Risk Assessment and Consequence Analysis

Introduction

Industrial fires and explosions are not assessed solely by asking whether an incident is possible. A professional assessment must also examine how often an initiating event may occur, what vulnerable people and assets may be exposed, how severe the consequences may be, and whether existing safeguards reduce the risk to a tolerable level. Risk assessment therefore connects technical knowledge with practical decisions about prevention, protection, emergency response and resource allocation.

In fire and process-safety practice, risk is commonly expressed as a combination of likelihood and consequence. This does not mean that risk can always be reduced to a single precise number. Data may be incomplete, models may contain assumptions, and human and organisational factors may be difficult to quantify. Nevertheless, a structured method enables hazards to be compared consistently and controls to be prioritised.

Consequence analysis examines the physical effects of credible accident scenarios. These may include pool fires, jet fires, flash fires, vapour-cloud explosions, confined explosions, boiling-liquid expanding-vapour explosions, toxic releases and domino or escalation effects. The results support decisions on separation distances, occupancy, passive and active fire protection, emergency planning and land-use control.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain hazard, risk, likelihood, consequence, vulnerability and ALARP.
2. Construct and interpret a qualitative and semi-quantitative risk matrix.
3. Develop credible fire and explosion scenarios using a bow-tie approach.
4. Explain the principles of heat radiation, explosion overpressure and atmospheric dispersion.
5. Identify escalation pathways and domino effects.
6. Apply the hierarchy of controls to risk-reduction decisions.
7. Interpret a basic consequence-analysis result and communicate its limitations.
8. Recommend proportionate controls and emergency actions for an industrial scenario.

1. Fundamental Concepts

Hazard and risk

A hazard is a source or situation with the potential to cause harm. Examples include flammable liquid, stored pressure, combustible dust, incompatible chemicals and an ignition source. A hazard exists even when no incident has occurred.

Risk is the combination of the likelihood of an unwanted event and the severity of its consequences. In a simple conceptual form:

This expression is a decision model rather than a universal physical law. Likelihood and consequence must be defined consistently, and multiplication is meaningful only when the scales have been designed for that purpose. A risk matrix often uses categories rather than numerical probabilities.

Important terms include:

• Initiating event: The event that starts an accident sequence, such as loss of containment.
• Top event: The point at which control over a hazard is lost, for example, release of flammable gas.
• Consequence: The harm produced by the event, including injury, fatality, environmental damage, property loss or business interruption.
• Exposure: The presence of people, equipment or the environment in the area affected by a hazard.
• Vulnerability: The susceptibility of a person, structure or system to harm.
• Scenario: A defined sequence of events with specified conditions, such as a leak followed by delayed ignition.
• Safeguard: A technical, procedural or organisational measure that prevents an event or limits its consequences.

Individual and societal risk

Individual risk is the frequency at which an individual at a specified location may be exposed to a defined level of harm. It is often represented as an annual frequency of fatality for a continuously present, hypothetical individual.

Societal risk considers the relationship between the frequency of accidents and the number of people harmed. It is important where a single event could affect many people, such as a major explosion near a densely occupied area. Societal risk may be displayed using an F–N curve, where F is the cumulative frequency of accidents causing N or more fatalities. Such analysis requires reliable data and careful treatment of occupancy, uncertainty and model assumptions; it should not be inferred from a simple risk matrix alone.

Tolerability and ALARP

A risk may be described as:

• Intolerable: It cannot be accepted except in extraordinary circumstances and requires immediate risk reduction or cessation of the activity.
• Tolerable if ALARP: It may be accepted only when risks have been reduced as low as reasonably practicable.
• Broadly acceptable: Further reduction may not normally be required, although legal duties and good practice still apply.

ALARP means as low as reasonably practicable. It requires more than choosing the cheapest control. A further risk-reduction measure should normally be implemented when its sacrifice—money, time, effort or operational disadvantage—is not grossly disproportionate to the risk reduction achieved. The duty to justify why a reasonably practicable measure was not adopted rests with the organisation managing the risk.

ALARP is not a substitute for compliance with legislation, codes or permit conditions. A legally required control must be implemented even if a matrix places the risk in a lower category.

