Ammonia is a promising fuel for decarbonizing the shipping industry, but its safety compared to traditional maritime fossil fuels remains questionable. As more projects explore ammonia-fueled vessels, safety concerns, particularly the acute toxicity and risks of ammonia release, are paramount. This research focused on the effects of accidental ammonia releases during ship-to-ship collisions, affecting ammonia tank integrity. We examined various release scenarios, considering factors like tank types and locations, breach sizes and positions, weather conditions, and dispersion patterns, using PHAST software for modeling. Results indicated that semipressurized tanks pose greater health risks on human health than fully refrigerated ones. Underwater releases are less hazardous, as a significant amount of ammonia dissolves before surfacing. Mitigation efforts, such as water curtains and containment basins, were evaluated for their effectiveness in minimizing the impact of ammonia releases. These measures significantly reduce risks to nearby populations but are less effective for crew safety onboard. This underscores the challenge of ensuring onboard safety in ammonia-fueled vessels, highlighting the need for innovative and effective safety design.

@en

Emergency response is a procedural safety barrier of paramount importance for the mitigation of fire scenarios and the prevention of escalation. However, in Natech scenarios, emergency response may be affected by the natural event impacting the site. Indeed, when contrasting Natech accidents, emergency responders have to face both the natural event and the cascading technological scenario. Despite the criticality of the issue, limited attention was devoted to date to the analysis of emergency response in cascading sequences triggered by natural events. The present study provides a novel and technically sound methodology to assess the performance of emergency response and the required intervention time in Natech scenarios. An expert survey combined with a Bayesian Network model was used to assess the performance of the emergency response. The routing and setup phases were identified as those mostly affected by natural events. Monte Carlo simulations were used to obtain baseline data and specific probability distributions for the time required to carry out the emergency response considering the factors that may hinder the response during natural events. In Natech accidents, the time for effective mitigation resulted higher of at least a factor 2 with respect to that expected in the case of conventional accidents. The methodology developed may be used to support the improvement of the emergency management of Natech scenarios, allowing for a detailed definition of site-specific emergency response plans. Moreover, the results may be used to provide a more accurate assessment of the fire-driven escalation probability in Natech events.

@en

Deliberate attacks (security attacks) pose a significant threat to offshore Oil&Gas critical infrastructures as they have the potential of triggering major event scenarios with severe consequences on people, property, and the surrounding environment. The standards API RP 70 and API RP 70I address security issues in the offshore Oil&Gas sector, providing a semi-quantitative approach to evaluate the actual level of security risk. However, as the credibility of security attacks grows, security risk assessments should be approached in a more systematic and quantitative way to measure vulnerabilities and determine the level of protection available in the site. In this context, the present study introduces a systematic quantitative procedure using Bayesian Network (BN) to calculate the probability of success of physical attacks and the role of preventive and mitigative response strategies. The procedure is applied to a case study allowing to show its potential for improving security in the offshore Oil&Gas industry.@en

Offshore Oil&Gas facilities are attractive targets of intentional malicious attacks (security attacks) that may trigger cascading events (e.g., the release and dispersion of hazardous material and/or energy, fires, explosions) with consequences on people, environment, and assets. The severity of these consequences is potentially similar to those arising from major accident scenarios originated by conventional safety-related causes. Current practice in managing the risk of security attacks mostly relies on qualitative or semi-quantitative procedures developed over the years in the offshore Oil&Gas industry. In the present study, a systematic quantitative procedure is developed, based on a Bayesian Network (BN) approach, for calculating the probability of success of physical security attacks, taking into account both preventive and mitigative security intervention strategies. The procedure addresses the specific framework of the offshore Oil&Gas industry. A case study concerning an offshore fixed Oil&Gas platform allowed us to demonstrate the quality of the results that can be achieved and their potential towards the improvement of the security of the installations considered.@en

