Fluid Dynamic Models Application in Risk Assessment

Risk is a common name for the probability of a hazard turning into a disaster. Vulnerability and hazard are not dangerous in and of themselves, but if they come together, they generate a risk. However, risk can be reduced and managed. If we are careful about how we treat the environment, and if we are aware of our weaknesses and vulnerabilities to existing hazards, then we can take measures to make sure that hazards do not turn into disasters. Hazard from LNG (Liquefied Natural Gas) cargo begins in the first processing stage of natural gas liquefaction and loading the substance into LNG tankers. The transport itself over the sea is the safest part of the distribution process, as is demonstrated by the statistic of nautical accidents in the past 40 years (DNV, 2007, Perkovic et al., 2010 & Gucma, 2007). A review of a Rand Corporation document (Murray et al.) published in 1976 indicates a high level of safety for LNG tankers. The document indicates that in the initial 16-year history (from 1959 up to 1974) there had been no significant accidents. It should be noted, though, that in 1974 the world LNG fleet included only 14 vessels; by November, 2009, there were 327 vessels, a figure expected to increase to 350 vessels sometime in 2010 (LNG Journal, 2008). The DNV (Det Norske Veritas) counts 185 nautical accidents involving LNG tankers, all without severe consequences for the crew. The frequency of LNG tanker accidents is therefore 5.6 x 10-2 per ship year. The findings of the DNV (2007) furthermore demonstrate that the potential loss of life for the LNG crew member is 9.74 x 10-3 or less, considering the occupational fatality rate onboard gas tankers is 4.9 x 10-4. The analysis of the northern Adriatic Sea (Petelin et al. 2009), or, precisely, the gulf of Trieste, demonstrates that nautical accidents should occur with a frequency of 1.25 x 10-2 per year, assuming the current traffic density, and increases to 2.62 x 10-2 if the ship traffic increases by 100%. The hazard associated with LNG is mainly in its potential to cause severe fires resulting in heat radiation. If a large quantity of LNG is spilled into a pool, the cloud that is formed as it evaporates is a mixture of natural gas, water vapour, and air. Initially the cloud is heavier than air (due to its low storage temperature) and remains close to the ground. The buoyancy moves the natural gas upward at a gas temperature of around 170 K (-1030C), as experimentally demonstrated by ioMosaic (2007). The major influences on natural gas diffusion are environmental conditions. The cloud moves in the direction of the wind and the wind causes the cloud to mix with more air. If the concentration of gas in the air is between 5% and 15% it is flammable and burns if it contacts any ignition source. A concentration of gas smaller than 5% will not ignite and if the concentration is over 15% the air becomes saturated. The explosion of natural gas is not possible in open spaces because


Introduction
Risk is a common name for the probability of a hazard turning into a disaster. Vulnerability and hazard are not dangerous in and of themselves, but if they come together, they generate a risk. However, risk can be reduced and managed. If we are careful about how we treat the environment, and if we are aware of our weaknesses and vulnerabilities to existing hazards, then we can take measures to make sure that hazards do not turn into disasters. Hazard from LNG (Liquefied Natural Gas) cargo begins in the first processing stage of natural gas liquefaction and loading the substance into LNG tankers. The transport itself over the sea is the safest part of the distribution process, as is demonstrated by the statistic of nautical accidents in the past 40 years (DNV, 2007, Perkovic et al., 2010& Gucma, 2007. A review of a Rand Corporation document (Murray et al.) published in 1976 indicates a high level of safety for LNG tankers. The document indicates that in the initial 16-year history (from 1959 up to 1974) there had been no significant accidents. It should be noted, though, that in 1974 the world LNG fleet included only 14 vessels; by November, 2009, there were 327 vessels, a figure expected to increase to 350 vessels sometime in 2010 (LNG Journal, 2008). The DNV (Det Norske Veritas) counts 185 nautical accidents involving LNG tankers, all without severe consequences for the crew. The frequency of LNG tanker accidents is therefore 5.6 x 10-2 per ship year. The findings of the DNV (2007) furthermore demonstrate that the potential loss of life for the LNG crew member is 9.74 x 10-3 or less, considering the occupational fatality rate onboard gas tankers is 4.9 x 10-4. The analysis of the northern Adriatic Sea (Petelin et al. 2009), or, precisely, the gulf of Trieste, demonstrates that nautical accidents should occur with a frequency of 1.25 x 10-2 per year, assuming the current traffic density, and increases to 2.62 x 10-2 if the ship traffic increases by 100%. The hazard associated with LNG is mainly in its potential to cause severe fires resulting in heat radiation. If a large quantity of LNG is spilled into a pool, the cloud that is formed as it evaporates is a mixture of natural gas, water vapour, and air. Initially the cloud is heavier than air (due to its low storage temperature) and remains close to the ground. The buoyancy moves the natural gas upward at a gas temperature of around 170 K (-103 0 C), as experimentally demonstrated by ioMosaic (2007). The major influences on natural gas diffusion are environmental conditions. The cloud moves in the direction of the wind and the wind causes the cloud to mix with more air. If the concentration of gas in the air is between 5% and 15% it is flammable and burns if it contacts any ignition source. A concentration of gas smaller than 5% will not ignite and if the concentration is over 15% the air becomes saturated. The explosion of natural gas is not possible in open spaces because the low velocity of flame spread, around 0.4 m/s, is not enough to produce a pressure wave (Fells et al, 1969). The burnout of gas/air mixture in open air could result only in a flash fire. Explosions could only result in enclosed spaces where gas is going to accumulate.