2. The Risk-Assessment Process

A competent assessment follows a defined scope and records the basis of judgement. A practical sequence is:

1. Define the system, activity, boundaries and assessment team.
2. Identify hazardous materials, energy sources and vulnerable receptors.
3. Identify initiating events and credible loss-of-containment mechanisms.
4. Develop accident scenarios, including successful and failed safeguards.
5. Estimate likelihood using historical data, equipment reliability, expert judgement or a combination of methods.
6. Estimate consequences using screening calculations or validated modelling.
7. Combine likelihood and consequence and compare the result with acceptance criteria.
8. Select additional controls using the hierarchy of controls and ALARP.
9. Assign responsibilities, deadlines and verification methods.
10. Record assumptions, uncertainties and actions, then review the assessment after changes or incidents.

The assessment team should include operational personnel, engineers, maintenance staff, emergency responders and, where necessary, specialists in fire protection, process safety, meteorology or toxicology. Participation by workers is especially valuable because written procedures may not reflect actual work practices.

Hazard-identification techniques

Common techniques include:

• What-if analysis: Structured questions such as “What if cooling fails?”
• Checklist analysis: Comparison with established requirements and past incidents.
• Job safety analysis: Breakdown of a task into steps and hazards.
• HAZOP: Examination of deviations from design intent using guidewords such as more, less, none, reverse and other than.
• Failure modes and effects analysis: Review of component failures and their effects.
• Fault-tree analysis: Deductive analysis beginning with an undesired top event.
• Event-tree analysis: Forward analysis of possible outcomes following an initiating event.
• Bow-tie analysis: Integration of causes, preventive barriers, the top event, mitigative barriers and consequences.

The choice depends on complexity, available data and the purpose of the study. A checklist may be appropriate for a routine storage area, whereas a major-hazard installation may require HAZOP, quantitative frequency analysis and consequence modelling.

3. Likelihood Assessment and Risk Matrices

Likelihood may be expressed qualitatively—rare, unlikely, possible, likely and almost certain—or quantitatively as a frequency or probability. The terms must be defined in the organisation’s risk criteria. For example, “rare” could mean less than once in 100 years, but another organisation may use a different interval. Unstated definitions create false precision and inconsistent decisions.

A five-by-five matrix commonly assigns scores from 1 to 5 for likelihood and consequence. An illustrative matrix is shown below.

The numerical product is useful for ranking, but it does not prove that a score of 12 is twice as risky as a score of 6. Category boundaries are policy choices, and two scenarios with the same score may require different controls. A low-frequency catastrophic event must not be dismissed merely because its matrix score resembles that of a frequent minor injury.

A sound matrix should define:

• the time basis for likelihood;
• the population and assets considered;
• consequence categories for people, environment, property and business;
• whether existing safeguards are included;
• action thresholds and approval authority;
• requirements for uncertainty and independent review.

Worked example: matrix application

A solvent transfer operation has a possible hose failure. The assessment team judges the likelihood as “possible” (3) and the credible consequence as “major” (4), because a release could produce a pool fire causing serious injury and substantial equipment damage. The initial score is:

where R is the matrix score, L is the likelihood category and C is the consequence category. If the organisation defines scores of 10–16 as “high,” additional measures are required. Possible measures include dry-break couplings, automatic pump shutdown, bonding and grounding, leak detection, improved drainage, exclusion of ignition sources and emergency isolation training.

After controls are verified, likelihood might be reassessed as “unlikely” (2), while the credible consequence remains “major” (4):

The consequence has not necessarily become less severe; the frequency of release has been reduced. The residual score must still be checked against legal requirements, engineering standards and ALARP expectations.

4. Scenario Development

A scenario should state at least:

• material and quantity;
• release location and duration;
• release direction and rate;
• pressure and temperature;
• ignition timing and source;
• ventilation or confinement;
• weather and stability conditions for outdoor releases;
• occupancy and vulnerable targets;
• performance of detection, isolation, suppression and emergency response.

Scenarios should include credible worst cases, not merely the most likely cases. “Worst case” must be technically credible and clearly distinguished from an arbitrary maximum. A useful set often includes:

1. Small leak with immediate detection.
2. Medium release with delayed isolation.
3. Large release with ignition.
4. Release without ignition but with vapour dispersion.
5. Failure of a critical safeguard.
6. Escalation to nearby equipment or adjacent inventories.

