipe
bays or on pipe bridges.
Type of failure
The main types of failure for process pipes are (ARF99):

− external leakage through the pipe wall or welds;
− obstruction due to deformation of the pipe or objects in the pipeline;
− unacceptable deformation or corrosion (without leakage or obstruction).
The main causes of pipe failure are mechanical causes (usually due to a combination of
overload and an inadequate design) and corrosion. It is suspected that corrosion produces
much smaller leaks than mechanical causes (ARF99).

Units of leakage frequency
Leaks per years of service

It is assumed that the probability of failure over a given period of time increases
exponentially, i.e. that the probability of failure increases exponentially according to the
time a pipe has been in service. In this case, the failure frequency per time unit is a
constant value. The failure frequency is usually expressed in years of service, although
hours of service are also commonly used.
A derived unit to express leakage frequency is ‘leaks per company per year’. This way of
expressing leakage frequency is only used for simple quantitative risk analyses in which the
results are only used to compare failure data of companies with a similar size and the
same amount of pipes.
Leaks per pipe length per year

For generic leakage frequencies the expression ‘leaks per meter year’ has preference and
is therefore used most often in quantitative risk analyses. It is assumed that the leakage
frequency increases proportionally to the length of the pipe.
An alternative expression of leakage frequency is ‘the number of leaks per unit

length/diameter ratio per year”. In this case it is assumed that the leakage frequency
increases proportionally to the pipe length and inversely proportionally to the pipe
diameter. Although this frequency unit is used often, there is no proof that it offers
certain advantages compared to the ‘frequency per pipe length per year’.
Effect of pipe length and diameter
Effect of pipe length on leakage frequency

As longer pipes have more welds and curves and, on the other hand, offer more
possibilities for impact and corrosion, the probability of leaks is higher than for shorter
pipes. In most studies it is assumed that the leakage frequency is proportional to the pipe
length, which is why the frequency is expressed in number of leaks per meter year.
Effect of pipe diameter on leakage frequency

Larger pipes have thicker walls and are therefore more resistant to impacts and corrosion
than smaller pipes. Often more attention is paid to design, inspection and maintenance as
well. Although some authors assume that the leakage frequency does not depend on the
pipe diameter, others think that the leakage frequency is inversely proportional to the
pipe diameter.

Failure frequencies
In quantitative risk analysis the Gulf data (ARF99) are frequently used. The failure data for
process pipes are based on data provided by an important chemical group (DNV TEDARES
source LO56, internal DNV document), which describes them as ‘a review of Gulf and other
data, Gulf Oil, 1978’. The original leakage frequencies of the Gulf data are summarised in
Table 27.
Based on the experienced failures an empirical correlation was established between pipe
length L and pipe diameter D.
Table 27: Original leakage frequencies of Gulf data (HKC94, ARF99)

Type of leakage Leak size in Leak size in Conditional Frequency
coverage (%) diameter (%) probability (per year)
Small leak <1 10 0.59 2.8 10-7 L/D
Large leak 1–5 22 0.25 1.2 10-7 L/D
Serious leakage 5 – 20 45 0.11 5.0 10-8 L/D
Rupture 20 - 100 100 0.05 2.2 10-8 L/D
Total 4.72 10-7 L/D
It should be remarked that all other interpretations and modifications of these data are
not part of the original dataset. The values displayed in italics are values derived from the
original Gulf data.
DNV has derived the following formula for global leakage frequency from the Gulf data:
F = 4.72 10-7L/D {3}

where
F = leakage frequency per year
L = pipe length (m)
D = pipe diameter (m)
Causes of failure of process pipes
Based on a study (DNV-Technica C1359, Feb. 1989; internal DNV document) in this context
comprising 921 accidents from international databases (HKC94) 72 causes of failure were
identified and divided into 12 categories. These causes were quantified further (DNV-
Technica study, H111, April 1991; internal DNV document) and can be used under specific
circumstances which are relevant to the failure of the pipe in order to refine the
abovementioned failure data. Table 28 provides an overview of the relevant causes and
their contribution, in terms of percentage, to the failure of process pipes.

Table 28: Contribution, in terms of percentage, of the partial causes of failure of process pipes
Cause Partial cause Contribution
(%)
Corrosion Wrong material 1.68
Corrosive contamination 0.38
Exceptional conditions 1.01
Aggressive environment 1.03
Poor protection 0.74
Zinc embrittlement 0.06
Cooling water circuit 0.06
Galvanic corrosion 0.33
Unknown 4.11
Erosion Turbulent flow 0.01
Unfavourable flow path 0.22
High flow speed 0.14
Erosive external environment 0.05
Unknown 0.27
Erosive contents 0.11
External pressure Removed pipe supports 0.28
Failure of pipe supports 0.98
Poor design of the supports 1.14
Unknown 0.11
External pressure 0.48
Temperature Insufficient material specification 0.87
Thermal pressures 0.38
Change of contents 0.60
Thermal shock 0.38
Poor pipe specifications 0.02
Domino effect 0.54
Unknown 1.01
Wrong installation Wrong placement of parts 0.16
Installation error 2.64
Insufficient equipment 1.09
Unknown 0.11
Procedural error Pipe not cleaned before opening 4.38
Wrong pipe worked on 0.87
Wrong equipment status 3.62
Wrong order of operations 2.90
Wrong (dis)connection of pipe/equipment 0.76
Pipe insufficiently insulated 1.56
Equipment not brought back to normal status 0.33
Unknown 3.78
Impact Impact of a nearby installation 1.68
Human impact 0.85
Falling object as a result of a natural cause 0.22
Vehicle impact 1.57
Unknown 0.43

Overpressure Source pressure too high 1.81
Failure of overpressure emergency stop system 0.22
High pressure source connected to low pressure side 0.11
Unexpected response 4.34
Freezing 1.18
Pressure pulses from flow heating 0.76
Pressure pulses from vibrating valves 0.11
Pressure pulse due to pump 0.05
Unknown 2.87
External pressure from heat 0.65
Vibration Vibration due to attached material 0.71
Vibration in the pipe due to faulty material 0.30
Unstable conditions 0.22
Design/installation error causes vibration 0.05
Water shock 0
Unknown 0.22
Material error Pipe 12.54
Valve 5.92
Gasket 5.48
Rupture disc 0.38
Other 1.79
Unknown 5.75
Unknown 9.0
Other Opening of a valve by excitation 0.11
Start-up 0.33
Sticking 0.65
Blocking of an open valve by a foreign body 0.05
Computer software failure 0.22
Bending moment too high in a curve 0.05
Perforation of an underground pipe 0.11
TOTAL 100
7.2. UNDERGROUND PIPELINES
Gas pipelines
The failure data for underground gas pipelines are derived from (EGIG, 2008). The EGIG
survey refers to the period 1970 – 2007. A total of 15 companies took part in the survey,
namely: DGC (Denmark), ENAGAS (Spain), Fluxys (Belgium), Gasum Oy (Finland), N.V.
Nederlandse Gasunie (The Netherlands), GRT Gaz (France), E.ON Ruhrgas AG (Germany),
SNAM Rete Gas (Italy), SWISSGAS (Switzerland), National Grid (United Kingdom), RWE
Transgas Net (Czech Republic), Ren Gasodutos S.A. (Portugal), Swedegas A.B. (Sweden),
Bord Gais Eireann (Ireland), OMV Gas GmbH (Austria).

