Safety barrier performance assessment by integrating computational fluid dynamics and evacuation modeling for toxic gas leakage scenarios

Toxic gas leakage represents a type of major process accident scenario threatening human life. Technical and non-technical safety barriers are employed to prevent toxic gas leakage accidents or mitigate the possible catastrophic consequences. Evacuation must be executed in severe toxic gas release scenarios. The performance assessment of technical safety barriers and evacuations in these accident scenarios, although very important, has never been investigated in previous studies. This paper proposes an approach integrating event tree analysis (ETA), computational fluid dynamics (CFD) simulation, and evacuation modeling (EM), for risk assessment of toxic gas leakage accidents in chemical plants. In the proposed approach, the spatiotemporal distribution of toxic gas is predicted by CFD simulations. A dynamic evacuation is determined by a cellular automaton (CA)-based model. Synergistic interventions resulting from technical safety barriers and evacuations are considered in the risk assessment. Considering safety barrier failures in the event tree analysis, individual fatality risks due to toxic gas leakage scenarios are calculated. For illustrative purposes, the proposed method is applied to a case of ammonia leakage. The results show that worse scenarios would be ignored without considering the failure probabilities of technical safety barriers, which can cause underestimated individual fatality risks. Timely gas detection & alarm has the potential to expedite the starting time of evacuations and thus may shorten the time that evacuees stay in the toxicity area to reduce individual fatality risks.


