ARTICLE IN PRESS

Dust explosions—Risk assessment

Russell A. Ogle*, Brenton L. Cox
Exponent, Inc., Warrenville, IL, United States
*Corresponding author: e-mail address: rogle@exponent.com

Contents
1. Why perform a risk assessment? 1
2. Consequence assessment 4
3. Likelihood assessment 12
3.1 Definition of likelihood (and probability) 12
3.2 Quantitative estimates of likelihood 15
4. Risk assessment 16
5. Risk management 22
6. Summary 25
References 25

1. Why perform a risk assessment?

The purpose of performing a risk assessment is to provide evidence-based
information and analysis to make informed decisions on how to treat particular
risks and how to select between options.
American National Standards Institute (2011a, p. 11)

All facilities that store, handle, or process combustible dusts are potentially
subject to combustible dust explosion hazards, which may result in some man-
ner of harm to its owners, employees, or the general public. These hazards
have been discussed at length in previous chapters. As a result of these hazards,
various standards have been published with the intent to control, mitigate, or
eliminate their negative consequences.a Several of these standards apply to a
particular family of commodities and/or processes, on the basis that they share
a similar hazard profile (e.g., NFPA 61 for agricultural dusts, NFPA 484 for
a
For non-governmental standards, see the National Fire Protection Association (NFPA) 652: Standard
on the Fundamentals of Combustible Dust, and NFPA’s various commodity standards, NFPA 61,
NFPA 484, NFPA 654, and NFPA 664. For governmental standards, see the United States’ grain
handling standard, 29 CFR 1910.262.

Methods in Chemical Process Safety # 2019 Elsevier Inc. 1

ISSN 2468-6514 All rights reserved.
https://doi.org/10.1016/bs.mcps.2019.03.002
 ARTICLE IN PRESS

2 Russell A. Ogle and Brenton L. Cox

metal dusts, or NFPA 664 for wood processing and woodworking facilities).
These standards are predominated by prescriptive requirements aimed at
mitigation and/or elimination of specific, known hazardous consequences
associated with that hazard profile. A common requirement, particularly in
more recent standards, includes performing a dust hazard analysis (DHA), as
discussed in a previous chapter. However, compliance with standards can
typically be achieved by implementing the required safety improvements
once a DHA has established the extent of the explosion hazard. Why, then,
would the same entity need to perform a dust explosion risk assessment?
The most general answer to that question is that a dust explosion risk assess-
ment is appropriate when an organization wishes to make an evidence-based
decision between various risk reduction options (American National
Standards Institute, 2011a, p. 11). Achieving compliance with applicable
standards does not eliminate the risk associated with dust explosions, and
it may not even minimize the risk. As a result, a variety of circumstances
may arise in which an organization must make a choice between two or
more risk management strategies. A risk assessment places various outcomes
on a common scale to facilitate this decision-making. However, prior to
discussing specific examples, it is useful to distinguish the following related
vocabulary: hazard, consequence, likelihood, and risk (American National
Standards Institute, 2011b).
• A hazard is a source of potential harm. Combustible dusts may present
fire and explosion hazards as they have the potential to participate in fires
and explosions.
• A consequence, in the context of these hazards, typically refers to a negative
(or hazardous) outcome associated with a dust fire or explosion. These
consequences may be financial, environmental, or health and safety
related.
• The likelihood of a consequence is an estimate of the frequency or
probability that the consequence occurs. Likelihood may be expressed
qualitatively or quantitatively.
• The concept of risk combines the consequences associated with a hazard
and the relative likelihood of those consequences becoming manifest.
Thus, in order to understand the risk of an activity, it is necessary to under-
stand the hazards, the potential consequences associated with those hazards,
and how often those consequential outcomes may occur. Once established,
a well-performed risk assessment facilitates the ranking of risk priorities, a
comparison of risk reduction options, and informs a variety of other risk
management decisions.
 ARTICLE IN PRESS

Dust explosions—Risk assessment 3

For example, an organization may want to consider a performance-based

approach to hazard control, rather than implementing the prescriptive
requirements dictated in a standard. This may be considered because a par-
ticular prescribed solution has been determined to be infeasible or imprac-
tical, or the organization may believe it has devised a better approach
(National Fire Protection Association, 2019, Section A.4.2.4). In these cases,
a risk assessment may be a requirement for compliance if a method other
than the prescribed approach is ultimately adopted. For example, the choice
of a performance-based approach may require accompanying documenta-
tion in need of approval by the authority having jurisdiction over the facility.
As part of a performance-based approach, a facility may establish its perfor-
mance criteria through a risk assessment considering the impact of the
performance-based design in fire and explosion scenarios, and its impact
on other prescribed design features (National Fire Protection Association,
2019, Section 6.2).
Another reason to perform a risk assessment related to combustible dust
hazards is when considering loss prevention strategies that exceed compli-
ance with applicable requirements. Each organization that handles combus-
tible dust has an explicit or implicit level of risk tolerance by performing
activities where combustible dust hazards exist. A consistently applied risk
assessment can help an organization better understand this risk across its facil-
ity or facilities, and determine areas where investment will yield the greatest
reduction to the overall safety-related risk associated with operation. By
considering the addition of an engineering or administrative safeguard, a risk
assessment allows a facility to establish a business case for safety-related
investments in a manner consistent with other financial decisions. All orga-
nizations are balancing the investment of time and resources with each oper-
ational decision, and a risk assessment establishes a hierarchy through which
investments can be prioritized to achieve the greatest level of risk reduction.
Many business decisions related to these investment decisions are made on
the basis that a certain capital investment will improve yield or otherwise
increase the bottom line of the business. A risk assessment elucidates the
potential (or avoidance thereof ) losses associated with dust hazards in a
similar manner.
The risk assessment process and its outputs may vary widely depending
on the scope and objectives of the study. Three factors tend to drive the
success of a combustible dust risk assessment:
• Scope: defining the scope of the study of the risk assessment by esta-
blishing the boundaries that will not be crossed,
 ARTICLE IN PRESS

4 Russell A. Ogle and Brenton L. Cox

• Data quality: selecting a risk assessment methodology consistent with the

quality of the information available to the risk assessment team, and
• Consistency: maintaining consistency in the interpretation of conse-
quence severity, likelihood, and risk level determination.
Defining the scope of the study is the process of identifying the portions of
the building and manufacturing processes that will be included in the risk
assessment. Failure to define the boundaries of the study can lead to wasted
time and effort.
The quality of the data is the second important consideration. Risk
assessment is often conceived as an exercise in probability mathematics. This
exercise is useful if it is based on an accurate development of the probabilistic
event structure (such as event trees), and if the likelihood of these events can
be reasonably estimated. Estimates of likelihood may be derived from failure
statistics databases if those statistics are both comprehensive and reliable. In
this context, reliability is evaluated in terms of accuracy, precision, and sim-
ilarity of the operating environment. Such data are available for many elec-
tronics devices and in the flow component devices found in nuclear power
plants. However, reliable failure statistics are not available in every industry.
This seems to be particularly so in industries that transport, handle, trans-
form, and store particulate solids. It is important to realize the strengths
and limitations of the consequence severity and likelihood estimates. These
concepts are elaborated on in subsequent sections.
However, perhaps the most important aspect of the application of a risk
assessment to make risk-based decisions is consistency. The ultimate user of
any risk study must ensure that the alternatives being compared have been
assessed in a consistent manner in terms of consequence severity, likelihood,
and risk level. Subsequent sections provide a detailed review of the two main
phases of any risk assessment activity: consequence assessment and likelihood
assessment. The final sections are focused on strategies for implementation.

