Introduction

Natural events were responsible of several major accidents scenarios that affected process equipment and storage facilities. This type of accidents is defined as Natech (Natural-Technological) scenario. Several past accident studies confirmed that lightning strike is the most frequent cause of Natech scenarios with respect to other naturel events like floods and earthquakes [1]. The study results in [2] showed that 33% of 242 fire and explosion accidents that occurred in storage tanks are triggered by lightning. Rasmussen [3] found that lightning accounts for 61% of the accidents initiated by naturel events. Past accidents surveys reported in the literature indicated that atmospheric storage tanks are the more vulnerable equipment items with respect to lightning impact [4]. Recent studies, mainly focus on the damage mode of process and storage equipment following lightning impact, found that the perforation of metallic shell and the electric arcs at discontinuous parts are the two dominant causes of damage to metal vessels [4, 5].

Although lightning protection measures and guidelines provided and addressed by several codes and standards for atmospheric storage tanks, a limited effect on reducing the probability of accidents caused by lightning was remarked because of the high number of lightning accidents reported in storage tanks that meet the relevant standards [6, 7].

The lightning impact mode on storage tanks may be characterized either by direct damage on the shell and the tank roof, or by ignition of flammable vapors released in the rim-seal area and the floating roof [5]. The final events that may follow lightning impact on atmospheric storage tanks containing flammable substances depends on many factors such as equipment features, type of the stored substance, and the available safety barriers. Several past studies analyzed accident scenarios that may be triggered by lightning strikes on storage tanks. Necci et al. [8] developed reference event trees and studied event sequences following lightning impact on different types of tanks (fixed roof tanks and external floating roof tanks). The frequencies of final scenarios were validated by past accident cases. Wu et al. [6] proposed a methodology based on generic event tree for the quantitative assessment of three categories of fire accidents scenarios caused by lightning on floating roof tanks. Wei et al. [9] developed a quantitative methodology for the risk assessment of direct lightning strike on external floating roof tanks. Cheng et al. [10] established a risk assessment model based on the Bayesian network to analyze Natech risk induced by lightning strikes on floating roof tanks.

The present study aims at the development of a specific event tree model for the identification and the quantification of accident scenarios following lightning impact on different types of atmospheric storage tanks and the integration of the role of fire safety barriers in the prevention and the mitigation of lightning-triggered scenarios. Past accident analysis was performed as a preliminary step. Fifty-eight lightning-triggered accidents that occurred on storage tanks were selected and statistically studied in order to show the possible event sequences and to identify the most frequent type of storage tanks and final scenarios involved.

The quantification of the event tree analysis is based on specific models existing in the literature for the calculation of lightning annual probability and direct damage probability [5, 7, 11]. The expected availability of fire safety barriers adopted in the site of interest is calculated using fault tree analysis method in the case of technical data related to the system are available while in the case that these data are unavailable, generic availability value of the barriers obtained from technical literature databases is used. The event tree related to external floating roof tanks was mapped into an equivalent Bayesian network model to determine the most critical basic events of fire safety barriers using the sensitivity analysis. Hence, an amelioration in the availability of these events was proposed, and then, the annual probabilities of consequences was updated. In order to illustrate the applied methodology and to see the importance of the integration of all relevant safety barriers performance, a real case study is analyzed. The obtained results proved the influence of the improvement of fire safety barriers on the reduction of the probability of lightning- triggered accidents.

Statistical Study of Past Accidents Triggered by Lightning Strike on Atmospheric Storage Tanks

Lightning-triggered accidents occurred on atmospheric storage tanks were retrieved from different major accident databases [12, 13] and research papers [6].As a first step, 58 accidents were selected and collected based on the existence of some detailed information needed for their classification (type of storage tank, final scenario, etc.) (see Appendix).

In the second step, these accidents were statistically analyzed according to the type of atmospheric storage tank involved and the final scenario resulted as shown in Fig. 1. 67% of the analyzed accidents involved external floating roof tanks (EFRT) which confirm the results of several recent studies that identify this type of storage tanks as the most vulnerable equipment to lightning strike [1, 2, 14]. It should be noticed that the second category, which is fixed roof tanks (FRT) include both cone roof tanks and internal floating roof tanks, due to the limited information provided by the databases analyzed concerning the type of fixed roof involved in accidents. Rim-seal fire was the most frequent final scenario occurred on EFRT 59% which is confirmed by the Last fire project [14]. The second is full surface fire scenario and the third is local pool fire scenario with percentages of 36% and 5%, respectively. For FRT, two possible final scenarios were reported, full surface fire 57% and confined explosion 43%, which is generally followed by full surface fire.