Introduction
An accidental release of toxic gas poses a considerable threat within the process industries since toxic material may evidently cause harm to human lives and the environment.Causes of toxic gas release include human errors, equipment aging and corrosion, technical faults, natural hazards, and intentional attacks.Generally, safety barriers can be employed to prevent undesired events and mitigate corresponding consequences [55].Identification, reliability/performance assessment, and management of safety barriers have already been investigated in previous studies.For example, Duijm [20] introduced safety-barrier diagrams as a safety management tool that can provide a useful framework for integrating information from risk analysis with operational safety management.Moreno et al. [46] proposed an innovative approach for hazard and safety barrier identification in biogas facilities.
In terms of safety barrier assessment, Landucci et al. [33] developed a methodology for performance assessment of safety barriers considering the effectiveness and availability of the safety barriers with respect to fire-induced domino effects.Then, this methodology was extended and applied in the assessment of safety barrier performance in the mitigation of domino scenarios caused by Natech events with the consideration of performance degradation of safety barriers [43,44].Bayesian Networks were also utilized in combination with performance assessment of safety barriers for risk assessment of the escalation scenario in offshore Oil-&Gas [5] and fire-caused domino effects [77].Dimaio et al. [19] assessed safety barrier degradation in the risk assessment of oil and gas systems by using multistate Bayesian networks, in which the failure probabilities of safety barriers were evaluated according to barrier health conditions.Ovidi et al. [47] proposed an approach for conducting a probabilistic analysis of fire-triggered domino effects based on agent-based modeling, in which the implementation of passive barriers, active barriers, and procedural measures with dynamic evaluation was considered.Moreover, the performance/reliability assessment of safety instrumented systems (SIS), which are typical safety barriers, were also investigated in previous studies.For instance, Meng et al. [40] proposed a set of modeling patterns to assess the reliability of SIS.Cai et al. [7] proposed a methodology for evaluating SIS with heterogeneous components based on multi-stage dynamic Bayesian networks (MDBN).The performance of SIS in the mitigation of cascading failures was also investigated considering the reliability and durability of SIS [68].Regarding safety barrier optimization and management, Janssens et al. [30] proposed a decision model to optimal allocate protective safety barriers and mitigate domino effects.Chen et al. [12] proposed a dynamic graph approach to support the allocation and evaluation of security measures and safety barriers with respect to man-made domino effects.Xing et al. [69] developed a joint optimization model to optimize safety barriers considering both business continuity and accident prevention in the case of steam generator tube rupture accidents.Yuan et al. [75] suggested the roadmap for future studies aiming for integrated management of safety and security barriers in chemical plants.
In terms of toxic gas leakage accidents, technical safety barriers such as emergency shutdown systems (ESD) and gas sensor detection are usually utilized [2,70].Some attempts have already been made to conduct risk assessments of toxic or hazardous gas leakage accidents.As an example, individual and social risks concerning natural gas leakage were calculated by employing ALOHA to simulate natural gas leakage and dispersion in power plants [49].Wu et al. [66] employed Bayesian network (BN) to conduct probabilistic analysis of natural gas pipeline network accidents.Wu et al. [67] proposed a dynamic risk analysis method to determine individual risks with respect to H 2 S leakage during managed pressure drilling phases, employing dynamic Bayesian network (DBN) under different accident scenarios.Meng et al. [41] presented a dynamic quantitative risk assessment method by combining Decision Making Trial and Evaluation Laboratory (DEMATEL) and BN to evaluate the system vulnerabilities and predict the occurrence probabilities of accidents induced by gas leakage.In the same research, the failure probabilities of safety barriers and the occurrence probabilities of different consequences were updated by using BN.Moreover, a risk-based methodology was proposed to optimize the location of gas detectors by employing a quantitative filtering approach to select representative leakage scenarios considering gas leakage probabilities and joint distribution probabilities of wind velocity and wind direction [11].Additionally, evacuations are widely employed as a measure to protect workers and/or residents from the impacts of toxic materials [29].About one-fifth of the hazardous chemical accidents in China for instance require the evacuation of nearby residents, which means emergency evacuations play an important role in the prevention and mitigation of damages caused by toxic gas leakage accidents [78].However, the relationship and interactions between technical safety barriers and emergency evacuations are rarely considered in previous studies.Therefore, this study aims to investigate the relationship and interactions between technical safety barriers and emergency evacuations and assess the synergistic effects of technical safety barriers and emergency evacuations on reducing individual fatality risks under the assumption of toxic gas leakage scenarios.
Computational fluid dynamics (CFD) simulations offer an important opportunity to integrate safety barriers into the risk assessment of toxic gas leakage accidents.CFD was widely used to investigate the consequence of gas leakage because of its advantages in predicting gas concentration distributions [26,64,74].A framework for quantitative risk assessment of LNG-fueled vessels concerning potential gas leakage was proposed, in which Event tree analysis and CFD simulation are integrated [26].Risk assessment of the most likely-spill scenario at LNG stations was carried out by a CFD model, supporting the design of LNG plant layout and site selection [56].CFD simulations were used to analyze gas dispersion in indoor and outdoor environments from a risk assessment and risk mitigation perspective [48,52,58].Meanwhile, the combination of CFD simulation and evacuation modeling has been employed as an effective tool to investigate the consequences and individual risks under toxic gas leakage scenarios.Interactions between evacuees and gas accidents were considered in order to conduct crowd evacuation by integrating CFD data into emergency evacuation simulations [32].A hybrid method combining CFD and Agent-Based Modeling (ABM) was proposed to support urban evacuation planning [21].A regional evacuation risk assessment model was developed based on CFD and agent-based simulations to support ventilation system design for underground buildings [23].An approach employing Fluent for gas leakage simulation and Pathfinder for evacuation modeling was proposed to evaluate the consequences of toxic gas leakage accidents in chemical plants [63].The combination of CFD simulations and evacuation modeling thus leaves a promising perspective in evaluating adverse effects on individuals during toxic gas leakage scenarios.
As shown in the above studies, some research has already been done to investigate risk assessments of toxic gas leakage accidents.Still, a practical risk assessment approach considering the influence of technical safety barriers and personnel evacuations on individual risks has not been developed yet.Additionally, the investigation of the relationship and interactions between technical safety barriers and emergency evacuations in terms of toxic gas leakage accident scenarios is lacking and the assessment of synergistic effects of technical safety barriers and emergency evacuations on reducing fatality risks is challenging.Therefore, this study aims to develop a risk assessment approach for toxic gas leakage accidents considering the implementation of technical safety barriers and the execution of emergency evacuations, which may significantly reduce individual risks.The relationship and interactions between technical safety barriers and emergency evacuations are considered in an event tree analysis, in which the fatality risks under toxic gas leakage accident scenarios are assessed with the help of CFD simulations and evacuation modeling.This study provides a new perspective on the assessment of synergistic effects of technical safety barriers and emergency evacuations on reducing fatality risks and also is of great potential to support risk-based safety barrier optimization and evacuation planning.

Methodology
The individual risks resulting from toxic gas leakage scenarios are determined by using probabilities of potential accident scenarios and the corresponding scenario consequences.An event tree is used to conduct probability analysis, in which the failure probabilities of safety barriers are considered.CFD simulations and personnel evacuation modelling are combined to conduct consequence analysis based on the doseresponse and probit model [4,9].The framework of the proposed approach is illustrated in Fig. 1.Firstly, the structure of the event tree used for toxic gas leakage accidents should be constructed with the consideration of the targeted safety barriers (ESD, sensor detection & warning, and evacuation).Then, the performance indicators of the safety barriers such as response time and probability of failure on demand (PFD) should be determined according to historical data, literature, or standards.According to the event tree, CFD simulations and EM should be conducted concerning the influence of safety barriers.The spatiotemporal concentration distribution of toxic gas can be obtained from the CFD simulations while the time-varying personnel locations can be obtained from EM. Afterwords, event tree analysis can be employed to calculate individual risks, in which the consequences are obtained based on the dose-response & probit model.Finally, the performance of safety barriers can be assessed by measuring their influence on individual risks.