2. Consequence assessment
Consequence assessment involves the definition of the hazard sce-
nario, the identification of the injury-causing agents, and the specification
of the levels of consequence magnitude. With combustible dust, the haz-
ards arise from combustion. The hazardous effects include thermal, chem-
ical, and mechanical hazards. The thermal effects of concern are flame
contact, hot gases, and thermal radiation. The chemical hazards are the
toxic gases generated by incomplete combustion. The mechanical hazards
are the hydrostatic overpressure associated with a deflagration, shock wave
 ARTICLE IN PRESS

Dust explosions—Risk assessment 5

formation and interactions that can magnify the deflagration overpressure,

missile projection from bursting equipment and vessels, and building collapse.
The specific hazards presented and their severity depend on the particular
combustible dust hazard scenario under consideration. In this section, we will
consider four hazard scenarios: smoldering, flash fire, deflagration, and flame
acceleration. These hazard scenarios and their hazardous effects are summa-
rized in Table 1. Unless stated otherwise, the following observations assume
that the combustible dust is an organic material.
The description of hazards for each hazard scenario reflects typical situ-
ations as determined from accident investigation reports, accident statistics,
and anecdotal experiences. The reader is cautioned to always be vigilant for
the possible exception to the rule.
The severity of any given hazard scenario depends on a number of dif-
ferent factors including, but not limited to, the properties of the combustible
dust, the size and shape of the confining equipment or structure, the nature
of the ignition event, and, for dispersed clouds, the nature of the turbulence
of the dust environment. For a particular hazard scenario, one could observe
a wide variation in hazard severity caused by variations in these physical fac-
tors. Hence, the risk analyst may have to resort to models of combustion
behavior that presume a more severe, rather than less severe, event. The
consequence analysis should be tempered by practical knowledge about
the processing technology and other relevant technical knowledge and
experience so that the end result reflects a reasonable attempt to define a typ-
ical hazard level and a worst credible hazard level. The worst credible hazard
level is intended to reflect a higher level of hazard than is actually achievable
in an accident situation with a single event failure. The risk analyst must

Table 1 Combustible dust hazard scenarios and hazard effects.

Hazard
scenario Thermal hazards Chemical hazards Mechanical hazards
Smoldering Glowing embers Carbon monoxide, Negligible
smoke
Flash fire Flames, hot gases, Negligible Negligible
thermal radiation
Deflagration Flames, hot gases, Usually negligible Overpressure, missiles,
thermal radiation structural collapse
Flame Flames, hot gases, Usually negligible Overpressure, shock wave
acceleration thermal radiation formation and interactions,
missiles, structural collapse
 ARTICLE IN PRESS

6 Russell A. Ogle and Brenton L. Cox

guard against specifying a worst-case scenario unless absolutely necessary.

Worst-case scenarios generally consider the occurrence of multiple indepen-
dent failure events, and may not represent a credible scenario. In fact, the
worst-case scenario conceivable is often extremely improbable. Worst-case
scenarios—hazard scenarios based on what is conceivable—can lead to
excessively burdensome risk management decisions.
Evaluating the severity of combustible dust consequences can be per-
formed by testing or by calculation. Testing is usually targeted at determin-
ing performance properties of combustible dust clouds or layers that will
indicate either the ease of ignition or the characteristics of the dust that will
influence the design of safeguards. See chapter “Experimental methods” by
Dastidar of this book discusses these experimental methods.
The calculation of hazards is grounded in combustion science (Eckhoff,
2003; Ogle, 2017). The calculations can be performed with simple combus-
tion models or, for more complex situations, with computational fluid
dynamics (CFD). CFD methods are especially well suited for understanding
deflagration development and propagation inside equipment or through
complex structures. A more detailed discussion of CFD can be found else-
where (Ogle, 2017, Chapter 10).
The first hazard scenario considered is smoldering. Smoldering is non-
flaming combustion. Smoldering propagates through unburnt material as
a combustion wave called a smolder wave. It tends to form glowing embers
and generates large quantities of carbon monoxide and smoke both of which
are explosive. Smoldering may appear to be a deceptively low risk scenario
because it is not typically associated with dramatic fire and explosion effects.
However, a smoldering fire can unexpectedly transition into a flaming fire or
explosion (Ogle, 2017, Chapter 5). Furthermore, the toxic effects of carbon
monoxide, which is odorless and colorless, begin to manifest at much lower
concentrations than its lower flammability limit (Carbon monoxide, 2018).
It is difficult to estimate the hazard level of a smoldering dust fire. The
hazard level depends primarily on the size of the dust deposit in which the
smoldering occurs and on the size of the enclosure in which the deposit is
located. A further difficulty is that there are very little data on smoke yields
for combustible dust.b However, a few generalizations can be stated. Some

b
Smoke yield is a quantitative measurement of the mass of smoke and its chemical composition resulting
from the incomplete combustion of fuel. See, for example, Gottuck, D.T. and Lattimer, B.Y. Chapter 16
Effect of Combustion Conditions on Species Production in Hurley, Morgan J., Daniel T. Gottuk, John
R. Hall Jr., Kazunori Harada, Erica D. Kuligowski, Milosh Puchovsky, John M. Watts Jr., and
Christopher J. Wieczorek, eds. SFPE Handbook of Fire Protection Engineering. Springer, 2015.
 ARTICLE IN PRESS

Dust explosions—Risk assessment 7

smoldering fires in industrial settings have been known to persist for weeks.
In those circumstances, only a small volume fraction of burning combustible
dust occupying an enclosure is required to create a potentially toxic environ-
ment. Larger volumes are required to achieve an explosive atmosphere.
Once smoldering begins in a dust deposit, it tends to expand in the form
of a smolder wave. Smolder waves are often idealized as spherically expan-
ding combustion waves. However, the propagation of a real smolder wave is
definitely non-spherical. Real smolder waves tend to weave their way
through the combustible dust deposit by progressing through localized
channels of greater gas permeability. Finally, smolder waves can transition
into flaming fires. This transition can present additional hazard effects such
as thermal effects or, if the enclosure atmosphere is flammable, mechanical
effects. The magnitude of uncertainty presented by the smoldering hazard
scenario severely limits the ability to estimate consequences.
The second hazard scenario to consider is the flash fire. A combustible
dust flash fire occurs when a flame sweeps through a cloud of dust dispersed
in air. Unlike smoldering, a flash fire is an extremely fast event. The injury
potential of a flash fire depends on the duration of the thermal radiation
exposure and the radiant heat flux.
The consequence assessment for a combustible dust flash fire begins with
a dust cloud that is ignited at its center with the flame propagating spherically
outward. However, dust clouds are rarely dispersed as spherical clouds, and
they can be ignited off-center or even at the edge. The spherical propagation
of the flame is a useful reference case, but the risk analyst must be on guard
for possible departures from that behavior.
Three basic features of the dust cloud help to define the hazard severity
of a flash fire: the dust cloud size, the duration of the combustion event,
and the thermal radiation output. For the purposes of consequence anal-
ysis, the dust cloud size can be estimated if one defines the mass of com-
bustible dust involved in the event and calculates the stoichiometric
concentration of the dust in air. The mass of dust is determined by con-
sidering the operational factors in that particular room. For example, a pre-
scribed level of housekeeping, defined by an action level for fugitive dust
cleanup, can help determine the mass of dust involved. Other methods for
determining the threshold quantity of accumulated fugitive dust can be
found in various safety standards such as NFPA 654 (National Fire
Protection Association, 2017).
Once the mass of dust has been determined, the next step is to specify the
dust concentration within the cloud. The stoichiometric concentration is
 ARTICLE IN PRESS