The bow-tie model is particularly useful. Threats such as corrosion, overpressure, impact or human error lead toward a top event such as loss of containment. Preventive barriers act before the top event; mitigative barriers act after it. Consequences may include fire, explosion, toxic exposure, environmental contamination and escalation.

Barrier quality should be tested using the criteria of independence, effectiveness, reliability, response time and inspectability. A written procedure that depends on perfect human action is generally a weaker barrier than a correctly designed, independent automatic shutdown.

5. Consequence Analysis

Consequence analysis estimates the physical effects of an accident and maps them against people, equipment and the environment. It may be qualitative, screening-level or detailed. The selected level should match the decision being made and the uncertainty in the input data.

5.1 Heat radiation

Fires transfer heat by radiation, convection and conduction. For people and exposed equipment at a distance, thermal radiation is often the dominant mechanism. A simplified point-source screening relationship is:

where q″ is incident radiant heat flux in W/m², χᵣ is the radiative fraction of the fire (dimensionless), Q is the fire heat-release rate in W, and r is the distance from the effective source in m. The expression assumes a point source, unobstructed transmission and a specified effective radiative fraction. It does not account fully for flame geometry, atmospheric attenuation, view factor, shielding, wind or changing fuel rate.

For a solid or extended flame, a more general conceptual relationship is:

where E_f is flame emissive power in W/m², F is the geometric view factor between flame and target, and τ is atmospheric transmissivity. The product has units of W/m². Detailed models may divide the flame into surface elements and integrate radiation over the visible flame.

Thermal dose depends on both intensity and exposure time. A person may survive a short exposure that would cause injury during a longer exposure. Clothing, posture, shielding, humidity and individual susceptibility also matter. Therefore, a heat-flux contour is not itself a prediction of injury; it is an input to vulnerability assessment.

5.2 Pool fires and jet fires

A pool fire occurs when a liquid forms a pool and burns at its surface. Important variables include pool diameter, fuel properties, burning rate, wind, flame tilt, spill containment and duration. Bunds may limit spread but can also produce a larger burning surface if drainage is poorly designed.

A jet fire results when pressurised flammable gas or liquid is released and ignites. Jet fires may produce intense, directional heat and can impinge directly on vessels, pipework or structural members. Isolation speed is often critical because it controls the available fuel inventory and duration.

5.3 Explosion overpressure

An explosion produces a pressure wave. Its effects depend on peak overpressure, impulse, duration, positive and negative phases, reflection and the vulnerability of the target. A simple pressure value cannot describe all damage mechanisms.

For vapour-cloud explosions, severity is affected by fuel concentration, cloud size, congestion, confinement, ignition location, flame speed and degree of mixing. A cloud within the flammable range may not produce a damaging explosion if ignition occurs in an open, uncongested area; conversely, congestion and confinement can accelerate flame propagation and increase overpressure.

TNT-equivalency methods are sometimes used for preliminary screening. They should not be treated as universally accurate because chemical explosions and vapour-cloud explosions differ in energy release and flame dynamics. Specialist validated models are appropriate for major-hazard decisions.

Overpressure effects may include broken glazing, damage to doors and walls, equipment displacement, structural failure and injury from blast or flying fragments. Reflections from solid surfaces can increase local pressure, so receptor geometry must be considered.

5.4 Flash fires and fireballs

A flash fire occurs when a flammable vapour cloud ignites without substantial explosion overpressure. People within the ignited cloud may suffer severe or fatal burns, while people outside it may experience little direct thermal exposure. Dispersion analysis is therefore essential for identifying the possible cloud footprint.

A fireball is a rapidly burning spherical or near-spherical flame, commonly associated with catastrophic vessel failure and rapid fuel release. It may generate intense short-duration thermal radiation. The hazard is controlled primarily by preventing vessel failure, maintaining separation, limiting inventory and providing effective emergency isolation and cooling where appropriate.

5.5 Atmospheric dispersion

Dispersion analysis predicts how a released gas or vapour travels and dilutes. Key variables include release rate, molecular weight, temperature, pressure, buoyancy, terrain, wind speed, atmospheric stability, obstacles and duration.