Event tree analysis (Step 1)
Event tree analysis (ETA) is widely used for quantitative risk analysis (QRA) of loss of containment (LOC) induced accidents in the process and chemical industries [1,13].ETA describes the consequences of an initiating event and is able to estimate the likelihood of possible outcomes of the event based on barrier failure probabilities and the initiating frequency [24].Particularly, ETA has advantages to illustrate the propagation from the initiating event to the outcome events whereby the influence of safety barriers are considered [61].In this study, the initiating event of ETA is a toxic gas leakage.With the consideration of three safety barriers (ESD, gas detection & alarm system and evacuation), the event tree can be obtained with four consequences, as shown in Fig. 2. In the event tree, the consequence frequencies or probabilities need to be calculated by considering the failure probabilities of two safety barriers (ESD and gas detection & alarm system).The consequences in the event tree can be determined by using the dose-response and probit model.

Safety barrier performance indicators (Step 2)
Safety barriers are widely used due to a concept that originates from the energy model [27].The concept represents various safety measures, safeguards, and protective layers used to prevent or mitigate undesired accidents.Safety barriers were suggested to be classified into technical and non-technical according to if human actions were involved in their activation and operations [60].Bow-tie diagrams were suggested to demonstrate the risk control process and to assess safety barrier performance in the ARAMIS project [18].In the same studies, the effectiveness, response time, and level of confidence (LC) were suggested as performance criteria for safety barriers.The effectiveness is the ability of a safety barrier to perform its safety function and can be expressed as a percentage or a probability.The response time presents the duration between the activation of a safety barrier and the complete achievement of the safety function performed by the safety barrier.The LC of a safety barrier can be linked to its probability of failure.The availability and effectiveness were used to describe the performance of safety barriers and were further evaluated quantitatively in previous studies [33,42].In those studies, the PFD was used to describe the availability of safety barriers.
In this study, the response time and PFD were used to evaluate the performance of two technical safety barriers.The response time was used as a performance indicator of the personnel evacuations.The safety function of each safety barrier was identified before the response time and the PFD was determined according to previous historical data or literature, as shown in Table 1.The leakage of ammonia gas was considered in this study.The response time of the ESD system can be calculated as follows: where RT ESD is the response time of the ESD system, T D is the detection time of the ESD system, and T I is the time used to complete the isolation of the container.According to [3,70], RT ESD is regarded as 90 s (T D = 60 s and T I = 30 s).According to [14], the response time of an ammonia gas detection & alarm system is within 60 s at 160% concentration of an alarm set value.50% STEL (short term exposure limit) is advised as the low-level alarm, which is 17 ppm [62].Therefore, the response time of the ammonia gas detection & alarm system is assumed to be 60 s in this study.It means that the gas detection & alarm system will be activated at the 60th s after the ammonia concentration reaches 17 ppm at the detection location.
Personnel evacuation is divided into early evacuation and delayed evacuation in this study.If the gas detection & alarm system was activated successfully, early evacuation would be started.Otherwise, the delayed evacuation will be arranged only after people notice the leakage of toxic gas by a characteristic smell or color of the toxic gas.Because humans can detect the odor of ammonia at concentrations larger than 5 ppm [34], it is assumed that the delayed evacuation will be started after the toxic gas is dispersed to the place occupied by people.The start time of the early evacuation and also of the delayed evacuation can be calculated as follows: where ST EE is the start time of early evacuation.T GD1 is the time from the initiation of the gas leakage over the dispersion of the gas to finally the detection by the gas detection & alarm system.RT GA is the response time of gas detection & alarm system.RT EE is the response time of early evacuation, which can be regarded as 30 s according to the evacuation response time (0 to 1 min) according to [16].
where ST DE is the start time of delayed evacuation.T GD2 is the time from gas leakage to gas being dispersed to the location occupied by people.RT DE is the response time of delayed evacuation, which is assumed to be 140 s referring to [16].The delayed evacuation needs a longer response time because extra time should be spent to get notice of the gas leakage by odor and the difficulties in emergency communication without the gas detection & alarm system.The PFD of ESD is 3.72 × 10 − 4 , which can be found in literature [33], being calculated by a fault tree analysis.According to the ARAMIS guideline, the LCs of gas detection and acoustic alarm are 1 and 2, respectively [28].The PFD of the gas detection & alarm system can be calculated according to the LCs of gas detection and acoustic alarm, which are the components of the gas detection & alarm system.The PFD of the gas detection & alarm system can be calculated as follows: where PFD GA is the PFD of gas detection & alarm system, PFD G is the PFD of gas detection, which was regarded as the PFD mean value for LC1, 0.06133.PFD A is the PFD of acoustic alarm, regarded as the PFD mean value for LC2, 0.00613 [28].Even if the gas detection & alarm system fails, delayed evacuation would still be conducted upon the notice of toxic gas by humans.Therefore, the PFD does not apply to the personnel evacuation and was not considered as a performance indicator of evacuations in this study.The detailed information about the safety barriers is listed in Table 1.
ESD implementation mainly influences the leakage source where toxic gas leaks from process equipment.Consequently, a time-varying leakage rate arises with the effects of ESD.The time-varying leakage rate after the activation of ESD can be calculated by referring to the method proposed by Yang et al. [70].By applying the time-varying leakage rate profile in CFD simulations, the intervention from ESD on the spatiotemporal concentration distribution of toxic gas and further on individual risks can be simulated and determined.The calculation result of the time-varying gas leakage rate profile considering the influence from ESD is described in Section 3.2.1.