Fire is one of the main accident scenarios occurring in chemical and process plants, and it can lead to domino effects due to thermal radiation. Emergency response is necessary to prevent fire escalation, in addition to safety barriers. In major industrial fire accidents, backup is usually required in emergency response, due to the lack of emergency response capacity of a single emergency response department. A method addressing the optimal allocation of emergency response forces, specifically considering the front-line departments, is developed in the present study. The emergency response of the front-line departments can reduce the thermal radiation received by the equipment adjacent to the primary fire and thus prolong the time to failure of the equipment, such that the backups have more time to get to the fire scene. The allocation analysis of emergency response teams is carried out considering the dynamic ttf of an adjacent equipment item resulting from the change in time of the thermal radiation received. A timed colored hybrid Petri-net (TCHPN) approach is proposed to model the emergency response process. The probability of preventing fire escalation is obtained from the TCHPN model and the optimal allocation of firefighting forces is determined. A case study illustrates the proposed approach, two scenarios are compared and results show that if a request for backup can be issued immediately according to the fire state, fewer emergency forces can be deployed on the front line department, such as the reduction from 6 emergency response teams to 3 teams to maintain the success probability of 0.91. The influence of other factors such as the position of fire departments and the layout of tanks on the allocation of emergency forces is also discussed.@en

Accidents triggered by natural events are becoming an increasing issue for policy-makers and industrial practitioners in the last decades. These events are called Natech (natural hazards triggering technological disasters), and their study is critical due to an increase in both the frequency and the magnitude of the consequences. Considering the possible failure of safety systems and the several equipment items potentially involved in the accidents due to the occurrence of multiple simultaneous failures and cascading events, the emergency response results to be a crucial aspect in the risk assessment and management of Natech events. Despite this, the emergency response can also be affected by the occurrence of natural events. The purpose of the present work is to understand the effects of natural events on emergency response. To reach this goal, some relevant past accidents are studied. The result of the analysis allows highlighting the effects of the natural events on the emergency response. Moreover, lessons learned on the critical elements of the emergency response are derived when considering Natech accidents and related cascading events.@en

Inherent safety design principles have been used extensively to design safer plants. However, to date their application is merely limited to technical changes in the process. An unexplored area of ISD is related to all the non-technical aspects linked to the safety of industrial plants, such as the Human and Organizational Factors, often referred to as HOFs. This study presents an Inherent Safety Decision Making framework (ISDDM), with the objective to provide a structured tool that can be easily used by industrial practitioners. The novelty of the ISDDM is the provision of a structured framework where purely technical and non-technical ISD alternatives are categorized and analyzed, to check if possible interactions exist among the alternatives proposed. To prove the usefulness of the model, a case-study addressing a carbon capture plant is carried out. This technology will play an important role in the reduction of CO₂ emission in carbon-intense industrial processes, implying a rapid scale-up of these plants in the next years, therefore justifying the analysis of this green technology. Adopting the proposed ISDDM, the improvements in terms of safety from the base case ranged from 58% to around 70% for the best design solution, while from an economic perspective, cost variations were comprised between 16% and 22%. The results of the study demonstrate that the framework can be rigorously implemented and that it provides a considerable number of additional alternatives due to the inclusion of HOFs in the analysis. In conclusion, an improved and adequate ISD is a key to environmental sustainability.

@en

Accidents resulting in industrial fires in chemical and process installations and in industrial parks where relevant quantities of hazardous substances are stored or processed may cause domino effects. Probit models developed and used in a multitude of studies can provide the probability of equipment failure, but they do not consider the effect of multiple radiation sources, and thus fail to capture the effects of severe scenarios as those where multiple fires start at different times in different units. In the present study, a critical thermal dose for equipment failure is defined. A direct procedure for the calculation of ttf based on the critical thermal dose is then introduced, which is able to account for the time at which the different secondary fires start or are extinguished. This allows considering the effects of the primary and of several secondary fire scenarios in causing a domino effect, updating the time to failure on the basis of the dynamic evolution of multiple fire scenarios. The proposed approach is demonstrated through case-studies addressing fire-induced domino effects in an oil storage tank farm.

@en

Industrial infrastructures, in particular those where hazardous substances are stored or handled, may be the target of malicious acts aiming at the disruption of normal operations. In the present study a toolbox of complementary and synergic techniques (Correspondence Analysis (CA), Fishbone Diagrams, Cause-Consequence Chains, Adversary Sequence Diagram, Root Cause Analysis) was applied to the in-depth analysis of physical security- and cybersecurity-related events that affected the process industry. The unprecedented original set of information obtained provides novel insights concerning these events. Clear correlations among security threats, including cyber-threats, and specific industrial sectors, as well as among the final scenarios and the different security threats from which they originate were identified by CA. In particular, vandalism resulted strongly correlated with the transportation of hazardous substances, and theft of materials with oil and gas pipelines. When considering chemical and petrochemical sites, cyber-attacks and the use of improvised explosives resulted to be the most common attack modes performed by the threat actors. Personnel and vehicle gateways resulted key elements when designing the Physical Protection System (PPS) of a facility. Insiders having the permission to enter the site bypass such controls, and were responsible of several successful attacks. Overall, the results confirm the concreteness of security-related events in the process industry and provide an original structured and detailed insight on the attack patterns experienced to date. Moreover, the results and the data obtained provide a novel set of baseline information for the application of SVA (Security Vulnerability Assessment) or SRA (Security Risk Assessment) methodologies in facilities where hazardous substances are stored or processed.

