DOI: 10.3303/CET2290118 Paper Received: 7 January 2022; Revised: 19 March 2022; Accepted: 4 May 2022 Please cite this article as: Bragatto P., Milazzo M.F., Vairo T., Hansler R., Bellamy L.J., 2022, Control of plant ageing at Seveso sites: achievements in research and transfer to current practice, Chemical Engineering Transactions, 90, 703-708 DOI:10.3303/CET2290118 CHEMICAL ENGINEERING TRANSACTIONS VOL. 90, 2022 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Aleš Bernatík, Bruno Fabiano Copyright © 2022, AIDIC Servizi S.r.l. ISBN 978-88-95608-88-4; ISSN 2283-9216 Control of Plant Ageing at Seveso Sites: Achievements in Research and Transfer to Current Practice Paolo Bragattoa,*, Maria Francesca Milazzob, Tomaso Vairoc, Rikkert Hanslerd, Linda J. Bellamye a INAIL Italian Workers’ Compensation Authority, v. Fontana Candida,1 00078 Monteporzio Catone (RM), Italy b Università di Messina Dipartimento di Ingegneria, C.da di Dio, 98158 Sant’Agata Messina Italy c ARPAL Agenzia per la protezione dell’ambiente ligure Via Bombrini, 8, 16149 Genova Italy d RIVM National Institute for Public Health and the Environment, Bilthoven, Netherlands e White Queen BV, PO Box 712, 2130 AS Hoofddorp, Netherlands p.bragatto@inail.it This paper addresses the issue of “ageing”, which for over a decade has been recognised as one the most relevant causes of accidents in chemical and oil industries. The EU Legislation explicitly mentions to manage ageing in the Directive Seveso III. Following the implementation of the Directive in national legislations, regulators had a few initiatives, including the publication of guidelines and recommended practices. Yet ageing is a very complex issue involving both technical and organizational factors. The greatest concern is the integrity of static containment systems, including pipes and vessels, where rupture may cause major losses of hazardous materials. Dynamic containment systems, including rotating machinery, are also important. The paper discusses a few practical solutions adopted by regulators in Europe, focusing on Italy and the Netherlands. Since 2018, Italian Authorities require the inspectors in charge to evaluate the adequateness of the ageing control programs of upper-tier Seveso sites by means of a codified protocol. The method has been developed with the collaboration of Regulators, Academia, and Industry. In three and more years of application, essential data about plant ageing of hundreds of Seveso sites were collected. This allowed a first statistical balance of ageing of Italian sites, as well as an assessment of the effectiveness of the Italian method. In order to place it in a broader context, these results are compared with related methods and findings about ageing in the Netherlands, obtained from investigated accidents 2004-2018. Introduction The Seveso III Directive (Directive 2012) stressed the need to integrate planned activities to control the hazard of corrosion and, more generally, the ageing of plants into the safety management system. The Directive did not give detailed indications on how to verify the adequacy of these plans during the inspections, which are required by art. 20, and left the freedom to implement the controls in the most appropriate ways. The “ageing” issue involves various aspects of safety management, including the knowledge of the deterioration mechanisms (physical, chemical and biological), the management of protective systems against corrosion, inspection methods and technologies, personnel skills, the adoption of recognised standard, maintenance strategies, the management of technical changes and documentation. These factors can mitigate or intensify and accelerate or decelerate the consequences of degradation mechanisms. From the regulator’s point of view, it is important to understand what the requirements of an ageing management programme are and how its appropriateness may be evaluated in a simple but equitable way. Whilst there are thousands of papers on deterioration mechanisms and control techniques, there are just a few papers addressing the evaluation of ageing plants. Amongst these the most relevant are mentioned in the following: Sobral and Ferreira (2015) proposed a methodology to determine the optimal inspection intervals for assets affected by ageing; Andrews and Fecarotti (2017) developed a method aimed at assessing equipment ageing, which considered different factors assumed relevant for ageing (including age, use, condition, inspection, repair and modifications), through a combined a 703 Petri net and a Bayesian network approach; Mohamed et al. (2019) identified, ranked, prioritised and grouped 28 critical factors for the successful implementation of risk based inspection (RBI) techniques. 