3

Estimating Consequences
and Severity

3.1. Purpose

One component of the risk of any accident scenario is its consequence. In

LOPA, the consequences are estimated to an order of magnitude of severity,
which requires much less effort than mathematical modeling, and yet still
facilitates comparison of risk from different scenarios. This chapter describes
the various types of consequence analysis used in LOPA. The continuing
examples illustrate consequence analysis using the principles outlined in this
chapter. This is Step 1 of the LOPA method.

3.2. Consequences of Interest

Consequences are the undesirable outcomes of accident scenarios. One of the

first decisions an organization must make when choosing to implement
LOPA is how to define the consequence endpoint. Some companies stop at
loss of containment; others estimate the final impact in terms of harm or
damage. The most common scenario of interest for LOPA in the chemical pro-
cess industry is loss of containment of hazardous material or energy. Loss of
containment can occur by a variety of mechanisms such as a leak from a
vessel, rupture of a pipeline, and lifting of a relief valve. The typical sequence
of consequences of a release of flammable/toxic material is shown in Figure
3.1 and explained below.

31
32 3. Estimating Consequences and Severity

FIGURE 3.1. Potential consequences from a flammable/toxic release.

The material released may be in a liquid, gas, or solid form, or a combina-

tion of these. If the released material is flammable, ignition may result in an
explosion and/or fire. In case of immediate ignition of a pressurized gas or
two-phase release, jet fires may ensue. In the absence of immediate ignition,
material may disperse to form a vapor cloud with delayed ignition as a flash
fire or explosion. Liquid spills may burn as pool fires if ignited. If the released
material is toxic, plant personnel or the public may be exposed to unhealthy
concentrations. The radiation flux from fires, overpressures from explosions,
and toxic concentrations from toxic releases are called physical effects. The
physical effects have impact on personnel, environment and property, and
may result in losses such as injuries, fatalities, environmental harm, and
property damage. In addition to these initial effects, there could be follow-on
losses due to business interruption, loss of quality of product, demolition
requirements, and loss of credibility with the public, regulators, customers,
and stockholders.
The range of consequence endpoints for a loss of containment scenario
include the release of the hazardous material, the dispersion of the hazardous
material, physical effects from fires, explosions and toxic releases; and the
losses from the impact of physical effects. All of these consequence endpoints
are quantifiable by some estimation method. For example, a release can be
measured in terms of the released quantity; the dispersion in terms of disper-
sion distance/area (for specific concentrations); and the losses in terms of
number of injuries and fatalities, property damage, financial losses or indirect
losses.
3.3. Consequence Evaluation Approaches for LOPA 33

3.3. Consequence Evaluation Approaches for LOPA

Consequence evaluation is an integral part of any risk assessment methodol-

ogy. What consequences should be evaluated, and how rigorously the
consequences are evaluated depend on several factors, including the risk
associated with the accident scenarios, and the risk assessment methodology
adopted by the organization, and the resources the organization is willing to
expend to refine the estimate. These implementation issues are discussed in
greater detail in Chapter 9. The different types of consequence evaluation are:
Release size/characterization
Simplified injury/fatality estimates
Simplified injury/fatality estimates with adjustments
Detailed injury/fatality estimates
Each of these methods has its advantages and disadvantages, which are
discussed in the following sections. The method used for consequence cate-
gorization should be consistent with the companys risk tolerance criteria.
Any organization implementing LOPA should carefully consider the
level of detail for consequence analysis, as this choice can significantly affect
the level of effort and training required. Figure 3.1 shows a generic release
event and possible outcomes. Some companies choose to stop the analysis at
identifying and quantifying the type and size of the release. Their risk toler-
ance criteria assume that releases of certain magnitudes have a certain likeli-
hood of harming the environment, people, or production/assets. In these
companies, the primary risk tolerance criterion is matched to the fact that the
consequence categorization stops at the release. Other companies choose to
explicitly account for the likelihood of some impact event (e.g., employee
injury), and therefore their consequence categories are also more explicit in
the degree of harm done. It should be noted that either approach can (and
typically does) provide comparable risk decisions.