Risk definition and acceptance criteria 2.1 Individual risk
The individual risk in regard to LNG is calculated as location specific, to a person exposed outside 24 hours per day. In several countries the authorities have defined criteria which have to be met in order to assess a level of societal risk as acceptable. Criteria for some countries were analysed and discussed by Trbojević (2005). Some of these are used internationally. In most countries an individual risk of 1E10-3 per year is taken as the upper bound criteria to assess the acceptability of an activity for employers working in an industrial installation. The upper risk criterion for the public is therefore 1*10-4 per year. Also the risk at locations where vulnerable objects are situated is taken into account. Vulnerable objects are those where people are present who react in a different way to a threat posed upon them as ordinary people. This difference can be caused by differences in state of health or the possibility of evacuating the location in case of danger. The calculation of the individual risk for a specific failure event is influenced by three main parameters: the two coordinate location x,y and weather conditions (wind speed and stability). The individual risk ,/ x y w IR is therefore the function of the frequency F fe of the failure event occurring in a year, the probability of the event in a particular direction (influenced by weather) and the probability of people dying due to exposure (DNV, 2008 θ is the direction of the release, θ 1 is the lower value of θ that influences the computation point, θ 2 is the upper value of θ that influences the computation point, /w P θ is the probability of the release occurring in the direction of the wind and / dw P θ is the probability of death considering the direction of the release and weather. This is the contribution to the individual risk from a single event under specific weather conditions. To obtain the overall individual risk at a given point all possible events must be taken into account. However in the sense of the order of magnitude the worst events (low probability/high consequences) have the most influence on individual risk. In the calculation process, low consequence events increase the size of high risk isolines, but usually do not influence the low risk isolines, risk lower than 1*10 -6 that reaches greatest distances. The strong dependence of the individual risk on weather conditions influences the total risk, calculated using the following equations:

Societal risk
Societal risk posed by an LNG terminal facility or hazardous activity is measured by the probability that a group of persons would be exposed to a hazardous level of harm (fatality) due to all types of accidents at the facility or its hazardous activity. The societal risk is dependent on both the density of people in the vicinity of an LNG terminal and the location of the population with respect to the facility. The societal risk is generally presented in the form of a curve, expressing the relationship between the annual probability (F) of exceeding a given number of fatalities and the number N (Trbojevic, 2005). In most countries the risk assessment is performed on the basis of potential fatalities to the exposed population. Different countries use slightly different criteria for risk acceptability. In the UK, the Health and Safety Executive (HSE) guidelines are to use the individual risk as the principal measure, but also to use the societal risk criteria for land use planning. The acceptability criteria levels for risks for facilities in the UK are specified by HSE (1989). Facilities are permitted only when these (published) criteria are met. In the Netherlands, however, both the individual risk criteria and the societal r i s k c r i t e r i a h a v e t o b e m e t w h e n c o n s i d e r ing (in risk assessment) those events whose hazardous effects extend to such distances at which the conditional probability for lethality is higher than 1% (Bottelberghs, 2000& Raj et al., 2009) . The risk tolerability criteria for fatalities established in various countries for societal risks are summarized in Fig. 1 (Trbojević, 2005). The risk calculations have to determine the number of people killed by a particular event and attach this to the associated frequency of the event to form the F-N curve. Probability of death is calculated from the consequence model and so it only remains for the risk model to integrate the probability of death for each event over the specified population.
/ ff e N represents the number of people killed by a given event, particular considering the weather category/wind direction combination. It is calculated for the population on a grid according to Equation ( 4 )

Consequences analyses background
Different scenarios of LNG release on water surface are possible, depending on where a rupture occurred. Accident scenarios like a collision between ships, grounding, and collision at the coast could all lead to a rupture of primary cargo containment that could spill LNG into the environment. The collision of two ships at 90 0 , in which the side collapsed ship is the LNG carrier is the worst scenario. The HAZID model of this is presented by (Pitblado, 2004). The scenarios of grounding and collision with the shore are less critical because the impact force is distributed over a wider area of the ship and the penetration is not as deep in the vessel's structure. During the unloading operation the transfer arm could break because of an unpredictable ship movement, even it is moored. The shutdown of the transfer operation occurs in 1 to 10 minutes depending on the emergency system used. Transfer lines with EMS (Emergency Shut Down System) could interrupt the transfer in 1 minute. During the calculation a tolerance of an additional minute is added. The investigation conducted indicates that the consequence approach should be based on some conservative initial conditions. We found that the best idea is to assume the greatest possible rupture size on primary containment or the transfer pipe, resulting from an accident. In this way a separate investigation could be conducted. The first is the calculation or assumption of possible rupture sizes and the second is the analyses of the resulting spills dynamics. In the paper the rupture size is assumed and taken from the literature (Pitblado, 2004), but the spill dynamics are computed.