1. Objectives The general ambition of this work is to promote the sharing of methods for ageing management among stakeholders, including plant operators, competent authorities, and inspectors. The attention is focused on two countries, Italy and the Netherlands that have been particularly attentive to this issue and have dealt with it in an exhaustive way. The aim is to provide useful suggestions for other European countries, which must manage the problem of ageing of Seveso plants. 2. Methods 2.1 The Ageing Fishbone Method The Italian response to the indications of the Directive was very concrete and practical. The national transposition legislation (Decreto Legislativo, 2015) faithfully reproduces the text of the Directive and requires the operator to prepare a plan to control ageing-related hazards, moreover, by means of the list of feedback of inspections, it makes very clear the obligation for Seveso inspectors in verifying the adequacy of this plan. The coordination unit for the uniform application of Seveso of the Ministry of Environment, which is the competent Authority for Seveso Legislation, decided to provide inspectors with a practical method to verify the adequacy of ageing management. It ensures reliable results without lengthening the inspection times, or burdening the tasks assigned to the establishment management. To develop a guideline, a working group was established. It defined the practical method starting from previous research, which weighted the various factors that could accelerate or decelerate the ageing of equipment (Bragatto and Milazzo 2016). The method was conventionally called AFB (Ageing Fishbone Method). The keys to the success of the method were the use of simple criteria that allow for a shared synthesis and, above all, the ability to bring together in the evaluation both technical and human-organisational factors. The method consists of some forms to be filled in: six for the factors that accelerate the ageing and six for those promoting longevity (in other words decelerating the ageing). The forms are always filled in with quantitative and easily verifiable data. In any well-organised Seveso establishment, the required data are easily available, but often they are separately managed amongst different departments, in particular the maintenance and HSE (health, safety and environment) departments. For an effective management, it is essential that within the safety management system, which usually refers to the HSE unit, there is a very close and continuous involvement of the maintenance department and, in particular, the integrity inspection unit. The diagram in Figure 1 represents the AFB method by referring to the first version of the guideline. In the upper part of the figure the ageing or accelerating factors (red) are shown, in the lower one there are the longevity or decelerating factors (green). The method is based on a scoring system. Scores range from 1 to 4 for all factors. Ageing factors have a negative weight, while longevity factors have a positive weight. A balance between negative and positive scores is the necessary condition for having a positive evaluation of the ageing management system. Most of the “physical” factors are related to the material, operating parameters, and conditions of the equipment and, therefore, their evaluation must be repeated for each individual containment system classified as critical for the release of hazardous materials. For “organisational” factors, including the inspection management system, inspection visits and control standards, the assessment must be made only once for the entire plant. In Figure 1, accelerating factors are in red boxes, whilst decelerating ones are in green boxes. The pressure vessel icon indicates technical factors. The factory icon represents organisational factors. There is no room in this article for a full discussion of all factors, details can be found in a previous publication (Milazzo and Bragatto, 2019). Here it is important to highlight