Memo to: Memo No: 116MFRQ9-10/ SEBC
Denise Costa (Essar Oil) From: Sebastien Cochet
Jane Shortall (Essar Oil) Date: 2018-07-24
Prep. By: Sebastien Cochet
Description of SAFETI Stages of Calculation (Event Trees)
1 OVERVIEW
DNV GL Software’s SAFETI program is a user-friendly, industry standard method for carrying out
Quantitative Risk Assessments (QRA) of process facilities. SAFETI allows you to quickly identify major
risk contributors. Time and effort can then be directed to mitigating these highest risk activities.
SAFETI analyses complex consequences from accident scenarios, taking account of local population, land
usage and weather conditions, to quantify the risk associated with the release of hazardous materials.
SAFETI incorporates the industry standard consequence modelling of PHAST.
Key features:
• Integrated dispersion modelling
• Wide range of toxic and flammable effect models
• Risk contour and FN curve generation
• Risk ranking of failure scenarios
• Facility to overlay results using
• Geographical Information Systems (GIS), aerial maps, plans and photographs
• Traceability and consistency in calculations
The typical stages of an onshore QRA are summarised in Table 1, which shows how each of the key
stages are applied to, or within, SAFETI. In studies using SAFETI the earlier stages of this process
(stages 1 to 5) are typically done “off-line”. However the later stages (i.e. stages 9 to 13) are
traditionally calculation intensive and it is these stages which are the primary function of SAFETI, since it
provides a powerful environment for integrating the stages and allowing data to be shared between them.
As such this memo will focus on describing these stages 9 to 13.
DNV GL Headquarters, Veritasveien 1, P.O.Box 300, 1322 Høvik, Norway. Tel: +47 67 57 99 00. www.dnvgl.com
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 2 of 18
Table 1 Typical Stages of QRA
Stage Activity Group
1 Definition of scope / objectives Case Definition (“offline”)
2 Data collection
3 Hazard identification
4 Case definition
5 Failure frequency estimation Frequency Analysis (“offline”)
6 Weather data input / definition Background Data (Input)
7 Ignition source input / definition
8 Population input / definition
9 Consequence modelling: Consequence Analysis (done in SAFETI), see
Section 3.1
• Discharge
(Models)
• Dispersion
• Fire and explosion
• Toxic
10 Event tree analysis Impact Analysis (done in SAFETI), see Section 3.2
11 Risk summation Risk Analysis (done in SAFETI), see Section 3.3
12 Sensitivity analysis
13 Results reporting
2 STRUCTURE OF SAFETI
PHAST sits at the core of SAFETI and is an integral part of it.
The core SAFETI program includes the standard version of PHAST and SAFETI respectively. However, a
series of add-ons are available that significantly enhance the capability of both programs. The available
add-ons include:
• PHAST Multi-Component. An extension to the core PHAST product that enables the rigorous
modelling of mixtures.
• PHAST 3D Explosions. A module that adds advanced explosion modelling capabilities and
reporting enhancements to the Phast platform. Explosion calculations consider the interaction of
a flammable cloud with a confined/congested region thus enabling more accurate assessment of
blast potential. Other key enhancements include directional modelling and multi-scenario hazard
contouring.
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 3 of 18
• SAFETI 3D Explosions. Extension to the standard Safeti product that offers enhanced risk and
explosion modelling capabilities. The enhancements offered by the PHAST 3D Explosions addon
described above are included but in a risk framework (i.e. risk factors such as ignition probability
and wind probability are explicitly accounted for. The extension also allows for the protection
afforded by buildings to be accounted for in the calculation of risk exposure (building
vulnerability modelling).
3 DESCRIPTION OF SAFETI CALCULATION STAGES
3.1 Consequence Analysis
Summaries of the consequence modelling techniques contained within SAFETI, which use the PHAST
consequence software platform, are provided in terms of the following key stages:
• Section 3.1.1 - Discharge modelling
• Section 3.1.2 - Dispersion modelling
• Section 3.1.3 - Consequence modelling (fire, explosion and toxic impacts)
Key features of the PHAST software, which apply to each of the above stages, are:
• PHAST is a comprehensive hazard analysis software tool which is applicable to all stages of
design and operation across a wide range of process industries. It has been adopted by many
international companies and governments as a decision support tool in industrial risk and public
safety matters.