CFD simulation of gas leakage and dispersion (Step 3a)
In this paper, CFD simulations are employed to predict the spatiotemporal distribution of toxic gas and thus support risk assessment.To achieve the simulation of gas leakage and its dispersion, mass conversion equations, Navier-Stokes equations, and energy conversion equations are implemented.Meanwhile, the multi-species transportation equation, the gas state equation, and the shear stress transport (SST) turbulence model are used.The detailed descriptions of the governing equations can be found in literature [64].The implementation procedures of conducting a CFD simulation based on the OpenFOAM platform are presented in Fig. 3.More detailed information about CFD simulation of gas leakage and dispersion can be found in studies [64,65,74].
The specific procedures in Fig. 3 are elaborated as follows: (i) Pre-processing: the pre-processing includes geometry construction and mesh generation.The computational domain geometry and mesh can be created and generated by using Ansys ICEM according to the geometry parameters and physical features of a chemical plant [71].Alternatively, the computational domain can be discretized by snappyHexMesh [45], a mesh generation tool of OpenFOAM.Generally, a mesh independence analysis needs to be conducted to ensure mesh-independent simulation results.(ii) Solving process: after the mesh generation, the model configurations, numerical scheme configurations, and calculation configurations are conducted before the calculation.The initial conditions and boundary conditions need to be defined according to the investigated scenarios.Furthermore, the solver and matrix solving method need to be selected.The rhoR-eactingBuoyantFoam solver, which has been applied to simulate gas leakage and dispersion [25,64], was selected in this study.Finally, the case can be run after the determination of calculation control parameters such as time step and total calculation time.
More information about the solving configurations of rhoR-eactingBuoyantFoam solver can refer to [25].(iii) Post-processing: after the calculation, the simulation results can be visualized, extracted, and analyzed.In terms of gas leakage scenarios, the concentration of toxic gas is extracted by means of points sampling or contours in the post-processing.