Analyses approaches
The computation of potential consequences is the first step toward understanding the severity of an accident. Several commercial computer programs apply a lumped parameter modelling technique. Empirical equations derived from physical equations consider different release scenarios, meteorological conditions, obstacle density, etc. A zone modelling technique divides the physical space into zones. Within each zone the uniform physical phenomena are computed using physical and empirical equations. With this approach several approximations and simplifications within models are assumed to reduce the complexity of formulations and to reduce the computation time. In some applications, like gas dispersion dynamics, results from empirical models could lead to underestimated results. For this reason the empirical models usually apply corrective parameters or factors to compute more conservative, corrective, results. Overestimated consequences results could lead to overestimated risk results and falsely estimate the risk level to exceed allowed limits ( Fig. 1). When this is suspected, further consequences analysis should be conducted, applying more accurate methods. The case of gas dispersion is computed using a CFD (Computational Fluid Dynamic) code and analysed for improved results.

Rupture size
The estimation of the rupture size caused by an accident involving an LNG carrier is not easy, because of the variables: a complex structure, the type of accident and the location of the primary rupture. The LNG carrier has four to five barriers that would have to fail before the LNG cargo is spilled. The shield of the LNG containment allows deformation before it ruptures. The characteristic of this material is that it remains elastic at a cargo storage temperature of -162 0 C. The second fact is that the reservoir is filled up to 96-97% and the rest is gas, about 800 m 3 . Because of this gas space the containment structure allows slow deformations that occur during an accident. The accident of the El Paso Paul Kayser (Bubbico et al., 2009) is a good example. The accident caused significant deformations of the ship's hull and ribbed construction yet the deformation of the cargo containment was limited to one meter and there was no release. Pitpablo (2004) suggests that the maximum possible rupture size is 250 mm in diameter when caused by grounding or collision with the shore.
Research conducted by DNV based on accident statistics and ship damage are based on the IMO (International Maritime Organisation) Guideline for Alternative Tanker Design (IMO, 1995). DNV found that an LNG tanker could resist a hull deformation of 3 meters and the reservoirs could resist 2 additional meters of deformation. Considered and analyzed ruptures on LNG vessels are only caused by accidents from the traffic point of view. Terroristic attacks and attacks with weapons are not considered. However, the interpretation of DNV (2008) and Sandia National Laboratory (Hightower et al., 2006) is widely acceptable. Major damage to LNG tankers by weapons is less probable because the vessel's structural stiffness is much greater than any building, bridge or other land structure.
In case a projectile breaks through the primary reservoir, there is a high probability of immediate ignition, a local fire or even the destruction of the ship, but not the formation of a flammable gas cloud and subsequent flash fire that is a danger to the neighbour population. On this basis DNV suggests the consideration of the largest rupture size of 1500 mm for a terroristic attack. Therefore the further scenarios analysis would consider the following LNG reservoir rupture size: • 250 mm Maximum possible rupture size caused by grounding • 750 mm Maximum possible rupture size caused by collision • 1500 mm Maximum possible rupture size caused by terrorist attack • 7,000 m3/h Maximum possible leakage rate for 10 min • 10,000 m3/h Maximum possible leakage rate caused by sabotage for 60 min

Atmospheric dispersion of a vapour cloud
As mentioned above, the spreading of the LNG pool is a dynamic process that is alimented by the spilling from the tank slowed down by evaporation or even vapours burning.
Research conducted by Hissong (2007) and ioMosaic (Melhem, 2007) presented in Table 1 explain that the evaporation rate could vary depending on water conditions. Leak rates from a tank rupture were calculated; initial gas, "flashing" and an aerosol are formed. An aerosol is a cloud of tiny liquids droplets or fine solid droplets suspended in air.
Calculating the droplet evaporation along the cloud trajectory, the overall vapour generation rate is obtained. In this section the dispersion model of the vapour cloud is described. The model considers different types of release: instantaneous, steady continuous and transient for dense (active) and lean (passive) gases. Our case considers a ground level instantaneous release from a tank rupture. That is the most catastrophic scenario, one which can lead to fast vapour cloud formation near ground level and with a high gas concentration. Because of a very fast transient and changes of variables, it is difficult to predict the course of events, especially close to the source of dispersion. Once the cloud, modelled as a cylinder, is formed, it begins to slump under the effect of gravity. The velocity of the edge of the cloud can be described as (Safer Sysetm, 1996): k 1 is a slumping constant that depends on the characteristic of released gases and weather conditions. The most important factor is wind speed. It is important to note that the dispersion model does not assume turbulent flow. Dispersion of the cloud is therefore a suitable element to be computed with the CFD model. The rate at which liquid fuel evaporates when burning is a function of the liquid temperature and the concentration of fuel vapour above the pool surface. According to the Clausius-Clapeyron relation, the volume fraction of the fuel vapour above the surface is a function of the liquid boiling temperature; where v h is the heat of vaporization, f W is the molecular weight, s T is the surface temperature, and b T is the boiling temperature of the fuel. The cloud transport due to wind is modelled as & Safer System, 1996: where x is the downwind distance variable and U CLOUD is the cloud speed, assumed to be equal to the wind speed. The value0.4 times the cloud height is assumed to be a reference height or the centre of gravity of wind force in the direction of cloud movement. In most dense gas releases, it is expected that there will be a central core region of uniform concentration along with edges at which the concentration decreases. It is expected that close to the source, the edges will be sharp and as the cloud disperses downwind the edges will become less steep. The concentration field is calculated considering a Gaussian distribution. That means that the isopleth limits, or the edge of observed concentration limits, take on a typical Gaussian distribution. Gaussian correlations for the atmospheric cloud dispersion are not proper for any initial conditions and release type, but are used as a conservative model (McGrattan, 1997).