8 Russell A. Ogle and Brenton L. Cox

recommended because it is a property of the material: it has a fundamental

meaning, is uniquely defined, and is independent of a test method. The stoi-
chiometric concentration is defined as the concentration of fuel that is
exactly required to consume all of the oxygen present in the cloud assuming
ideal combustion. To calculate the stoichiometric dust concentration, one
must know the chemical composition of the dust expressed as the empirical
formula and the molar mass of the dust. For an organic dust composed of
carbon, hydrogen, and oxygen, the combustion stoichiometry equation
can be written thus:

y z
Cx Hy Oz + x +
ðO2 + 3:76N2 Þ
y
4 2
y z
! xCO2 + H2 O + 3:76 x +
N2 (1)
2 4 2
This gives a simple result for calculating the stoichiometric dust con-
centration in g/m3 for any organic fuel of the form CxHyOz with a molar
mass Md expressed in g/mol:
8:59 Md
ρd, st ¼
y z (2)
x+

4 2
The derivation of this relationship and a similar relation for metal com-
bustion can be found in the literature (Ogle, 2017, Chapter 3).
Knowing the mass of dust involved in the flash fire and its stoichiometric
concentration, one can calculate the volume and then the radius of a spher-
ical dust cloud. Assuming an order of magnitude estimate of the burning
velocity of the dust flame as 1 m/s, one can estimate the duration of the flash
fire event by taking the radius of the cloud and dividing by the burning
velocity. For more detail, see Ogle (2017, Chapters 3 and 7). This represents
the duration of the thermal exposure.
Although there are empirical data on the radiant heat flux from combus-
tible dust flash fires, it has not been compiled into a quantitative correlation
(Ogle, 2017, Chapter 7). Correlations do exist for the radiant heat flux from
flammable vapor flash fires, but these are based on much larger quantities of
fuel than are typically encountered in a combustible dust deflagration
(Center for Chemical Process Safety, 1994; Van den Bosch & Weterings,
2005). As flash fires become larger, buoyancy effects become more signifi-
cant and may not be appropriate for smaller scale events. Instead, it is rec-
ommended that the risk analyst use the black body emissive power for
thermal radiation and a view factor analysis to determine potential radiant
 ARTICLE IN PRESS

Dust explosions—Risk assessment 9

heat flux magnitudes on the target surface. The black body emissive power is
given by the following expression:

qb ¼ σTf4 (3)

The quantity qb is the black body emissive power, Tf is the fireball tem-
perature expressed in Kelvin, and σ is the Stefan-Boltzmann constant which
has a value of 5.67  10
8 W/m2 K4.
The severity of human burn injury is determined by observation of the
type of burn received. Severity is ranked by medical diagnosis and classi-
fied in increasing order of severity as first-degree, second-degree, and
third-degree burns. A first-degree burn is analogous to sunburn. It is char-
acterized by reddening of the skin and some pain, but without blisters or
permanent damage. A second-degree burn is characterized by severe red-
dening of the skin, with blisters formed in the outer layers. A third-degree
burn is characterized by destruction of all skin layers and permanent
damage (Prugh, 1994).
The propensity for human burn injury is correlated with the dosage of
radiant heat flux for a specified period of time. As a reference point, sunlight
imposes a radiant heat flux of roughly 1 kW/m2. An example of human burn
injury criteria are summarized in Table 2 adapted from Prugh (1994).
The probability of surviving exposure to thermal radiation is related to
the extent of third-degree burns and age of the individual. Hence, these
guidelines are a reasonable first approximation, but they are merely guide-
lines and should not be considered as absolute values. The mechanism
of human burn injury is very complex and has been the subject of numer-
ous studies. For a review of the recent literature, see Wieczorek and
Dembsey (2015).

Table 2 Human burn injury due to thermal radiation exposure.

Radiant heat
flux (kW/m2) Duration (s) Dosage (J/m2) Consequence
3.7 45 170 Pain threshold
9 45 430 Second-degree burn
18 45 850 50% fatality (assumes third-degree
burn over 50% of skin surface)
40 45 1800 99% fatality (assumes third-degree
burn over 90% of skin surface)
 ARTICLE IN PRESS

10 Russell A. Ogle and Brenton L. Cox

The third hazard scenario to consider is the confined dust deflagration.

The difference between a combustible dust flash fire and a dust deflagration
is confinement such that the combustion process generates an overpressure
sufficient to cause blast damage. A simple way to draw this distinction is to
consider the overpressure generated in an enclosure as a function of the size
of the dust cloud. The fractional fill of an enclosure αfill is defined as the ratio
of the dust cloud volume to the enclosure volume. The fractional fill is
equated with a ratio of pressures: the de minimis overpressure divided by
the maximum overpressure of a dust deflagration (i.e., Pex, the overpressure
generated by a dust deflagration where the dust cloud volume equals the
enclosure volume). The de minimis overpressure is taken as 0.03 bar g
(Center for Chemical Process Safety, 1996). The flash fire criterion is then
given by the following equation:

0:03
αfill ðflash fireÞ  (4)
ðPex
1:013Þ

The derivation of this relationship can be found in the literature (Ogle,

2017, Chapter 3).
The hazardous effects of a dust deflagration are overpressure, missiles,
and structural collapse. The following damage criteria come from a reference
for evaluating the consequences of external blast, but they are relevant to
internal blast effects as well (Center for Chemical Process Safety, 1996).
The damage criteria are based on the premise that the greatest hazard to per-
sonnel is posed by the failure of the structure, which leads to the projection
of missiles and falling debris. The analysis of the structural dynamics and asso-
ciated damage that occurs due to an explosion is a very complex undertak-
ing. These structural damage criteria represent a first approximation and are
not absolute values; they are guidelines for predicting the consequences of a
very complex phenomenon and should be applied cautiously.
• Minor damage (△P > 0.03 bar g): Significant cosmetic damage to structure.
Building repair is possible. Possible minor personnel injury due to glass
breakage or scabbing.
• Moderate damage (△P > 0.07 bar g): Possible deformation of structural
members, short of failure. Building may be reusable without repair. Pos-
sibly some debris formed. Personnel injury from debris is likely.
• Major damage (△P > 0.14 bar g): Possible failure of isolated structural
members. Partial building collapse. Building cannot be reused and must
be replaced. Possible serious injury or fatality of some building occupants.
 ARTICLE IN PRESS

