Nicola Paltrinieri

Lessons Learned from Toulouse and Buncefield Disasters: From Risk Analysis Failures to the Identification of Atypical Scenarios Through a Better Knowledge Management

The recent occurrence of severe major accidents has brought to light flaws and limitations of hazard identification (HAZID) processes performed for safety reports, as in the accidents at Toulouse (France) and Buncefield (UK), where the accident scenarios that occurred were not captured by HAZID techniques. This study focuses on this type of atypical accident scenario deviating from normal expectations. The main purpose is to analyze the examples of atypical accidents mentioned and to attempt to identify them through the application of a well-known methodology such as the bow-tie analysis. To these aims, the concept of atypical event is accurately defined. Early warnings, causes, consequences, and occurrence mechanisms of the specific events are widely studied and general failures of risk assessment, management, and governance isolated. These activities contribute to outline a set of targeted recommendations, addressing transversal common deficiencies and also demonstrating how a better management of knowledge from the study of past events can support future risk assessment processes in the identification of atypical accident scenarios. Thus, a new methodology is not suggested; rather, a specific approach coordinating a more effective use of experience and available information is described, to suggest that lessons to be learned from past accidents can be effectively translated into actions of prevention.

On the application of near accident data to risk analysis of major accidents

Abstract Major accidents are low frequency high consequence events which are not well supported by conventional statistical methods due to data scarcity. In the absence or shortage of major accident direct data, the use of partially related data of near accidents – accident precursor data – has drawn much attention. In the present work, a methodology has been proposed based on hierarchical Bayesian analysis and accident precursor data to risk analysis of major accidents. While hierarchical Bayesian analysis facilitates incorporation of generic data into the analysis, the dependency and interaction between accident and near accident data can be encoded via a multinomial likelihood function. We applied the proposed methodology to risk analysis of offshore blowouts and demonstrated its outperformance compared to conventional approaches.

Hazard identification for innovative LNG regasification technologies

Emerging risks may arise from process intensification and new scenarios due to the innovative technologies and higher potentialities of new LNG regasification facilities. In the conventional hazard identification process it is difficult to include new scenarios related to innovative technologies or facilities, for which limited or no operational experience is available. In the present study, a new technique for HAZard IDentification (HAZID), named Dynamic Procedure for Atypical Scenarios Identification (DyPASI), was applied to identify atypical accident scenarios in LNG terminals. The technique aims to make easier and more systematic the process of learning from early warnings and identify atypical accident scenarios otherwise disregarded by common HAZID techniques. The comparison with a survey of the accident scenarios typically considered in available Environmental Impact Assessment (EIA) studies evidences that DyPASI is a valuable tool to obtain a complete and updated overview of potential hazards in particular for new or innovative technologies, where limited operational experience is available.

Towards a new approach for the identification of atypical accident scenarios

Proper hazard identification (HAZID) in safety reports has become progressively more difficult to achieve. Several major accidents in Europe in recent years, such as Buncefield and Toulouse, were not even considered by their site ‘Seveso-II’ Safety Case. One of the reasons is that available HAZID methodologies take no notice of apparently least likely events. Nonidentified scenarios thus constitute a latent risk, whose management is extremely complex and open ended. For this reason, the EC project iNTeg-Risk, in one of its tasks, aimed to investigate the issue of atypical scenarios and explain how they could have been identified. This study wants to describe the approach used and its immediate results, paving the way towards a new method for the identification of atypical accident scenarios. An in-depth accident analysis of some of these accidents was performed, in order to outline general features of plants in which they occurred, their causes, consequences, and lessons learned. This analysis followed a precise common scheme, which allowed a systematic approach to the problem by the experts involved. Based on the findings, failures connected to risk management and risk appraisal were identified. Three main basic issues in risk appraisal were identified: the low perception of emerging risks related to atypical accident scenarios, the lack of knowledge about related events, such as early warnings, and the incapability of current techniques in leading analysts to the identification of atypical scenarios.

Coupling of advanced techniques for dynamic risk management

Identification and assessment of hazards and risks in the activities of the process industry are of paramount importance for the prevention of major accidents. Although several techniques of HAZard Identification (HAZID) and quantified risk analysis have often been proved effective in the industry, they generally lack the dynamic dimension of risk management. In other words, they lack the ability to learn from new risk notions, experience and early warnings. When carrying out HAZID and risk assessment, there is the need to know how to deal with atypical accident scenarios as soon as their emergence is demonstrated. The related risk needs to be addressed in an ever-changing environment. In fact, what is not identified or assessed cannot be prevented or mitigated and latent risk is more dangerous than recognized one due to the relative lack of preparedness. This study proposes a dynamic approach to risk by coupling an advanced technique for hazard identification to an innovative method for risk assessment: the Dynamic procedure for atypical scenarios identification (DyPASI) and the Dynamic risk assessment (DRA) method. DyPASI was developed within the EC project iNTeg-Risk. This technique aims to complete and update HAZID. Atypical accident scenarios, which by definition are deviating from normal expectations of unwanted events or worst case reference scenarios, are identified through a systematic screening of related emerging risk notions. The DRA method aims to estimate the updated expected frequency of accident scenarios by means of Bayesian inference. Real time abnormal situations or incident data are used as new information to update the failure probabilities of the system safety barriers, which necessarily affect the overall scenario frequencies and the related risk profile. The BP Texas City refinery accident, that occurred on 23 March 2005, was considered as a case study. The results obtained from the application of the dynamic risk approach show that the accident should have been expected and its occurrence probability could have been reduced through this approach. The results highlight the need of safety culture and decision-making processes capable of dealing dynamically with emerging and increasing risk issues.

