CETvol87 DOI: 10.3303/CET2187065 Paper Received: 29 September 2020; Revised: 13 February 2021; Accepted: 5 May 2021 Please cite this article as: Colombo S., Piazza L., Bozzano G., Manenti F., 2021, Risk Engineering & Food Products Processing: Towards a Simulation-based Approach, Chemical Engineering Transactions, 87, 385-390 DOI:10.3303/CET2187065 CHEMICAL ENGINEERING TRANSACTIONS VOL. 87, 2021 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Laura Piazza, Mauro Moresi, Francesco Donsì Copyright © 2021, AIDIC Servizi S.r.l. ISBN 978-88-95608-85-3; ISSN 2283-9216 Risk Engineering & Food Products Processing: towards a Simulation-based Approach Simone Colomboa,c,d*, Laura Piazzab,c, Giulia Bozzanoa,c, Flavio Manentia,c a Politecnico di Milano, Department of Chemistry, Materials and Chemical Engineering “Giulio Natta” b Università degli Studi di Milano, Department of Environmental Science and Policy c Centre for Sustainable Process Engineering Research (SuPER) d Symlogik (spin-off of the Politecnico di Milano), Via dei Piatti, 3, 20123, Milano simone.colombo@polimi.it Designing food processes and keep them updated at the pace of innovation to face competition, consumers’ trends and sustainability precepts is all but an easy task to accomplish. The complexity is steadily increasing and, with it, the need to adopt a systemic, as well as systematic, approach in designing and maintaining food processes to avoid compromising their survival and to guarantee their steady efficiency. The use of scenarios to exploring the uncertainty associated with that complexity becomes essential to support designers and, even more broadly, all decision makers involved in the design and operation of a technological process. Risk engineering can play an important role in that direction as it allows to account for hazards and threats associated with the identified opportunities. In the food industry hazards related to the safety of food production are identified and assessed through the well-known, widely used and regulated methodology “Hazards Analysis and Critical Control Point (HACCP)”, whose application is nowadays fostered by the international standard ISO 22000. Yet, the HACCP, as many other methodologies applied in other sectors, fails to capture the complexity associated with food processes, thus leaving space for grey zones where inter- functional risks can grow and manifest. The manuscript presents how the Holistic Risk Analysis and Modelling (HoRAM) method can be conveniently applied to provide decision makers with the necessary information (scenario analysis) by assessing the technological element jointly with the human and organizational ones (i.e., a systemic approach). Further, the manuscript also explains how HoRAM allows to systemically and systematically account for the consequences that might be generated by each scenario and for the entire universe as a whole, thus allowing to include in the decision both the possibility of the unwanted outcomes and the associated effort needed to make them less likely or less severe. Finally, it explains how the scenarios produced can be managed at different level of abstraction to allow the analyst better understanding the problem analysed and the decision-maker the profile of the opportunity to pursue. 1. Introduction 1.1 Shortcomings of current approaches Adopting a risk-based approach (and not a simple opportunity-based one) in the design and management of productive processes allows to consider hazards and threats associated with the identified production opportunities. In the food engineering realm, hazards associated with the safety of food production are typically assessed through the “Hazard Analysis and Critical Control Point (HACCP)” (Sperber, 1991) methodology. There have been even attempts to use the HAZOP (Hazard and Operability Analysis) methodology (Mayes and Kilsby, 1989), which is widely known and used originally and primarily in the chemical and petrochemical industry. While the HAZOP has a process-driven approach, the HACCP whose application is fostered by the international standard ISO 22000, has a “punctual” approach (similarly to the Failure Mode and Effect Analysis methodology – MIL–P–1629, 1949) in the sense it identifies punctual safety risks in the process, thus leaving space for grey zones where inter-functional, systemic risks can grow and 385 manifest. The HACCP suffers from a threefold limitation, namely: 1) it fails to assess the systemic risks, 2) it does not allow to identify the entire spectrum of possible alternatives with which the productive system can manifest, and 3) it does not allow to account for the effect(s) of the selected solutions to mitigate the identified (punctual) risks on the overall productive system. 