The criteria for classification of incidents in this database are:
− there is always an accidental release of gas;
− the pipeline must meet the following conditions:
1. made of steel;
2. onshore;
3. maximum working pressure greater than 15 bar;
4. located outside the fences of the gas installations;
− the incidents do not refer to the corresponding equipment (valves,
compressors) or parts other than the pipeline itself.
Depending on the leak size the following three types of damage are distinguished:
− Crack: defect diameter equal to or smaller than 2 cm;
− Hole: defect diameter bigger than 2 cm and equal to or smaller than the
pipeline diameter;
− Rupture: defect diameter bigger than the pipeline diameter.
Failure frequencies
The failure frequencies for the entire period 1970-2007, for the last 5 years (2003-2007)
and for the last year (2007) are summarised in Table 29.
Table 29: Failure frequencies [/km.year] for gas pipelines (EGIG, 2008)
Period Number of incidents Population Failure frequency
[km.year] [/km.year]
1970-2007 1,172 3,150,000 3.7 10-4
2003-2007 88 620,000 1.4 10-4
2007 14 130,000 1.1 10-4
In Table 30 an overview is provided of failure frequencies by cause and type of leakage for
the period 1970-2007. These values were taken from figure 17 from (EGIG, 2008). Based on
this, the percentage for the different types of failure compared to the total failure
frequency can be determined.
Table 30: Failure frequencies [/km.year] for gas pipelines by cause (1970-2007) (EGIG, 2008)
Cause of incident
Type of
Third-party Construction Soil Operational
leakage Corrosion Other Total %
activity material movement errors
Crack 5.0 10-5 5.5 10-5 4.0 10-5 5.0 10-6 1.0 10-5 2.0 10-5 1.8 10-4 50.3
Hole 1.0 10-4 2.5 10-6 1.5 10-5 5.0 10-6 5.0 10-6 - 1.3 10-4 35.7
Rupture 3.5 10-5 - 5.0 10-6 1.0 10-5 - - 5.0 10-5 14.0
Together with the overall failure frequency of 1.4 10-4/km.year for the period 2003-2007,
this results in the following failure frequencies for the different types of failure for
underground gas pipelines:
− Crack: 7.2 10-5 /km.year;
− Hole: 5.1 10-5 /km.year;
− Rupture: 2.0 10-5 /km.year.

Causes of failure
Based on (EGIG, 2008) Table 31 was drawn up with an overview of the relevant causes and
their contribution, in terms of percentage, to the failure of the underground gas pipeline.
Table 31: Contribution, in terms of percentage, of the partial causes of failure of an underground
gas pipeline
Cause Partial cause Contribution per partial cause (%) Contribution per cause (%)
Excavation 18.85
Ground works 4.46
Public works 4.46
Third-party activity 49.6
Agriculture 4.46
Drainage 3.97
Unknown 13.39
External corrosion 12.47
Pitting 8.48
Galvanic corrosion 1.50
Corrosion Stress corrosion 0.62 15.4
Unknown 1.87
Internal corrosion 2.31
Unknown 0.62
Construction/material - 16.50 16.5
Bursting of a dike 0.07
Flood 1.31
Landslide 4.09
Soil movement 7.3
Mine 0.37
River 0.44
Other/unknown 1.02
Operational error - 4.60 4.6
Lightning 1.68
Other/unknown 6.7
Unknown 5.02
Liquid pipelines
The recommended data for this type of pipeline were deduced from (Concawe, 2008)
through analysis of incidents in the European oil pipeline network. The study comprises
pipelines used for transporting crude oil or petroleum products over a length of at least 2
km in the public domain running cross-country, including pumping stations and
intermediate storage facilities.
In (Concawe, 2008) the following arbitrary definitions were used for different leak sizes:
− Pinhole: less than 2x2 mm;
− Fissure: 2 to 75 mm long and up to 10% of the pipeline diameter wide;
− Hole: 2 to 75 mm long and at least 10% of the pipeline diameter wide;
− Split: 75 to 1000 mm long and up to 10% of the pipeline diameter wide;
− Rupture: more than 75 mm long and at least 10% of the pipeline diameter
wide.

‘No hole’ means that the spillage was caused by the failure of a gasket or seal, or
mechanical failure.
Failure frequencies
The failure frequencies for the entire 1971-2006 period, for the last 5 years (2002-2006)
and for the last year (2006) are summarised in Table 32.
Table 32: Failure frequencies [/km.year] of liquid pipelines (CONCAWE, 2008)

Period Number of incidents Population Failure frequency
[km.year] [/km.year]
1971-2006 448 800,000 5.6 10-4
2002-2006 54 174,000 3.1 10-4
2006 12 35,400 3.4 10-4
Liquid pipelines can be subdivided into hot and cold pipelines. The above failure
frequencies are totals including all pipelines. However, there is a considerable difference
in failure frequencies and causes between both types of pipelines. Generally speaking, hot
pipelines have a higher failure frequency caused by (external) corrosion. That is why in the
past a lot of these pipelines have been closed or converted into cold pipelines.
As (external) corrosion is typical for hot pipelines, which are currently scarce (0.8%),
(external) corrosion will not be taken into consideration as a cause of failure for hot
pipelines during the further elaboration of failure frequencies and causes of failure. For
the 2002-2006 period it concerns 1 failure, resulting in a failure frequency of 3.0 10-4/year.
The distribution according to leak size is reflected in Table 33. This table refers to the
1971-2006 period and was compiled based on the data of 239 incidents for which such
details were submitted.
Table 33:Distribution of failure of liquid pipelines according to leak type (1971-2006) (Concawe,
2008)
Leak type Number of incidents %
No hole 5 2
Pinhole 22 9
Fissure 37 15
Hole 81 34
Split 48 20
Rupture 46 19
The definitions used in (Concawe, 2008) differ from those used in (EGIG, 2008) (crack ≤ 20
mm, hole > 20 mm and rupture). In order to be able to use the same classification, the
categories ‘no hole’ and ‘pinhole’ will be included in ‘crack’ entirely. ‘Fissure’ and ‘hole’
will be divided over ‘crack’ and ‘hole’ (50% each). ‘Split’ will be classified entirely under
‘hole’. Finally, ‘rupture’ in (Concawe, 2008) will be equated to ‘rupture’ in (EGIG, 2008).