Chapter 7 – Reactive and Proactive Approaches: Tutorials and Example

Bayesian inference-based dynamic risk assessment (BIDRA) and the risk barometer represent two different approaches that may be adopted for dynamic evaluation of accident frequency. BIDRA is a methodology for reactive risk assessment based on Bayesian inference, whereas the risk barometer is based on real-time indicator monitoring aiming to support proactive assessment of risk. This chapter illustrates two tutorials for the application of the BIDRA and risk barometer techniques. Moreover, application to the same representative case is performed by simulating the inputs for the methodologies: past near misses and accidents for BIDRA, and technical, operational, and organizational indicator trends for the risk barometer. This example aims to highlight similarities and differences and provides support for the selection of methods.

Accident Frequency Evaluation to Support Dynamic Risk Studies

Accident Frequency Evaluation to Support Dynamic Risk Studies Gabriele Landucci*, Nicola Paltrinieri a Dipartimento di Ingegneria Civile e Industriale, Università di Pisa, Largo Lucio Lazzarino 2, 56126 Pisa, Italy b Department of Production and Quality Engineering, Norwegian University of Science and Technology NTNU, Trondheim, Norway c SINTEF Technology and Society, Safety Research, Trondheim, Norway gabriele.landucci@unipi.it

Prevention of atypical accident scenarios through the use of resilience based early warning indicators

An “atypical” accident scenario is a scenario deviating from normal expectations and, thus, not deemed credible by common processes of risk assessment. Past experience shows that non identified accident scenarios as such represent a latent risk for industry and society and sometimes their occurrence can lead to consequences of unexpected extent. An evident example of an atypical accident was the major accident occurred at Buncefield on 11th December 2005. A detailed analysis of this and other cases in literature has shed some light on the complexity of their causal factors, demonstrating that an atypical major accident is not the consequence of a single uncommon event, but rather the result of a series of failures at different levels of risk management. Thus, it has been a major challenge to foresee combinations of such failures and corresponding unidentified accident scenarios. Two complementary approaches to deal with this challenge are: i) improved identification of atypical scenarios, to reduce the occurrence of unforeseen events; ii) improved early detection, to reduce the possibility of remaining unforeseen events leading to an accident. For this reason the Resilience based Early Warning Indicator (REWI) method has been considered in this contribution. The main aim of this work is to show the preliminary results of the application of this method to the site at Buncefield, obtained by adapting the candidate set of REWI indicators to the oil depot characteristics and defining new indicators on the basis of the accident causes. In this way it has been also possible to understand the relevance of these resilience based indicators as early warnings of the atypical scenario and to demonstrate, by the correspondence of the defined indicators with the accident causes, that this major accident would have been likely prevented by the application of the REWI method. to an accident would be reduced. For this reason the Resilience based Early Warning Indicator (REWI) method has been considered in this contribution. In fact, the concept of resilience refers to the capability of recognizing, adapting to, and coping with the unexpected and one of its key characteristics is the interaction and interchange between different (organizational) system layers, levels, and focal points. The main aim of this work is to show the preliminary results of the application of this method to the site at Buncefield. A candidate set of resilience based early warning indicators are adapted taking into account characteristics of the oil depot. Then, the accident causes identified in the analysis are related to the indicators, in order to understand the relevance of these resilience based indicators as early warnings of the atypical accident scenario occurrence and to which extent this major accident could have been prevented.

Chapter 5 - Reactive approaches of probability update based on Bayesian methods

Dynamic safety analysis in chemical and process facilities is necessary to prevent unwanted events that may cause catastrophic accidents. Probability updating and adapting of stochastic events and dynamic processes, which evolve over time, are the key to dynamic safety analysis. Conventional risk assessment techniques, such as fault tree, event tree, and bow-tie analyses, have long been used for effective safety analysis of process plants; however, owing to their static characteristics, their application to dynamic safety analysis has been relatively limited. Bayesian methods, such as hierarchical Bayesian analysis and Bayesian network, are effective techniques with ample potential for application in dynamic safety analysis. This chapter is aimed at presenting the state-of-the-art application of Bayesian analysis and especially the Bayesian network method in dynamic safety analysis of process systems.

Proactive Approaches of Dynamic Risk Assessment Based on Indicators

Collection and monitoring of specific indicators may enable dynamic and proactive risk assessment. In fact, such collection, improved by todays advanced information technology systems, may provide real-time information on the overall risk variation. Moreover, monitoring human and organizational factors may allow prevention of potential underlying causes of accidents. Four classes of proactive approaches for dynamic risk assessment are presented in this chapter. They represent four levels of connection to the overall risk picture, from connection assumed on the basis of past accident analysis to dynamic aggregation methodologies. The risk barometer technique is presented as representative example of the latter. Its attention to human and organizational factors is demonstrated not only by real-time collection of specific indicators but also by its capability to support key safety decision-makers in short- and medium-term planning.