1.2 The importance of moving towards a simulation-based approach (scenario analysis) When the problem to analyse is complex (and food processes are complex systems), moving towards simulation-based approaches becomes a necessity more than a choice, on penalty of failing to capture the complexity and the associated risks that, in turn, might lead to supporting the decision-making process with a distorted vision of problems and an identification of solutions that might not mitigate the overall risk level. Simulation-based approaches can be broken down into two main typologies, namely: those driven by data and those driven by logic. In both cases the analyst is required to identifying the elective random variables (i.e., only those relevant to decision making problem at stake) and correlate them logically and stochastically, letting the burden to create the scenarios to the algorithm. The huge difference between the two approaches lies in that those driven by data are pure numerical simulations (i.e., they produce numerical results only) while those driven by logic are logic-stochastic simulations and, as such, they simulate both the logic and the stochastic side of the problem (i.e., they produce even the semantic of the scenarios generated). Further, data-driven approaches are constrained by the availability of data themselves (i.e., they can make previsions only whether there is already a recorded experience), while those driven by logic can create reliable previsions even without historical data (i.e., they can make previsions even without data on past events). Amongst the logic-driven methodologies there is the Holistic Risk Analysis and Modelling (HoRAM) method (Colombo, 2019) described in this manuscript (that, to the best knowledge of the authors, is the only methodology to date falling into this category). The HoRAM method demonstrated its adequacy to analyse even complex, highly uncertain decision-making problems like the supply of raw materials to support the energy transition (Ciotola et al., 2020). Goal of the subsequent sections of this manuscript is to explain, through a simple (yet not trivial) use case, how the HoRAM method can be conveniently applied even in the food industry to design resilient processes and keep them up to date to face competition, consumers’ trends and sustainability precepts. 2. The application of the HoRAM method to nectarines’ recovery In line with the ISO31000 spirit, the HoRAM method has been conceived to: 1) analyse the system/phenomenon by simultaneously accounting for the Human, the Technological, and the Organisational (HTO) elements; 2) generate all the logically possible scenarios associated with the identified elective variables; 3) accommodate the consequences associated to each scenario (for a risk-based identification of the critical variables/functions); 4) prioritise the critical variables/functions on the basis of their relative contribution to the overall risk; 5) manage the scenarios at different level of abstraction and for limited portions of the risk; 6) perform complex analyses in a manageable timeframe (unthinkable to achieve with traditional manual approaches); 7) provide decision makers with easy-to-interpret results allowing both to clearly decide where (and to what an extent) investing the resources and to justify why they have been invested in such a manner. Methodologically, to be accomplished the HoRAM process requires 3 phases, namely: 1) the phenomenon characterisation, 2) the risk level identification, and 3) the risk treatment. 2.1 The phenomenon characterisation (Phase 1) The first phase is meant to understand the phenomenon to be analysed and is the only step in the methodology that requires the manual activity of the analyst(s) (even with the support of free or commercially available software). Methodologically, it requires the formal representation, at functional level, of the overall Human-Technology-Organisation (HTO) system, namely: the technological components (both hardware and software), the human activities/tasks (the “liveware”) and the organisational roles and business processes (the “organisationware”). In the HoRAM perspective, this is achieved by deriving (up to) 4 types of schematisations (dependently on the problem tackled): 1) the Functional Analysis (FA), 2) the Command, Control and Communication Diagram (C3D), 3) the Task Analysis (TA), and, finally, 4) the Decision Action Diagram (DAD). The FA and the C3D are, so to say, preconditions to achieve a sufficient level of understanding of how the HTO system works, while the TA and the DAD might be deemed not necessary or performed just for some specific human activities, not least because they might turn out to be extremely time consuming. For a more detailed description of this phase, please refer to Colombo’s manuscript (Colombo, 2019). To better understand the HoRAM method it has been applied to analyse the transition European Food Banks (EFB) are facing today to shift from the receiver-distributor paradigm to that of receiver-transformer-distributor. More specifically, the use case focused on the “saving” of nectarines from waste as their valorisation (i.e., production and distribution) is geographically