@en

Industrial facilities where relevant quantities of hazardous chemicals are stored or processed may be direct or indirect targets of malicious acts of interference, including cyber or physical attacks. In the case of direct attacks, one or more process units may be damaged within the installation, often with the clear willingness of triggering domino effects escalating the primary event and possibly involving the entire installation. Also indirect attacks may be relevant, where the damage or destruction of neighboring sensible civilian targets is the primary aim of the action, but domino effects may be generated by the effects of the interaction with primary, large-scale accidents occurring outside the physical border of the facility. Escalation may result in cascading events that may heavily involve and damage the industrial facility of concern.@en

Cascading events in which an escalation triggered by a domino effect takes place are high-impact low-probability accidents that require specific prevention and mitigation in design and operation of industrial facilities and industrial parks. A domino effect phenomenon was responsible of several catastrophic accidents that affected the chemical and process industry, as well as critical infrastructures for energy and other industrial sectors where relevant quantities of hazardous substances are stored or processed. Although to date most of these events were caused by unintentional domino effects, related to process safety accidents, intentional, security-related, domino effects may cause similar scenarios. Significant regulatory requirements and technical standards address the prevention and mitigation of domino effects in the design and operation of industrial sites. However, the complexity of the topic and the limited data available result in a poor agreement on assessment procedures to address escalation hazards possibly resulting in domino scenarios. Even if methods, models, and tools developed now facilitate the quantitative assessment of domino scenarios in risk analysis and in the safety management of industrial sites, a number of open points still remain. In recent years, a constant progress was made in improving the quantitative methods for understanding and assessing domino effects, and in addressing and reducing the uncertainty. Recent research efforts dedicated to the exploration of domino effects allowed the development of methods for dynamic risk assessment. These may now be complemented by specific methods addressing the quantitative performance of safety barriers to prevent the escalation. In parallel, a relevant effort was dedicate to methods addressing the control and prevention of intentional domino effects. In the present chapter, an overview of the more active research areas in domino effects is provided, and the importance of innovation and new findings for the assessment and the management of the risk caused by cascading events triggered by domino effects is provided.@en

The authors regret that an imprecise statement was made in this article, and wish to offer this Corrigendum as clarification. The authors would like to apologise for any inconvenience caused. Imprecise statement: Misuri et al. (2018, pp. 70) state in their work: “Differently from EN [evidential network], CN [credal network] can be used both to conduct forward analysis and to update probabilities”. This statement implies that EN cannot be used for belief updating and should be mapped into a corresponding CN for that purpose. Correction: The foregoing statement may be correct for conventional ENs that are based on Dempster's combination rule, but does not hold true for the EN developed by Simon and co-workers (2008, 2009) based on Bayesian network (BN) inference algorithms (herein, BN-based EN). Simon and Weber (2009) explicitly mention in their work that the developed EN can be used for belief updating: “The computation mechanism is based on the Bayes theorem, which is extended to the representation of uncertain information according to the framework of Dempster-Shafer theory. Specific evidence (Hard evidence) is modeled by a mass of 1 on one of the focal elements of the frame of discernment. Non-specific evidence (Soft evidence) corresponds to a mass distribution on the focal elements of the frame of discernment.” Proof: Fig. 1 displays the BN-based EN developed in Misuri et al. (2018) for security vulnerability assessment of a process plant where the belief masses have been updated given the evidence “Attack = Success”. Misuri et al. (2018) used the BN-based EN for predicting the probability of a successful attack (forward analysis), but to update the probabilities (backward analysis) they mapped the BN-based EN into an equivalent CN and calculated the updated probabilities given “Attack = Success”. They used two packages, JavaBayes and GL2U, to implement the CN, concluding that JavaBayes results in more consisting updated probabilities with regard to the evidence (the 2nd column in Table 1). In the present corrigendum, we used the BN-based EN (Fig. 1) for belief updating given “Attack = Success”. The updated beliefs were subsequently used to calculate updated probability intervals (the 3rd column in Table 1), showing a good agreement between the results of CN and BN-based EN. Conclusion: The EN developed by Simon and co-workers (2008, 2009) based on BN can be used for belief mass updating the same way BN can be used for probability updating, with no need for using CN.