the application of some criteria, such as the role of standards and the importance of the gathered experience. The adoption of recognised standards and, alternatively, recognised good practices are promoted by assigning higher scores to specific factors. Eligible documents for ageing management include API 581 (API 2016), EEMUA 159 (EEMUA 2018), EN 16991 (CEN 2018). The adoption of recognised standards for the qualification of personnel assigned to controls (ISO 2012) and functional safety (IEC 2016) also gives rewarding in the calculation of the overall index. If recognised standards or guidelines are not available, the experience gained in over twenty years of systematic application of Seveso has provided the references to calibrate the method. The method was published by the National Competent Authority in 2018 and entered immediately in force. The working group did not finish the activities with the first version, but after the initial period of application of the AFB, it tried to collect the difficulties and criticisms of inspectors, as well as the suggestions of managers. Thus, the version 2.0 of the guideline was born, released after 3 years from the first version. The new version maintains 704 the original scheme of factors and sub-factors that negatively or positively contribute to equipment ageing. The main novelty is the extension of the applicability to dynamic systems that were not included in the first version. In process plants the most important dynamic systems are rotating machines, as their failures are the cause of major accidents. The idea of including both static and dynamic in the same management system was, initially, introduced by the RIMAP project (Stanojevic et al., 2015) and implemented in EN 16991 (CEN 2018). The factor “stops” obviously does not apply to dynamic systems as well as “physical protections” and even “mandatory inspections”. In Figure 1, the extensions factors that can be applied to dynamic systems in version 2.0 are highlighted in yellow; the pump icon represents those relevant to control the ageing of rotating machinery. 2.2 The Dutch approach The Directive 2012/18/EU Seveso III was implemented in the Netherlands as the Major Accident Hazards Decree or BRZO (BRZO, 2015), which is elaborated upon in the Major Accident Hazards Regulation or RRZO (RRZO, 2016) and further explained by supporting guidance (PGS6, 2021). Seveso III states that operators should have a general obligation to take all the necessary measures required to prevent major accidents, to mitigate their consequences and to take recovery measures. A scenario-based approach is adopted in the Dutch regulation to enable companies to demonstrate that they have done so. Upper-tier sites are required to use a selection of specific installation loss of containment (LOC) accident scenarios that are sufficient for demonstrating that the major-accident hazards are managed in an adequate manner. These scenarios are addressed in a software tool and model, called Storybuilder which is described elsewhere (Bellamy et al. 2007, 2012, 2013). Storybuilder is used by the National Institute for Public Health and the Environment (RIVM) to capture the sociotechnical aspects of accident scenarios that have occurred in Dutch installations and to provide information on the results. The model is a bow-tie structure built up of a number of lines of defence and the accidents are analysed in the model as a sequence of failure events (e.g. using incorrect material for the containment or a connection) and occasional success events (e.g. in limiting the effects of a release). The model includes technical components (safety barriers), the underlying management system components and the interfacing human tasks at the front line. The database has been built up over many years, from analysing the investigation reports of the Major Hazard Control Inspectorate of the Ministry of Social Affairs and Employment (Kooi et al., 2020). There are currently 326 accidents involving hazardous substances that occurred at major hazard chemical companies between 2004 and 2018 in the database. Of these 279 are from top tier Seveso sites. As well as providing important learning information on causes of loss of containment accidents, these data are used in reporting to parliament on the state of safety in the Netherlands with respect to Seveso sites. It was possible to extract ageing-related scenarios from the database, including underlying causes. In this paper, the focus is just on material ageing scenarios, primarily concentrating on the events leading up to loss of containment. In the period 2005-2016, there were 70 material degradation scenarios in the upper-tier Seveso installation data set which constitutes 25% of all the upper-tier accidents. 