and temporally highly concentrated, thus putting high risks on 386 their valorisation by EFB. In Italy nectarines are prevalently produced in the three regions of Piedmont, Lombardy, and Emilia-Romagna and mainly distributed by food banks within the two months of July and August. The decision-making boundary conditions for nectarine-derived products are many, namely: 1) preserve as much as possible a high nutritional value, 2) extend as much as possible the shelf life of the processed products, 3) ease the distribution by EFB and charity structures, 4) ease the consumption even by those people who are most in need (i.e., homeless), 5) reduce the need for storage space by EFB and charity structures, 6) reduce as much as reasonably practicable the need for refrigeration by EFB and charity structures. 2.2 The risk level identification (Phase 2) The nutritional values and the associated extension of the shelf life in relation with the possible ways nectarines can be processed are summarised in Table 1. Table 1: Nutritional values of possible transformation alternatives to extend the shelf life of nectarines (USDA, 2011) The fresh fruit is clearly the best source of all in terms of nutritional values as each of its possible ways of transformation bears pros and cons with it. For example, sliced (fresh) fruit slightly extends the shelf life of the product, offers an easy consumption by the most indigents people (i.e., homeless), but it requires (a not negligible amount of) frigories to be maintained. Sterilized fruit juice is another good alternative as it significantly extends the shelf life at room temperature and it is easy to consume as typically packed in polylaminated cartons (even in the mono portions size), but it fails to provide sense of satiety. Dehydrated fruit has the advantage of being light, long-lasting at room temperature (given an appropriate packaging), and easy to consume by needy people, but it delivers a significant amount of calories (thus bringing with it even a consumption risk because normally eaten by low educated people not capable to assess the diet balance). In addition to the above-mentioned desiderata (i.e., design constraints), there are three other major challenges a process designer has to face to support the transformation of EFB, namely: 1) design a process flexible enough to treat, on the one hand, a small and large amount of raw material (nectarines) at the same time and, on the other hand, different type of raw materials (e.g., nectarines, other seasonal fruits) and at a different degree of maturation (donated raw material are typically not subject to any type of quality selection); 2) bring automation to EFB to an extent capable of satisfying the contradictory need of not being too high (as food banks are charitable organisations and, as such, they need to involve people in what they do) but not even too low as they might easily need to face a shortage of volunteers in the period needed to treat the raw material (nectarines, for example, are to be treated in the two months, July and August, of pick of vacation). Further, the automation has not to be too complex to manage as food banks can very seldom count on highly specialised skills (i.e., amongst volunteers is a rarity to find people holding a master degree and a professional experience suitable to manage the process). It ought to be clear that designing a process capable to deliver a service with such a high degree of uncertainty is not an easy task to accomplish and cannot be performed but approaching the problem from a risk-based perspective (i.e., a perspective capable to manage the uncertainty side of the problem in addition to the deterministic one). As a result of a preliminary phenomenon characterization, nectarine puree was selected for the case study, the product being in principle suited to the objectives of the EFB. Nectarines’ puree is produced by using ripe nectarines that are smashed and then sterilized. Nectarine’s puree is normally supplied aseptic (as it goes through a heat treatment) in drums, in bags-in-boxes or is delivered in single portion packaging. In the ALBA scheme (Colombo, 2016), the problem is to be modelled as a progressive sequence of binary (or binarized) random events (i.e., the elective random variables). To avoid ambiguities and ease the calculation of the probability values, each random event must be formulated in a way than can be easily verifiable whether the hypothetic gambler has lost or won the bet. The elective random variables are to be initially derived from Phase 1 and described according the ALBA syntax. Figure 1 shows an extract of the overall logic-stochastic model created to produce the fruit puree. Product Shelf Life Calories [kcal] Water [g] Carbs [g] Proteins [g] Lipids [mg] Vitamin A [mg] Vitamin C [mg] Calcium [mg] Iron [mg] Potassium [mg] Sliced Fruit 5 days @ 5°C 6-9 months frozen 39 88.87 8.7 0.8 5 0.1 6.6 6 0.25 190 Fruit Juice 12-18 months @ room T 54 85.64 