Fig. 1
figure 1

Statistics of accidents triggered by lightning strike according to the type of atmospheric storage tanks

Full size image

Event Tree Analysis of Accident Scenarios Triggered by Lightning Strike

Identification of Accident Scenarios

The final scenarios following a lightning strike depend on the features of the tank (type of the tank, its mechanical properties), the type of the stored substance, and the implemented fire safety barriers.

The event tree (ET) method is used to determine the accident sequences that may result from lightning strike (initial event) on atmospheric storage tanks of flammable liquids.

Based on the tank type, three different ET models were generated considering the role of safety barriers installed in the storage tank of interest. Two models are obtained for EFRT considering two different cases. The first one, where the direct lightning strike is supposed to affect the tank shell, while in the second case direct lightning strike is supposed to affect the floating roof (see Fig. 2 and Fig. 3). The ET obtained for FRT is reported in Fig. 4.

Fig. 2
figure 2

Event tree following the direct lightning impact on the tank shell of external floating roof tanks

Full size image
Fig. 3
figure 3

Event tree following the direct lightning impact on the tank roof of external floating roof tanks

Full size image
Fig. 4
figure 4

Event tree following lightning impact on fixed roof tanks

Full size image

For EFRT, The first case is characterized by the direct action of lightning strike on the tank shell, which results in the release of flammable liquid in the bund area, thus the possible ignition of this flammable pool by lightning may give a pool fire. The molten metals at high temperature may easily be a source of ignition [6]. The second case is characterized by the direct action of lightning strike on the floating roof that may result in the damage or the perforation of this roof. When the floating roof is perforated, vapors existing in the space between the floating roof and the liquid surface will be released forming a flammable mixture with air [6]. If the released vapor is ignited, local pool fire may occur with possible escalation to full surface fire. If the direct damage on the tank shell and the roof does not occur, the ignition of flammable vapors that may exist in the rim-seal area, especially between the primary and the secondary seal cause a rim-seal fire. The possible escalation of this type of fire to a full surface fire depends on the action of fire safety barriers. It has to be mentioned that the ignition of flammable liquids that may exist above the floating pan is not considered in this study because this event is considered as rare event with low occurrence probability according to past accidents studies. For FRT, two possible scenarios are considered. The direct damage of cone roof tanks or internal floating roof tanks is limited only to tank shell. In this case, the consequent final scenario is the release of flammable liquid to the bund area with possibility of ignition. Alternatively, the ignition of flammable mixture that exists inside fixed roof tank may cause a confined explosion. The presence of this flammable mixture in the top space between the liquid surface and the roof is related to the unavailability of inert gas blanketing system [8]. If the fixed roof tank is constructed in accordance with API 650 standard [15], which recommend to provide a weak joint between the roof and the top of the tank wall, the confined explosion can be followed by a full surface fire. It must be remarked that the probability of presence of flammable vapors outside the tank is assumed equal to 1 for all cases.

Annual Probability Assessment of Final Accident Scenarios

The quantification of ET models shown in Figs. 2, 3 and 4 is based on the calculation of final outcomes annual probabilities using GRIF commercial software [16]. This step is achieved by the assessment of different event probabilities included in the ET models. In the following, we discuss the procedures and methods used for the calculation of different probabilities.

Annual Probability Assessment of Lightning Impact on Storage Tanks

The first step in the quantification of the event tree representing the accident scenarios following the lightning strike on storage tanks is the calculation of the annual probability of lightning strike in the site of interest. Firstly, the flash density at ground level \(({N}_{g})\) should be computed and may be obtained from several literature databases or from lightning location networks that exist in many areas of the world. According to IEC 62305-2-2010 standard [11], \({N}_{g}\) can be estimated using Eq. 1:

$$ N_{g} = 0.1 \times T $$
(1)

where \(N_{g}\) is the flash density at ground level expressed in flashes/km2year and \(T\) is the yearly number of days of thunderstorm at the site of interest.