• The Unified Dispersion Model (UDM) at its heart is respected as one of the world’s leading
dispersion models for process safety applications. The theory and performance have been
independently reviewed as part of the EC funded project SMEDIS, and it has excelled in both
areas.
• The UDM has been validated by PHMSA (the US Department of Transportation Pipeline and
Hazardous Materials Safety Administration) for use of modelling LNG releases in support of
facility siting studies.
3.1.1 Discharge Modelling
SAFETI can model all of the release types covered by the PHAST suite of consequence models, which are
defined by Vessel type, Scenario and Phase of material (under its containment conditions).
Discharge data can be input directly for any scenario (i.e. ‘user-defined’ model) or calculated within
PHAST, which can then combine the discharge and dispersion phases (i.e. ‘pipe / vessel’ model).
• Instantaneous discharge. If a sudden catastrophic rupture and loss of containment of a
pressurised vessel occurs, liquid will flash off and the resulting vapour will expand rapidly while
gas contents may cool and condense. If the vessel is refrigerated and not under significant
pressure, a liquid pool may be formed.
• Continuous discharge. A continuous release corresponds to a prolonged release, such as from
a ruptured pipe or through a hole in a vessel wall. In the case of a refrigerated release,
hydrostatic forces (the liquid head) provide the driving force equivalent to a pressure.
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 4 of 18
In each case, the modelling uses initial conditions specified by the user and calculates the final
conditions. The final conditions are reached when the internal pressure of the released material has
fallen to atmospheric pressure.
3.1.2 Dispersion Modelling
Once a material has been released into the atmosphere and has expanded so that its internal pressure
has fallen to atmospheric pressure, it will travel away from the release point under the influence of its
own initial velocity and the ambient wind velocity. In the SAFETI package, horizontal releases are
assumed always to be downwind (the worst case).
There are two main aspects to handling a release, which act in parallel:
• The first of these might be called the 'phenomenology' of the release: whether liquid rains out or
not, the rate of evaporation of any pool, and whether it behaves as an instantaneous or
continuous release (see Figure 1).
• Secondly, there are the various dilution (air entrainment) regimes: turbulent jet, slumping dense
cloud or passive tracer.
In SAFETI the calculation of the dispersion of a release has been made as general as possible by
incorporating all possible behaviours. That is, there is some treatment of every phenomenon that might
occur for each release, with no prior assumptions about which ones are appropriate. The physical
parameters defining a release are the only information used to decide how the modelling should proceed.
As a result, the range of behaviour that can be exhibited is very large.
The dispersion processes and the phenomenology are handled simultaneously in the modelling and any
phenomenology can occur in association with any of the entrainment regimes.
The procedure adopted in the consequence module of SAFETI is to calculate the physical parameters of
the cloud (dimensions, density, temperature, concentration, liquid fraction) at regular intervals away
from the release point. At each step, the program considers both the dispersion processes and the
phenomenology, selecting the most appropriate models for each, given the current state of the cloud.
Thus the models used for rates of entrainment and spread may change as the cloud evolves; this is done
in such a way as to make the transitions as smooth as possible. Simultaneously, the possibility of, for
example, rainout is considered at each step. Liquid rained out forms a pool which is then allowed to
evaporate, either back into the cloud as this continues to pass or following the cloud once it has finished
passing.
Thus, the consequence module is not one model but a set of models to represent different dispersion
processes as they occur. The program selects automatically the appropriate models to use at any point
in the cloud dispersion. Dispersion continues until the cloud concentration is below the minimum
concentration of interest.
Finally, the results required by the risk calculations are not dispersion results but the consequences:
doses and effect zones, which are calculated by the consequence module.
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 5 of 18
Figure 1 - Event Tree for the Dispersion Modelling Used Within SAFETI
3.1.3 Consequence Modelling
The consequence models take the dispersion model and other case data and use it to predict the effects
on people (or effect zone) given that the release and weather conditions occur. These are expressed
differently for toxic and flammable effects. Furthermore for toxic consequences there is one set of results
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 6 of 18
which express the variation in fatality risk with distance from the release point whereas for flammable
consequences there are two sets of results:
• One is a sequence of flammable masses and areas within the lower flammable limit contour as a
function of distance and time from the release point - analogous to the toxic consequences but
carrying no probability information
• The other is a set of effect levels for various possible consequences: jet fire, pool fire, fireball (or
BLEVE), explosion.
