Risk Analysis in Handling and Storage of Petroleum Products

Increase in productivity and technological system innovation have resulted a boost in the specific activity of use and handling petroleum Products the chemical and physical properties of petroleum products represent an advantage when they are used for its own uses, but may result in accidental scenarios which can cause serious damage to people and to environment. The quantitative risk analysis applied to gasoline storage plant is a tool to quantify the damage and to planning safety of exposed workers and people in surrounding area. Therefore this represents an effective means for emergency planning. Defined the vulnerability of the potential damage area through the characterization of known exposure levels, is possible to assess the individual risk indicators which depends on these exposure levels and the hazard scenarios evolution. The evaluations are used to verify that, for the emergency management purposes and safety design, it is partial to consider only the accidental events with high probability of occurrence but is exhaustive to use a quantitative probabilistic risk indicator (Expected Value of Damage). Through simulation of generated danger flow, consistent with the operating conditions of the plant, the compliance conditions in the early step of emergency management and the practical procedures for the implementation of the identified hazard scenarios have been laid down. These assessments check, as strategic goals, that the collection areas are not affected by the danger flow.


INTRODUCTION
The analyzed plant consists of 18 above-ground tanks for the storage of gasoline equipped with floating roof (Fig. 1).
Within the plant there are pipes for the products transfer and shelters for the tank trucks load.
The product capacity, that could be present, exceed the limits suggested in the legislative Decree August 17th, 1999, n. 334 for the flammable substances (implementation of the Council Directive 96/82/EC of December 9th, 1996 on the control of major-accident hazards involving dangerous substances), therefore the activity is subjected to clause 8 (legal obligation to draw up the Safety Report) to clause 6 (legal obligation the Notification) and to clause 7 (legal obligation the Majoraccident prevention policy) of this Decree. Within the plant are carried only pumping procedures for the product transfer from containment systems to other, such as tanks and tank trucks without changes in chemical/physical properties of the substance.

Quantitative Risk Analysis (QRA)
The quantitative probabilistic risk analysis examines potential negative consequences of events that could occur when considering a technical system (industrial plant) in a social environment. The only choice in this situation is to develop a representative model of the risks associated to the system. Since that exists an unlimited number of possibilities that dangerous effects may develop it is impossible to evaluate all possible situations; therefore the analysis is restricted to a limited number of selected representative scenarios. It should always keep in mind that risk analysis is a model based on preconditions and assumptions and is not a copy of reality. Nevertheless risk analysis provides a much better understanding of riskrelated processes than merely experience-based concepts. This is a systemic approach to analyze sequences and interrelations in potential incidents or accidents, considering the events logic chain, critical dangerous events and undesired consequences.
The model makes the quantification of risks establishing the basis of a performance-based approach for the assessment of safety standards.
The solutions of this analysis allow to check general consistency of safety planning, to choose between alternatives design solutions, to demonstrate that safety standards are fulfilled, e.g., in case of deviations from the prescriptions and to optimize safety planning in terms of cost-effectiveness.
Nowadays the safety for human beings in many countries is done on the basis of prescriptive regulations: A prescriptive requirement specifies particular safety features, actions or programmatic elements to be included in the design of the technical system, as the means for achieving a desired goal. The implementation of these requirements has to be done more or less without considering the individual characteristics of a building or industrial process.
The methodology of quantitative probabilistic risk analysis contributes to define a proactive approach to safety useful to quantify the potential risks overcoming and integrating the based approach on the learned concepts by accident happened yet.
The analysis aims to measure any adverse events that may occur when considering an engineering system in a social environment. The procedure is to develop a representative model of the connected to the system risks. The unlimited development of potentially dangerous events replaces a numerable and statistically appropriate representation equivalent in characteristic elements, which are the complete group of consequences scenarios.
The properties of the Quantitative probabilistic Risk Analysis can be summarized as follows (Fig. 2): • It is a systemic approach that analyzes the chained development to potential incidents or accidents, by evaluating the development of logical and sequential flow of the danger starting from the triggering event to unintended consequences • It quantifies the risk through consistent, standardized, reproducible indicators • The application of quantitative probabilistic risk analysis provides a hierarchical structure that involves the following logical steps • The characterization of the leading accident conditions through the coding of descriptors that provides the standardization and the comparability of accident conditions • The characterization of the occurrence of the accident (Fault Tree Analysis-FTA) • The assessment of the probability and of the hazard • The evolution of accident scenarios (Event Tree Analysis-ETA) to the conditions that characterize the damage (damage scenarios and severity of the accident consequences) The quantitative measure of probability of accident occurrence involves the adoption of conventional standardization criteria of incidental rate.
These rate result from classification procedures of accidents according to criteria of standardization (mode of occurrence) and homogenization (by event type and activity sector that make the information comparable and statistically representative of accident trends).
The damage indicator, as a measure of the consequences of accidents and/or incidents is a random variable conditioned by the characteristics of the triggering event of the danger flow.
The aim is the probabilistic analysis of the causeeffect relationships between hazard and indicator of injury severity.