Together with the overall failure frequency of 3.0 10-4/year for the 2002-2006 period, this
results in the following failure frequencies for the different types of failure for
underground liquid pipelines:
− Crack (36%): 1.1 10-4 /km.year;
− Hole (45%): 1.4 10-4 /km.year;
− Rupture (19%): 5.9 10-5 /km.year.
Causes of failure
Based on (Concawe, 2008) Table 34 was drawn up with an overview of the relevant causes
and their contribution, in terms of percentage, to the failure of the underground liquid
pipeline. In the determination of the contribution per (partial) cause the contribution of
hot pipelines for the cause of (external) corrosion was also left out.
Table 34: Contribution, in terms of percentage, of the partial causes of failure of underground
liquid pipelines
Contribution Contribution
Cause Partial cause per partial per cause
cause (%) (%)
Welding error 2.54
Construction error 1.52
Construction
Installation error 2.54
Other/unknown 4.06
Mechanical 28.42
Design error 1.78
Wrong material 6.85
Design and material
Age/fatigue 1.52
Other/unknown 7.61
Equipment 0.51
System Control systems 0.76
Other/unknown 1.27
Operational Not made pressure-free or drained 0.76 7.87
Wrong treatment 3.30
Human
Wrong maintenance/construction 1.02
Other/unknown 0.25
External corrosion 11.68
Corrosion Internal corrosion 5.84 18.54
Stress corrosion 1.02
Landslide 1.27
Subsidence 0.76
Soil movement
Earthquake 0.25
Natural hazards 3.80
Other/unknown 0.25
Flood 0.76
Other
Unknown 0.51

Construction
Excavation 9.14
Bulldozer 3.30
Agriculture
Excavation 7.61
Bulldozer 0.76
Accidents Other 0.51
Underground infrastructure
Third-party activity Excavation 3.05 41.38
Bulldozer 0.76
Drilling/explosion 2.28
Other 1.02
Other/unknown 1.02
Terrorism 0.51
Intentional damage Vandalism 1.27
Theft 3.55
Incidents 6.60
The failure frequencies for above ground pipelines were derived from the Gulf Data.
The failure frequencies for underground pipelines were derived from a combination of the
failure frequencies for gas and liquid pipelines, as no significant differences can be
observed in the failure frequencies for the most recent period for underground gas and
liquid pipelines. The underlying data were derived from, respectively, (EGIG, 2008) and
(Concawe, 2008), always using data for the most recent period. The total failure frequency
is determined in Table 35.
Table 35: Failure frequency for underground pipelines (EGIG, 2008; Concawe, 2008)
Source Number of Total number km.yr Frequency [/km.yr]
incidents and 99 % reliability interval
EGIG 88 620,000 1.1 10-4 - 1.4 10-4 – 1.9 10-4
Concawe 53 174,000 2.1 10-4 – 3.0 10-4 - 4.3 10-4
Total 141 794,000 1.4 10-4 – 1.8 10-4 - 2.2 10-4
In Table 36 an overview is provided of failure frequencies according to type of leakage for

gas and liquid pipelines together.
Table 36: Failure frequency [/km.yr] according to type of leakage

Type of Failure frequency [/km.yr]
Number of incidents
leakage and 99 % reliability interval
Crack 63 5.6 10-5 - 7.9 10-5 – 1.1 10-4
Hole 55 4.8 10-5 - 6.9 10-5 – 9.7 10-5
Rupture 22 1.5 10-5 - 2.8 10-5 – 4.7 10-5

Chapter 8: Loading and unloading activities
8.1. LOADING AND UNLOADING OF ROAD TANKERS, TANKWAGONS AND SHIPS

In Table 37 the failure data recommended in (RIVM) are given for loading and unloading
activities with pressure tanks and atmospheric tanks of road tankers, tankwagons and ships
within a company. The definitions used for the phenomena described are the following:
− L.1a: Complete rupture of the loading and unloading hose. The outflow is
located at both sides of the complete rupture.
− L.2a: Leak in the loading and unloading hose. The outflow takes place via a
leak with an effective diameter of 10% of the nominal diameter, which is
not bigger than 50 mm.
− L.1b: Complete rupture of the loading and unloading arm. The outflow is
located at both sides of the complete rupture.
− L.2b: Leak in the loading and unloading arm. The outflow takes place via a
leak with an effective diameter of 10% of the nominal diameter, which is
not bigger than 50 mm.
Table 37: Failure frequencies for loading and unloading activities (RIVM)
L.1a L.2a L.1b L.2b
per hour per hour per hour per hour
Pressure tank
4 10-6 4 10-5 3 10-8 3 10-7
Atmospheric tank
The frequency of catastrophic rupture of a loading arm or loading hose of road tankers,
tankwagons and ships was derived from the COVO study (COVO81, AEC75, We76, Ja71).
Here, a failure frequency is used for a pipeline hose under light pressure; the rupture
frequency of a pipeline hose under high pressure is a factor 10 higher. The leakage
frequency is supposed to be 10 times higher than the rupture frequency. When calculating
the amounts of outflow the available safety measures, such as leak detectors, manually or
automatically operated emergency valves and the corresponding response times should be
taken into account.
8.2. LOADING AND UNLOADING OF LPG
The failure frequencies for LPG hoses stem from (HSE), where the following failure
frequencies are mentioned specifically for the (un)loading of LPG:
Leak size (mm) Nominal leak diameter (mm) Failure frequency (/hr)
3-10 5 2.7 10-6
10- 50 25 2.7 10-6
Rupture 50 5.4 10-7
It is also mentioned that the hoses are equipped with break-away couplings, creating
protection against causes which would give rise to too much mechanical pressure (e.g. a

tanker driving off with a connected hose). This way, this cause is eliminated for the hose
rupture scenario.
The failure frequencies for loading and unloading activities were taken from (RIVM).
Failure frequencies for the flexible loading hoses for LPG were added to these (HSE).
For the failure frequencies of the road tankers and tankwagons themselves we refer to the
chapter on pressure tanks and atmospheric tanks.

Chapter 9: Fire in warehouses
Several statistical studies are available on the probability of occurrence of a fire in a

warehouse. The meaning given to ‘fire’ is not the same in the different studies, but
broadly speaking, three categories can be distinguished:
− Incident: this is a situation where it can be said that there has been a fire, but
where the damage is limited or inexistent thanks to fast intervention. It is very hard
to gather reliable statistical data on this kind of situations.
− Reported fire: the fire was reported by the authorities, which means that the fire
brigade had to intervene.
− Extremely serious fire: the accident complies with the Seveso legislation. Certain
authors opt for the criterion of the collapse of the warehouse roof.
In 1992 Hymes (Hymes et al., 1992) carried out a study (by order of the British HSE)
referring to storage warehouses in the United Kingdom during the period 1976-1987. Hymes
refers to an older study by Baldwin, which had found a frequency of 1.2 10-2 for reported
fires per warehouse and per year.
Hymes concludes that per warehouse 1 to 5 situations per year occur in which the use of a
fire extinguisher is required.
Hymes mentions a total of 351 reported fires on a total population of 36,192

warehouse.years. This results in a frequency of 9.7 10-3 reported fires /warehouse.year
with a 99 % reliability interval which equals 8.4 10-3 – 1.1 10-2.
Hymes found that in 20.5% of cases fires escalated into extremely serious fires (collapse of
the roof).
For 25% of fires there was insufficient information available to be able to decide whether
there was escalation or not.
If it is assumed that escalation into an extremely serious fire took place as well in 20.5% of
these unknown cases, this means a total of 90 fires that escalated into an extremely
serious fire (26%). This results in a frequency of 2.5 10-3 extremely serious
fires/warehouse.year with a 99% reliability interval equal to 1.8 10-3 - 3.2 10-2.
Whether or not a fire escalates will depend, among other things, on the intervention
resources.
For warehouses equipped with a sprinkler installation it turned out that the sprinkler
installation was not able to control the fire in 7% of cases, i.e. it was able to control the
fire in 93% of cases. In other words, if all 351 warehouses had been equipped with an
automatically activated sprinkler system, only 25 fires would have escalated into
extremely serious fires. This results in a frequency of occurrence of 6.6 10-4 extremely
serious fires per warehouse.year with a 99% reliability interval equal to 3.9 10-4 - 1.1 10-3.