Dust explosions—Risk assessment 11

• Catastrophic damage (△P > 0.21 bar g): Complete collapse of structure.
Probable serious injury or fatality of all occupants.
The constant volume overpressure of a dust deflagration is a function of the
dust chemical composition, the particle size distribution, the dust concentra-
tion, the turbulence level, and ignition source characteristics. Typical labora-
tory measurements of constant volume dust deflagrations yield overpressures
in the range of 5–10 bar g (Ogle, 2017, Chapter 8). These overpressures are
10–300 times greater than the structural damage criteria presented above.
Clearly, containment of the explosion pressure is typically not possible in
building structures.
The final hazard scenario to consider is flame acceleration. Flame accel-
eration effects tend to magnify the dust explosion hazard. Example scenarios
involving flame acceleration effects are secondary explosions, confined dust
deflagrations, and pressure piling. In each case, the deflagration wave gen-
erates a shock wave that promotes the extension of the explosion far beyond
its origin. Flame acceleration often causes multiple equipment or structural
failures called domino effects. These domino effects can greatly magnify the
consequence severity of the dust explosion.
Secondary explosions occur when there is a significant accumulation of
combustible dust throughout a room. In the event that a primary dust def-
lagration vents into the room, the shock wave generated can loft and suspend
the fugitive dust into the air. The flame, which travels at a much slower
speed than the shock wave, then propagates through the suspended dust
cloud. The end result is that the secondary explosion exhibits a much greater
level of damage than would have occurred if only the primary explosion had
occurred.
In a confined dust deflagration, the deflagration propagates through a
conduit. The conduit prevents expansion of the high pressure, high temper-
ature combustion products and constrains the expansion to one dimension.
This channeling of the explosion energy results in an acceleration of the
flame with the formation and strengthening of a shock wave. The incidence
and reflection of the shock wave at an elbow or tee can increase the imposed
overpressure by a factor of 2–8. If the deflagration breaches the conduit and
vents into the surroundings, an expansion wave can form and travel in the
reverse direction of the conduit. Expansion waves often cause collapse of
conduits due to the sub-atmospheric pressures that they can generate.
Pressure piling occurs when the deflagration travels from one vessel or
enclosure to another. The shock wave formed from the initial explosion
causes a pre-pressurization of the target enclosure and suspends any fugitive
 ARTICLE IN PRESS

12 Russell A. Ogle and Brenton L. Cox

dust in its path. When the flame pursues the suspended dust, the explosion
pressure in the second enclosure is increased by the pre-pressurization effect.
Properly designed deflagration protection measures in the second enclosure
can be overwhelmed by the pressure piling effect.
The common element that runs through these various scenarios is the
formation of a shock wave caused by the propagating dust deflagration.
The overpressure generated by the shock wave can be calculated as a func-
tion of the flame speed using the following simple linear relation:
P2
P1 ¼ ρ1 c1 ðv2
v1 Þ or ΔP ¼ ρ1 c1 Δv (5)
This equation indicates that the overpressure of the shock wave equals
the flame speed, Δv, times the unburnt density of the air, ρ1, and the sound
speed, c1. At typical ambient conditions of 1 atm. and 300 K, the overpressure
generated by a dust flame with a flame speed of 50 m/s is approximately
0.2 bar g, a pressure level equal to the catastrophic damage criterion. The risk
analyst should bear in mind that this linear relation is an approximation for
flame speeds <400 m/s.

3. Likelihood assessment
Likelihood assessment is the process of estimating the likelihood of a
particular outcome. In spoken English, the word likelihood is interchange-
able with the word probability (Merriam-Webster, 2018). In the context
of risk assessment, this definition is still accurate, but likelihood may or
may not be imbued with the same level of mathematical rigor as the term
probability connotes. Thus, there is sometimes a distinction between the
use of the word likelihood and the word probability, in that the likelihood
may not be mathematically-derived (American National Standards
Institute, 2011b). As defined by the CCPS (2017, p. 73), “the likelihood
of an event is a measure of the expected probability or frequency with
which an event occurs.” In other words, likelihood is an estimate of prob-
ability. Except when otherwise clarified, in this chapter, this definition
of likelihood is adopted. First, though, a more detailed discussion of this
distinction is provided.

3.1 Definition of likelihood (and probability)

A useful discussion of the various approaches to likelihood estimation
appeared in a recent study about uncertainty by Crump (2017), where
 ARTICLE IN PRESS

Dust explosions—Risk assessment 13

the author set forth three categories of likelihood (note, the reference used
the term probability in the broad sense in which this chapter and many other
references use the word likelihood). These three categories are theoretical
(or classical), empirical (or relative), and subjective. The categories are well
illustrated by considering the rolling of two dice.
The theoretical likelihood is the classical probability. The probability of
rolling a seven is the sum of the outcomes that result in a seven divided by the
sum of all possible outcomes. There are six outcomes of a two-dice roll that
result in an outcome totaling seven: 1-6, 2-5, 3-4, 4-3, 5-2, 6-1. There are
36 total outcomes. Therefore, the probability is 6/36 or 1/6 (or 0.167) of
rolling a seven. In equation form:

sum ðoutcomes where n ¼ 7Þ 6 1

Pn¼7 ¼ ¼ ¼ (6)
sum ðall potential outcomesÞ 36 6

When accurately computed and applied, these results are universal and
free of bias. However, it is not generally practical (or even possible) to estab-
lish the theoretical likelihood of an outcome associated with combustible
dusts fires and explosions. Thus, likelihood must be estimated through
empirical and/or subjective means, and it is important to understand their
relative strengths and weaknesses.
Empirical likelihood is based on data. The formulation of empirical like-
lihood is similar in appearance to the theoretical probability, but there is an
important distinction. To continue the example, consider a scenario where a
pair of dice is rolled daily, and its outcome is recorded. The empirical like-
lihood is calculated by dividing the total number of recorded sevens by the
total number of dice rolls performed. In equation form:

emp number of days where a seven was rolled

Ln¼7 ¼ (7)
total number of days dice were rolled

After many trials, the empirically derived likelihood will approach the
theoretical likelihood (or the probability). If the dice are rolled once a
day, 5 days a week, for 40 years, it is reasonable to believe the total number
of sevens will be close to one sixth, or about 1733 of the 10,400 tests. How-
ever, if few trials have been run, or if the theoretical probability of the out-
come of interest is low, then the empirically derived likelihood may vary
widely from the true theoretical probability.
Analogs to these empirical tests in the realm of combustible dust are his-
torical process failure data, incident/near miss investigations, and equipment
 ARTICLE IN PRESS