Scenarios and results
The first simulations conducted are used to compare results obtained from the lumped model (fast computation) and CFD model like FDS (Fire Dynamics Simulator). The scenarios include a simple geometry with a domain size 500m x 200m x 100 m in x, y and z directions. The diameter of the spilled pool is related with the diameter of the hole on a reservoir shield. Possible or applied scenarios are refined in a previous section, the resulting pool sizes are further obtained from functions explained in (ioMosaic, 2007). The following scenarios assume the hole at the bottom of the reservoir and 9000 kg of LNG content is spilled in 10 seconds and forms the pool. The evaporation rate of natural gas from the pool surface is calculated by the lumped model and assumed to be 0.16 kg/m 2 s for the CFD model in a stable sea and stable weather conditions. Calculated pool diameter for leaking 7,000 m 3 /h for 10 min 5. D = 400 m Calculated pool diameter for leaking 10,000 m 3 /h for 60 min Because of the very similar pool sizes scenarios 2 and 4 are calculated once as are scenarios 3 and 5.

Pool size related to rupture size
The course of events after an accident could follow different directions before the course of the accident is definitive. Depending on the accident dynamics, and the time and place of occurrence it could lead to different levels of risk. An example is the immediate ignition of a vapour cloud. If this occurs in a populated area, it represents a high risk event, but if it occurs outside the populated area it would be a low risk event. The reason is in the consequences of the event. The second event mentioned would be high risk if the ignition of the cloud would be delayed and the cloud would be transported downwind into a populated area. The first scenario assumes the evaporation of natural gas from the LNG pool on a water surface of an area of 400 m 2 . The evaporating gas is moved downwind at 2 m/s; the surrounding temperature is 20 o C. The model does not include complex geometry, buildings, and relief that would slightly change the flow dynamics of the vapour cloud. The table above explains how the cloud formation is modelled with FDS. There is no phase transition modelled from liquid to gas. Instead of this the gas release with a specified mass flux dynamics or evaporation rate (Table 1) is applied. The first scenario treats a minor leak and consequently a smaller spilling pool. The scenario is primary used for model testing and for the selection of adequate boundary and initial conditions. It is also used for the comparison of results with further models where the differences of consequences could be compared for different releases.

Results
The comparison of results from the lumped model and CFD model explain the adequacy of the analysis. Fig. 2 shows the results of a Methane concentration field. The bold polyline represent the concentration 3000 ppm and the shape of the cloud downwind. The overlaid curves (continuous and dashed) represent the cloud height, calculated by the lumped model described above. Instead of the concentration field the dotted red line represents the cloud height obtained from averaging local heights of the Methane cloud. The following in Fig. 3 is the comparison of evaporated gas concentration between two models. 5% concentration is selected because it represents the LFL (lower flammable limit) for methane. The time scale, presented on a graph requires a second axis only for the lumped model results. However, the comparison of CFD fields and the cloud heights of the lumped model show close results and time dynamics.
The obtained results are a good guideline for the setup of further model scenarios. One finding is that the FDS program does not allow for a satisfying definition of the pool evaporation process; therefore the dispersion is overestimated at a later time. The pool evaporation process does not have equal dynamics in both models. The solution found is the combination, where the pool evaporation process is modelled by a lumped model and the cloud dispersion by CFD. This technique is also applied in further scenarios.
A small release of LNG on a water surface reaches the thermal equilibrium fairly rapidly and the evaporated gas quickly dilutes to concentrations below the LFL (low flammable limit) that is 5% in the air. The area at risk of fire is about 150 to 200 m downwind. The model does not include complex geometry, buildings, or relief that would slightly change the flow dynamics of the vapour cloud. In real situations local gas accumulations could occur in bounded spaces where the gas could exceed 5% concentrations. The literature www.intechopen.com (Fells et al., 1969, ioMosaic, 2007& Hissong, 2007 does not devote special attention to this phenomenon because it is would require overly complex stochastic machinations.