Several simplified models may be used to assess the lightning impact annual probability. According to the IEC 62305–02-2010 standard, the overall annual probability of lightning impact on the whole tank (including the tank shell and the roof) \(P_{f}\) can be calculated as:

$$ P_{f} = N_{g} \times A_{e} \times C_{t} \times 10^{ - 6} $$
(2)

where \({N}_{g}\) is the ground flash density, \({C}_{t}\) is the location factor, and \({A}_{e}\) is the equivalent receiving area of an isolated tank on flat ground, which can be estimated using Eq. 3:

$$ A_{e} = \pi \left( {R + 3H} \right)^{2} $$
(3)

where \(R\) is the radius of the tank and \(H\) is the height of the tank.

The values of location factor of the tank are shown in Table 1.

Table 1 Values of the location factor of the tank \(({C}_{t})\)
Full size table

Probability of Direct Damage

Lightning current has an intense heating effect, which can cause the melting of a portion of the metal at the attachment point between the electric arc and the storage tank. When the tank shell or the floating roof is damaged or perforated, it will lead to leakage and escape of liquid or vapor. The flammable materials will be ignited by the hot metal heated by lightning current [6]. The model developed by [5] is used in this study for the calculation of the perforation probability of the tank shell and the tank roof. The following equation allowed the determination of this probability:

$$ {\text{ ln}}\left( {P_{d} } \right) = 0.8944 - 0.908\ln \left( t \right) $$
(4)

where \({P}_{d}\) is the perforation probability and \(t\) is the steel thickness in mm.

According to Necci et al. [7], in the case of atmospheric tank containing flammable liquids, the loss of containment occurs only if the damage is generated on the tank shell surface that is in contact with the liquid. The damage probability of the tank shell \(({P}_{DD})\) is calculated by Eq. 5 and the damage probability of the floating roof \(({P}_{DDR})\) by Eq. 6 [7]:

$$ P_{{{\text{DD}}}} = \frac{{P_{d} \cdot S_{L} }}{{S_{{{\text{tot}}}} }} $$
(5)
$$ P_{{{\text{DDR}}}} = \frac{{P_{d} \cdot S_{R} }}{{S_{{{\text{tot}}}} }} $$
(6)

where \({P}_{d}\) is the perforation probability of the tank shell,\({ S}_{tot}\) is the total surface of the tank exposed to potential lightning impact, \({S}_{L}\) is the exposed surface of the tank shell (surface in contact with the liquid), and \({S}_{R}\) is the surface of the floating roof.

Availability of Fire Safety Barriers

Various national and international codes and standards are followed for the design of fire safety barriers [15, 17, 18]. Several safety barriers may be installed in storage tanks containing flammable liquids and that depends on some factors such as the layout and the size of the facility, the tank geometry, and the flammability hazard class of the stored substances [17].

According to the potential accident scenarios determined in “Identification of Accident Scenarios” section, fire safety barriers play an important role in the prevention of early-rising fires and the mitigation of consequences of accident scenarios following lightning strike on storage tanks. In the case where fire safety barrier is unavailable, the accident sequence evolves to the final event. Therefore, the probability of failure on demand \(\left(\mathrm{PFD}\right)\), which represents the unavailability of the system, needs to be assessed. This failure probability can be analyzed and calculated either using fault tree (FT) method in the case that reliability and technical data of components are available or using generic values of \(PFD\) obtained from literature reliability databases. The classification of the required fire safety barriers defined by [8] accordingly to OISD standard 116 [17] is adopted in this study, as follows:

  • Semi-fixed foam systems

  • Halon rim-seal fire extinguishing systems

  • Inert gas blanketing systems

  • Manual foam extinguishing systems

It must be remarked that other fire safety barriers that are irrelevant to the purpose of this study such as water deluge systems was not considered since their role is to reduce the damage probability of nearby equipment. In the following, the main categories of fire safety barriers relevant in the framework of accidents caused by lightning strike are briefly described as well as their technical features and availability.