14 Russell A. Ogle and Brenton L. Cox

failure rate information. These data sources can be used to compile the
empirical likelihood of certain events occurring over the number of years
of operation. For example, for a large organization that performs many
iterations of the same activity, it may be possible to estimate the frequency
of an initiating event from historical information. However, even though
this category of likelihood is, at least by some measures, objectively obtained,
it is far from guaranteeing a number close to the true theoretical probability,
particularly for low probability outcomes, rarely performed activities, or
new processes. Abuswer, Amyotte, Khan, and Morrison (2013) suggest
that at least 10 years of operation is required to obtain a reliable likelihood
assessment, but this number may need to be even larger to accurately cap-
ture lower probability occurrences. In addition to small sample sizes, his-
torical data may be subject to biases, such as under-reporting of incidents
and/or near-misses, incorrect attribution of causes, or gaps in the historical
record. As a result, this methodology may result in an underestimation of
incidents and a false sense of resiliency (Center for Chemical Process
Safety, 2017, p. 74).
Subjective likelihood relies on the judgment, experience, and intuition
of the participants in the risk assessment. The team may also rely on anec-
dotal resources such as the memory and tenure of senior operators and other
employees. This approach typically results in qualitative statements of like-
lihood, such as “expected to happen once in the life of the facility” or order
of magnitude estimates (e.g., 10
2 year
1). This category is the simplest
to understand, but not necessarily the simplest to properly execute, as it is
also the most susceptible to bias. However, the team may rely upon outside
references to calibrate their judgment and defend against the over or under-
prediction of risk. For example, guidance for subjective estimation of like-
lihood is provided in the Center for Chemical Process Safety Guidelines for
Combustible Dust Hazard Assessment, and of particular utility is the qualitative
and semi-quantitative data provided in its Appendix C (2017).
Hybrid or intermediate methods for estimation of likelihood also exist.
Consider the common case mentioned above, where a consequence of
interest has not taken place in the life of the facility, but is nonetheless both
physically possible and credible. For guidance in this scenario, see a study
by Freeman (2011), which examined a variety of quantitative methods
for estimating the likelihood of the unexperienced incident. The method-
ology recommended by this study was to first assume that the consequence
or initiating event has happened, but only once in the total number of years
of operation. If this assumption does not yield a tolerable level of risk, then
 ARTICLE IN PRESS

Dust explosions—Risk assessment 15

more complex methods involving probability theory are recommended. In

either case, the result is a mathematically derived likelihood, but it is still
arguably subjective, as there is not an unambiguously “correct” method
to estimate the likelihood of these low probability events.

3.2 Quantitative estimates of likelihood

Estimates of likelihood may be quantified regardless of whether they are
derived from empirical data such as failure rates, or are subjectively deter-
mined. However, care should be taken to ensure consistency when conver-
ting qualitative statements to quantitative values. For example, the statement
“expected to occur once in the lifetime of the facility” may differ depending
on the team’s assessment of the facility’s lifetime (Center for Chemical
Process Safety, 2017). See the article by Crump (2017) for an illustrative dis-
cussion on the various interpretations of qualitative statements like certain,
likely, improbable, and doubtful.
Particularly in the setting of a quantitative risk assessment (QRA), esti-
mates of likelihood for a given consequence may begin by contemplating the
frequency of a specific initiating event. The likelihood of a specific conse-
quence may then be calculated by multiplying the frequency of the initiating
event by the probability of each subsequent event necessary to result in the
final outcome of interest. In equation form:
YN
Li ðconsequenceÞ ¼ f ðinitiating eventÞ∗ j¼1 Pj ðintermediate eventÞ (8)

Note, one initiating event may have a number of distinct consequences.

This is represented here by the index i, where the ith consequence from the
initiating event is being considered. Similarly, a number of intermediate
events may be necessary to result in the ith consequence. The equation rep-
resents each of these N intermediate events with the index j. The product of
all N intermediate events multiplied by the frequency f of the initiating event
yields the frequency fi of the consequence of interest. Initiating event fre-
quencies have been proposed in other references (Center for Chemical
Process Safety, 2017, Appendix C, Section C.1.1).
Consider as a simple example the sequence of events for a dust deflagra-
tion involving fugitive combustible dust deposited on the floor of a room.
The hazard scenario is that the dust could become suspended as a cloud with
a dust concentration at or exceeding the minimum explosible concentration.
Assume further that an adequate ignition source is present within the dust
cloud. Finally assume that a worker is inside the room and close enough
 ARTICLE IN PRESS

16 Russell A. Ogle and Brenton L. Cox

Fig. 1 Event tree branch for a dust deflagration.

to the dust cloud so that he or she could be injured if the cloud is ignited.
This hazard scenario is portrayed as a single branch on a simple event tree as
shown in Fig. 1, adapted from Ramirez, Ogle, and Carpenter (2015).
Based on this simple example, the likelihood that a dust suspension event
leads to human injury is estimated according to the following equation:
Li ðhuman injury due to dust deflagrationÞ
YN
¼ f ðsuspensionÞ∗ j¼1 Pj ðintermediate eventsÞ
¼ f ðsuspensionÞ∗P ðignitionÞ∗P ðoccupancyÞ (9)
The frequency that dust will be suspended may be further subdivided, for
example, into an equipment failure or a loss of containment from a duct. The
probability of ignition can be estimated between 1 and 0.01, depending on
the minimum ignition energy (MIE) of the dust (Center for Chemical
Process Safety, 2017, Appendix C, Section C.1.2). If hot work or other
obvious ignition sources are present, the probability of ignition is generally
assumed to be 1. The probability of occupancy can be calculated from the
type of activities performed in the space and how often operators or other
personnel are required to perform those activities.
This example illustrates how various factors, including the presence or
absence of a safeguard, may be considered when contemplating the like-
lihood of a given consequence. In areas where frequent suspensions of
combustible dust exist, robust ignition source control measures and/or
limitations to human occupancy may be necessary to reduce risk to a tol-
erable level. CCPS provides guidance on estimates of the effectiveness of
ignition source controls, which may reduce the ignition probability by as
much as an order of magnitude (2017, Appendix C, Section C.1.2). Once
consequence severity and likelihood have been adequately assessed, risk
can be considered.

4. Risk assessment
The purpose of risk assessment is to provide an evidence-based process
by which an organization can identify, evaluate, and control the hazards of
their operation in a cost-effective manner. In its most general application,
the goal of a risk assessment is to consider the entire portfolio of risks that
 ARTICLE IN PRESS

Dust explosions—Risk assessment 17

the organization must manage, and to prioritize the investment of capital and
operating expenses in a way that promotes the most aggressive control actions
applied to the most significant hazards in the operation. In more targeted
activities, a risk assessment may aim to compare specific aspects of two alter-
natives. In either case, the objective is to make informed, risk-based manage-
ment decisions, where the slogan of good risk management is “worst first.”
The risk assessment process is rarely a solo activity; it usually requires a
team of participants who embody both the technical and business knowl-
edge for the facility. The proper implementation of risk assessment requires
that the risk study participants all understand the distinction between con-
sequence, likelihood, and risk.
As previously described, risk is a measure of probable loss. Risk can be
defined as follows: “A measure of human injury, environmental damage, or
economic loss in terms of both the incident likelihood and the magnitude of
the injury, damage, or loss” (Center for Chemical Process Safety, 2000,
p. 735). Risk is best understood as a quantity composed of two constit-
uent parts, consequence severity and likelihood. Since risk, consequence,
and likelihood are quantitative concepts, the risk assessment team needs a
set of measurement scales for each of these attributes. In a formal probabi-
listic risk assessment, one would develop an extensive set of event trees to
describe the various accident scenarios of interest and then calculate the
probable loss as consequence times the probability of occurrence (Center
for Chemical Process Safety, 2000, Chapter 3; National Aeronautics and
Space Administration, 2011, Chapter 3).
Formal probabilistic risk assessments (PRA) have been popular in many
industries such as nuclear power, aerospace vehicles, offshore oil and gas
production platforms, and petrochemical plants. This is not the case for
facilities that handle particulate solids. However, some studies have been
published that illustrate the use of PRA for dust explosions using general-
ized failure data obtained from various industries, e.g., Jones, Brusewitz,
and Goforth (1989, 1990) and Abuswer, Amyotte, Khan, and Morrison
(2013). It is important to note that these studies assume that reliable failure
rate statistics from operating conditions relevant to that industry are avail-
able. This is not a safe assumption for the equipment that is typically used to
process particulate solids. For example, it may be possible to locate failure
rate statistics on conveyor bearings, but was the failure data obtained from a
service environment that is sufficiently similar to your plant? Formal prob-
abilistic risk assessments frequently require extensive data, effort, and
expertise. The investment required and the data needed may not be feasible
in many organizations.
 ARTICLE IN PRESS