Method 1: Category Approach without Direct Reference

to Human Harm
This method typically uses matrices to differentiate consequences into vari-
ous categories. It avoids estimating the number of potential injuries or fatali-
ties, thereby:
avoiding any overt appearance that injuries and fatalities are tolerable,
and
helping the team make more accurate judgments about relative risk,
since it is very difficult to estimate qualitatively the number of people
who might be harmed and how severe the harm might be. For instance,
falling down a flight of stairs could result in a spectrum of conse-
34 3. Estimating Consequences and Severity

quences, ranging from a slight bruise to a fatality. Or, a toxic release

can result in one or more fatalities or no harm at all, depending on the
proximity of people to the release point and the time and capability
they have to escape.
Table 3.1 is an example that includes a simple approach to categorize the
consequences from a chemical release. Each consequence is assigned a
numerical category from 1 to 5, with 5 being the most severe. Table 3.1
includes three matrices:
The upper matrix relates release size and the physical and toxicological
properties to consequence categories (this avoids the need for quantita-
tive calculations of dispersion, etc.).
The middle matrix relates plant type and type of damage or production
loss to consequence categories.
The lower matrix relates equivalent cost factors to consequence catego-
ries.
Note that the middle and lower matrices are used when
the scenario does not involve a material release, or
the severity category for the scenario is higher on one of the lower
matrices than it is on the upper matrix, or
the analyst judges the lower matrices better describe the consequence.
[Note that the consequence category for vapor releases can be reduced in
severity if dispersion modeling (quantitative analysis) is performed and
shows that a lower impact category is warranted.] Once the release category
has been assigned, it is combined with the anticipated or calculated frequency
(see Chapters 5, 6, and 7) of the consequence to assess whether the risk is tol-
erable (see Chapter 8).
The advantages of this method:
The method is simple and easy to use because the size and properties of
the release are relatively easy to assess. No case-by-case modeling is
required. A release of a certain size is assigned a certain consequence
value independent of the eventual effect (fire, explosion, toxic release,
injury, fatality, etc.). The criteria for loss of production are similarly
simple to assess.
When combined with a matrix showing the organizations risk toler-
ance criteria, the method allows visual assessment of where a given
risk lies in relation to the organizations guidelines.
The disadvantages of this method:
It requires either the acceptance of the consequence categorization
matrix or the development of such a matrix by baseline modeling. The
 TABLE 3.1
Example Consequence Categorization

Size of Release (beyond a dike)

100- to 1,000- to 10,000- to

1- to 10- 10- to 100- 1,000- 10,000- 100,000- >100,000-
Release pound pound pound pound pound pound
Characteristic release release release release release release

Extremely
toxic above Category 3 Category 4 Category 5 Category 5 Category 5 Category 5
BP*

Extremely
toxic below BP
Category 2 Category 3 Category 4 Category 5 Category 5 Category 5
or highly toxic
above BP

Highly toxic
below BP or
Category 2 Category 2 Category 3 Category 4 Category 5 Category 5
flammable
above BP

Flammable
Category 1 Category 2 Category 2 Category 3 Category 4 Category 5
below BP

Combustible
Category 1 Category 1 Category 1 Category 2 Category 2 Category 3
liquid

*BP = atmospheric boiling point

Magnitude of Loss

Vessel Vessel
Spared or rupture rupture
non- Plant Plant Plant 3,000 to >10,000
Consequence essential outage outage 13 outage 10,000 gal gal
Characteristic equipment <1 month months >3 months 100300 psi >300 psi

Mechanical
damage to
Category 2 Category 3 Category 4 Category 4 Category 4 Category 5
large main
product plant

Mechanical
damage to
Category 2 Category 2 Category 3 Category 4 Category 4 Category 5
small by-prod-
uct plant

Consequence cost (U.S. dollars)

Consequence $10,000 $100,000 $1,000,000

Characteristic $0$10,000 $100,000 $1,000,000 $10,000,000 >$10,000,000

Overall cost of
Category 1 Category 2 Category 3 Category 4 Category 5
event
Note: This table of values is for example only, to indicate what one or more companies use to catego-
rize consequences. CCPS does not endorse one method over another.