Halon Rim-Seal Fire Extinguishing Systems

The automatic actuated rim-seal fire extinguishing system may be based on foam flooding, clean agent flooding mechanism, or other extinguishing agents such as halon [17]. Halon-based extinguishing system is installed on the floating roof of storage tanks and widely used for rim-seal fires. The successful activation of this system allows an efficient and fast detection and extinguishment of rim-seal fire due to automatic action of the detection system which is followed by an audible and visual alarms. The system is composed of three main parts: detection subsystem, extinction subsystem, and alarming subsystem. The detection function is assured by glass bulbs that are connected in between by a stainless-steel cable. The extinguishing subsystem basically consists of a high pressure halon cylinder linked to distribution piping containing nozzles that are located within the rim space area. Normally, a single-halon cylinder can cover up to 40 m of distribution piping [19]. Once the rim-seal fire is started, the glass bulb broke away and allows halon to be discharged on the fire area for its extinguishment. As a result, the pressure drop in halon cylinder detected by the pressure switch will generate an alarm in the local control panel and will be transmitted also to fire panel in the control room. In this study, the \(\mathrm{PFD}\) value was derived from quantitative FT analysis of halon rim-seal fire extinguishing system (see Fig. 5).

Fig. 5
figure 5

Fault tree of Halon rim-seal fire extinguishing system

Full size image
Semi-Fixed Foam Systems

To prevent fires, fixed or semi-fixed foam systems are generally installed in all types of atmospheric storage tanks. The difference between fixed and semi-fixed foam system, which is analyzed in this study, is that foam-proportioning components are permanently installed in the case of fixed foam systems while in the case of semi-fixed foam systems, foam-producing materials are transported to the scene after the fire starts and are connected to the piping. For EFRT, this protection system is aimed at the extinguishment of rim-seal fire caused by the ignition of flammable vapors, based on foam flooding of rim-seal area, which is bounded by a foam dam. Semi-fixed foam systems may be used also for the extinguishment of full surface fire resulted from the propagation of rim-seal fire and the sinking of the floating roof. For cone roof tanks and internal floating roof tanks, semi-fixed foam system may be used for full surface fire extinguishment that may take place after the explosion of the tank roof.

In this study, a detailed FT was carried out to obtain a conservative \(\mathrm{PFD}\) value of semi-fixed foam system as shown in Fig. 6. This fault tree was constructed following, and the real technical features of the system installed in the facility analyzed in the case study.

Fig. 6
figure 6

Fault tree of Semi-fixed foam system

Full size image
Inert Gas Blanketing Systems

In FRT, fire safety barriers may also include inert gas blanketing system, which introduces an inert or inactive gas such as nitrogen to the top space of storage tank to reduce the amounts of oxygen. The addition of inert gas to the tank allows the prevention of contact between the combustible or flammable liquid and the oxygen, reducing the potential ignition. The system includes a valve that controls the nitrogen coming into the tank. The valve is continuously adjusted to maintain a slightly constant positive pressure in the tank’s vapor space. The features and architectures of these systems may change depending on many factors such as tank type, tank size, and design considerations on the installation due to the absence of detailed requirements for inert gas blanketing systems in specific standards [8]. Concerning availability of inert gas blanketing system, a generic \(\mathrm{PFD}\) value may be derived from literature databases.

Manual Foam Extinguishing Systems

The manual foam extinguishing system (foam monitor) is an equipment for fire extinguishment, particularly for oil storage areas. Generally, this equipment is installed outside the bund area or on the storage tank roof and may be mounted on mobile or fixed supports. The role of foam monitor in the framework of accidents scenarios triggered by lightning strike may be considered if a suitable rate of foam is applied. For EFRT, foam monitor may be effective for pool fire extinguishment ignited in the bund area and full surface fire that may take place on the tank roof if semi-fixed foam system is failed. For FRT, the role of this safety barrier is limited to the extinguishment of bund pool fire since the extinguishment of full surface fire is impossible due to the limited rate of foam monitor. In this study, the \(PFD\) value of foam monitor was conservatively derived from available literature database [20], as shown in Table 4.

Bayesian Network and Sensitivity Analysis

Bayesian Network Overview

Bayesian network (BN) is one of the most effective methods in the framework of quantitative risk analysis [21,22,23]. BN is a directed acyclic graph consisting of both qualitative and quantitative parts, where stochastic variables are represented by nodes, directed arcs symbolizing causal relationships between the linked nodes, and conditional probability tables (CPTs) assigned to the nodes describe conditional dependencies [24]. The main advantage of BN is the ability to update the prior probability of events given new observations basing on Bayes theorem, which can derive more accurate probability values of accident consequences and the posterior probabilities of root nodes representing basic events [25]. BN represents a joint probability distribution which can be given by Eq. 7 [26]:

$$ P\left( U \right) = \prod\limits_{i = 1}^{n} {P\left( {\left. {X_{i} } \right|{\text{Parent}}\left( {X_{i} } \right)} \right)} $$
(7)

where \(P(U)\) is the joint probability distribution of variables \(U=\left\{Xi,\dots ,Xn\right\}\) and \(Parent(Xi)\) is the parent set of \(Xi\).