The probability of death, due to a toxic release, at a point is calculated via the "probit equation". The
toxicity of a material is defined by three parameters, N, a and b, which are applied to the toxic load (L)
calculated by the toxic dispersion model. The toxic load allows the probability of death to be calculated,
and any release, no matter how complicated in behaviour, has its concentration-time history over the
area affected reduced to this single measure of effect.
Flammable consequences are far more complicated than toxic consequences since there is a range of
possible effects.
• A "free jet" can give rise to a jet flame or explosion
• Immediate ignition of a continuous release can lead to a jet or pool fire
• Immediate ignition of an instantaneous release can lead to a fireball
• Delayed ignition of any release may lead to a flash fire, a pool fire, an explosion or a combination
of these.
The possible consequences depend on the route taken through the dispersion modelling, as in Figure 1.
Some only require the possibility to exist, others are time-dependent and so require the sequence of
flammable masses and areas within the LFL contour as a function of distance and time calculated from
the dispersion modelling.
The event trees determining the possible outcomes are discussed further in Section 3.2.1
3.2 Impact Analysis
3.2.1 Event Trees
The dispersion modelling assesses all possible outcomes of a release and enables a range of
consequence models, as described in Section 3.1, to be applied to each, where appropriate. The impacts
associated with each are determined through a series of event trees, which provide a framework for
SAFETI to determine the probability of each of the possible outcomes. The impacts of each release are
the combination of the consequences (Section 3.1, and the vulnerability of the exposed population).
It should be noted that these are not ‘event trees’ in the sense often understood by risk analysts, in that
there are not pre-defined probabilities associated with all of the branch points. The event tree functions
are:
• To set the constraints on the modelling of a release according to the dispersion (and discharge)
phenomenology. This, in the context of impacts, results in four different basic event trees
according to the type of discharge / dispersion (continuous or instantaneous, with or without
rainout).
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 7 of 18
• To combine the dispersion results with the ignition probabilities applicable to each release (where
immediate ignition is predefined for each release and delayed ignition is determined by the
presence of ignition sources in relation to the dispersion characteristics), to determine the range
of impact (or hazardous event) outcomes.
• The above factors limit the range of outcomes that can occur for a given release, but maintain
some flexibility for certain outcomes, such as the fraction of delayed vapour cloud ignitions that
result in explosions. Event tree parameters (i.e. branch probabilities) control these aspects of the
route. These parameters can be varied by the risk analyst as required.
The event trees and the associated parameters are defined in the following sections for each of the four
basic event trees:
• Section 3.2.1.1 - Continuous release, without rainout
• Section 3.2.1.2 - Continuous release, with rainout
• Section 3.2.1.3 - Instantaneous release, without rainout
• Section 3.2.1.4 - Instantaneous release, with rainout
Note that some description of the different parameters and branch outcomes is given for the first of the
above event trees. The basic approach is the same in each case, so for the latter cases only the event
tree structure and the SAFETI default parameters are given.
3.2.1.1 Continuous Release, Without Rainout, Event Tree
The event tree structure used within SAFETI for continuous releases, where rainout does not occur (i.e.
where releases remain in the gas phase), is shown schematically in Figure 2. This illustrates how each of
the branch probabilities are determined, drawing together:
The simple event tree structure (as given by the SAFETI help function), shown in Figure 3
The event tree parameters that are applied within SAFETI, where the default values are given in Figure 4.
The parameters and structure illustrated by Figure 10 are described further below.
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 8 of 18
Immediate Evaluate Short Consequence
Source Short Release?
ignition? Release? (model used)?
Y Y Y
Release Fireball
Us es Determined
pa ra meter by SAFETI Flash Fire Us es pa ra meter va l ues (C i n Fi g 3)
va l ues (B in a ccording
Fi g 3) to rel ease
properties Explosion
No Effect (onl y a ppl i es i f cons equences a re
negl i gi bl e)
N N
Jet Fire Us es pa ra meter va l ues (D i n Fi g 3) i f
vertica l effects s peci fi ed i n Model
Consequence
Delayed Ignition?