35
36 3. Estimating Consequences and Severity

baseline modeling is time consuming and requires a good basic under-

standing of modeling techniques and physical processes.
The endpoints are not presented in terms of specific injury/fatal-
ity/cost figures, which can cause interpretation problems in some
organizations.

Method 2: Qualitative Estimates with Human Harm

This method uses the final impact to humans as the consequence of interest,
but arrives at the value using purely qualitative judgment. For each scenario,
the human consequences are estimated directly by the LOPA analyst, using
past experience, previously generated look-up tables, or knowledge of prior
detailed release modeling of similar releases. Table 3.2 shows the conse-
quence categorization resulting from this method.
The resulting risk of an injury/fatality can be compared directly to a
fatality risk tolerance criterion (see Chapter 8) for an individual event, or all of
the events associated with a process or plant can be summed and then com-
pared to process/plant risk tolerance criteria.
The advantages of this method are:
Simplicity of understanding: Many people tend to better understand con-
sequence in terms of harm rather than expressing risk in terms of
release size.
Direct comparison with corporate guidelines: Many companies already
have established guidelines for risk of a fatality/injury, or for risk of a
certain monetary loss.
The disadvantages of this method are:
Implicit assumptions for the probability of ignition for flammable
releases, for the probability of injury, and the probability that a person
is present in the area may over- or underestimate the risk of fatality.
Look-up tables such as Table 3.2 are even less precise (more subjective)
than release categorization tables such as Table 3.1.
The estimation of the consequence severity may vary between differ-
ent analysts, unless some guidance is provided across the company.

Method 3: Qualitative Estimates with Human Harm with

Adjustments for Postrelease Probabilities
Alternatively, the LOPA analyst can initially estimate the magnitude of a
release qualitatively similar to Method 2 (but not as subjective as a look-up
table similar to Table 3.2), and then later (as described in Chapter 7) adjust the
event frequency by the probability that:
3.3. Consequence Evaluation Approaches for LOPA 37

TABLE 3.2
Qualitative Categorization (Combined Loss Categories)

Low Consequence

Personnel Minor or no injury; no lost time

Community No injury, hazard, or annoyance to public

Environment Recordable event with no agency notification or permit violation

Facility Minimal equipment damage at an estimated cost of less than $100,000 and
with no loss of production

Medium Consequence

Personnel Single injury, not severe; possible lost time

Community Odor or noise complaint from the public

Environment Release that results in agency notification or permit violation

Facility Some equipment damage at an estimated cost greater than $100,000 and
with minimal loss of production

High Consequence

Personnel One or more severe injuries

Community One or more minor injuries

Environment Significant release with serious offsite impact

Facility Major damage to process area(s) at an estimated cost greater than

$1,000,000 or some loss of production

Very High Consequence

Personnel Fatality or permanently disabling injury

Community One or more severe injuries

Environment Significant release with serious offsite impact and more likely than not to
cause immediate or long-term health effects

Facility Major or total destruction of process area(s) at an estimated cost greater

than $10,000,000 or a significant loss of production

Note: This table of values is for example only, to indicate what one or more companies use to catego-
rize consequences. CCPS does not endorse one method over another.
38 3. Estimating Consequences and Severity

the event will result in a flammable or toxic cloud;

for a flammable cloud, an ignition source will be present;
an individual will be present in the area when the event occurs;
the individual will experience a fatal (or injurious) consequence.

The advantages of this method:

Simplicity of understanding: People tend to better understand conse-

quence in terms of harm rather than expressing risk in terms of release
size.
Direct comparison with corporate guidelines: Many companies already
have established guidelines for risk of a fatality or injury.
Frequency adjustments: The frequency adjustments may give a better
estimate of the risk of human harm.