Risk assessment of an LNG terminal
The assessment of the installation presented is focused on the accidental events of the LNGC approaching territorial waters though the northern Adriatic separation zone, entering the port and the unloading operation in the sense of individual risk and social risk. Therefore the appropriate approach is to discover and analyse processes and installation elements that could lead to undesired consequences. There are several widely approved methods, like HAZID (Hazard Identification) and HAZOP (Hazard and Operability), described in Macdonald (2004) and in the Guidelines for the management of change for process safety (2008) that are used for structured and systematic examination of a planned or existing process or operation in order to identify and evaluate problems that may represent risks to personnel or equipment. The HAZOP study and report are not presented in the paper, but the evaluated accident events frequencies are used for the evaluation of individual and social risk.

Scenario based models
The population is exposed to risk depending on the reliability of the installation and its components. This is done according to recommendation of the Manual Risk Calculations (2008), Guidelines for the management and change for process safety (2008), DNV reports (2008) and ioMosaic reports (2007). In general the following scenarios are modelled for vessels: • catastrophic rupture with instantaneous release of full inventory; • a large leak resulting in a continuous release with a fixed duration (10 minutes); • a small leak (10 mm) The failure frequencies for the scenarios are derived from the Dutch guidelines (2008). The study leads to several accident scenarios with elevated risk and takes into account accidents www.intechopen.com that occur due to technical failures. The catastrophic rupture with full lost of inventory is left out of possible technical failure scenarios. This is an important assumption because technical failures could be identified and evaluated by the above methods. The conducted QRA (Quantitative Risk Assessment) takes into account scenarios listed in Table 3 The worst consequences would result from the largest releases. The rupture of a loading arm during the unloading operation could lead to large spills and influence the risk level. The difference between the first and second scenario is the installation of the emergency shutdown valve on the transfer line. This valve restricts the release time for ruptures of the arms. A value of 120 seconds as maximum release duration is chosen as it is widely accepted to be a conservative value for pipe isolation. Also the scenario that the ESD valves can fail has been taken into account (probability of 0.001 is taken into account). In that case a maximum release time of 30 min is applied. The defined scenarios are assessed for their impact on external safety by using criteria for individual risk and for societal risk. Fig. 4 shows curves of the individual risk for scenarios P1 to P8 from Table 3, which includes unloading operations on moored tankers. The criterion for individual risk is 1E-6/ avg year for population, a commonly accepted risk throughout the world (Trbojević, 2005). The area with this risk is contained within the installation boundary. The personnel of the installation and of the terminal are the only ones exposed to risk higher than 1E-6/avge year. However, the employed personnel are adequately educated and trained for possible threats and have defined procedures to overcome possible emergencies. Scenarios with a major influence on risk are larger spills (scenarios P1 and P2) like rupture of a loading arm at lower wind speeds. The reason is that the vapour cloud remains compact for a longer time and moves downwind, possibly into the direction of a populated area. The populated neighbourhoods located south and north of the port are exposed to a much lower risk than 1E-6/avge year. In this case the LNG unloading operation, considering the eight most likely accident events, is safe for people living or passing through the LNG terminal neighbourhood. Personnel working on the LNG terminal on pier 2 (Fig. 4) and on neighbouring terminals on pier 1 are covered by the risk zone 1E-6/ avg year. www.intechopen.com

Fig. 4. Individual risk for LNG terminal
The societal risk is further presented in Fig. 5 with an F-N curve. The maximum expected number of fatalities is 20 with the probability of 4*10 -7 that is found at the end of F-N curve. The entire societal risk curve (F-N) is located within the ALARP (As Low as Reasonably Practicable) area delimited by the Max and Min Risk Criteria straight lines. This could be taken as an argument that the LNG terminal operations are not harmful to neighbouring populations. Employed personnel on the jetty and pier 2 are the only people who contribute to societal risk, excluding them, the F-N curve would be lower than the Min Risk Criteria. The summary of risk assessment shows that the 1E-6/ avg year individual risk contours do not reach any vulnerable location outside the port area and therefore the level of societal risk is not unacceptable, since the presence of people in the direct vicinity of the jetty is limited and the distance to populated areas like the town centre is too far to pose a societal risk. The most important factor in risk assessment is determining the level of assessment, which then determines which scenarios and types of accident are investigated. Here we dealt only with technical failures during the unloading operation with major predictable consequences. Modern industrial installations are no longer problematic regarding safety aspects mainly because of the application of state of the art standards for construction, materials, and operations and so on. During last decade a lot of attention has been focused on unpredictable risks that are human and societal related; that is to say, terrorism, which has not yet been well defined. A lot of work is done by developing countries to overcome this risk and to include it in different standards and procedures. But up to now no one standard regarding construction or materials of industrial installations has been changed because of the risk posed by terrorism, though several new operational procedures have been applied in practice.