18 Russell A. Ogle and Brenton L. Cox

There is a need for less expensive, less intensive risk assessment methods.
One such method is the Layer of Protection Analysis or LOPA method
(Center for Chemical Process Safety, 2017, Appendix C). The LOPA
method relies on order of magnitude estimates for failure event probabilities.
Data for the estimation of failure event probabilities are easier to obtain and
are less sensitive to equipment service conditions. In the chemical process
industries, LOPA has become popular as a refinement to process hazard
analyses. The authors recommend that if you wish to conduct a combustible
dust risk assessment, consider using LOPA. Techniques that are more
sophisticated can only be justified if you are confident you have reliable fail-
ure event probabilities to use in your analysis.
As shown in the previous chapter, the risk matrix is a popular tool used to
promote consistency in the evaluation of consequence severity, likelihood,
and risk level. Before the risk matrix is introduced here, we must first
consider the problem of measurement. There are three different types of
measurement scales: nominal, ordinal, and cardinal (Corder & Foreman,
2009). Cardinal scales are the most familiar measurement scale. In a cardinal
measurement scale, each observation is assigned a real number. The number
is an indication of the magnitude of the observation. In the context of a risk
assessment, an example of a cardinal measurement scale would be the
measurement of a loss event in terms of the monetary value of the damage
caused by the incident. The advantage of the cardinal scale is its familiarity;
we are used to measuring things with numbers. However, there are many
examples of losses where an observation of the loss cannot be easily translated
into a monetary value. Hence, there is a need for other types of measurement
scales.
A nominal scale essentially assigns observations to categories without
consideration for the magnitude of the observation. An example of a
nominal scale would be to classify a set of marbles according to their color.
The only quantitative information derived from a nominal scale is the
number of marbles assigned to a particular color. Because a nominal scale
is not able to convey a sense of magnitude, it rarely finds application in risk
evaluation.
An ordinal scale is a measurement based on a ranking of magnitude.
Returning to the marble analogy, one could sort marbles according to size
by ranking them as small, medium, and large. The categories small, medium,
and large could be assigned the value of 1, 2, and 3. The numerical values do
not convey the exact diameter of the marble (that would be a cardinal scale
measurement). Instead, the numerical values convey the relative size of the
 ARTICLE IN PRESS

Dust explosions—Risk assessment 19

marbles. In risk assessment, ordinal scales have proven to be a useful artifice

for the evaluation of consequence, likelihood, and risk.
Let us consider consequence severity first. The magnitude of a conse-
quence must be translated into a readily understood measurement of severity.
Generally speaking, the hazards of dust explosions and fires include overpres-
sure, flame and thermal effects, and toxic gas exposure. Specifying a range of
consequences in terms of mechanical, thermal, and chemical effects would
be a complex undertaking and would likely be difficult to use. Instead, the
traditional approach to consequence evaluation is to specify a range of con-
sequences in terms of the severity of the injury caused by the exposure to
the event. An example of how to quantify severity is to consider a range of
onsite worker consequences in increasing order of severity: no injury,
minor injury (first aid), severe injury (hospitalization), permanently dis-
abling injury or fatality, and multiple fatalities. The consequence levels
can be assigned a numerical rank (Table 3).
In this example, the numerical value of the consequence category
increases as the severity increases. The type of consequence shown here is
specific to worker safety. Similar measurement scales could be devised for
environmental impact or business impact.
The magnitude of the likelihood is simply the probability of occurrence.
In a formal probabilistic risk assessment, the probability of occurrence is
decomposed into its constituent probabilities, and each probability is esti-
mated from an appropriate statistical database. Unfortunately, the data
required for this detailed determination of probabilities are not always avail-
able, and in many situations, it is not a convenient approach to use in a team
setting. A simpler and easier approach can be facilitated by the use of an ordi-
nal scale that substitutes judgment for rigorous probability determinations.
An example of how to quantify likelihood is to specify a range of likeli-
hoods in increasing order of probability: not expected to occur in the

Table 3 Consequence severity.

Consequence category Description
1 No injury
2 Minor injury (first aid)
3 Severe injury (hospitalization)
4 Permanently disabling injury or fatality
5 Multiple fatalities
 ARTICLE IN PRESS

20 Russell A. Ogle and Brenton L. Cox

Table 4 Likelihood levels.

Likelihood category Description
1 Not expected to occur in the lifetime of the facility
2 May occur once during the life of the facility
3 May occur several times in the life of the facility
4 Expected to occur once every year
5 May occur several times each year

Table 5 Risk categories.

Risk category Description
I Acceptable (no mitigation required)
II Moderate (mitigation desirable but not required)
III High (mitigation required within a reasonable period of time)
IV Unacceptable (mitigation required immediately)

lifetime of the facility, may occur once during the life of the facility, may
occur several times in the life of the facility, expected to occur once every
year, and may occur several times each year. The likelihood levels can be
assigned a numerical rank (Table 4):
In this example, the numerical value of the likelihood category increases
as the probability of occurrence increases.
Now we need an ordinal measurement scale for risk. Examples of cate-
gories of risk level are the following: acceptable (no mitigation required),
moderate (mitigation desirable but not required), high (mitigation required
within a reasonable period of time), and unacceptable (mitigation required
immediately). This measurement scale is summarized in Table 5.
The numerical value of the risk category increases as the risk magnitude
increases.
Once the ordinal measurement scales for consequence severity, likeli-
hood, and risk have been established, the risk analysis team must have a pro-
cess for mapping a specific consequence-likelihood pair into a measure of
risk. A commonly used approach for this mapping is the risk matrix.
The risk matrix is a semi-quantitative tool for mapping consequence-
likelihood pairs into a risk level. The matrix is frequently formatted with
likelihood levels forming the rows and consequence severity levels forming
 ARTICLE IN PRESS

Dust explosions—Risk assessment 21

Fig. 2 Risk matrix.