AJAS
The Fault Tree Analysis (FTA) is a process of the accident partition in the logically connected subevents in order to identify the sequences that lead to the accident scenarios.
This analysis identifies the structure of causeeffect relationships and aims to evaluate the effectiveness of preventive measures (Fig. 3).
The Event Tree Analysis (ETA) is a sequential and related representation of all alternative paths of hazard scenarios evolution triggered by the initiating event.
Each of these alternative routes of the danger flow leads to a specific and separate damage scenario that will be characterized by a probability of occurrence and a level of the consequences severity (damage indicator).
The Event Tree Analysis (ETA) is a sequential and related representation (Fig. 4).

Evaluation of Initiating Events Probability
The analysis of available databases (Cox et al., 1990;Lees, 2012) has focused on the evaluation of the historical and statistical data of the breaking events of the plant and/or equipment transfer in order to deduce the probability of occurrence for the models of Quantitative Risk Analysis (QRA) and to evaluate the quantitative risk indicators.
The historical and statistical data analysis allows a macroscopic investigation of typical incidental events of the analyzed plant equipment. As first approximation, this analysis identifies the critical points of the plant and provides a valuation of the frequency of critical Initiating Events (IE).
The validity of this application is therefore limited to particularly simple installations where the consequences of the process deviations are predictable on the basis of experience alone.
The causes of initiating events assumed for the gasoline plant, typically refer to historical analysis of accidents linked to: • The partial break of the transfer products pipes • The total break of the transfer products pipes • The leak from a gasket of the coupling flange • The partial break of the storage tank • The catastrophic break of the storage tank • Overfilling of the storage tank The evaluation of the probability of the occurrence of each initiating events, is based on the use of available statistical indicators for the petroleum products plant (Table 1).
These values are based on international data series from worldwide databases (Lees, 2012), for the similar systems, dating back to various decades.
With the aim of providing a technical-scientific standardized model relevant for similar contexts, the events have been normalized with respect to suitable space-time frame and they have been standardized with respect to the real size of the plant.
The probability of "release for the overfilling tank" event, was calculated by the Fault Tree analysis, considering in this fault tree, the probability of the failure of control systems components (Fig. 5).
The elementary events are linked each other by AND and OR logic gates which have the following logic functions: AND: Provides the event described in output if all incoming events happens true. OR: Provides the event described in output if at least one of the input events happens true.
Starting from the initiating events we proceeded to the specific reconstruction of individual scenarios of the danger by the event tree analysis.
This technique is based on the graphical representation of a logical model which identifies the evolution of incidental hypothesis.
In order to define the consequences of incidental events, it is appropriate to define the size of the spillage, which determines the quantity of the substance in the environment.
The flow rate in the liquid phase was calculated by application of the release models, based on the equation of mechanical energy balance (YB, 2005).
In case of leakage of a liquid product, the pushing force is generally the pressure and the pressure energy is converted to kinetic energy during the release.
The flow rate of released fluid depends not only on the size of the hole (or the opening from which the leak occurs) but also on other factors such as the density of the fluid, the proportion of the liquid head, the initial and final value of the spilled fluid, the sum of terms related to the load losses and the speed of leakage of fluid from the hole.
The size of the total release is related to the duration of the spill.
The duration of the outflow is defined by summing the required time to detect the leak (alarm time) and the required time to intervene operatively and to stop the release.
The intervention times, needed for to block the leak, were evaluated on the basis of emergency management teams and protections systems in the plant.
These technical and organizational predispositions are consistent with the goals of the Ministerial Decree October 20th, 1998:  The characterization of the incidental scenarios compatible with the initiating event was performed by evaluating the presence of immediate or delayed trigger and the operation of the systems to reduce the release of the hazardous substance.
For flammable substances, depending on whether there is ignition and whether this is immediate or delayed, the resulting scenarios are quite different.
The value of probability to be attributed to the different types of ignition was obtained by the release rate (Cox et al., 1990;Hyatt, 2004;Lees, 2012) (Table 2-5).
The attribution, based on the statistical data, of a probability value of thez mentioned factors, has made possible the quantification of the probability of occurrence of incidental scenarios.
The trigger of the cloud of flammable vapors, can generate both the Unconfined Vapor Cloud Explosion (UVCE) that the Flash-Fire.
To obtain the explosion is necessary a minimum degree of the vapors confinement which produces an increase in turbulence and an higher rate of burning.
In the events trees for all analyzed cases it was assumed a probability of 0, 05 of necessary minimum confinement to cause an UVCE and consequently a probability of 0, 95 of Flash Fire.