Conclusion on LNG risk assessment
The investigation conducted is focused on the discovery of an appropriate approach to risk assessment for an LNG delivery terminal located close to a populated area. The assessment should focus mainly on the identification of accident scenarios which results in individual risk higher than 1E-3 / avg year for the neighbouring population. Because the risk calculations are most influenced by large accident consequences, these accidents should be analysed in detail to avoid over or under estimation of fast computing consequence (dispersion) models, which are usually used in risk assessment software. The comparison of a lumped model and CFD model is therefore conducted and the differences are analysed and discussed. After obtaining satisfying results the individual and societal risk is computed for the specified number of accident scenarios. The lumped model approach for consequence calculation is the best choice in the initial phase of risk analyses when several simulations need to be done. Additional detailed analyses are required when the risk is near the limit of that ALARP region. The numerical simulation of a problematic scenario could explain whether the consequences and therefore the risk is really too high, or whether it should fall within an acceptable area. Usually this is not a satisfying solution, so regarding this some modifications of the project are commonly proposed. A possibility for further development is on a risk model based on CFD that relies on several overlaying CFD scenarios in combination with risk criteria functions and obtained individual risk levels. Depending on the accuracy of analysed scenarios the risk range could be much more realistic than in lumped models where the range is intentionally more conservative. In any case, the method would be very time consuming yet could be quite useful in the last stage of risk assessment.

Fluid dynamic models for road tunnels risk assessment
The definition of the deterministic approach in safety analyses arises from the need to understand the conditions that emerge during a fire accident in a road tunnel. The key factor of the tunnel operations during the fire is the ventilation, which during the initial phases of the fire have a strong impact on the evacuation of people and later on the access of the intervention units in the tunnel. The text presents the use of the CFD model in the tunnel safety assessment process. The set-up of the initial and boundary conditions and the requirement for grid density found from validation tests of an FDS (Fire Dynamics Simulator) is used to prepare different kinds of fire scenarios in different ventilation conditions; natural, semi transverse, transverse and longitudinal ventilation. The observed variables, soot density and temperature, are presented in minutes time steps trough the entire tunnel length. Comparing the obtained data in a table allows the analyses of the ventilation conditions for different heat releases from fires. The second step is to add additional criteria of human behaviour inside the tunnel (evacuation) and human resistance to the elevated gas concentrations and temperature (Haack, 1998(Haack, & 2002.

Methodological approach on tunnel safety
In order to identify the interactive and uniting relationships in a system, analysis is necessary to replace the apparent structure of individual statements on the components of a system and their relationships with their underlying common logical structure (system analysis). For example, if we are dealing with a system which we call "a chemical process plant", we get at its various components successively, by means of deductive analysis: the buildings, the operators, the storage tanks, the control systems, the operating procedures, etc.. Each such component is thrown into the modelling reality by a distinct act of noticing, and is steadily held together with those components already segregated. The aim of system analysis is to investigate the system's behaviour (i.e. the succession of its states over time) on the basis of its components' changes with time. The results of system analysis can be expressed in qualitative and quantitative terms (statements resulting from "qualitative analysis" and numbers resulting from "quantitative analysis"). The deterministic approach breathe into the analysis of the greater part of physical events like fire source characteristic and its dynamics, the operation of the ventilation system and other conditions as well as their reciprocal interactions. The approach leads also to the definition of the technical system "safety efficiency" in the range of possibilities that exist in a real word and are functionally descriptive. When the approach is used in practice, we should define a number of "safety categories" base on events probability and consequences for the individual risk. The example in presented in a  (Kirchsteiger, 1999) www.intechopen.com Note that, in these schemes, a quantitative definition is often given in addition to the qualitative definition, mainly to ensure consistency in the course of the analysis and provide benchmarks ("semi-quantitative analysis"). In schemes of this type, the assessment team, usually comprising members of line management, safety engineers and operations personnel, will first identify all hazards, using HAZOP or similar approaches, and then assigns a severity category to each of these, for both likelihood and consequences (PIARC, 2003& Brussaard, 2004. Following the assumptions of (Kirchsteiger, 1999), a "risk matrix" would then be defined as a 5 x 5 matrix with each side corresponding to one severity category.
''Likelihood'' ''Severity category '' Consequences ''Severity category'' Table 5. Deterministic safety analysis -example of risk matrix (Kirchsteiger, 1999) Different shading in a table indicates different risk levels. Hazards with high assessments, such as A1, B1 and A2 in the black squares, are thought of as being very severe and requiring immediate action to reduce. Hazards with low assessments, such as E5, E4 and D5 in the white squares, are considered to require no further action. Hazards between these two (grey squares) are considered worthy of some improvement if a cost-effective solution can be found.