The disadvantages of this method:

The simplifications made in assessing the probabilities of the events

subsequent to the release. The results of real-world events have proven
to be both significantly less and significantly greater than those calcu-
lated by analysts. However, if consistent approaches are used, it is rea-
sonable to expect that this method will highlight scenarios with
relatively higher risk.
Extra parameters for the probability of reaching the stated impact or
outcome must be included in the risk calculation (described in Chapter
7), and these may change over time (e.g., the number of people or their
location changes).
The estimation of the consequence severity may vary between differ-
ent analysts, unless some guidance is provided across the company.
This method would need to be augmented to address business impact
or economic risk.

Method 4: Quantitative Estimates with Human Harm

This method is similar to the qualitative estimates with human harm method
(Method 3), but uses detailed analyses in determining the effects of a release
and its effects upon individuals and equipment. This method involves the use
of mathematical models (typically complex computerized models) to simu-
late the release itself (also called source term modeling), the subsequent
dispersion, and the toxic or blast/thermal effect. Figure 3.2 illustrates the typ-
ical results from detailed modeling of the release of a highly toxic material.
Refer to Guidelines for Consequence Analysis of Chemical Releases (CCPS, 1999)
for more details on quantitative modeling.
3.3. Consequence Evaluation Approaches for LOPA 39

FIGURE 3.2. Typical vulnerability zone from detailed (mathematical) modeling. ERPG 2 is
the maximum airborne concentration below which it is believed that nearly all individu-
als could be exposed for up to one hour without experiencing or developing irreversible
or serious health effects or symptoms which could impair an individuals ability to take
protective action.

The advantages of this method:

A greater degree of certainty concerning the predicted consequences.

Direct comparison with corporate guidelines.

The disadvantages of this method:

Although the modeling programs are much more sophisticated than

the estimation methods, the results of real-world events have been
both significantly less and significantly greater than those calculated
by analysts. Modeling results are strongly affected by the exact release
conditions (e.g., is the pipe severed or cracked? is the break near the
tank or mid-run? is the release oriented up or down?), atmospheric sta-
bility, wind direction, time to ignition, etc. There are thousands of pos-
sible permutations to consider. Inevitably only a few representative
cases can be chosen.
The level of sophistication required for modeling the consequence of a
scenario is disproportionate to that used to estimate the order of mag-
nitude frequency of the scenario with LOPA.
The training, experience and effort required to perform the modeling
can be prohibitive, and such analysis is usually only applied to scenar-
ios that have already been judged to have potentially fatal results.
40 3. Estimating Consequences and Severity

For these reasons, this method is typically used only for compounds that
are new to a company, or for scenarios requiring a higher level of scrutiny
than LOPA can provide. Modeling is frequently reserved for scenarios that
require CPQRAthe step beyond LOPA.

3.4. Continuing Examples

In this section, consequences are assessed for the scenarios described in the
continuing examples. We will use two methods in this chapter to categorize
the consequences to illustrate the concepts used for LOPA.
The first (Method 1) will use a category, look-up method, using Table 3.1
as the reference table. For this approach, only the boiling point, flammability
data, and total quantity of the material are required.
The second (Method 3) will qualitatively estimate the scenario conse-
quences using prior experience of the authors. Method 3 is further addressed
in Chapter 7, where we include consideration of the probability of ignition,
probability of harm, etc.
In writing this book, we also confirmed the consequence severity by a
detailed dispersion calculation and flammable effects model (Method 4), but
the results are not shown in the book. This method required
flammability data for hexane,
past experience with similar incidents in the industry, and
a general understanding of fires and explosions and the models that
describe these phenomena.

Continuing Example 1: Hexane Surge Tank Overflow

Scenario 1a: Hexane Surge Tank OverflowSpill Not Contained by

the Dike
For this case, we will assume that the total overflow can be as large as 40,000
lb of hexane, and that the dike is present as an IPL (addressed in detail in
Chapter 6). The dike has a probability of failure with the release spreading
beyond the dike.