Mapping Fault Tree and Event Tree into Bayesian Network

Converting from FT and ET into the equivalent BN is based on the algorithm presented in the work of Khakzad et al. [26] as shown in Fig. 7. This mapping algorithm includes graphical and numerical tasks. In graphical mapping, the basic, intermediate, and top events in FT are represented as root, intermediate, and top nodes in the BN model. Besides, safety barriers and consequences in ET are considered as safety and consequence nodes in the BN model. In numerical mapping, the occurrence probabilities of the basic events are inserted as prior probabilities for the root nodes, and a conditional probability table (CPT) is assigned for each intermediate and top node according to the type of the gate [22].

Fig. 7
figure 7

Mapping algorithm from FT and ET into equivalent BN

Full size image

Sensitivity Analysis

Sensitivity analysis is used to identify the most critical root nodes corresponding to basic events that contribute to the occurrence of the target node. In which case the sensitivity analysis can be used as a criterion guiding event selection. Several techniques are available in the literature and can be used to execute sensitivity analysis, including: Risk Reduction Worth (\(RRW\)) [27], Birnbaum Importance Measure (\(BIM\)) [28], Bayesian Network [29], and Rate of Variation (\(RoV\)) [25] in probabilities. In this study, the \(RoV\) method was used to determine the most critical basic events, which can be calculated as follows:

$$ {\text{RoV}}\left( {X_{i} } \right) = \frac{{{\text{posterior}}\left( {X_{i} } \right) - {\text{prior}}\left( {X_{i} } \right)}}{{{\text{prior}}\left( {X_{i} } \right)}} $$
(8)

where \(prior({X}_{i})\) represents the prior probability of root node \({X}_{i}\) and \(posterior\left({X}_{i}\right)\) represents the posterior probability of root node \({X}_{i}\).

Case Study

A case study of accident scenarios triggered by lightning strike was carried out to illustrate the methodology. The layout of the tank farm of an existing oil terminal, which is located in Skikda city, Algeria, is shown in Fig. 8. There are eighteen atmospheric storage tanks with the same capacity of 51,200 m3, fourteen storing crude oil and four storing naphtha. Features and geometric parameters of all tanks are listed in Table 2. These storage tanks are designed in accordance with API standard 650 [15]. Each tank is equipped with a semi-fixed foam system and a halon rim-seal fire extinguishing system. Besides, there are ten manual foam monitors installed outside bund areas. It is worth mentioning that foam monitors were assumed to be effective only for some tanks (TK01–TK06) and (TK15–TK18) based on two factors: the distance between the tank and foam monitor, single bund area for each tank (Table 3).

Fig. 8
figure 8

Layout of the tank farm analyzed in the case study

Full size image
Table 2 Features of storage tanks considered in the case study
Full size table
Table 3 Failure probabilities of basic events
Full size table

Results and Discussion

FT and ET Results

As discussed before, the \(\mathrm{PFD}\) value of halon rim-seal fire extinguishing system and semi-fixed foam system is calculated using FT analysis, while for foam monitor, a conservative \(\mathrm{PFD}\) value was derived from literature database as reported in Table 4. Failure probabilities of basic events derived from several literature reliability databases [30,31,32,33] are listed in Table 3.

Table 4 Calculated probabilities of events and safety barriers used in event trees for the calculation of consequences probabilities
Full size table

The application of ET models presented in Figs. 2 and 3 to the case study allowed the calculation of the annual probabilities of final outcomes for the two cases considered as reported in Tables 5 and 6. Table 5 shows the results of final outcomes probabilities obtained for the first case (see Fig. 2) where the direct lightning impact is supposed to affect the tank shell. Table 6 shows the results of final outcomes probabilities obtained for second case (see Fig. 3) where the direct lightning impact is supposed to affect the tank roof. Lightning impact annual probability and direct damage probability of the floating roof and the tank shell were calculated applying the simplified equations presented in “Annual Probability Assessment of Lightning Impact on Storage Tanks” and “Probability of Direct Damage” sections, using a flash density at ground level equal to 4 y−1 km−2 [34] and a location factor equal to 0.5, and the results are reported in Table 4.