@en

Security management of critical infrastructures is a complex task as a great variety of technical and socio-political information is needed to realistically predict the risk of intentional malevolent acts. In the present study, a methodology based on Limited Memory Influence Diagram (LIMID) has been developed for the protection of critical infrastructures via cost-effective allocation of security measures. LIMID is an extension of Bayesian network (BN) intended for decision-making, allowing for efficient modelling of complex systems while accounting for interdependencies and interaction of system components. The probability updating feature of BN has been used to investigate the effect of vulnerabilities on adversaries’ preferences when planning attacks. Moreover, the proposed methodology has been shown to be able to identify an optimal defensive strategy given an attack through maximizing defenders’ expected utility. Despite being demonstrated via a chemical facility, the methodology can easily be tailored to a wide variety of critical infrastructures.

@en

Quantitative risk assessment (QRA) has played an effective role in improving safety of process systems during the last decades. However, QRA conventional techniques such as fault tree and bow-tie diagram suffer from drawbacks as being static and ineffective in handling uncertainty, which hamper their application to risk analysis of process systems. Bayesian network (BN) has well proven as a flexible and robust technique in accident modeling and risk assessment of engineering systems. Despite its merits, conventional applications of BN have been criticized for the utilization of crisp probabilities in assessing uncertainty. The present study is aimed at alleviating this drawback by developing a Fuzzy Bayesian Network (FBN) methodology to deal more effectively with uncertainty. Using expert elicitation and fuzzy theory to determine probabilities, FBN employs the same reasoning and inference algorithms of conventional BN for predictive analysis and probability updating. A comparison between the results of FBN and BN, especially in critically analysis of root events, shows the outperformance of FBN in providing more detailed, transparent and realistic results.

@en

Domino effects triggered by fire can cause extremely severe damages to the chemical and process plants. In the need of a more effective prevention of fire domino effects, the present study focuses on firefighting which has received less attention compared to passive and active fire protection systems. Considering both the vulnerability and recoverability phases during fire domino effects, we have introduced a methodology for optimal identification of firefighting strategies so as to increase the resiliency of process plants in dealing with fire escalation scenarios. The area above the resilience curve (AARC), which is equal to the accumulation of loss of resilience over time, was considered as the metric to identify the optimal firefighting strategies. In other words, the strategy leading to the lowest AARC can be selected as the optimal strategy from a resiliency perspective@en

Risk and Safety Management are crucial aspects in chemical industry and academic laboratories. From their rich experience in academic education and industrial practice, the authors present options for professional training addressing engineers and scientists at different career levels. The book informs about existing norms (OHSAS, ISO, etc.) and discusses examples from several countries.@en

The industrial clustering process in the chemical industry is becoming progressively more important due to economic, social and political issues. Industrial clustering means agglomeration of companies in the same geographical area in order to increase productivity and reduce costs. Nonetheless, clustering also has some important safety and security implications. The aim of this study is twofold: firstly, the development of an algorithm for the classification of chemical industrial clusters with regards to safety and security risks. Secondly, considering the importance of a multi-plant safety and security management system, highlighting the greater efficiency in the reduction of risk where adequate cooperation exists. The methodology is divided in three main steps, namely, “selection” (of the chemical parks to be processed), “assessment” of average hazard and vulnerability of installations within the cluster area, followed by an analysis of the relationships within companies in terms of strategic and operational cooperation, and “ranking”. The last step evaluates the strong influences of the above-mentioned parameters through the analytic network process (ANP) and leads to a final classification.

@en

Before the tragedy of 9/11, the perception of risk in process plants was mainly focused on accidental events caused by technical failures, human errors or natural events. However, since then, the risk of deliberate actions against process facilities - also known as security risk - has also become a concern. Security risk assessment of engineering systems and infrastructures constitutes a complex task since a significant multitude of technical and socio-political information is needed to reasonably predict the risk of intentional malevolent acts. In the present study, a methodology based on Bayesian network (BN) has been applied to increase the security of critical infrastructures via cost-effective allocation of security measures. Using the probability updating feature of BN, the proposed methodology can be employed to investigate the effect of vulnerabilities on adversaries' preferences while planning security scenarios. Moreover, the proposed methodology is capable of efficiently identifying an optimal defensive strategy given a security scenario (i.e., an attack) through maximizing defenders' expected utility.@en