Personnel evacuation modelling (Step 3b)
The dynamic personnel evacuation is performed by a cellular automaton (CA) based model in this study.The CA-based model is a two- dimensional model with the feature of v max = 1, which means a single pedestrian moves a maximum of one cell per timestep [6].The CA-based model has been widely used in different scenarios for evacuation simulation with good performance due to its advantages in high efficiency, strong scalability, and simple implementation [36].Fig. 4 shows the flow chart of the personnel evacuation modelling, and each step is thoroughly illustrated.
(i) Initialization: the computational domain (i.e., chemical plants) is discretized into a two-dimensional grid.The corresponding number marks all elements involved in the personnel evacuation modelling (e.g., "1" represents personnel location, "2" represents evacuation destination, and "3" represents obstruction).The evacuation trajectory of personnel can be obtained by modifying a two-dimensional matrix according to the moving rules.(ii) Moving rules: the movement of the personnel to an unoccupied neighbour grid is determined by a matrix of preferences.The matrix of preferences can be calculated by Eq. ( 14) considering safety distance, environmental familiarity, and personal psychology.
where P n is a 3 by 3 matrix to present preferences of the evacuee to enter the neighbour grids.b n is the occupation number of the target grid.b n = 0 is used for an occupied grid, and b n = 1 is used for an empty grid.D n is the extracted dynamic floor field at the neighbour grids.Floor field is a concept used to take into account the interactions between pedestrians and the geometry of the system.The modification rules of the dynamic floor field according to its diffusion and decay can be found in [6].R max is the distance between the evacuee and the evacuation destination, R n is the distance between neighbour grids and the evacuation destination.s represents the familiarity of evacuees with the environment (10 means very familiar).a presents the panic level of the evacuees during evacuation (10 means not panic at all).In this study, s is set as 9, which means that the evacuees are familiar with the environment.For early evacuations, a is set as 8, which means that the evacuees are not panic.For delayed evacuations, a is set as 4. It means that the evacuees have a lower panic degree during early evacuations compared with delayed evacuations.Finally, a matrix with the normalization of P n can be used to present the probabilities of the evacuee moving to the neighbour grids.The code used to conduct the evacuation modelling can be found in [72].(iii) Solving loop: the movement of personnel can be executed after the simulation initialization and the definition of moving rules.According to the defined moving rules, every evacuee can be moved until all the evacuees are evacuated to a safe destination.Meanwhile, the trajectory of evacuees can be displayed through the visualization tool.

Individual risk calculation (Step 4 and Step 5)
The individual risks resulting from toxic gas leakage scenarios are determined by the probabilities of the assumed potential accident scenarios and their corresponding consequences.After the event tree (as shown in Fig. 2) is developed, the probabilities of potential accident scenarios can be determined by employing the event tree analysis.Meanwhile, the consequences in the event tree can be calculated based on the spatiotemporal gas concentration distribution and the timevarying personnel locations that are obtained from CFD simulations and EM, respectively.The dose-response and probit model was already used in previous researches to calculate the consequences when people are exposed to toxic gas [63,70].The formulas of the dose-response and probit model are presented as follows [4]: where D is the inhalation dose of the released toxic gas for an individual at location (x 0 , y 0 , z 0 ).C(x 0 , y 0 , z 0 , t) represents the time-dependent gas concentration exposed by the individual.t 0 and t 1 are the starting time and ending time of the exposure under toxic gas.n is a model constant, which can be determined according to the property of the released toxic gas.As for ammonia, n is 2.0 according to the yellow book [59].
The probit model is employed to convert the inhalation dose D to the fatality probability.The probability of fatality P can be calculated by Eq. ( 14) [38].The parameter Y in Eq. ( 14) is related to the inhalation dose D, which can be calculated according to Eq. (15).
where A and B are both model constants related to the investigated toxic gas.As for ammonia, A = -16.29 and B = 1.0 can be used according to [59].
In the event tree analysis, the four consequences with different combinations of the safety barrier interventions can be obtained and analyzed.The individual risks with and without the interventions from the safety barriers can also be compared.Furthermore, the performance of safety barriers can be assessed by measuring how much the fatality probability can be reduced by the safety barriers.

Case study
Ammonia is widely used as a refrigerant in industrial facilities such as meat, fish processing facilities, and is used as an intermediate for the production of fertilizes in chemical facilities.An illustrative case study was conducted considering the toxicant effects of ammonia leakage in an ammonia refrigeration facility in a chemical factory.

Accident scenarios
Fig. 5 shows the aerial view of the investigated chemical factory.There is an ammonia refrigeration system with one storage tank and two separators in the factory area.It is assumed that a rupture happened to an ammonia pipeline, which is connected to a gas separator.The gas separator has a volume of 500 m 3 .In order to demonstrate a severe accident scenario, a relatively large leak hole is assumed in this study.The area of the leak hole is assumed as 1.1304 m 2 (a circular hole with a radius of 0.6 m).The temperature and pressure inside the leak hole are assumed to be 239.85K and 3 kPa, respectively.The corresponding gas leakage rate can be calculated by using the hole model [76].The calculated mass leak rate is 210.2387kg/s and the calculated leak velocity is 209.2082m/s.Six gas sensors at the height of 2 m are installed around the ammonia refrigeration system for ammonia detection.It is assumed that a workshop with 60 people is the evacuation starting location.The exit is located in the northeast corner of the chemical factory.The wind condition is assumed to be east wind with a speed of 1.5 m/s.