METHOD 1
Using this method, the consequence category from Table 3.1 for a release of
40,000 lb of a flammable liquid below its boiling point is Category 4.

METHOD 3
For this method up to 40,000 lb of hexane is released which could result in a
large pool fire. In view of the low volatility of hexane, a flammable cloud is
3.4. Continuing Examples 41

not expected beyond the pool. A flash fire is considered unlikely, based on the
flash point of hexane at process temperatures. The fire has the capacity to
injure personnel in the immediate area of the spill, which now includes an
area beyond the dike. This qualitative interim result will be combined in
Chapter 7 with the probability of ignition, probability of personnel present,
and probability of harm done to personnel, given they are present.

Scenario 1b: Hexane Surge Tank OverflowSpill Contained by the

Dike
Given the flow rate into the vessel, the frequency of operator rounds, and the
many other upstream limitations and safeguards, the plant engineers esti-
mate that the maximum overflow (after completely filling the vessel) is 40,000
lb of hexane. Scenario 1b assumes that the dike will work perfectly to contain
the spill.

METHOD 1
Using this method, there is no consequence since the release is completely
contained by the dike. Table 3.1 ignores spills of flammable liquid into dikes,
if the dikes are assumed not to fail.

METHOD 3
For this method we have up to 40,000 lb of hexane in the dike which could
result in a contained pool fire. In view of the low volatility of hexane, a flam-
mable cloud is not expected beyond the pool. A flash fire is considered
unlikely, based on the flash point of hexane at process temperatures. The fire
has the capacity to injure personnel in the immediate area. This qualitative
interim result will be combined in Chapter 7 with the probability of ignition,
probability of personnel present, and probability of harm done to personnel,
given they are present.

Continuing Example 2: Hexane Storage Tank Overflow

Scenario 2a: Hexane Storage Tank OverflowSpill Not Contained by

the Dike
For this case, we will assume that the total overflow can be as large as 40,000
lb of hexane, and that the dike is present as an IPL (addressed in detail in
Chapter 6). The dike has a probability of failure with the release spreading
beyond the dike.

METHOD 1
Using this method, the consequence category from Table 3.1 for a release of
40,000 lb of a flammable liquid below its boiling point is Category 4.
42 3. Estimating Consequences and Severity

METHOD 3
For this method up to 40,000 lb of hexane are released which could result in a
large pool fire. Again, in view of the low volatility of the hexane, a flammable
cloud is not expected beyond the pool. A flash fire is considered unlikely,
based on the flash point of hexane at process temperatures. The fire has the
capacity to injure personnel in the immediate area of the spill, which now
includes an area beyond the dike. This qualitative interim result will be com-
bined in Chapter 7 with the probability of ignition, probability of personnel
present, and probability of harm done to personnel, given they are present.

Scenario 2b: Hexane Storage Tank OverflowSpill Contained by the

Dike
For this case, we will assume that the total overflow can be as large as 40,000
lb of hexane, and that the dike will not fail.

METHOD 1
Using this method, there is no consequence since the release is completely
contained by the dike. Table 3.1 ignores spills of flammable liquid into dikes,
if the dikes are assumed not to fail.

METHOD 3
For this method up to 40,000 lb of hexane may be present in the dike which
could result in a contained pool fire. Again, in view of the low volatility of the
hexane, a flammable cloud is not expected beyond the pool. A flash fire is
considered unlikely, based on the flash point of hexane at process tempera-
tures. The fire has the capacity to injure personnel in the immediate area. of
the spill. This qualitative interim result (a release of 40,000 lb of hexane into
the dike) will be combined in Chapter 7 with the probability of ignition, prob-
ability of personnel present, and probability of harm done to personnel, given
they are present.

3.5. Link Forward

Chapter 4 will explain how scenarios are selected and developed for pur-
poses of LOPA. As mentioned earlier, categorizing the consequences is often
the screening criteria for selecting the scenarios for LOPA. Other criteria can
also be used. Chapters 5 and 6 will complete the data collection and scenario
development efforts for a LOPA scenario.