705 2.3 Common European Criteria The Major Accident Hazard Bureau of the EU Commission, to support national regulators, issued the “common inspection criteria” on the maintenance of containment systems (CIC 2019). This is not a standard or a guideline but just a short document, providing a few suggestions for conducting uniform inspections on the ageing management of a Seveso establishment. It includes atmospheric and pressure vessels, pipelines and rotating machinery and recommends the inspectors to verify that the operators have a sound knowledge of the degradation mechanisms, a careful management of inspection and maintenance information along the plant lifecycle and an adequate monitoring of the actual condition of containment systems. Even a few organisational issues relevant to ageing are mentioned. 3. Results 3.1 Results in Italy There were high expectations in 2018, when the method was published, because in the previous decade at least one third of major accidents were attributed to equipment ageing. During the past 3 years, no ageing- related accident occurred in Italy and the AFB method has been applied on a national basis for inspections in Seveso establishments. As reported in a recent paper (Marazzo and Vazzana, 2021), in August 2021, there were already 160 upper-tier establishments in which the method had been applied. In some 80% of cases, the inspectors found a correct management of the mechanical integrity of plants and equipment. However, critical issues emerged in 30 sites, which led to recommendations or prescriptions. Recurring non-compliances include the lack or non-application of asset integrity plans, except for mandatory obligations, the lack of knowledge of the deterioration mechanisms and the difficulty of estimating the residual useful life. 3.2 Results in the Netherlands Among the 70 accidents mentioned in Section 2.2, there were 58 accidents with no victims (83%) and 12 with twenty-five victims with injuries (17%), at least seven victims requiring hospitalization but there were no deaths. The main direct causes of LOC were corrosion (57%) and fatigue (27%) as shown in Table 1. Table 1: Direct causes of loss of containment in the 70 material degradation accidents Direct cause Number of ageing accidents % of ageing accidents Corrosion 40 57% Fatigue, creep, embrittlement 19 27% Vibrations 5 7% Erosion 1 1% Material degradation, other 5 7% Figure 2 gives the results for the 70 accidents as shown in the three lines of defence of the Storybuilder bow-tie model. The key ageing direct causes are corrosion (C), fatigue (F), a few cases of vibration (V) and one case of erosion (E). The lines in the diagram represent accident pathways through the model. The dominant safety barrier failures are those related to controlling the process conditions with respect to material degradation (47%) and secondly the materials of the containment (36%). Design factors (14%) and assembly of connections (14%) also play an important role. A significant factor in the second line of defence is the lack of indications of the deviations (64%). Without an indication, there can be no detection, diagnosis or response. In 13% of accidents the signals were not detected while diagnosis and response constitute 15% of failures to recover. The recovery failures lead primarily to failure of the primary containment. Mostly there is no applicable protection against the effect of recovery failure meaning that the event will simply escalate to a release. Regarding underlying causes, the model captures the factors that fail to support the barriers in the lines of defence. These are the management delivery systems, which provide the resources to the front-line tasks supporting the operation of the barriers, and the performance of the front line tasks themselves. Table 2a shows the delivery system failures for the first and second lines of defence. Note that there are up to 3 delivery system failures per barrier per accident and an accident can