For a simplified continuous release in a steady wind, a Gaussian plume representation is:

where C is concentration, Q is release rate in mass per time, u is mean wind speed, x is downwind distance, y is crosswind distance, z is height, H is effective release height, and σ_y and σ_z are horizontal and vertical dispersion parameters. The equation assumes steady conditions, a homogeneous terrain, a continuous release, approximately constant wind and Gaussian spreading. It is not automatically suitable for dense-gas releases, complex buildings, changing weather or short-duration releases.

For a ground-level release, H may be close to zero. For a dense gas, gravity-driven slumping and pooling may dominate initially, so a dense-gas model is more appropriate. Concentrations should be compared with relevant flammable limits, exposure limits or toxic endpoints, using the correct units and basis.

5.6 Escalation and domino effects

An incident may damage adjacent equipment and create secondary events. Examples include:

• a pool fire heating a storage vessel;
• a jet fire weakening a pipe rack;
• blast debris rupturing neighbouring lines;
• a toxic release forcing evacuation from a control room;
• loss of utilities disabling detection, cooling or isolation;
• drainage carrying burning liquid to another area.

Escalation analysis examines separation, orientation, passive fire protection, firewater supply, drainage, emergency access, equipment layout and time to failure. It must consider common-cause failures: a single firewater pump, electrical substation or control system may support several safeguards and therefore represent a vulnerability larger than its individual component failure suggests.

6. Hierarchy of Controls

Risk reduction should follow the hierarchy of controls rather than relying first on personal protective equipment (PPE).

Elimination and substitution usually reduce risk at source. Engineering controls are generally more reliable than administrative controls because they depend less on individual behaviour. Administrative controls remain essential, particularly for non-routine work, but they must be realistic, supervised and periodically verified. PPE is the last line of defence and should never be used to justify inadequate containment or isolation.

Controls should be specified as performance requirements. “Install detection” is weaker than “provide detection capable of identifying the credible release within the required response time, with tested alarm coverage and a defined shutdown action.” Verification should demonstrate that the control exists, is available when needed and performs its intended function.

7. Applied Case: Illustrative Solvent-Storage Incident

Background

A manufacturing plant stores a flammable solvent in a fixed tank and transfers it through a flexible hose to a blending vessel. The transfer area is near a loading route and approximately 25 m from a process building. The tank has a manual isolation valve, earthing connection and portable extinguishers. There is no automatic leak detection.

Problem

A hose coupling can fail during transfer. The release may form a pool, encounter a vehicle or electrical ignition source, and produce a pool fire. If vapour drifts toward the process building before ignition, a flash fire may occur. A fire involving the transfer hose could expose the tank and nearby equipment, creating escalation potential.

Analysis

The assessment team identifies the top event as loss of containment during transfer. Threats include hose degradation, incorrect coupling, vehicle impact and overpressure caused by a blocked line. Existing preventive barriers are inspection, operator observation and earthing. Their limitations are dependence on human presence and the possibility that inspection misses internal damage.

Credible scenarios are assessed as follows:

A screening radiation calculation may be used only to identify whether nearby occupied areas require detailed analysis. Suppose an estimated fire heat-release rate is Q = 10 MW and the assumed radiative fraction is χᵣ = 0.20. At r = 20 m, the point-source estimate is:

This result is approximately 0.40 kW/m². It is a screening estimate, not a prediction of injury, because flame dimensions, shielding, atmospheric transmission and the actual burning rate are uncertain. A detailed model would be required before approving the layout or establishing a precise exclusion distance.

Approach and solution

The team recommends:

1. Replace the flexible hose with a suitable protected connection where practicable.
2. Fit a dry-break coupling and excess-flow or automatic shutoff device.
3. Install hydrocarbon detection linked to an alarm and emergency isolation.
4. Protect the transfer point from vehicle impact using physical barriers.
5. Improve drainage so released liquid cannot flow toward the building or ignition sources.
6. Confirm bonding and grounding before transfer.
7. Establish a transfer permit and pre-use hose inspection.
8. Provide fixed or semi-fixed fire protection based on the detailed fire study.
9. Define emergency shutdown, evacuation and firefighting boundaries.
10. Test detection, isolation and firewater systems at planned intervals.