13.9 0.27 0 0.08 5.3 5 0.19 40 Puree 24 months frozen 42.6 - 10.5 0.8 0 0.3 8 8 0.22 40 Light Jam 24 months @ room T 117 - 12.6 0.4 3 0.03 8.8 20 0.49 77 Dehidrated Fruit 6-12 months @ room T 357 3 8.8 0.48 9 0.05 5 62 0.25 122 Canned Fruit 12-18 months @ room T 72 80.62 14.9 0.5 0 0.11 3.6 6 0.27 128 387 Figure 1 – Extract of the logic-stochastic model created to produce the fruit puree Once the logic-stochastic model is created, the universe of scenarios (i.e., the partition) is generated through the cloud-based Klarisk® platform that produces the results both in the form of readable stories (left of figure 2), and overall numerical results of the stochastic simulation (right of figure 2). The advantage of producing even the logical part of the simulation is that it allows to check both the correctness and the meaningfulness of the results; something that with pure numerical simulations can only be achieved by interpreting the numerical results (with all the interpretational flaws that this might entail). Overall, the universe to produce fruit puree is made up of 1.021.811 possible scenarios (right of figure 2), with a probability cut of 1E-12 and a residual probability of 4.98E-07 (i.e., the sum of the probability of all scenarios not analysed). The first scenario, which is the one reflecting the design intent (i.e., the one where everything goes exactly as designed both technologically and organisationally) has a probability of occurrence of 38.3% (left of figure 2). Figure 2 – Extract of the first constituent/scenario (left) and overall numerical results of the simulation (right) But the first scenario is a subset of the entire universe made up of all scenarios concluding positively (despite the phenomenologically allowed failures). As Ahmed et al. (2010) highlighted, “currently available scenario management processes are cumbersome and not properly supported by available tools and technologies. They support neither the top-down approach — the breaking down of a scenario into executable and assessable component scenarios at various levels of abstraction; nor the bottom-up approach — the combining of small scenarios into the development of a high-level scenario that represents a complex set of problems”. The HoRAM method in this respect allows the analyst to nimbly manage the scenarios by selecting the logical conditions to satisfy in the selection matrix of the Klarisk® platform. Identifying which variables, amongst all of those considered in the model, are the most important in terms of relative contribution in producing the overall risk (and not just in terms of probability of occurrence) is of paramount importance (as it allows the decision maker to know where devoting the resources to mitigate the risk). In that respect, HoRAM produces as “final step” the Critical Functions List (CFL), which is the list of critical functions prioritised by contribution to the overall risk. Figure 3 shows the first five critical functions contributing to nearly 95% of the total risk (precisely 9.45937E+01 %). 388 Figure 3 – Critical Functions List (CFL) to produce fruit puree The results shown in figure 3 communicate to decision maker that, in the designed configuration (i.e., the original process to which it has been added a food processing module to produce nectarines’ puree), amongst the nearly hundred variables considered in the model, those that produce 95% of the overall risk are only five. 2.3 The risk treatment (Phase 3) According to the ISO3100 scheme, once the current risk level is identified, the risk is to be treated (i.e., modelled) to mitigate it. With traditional approaches the risk modelling task is extremely weak as the analyst(s) either assume that the efficacy of the solution(s) be positive even at system level or assess their impact heuristically as the risk analysis is not typically performed once again with the new configuration (i.e., with the solution(s) implemented). Yet, this is a very risky approach as the complexity of today systems is sufficiently high to make the heuristic anticipation of what might be the effect of the solution(s) on the behaviour of the system analysed well beyond the human cognitive capabilities (Dekker, 2014). It might then happen that the envisaged solutions are not just neutral to the risk, i.e., they do not diminish it, but they even increase it, thus bearing the decision-making process in the wrong direction. In the HoRAM perspective this condition would never occur as the goodness of the envisaged solution(s) has, methodologically, to be checked via both the well-known risk curve (i.e., the Complementary Cumulative Distribution Function) and the newly defined risk spectrum (i.e., the Risk Distribution Function). And the beauty of the approach is that this step requires a little effort, with respect to that needed to create the overall model, to accommodate the envisaged solutions and check their efficiency . Figure 4 – Comparison of CCDF and RDF for the current set-up