CFD simulation configurations
A CFD model was developed to model toxic gas leakage and dispersion.The geometry and mesh were generated by using Ansys ICEM.The computational domain of the CFD simulations was set as Fig. 5. Overhead view of the investigated chemical factory.

S. Yuan et al.
2400 m × 1160 m × 60 m with the chemical factory centered at (1200 m, 580 m, 0 m) to reduce the effects of uncertainty (in terms of pressure reflection, inverse flow, etc.) in the boundary conditions on the simulation results.Similar computational domain setups in terms of CFD simulations of gas dispersion in the presence of obstacles can also be found in other studies [57,64].The initial conditions and boundary conditions were listed in Table 2 and were elaborated as follows: (i) Inlet: An uneven wind velocity profile was used to consider the effect of atmospheric boundary layer conditions.The wind velocity at different height levels can be calculated by Eq. ( 16).
where u(z) is the wind velocity at the height z, u 0 represents the wind velocity at reference height z 0 , λ is a dimensionless coefficient associated with atmospheric stability and surface roughness.In this study, the specific values ofu 0 , z 0 , λ are set as 1.5 m/s, 2 m, and 0.4.
(i) Leak: A velocity inlet condition was used at the leak hole.The leakage rate can be calculated according to the hole model [76].The leakage velocity was set as 209.2082 m/s according to the calculated leakage rate.(ii) Outlet: Pressure outlet conditions were employed at all the outlets, and the pressure is set as 101,325 Pa.(iii) Walls: All the buildings, facilities, and ground in the factory were defined as no-slip wall conditions 1 .
The computational domain was discretized by using tetrahedra cells with refined mesh in the regions of importance.For example, fine mesh was used around the leak hole, near the ground, the storage tanks, and the obstacles, to increase the simulation accuracy.Coarser mesh was used in other regions where the velocity and pressure gradients are expected to be lesser or absent.Additionally, a mesh independence analysis with three meshes created in the same manner (mesh_1 with 700,000 cells, mesh_2 with 500,000 cells, and mesh_3 with 300,000 cells) was conducted to ensure mesh-independent results.We compared the calculated gas concentrations at specific sampling points around the leakage location to demonstrate the performance of each mesh.The calculated gas concentrations by using different mesh schemes are shown in Fig. 6 (a).The results show that the average relative error between mesh_1 and mesh_2 is 6.71% while the average relative error between mesh_2 and mesh_3 is 14.36%.Therefore, mesh_2 was selected in the further simulations to ensure both good calculation efficiency and accuracy.The minimal and average mesh volume sizes of mesh_2 are 0.000246646 m 3 and 330 m 3 , respectively.The maximum mesh skewness is 0.679095.Celik et al. [10] suggested a procedure for estimating and reporting discretization error in CFD applications, in which the grid convergence index (GCI) was used to indicate the discretization error.We also calculated the GCIs of mesh_2 to indicate its discretization errors/simulation uncertainties, which are shown as error bars in Fig. 6 (b).Detailed formulas for calculating the GCI can be found in [10].The average discretization error of mesh_2 is 3.88% according to the results.
To simulate the intervention from ESD, dynamic leakage rates were employed in the CFD simulations.The initial gas leakage rate can be calculated according to the hole model [76].After the isolation of the container is complete by ESD, the gas leakage rate decreases due to the pressure drop inside the container.The dynamic leakage rates caused by ESD can be calculated according to the method proposed in [70].Based on whether the ESD is activated successfully, two profiles of gas leakage rate can be calculated, as shown in Fig. 7.The two kinds of gas leakage rate profiles were used as velocity boundary conditions for the leak hole in the CFD simulations.

Evacuation modeling configurations
A two-dimensional cellular automaton (CA) model was employed to simulate the personnel evacuation process in this study.The twodimensional model was developed according to the layout of the investigated chemical factory.The computational domain of this model was discretized into grids with the size of 0.4 × 0.4 m 2 according to the typical space occupied by a pedestrian in a dense crowd [6].In the CA model, a single pedestrian can move one cell per time step at most.According to the empirically average velocity of a pedestrian (1.3 m/s), the time step was set as 0.3 s.The developed CA model was shown in Fig. 8, in which the evacuation starting location, evacuation destination (exit), and obstructions were marked by red, green, and yellow lines, respectively.The start times of the early evacuation and delayed evacuation can be calculated according to formula (2) and formula (3), respectively.According to the CFD simulation results, the leaked gas dispersed to one of the gas sensor locations at 0.5 s after the initiation of the gas leakage.Thus the gas detection & alarm system will be an alarm at 30.5 s and the early evacuation would start from 90.5 s.By contrast, the leaked gas dispersed to the workshop at 20 s.It means that the delayed evacuation would start at 160 s, which can be calculated according to formula (3).