Outcome

The revised design reduces the likelihood of a large, sustained release and improves the speed of detection and isolation. Consequence severity remains potentially major, so separation, occupancy control and emergency response remain necessary. The organisation documents residual risk, verifies each safety-critical barrier and schedules a management-of-change review if the solvent, hose arrangement, throughput or surrounding layout changes.

Learning points

The case demonstrates that risk reduction is usually achieved through several independent layers. A risk matrix alone would not reveal the value of drainage, vehicle protection or automatic isolation. Consequence analysis also shows why reducing release duration may be more effective than relying only on firefighting after ignition.

8. Limitations, Governance and Professional Practice

Risk assessments can fail through incomplete scenarios, optimistic assumptions, poor data, inadequate competence or pressure to achieve a preferred result. Common weaknesses include treating safeguards as independent when they share a power supply, ignoring maintenance and testing, assuming full occupancy information, using inappropriate dispersion models and reporting numerical results without uncertainty.

A professional report should identify:

• data sources and their quality;
• model name, version and validation basis;
• assumptions and boundary conditions;
• weather and occupancy cases;
• treatment of safeguard failure;
• uncertainty and sensitivity results;
• acceptance criteria and decision authority;
• actions, owners, due dates and verification evidence.

Risk assessment is also a governance activity. Management must provide competent personnel, sufficient time and access to reliable information. Workers should be able to report hazards without retaliation. Emergency responders should receive scenario information, site plans and chemical data while recognising that responders must not be exposed to an unmanaged risk merely to protect property.

Legal requirements vary by jurisdiction, but major-hazard, fire, building, environmental, occupational-health and pressure-equipment regulations commonly impose duties concerning prevention, safe systems of work, emergency planning, hazardous-area control and competent inspection. Industry standards and guidance support compliance but do not remove the need for engineering judgement.

Technology and AI

Digital tools can improve consequence mapping, sensor monitoring, digital twins, geographic information systems and inspection prioritisation. Machine-learning systems may identify patterns in equipment condition or alarm history. However, AI outputs depend on data quality and should not replace hazard ownership, engineering review or emergency decision-making. Critical safeguards should remain explainable, tested and fail-safe. Any automated recommendation affecting isolation or evacuation requires defined authority, validation and cybersecurity protection.

Best-Practice Checklist

Before accepting an assessment, confirm that:

• the scope and boundaries are explicit;
• all credible release and ignition scenarios are considered;
• people, environment, assets and business interruption are addressed;
• likelihood categories have written definitions;
• consequence models match the release type and decision;
• uncertainty and sensitivity are documented;
• safeguards are independent, effective and testable;
• controls follow the hierarchy of controls;
• ALARP justification is recorded;
• emergency arrangements reflect the analysed scenarios;
• actions have owners and verification dates;
• the assessment is reviewed after change, incident or new information.

Chapter Summary

Risk assessment combines likelihood, consequence and exposure to support proportionate fire and explosion safety decisions. Risk matrices provide a practical ranking tool, but their categories must be defined and their limitations understood. Scenario analysis begins with credible initiating events, identifies the top event and examines the performance of preventive and mitigative barriers.

Consequence analysis considers thermal radiation, overpressure, dispersion, flash fires, jet fires, pool fires, fireballs and escalation. Screening equations can assist early decisions, but they rely on assumptions concerning source geometry, release behaviour, weather and receptor vulnerability. Detailed modelling is required when consequences may affect major-hazard decisions, occupied buildings or land-use planning.

The hierarchy of controls gives priority to elimination, substitution and reliable engineering controls, followed by administrative measures and PPE. ALARP requires implementation of further risk reduction unless the sacrifice is grossly disproportionate to the benefit, while legal requirements remain mandatory. Effective assessments are transparent, multidisciplinary, verified and periodically reviewed.

Key Terms

Hazard: A source or situation with potential to cause harm.

Risk: The combination of likelihood and consequence.

Likelihood: The chance or frequency of an event occurring.

Consequence: The harm resulting from an event.

Exposure: Contact of people, assets or the environment with a hazard.

Vulnerability: Susceptibility to injury, damage or loss.

Initiating event: An event that begins an accident sequence.

Top event: Loss of control over a hazardous condition.