Conclusion – Generic failure frequencies HBFF2009
For a fire in warehouses the failure frequencies obtained by Hymes are used.

Chapter 10: Packaging units
The failure frequencies for packaging unit storage and handling were obtained from
practical data from different Flemish Seveso establishments (SGS). The data on which the
failure frequencies are based are shown in the table below.
Table 38: Overview of data from Flemish Seveso establishments

Packaging unit
Packaging unit handling
storage
Number
Population
Company Production/storage Period of Number Population Number
(packaging
years of (packaging of
unit
failures unit years) failures
handling)
1993-
1 Storage 13 1 1,040,000 25 2,860,000
2005
2005-
2 Process 2 16 132,354 12 529,416
2006
2002-
3 Storage 5 0 -* 26 108,000
2006
2004-
4 Storage 3 0 -* 7 15,000
2006
2003-
5 Process 4 15 29,665 23 88,995
2006
1995-
6 Process 11 3 75,342 5 150,683
2005
Total 35 1,277,361 98 3,752,094
2.64 10-5
2.74 10-5
Failure frequency [/packaging unit
[/packaging unit year]
handling]
1.98 10-5 – 3.38 10-5
1.72 10-5 – 4.18 10-5
99% reliability interval [/packaging unit
[/packaging unit year]
handling]
* no data on packaging unit storage available
Based on the practical data insight could be obtained into the distribution of the causes of
failure and the released amount of product. In the table below this is illustrated for
packaging unit handling and storage.
Table 39: Causes of failure for packaging unit handling and storage
Packaging unit handling Packaging unit storage
Cause of failure Percentage Cause of failure Percentage
Perforation/collision 31% Leaking valve or sealing 42%
Fall 29% Fall 13%
Leaking valve or sealing 9% Mechanical pressure 13%
Nail (on pallet or lorry floor) 9% Heat 3%
Unknown 23% Unknown 29%

Moreover, based on the practical data a distribution of the released amount of product
could be drawn up. This is reflected in Table 40.
Table 40: Release in case of packaging unit failure

Release Percentage Release Percentage
< 100 kg or l 51% < 100 kg or l 65%
> 100 kg or l 40% > 100 kg or l 19%
Unknown 9% Unknown 16%
If the distribution of the known released amounts is applied to the failures for which no
released amounts are known, the distribution of released amounts below can be
determined for packaging unit handling and storage.
Table 41: Distribution of released amounts for packaging units

Release Percentage Release Percentage
≤ 100 kg or l 56% ≤ 100 kg or l 77%
> 100 kg or l 44% > 100 kg or l 23%
In (CPR15) a failure frequency ten times lower is used for the simultaneous failure of two
vessels than for the failure of one vessel.
Conclusion – Generic failure frequencies HBFF2009
For packaging unit storage and packaging unit handling a failure frequency of respectively
2.5 10-5 per packaging unit year and per packaging unit handling is obtained based on Table
38 (rounded off). For packaging unit handling this failure frequency only applies in case of
failure of 1 item of packaging units. The failure frequency for packaging unit handling
where all packaging units on a pallet fail is 10 times lower than that of 1 failing packaging
unit.

Chapter 11: Repression systems
For the probabilities of failure and the response times of repression systems the
information from (RIVM) is taken as a basis (see below).
11.1.B
1.1. BLOCKING SYSTEMS
Definition and characteristics
Blocking systems are used to limit the released amount following a release. A blocking
system consists of a detection system, for instance gas detection, combined with shut-off
valves. The valves can be shut off automatically or manually.
The effectiveness of a blocking system is determined by various factors, such as the
position of gas detection monitors and their distribution throughout the various wind
directions. Furthermore, the detection limit and the response time of the system as well as
the operator’s intervention time are also relevant.
The following conditions must be met in order to include the operation of a blocking
system in the risk analysis:
− an automatic detection system must be available that results in signalling in the
control room or automatic operation of the blocking valves. An example of this is a
gas detection system with sufficiently sensitive monitors and adequate detection
points. In the case of signalling in the control room this room must be continuously
staffed.
− the detection system and the shut-off valves must be regularly tested.
For situations in which there is no automatic detection system but instead only visual
monitoring by an operator, please refer to 11.4.
Modelling
The effect of a blocking system must be determined using a specific event tree, in which
the failure of the system is also considered. The default values specified here for three
representative systems can be used as a guideline. It should be emphasised that the values
set out below are only included to give an impression of generally accepted values. For a
quantitative risk analysis the actual situation must be taken as a basis, particularly if the
probabilities of failure and response times vary significantly from the default values
specified here.
1 Automatic blocking system

An automatic blocking system is a system in which leak detection and the closing of
blocking valves is automatic. Action by an operator is not necessary. The probability of
failure per operation is 0.001, and the time required for closing the blocking valves is 2
minutes.

2 Semi-automatic blocking system
A semi-automatic blocking system is a system in which the detection of the leak takes
place automatically and leads to an alarm signal in a continuously staffed control room.
After validating the signal the operator closes the blocking valves by actuating a switch in
the control room. The probability of failure per operation is 0.01, and the time required
for closing the blocking valves is 10 minutes.
3 Non-automated blocking system

A non-automated blocking system is a system in which the detection of the leak takes
place automatically and leads to an alarm signal in a continuously staffed control room.
The operator does not have the facilities to shut off the blocking valves by actuating a
switch in the control room, but has to take action outside the control room. For such a
system the time required to effectively perform the required actions is so long that there
is no effect on the quantitative analysis, given the maximum duration of an outflow of 30
minutes that is generally applied.
If several blocking systems are in place, the probability of failure of the entire blocking
system must be determined. This is not necessarily equal to the product of the individual
probabilities of failure for each blocking system, because often ‘common mode failures’
occur. In practice, it appears to be extremely difficult to achieve a probability of failure of
0.001 or lower for (a combination of) blocking systems. If in a quantitative analysis a
probability of failure per operation of less than 0.001 is used in the calculation, this must
be explicitly substantiated using a fault tree analysis, taking ‘common mode failures’ into
account.
Example
A 10 meter pipe (3”) is connected with the liquid phase of a pressure tank of ammonia (100
tonnes). A blocking valve is available between the pipe and the tank. The scenarios for
pipe rupture are set out for the various systems in Table 42.
Table 42: Scenarios for pipe rupture in an ammonia pressure tank for blocking systems
Blocking system Functioning Frequency (per year) Flow rate Duration of
(kg/s) outflow (s)
None NA 3 10-6 16.5 1,800
Automatic blocking fails 3 10-9 16.5 1,800
system works 2.997 10-6 16.5 120
Semi-automatic fails 3 10-8 16.5 1,800
blocking system works 2.97 10-6 16.5 600
Non-automated NA 3 10-6 16.5 1,800
blocking system