Risk calculation
Ammonia is a toxic material with colorless gas and a characteristically pungent smell.According to Silverman et al. [54], the Immediately Dangerous to Life or Health Concentrations (IDLH) of ammonia is 300 ppm.Other limit values for ammonia can be found in Table 3.An ammonia concentration distribution section at 1.7 m height was extracted and used to calculated individual risks in this case study.
According to Fig. 2, four scenarios may happen after the initiation of the toxic gas leakage.The consequence of each scenario can be obtained based on the dose-response and probit model.Moreover, an event tree analysis was employed to perform a risk analysis, as shown in Fig. 9.The probabilities of the final events can be calculated by considering the PFD of each safety barrier.According to the frequency of a rupture that happened to the ammonia pipeline (8.90 × 10 − 6 events/year) [73], the frequencies of the final events were calculated by the event tree analysis in Fig. 9.Eventually, with the combination of the calculated consequences through dose-response and probit model and the final event frequencies (or probabilities), the personnel fatality risks resulting from toxic gas leakage scenarios are presented in Table 4.
As shown in Table 4, consequence 4 has the highest fatality probability because of the failures of ESD and gas detection & alarm system.By contrast, consequence 1 has the lowest fatality probability, which means the safety barriers were able to mitigate disastrous consequences successfully.

Table 2
Initial conditions and boundary conditions used in the CFD simulations.As shown in Fig. 10, the ammonia distribution with ESD at 120 s is significantly smaller than the ammonia distribution without ESD.That is due to the fact that the isolation of the leaking vessel was completed by ESD at 90 s and led to a sharp decrease in the gas leakage rate until it came to zero (see Fig. 7).The successful control of the gas leakage rate led to a smaller concentration of toxic gas in the evacuation route at 120 s and 240 s.Therefore, the fatality probabilities of the evacuees were significantly decreased with the safety interventions from ESD, from 0.0206 to 6.108 × 10 − 6 for early evacuation and from 0.08503 to 2.018 × 10 − 5 for delayed evacuation.

Influence from evacuations
Generally, evacuations are conducted after getting notice of toxic gas leakage in order to mitigate or avoid personal casualties.Gas detection & early alarm systems influence the effects of evacuations significantly by providing a timely alarm.The effects of early evacuations and delayed evacuation on the fatality probabilities of evacuees are analyzed in this section.
Fig. 11 shows the ammonia concentration slices and the locations of the evacuees during early and delayed evacuation processes.The early evacuation started at 90.5 s, whereas the delayed evacuation started at 160 s.If the ESD failed after gas leakage, evacuees could escape the  toxicity area at about 249.5 s during the early evacuation, whereas at about 415 s during the delayed evacuation as shown in Fig. 11.When ESD is successfully activated, evacuees can escape the toxicity area at about 234.5 s during the early evacuation, whereas at about 340 s during the delayed evacuation.According to Table 4, the early evacuation effectively mitigated the disastrous consequences compared with the delayed evacuation.The mean value of the fatality probabilities reduces from 0.08503 to 0.0206 without the intervention from ESD and from 2.018 × 10 − 5 to 6.108 × 10 − 6 under the intervention from ESD.It means that the starting time of evacuations has a significant influence on the final consequence.

Innovations of the proposed approach
Technical safety barriers and emergency evacuations play important roles in reducing individual fatality risks in terms of toxic gas leakage accident scenarios.However, the synergistic effects of technical safety barriers and emergency evacuations on risk reduction are seldom investigated in previous studies.Targeting this gap, the proposed approach combines event tree analysis (ETA), computational fluid dynamics (CFD) simulations, and evacuation modeling (EM), for quantifying the fatality risk of toxic gas leakage accidents in chemical plants.The interactions between technical safety barriers and emergency evacuations are considered in the proposed approach.The spatiotemporal distribution of toxic gas is predicted using CFD simulations, which is an alternative way for consequence assessment of toxic gas leakage scenarios when historical and experimental data are not available.The dynamic evacuation process is considered in the proposed approach by employing a cellular automaton (CA)-based model.Eventually, the influence of safety interventions, which are caused by the implementation of ESD, gas detection & alarm system, and evacuations, are measured and assessed by the reduction of individual fatality risks.The proposed approach is capable to assess the synergistic effects of technical safety barriers and emergency evacuations on risk reduction in the case of toxic gas leakage accident scenarios.Also, this study provides a new perspective on the assessment of safety barriers by integrating CFD simulations into the quantitative risk assessment (QRA) framework.Finally, the integration of CFD simulations and evacuation modeling to support individual fatality risks calculation with respect to toxic gas leakage scenarios is another innovation of the proposed approach.