Computer models and simulations
Deterministic models that would consider all physical parameters are almost unfeasible in practice and if feasible would require very complex and time consuming computations. The application of deterministic analyses results in practice is conditioned by the simplification of some physical phenomena (like turbulence) (Gasser et al., 2002. The fluid flow is modelled by solving the basic conservation equations. Those are conservation of mass (8), conservation of mixture fraction (9), conservation of momentum (10) and conservation of energy (11) using a form for low Mach number & Fletcher, 1991. The approximation involves the filtering out of acoustic waves.
Where ρ is a density, u is a velocity vector, Z is the mixture fraction, T the temperature and D is a molecular diffusivity. p  is the perturbation pressure caused by pressure differences, τ the viscosity stress tensor and k the thermal conductivity. c q′′′  and ∇q r are the source terms of chemical reaction and radiation, respectively. The radiation term has a negative sign because it represents a heat sink. The effect of the flow field turbulence is modelled using LES (Large Eddy Simulation), in which the large scale eddies are computed directly and the sub-grid scale dissipative processes are modelled (Sagaut, 2002). The unknown sub-grid stress tensor τ is modelled by Smagorinsky model (Lesieur, 1997). Further the combustion model is based on the assumption that the combustion in mixingcontrolled. This implies that all species of interest can be described in terms of the mixture fraction Z. Heat from the reaction of fuel and oxygen is released along an infinitely thin sheet where Z takes on its stoichiometric value as determined by the solution of the transport equation for Z. The state relations are calculated for a stoichiometric reaction of C 7 H 16 (Oil), which is proposed by , Heskestad, 1995& Mingchung, 1999 and called a Crude oil reaction.

Tunnel fire analysis
The idea is based on the creation of a deterministic risk matrix as it is showed in the Table 5. The safety category is represented by the power of the fire and the type of ventilation at different strengths and on other side the consequences are evaluated in the time during the progress of the fire. The risk criteria are defined as a relation between the hot smoke layer height, the distance from the fire position and the evacuation time of the users. In case the speed of the smoke is higher than the speed of the evacuation and in case the height of the hot layer is higher than the speed of the evacuation, the risk is high.

Tunnel fire scenario
All together 12 tunnel fire scenarios are presented. Three levels of fire force are simulated, each with four different types of ventilation. The span of the fire force is between 20 MW, 50 MW and 100 MW whilst the ventilation is sorted from the less to the more effective: 1 -natural, 2 -longitudinal, 3 -semi transverse and 4 -transverse or improved transverse ventilation. The whole section of the simulated tunnel is 650 m long, the other dimensions are width 10 m and height 8 m or 6 m when the roof is lowered. Though the dimensions and shape of the tunnel tube partly differentiate among them that does not influence what happens during the fire. That is why ordinary skeleton measurements are chosen. The geometry of the tunnel model, the type of ventilation and the location of the fire are shown on Fig. 6. The fire is placed on a distance of 300 m in all the models, it differs only in the size of the burning area. The focus point is defined as the heat source to which the combusted model calculates the mass transfer on the base of the accorded combusting reaction and the oxygen consumption. The ignition point is shown in Fig. 6. When we define the base igniting temperature, heat conductivity, calorific value, etc. (depending on the models demands) it is treated in the model as combustible substance and it cooperates with the generation of heat www.intechopen.com in the combusting model. In case of the described scenarios, the base is relatively small or of small volume, that is why the heat contribution of the burning base is only a few percent of the defined freed heat of the boundary condition.

Initial, boundary conditions and discretization
The definition of the initial and boundary conditions is a peculiarity of each model. Four elementary ways of ventilation are discussed: natural, longitudinal, semi transverse and transverse. In definition of the geometry of the tunnel, the natural and longitudinal ventilation are discussed together and the semi transverse and transverse ones also in the same way (Woodburn, 1996). The comparison is shown on the lower picture: It is clear that the tunnel models with natural and longitudinal ventilation take the whole section of the tunnel, however the tunnel models with semi transverse and transverse ventilation consider only the light section of the tunnel (without the ventilation drains). The suction flaps are defined with the speed margin condition on the limit of the calculating domain (Cheng et al., 2001).

Parameters and approach to the result analysis
The simulation results are presented on levels of fire force and types of tunnel ventilation. The consequences of the distance of the smoke and the temperature are qualitatively evaluated from the current and temperature field. With this, it must be noted that mistakes are possible in calculating the average value in different time and space steps, which are limited with the unified way of average calculating. With that, it is true that the risk of exposure to smoke is that the participant is exposed in the moment when the smoke reaches him. The most risky examples are the ones when the participant does not start with the immediate self-rescue procedure after the start of the fire and the second when the spreading speed of the smoke is higher than the self-rescue procedure speed of the participants in the tunnel. The other risk criterion is high temperature that usually has a lower contribution to the risk than smoke. In most cases this depends on the way of ventilation.
The limit value of the concentration of smoke particles (PM10 heavy particles with the diameter up to 10 µm) is 1000 mg/m 3  and the limit temperature is 50 o C. Though the smoke particles are less problematic from a poisonous point of view, than other combustible products (CO 2 -carbon dioxide, CO-carbon monoxide, HCNhydrogen cyanide, HCl-hydrogen chloride, etc.) their relation to the concentration is conditional and often very similar. From different experiments in the Memorial Tunnel (1996) it can be found for example concentrations of smoke particles and CO in relation around 10:1. A similar relation can be also found on toxic levels of these products. LC 50 (Lethal Concentration 50 %) for soot particles is 30g/m 3 in a 30 min exposure or 1-3g min/m 3 LC 50 , for CO is 2000-3500 ppm, which is 2300-4000 mg/m 3 in a 30-60 min exposure. The limit temperature values of human endurance are according to Gann (1994) 100 0 C for 30 min and 75 0 C for 60 min of exposure. Because this information is true for an adult man it is the most optimal. But within the same research there are difficulties in breathing already at 65 o C of air temperature. Taking this into account there are two values that are used in the result analysis. The chosen limit concentration of smoke particles is 1000 m g/m 3 and the limit temperature is 50 o C. The risk or consequences are divided in five categories that are shown in the Table 6, these are: 1. LR -low risk: smaller injury 2. MR -medium risk: serious injury with full recovery 3. SR -serious risk: permanent injury 4. VHR -very high risk: low casualty number (1-3), numerous injured 5. EHR -extremely high risk: numerous casualties In the result analysis each category matches a logical inscription and it conditions with the time from the start of the simulation, any distance from the fire area, fire force, way of ventilation, limit value of the concentration of smoke particles and the limit temperature.