11.2.E
11.2. EXCESS FLOW VALVE
Definition
An excess flow valve is a valve that closes if the flow rate exceeds a set value.
Characteristics
An excess flow valve is a system in which the valve closes automatically if the flow rate
exceeds a set value, for example because the pressure on a valve exceeds the spring
pressure. A system in which a detector emits a signal as a result of which a valve is shut off
is not an excess flow valve, but a blocking system.
Modelling
An excess flow valve is included in a quantitative risk analysis. Its operation depends on
the ratio between the calculated outflow rate and the set value of the excess flow valve.
Probabilities of failure as displayed in Table 43 apply.
Table 43: Possibilities of failure for excess flow valve

Relation between outflow rate and set value Probability of not closing
outflow rate ≤ set value 1
set value < outflow rate ≤ 1.2 × set value 0.12
outflow rate > 1.2 × set value 0.06
The response time of the excess flow valve is five seconds.
Example
When (un)loading a road tanker with 20 tonnes of LPG (see Figure 4) two excess flow
valves are available, namely internally (EFV-1 between the tanker and the pump, set value
13.1 kg/s) and behind the pump (EFV-2 between the pump and the filling point, set value
7.4 kg/s). Based on the outflow rates (Ham JM and van Blanken AWT (2004)) the
probabilities of failure for the various releases are set out in Table 44; the resulting
scenarios are set out in Table 45.

Figure 4: (Un)loading of an LPG tanker
Table 44: Releases for (un)loading and probabilities of failure for excess flow valves
LOC Flow rate (kg/s) Probability of Probability of
closing EFV-1 closing EFV-2
Base pipeline rupture 28 0.94 NA
Base pipeline leakage 1.1 0 NA
Unloading hose rupture 8.4 0 0.88
Unloading hose leakage 0.5 0 0
Table 45: Scenarios for loading and unloading activities

LOC System response Probability of Flow rate Duration (s)
consequence (kg/s)
Base pipeline rupture EFV-1 closes 0.94 28.0 5
Base pipeline rupture EFV-1 fails 0.06 28.0 714
Base pipeline leakage EFV-1 does not 1 1.06 1,800
close
Unloading hose rupture EFV-2 closes 0.88 8.4 5
Unloading hose rupture EFV-2 fails 0.12 8.4 1,800
Unloading hose leakage EFV-2 does not 1 0.46 1,800
close
Remarks
1. The duration of outflow of 5 s still needs to be extended by the time required for
the outflow of the contents of the hoses with the given flow rate.
2. The contribution of the outflow from the storage tank still needs to be taken into
account.

11.3.N
1.3. NON-RETURN VALVE
Definition
A non-return valve is a valve that closes when the direction of the flow is against the set
direction.
Characteristics
A non-return valve is a system in which the valve automatically closes when return flow
occurs. A system in which a detector emits a signal as a result of which a valve is closed is
not a non-return valve, but a blocking system.
Modelling
Generally speaking, non-return valves are not very reliable. If they are not regularly
tested, non-return valves are not included in a quantitative risk analysis.
If a non-return valve is regularly tested, it is included.
The default response time is five seconds and the default probability of failure is 0.06 per
operation.
Example
When unloading from an LPG tanker into a storage tank, return flow will occur in the event
of a rupture of the loading hose. The outflow rate from the storage tank is 7 kg/s. Table 46
shows the contribution of the return flow to the rupture scenario if a non-return valve is
available.
Table 46: Contribution of the return flow from the storage tank to the rupture scenario
Release System response Probability of Flow rate Duration (s)
consequence (kg/s)
Unloading hose Non-return valve 0.94 7 5
rupture closes
Unloading hose Non-return valve fails 0.06 7 1,800
rupture
11.4. OPERATOR INTERVENTION
Description
During (un)loading operations there is often an operator 3 present on site who supervises
the process and is able to operate a valve by actuating an emergency stop. Operator
intervention during (un)loading can be included in the quantitative risk analysis, provided
the following conditions are met:
3
A driver can also be regarded as an operator during (un)loading.

1. From the start to the end of the (un)loading operation the operator present on site
has a view of the (un)loading and the loading/unloading hose or arm. In particular,
the operator is not sitting in the cabin of the road tanker or inside a building during
the (un)loading operation.
2. The on-site presence of the operator is guaranteed by a device such as a dead
man’s handle or by a procedure in the safety management system and is checked
during inspections.
3. The activation of the emergency stop by the operator present in case of leakage
during (un)loading is described in a procedure.
4. The operator present on site is adequately trained and is also familiar with the
applicable procedures.
5. The emergency stop is positioned according to the applicable standards, so that it
can be activated quickly regardless of the direction of the outflow.
If these conditions are met, the duration of outflow can be limited to two minutes in the
quantitative risk analysis. If one of these conditions is not met, the duration of the outflow
to be observed is 30 minutes. The effective operation of an emergency stop has a
probability of failure of 0.1 per operation.
Example
When (un)loading ammonia into a road tanker (outflow rate 8.4 kg/s) there is continuous
supervision by the operator. The presence of the operator is guaranteed by a procedure.
The operator has the possibility to press an emergency button immediately, which stops
the (un)loading operation and closes valves. The (un)loading scenarios are set out in Table
47.
Table 47: (Un)loading scenarios with continuous operator presence

LOC System response Probability of Flow rate Duration (s)
consequence (kg/s)
Loading hose Operator intervention 0.9 8.4 120
rupture
Loading hose No operator intervention 0.1 8.4 1,800
rupture
Loading hose Operator intervention 0.9 0.46 120
leakage
Loading hose No operator intervention 0.1 0.46 1,800
leakage
Remarks
1. The duration of outflow still needs to be extended by the time required for the
outflow of the contents of the hoses with the given flow rate.
2. Any contribution from the outflow from the tanker also needs to be taken into
account.

11.5.C
.5. CONCLUSION – GENERIC FAILURE FREQUENCIES HBFF2009
For repression systems the probabilities of failure from (RIVM) are taken as a basis. The
Handbook on Failure Frequencies 2009 takes over the insights from (Sertius) and
recommends basing the probabilities of failure on specific data, e.g. on (IEC1) and (IEC2).

Chapter 12: Consequential events
12.1.E
.1. EVENT TREE
Depending on the circumstances under which the release of a hazardous substance takes
place, and on the nature of the release, this release can result in different dangerous
phenomena. This is represented in a general way in the event tree of Figure 5, in which
the different phenomena to be taken into account are indicated by ‘E0’, ‘E1’, etc.
(Sertius).
Figure 5: Generic event tree

direct delayed explosion
ignition ignition PE
PD PV
E1 PD
E0
E2 ( 1-PD) ×PV ×PE
E3 ( 1-PD) ×PV ×( 1-PE )
E4 ( 1-PD) ×( 1-PV )
The hazardous phenomena to be taken into consideration are displayed for the different
substance types in Table 48 for rupture and in Table 49 for leakage and 10-minute outflow.
Table 48: Hazardous phenomena for rupture

Effect Non-combustible substances Group 0 Group 1 Groups 2 and 3
E0 Physical explosion Physical explosion Physical explosion Physical explosion
Fire ball (under
pressure)
E1 - Pool fire Pool fire
Pool fire
(pressureless)
Vapour cloud Vapour cloud
E2 - explosion explosion -
Pool fire Pool fire
Flash fire Flash fire Flash fire
E3 -
Pool fire Pool fire Pool fire
E4 Toxic vapour cloud Toxic vapour cloud Toxic vapour cloud Toxic vapour cloud