the columns. An example risk matrix, adopted from the NFPA combustible
dust book, is shown in Fig. 2 (Frank, Rodgers, & Colonna, 2012):
In this risk matrix, the consequence severity level increases from left to
right, and the likelihood level increases from the bottom to the top. This
assignment of risk levels is not simply the judgment of a single individual.
The designation of risk level that corresponds to each consequence-
likelihood pairing is a risk management determination that must faithfully
reflect the risk tolerance of the decision makers responsible for the manage-
ment of the organization.
The use of the risk matrix is, to a certain degree, a subjective evaluation
of risk. The organization must rely on the judgment of the risk analysis team
to implement the risk assessment process in a way that is consistent with the
safety values of the organization. One might think that it would be easier and
less controversial to use a specific number as the safety risk goal. This is often
not the case. In some countries there are regulations that mandate a specific
safety risk goal. Other countries, like the United States, do not provide such
guidance. An organization can choose to adopt its own safety risk goal, and
there are well-established methods for making that determination (Center
for Chemical Process Safety, 2009).
There are advantages and disadvantages to using a risk matrix. The pri-
mary advantages are that it is relatively easy to use and serves to standardize
the documentation of the risk assessment effort. The primary disadvantage,
often cited in the risk assessment literature, is that it may oversimplify the task
of estimating consequence severity and likelihood (Baybutt, 2018; Cox,
2008; Pickering & Cowley, 2010). The authors believe that the use of a risk
matrix can be effectively used if care is taken to promote consistent and
 ARTICLE IN PRESS

22 Russell A. Ogle and Brenton L. Cox

objective evaluations of each consequence-likelihood paring. The ultimate

choice lies with the organization and/or the risk assessment team.
The ultimate purpose of the risk assessment process is typically not to
simply evaluate the risk of a particular hazard scenario, but to also evaluate
the potential risk reduction benefit of safeguards (see chapter “Safety mea-
sures” by Taveau). The risk matrix can help in this regard as well. The sys-
tem’s safety hierarchy provides a convenient framework for evaluating the
potential risk reduction benefit of different safeguards. The system’s safety
hierarchy is a ranking of safeguards in decreasing order of effectiveness:
• Eliminate the hazard
• Reduce the hazard severity with passive safeguards
• Reduce the hazard severity with active safeguards
• Reduce the hazard severity with procedural safeguards
• Tolerate the residual hazard severity
In this context, eliminating the hazard would imply eliminating the gener-
ation, handling, or storage of combustible dust. This is likely an unacceptable
alternative. The next two classes of safeguards are often referred to as engi-
neering controls. A passive safeguard is one that simply works by virtue of its
existence; it does not require a physical actuation. Explosion containment is
an example of a passive safeguard. An active safeguard is one that requires a
physical actuation to work. Explosion suppression is an example of an active
safeguard. A procedural safeguard, also called an administrative control, con-
trols a hazard through operational procedures. A hot-work safety program is
an example of a procedural control. Finally, the last safeguard in the hierar-
chy is tolerating the residual hazard severity. The residual hazard severity is
the potential for harm that remains after implementation of the safeguards.
This is also sometimes referred to as residual risk tolerance.

5. Risk management
In this chapter, we have focused on the risks associated with combus-
tible dust. The ultimate goal of risk management is to identify, evaluate, and
control risks within the organization. We have discussed how to evaluate the
components of risk, consequence severity, and likelihood, and we have
offered some cautions on the challenges involved. The risk matrix was dis-
cussed as a commonly used device for mapping consequence and likelihood
into a risk level. If it is to be a useful tool, the risk matrix must accurately
reflect the organization’s risk tolerance. Once each hazard scenario has been
evaluated and mapped into a risk level, recommendations for control mea-
sures can be evaluated and selected. Combining these recommendations into
 ARTICLE IN PRESS

Dust explosions—Risk assessment 23

a structured document, sometimes called a risk register, is a useful way to

track the list of action items to be implemented and monitored. This
activity—identifying, evaluating, and controlling risk—is called risk man-
agement. In this section, we discuss some good practices to help promote
successful risk management.
First and foremost, the risk management initiative must be directed and
supported by the organization’s management in a visible and substantive
manner. The risk team must be empowered to proceed with the risk assess-
ment and report on their progress to the organization’s management. The
organization’s management must be committed to objectively evaluating
and implementing the risk team’s recommendations. This does not mean
that the risk team’s recommendations should be accepted uncritically. In
fact, risk management works best in an environment of objective thought-
fulness and careful evaluation of alternative risk controls. Money spent on
risk control for one portion of a manufacturing process may preclude money
spent on another portion of the same process. Monetary resources are always
finite. It is management’s responsibility to allocate those resources to the best
use for safety of the entire manufacturing operation. One purpose of a risk
assessment is to equip management with the knowledge necessary to make
informed decisions of this nature.
The performance of the risk assessment team can be optimized through
training, preparation, and calibration. The risk assessment team should be
drawn from the organization representing the engineering (or scientific),
operations, and maintenance functions. At least one member of the risk
assessment team should have some level of training in risk assessment meth-
odology. This person is usually the designated facilitator of the risk assess-
ment assignment. The facilitator should brief the remaining team
members on the methodology to be used and the plan for implementation.
Preparation for the risk assessment includes collecting and reviewing the
design basis documents for the process under study. The team should be
familiar with the design basis and understand the impact of any data gaps that
are discovered during the preparation activity. The risk assessment team
must understand the design basis for both the manufacturing processes
and the buildings that support them. The design basis is typically docu-
mented through drawings, specifications, equipment operating manuals,
operating procedures, and related documents. It is difficult to assess the risk
reduction benefit of a protective device, like an explosion vent, if the design
basis for the explosion vent is unknown.
Finally, it is important to calibrate the team members on the conse-
quence severity, likelihood, and risk levels. This can take many forms
 ARTICLE IN PRESS

24 Russell A. Ogle and Brenton L. Cox

and varying levels of effort. The simplest calibration tool is a simple table of
definitions and examples to define each category (Center for Chemical
Process Safety, 2017, pp. 112–114 and Appendix C). A more elaborate
effort would include conducting group exercises to challenge, test, and
improve the group’s ability to achieve consistency in the use of profes-
sional judgment (Hubbard, 2010).
During the risk assessment exercise, the team may generate risk reduc-
tion recommendations. Risk reduction recommendations should be phrased
in a manner that acknowledges that the team may not have the time,
resources, or knowledge to determine the best solution for each combustible
dust hazard scenario. Instead, the risk reduction recommendations should
be generalized statements of risk reduction upon which organization man-
agement must evaluate and act. An example of a poor risk-based recom-
mendation is, “Add explosion venting to Dust Collector XXX-17 within
the next six months.” This type of recommendation is likely too specific
and may not recognize alternative measures for Dust Collector XXX-17,
such as implementing explosion suppression, inerting with nitrogen gas, or
decommissioning based on its poor condition and age. An example of a better
risk-based recommendation is, “Consider in the next six months whether
explosion protection is needed for Dust Collector XXX-17.” This recom-
mendation gives management the flexibility to determine the best path
forward for the equipment.
Two main work products result from the risk assessment. The first is the
summary report that documents the scope of the study, the design basis doc-
uments reviewed, and the risk assessment process itself. The documentation
for the risk assessment process should include a list of all combustible dust
hazard scenarios reviewed, the determination of consequence severity, like-
lihood, and risk level for each scenario, and the risk reduction recommen-
dations. The second work product is the risk register. The risk register is
essentially a list of action items that require follow-up with the organization’s
management. A process is required for monitoring the risk register and
verifying that each item has been reviewed and some action has been taken
(or in the absence of action, an explanation has been provided). Many orga-
nizations couple their risk register to the organization’s work flow system so
that the purchasing, engineering, operations, and maintenance staff are
alerted to the need to process any given work order to fulfill the accomplish-
ment of a risk reduction item.
One of the major benefits of the risk register is that it gives organization
management a tool for auditing the outcome of each risk reduction
 ARTICLE IN PRESS