The Event Tree Analysis and Evaluation of the Incidental Scenarios Probability
The Event Tree Analysis shows all potential evolutionary paths of an initiating event, which differ in terms of residual hazard related to the effect of the designed safety functions to protect the system.
The Events Trees, developed since the compliant initiating events for the plant, are composed of the following analytical steps: • identification of the initiating event • identification of the safety functions • construction of the event tree • analysis of the outcomes The initiating event, chosen to illustrate the Event Tree diagram, is the "Catastrophic break of the gasoline storage tank" with a dual purpose: • To demonstrate the means by which it makes the analysis of the physical-chemical event and the quantification of the probability of occurrence • To demonstrate the opportunity to perform the risk analysis for the event "Catastrophic break of the tank" although it is characterized by incidental scenarios that have a low probability of occurrence It is noted that a "catastrophic break" it is considered a rupture of considerable size, which can cause the leakage of all the product.
The containment basin, present in the plant, has such dimensions to retain all the liquid contained in the tank.
As a precaution, the analysis was conducted on the greatest tank. The Event Tree is shown in Fig. 6. The tanks are equipped with level control system, which allows to check any time the actual level of the liquid. The leakage can be actually detected and the released product can be transferred into suitable volumes of containment. The probability of the leakage detection has been calculated using the "fault tree" shown in Fig. 7 from where it is deduced that the leakage detection and the consequent drainage can happen only if the leakage is detected by the person in charge of the supervision or if simultaneously the proper functioning of the level indicator and the operator of the remote control detects the leakage occur.
The probability of the release detection, obtained by the Fault Tree Analysis, is 9,21E-01 while the complementary probability that represents the not detection of the spillage is 7, 90E-02.  The occurrence probability of the complete group of incidental scenarios, compatible with the initiating events, are reported in the following table (Table 6).

AJAS
The different modes and intensity of the hazard flow.
The harmful effects of a chemical incidental event invests with decreasing severity the surrounding area, depending on the distance from the ignition source, except if a domino effect occurs. A fire can cause limited direct damage to exposed person in the proximity area (radiation, toxic combustion products).
The explosions, instead, have always effects in terms of pressure wave.
Depending on the explosion size, effects linked to the splinters and at the development of heat and combustion products may also occur.
• pjh = Probability of the hth consequences event given the jth hazard scenario • djh = Severity of the hth consequences event given the jth hazard scenario For the representation of the damage areas, concerned by the occurrence of the incidental scenario, reference was made to the related threshold values in Ministerial Decree May 9th, 2001 (Minimum safety requirements relating to urban and territorial planning for the affected areas by the major accident hazard plants- Table 7).