Safeguard: A measure that prevents or limits an accident.

Bow-tie analysis: A method linking threats, barriers, a top event and consequences.

Risk matrix: A table combining likelihood and consequence categories.

ALARP: As low as reasonably practicable.

Pool fire: A fire burning on the surface of a liquid pool.

Jet fire: A flame from an ignited pressurised release.

Flash fire: Rapid burning of a flammable vapour cloud.

Overpressure: Pressure above ambient pressure generated by an explosion or pressure wave.

Dispersion: Transport and dilution of a released gas or vapour.

Escalation: Growth of an incident through damage to nearby systems or inventories.

Domino effect: A sequence in which one accident initiates further accidents.

Hierarchy of controls: The ordered preference for eliminating or reducing hazards.

Review Questions

Short Answer Questions

1. Distinguish between a hazard and a risk.
2. What is the purpose of a risk matrix?
3. Define ALARP.
4. Name two factors that influence explosion overpressure.
5. Why is PPE placed low in the hierarchy of controls?

Long Answer Questions

1. Explain the stages of a structured industrial fire-risk assessment.
2. Discuss the assumptions and limitations of a point-source radiation estimate.
3. Compare individual risk and societal risk.
4. Explain how a bow-tie analysis identifies and evaluates safeguards.
5. Describe the main factors that should be included in atmospheric-dispersion analysis.

Analytical / Application Questions

1. A release scenario is rated likelihood 4 and consequence 3 on a five-by-five matrix. Calculate its matrix score and explain why the score alone cannot determine whether the risk is acceptable.
2. A flammable-liquid transfer point is beside a roadway and an occupied control room. Propose controls using all levels of the hierarchy of controls and justify their priority.
3. A storage-vessel fire may heat an adjacent vessel. Analyse the possible escalation pathways and recommend barriers for prevention, detection, isolation and emergency response.

Multiple Choice Questions with Answers

Question 1

Which statement best describes risk?

A. The presence of a hazardous chemical

B. The combination of likelihood and consequence

C. The amount of stored inventory only

D. The emergency response time only

Correct Answer: B. The combination of likelihood and consequence

Question 2

In a bow-tie analysis, the top event represents:

A. The final financial loss

B. The first unsafe act

C. Loss of control over a hazardous condition

D. Successful emergency recovery

Correct Answer: C. Loss of control over a hazardous condition

Question 3

Using the illustrative matrix, what score results from likelihood 3 and consequence 4?

A. 7

B. 9

C. 12

D. 16

Correct Answer: C. 12

Question 4

Which control is highest in the hierarchy of controls?

A. Personal protective equipment

B. Administrative procedure

C. Engineering control

D. Elimination

Correct Answer: D. Elimination

Question 5

The simplified point-source radiation relationship shows that incident radiation varies approximately with:

A. The square of distance

B. The inverse square of distance

C. The cube of distance

D. Distance independently of fire size

Correct Answer: B. The inverse square of distance

Question 6

Which factor can increase vapour-cloud explosion severity?

A. Reduced congestion and confinement

B. Complete absence of fuel

C. Congestion and confinement

D. Immediate removal of all vapour

Correct Answer: C. Congestion and confinement

Question 7

A flash fire is best described as:

A. Burning of a flammable vapour cloud

B. A vessel rupture caused only by corrosion

C. A fire limited to a solid surface

D. A pressure wave without combustion

Correct Answer: A. Burning of a flammable vapour cloud

Question 8

In the Gaussian plume expression, u represents:

A. Mean wind speed

B. Release temperature

C. Flame emissive power

D. Atmospheric pressure

Correct Answer: A. Mean wind speed

Question 9

ALARP requires that:

A. Only the cheapest control is selected

B. All risks must be reduced to zero

C. Further reasonable risk reduction is implemented unless grossly disproportionate

D. Legal requirements may be ignored when a matrix score is low

Correct Answer: C. Further reasonable risk reduction is implemented unless grossly disproportionate

Question 10

Which is an example of escalation?

A. A completed inspection with no findings

B. A pool fire heating a nearby storage vessel

C. A worker wearing safety footwear

D. A closed isolation valve preventing release

Correct Answer: B. A pool fire heating a nearby storage vessel