Recommendations for future work
This study provides a new approach for risk assessments of toxic gas leakage scenarios with the consideration of the implementation of technical safety barriers and emergency evacuations.CFD simulations and evacuation modeling were integrated into QRA to support the individual fatality risks calculation with respect to toxic gas leakage scenarios.Future studies may extend the proposed approach and apply it for risk-based safety barrier allocation/management, evacuation route optimization, and evacuation planning.
Because risk-based safety barrier allocation (such as gas sensor allocation) and evacuation route optimization usually need to analyze and compare many alternative strategies, a large number of simulations need to be carried out, which is time-consuming.The acceleration of gas dispersion prediction helps to improve the proposed approach concerning the timely risk assessment and emergency response.Some approaches aiming for reducing the computation time of CFD simulations while keeping the accuracy would help to improve the proposed approach.For example, response surface methodology (RSM) can be employed to predict gas cloud dispersion in a good agreement with CFD simulation results [22].Shi et al. [50] proposed a simplified procedure for gas dispersion prediction, and the results show that it is robust and computationally efficient for explosion risk analysis with the stochastic simulation technique.Silgado-Correa et al. [53] proposed a mathematical model for predicting accidental gas dispersion and the proposed  ).Moreover, the cellular automaton (CA)-based model used in this study can also be replaced by more advanced evacuation models with the consideration of more pedestrian behaviors and emergency communications, such as multiagent-based modeling [35] and social force models [37].

Conclusions
This study investigates fatality risks of individuals under toxic gas leakage scenarios in a chemical factory.Performance assessments of technical safety barriers and personnel evacuations are conducted and the synergistic effects of technical safety barriers and emergency evacuations on fatality risk reduction are considered.With the combination of event tree analysis, CFD simulations, and evacuation modelling, a new approach was developed to conduct risk assessments of toxic gas leakage scenarios with good feasibility.Performance assessment of safety barriers is necessary to consider safety interventions related to technical safety barriers and evacuations under toxic gas leakage scenarios.Without considering the failure probabilities of the safety barriers, worse scenarios will be missed, which may induce underestimated individual fatality risks.ESD, gas detection & alarm systems, and personnel evacuations are essential safety measures to reduce the individual risks in case of toxic gas leakages happening in the process industries.ESD represents an important safety function in controlling gas leakage rates and in further mitigating the toxicity region.Timely gas detection & alarm has the potential to expedite the starting time of evacuations and thus may shorten the time that evacuees stay in the toxicity area.

Table 4
Calculated consequences and individual fatality risks in the event tree.

Declaration of Competing Interest
The research being report in this paper titled "Safety barrier performance assessment by integrating CFD and evacuation modeling for toxic gas leakage scenarios" was supported by Delft University of Technology and China Scholarship Council.The authors of this paper have the IP ownership related to the research being reported.The terms of this arrangement have been reviewed and approved by the university in accordance with its policy on objectivity in research.S. Yuan et al.

S
.Yuan et al.

1 .
Influence from ESD As a technical safety barrier, ESD fulfills its safety functions by isolating the leaking vessel, thus controlling the gas leakage rate.The effects of the safety intervention from ESD are mainly reflected by the spatiotemporal distributions of toxic gas.The ammonia concentration slices at 120 s, and 240 s with and without the activation of ESD are shown in Fig. 10.Meanwhile, the evacuation routes are presented in Fig. 10 by white arrows.

Fig. 6 .
Fig. 6. Results of mesh independence analysis (Fig. 6 (a) shows the calculated ammonia concentrations by using different mesh schemes and Fig. 6 (b) shows the result of mesh_2 with its error bars).

Fig. 7 .
Fig. 7. Gas leakage rate profiles used as velocity boundary conditions for the leak hole.

Fig. 9 .
Fig. 9. Frequencies of the final events performed by an event tree analysis.

Fig. 10 .
Fig. 10.Ammonia concentration slices at 120 s and 240 s with and without the activation of ESD.

Fig. 11 .
Fig. 11.Ammonia concentration slices and the locations of evacuees during the early and delayed evacuation processes (white dots present evacuees).

Table 1
Performance indicators of safety barriers concerning toxic gas leakage scenarios.