Evacuation model
The easier discussing of results is enforced with the understanding of people behaviour during a fire in the tunnel which after the spotted fire begins with the self-rescue procedure. This is a withdrawal from the tunnel or to the first transverse passage in two tube tunnel scenarios. The movement of the people in similar conditions is very unpredictable, some become immediately aware of the danger and begin with the selfrescue procedure others do not perceive the danger in time and start with the self-rescue procedure too late. On self-rescue there is a simplified model of people movement in the tunnel. The model takes into consideration the elementary movement parameters as: start of the self-rescue, walking speed, tunnel length and logical curiosity that in the initial location north or south arranges the movement direction north or south. With this the possibility of a tunnel user approaching the fire during the self-rescue procedure is excluded in the model. With a program the self-rescue procedure is defined with the following conditional note: With the presented model the possibilities of the analysis or the following of the movement of the users in the tunnel increase additionally. The calculated locations are then used for checking the temperature and the smoke concentration on the ground in these places and consequently the level of risk.

Results
The first level of risk is presented by the presence of smoke that includes the first four risk stages, the presence of high temperature contributes additional (the highest) risk stage. The Table 6 presents a deterministic register of risk for a constant location in a tunnel during a fire that is 252 m north of the fire. The picture that we get whit this is very representative because it confirms the theory on safety analyses. From the table the safety categories can be seen and appropriate consequences can be allocated. Table 6 has especially a comparative purpose for finding the influence of different ways of ventilation on the fire dynamic, smoke and temperature development. We can logically assume that the risk in low fire force is lower in comparison with bigger fires. Following the same logic along with the consideration of different ways of ventilation and manner of management it soon becomes difficult. One of the noticeable differences is the level of the calculated risk (MR -medium risk) in longitudinal ventilation of a 20 MW fire. It is expected that the increased risk also appears in the 50 MW fire but it is not so. The search for a cause is difficult because this is hidden in the fluid dynamics during the fire, taking into account that the geometry, the discreetness and the initial and boundary conditions (except the force of the fire) are unaltered. The second important result in the table is the possibility of analysing the influence of turning on the ventilators on the forming of the smoke curtain. It is especially noticeable in the transverse ventilation of 50 MW and 100MW fires where on the turning on, local increased temperatures and smoke concentrations occur. Table 6 is made as a functionally dependent dynamic register, which chooses the calculated values from the data base with the changing of the observed location and on the basis of conditions from the chapter above, calculates the risk. With the evacuation model is possible to define the tunnel user's location in time intervals of one minute on the bases of the starting user's position, delay with the self-rescue procedure and the walking speed. In this way it is possible to predict the tunnel users movement for the following 15 min and check the smoke concentration and the temperature height to which they will be exposed or establish the risk level. The table represents a conceptual

Conclusion on tunnel risk assessment
For a register of a fire in a tunnel and a safety evaluation, the probability accession is too general because a greater event number of physical legality is shown with a statistical probability. A relatively accurate fire dynamics register, which is possible with mathematical models, is often meant only for science. That is why the dissertation is ideally oriented in the use of mathematical CFD models for the making of a system of scenarios that can be further used for developing an effective fire plan or fire management, fire drills, etc. A complex of fire scenarios in different tunnel ventilations and fire forces is presented in the work. The work includes a qualitative analysis of the current circumstances in four different ventilation conditions; natural, longitudinal, transverse and semi transverse. In this way a comparison of individual types of ventilation systems, ventilation plans and their effectiveness in assuring sufficient evacuation times is possible. Also a possibility of usage on a singular tunnel is presented, for which a deterministic safety analysis within a selected number of scenarios would be made. Such an accession requires a lot of calculating time but it is changeable in the development of the safety analysis and fire plan. The geometry and some ventilation plans are "constants" in this case and only the fire location can be changed. Apart from the number and way of setting the scenarios, the simulation results are values of the selected variables. The discussed variables are mostly the smoke density and the temperature which define the different risk levels on the basis of the human endurance in increased values and conditional interacting dependence. On this basis the deterministic risk register is made which is the key element of the dissertation. The register presents a passage between a practical way of using the CFD model and the user who needs clear and fast accessible data of the situation during a fire in a tunnel.