Dust explosions—Risk assessment 25

recommendation. Thus, both the risk team and the organization’s manage-
ment can have assurance that the risk reduction recommendations are being
addressed in a timely fashion. The risk register can also alert management to
funding or staffing needs that may not have been anticipated, and thereby
serves as a business planning tool.
Finally, the process of risk management must also consider the manage-
ment of change (MOC) process employed in the organization. It is likely
that each risk reduction recommendation will trigger an MOC action item
as new features are introduced into the process or as equipment is modified.

6. Summary
The prescriptive requirements of safety standards can be inflexible and
difficult to implement in new or novel process technologies. A combustible
dust risk assessment may reveal an alternative approach for identifying, eval-
uating, and controlling combustible dust risks. However, risk assessment
requires specialized knowledge and data that may be difficult to obtain. If
an organization chooses to conduct a combustible dust risk assessment, they
should strive to select a diverse pool of talent for the risk team. It is vitally
important that organization management clearly conveys their risk tolerance
criteria, and that the risk team facilitator ensures that their efforts meet that
requirement. Organization management must commit to evaluating and
implementing the risk reduction recommendations that are presented by
the risk team. The risk study should be documented and its recommenda-
tions should be audited and updated as necessary. Regulatory compliance is
another consideration that must be addressed.

References
Abuswer, M., Amyotte, P., Khan, F., & Morrison, L. (2013). An optimal level of dust explo-
sion risk management: Framework and application. Journal of Loss Prevention in the Process
Industries, 26, 1530–1541. https://doi.org/10.1016/j.jlp.2013.08.018.
American National Standards Institute. (2011a). ANSI/ASSE/IEC/ISO 31010 (Z690.3-
2011) risk assessment techniques. Des Plaines, Illinois: American Society of Safety
Engineers.
American National Standards Institute. (2011b). ANSI/ASSE/ISO guide 73 (Z690.1-2011)
vocabulary for risk management. Des Plaines, Illinois: American Society of Safety Engineers.
Baybutt, P. (2018). Guidelines for designing risk matrices. Process Safety Progress, 37, 49–55.
https://doi.org/10.1002/prs.11905.
Carbon monoxide. (2018). National institute for occupational safety and health (NIOSH)
pocket guide to chemical hazards. Retrieved from https://www.cdc.gov/niosh/npg/
npgd0105.html.
 ARTICLE IN PRESS

26 Russell A. Ogle and Brenton L. Cox

Center for Chemical Process Safety. (1994). Guidelines for evaluating the characteristics of vapor
cloud explosions, flash fires, and BLEVEs. New York, NY: John Wiley & Sons.
Center for Chemical Process Safety. (1996). Guidelines for evaluating process plant buildings for
external explosions and fires. New York, NY: John Wiley & Sons.
Center for Chemical Process Safety. (2000). Guidelines for chemical process quantitative risk anal-
ysis (2n ed.). New York, NY: John Wiley & Sons.
Center for Chemical Process Safety. (2009). Guidelines for developing quantitative safety risk
criteria. New York, NY: John Wiley & Sons.
Center for Chemical Process Safety. (2017). Guidelines for combustible dust hazard assessment.
New York, NY: John Wiley & Sons.
Corder, G. W., & Foreman, D. I. (2009). Nonparametric statistics for non-statisticians. Hoboken,
NJ: John Wiley & Sons.
Cox, L. A. (2008). What’s wrong with risk matrices? Risk Analysis, 28, 497–512. https://doi.
org/10.1111/j.1539-6924.2008.01030.x.
Crump, J. J. (2017). Uncertain about uncertainty. In Proceedings of the American Institute
of Chemical Engineers 2017 spring meeting and 13th Global Congress on Process Safety, San
Antonio, Texas.
Eckhoff, R. (2003). Dust explosions in the process industries (3rd ed.). Oxford: Gulf Professional
Publishing.
Frank, W. L., Rodgers, S. A., & Colonna, G. R. (2012). NFPA guide to combustible dusts.
Quincy, MA: National Fire Protection Association.
Freeman, R. (2011). What to do when nothing has happened? Process Safety Progress, 30(3),
204–211. https://doi.org/10.1002/prs.10463.
Hubbard, D. W. (2010). How to measure anything. Finding the value in “intangibles” in business
(2nd ed.). Hoboken, NJ: John Wiley & Sons.
Jones, D. D., Brusewitz, G. H., & Goforth, K. J. (1989). Fault tree analysis of a grain dust
explosion in a bucket elevator leg. Transactions of the ASAE, 32, 1691–1700.
Jones, D. D., Brusewitz, G. H., & Goforth, K. J. (1990). Elevator leg explosion as a function
of specific failures. Transactions of the ASAE, 33, 1629–1632.
Likelihood. (2018). Merriam-Webster. Retrieved from https://www.merriam-webster.com/
dictionary/likelihood.
National Aeronautics and Space Administration. (2011). Probabilistic risk assessment procedures
guide for NASA managers and practitioners. [Second Edition].
National Fire Protection Association. (2017). Standard for the prevention of fire and dust explosions
from the manufacturing, processing, and handling of combustible particulate solids. Quincy, MA:
National Fire Protection Association.
National Fire Protection Association. (2019). Standard on the fundamentals of combustible dust.
Quincy, MA: National Fire Protection Association.
Ogle, R. A. (2017). Dust explosion dynamics. Oxford: Butterworth-Heinemann.
Pickering, A., & Cowley, S. P. (2010). Risk matrices: Implied accuracy and false assumptions.
Journal of Health & Safety, Research & Practice, 2, 9–16.
Prugh, R. W. (1994). Quantitative evaluation of fireball hazards. Process Safety Progress, 13,
83–91.
Ramirez, J. C., Ogle, R. A., & Carpenter, A. R. (2015). Risk evaluation and the NFPA 654
layer depth criteria for dust explosion and flash fire hazards. In ASME 2015 international
mechanical engineering congress and exposition, American Society of Mechanical Engineers.
Van den Bosch, C. J. H., & Weterings, R. A. P. M. (2005). Yellow book: Methods for the cal-
culation of physical effects (3rd ed.). Second revised print. Committee for the Prevention of
Disasters.
Wieczorek, C. J., Dembsey, N. A., & Hall, J. R., Jr. (2015). Effects of thermal radiation on
people: Predicting 1st and 2nd degree skin burns. In M. J. Hurley, D. T. Gottuk,
K. Harada, E. D. Kuligowski, M. Puchovsky, J. M. Watts, Jr., & C. J. Wieczorek
(Eds.), SFPE handbook of fire protection engineering. New York, NY: Springer.