Table 5 Annual probabilities of final outcomes in the case that direct lightning impact is supposed to affect the tank shell
Full size table
Table 6 Annual probabilities of final outcomes in the case that direct lightning impact is supposed to affect the tank roof
Full size table

As shown in Tables 5 and 6, the annual probability values of consequences range between 10–7 and 10–2 for storage tanks where the role of foam monitor was considered (TK01–TK06; TK15–TK18), while for tanks where this safety barrier was considered irrelevant, these values range between 10–5 and 10–2. It must be mentioned that the same results are obtained for all tanks due to identical geometrical and technical features and the same fire safety barriers installed in all of them except for foam monitors. Storage tanks equipped with foam monitors have lower probability values for final outcomes that can be affected by this safety barrier. In the first case, the probabilities of pool fire and full surface fire are lower by two orders of magnitude than the probabilities of pool fire and full surface fire for tanks without foam monitors, while the same results are obtained for the remaining consequences in the two sets of tanks. In the second case, full surface fire has also two orders of magnitude lower values for tanks equipped with foam monitors, while the remaining consequences have the same results for the two sets of tanks. From these observations, we can determine the importance of considering the role of foam monitors and the integration of all relevant fire safety barriers in the framework of the analysis of accident scenarios triggered by lightning strike on atmospheric storage tanks.

According to the results of the first case (see Table 5), we can easily observe that rim-seal fire extinguishment has the highest annual probability value among all consequences. This may be explained by the high probability of presence of flammable vapors in the rim-seal area along with the high probability of ignition caused by lightning strike, and the fact that only halon rim-seal fire extinguishing system may mitigate or prevent rim-seal fire from escalation. On the contrary, full surface fire has the lowest annual probability value due to the additional fire safety barriers that may prevent or mitigate this consequence (semi-fixed foam system and foam monitor). Local pool fire extinguishment shows an intermediate probability value about two orders of magnitude lower than rim-seal fire extinguishment because of semi-fixed foam system that can intervene to prevent the escalation of local pool fire to the whole surface of the tank roof. The probability of pool fire extinguishment is slightly lower than the probability value of rim-seal fire extinguishment due to the lower direct damage probability of the tank shell. The probability of pool fire is about two orders of magnitude lower than pool fire extinguishment due to the action of foam monitor that may prevent the escalation of this pool fire in the bund area.

Concerning the results of the second case (see Table 6), the probability value of rim-seal fire extinguishment is slightly lower than the one of the first case since the probability of no direct damage of the tank roof is smaller than the one of the tank shells. The probability of local pool fire extinguishment and full surface fire are higher than those of the first case due to the existence of two possible event sequences that may lead to these consequences in this second case. Rim-seal fire extinguishment in the second case has also the highest probability value among all consequences, then local pool fire extinguishment is the second, and full surface fire is the lowest.

BN Results

Prediction Analysis

In order to overcome the limitations of ET and FT and to perform a sensitivity analysis, the fault trees of fire safety barriers and the ET related to the first case (see Fig. 2) were converted into an equivalent BN model (see Fig. 9) following the mapping algorithm presented in Fig. 7, and using GeNIe software [35]. For the sake of brevity, this model is constructed only for the first case where lightning strike is supposed to affect the tank shell.

Fig. 9
figure 9

BN model of accident scenarios triggered by lightning strike on atmospheric storage tanks

Full size image

The same failure probabilities of basic events (Xi) of fault trees listed in Table 3 and the intermediate events probabilities of the corresponding ET reported in Table 4 were used also in the BN model to calculate the top nodes probabilities and the annual probabilities of the consequence nodes. The results are shown in Table 7.

Table 7 Calculated probabilities of top and consequence nodes
Full size table

The results obtained from the predictive analysis using BN show that the values of top events probabilities and the annual probabilities of consequences are nearly the same as the results of ET and FT with slight differences for: TE1 (Halon rim-seal fire extinguishing system fails on demand), C5 (Local pool fire extinguishment), C6 (Full surface fire extinguishment), and C7 (Full surface fire). The results showed also that the consequence C4 (Rim-seal fire extinguishment) was the most probable consequence of accident scenarios caused by lightning strike (Fig. 10).