have more than one barrier failure. Failure to deliver procedures/planning to the task is clearly the most frequent failure (40% & 37%), followed by equipment and competence, although equipment delivery failures seem to be less for the recovery barrier. Procedures refer to specific performance criteria that specify in detail, usually in written form, a formalised 'normative' behaviour or method for carrying out tasks. Plans refer to explicit planning of activities in time. It includes maintenance regime, maintenance scheduling (including shutdown planning), and testing and inspection activities. This delivery system also refers to rules, permits, programs and risk assessments. The large number of unknowns for the management delivery systems indicate that the investigation reports are 706 missing information on these underlying causes. With the barrier task failures however, the unknowns are much less as shown in Table 2b. Here for the first line of defence, failure to maintain/inspect/test the barrier is dominant (53%) but not so in the second line of defence for recovery (16%). Note that here there can only be one task failure per barrier per accident but accidents can have more than one barrier failure. For the second LOD, providing a barrier for recovering from deviations is the dominant task failure (37%). Providing the barrier is important in both LODs. Failures in operating the barrier are less frequent. Finally, there is only one case of failure in supervising the barrier tasks for both LODs. Figure 2: Pattern of 70 material degradation failures (on the left-hand side (causes) of the Storybuilder bow-tie). Table 2a: 1st line of defence (2nd LOD recovery) underlying delivery system failures. Table 2b: 1st line of defence (2nd LOD recovery) underlying barrier task failures Management delivery system failure no. of ageing accidents % of ageing accidents Barrier task failures no. of ageing accidents % of ageing accidents Procedures/planning 28 (26) 40% (37%) Maintain/inspect/test barrier 37 (11) 53% (16%) Equipment 17 ( 5) 24% ( 7%) Provide barrier 27 (26) 39% (37%) Competence 12 ( 7) 17% (10%) Operate barrier 10 (17) 14% (24%) Safety motivation/awareness 7 ( 7) 10% (10%) Supervise barrier tasks 1 ( 1) 1% ( 1%) Conflicting goals resolution 4 ( 1) 6% ( 1%) Unknown 9 (15) 13% (21%) Communication/collaboration 2 ( 1) 3% ( 1%) Ergonomics 1 ( 1) 1% ( 1%) Unknown 29 (35) 41% (50%) 4. Conclusions The ageing issue, after ten years, is not yet “out of fashion”. On the contrary, the ecological transition is complicating the matter. All governments plan to replace current fuels and raw materials with carbon-free alternatives within, hopefully, fifteen years. Investments will reasonably be concentrated on new eco-sustainable plants, while for traditional products the existing aged plants will continue to be used and, consequently, attention to the risks associated with the ageing has to increase. In the transition phase, furthermore, existing plants will be used for new products. Existing tanks and lines can be used for eco-sustainable fuels (blue or green), if in 707 adequate condition. The deterioration mechanisms and the related control systems will have to be carefully reconsidered, to guarantee the required safety levels over time. To maintain a higher attention on ageing issue, national regulators should develop multifactor methods for ageing evaluation, such as the pioneering Italian AFB. In these frameworks, the understanding of the underlying causes of ageing related accidents, presented in Section 3.2, is essential to prioritise the factors and to steer, consequently, the development of the methods. Pervasive monitoring and health prognostics are now possible, thanks to the enabling technologies of industry 4.0. They have the potential to extend the safe life of aged plants, at least until the day when they will be replaced by the new ones, based on carbon-free processes. Thus, in the meantime, the ageing evaluation method must evolve to include pervasive monitoring and prognostic techniques. Last, but not least, obsolescence and organisational ageing should be integrated in the future guidelines. References Andrews, J., Fecarotti, C., 2017. System design and maintenance modelling for safety in extended life operation. Reliab. Eng. and Syst. Saf. 163, 95–108. API, 2016, Risk-Based Inspection Methodology. API RP 