and the designed one with puree production 389 Semantically, the risk curve tells the decision maker(s) whether each envisaged solution increases or decreases the risk, while the risk spectrum shows how it punctually changes (i.e., for each class) and whether it changes its (overall) profile. The left side of figure 4 (representing the CCDF) shows that the introduction of a food processing unit to produce fruit puree (blue line) significantly diminishes the risk throughout the entire consequence range, thus improving the current configuration without the food processing unit (red line). The right side of figure 4 (representing the RDF) shows, more precisely, that the introduction of the food processing unit has the effect of pushing the risk leftwards (i.e., towards lower impact values), thus allowing to significantly change in better its profile (i.e., reducing the exposure). The 2 major yellow picks in the right side of the spectrum would have been “transformed” into the many smaller blue ones at a lower impact. 3. Conclusions Adopting a risk-based (instead of an opportunity-based) approach to decision making is of paramount importance as it allows to include in the decision the unwanted outcomes and the effort that would be needed to make them less likely or less severe. Due to the increasing complexity of productive processes, appealing to simulation approaches to perform scenario analysis, to exploring the uncertainty and making clear what might be the impact of the different solutions, becomes essential to support decision makers. Further, to enable a risk-based approach, each possible scenario is to be coupled with the consequences it might produce and, altogether, the scenarios are to be consolidated to give rise to the overall risk. Finally, the overall universe of produced scenarios, coupled with their consequences, is to be systematically analysed to identify what are the variables (amongst those considered) that produce the overall risk and what is their relative weight. Within the world of simulation, the use of artificial logic (or logic-based artificial intelligence) has the invaluable, practical benefit to simulate even the logical part of the scenarios production (and not just the numerical one), thus allowing to check both the correctness and the meaningfulness of the results (i.e., the semantic of the scenarios generated). In the specific case of nectarines’ recovery, the HoRAM method allowed to create and analyse a partition of more than one million of mutually exclusive scenarios in a fist of minutes (with a normal laptop), which is a practically impossible objective to achieve with whatever manual approach. The preliminary results clearly showed that the potential benefits of introducing a food processing unit, to allow EFB recovering a higher number of nectarines, would worth the effort as the benefits seem to significantly outweigh the efforts (as the risk of losing nectarines would be significantly lower). This was made clearly evident from the risk level described by the risk curve (i.e., the CCDF) and the risk spectrum (i.e., the RDF). Further, the critical function analysis (the last and computationally most demanding step of the HoRAM process) allowed to highlight that, amongst the nearly hundred variables considered in the model, only five of them contribute to produce 95% of the risk. References Ahmed, D. M., Sundaram, D., Piramuthu, S., 2010. Knowledge-based scenario management — Process and support, Decision Support Systems, 49(4), 507-520, https://doi.org/10.1016/j.dss.2010.06.004. Ciotola, A., Fuss, M., Colombo, S., Poganietz, W.R., 2020. The potential supply risk of vanadium for the renewable energy transition in Germany. Journal of Energy Storage, 33, in press, https://doi.org/10.1016/j.est.2020.102094. Colombo, S., 2016. Risk-based Decision Making in Complex Systems: the ALBA Method. IEEE International Conference on Industrial Engineering and Engineering Management (IEEM), Bali 4-7 December 2016, 476-480, https://doi.org/10.1016/j.ssci.2018.09.018. Colombo, S., 2019. The Holistic Risk Analysis and Modelling (HoRAM) method. Safety Science, 112, 18-37, https://doi.org/10.1016/j.ssci.2018.09.018. Dekker, S., 2014. Safety Differently: Human Factors for a New Era. CRC Press. ISBN: 1482241994. Mayes, T., Kilsby, D.C., 1989. The use of HAZOP hazard analysis to identify critical control points for the microbiological safety of food. Food Quality and Preference, 1(2), 53-57, https://doi.org/10.1016/S0950- 3293(89)80002-3. MIL–P–1629, 1949. Procedures for Performing a Failure Mode, Effects and Criticality Analysis. U.S. Department of Defense. Sperber, W.H., 1991. Use of the HACCP System to Assure Food Safety. Journal of Association of Official Analytical Chemists, 74(2), 433–434, https://doi.org/10.1093/jaoac/74.2.433. U.S. Department of Agriculture, Agricultural Research Service. 2011. USDA National Nutrient Database for Standard Reference, Release 24 (http://ndb.nal.usda.gov/). 390