Fig. 10
figure 10

Rate of variation (RoV) of basic event probabilities

Full size image

Sensitivity Analysis

To identify the most critical basic events that contribute to the occurrence of consequences, a sensitivity analysis was performed using Rate of Variation (RoV) technique. Firstly, a diagnosis analysis was executed to update the BN model. For this purpose, the consequence C7 (full surface fire) was set as target node. The results obtained for posterior probabilities of basic events are reported in Table 8, and the probability changes of basic events show the difference between prior and posterior probabilities (see Fig. 11). Based on prior and posterior probabilities, RoV of basic events (Xi) is then calculated using Eq. 8, and the results are listed in Table 8. According to the diagram represented in Fig. 10, which shows the RoV of all basic events probabilities, four major sets were identified. The first one includes 7 most influential basic events with the highest RoV value (11.4), which are X5, X6, X7, X8, X9, X10, X11. The second set includes five basic events with RoV of 8.6 (X12, X16, X19, X20, X21). The third set includes 9 basic events that have an intermediate RoV value of 5.8 (X22, X23, X24, X25, X29, X30,X31, X32, X33). The final set includes all the remaining basic events that have low RoV values.

Table 8 Prior, posterior probabilities, and RoV values of basic events
Full size table
Fig. 11
figure 11

Difference between prior and posterior probabilities of basic events

Full size image

Based on the Tornado diagram given by GeNIe software, X12, X24, X6, X7, X9, X19, X33 were considered as the most critical basic events, as shown in Fig. 12. Besides these events, three other events are appeared (Pign, Pf, and SB) in this diagram. However, these events are not considered as critical since they are out of the scope of sensitivity analysis.

Fig. 12
figure 12

Tornado diagram of the most critical basic events

Full size image

To ameliorate the availability of fire safety barriers and to reduce the consequences probabilities of accident scenarios triggered by lightning strike, an amelioration of the failure probability of the most critical events was proposed. For this purpose, the failure probability of the 7 most critical basic events, obtained by RoV technique, was decreased by one order of magnitude (this amelioration may be realized practically by decreasing the test interval, modification of the maintenance strategy, etc.) and used for the calculation of the new probabilities of top events and the annual probabilities of consequences, as shown in Table 9.

Table 9 Calculated probabilities of top events and annual probabilities of consequences after the amelioration of critical basic events
Full size table

The failure probability on demand of halon rim-seal extinguishing system (TE1) is decreased from 8.27E-3 to 9.56E-4 with a considerable percentage reduction of 88% after the amelioration, while the probability of failure on demand of semi-fixed foam system still the same because all the ameliorated basic elements are related to TE1. The probabilities of consequences affected by fire safety barriers (C4, C5, C6, C7) are also decreased after the amelioration. On the contrary, the probabilities of consequences not affected by fire safety barriers are the same as before the amelioration. These results reflect the importance of the improvement of fire safety barriers performance in reducing the annual probability of accident scenarios, which can meet high safety requirements.

Conclusion

The present study has introduced a methodology for the integration of the role of fire safety barriers in the probabilistic analysis of accident scenarios triggered by lightning strike on atmospheric storage tanks. Firstly, a statistical survey of past similar accidents was performed. Then, based on the type of atmospheric storage tanks, different event tree (ET) models of lightning-triggered accidents were constructed taking into account all relevant fire safety barriers. Fault tree (FT) method was used for the quantitative assessment of the expected availability of fire safety barriers considered in the case study. Hence, the probabilities of other intermediate events needed for the quantification of event trees were calculated using specific models. Finally, the ET related to external floating roof tanks and fault trees of fire safety barriers were mapped into an equivalent Bayesian network model to perform a sensitivity analysis for identifying the most critical fire safety barrier and basic elements that contribute to the occurrence of dangerous accident consequences. Then, a recalculation of consequence probabilities of accidents scenarios triggered by lightning was executed considering a proposed amelioration in the availability of the identified critical basic elements. The results obtained in this study proved the importance of considering all relevant fire safety barriers and the influence of their amelioration in the probabilistic analysis of risk caused by accident scenarios triggered by lightning strike.