581 3rd ed., Washington DC, US. Bragatto P., Milazzo M.F. 2016, Risk due to the ageing of equipment: Assessment and management, Chemical Engineering Transactions, 53, 253-258. Bellamy, L.J., Ale B.J.M., Geyer T.A.W., Goossens L.H.J., Hale A.R., Oh J., Mud, M., Bloemhof A, Papazoglou I.A., Whiston J.Y., 2007. Storybuilder - A tool for the analysis of accident reports. Reliab. Eng. and Syst. Saf. 92, 735–744 Bellamy, L.J., Lisbona, D., Johnson, M., Kooi, E., Manuel, H.J., 2012. The major accident failure rates project: Concept phase. UK Health & Safety Executive, RR915. https://www.hse.gov.uk/research/rrhtm/rr915.htm Bellamy L.J., Mud M., Manuel H., Oh J.I.H., 2013. Analysis of underlying causes of investigated loss of containment incidents in Dutch Seveso plants using the Storybuilder method. J. Loss Prev. Process. Ind., 26, 1039-1059 BRZO 2015. Besluit risico's zware ongevallen. Kingdom of the Netherlands. EN version: https://www.arboineuropa.nl/wp-content/uploads/2016/12/Besluit-risicos-zware-ongevallen-ENG-1.rtf CEN, 2018, Risk based inspection framework (RBIF). EN 16991 1st ed. Brussels, B CIC, 2019 Maintenance of Primary Containment Systems – Common Inspection Criteria. n° 9 https://minerva.jrc.ec.europa.eu/EN/content/minerva/f30d9006-41d0-46d1-bf43-e033d2f5a9cd/publications EEMUA, 2018, Above ground flat bottomed storage tanks. Guideline 159 5th ed. London UK. Decreto Legislativo 26 giugno 2015 n. 105 Attuazione della direttiva 2012/18/UE relativa al controllo del pericolo di incidenti rilevanti. Gazzetta Ufficiale della Repubblica Italiana 14-07-2015 n.161 s.o. n. 38. Directive 2012/18/EU of the European Parliament and of the Council on the control of major-accident hazards involving dangerous substances Official Journal of the European Union 24 July 2012 L 197 Volume 55 IEC, 2016, Functional safety: Safety instrumented systems for process industry sector, IEC61511, Geneva CH ISO, 2012, Non-destructive testing - Qualification and certification of NDT personnel, ISO9712, Geneva CH. Kooi, E.S., Manuel, H.J., Mud, M., Bellamy, L.J., 2020. Fifteen years of incident analysis. Causes, consequences, and other characteristics of incidents with hazardous substances at major hazard companies in the period 2004-2018. RIVM report 2020-0115. https://www.rivm.nl/bibliotheek/rapporten/2020-0115.pdf Marrazzo, R. Vazzana,F. 2021 La gestione dell’ageing negli stabilimenti Seveso nazionali: analisi di incidenti e buone pratiche ispettive in Atti Convegno SAFAP INAIL ISBN 978-88-7484-709-9 pp.352-358. in Italian. Milazzo, M.F., Bragatto, P.A., 2019. A framework addressing a safe ageing management in complex industrial sites: The Italian experience in «Seveso» establishments. J. Loss Prev. Process. Ind. 58, 70–81. Mohamed, R., Che Hassan, C.R., Hamid, M.D., 2019. Critical success factors of risk-based inspection. Process Saf. Prog. 38 (1), 4–20. PGS6, 2021 Directions for applying the Seveso paragraph in the Bal. Appendix G Installation Scenarios [In Dutch]. Publication series Dangerous Substances 6:2021 version 0.1 (March 2021). https://publicatiereeksgevaarlijkestoffen.nl/publicaties/PGS6.html RRZO, 2016. Regeling risico’s zware ongevallen. Kingdom of the Netherlands. NL version https://wetten.overheid.nl/BWBR0037692/2016-03-04 EN version: https://www.arboineuropa.nl/wp- content/uploads/2016/12/Regeling-risico%E2%80%99s-zware-ongevallen-ENG-1.rtf Sobral, J., Ferreira, L., 2015. Establishment of optimal physical assets inspection frequency based on risk principles. Mainten. Reliab. 17 (2), 243–249. Stanojević, P., Jovanović, A., Kirin, S., Misita, M., Orlić, B., & Eremić, S. (2015). Some achievements in RBIM implementation according to RIMAP approach. Structural Integrity and Life, 15(2), 79-84. 708 https://www.hse.gov.uk/research/rrhtm/rr915.htm https://www.arboineuropa.nl/wp-content/uploads/2016/12/Besluit-risicos-zware-ongevallen-ENG-1.rtf https://minerva.jrc.ec.europa.eu/EN/content/minerva/f30d9006-41d0-46d1-bf43-e033d2f5a9cd/publications https://www.rivm.nl/bibliotheek/rapporten/2020-0115.pdf https://www.arboineuropa.nl/wp-content/uploads/2016/12/Regeling-risico%E2%80%99s-zware-ongevallen-ENG-1.rtf https://www.arboineuropa.nl/wp-content/uploads/2016/12/Regeling-risico%E2%80%99s-zware-ongevallen-ENG-1.rtf lp-2022-abstract-097.pdf Control of Plant Ageing at Seveso Sites: Achievements in Research and Transfer to Current Practice