(model used)?
N Y
Flash Fire
Determined Us es pa ra meter va l ues (E i n Fi g 3)
by SAFETI
a ccording to
Explosion
di s persion,
dura tion, No Effect (onl y a ppl i es i f cons equences a re
i gnition negl i gi bl e)
N
No ignition
Figure 2 - Summary of Event Tree for Continuous Release, Without Rainout
The first stage in the event tree is to determine whether immediate ignition occurs:
• Immediate ignition is defined as that applying to the release before it has begun to disperse (and
hence to move away from the release point).
• The value can be changed by the user within the parameters section, and hence can be specified
at a study or a run row level (as shown in Figure 4). The Model definition also enables the
immediate ignition probability to be defined, such that a different value can be applied to each
and every release scenario.
• If immediate ignition does not occur then the delayed ignition probability is determined by the
SAFETI model (by comparing the dispersion of each release against the defined ignition sources)
and hence there are no default values given in Figure 4 for this branch.
• Where delayed ignition occurs, the impacts are determined by the flash fire and/or explosion
consequence models according to the probabilities defined within the “delayed ignition of cloud”
box within Figure 4. Note that if the cloud size or conditions are below the lower limits of the
model parameters then no impacts will occur (hence the “no effect” branch of the event tree in
Figure 3 is determined by the model and does not have a pre-defined probability).
• If no delayed ignition occurs there are no impacts associated with the release, other than those
associated with any toxic effects, if appropriate.
• For immediate ignition events, two sets of outcomes are considered according to the duration of
the release.
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 9 of 18
• The “short release fraction” (or “fraction for effects” in Figure 4) can be specified to determine
the fraction of immediately ignited events for which short duration effects are considered. Note
that if the value is set to 1 (as is the default) this means that the duration of each event is
evaluated within SAFETI and does not mean that the “short duration effects” are automatically
applied.
• If the release falls within the short duration criterion (which is part of the Flammables
Parameters, where the default cut-off is set at 20 seconds) then the impacts are modelled either
by the flash fire, explosion or fireball (BLEVE) consequence models. The probabilities of each are
set within the “short duration effects” box within Figure 4 where it can be seen that the default is
that all such events are modelled as fireballs.
• For the remainder of immediate ignition events the jet fire consequence model is used. If the
option to model vertical jet fire effects is applied (which is set separately, within the Parameters
or the individual Model) the default, as shown in the event tree, is that 60% are treated as
horizontal. Note that this only applies if vertical effects are considered, otherwise all jet fires are
modelled as horizontal.
Figure 3 - Continuous Release, Without Rainout, Event Tree Structure
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 10 of 18
Figure 4 - Continuous Release, Without Rainout, Event Tree (Default) Parameters
3.2.1.2 Continuous Release, With Rainout, Event Tree
The event tree structure used within SAFETI for continuous releases, where rainout occurs (i.e. where
releases may be either gas or liquid, or both), is given in Figure 5. The corresponding default parameters
that are applied within SAFETI are given in Figure 6. While there are additional outcomes in this case, to
account for pool fire outcomes, the basic approach applied within SAFETI is the same as described in the
previous section, for continuous releases without rainout.
In this case, the probabilities can be set so that only pool fires are considered, or to allow both pool and
other outcomes associated with the flashed vapour of gas fraction to be applied at the same time. An
additional parameter is defined as a maximum limit on the probability of delayed ignition applying to
pools, the “residual pool fire” parameter.
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 11 of 18
Figure 5 - Continuous Release, With Rainout, Event Tree Structure
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 12 of 18
Figure 6 - Continuous Release, With Rainout, Event Tree (Default) Parameters
3.2.1.3 Instantaneous Release, Without Rainout, Event Tree
The event tree structure used within SAFETI for instantaneous releases, where rainout does not occur
(i.e. where releases remain in the gas phase), is given in Figure 7. An example of the corresponding
default parameters that are applied within SAFETI is shown in Figure 8.
The basic approach applied within SAFETI is the same as described for continuous releases without
rainout (in Section 3.2.1.1), where in this case only short duration effects result from immediate ignition.