Table 49: Hazardous phenomena for leakage and complete outflow in 10 min.
Effect Non-combustible substances Group 0 Group 1 Groups 2 and 3
E0 - - - -
Jet fire
E1 - Pool fire Pool fire
Pool fire
Vapour cloud
Vapour cloud
explosion
E2 - explosion -
Jet fire
Pool fire
Pool fire
Flash fire
Flash fire Flash fire
E3 - Jet fire
Pool fire Pool fire
Pool fire
E4 Toxic vapour cloud Toxic vapour cloud Toxic vapour cloud Toxic vapour cloud
The practical completion of the event tree is done based on 4 parameters, namely:
1. The nature of the release:
− Rupture;
− Leakage and complete outflow in 10 min.
2. The nature of the substance:
− Non-combustible gases and liquids.
− Combustible gases and liquids, distinguishing further between:
Gases or liquid vapours with low reactivity 4 ;
Gases or liquid vapours with medium or high reactivity.
3. The circumstances the substance is in at the time of the release:
− Group 0: the product is in a gaseous state, the product is above the
atmospheric boiling point or the atmospheric boiling point of the product is
lower than or equal to -25°C.
Typical examples: LPG storage, LNG and other cold storage, boiling solvents
in reactors, storage in gasometer, etc.
− Group 1: the product is at or above the flashpoint, but below the
atmospheric boiling point.
Typical example: storage of P1 products.
− Group 2: the product is at a temperature which is less than 35°C below the
flashpoint.
Typical example: storage of P2 products.
− Group 3: the product is at a temperature which is 35°C or more below the
flashpoint.
Typical example: storage of P3 and P4 products.
This parameter is only considered for combustible gases and liquids.
4. The amount of the release:
4
The reactivity of a substance is understood to mean its susceptibility to flame acceleration. This is
determined on the basis of information such as the size of the explosion area, the minimum ignition
energy, the spontaneous combustion temperature, experimental information and experience in
practical situations. According to (PB99) the following substances are low reactive:
- allyl chloride - ethyl chloride - methyl chloride
- ammonia - carbon monoxide - tetraethyl lead
- dichloropropene - methane
- epichlorohydrin - methyl bromide

− Instantaneous source term < 1.000 kg, continuous source term < 10 kg/s.
− Instantaneous source term 1,000 – 10,000 kg, continuous source term 10 -
100 kg/s.
− Instantaneous source term > 1000 kg, continuous source term > 100 kg/s.
This parameter is only considered for combustible gases and liquids.
12.2.P
.2. PROBABILITIES OF IGNITION (SERTIUS)
Direct ignition in groups 0 and 1
The probability of direct ignition (PD) for groups 0 and 1 is taken from (HBKC 2004). These
probabilities of ignition are also mentioned in (RIVM). The result can be seen in Table 50.
Table 50: Direct ignition in groups 0 and 1

Source term Probability of ignition
Type of Group 0 – Group 0 –
Continuous Instantaneous Group Group Group
ignition high low
[kg/s] [kg] 1 2 3
reactivity reactivity
< 10 < 1,000 PD 0.2 0.02 0.065
PU
PE
10 – 100 1,000 – PD 0.5 0.04 0.065
10,000 PU
PE
> 100 > 10,000 PD 0.7 0.09 0.065
PU
PE
Late ignition in groups 0 and 1
The probability of late ignition (PU) of highly reactive gases can be taken from (HBKC 2004). For
the probability of late ignition (PU) of low reactive gases and group 1 it is supposed that this is
equal to the probability of direct ignition (SGS, July 2007). The result can be found in
Table 51.

Table 51: Late ignition in group 0 and 1 products
ignition high low
[kg/s] [kg] 1 2 3
< 10 < 1,000 PD 0.2 0.02 0.065
PU 0.05 0.02 0.065
PE
10 – 100 1,000 – PD 0.5 0.04 0.065
10,000 PU 0.1 0.04 0.065
PE
> 100 > 10,000 PD 0.7 0.09 0.065
PU 0.2 0.09 0.065
PE
Explosion in groups 0 and 1
The probability of explosion is determined with the help of Prugh’s model (Prugh, 1988).
This model determines the probability of explosion and late ignition based on the mass
present in the explosion area. Figure 6 displays the graph representing the
abovementioned relationships.

Figure 6: Probability of explosion and probability of late ignition according to Prugh’s model
(Prugh, 1988)
PE
0.1
probability
PU
0.01
0.001
102 103 104 105
Mass in explosion area [kg]
For gases, both highly and low reactive, it is (conservatively) assumed that the mass in the
explosion area is not much smaller than the mass of the instantaneous source term. As a
result, the probability of explosion can be read from the figure based on this mass. For
liquids the mass in the explosion area is determined based on the probability of late
ignition. In turn, this results in the probability of explosion. The result of the above
reasoning can be found in Table 52.
Table 52: Explosion in groups 0 and 1

ignition high low
[kg/s] [kg] 1 2 3
< 10 < 1,000 PD 0.2 0.02 0.065
PU 0.05 0.02 0.065
PE 0.2 0.2 0.2
10 – 100 1000 – 10,000 PD 0.5 0.04 0.065
PU 0.1 0.04 0.065
PE 0.3 0.3 0.2
> 100 > 10,000 PD 0.7 0.09 0.065
PU 0.2 0.09 0.065
PE 0.4 0.4 0.2

Groups 2 and 3
The probability of direct ignition for groups 2 and 3 is based on the proportions used for
tank fires (see paragraph 4.4). For group 2 this proportion is 0.3 of the probability of
ignition of group 1; for group 3 it is 0.09 of the probability of ignition of group 1. It is
assumed that the probability of late ignition for groups 2 and 3 is negligible. Table 53
gives an overview of the resulting probabilities of ignition.
The probability of explosion (PE) for groups 2 and 3 is very low.
Table 53: Ignition and explosion for groups 2 and 3

ignition high low
[kg/s] [kg] 1 2 3
< 10 < 1,000 PD 0.2 0.02 0.065 0.02 0.006
PU 0.05 0.02 0.065 - -
PE 0.2 0.2 0.2 - -
10 – 100 1,000 – PD 0.5 0.04 0.065 0.02 0.006
10,000 PU 0.1 0.04 0.065 - -
PE 0.3 0.3 0.2 - -
> 100 > 10,000 PD 0.7 0.09 0.065 0.02 0.006
PU 0.2 0.09 0.065 - -
PE 0.4 0.4 0.2 - -
Correction delayed ignition
Delayed ignition as intended in HBFF 2009 is not the same as the late ignition in the
previous tables, and should therefore be corrected. The late ignition in the previous tables
results from the reasoning that the probability of no ignition equals 1 - PD - PU. However,
from the event tree used here it follows that this probability equals (1 – PD).(1 – PV). From
this, it can be concluded that PV = PU/(1 – PD). The final result can be found in Table 54.
Table 54: Correction delayed ignition

ignition high low
[kg/s] [kg] 1 2 3
< 10 < 1,000 PD 0.2 0.02 0.065 0.02 0.006
PV 0.06 0.02 0.07 - -
PE 0.2 0.2 0.2 - -
10 – 100 1000 – 10,000 PD 0.5 0.04 0.065 0.02 0.006
PV 0.2 0.04 0.07 - -
PE 0.3 0.3 0.2 - -
> 100 > 10,000 PD 0.7 0.09 0.065 0.02 0.006
PV 0.7 0.1 0.07 - -
PE 0.4 0.4 0.2 - -

The consequential events are determined based on the reasoning above.