Vulnerability Levels and Damage Indicators
The carried out simulations to quantify the hazard of defined incidental scenarios by the Event Tree, represent significant scenarios of dispersion, of spills and consequent propagation of the pool with possible immediate trigger of the product (Pool-Fire) or delayed trigger of flammable vapor cloud (Flash Fire) or explosion of Unconfined Vapor Cloud (UVCE).
The incidental scenarios, resulting from the release into the atmosphere and the subsequent ignition of gasoline, are: • Pool-Fire: trigger of a released liquid substance in confined area or not This event normally produces the fire of the "pool" from which it can derive a radiation phenomenon and smoke emission. The effects are related to the radiant heat that hits the target.
The threshold values are expressed as thermal power incident for unit of exposed surface (kW/m2): • Flash-Fire: physical phenomenon resulting from the delayed ignition of a flammable vapors cloud produced by the leakage substance In the case of formation of a flammable liquid pool that doesn't find immediate ignition, the liquid vaporizes from the puddle and creates a flammable cloud.
The consequences of trigger of the flammable substance cloud (gas or vapor) are represented by the instantaneous thermal radiation.
The flammable cloud is the whole area in which the concentration of the flammable-air mixture is above the lower flammability limit.
The flammable cloud is the part of the air-flammable mixture at concentration above the lower flammability limit or at half of that value.
The flash fire has a great heat flux in a short time interval, typically less than 3 sec. Occasional events of lethality can concomitantly occur with any isolated pockets and local flame, possibly also present over the lower flammability limit, due to possible nonhomogeneity of the cloud.
Unconfined Vapour Cloud Explosion (UVCE): not confined release in the environment to a flammable substance in the gas phase or vapor from variables effects of temperature and overpressure.
The threshold value for extended lethal effects, refers at the indirect lethality caused by falls, throws the body of obstacles, impacts of splinters and especially collapse of buildings (0.3 bar), while, in unconfined areas (without buildings or other vulnerable systems) it may be appropriate to consider only the direct lethality, generated by the shock waves such (0.6 bar).
The limit value for irreversible and reversible injuries are essentially related to the distance to which the projection of splinters, even light, generated by the shock wave are expected.
With regard to the domino effect, the threshold value (0.3 bar) was fixed according to average distance of the splinters projection that may cause damage at tanks, equipments, piping.

Damage Area Simulations
After having identified the scenarios that may occur from the incidental event, we proceeded to quantify the areas of potential damage in order to characterize the hazards level of the system.
The size of the expected potential damage areas from the evolution of incidental scenarios was quantified using the program Aerial Locations of Hazardous Atmospheres (ALOHA), which has allowed us to define the vulnerability of the territory (Table 8).

AJAS
With regard the assumed weather conditions, as first evaluation of the incidental consequences, it was assumed the class of atmospheric stability D/5 (neutral atmosphere), with the measured wind speed at 10 m in height relative to the surface of the soil equal to 5 m sec −1 , air temperature of 15°C and humidity of 70% (Marx and Cornwell, 2009).

RESULTS
The probability of the incidental scenarios and the evaluation of the potential damage areas allow to define the hazard level of the system.
For comparative analysis has been assumed an evenly distributed and constant crowding of the damage areas, equal to 0.01 exposed/m2.
The damage areas extension and the expected value of the damage (fatalities and injuries) are summarized in Table 9.

DISCUSSION
Finally, the analysis has shown that for the purpose of risk analysis it is not representative to consider unlikely the incidental events based only on the probability of occurrence.

AJAS
It is more appropriate and necessary to quantify the probability of occurrence of all incidental scenarios and the exposure level to a fixed damage threshold value.
The "Catastrophic break of the storage tank" event, described and analyzed for the purposes of the comparative analysis, is characterized by potential incidental scenarios with low probability of occurrence: therefore this event could be considered not significant (probability of occurrence less than 10E-05).
The event, chosen to make the comparison, is the "Breaking of the gasket coupling flange", from which we report two different failure modes: • Breaking of the gasket coupling flange of 8 inches • Breaking of the gasket coupling flange of 6 inches The damage areas of three events are shown in the Fig.  8-10.
The objective of the test is to demonstrate that the not significant event (Catastrophic break of the storage tank), contributes to the number of expected victims per year more than the other two events (Table 10).

CONCLUSION
The comparative analysis shows that the "Catastrophic break of the storage tank" event cannot be overlooked. The classification of hazardous events based on the adoption of probability values is incomplete (Pasman et al., 2009). Therefore a significant risk indicator (expected value of damage) should be considered in order to plan emergency operations.
The risk indicators, such as the expected normalized value of the damage, are certainly the most appropriate quantitative tool for the evaluation of risk level.