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 13 of 18
Figure 7 - Instantaneous Release, Without Rainout, Event Tree Structure
Figure 8 - Instantaneous Release, Without Rainout, Event Tree (Default) Parameters
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 14 of 18
3.2.1.4 Instantaneous Release, With Rainout, Event Tree
The event tree structure used within SAFETI for instantaneous releases, where rainout occurs, is given in
Figure 9. The corresponding default parameters that are applied within SAFETI are given in Figure 10.
The basic approach applied within SAFETI is the same as described for continuous releases with rainout
(in Section 3.2.1.2), where in this case only short duration effects result from immediate ignition.
Figure 9 - Instantaneous Release, With Rainout, Event Tree Structure
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 15 of 18
Figure 10 - Instantaneous Release, With Rainout, Event Tree (Default) Parameters
3.2.2 Vulnerability
The outcomes of each event tree, i.e. the consequence model results, are used to predict the distance to
(or, strictly, the area covered by) any desired hazard level, e.g. a thermal radiation level of 12.5 kW/m2
for a jet fire. However, for risk calculations, it is necessary to associate hazard levels with their effect, or
impact, on people.
As risks to people will be measured in terms of fatality, it is necessary to relate hazard levels to
likelihood of fatality. This is done by setting the modelling end point or impact criteria. With a simple cut-
off model the assumption is that if the hazard exceeds the specified criterion at that location, any person
present may suffer fatality.
The cut-off model approach is illustrated by Figure 11:
• In reality the consequences associated with a particular hazard, and hence the probability of
fatality (P), will vary with distance from the release point. The curve shown (right hand side of
Figure 11) illustrates the probability of fatality reducing from 1 to 0, as distance increases. It is
not practical to calculate the exact probability and distance for every person (or asset) for every
release. Hence a ‘cut off’ criterion is used, where the probability of fatality is set at a fixed
consequence level (and hence distance) as illustrated by the shaded ‘box’.
• This set consequence level (or end point criterion) determines the impact (or effect) zone, as
illustrated in the left hand side of Figure 11. Risk levels are determined by calculating the
number of people within an impact zone (for each release and hazard) and applying a set
probability of fatality within this zone.
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 16 of 18
The modelling end points or impact criteria cover consequences such flammable, overpressure and toxic
scenarios.
Figure 11 - Illustration of Simple Cut-off Model for End Point Criteria
3.3 Risk Analysis
Once the consequences have been calculated, they are combined with the input weather, population and
ignition source data, with the corresponding failure case frequencies and with the event tree probabilities
to calculate the risks. The calculation of risk is undertaken within the impact module.
This is a highly flexible program that can accept a wide variety of problem definitions (weather types,
wind rose directions, grid size).
Each failure case is analysed to determine its impact, as described within the previous sections.
Frequency information is extracted from the failure case description and combined with meteorological
probabilities and any event tree conditional probabilities leading to that particular outcome. Both risk at
every grid point and societal risk for each incident can be determined.
In general terms, it is assumed for individual risk that the population is out of doors and does not shelter
or escape. For societal risk, it is possible to include mitigation by sheltering or by evacuation, by
reducing the exposed population.
The evaluation of the risk even at a single point involves a large number of calculations, especially for
releases of flammable materials. Calculations must be performed for each release case and weather type,
and for each wind direction which would include that point inside the effect zone. Often however the
required result is not the risk at one point but over an area, in the form of “iso-risk contours” (Figure 12).
To obtain these, the point risk calculations must be repeated at a large number of grid points within the
area of interest. The impact module uses a default grid of 200 x 200 points. This grid can be amended if
a case travels a very short or long distance.
To calculate societal risk, the total number of fatalities for each release case, weather type and wind
direction must be calculated: this will usually be spread over a number of grid squares. The frequencies
of all combinations contributing to the same number of fatalities must be summed. The results are
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 17 of 18
typically presented as a F-N societal risk curve, but are also tabulated in terms of annual fatalities (i.e.
potential loss of life, PLL).
The impact module also produces tables showing the overall ranking of incidents in terms of their
contribution to the overall risk.
Figure 12 Example of Individual Risk Results (Contours)
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
Page 18 of 18
Figure 13 Example of Societal Risk Results (F-N Curve)
116MFRQ9-10_1-1AQ1YUX_CT_SAFETI Event
Tree Description.docx