Chapter 13: References
AEC75, US, Atomic Energy Commission, reactor safety study – an assessment of accident
risks in the U.S. Commercial Nuclear Power Plants, WASH-1400, appendix III Failure data
(and references therein), 1975
American Institute of Chemical Engineers (AIChE) 1989, Guidelines For Process Equipment
Reliability Data, PERD
Arulanantham D.C., Reeves F.P. (1981), Some data on the reliability of pressure equipment
in the chemical plant environment, Int. J. Press. Vessels & Piping, 9 (1981), pp 327-338
ARF99, DNV (1999), ARF Document, Technical Note, Process Equipment Failure Frequencies
AMINAL, Safety Reporting Division (1994), Handboek Kanscijfers voor het opstellen van een
veiligheidsrapport
AMINAL, Safety Reporting Division (2004), Handboek Kanscijfers voor het opstellen van een
veiligheidsrapport
Blything and Reeves (1988), An initial prediction of the BLEVE frequency of a 100 te butane
storage vessel, SRD/HSE R488
Cavrois E. (1985), Histoire des bouteilles à gaz, IGC Documents 31/5/F
Concawe, Western Europe Cross-Country Oil Pipelines. 25-Year Performance Statistics –

Concawe Brussels, June 1998
Concawe, report 7/08, Performance of European cross-country oil pipelines. Statistical

summary of reported spillages in 2006 and since 1971, August 2008
COVO81, COVO commission, Risk analysis of six potentially hazardous industrial objects in
the Rijnmond area, a pilot study, a report to the Rijnmond public authority, Schiedam:
Central Environmental Control Agency Rijnmond, 1981
CPR15, VROM, Risico-analyse methodiek CPR15-bedrijven, The Hague, October 1997
Crossthwaite, P.J., Fitzpatrick, R.D. & Hurst, N.W. (1988), ‘Risk Assessment for the Siting
of Developments near Liquefied Petroleum Gas installations’, IcemE Symposium Series No
10
Davidson (1988)
DNV, Decat, G., Wouters, G., Eindverslag van de onderzoeksopdracht “Actualisatie

Handboek Kanscijfers” t.b.v. externe veiligheidsrapportering, April 2001

Dorey (1979), Reliability Data derived from EDF operating experience, Second National
Reliability Conference, March 1979
EGIG, 7th EGIG report (1970-2007), Doc. Number EGIG 08.TV-B.0502, December 2008
EPRI (1981), Component Failure and Repair Data for Coal-fired Power Units
Ham JM and van Blanken AWT (2004), Invloed systeemreacties LPG-tankinstallatie op risico
LPG-tankstation (ligging PR-contour). TNO report R 2004/107
[HBKC1994], Handboek Kanscijfers ten behoeve van het opstellen van een
veiligheidsrapport, Ministry of the Flemish Community, LIN, AMINAL, Hazardous Substances
and Risk Management Division, 1994
[HBKC2004], Handboek Kanscijfers voor het opstellen van een veiligheidsrapport, Ministry
of the Flemish Community, LIN, AMINAL, Safety Reporting Division, 2004
HSE (1991), Advisory Committee on Dangerous Substances, Major hazard aspects of the
transport of dangerous substances, HSE-books, 1991
HSE (1997), Offshore Hydrocarbon Release Statistics 1997, Offshore Technology Report OTO
97 950
Hymes I and Flynn JF (1992), The Probability of Fires in Warehouses and Storage Premises,
SRD/HSE R578
IEC1, IEC 61508: Functional Safety of electrical/electronic/programmable electronic

safety-related systems
IEC2, IEC 61511: Functional safety – Safety instrumented systems for the process industry
sector
Ja71, Jacobs, R.M., Minimizing hazards in design, Quality progress, 1971
Johnson DW and Welker JR (1981), Development of an improved LNG plant failure rate
data base, Gas Research Institute
Lauriks L and Vandorpe S (1983), Pompen algemene aspecten – toepassingen – keuze,

Water no 8, January 1983
Lees FP (1980), Loss Prevention in the Process Industries, Butterworths
LFP97 (1997), LASTFIRE PROJECT (Large Atmospheric Storage Tank Fire Project), Analysis
of Incident Frequency Survey

LFPRW97 (1997), LASTFIRE PROJECT (Large Atmospheric Storage Tank Fire Project), Risk
Workbook
Marchal (1985), Bouteilles à gaz – Analyse Statistique des accidents, IGC Document 31/85/F
NFPA30 (07/08/1987), Flammable and Combustible Liquids Code, ANSI/NFPA30, an

American National Standard
OREDA92, Offshore reliability data, 2nd edition, DNV Technica, 1992
OREDA97, Offshore Reliability Data, 3rd edition, Sintef Industrial Management, Norway,
1997
PB99, CRP18E; Purple Book, Guidelines for quantitative risk assessment, Sdu Uitgevers, The
Hague, Committee for the Prevention of Disaster, 1st edition, 1999
Perry RH (1985), Perry’s Chemical Engineering’s Handbook, McGraw-Hill Book Co
Prugh RW (1988), Evaluation of unconfined vapour cloud explosion hazards, Proc. Int’l
Conf. Vapor Cloud Modelling, AlChE, NY
Reeves, A.B., Minah, F.C. & Chow, V.H.K. (1997), ‘Quantitative Risk Assessment
Methodology for LPG Installations’, EMSD Symposium on Risk and Safety Management in Gas
Industry, Hong Kong, March 1997
Rholf FJ and Sokal RR (1995), Statistical Tables, Third edition, State University of New
York, Stony Brook
RIVM/CEV (1 January 2008), Handleiding Risicoberekeningen BEVI, version 3.0
Sertius (2009), LV\090402, 27.04.2009
SGS (July 2007), TWOL project ‘Actualisatie van de faalfrequenties in risicoberekeningen in

Sevesobedrijven’, end report
Smith DJ (1988), Reliability and Maintainability in Perspective, MacMillan, 1987
Smith, T.A. and Warwick, R.G. (1981), ‘A Survey of Defects in Pressure Vessels in the UK
for the Period 1962-78, and its Relevance to Nuclear Primary Circuits’, UKAEA Safety and
Reliability Directorate Report SRD R203
Svensson and Sjǿrgen (1988), Reliability of Plate Heat Exchangers in the Power Industry,
ASME/IEEE Power Generation Conference, 1988

VvoW95 (1995), Systematiek voor indeling van stoffen ten behoeve van risico-berekeningen
bij het vervoer van gevaarlijke stoffen. Project Veilig Vervoer over Water; Deelproject
S3b. The Hague: Ministry of Transport, Public Works and Water Management.
We76, Welker, J.R., et al, Fire safety aboard LNG vessels, NTISAD/A – 030 619, 1976
Westinghouse, Savannah River Site Generic Data Base Development (U), WSRC-TR-93-262,
rev. 1, May 1998
Whittle (1993), LPG installation design and general risk assessment methodolgy employed
by the gas standards office, Conference on risk & safety management in the gas industry,
Hong Kong, October 1993

