Ignition Probability, the Number With the Widest Range

A flammable release either finds an ignition source or it does not. Everything downstream in a quantitative risk assessment hangs off that branch, and the number attached to it is the least defended in most studies.

Leak frequency at least has published databases behind it, with editions and populations you can argue about. Ignition probability has correlations built on sparse data, and reasonable engineers using different published models will differ by a factor of several on the same release.

P_{i g n} = P_{imm} + (1 - P_{imm}) P_{d e l}

$P_{imm}$: probability of immediate ignition at the point of release
$P_{d e l}$: probability of delayed ignition once a cloud has formed and drifted
$P_{i g n}$: total probability the release ignites at all

The split matters as much as the total. Immediate ignition gives a jet fire at the source. Delayed ignition gives a cloud that has already travelled, and a much larger footprint.

Two ignitions, two entirely different events

Treating ignition as a single probability hides the part that decides the consequence. Immediate ignition produces a jet fire or pool fire at the release point. It hurts people close by, it can escalate to neighbouring equipment, and its footprint is bounded and calculable.

Delayed ignition is the one that reaches the fence. The cloud has time to grow, drift and find congestion, and what happens when it lights depends entirely on what it has drifted into. The same mass of gas gives a flash fire in open ground and a damaging blast inside a pipe rack.

Immediate ignition, jet or pool fire. Local, escalating, bounded footprint.
Delayed ignition in open unobstructed ground, flash fire. Fatal inside the cloud, little overpressure.
Delayed ignition in congestion, vapour cloud explosion. Overpressure damage well beyond the cloud itself.
No ignition, the release disperses. Which is the outcome for most releases, and the reason ignition probability is well below one.

Caution

A study that reports a single ignition probability without splitting immediate from delayed has already lost the ability to distinguish a jet fire from a blast. Those two outcomes have different victims, different distances and different mitigation, so collapsing them makes the result unusable for decisions about layout and occupied buildings.

Where the numbers come from

The common correlations relate ignition probability to release rate, on the reasonable logic that a bigger release both reaches more potential sources and presents more mass to each. Several published models exist and they are built on different incident populations.

The Cox, Lees and Ang correlations, long standing and widely embedded in software defaults, relating ignition probability to release rate for gas and for liquid.
The UKOOA ignition probability model, developed for offshore installations, which builds up from a source count and the layout rather than from release rate alone.
The IOGP risk assessment data directory ignition probability report, which pools operator data.
Energy Institute reviews of ignition probability, which are useful precisely because they compare the models rather than adding another one.

These do not agree. A model derived from offshore modules, where equipment density and source count are high, does not describe an onshore tank farm with long open sight lines. Applying an offshore correlation to a bunded storage area is a modelling choice, and it needs to be stated as one.

Assumption

Every ignition correlation carries an implied source population. It assumes a certain density of electrical equipment, hot surfaces, vehicles, flares and human activity. If your facility is materially more or less congested with ignition sources than the population behind the model, the correlation is being applied outside the data it was built on.

Congestion, which decides the consequence

Once a cloud ignites, the question is whether the flame accelerates. Flame acceleration needs obstacles. A flame front moving through repeated rows of pipework, structure and vessels is turbulised, speeds up, and generates overpressure. The same flame in genuinely open ground burns through the cloud without producing much of a blast at all.

f_{V CE} = f_{re l e a se}; P_{d e l}; P_{co n g}

$f_{re l e a se}$: frequency of the release case, per year
$P_{d e l}$: probability of delayed ignition given the release
$P_{co n g}$: probability the cloud reaches a congested region before ignition

Three multiplied probabilities, each carrying its own uncertainty. This is why explosion risk results move so much between studies of the same plant.

The congestion assessment is where studies age fastest. A plot plan carrying fifteen years of additional pipework, temporary structures, laydown and scaffold is not the plot plan the original study assessed, and congestion only ever increases. A study whose explosion overpressures were calculated against the as designed layout is describing a facility that no longer exists.

The ignition source nobody identified

On 1 June 1974 a temporary bypass assembly at the Nypro works at Flixborough in Lincolnshire failed, releasing a large quantity of hot cyclohexane. A vapour cloud formed and spread across the site. When it ignited the explosion destroyed the works, killed twenty eight people and injured many more.

The inquiry examined the plant in detail. It could not conclusively identify what ignited the cloud. Several candidates were considered and none was established beyond doubt.

That is the point worth carrying into a risk assessment. In a facility of that size a flammable cloud of that scale will find something. Which specific source did the igniting is almost incidental, and a safety case built on the claim that ignition sources are controlled is claiming something no operator can fully verify. Flixborough is also why the modern major hazards regime exists, since it prompted the work that led to the UK control of major accident hazards framework.

Event tree from a flammable release, branching through immediate ignition to a jet fire, delayed ignition into congestion giving a vapour cloud explosion, delayed ignition in open ground giving a flash fire, and no ignition giving safe dispersal, with the branch probabilities marked as the uncertain terms — Every branch carries a probability with a wide defensible range. The outcomes at the ends are not variations of one event, they are different events with different footprints.

Defending the value you used

The aim is not certainty, which is not available. It is a value a reviewer can follow and disagree with specifically rather than generally.

Name the correlation and the edition, and say why it suits this facility rather than the alternatives.
Split immediate from delayed rather than reporting a single lumped figure.
Assess congestion against the plot plan as it stands today, including temporary structures, not the design drawing.
Run the result across the range the published models actually span, not just the base case.
Where the decision flips inside that range, say so plainly. That is the finding, not an inconvenience.

Reference

Cox, Lees and Ang, Classification of hazardous locations, for the release rate correlations. UKOOA ignition probability review for the offshore source based approach. IOGP risk assessment data directory, ignition probabilities report. Energy Institute research reports reviewing ignition probability models. CCPS Guidelines for Vapor Cloud Explosion, Pressure Vessel Burst, BLEVE and Flash Fire Hazards for the consequence side. The Flixborough disaster, report of the court of inquiry, 1975.

Three questions worth asking today

Does our study report immediate and delayed ignition separately, or one lumped number?
Which correlation was used, and was it built on a facility type resembling ours?
When was the congestion assessment last checked against the plant as it actually stands?

The third question is the one that quietly invalidates studies. Congestion only ever grows. If nobody has revisited it since the plant was built, the explosion results in your safety case describe a facility that was demolished by its own modifications years ago.

Related services

All insights Talk to a specialist