Appendix
STATISTICAL BACKGROUND
In the recommended failure frequencies the reliability interval is calculated based on the
Poisson distribution. To calculate the reliability interval around the mean of the Poisson
distribution the method used is that of (F. J. Rohlf, R.R. Sokal, 1995) (this refers to E.L.
Crown and R.S. Gardner in Biometrika 46:441-453, 1959). These values are recommended
because they show a continuous progression. The reliability intervals calculated according
to Pearson (Pearson, 1954) for values of n between 10 and 15 show some discontinuities.
For values of λ (number of incidents) lower than or equal to 50 (λ ≤ 50) the 99% double
reliability interval for a Poisson variable can be calculated by means of the corresponding
values in the table below.
For values of λ (number of incidents) higher than 50 (λ > 50) the 99% double reliability
interval can be calculated by means of the following formulas:
for the lower limit: Ml = λ - 1/2 + 3/8 * (2.576)² - 2.576 * λ − 1 / 2 + 1 / 8 * ( 2.576)²
for the upper limit: Mu = λ + 1/2 + 3/8 * (2.576)² + 2.576 * λ + 1 / 2 + 1 / 8 * ( 2.576)²
Table 55: 99% double reliability intervals for Poisson variable (1 – 2α = 0.99; α = 0.005) [Rohlf and
Sokal, 1995]
Double Rohlf and Sokal, Double Rohlf and Sokal,
interval 1995 interval 1995
Number of Lower Upper Number of Lower Upper
incidents (λ) limit limit incidents (λ) limit limit
0 0.000 5.288 26 15.277 42.354
1 0.011 7.336 27 15.814 43.381
2 0.149 9.312 28 16.801 44.854
3 0.437 11.263 29 17.313 45.880
4 0.824 12.762 30 18.363 47.352
5 1.280 14.307 31 18.808 48.376
6 1.786 15.813 32 19.874 49.848
7 2.331 17.312 33 20.299 50.872
8 2.907 18.807 34 21.360 52.343
9 3.508 20.298 35 22.043 53.366
10 4.131 21.359 36 22.845 54.837
11 4.772 22.844 37 23.765 55.859
12 5.289 24.326 38 24.327 56.879
13 5.829 25.376 39 25.377 58.351
14 6.668 26.855 40 25.829 59.371
15 7.337 28.334 41 26.856 60.842
16 7.756 29.376 42 27.718 61.862
17 8.727 30.852 43 28.335 62.880
18 9.313 32.328 44 29.377 64.352

19 10.010 33.365 45 29.901 65.370
20 10.859 34.840 46 30.853 66.841
21 11.264 35.874 47 31.840 67.859
22 12.347 37.347 48 32.329 68.876
23 12.793 38.379 49 33.366 70.348
24 13.794 39.852 50 34.183 71.364
25 14.308 40.881

Colophon
This document is a translation in English of the Dutch Achtergrondinformatie – Bijlage bij
Handboek Faalfrequenties 2009 voor het opstellen van een veiligheidsrapport. In case of
inconsistencies or problems, the original language document shall take precedence over
this translation.
Edited by
The Flemish Government

Environment, Nature and Energy Department
Graaf de Ferrarisgebouw
Koning Albert II-laan 20
B-1000 Brussels
Published by
J.-P. Heirman, Secretary-General

Environment, Nature and Energy Department
Deposit number
D/2009/3241/355
Edition
May 2009

Background Information 2009

Enviado por

Dados do documento

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

Background Information 2009

Enviado por

Direitos autorais:

Formatos disponíveis

BACKGROUND

CHAPTER 2: PRESSURE TANKS 15

CHAPTER 3: MOBILE PRESSURE CONTAINERS 22

CHAPTER 4: ATMOSPHERIC TANKS 24

CHAPTER 5: HEAT EXCHANGERS 40

CHAPTER 6: PUMPS AND COMPRESSORS 45

CHAPTER 7: PIPE SYSTEMS 50

CHAPTER 8: LOADING AND UNLOADING ACTIVITIES 60

CHAPTER 9: FIRE IN WAREHOUSES 62

CHAPTER 10: PACKAGING UNITS 64

CHAPTER 11: REPRESSION SYSTEMS 66

CHAPTER 12: CONSEQUENTIAL EVENTS 73

CHAPTER 13: REFERENCES 80

Background Information Handbook on Failure Frequencies 2009 05/05/2009 5

The background information is therefore provided in a separate document, as this

Background Information Handbook on Failure Frequencies 2009 05/05/2009 7

1.1. GENERAL (SERTIUS)

In order to compensate for this, it was proposed to model instantaneous failure of

The calculations are based on two basic principles:

Background Information Handbook on Failure Frequencies 2009 05/05/2009 9

Generally, 3 types of failure are considered in case of leakage:

Table 2: Types of failure and frequency for leakage

1.2. INSTANTANEOUS FAILURE

10 Background Information Handbook on Failure Frequencies 2009 05/05/2009

Background Information Handbook on Failure Frequencies 2009 05/05/2009 11

Figure 1: Distribution of leak diameters

The formula above becomes:

12 Background Information Handbook on Failure Frequencies 2009 05/05/2009

Background Information Handbook on Failure Frequencies 2009 05/05/2009 13

PI and PV will be derived in the following chapters.

14 Background Information Handbook on Failure Frequencies 2009 05/05/2009

2.1. BASIC FAILURE DATA ACCORDING TO SMITH & WARWICK

Smith & Warwick defined two categories of failure:

The installation types selected for the study were:

Background Information Handbook on Failure Frequencies 2009 05/05/2009 15

Split propagation 216 94%

The underlying causes of these splits were:

Material fatigue 52 24%

Table 3 shows the failure frequencies derived from this investigation.

16 Background Information Handbook on Failure Frequencies 2009 05/05/2009

2.3. TYPES AND CAUSES OF FAILURE

Table 5 gives an overview of the distribution of causes of failure in pressure vessels

Background Information Handbook on Failure Frequencies 2009 05/05/2009 17

2.4. FACTORS THAT INFLUENCE THE LEAKAGE FREQUENCY OF SPECIFIC TANKS

Effect of operating environment

Effect of vessel material

18 Background Information Handbook on Failure Frequencies 2009 05/05/2009

Effect of vessel content

Effect of underground tanks

Possible causes of these types of failure are:

Background Information Handbook on Failure Frequencies 2009 05/05/2009 19

Effect of tank inspection (radiography)

Effect of stress relief

Effects of other company-specific factors

2.5. CONCLUSION – GENERIC FAILURE FREQUENCIES HBFF2009

20 Background Information Handbook on Failure Frequencies 2009 05/05/2009

Road tankers and tankwagons

Background Information Handbook on Failure Frequencies 2009 05/05/2009 21

3.1. GAS CYLINDERS

Marchal classified the 74 accidents according to the following causes:

 Causes related to the cylinder itself:

22 Background Information Handbook on Failure Frequencies 2009 05/05/2009

3.2. PRESSURE VESSELS

3.3. CONCLUSION – GENERIC FAILURE FREQUENCIES HBFF2009

Causes related to the cylinder itself: