DOI: 10.3303/CET2291047 Paper Received: 5 March2022; Revised: 7 April 2022; Accepted: 4 May 2022 Please cite this article as: Vairo T., Benvenuto A.C., Tedeschi A., Reverberi A., Fabiano B., 2022, Make Bow-tie Dynamic by Rethinking It as a Hierarchical Bayesian Network. Dynamic Risk Assessment of an Lng Bunkering Operation, Chemical Engineering Transactions, 91, 277-282 DOI:10.3303/CET2291047 CHEMICAL ENGINEERING TRANSACTIONS VOL. 91, 2022 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Valerio Cozzani, Bruno Fabiano, Genserik Reniers Copyright © 2022, AIDIC Servizi S.r.l. ISBN 978-88-95608-89-1; ISSN 2283-9216 Make Bow-tie Dynamic by Rethinking it as a Hierarchical Bayesian Network. Dynamic Risk Assessment of an LNG Bunkering Operation Tomaso Vairoa*, Agostino C. Benvenutob, Amalia Tedeschic, Andrea P. Reverberid, Bruno Fabianoa aDICCA – Civil, Chemical and Environmental Engineering Dept – Genoa University, Via Opera Pia, 15 – 16145 Genoa, Italy b Studio di Ingegneria Benvenuto & Associati, Via Corsica, 10, 16128 Genoa, Italy c Comando Provinciale del Vigili del Fuoco di Genova, Via Albertazzi 2, Genoa, Italy d DCCI - Department of Chemistry and Industrial Chemistry, Genoa University, via Dodecaneso 31, 16146, Genoa, Italy tomaso.vairo@edu.unige.it In the present era, the spread of cyber-physical systems in the framework of the so-called Industry 4.0, is leading towards a complete automation of industrial processes, which are increasingly decentralized, smart, and require fewer and fewer frontline personnel. The risk assessment process is certainly not excluded from the revolution, and in perspective needs to be automatic, dynamic and linked with the conditions that emerge, moment by moment, in the life of a complex system. Analytical techniques can help in converting data in information and hence system knowledge to spot trends in operational performance, thus improving risk assessment quality. Even though the bow-tie approach is widely used within the context of complex systems, it still evidences several limitations, mainly connected to the actual assessment of likelihood and interdependencies in the fault and event trees. This paper shows how a bow tie analysis can be reframed as a Hierarchical Bayesian Network, where the probability distributions of the network nodes are updated with real time predictions during the operations. The proposed model was then applied to the risk assessment of a shore-to-ship LNG bunkering operation. 1. Introduction Digitalization and industry 4.0 revolution is leading toward complete plant automation, with sensors and data streams allowing observations and machine learning and artificial intelligence-based methods allowing hidden abnormal features detectable. Sustainability issues drive towards integration of risk and LCA (Vianello et al., 2022) and at the same time, transient operations behaviour is available for risk analysis and as shown by Osarogiagbon et al. (2021), big data can train artificial intelligence to develop models supporting decision- making and effective risk assessment. In the design and implementation of reliable operational control systems, one of the critical issues to be addressed in the risk assessment is the coexistence of Boolean elements (e.g. failure of instruments) and analogical elements (deviation of process variables). In fact, the results of the risk analysis are conventionally obtained from logical concatenations of barrier failures and events and are characterized by a Boolean (true/ false) approach. What is not yet completely evaluated is the transition between a safe state and a risk state, considering that the transition between the states is reflected in the absence of required control barriers. The bow-tie method is a well-established risk assessment tool, widely used within the broad context of complex systems. It describes the effects of root causes on a top event and explains the resulting consequences, taking into account the effectiveness of barriers and the influence of the escalation factors. Bow-tie was approached by Ding et al. (2020) to assess the adequacy and efficacy of safety barriers in reducing storage fire risk, Alves et al. (2021) supported by it the management of onshore pipelines operational risk and Brown et al. (2021) investigated inherent safety options for emerging pandemic hazards. However, the bow-tie approach suffers several recognized, limitations, mainly connected to the actual assessment of likelihood and interdependencies in the fault and event trees. Additionally, management processes and possible 277 shortcomings modify probabilities of failure-on-demand of the safety barriers to different extents, depending on the type of safety barrier (passive, automated, or human action related). Some limitations of the tool were faced by, Badreddine and Amor (2013) who relying on a Bayesian approach constructed bow-tie diagrams from actual data implementation to evaluate appropriate preventive and protective barriers dynamically. This paper aims at providing a flexible framework towards bow-tie analysis transposition as a Hierarchical Bayesian Network (HBN), for a wide range of accident scenarios. In order to dynamically assess the system safety, the probability distributions linked with the nodes of the network are updated in real time while collecting evidences during the operations, giving the chance of intercepting the emerging risk path by identifying the precursor events. Starting from this observation, in the present paper, is presented a dynamic approach to the operational control through a hybrid system based on the prediction of critical variables, from one side, and the consequent automatic updating of the risk assessment parameters. As proof of concept, the framework was applied to the risk assessment of a shore-to-ship LNG bunkering operation. 2. Theoretical background The approach incorporates several AI systems into a comprehensive and interconnected logic, namely soft sensors, which have a solid predictive capacity on process variables (Vairo et al., 2021a) and hierarchical inferential systems, which explore the interdependencies between system components in relation to the fluctuation of process variables. The soft sensors, based on deep neural networks, rely on the real-time monitoring network of the critical process variables and are able to predict the trend of the same variables on a suitable time scale (usually half an hour later) during the ongoing operations. Subsequently, the hierarchical Bayesian network, receiving as inputs the predicted trends of the critical variables, updates the bow-tie risk parameters, as quantified in the fault and event trees. Accordingly, dynamic probability distribution for the Top Events and the possible evolving scenarios are attained. Bayesian hierarchical modelling is a statistical model written in multiple levels (hierarchical form) that estimates the parameters of the posterior distribution using the Bayesian method. The sub-models combine to form the hierarchical model, and Bayes' theorem is used to integrate them with the observed data and account for all the uncertainty that is present. The result of this integration is the posterior distribution, also known as the updated probability estimate, as additional evidence on the prior distribution is acquired (Allenby et al., 2005). An overview of the proposed method structured into five main steps and several sub-steps, is presented in Figure 1. Figure 1: Logical flowchart of the proposed method Hierarchical modelling is used when information is available on several different levels of observational units. In the outlined framework, we consider relevant sources of information the following ones: prior probabilities obtained by Fault and Event Trees; boolean failures and predictions on critical variables values. As widely known, Bayesian hierarchical modelling makes use of two notable concepts in deriving the posterior distribution, namely Hyperparameter: parameters of the prior distribution and Hyperpriors: distributions of hyperparameters. Suppose a random variable Y follows a normal distribution with parameter θ as the mean and variance 1, i.e.: Y | θ ~ N(θ, 1) (1) Suppose that the parameter θ has a distribution given by a normal distribution with mean μ and variance 1: θ | μ ~ N(μ, 1) (2) Furthermore, μ follows another distribution given, for example, by the standard normal distribution, N(0, 1). The parameter μ is called the hyperparameter, while its distribution given by N(0, 1) is an example of a hyperprior distribution. The notation of the distribution of Y changes as another parameter is added, i.e.: Y | θ, μ ~ N(θ, 1) (3) 278 Considering another stage, μ, characterized by normal distribution mean β and variance ε, meaning μ ~ N(β, ε) (4) β and ε can be defined hyperparameters characterized by their hyperprior distributions as well (Lee et al., 2021). For a 3-stage hierarchical model, the posterior distribution is provided as follows: 𝑃(𝜃, 𝜑, 𝑋 |𝑌) = 𝑃(𝑌 | 𝜃) 𝑃(𝜃 |𝜑) 𝑃(𝜑 |𝑋) 𝑃(𝑋) 𝑃(𝑌) (5) The hierarchical modelling can easily fit the bow-tie structure, in which each stage can be represented with a hierarchical level of the Bayes net. The hierarchical network is turned in a predictive tool by incorporating, as evidences, the prediction of critical variables trend, obtained considering it a part of a Hidden Markov Model (HMM). A HMM is a generative probabilistic model, in which a sequence of observable X variables is generated by a sequence of internal hidden states Z. The hidden states are not observed directly. The transitions between hidden states are assumed to have the form of a first order Markov chain. They can be specified by the start probability vector π and a transition probability matrix A. The emission probability of an observable variable can be any distribution with parameters θ conditioned on the current hidden state. Consequently, the HMM is completely determined by π, A and θ. The predicted trend of critical variables is then affecting the risk parameters, which are updated in real time. 3. Applicative Case Study Recently, ship propulsion considering LNG as a possible fuel (with dual fuel marine engines installed on board) has favoured important discussions about LNG supply chain and delivery on board to the ship power plant (Vairo et al., 2021b). On these grounds, in order to assess the capability of the approach, a LNG Shore-to-Ship bunkering operation was analysed considering in detail all the physical components, the structural elements and components along with their interactions. The transfer unit is equipped with following critical components, affecting barrier effectiveness: quick release hooks; fenders; dock monitoring system to check the ship's position and speed of approach, weather and sea conditions; pier control room. The quick release hooks will be installed on the dock. All hooks are capable of moving both vertically and horizontally and each is designed to be released independently of the other. The pier control room is equipped with controls for the emergency stop of the LNG transfer, for the release of the LNG transfer connection and equipment for the remote control of the fire extinguishing system. The Ship-to-Shore connection is used to reciprocally exchange Emergency Shut-Down (ESD) between the ship and the ground system. The connection between the ship and the plant takes place via a loading arm, with two independent lines: one for the liquid phase (LNG) discharged from the ship to the plant and a flexible line for the gas phase (steam return from the plant to the ship); vice versa, the steam to the plant and the LNG to the ship, during the bunkering of a barge. The critical safety devices of the loading arm are identified as follows: - a quick release system (Powered Emergency Release Coupling - PERC); - a PLC for the loading arm connected to the Basic Process Control System (BPCS) of the plant, integrated into the Hydraulic Processing Unit; - the arm connected to the ship by means of 2 flanged connections, one for the liquid and one for the vapor. The operations of connection/disconnection of the loading arm are continuously monitored through the control system (pressure gauges and thermometers). The critical lines are the liquid line (nominal diameter 10” and the vapour line (nominal diameter 8”). 3.1 Bunkering operation Risk Assessment The main causes of loss of containment during bunkering reside in the coupling operation of the bunkering manifold to the receiving vessel and are due to damage to the connection pipe during normal operations and SIMOPS (simultaneous operations). During bunkering operations, loss of containment can occur in different parts of the process. In particular, the situations that can lead to a loss of containment concern failures of critical equipment and failures of the receiving vessel. Figures 2, 3, 4 represent the logical development of the simplified risk assessment, including respectively Fault Tree, Event Tree and overall Bow-Tie. It is well worth noting that given the inherent hazard of handled material, a better and more detailed description of all the possible outcomes and of the relative probabilities should include a refined evaluation of the ignition taxonomy considering on a statistical basis, immediate, delayed local and remote ignition probability (Vairo et al., 2021c). 279 Figure 2: FTA for bunkering operation Figure 3: ETA for bunkering operation Figure 4: Bow-Tie for bunkering operation 4. Results and discussion The bow-tie is transposed into a HBN by developing a specific .xml files, analogously to the approach by (Zurheide et al., (2021) introducing all logical dependencies and barriers. Table 1 refers to intermediate events. Table 1: First level dependencies: intermediate events ESD X1 (or gate) ESD (works – PD Tab.1) X1 (works - inference) ESD (works – PD Tab. 1) X1 (fails - inference) ESD (fails – marginal Tab.1) X1 (works - inference) ESD (fails – marginal Tab.1) X1 (fails - inference) LNG (works) 1 1 1 0 LNG (fails) 0 0 0 1 280 According to the logic framework previously outlined, root failures (leaks from flanges, valves, breakage or detachment of the hose, etc.) are correlated with the trend of critical process variables (temperature, pressure, as monitored by the control system) through a hidden state Markov model (HMM). The sequences predicted by the HMM, are integrated in the form of evidences into the HBN, which consequently updates the risk parameters, as visualized in the Tables 2-3. Table 2: Root events probabilities update Stage Expected probability State PDF ESD (works) 0.99998 Safe Hose (works) 1 Safe S_Pipeline (works) 0.99999 Safe S_Flanges (works) 0.99997 Safe B_Pipeline (works) 0.99989 Safe B_Flanges (works) 0.99982 Safe Table 3: Second level dependencies: intermediate events Shore Bunker Hose Shore (w) Bunker (w) Hose (w) Shore (w) Bunker (w) Hose (f) Shore (w) Bunker (f) Hose (w) Shore (w) Bunker (f) Hose (f) Shore (f) Bunker (w) Hose (w) Shore (f) Bunker (w) Hose (f) Shore (f) Bunker (f) Hose (w) Shore (f) Bunker (f) Hose (f) X1 (works) X1 (fails) The procedure is similarly developed considering all the tree gates. In accordance with the real time update of the risk parameters, the probability distributions of the accident scenarios are updated as well. Figure 5: MCMC traces of Scenarios Probability Distributions 281 Figure 5 depicts in form of immediate readability the MCMC traces of the dynamic probability distributions for all the scenarios conceived for the given process according to the bow-tie development. 5. Conclusions The proposed system is an application of Bayesian Hierarchical Inference to the bow-tie analysis, where the deviations are anticipated by a predictive model. The risk parameters and the accidental scenarios probabilities are inferred starting from the system states sequences and are represented in the form of probability distribution functions (PDF). The Bayesian approach allows to explore the interdependencies among the system components and their modification alongside with process variables fluctuation, thus capturing the changes in operational conditions and improving the dynamic facet of risk. The outcome is a dynamic update of the probabilities (root events, top events and accidental scenarios), which provide an extremely powerful indication on how the system is performing, if it is approaching an unsafe state and how far, or close, the system is to a hazardous deviation. Precise failure data of system components utilized to calculate the failure probability require advanced refinement, e.g. utilizing a Noisy-OR gate Bayesian network relying on intuitionistic fuzzy theory (Jianxing et al., 2021). So ongoing development of the approach are addressed to the improvement of Bayesian network in the bowtie configuration to tie results by refining uncertainty assessment of input data. Acknowledgment This research was partially funded by INAIL within the framework of the call BRIC/2019/ID2 (Project DYN- RISK). References Allenby G.M., Rossi P.E., McCulloch R.E. 2005, Hierarchical Bayes Model: a practitioner’s guide, Journal of Bayesian Applications in Marketing, 1-4. Alves D.T.S., Lima G.B.A. 2021, Establishing an onshore pipeline incident database to support operational risk management in Brazil - Part 2: Bowtie proposition and statistics of failure, Process Safety and Environmental Protection, 155, 80-97. Badreddine A., Amor N. B. 2013, A Bayesian approach to construct bow tie diagrams for risk evaluation. Process Safety and Environmental Protection, 91, 159-171. Brown K.R., VanBerkel P., Khan F.I., Amyotte P.R., 2021, Application of bow tie analysis and inherently safer design to the novel coronavirus hazard, Process Safety and Environmental Protection, 152, 701-718. Ding, L., Khan, F., JI, J. 2020, Risk-based safety measure allocation to prevent and mitigate storage fire hazards. Process Safety and Environmental Protection, 135, 282-293. Jianxing Y, Shibo W, Yang Y, Haicheng C, Haizhao F, Jiahao L, et al. Process system failure evaluation method based on a Noisy-OR gate intuitionistic fuzzy Bayesian network in an uncertain environment. Process Safety and Environmental Protection, 150, 281-97. Lee S.Y., Mallick B., 2021, Bayesian hierarchical modeling: application towards production results in the Eagle Ford Shale of South Texas, Sankhya B, Doi:10.1007/s13571-020-00245-8. Osarogiagbon, A.U., Khan, F., Venkatesan, R., Gillard, P., 2021. Review and analysis of supervised machine learning algorithms for hazardous events in drilling operations. Process Safety and Environmental Protection 147, 367–384. Vairo T., Reverberi A.P., Bragatto P.A., Milazzo M.F., Fabiano B., 2021a, Predictive model and soft sensors application to dynamic process operative control, Chemical Engineering Transactions, 86, 535-540. Vairo T., Reverberi A.P., Gualeni P., Fabiano B., 2021b, Resilience dynamic assessment based on precursor events: application to ship LNG bunkering operations, Sustainability 13(12), 6836, DOI:10.3390/su13126836 Vairo T., Pontiggia M., Fabiano B. 2021, Critical aspects of natural gas pipelines risk assessments. A case- study application on buried layout. Process Safety and Environmental Protection 2021, 149, 258-268. Vianello, C., Bassani, A., Mocellin, P., Manenti, F., Pirola, C., Fabiano, B., Colombo, S., Maschio, G., 2022. Hybrid risk-based LCA to improve the Acid Gas to Syngas (AG2S™) process, Journal of Loss Prevention in the Process Industries, 75, 104694 DOI: 10.1016/j.jlp.2021.104694 Zurheide, F.T., Hermann, E., Lampesberger, H., 2021, pyBNBowTie: Python library for Bow-Tie analysis based on Bayesian Networks. Procedia Computer Science 180, 344–351. 282 76vairo.pdf Make Bow-tie Dynamic by Rethinking it as a Hierarchical Bayesian Network. Dynamic Risk Assessment of an LNG Bunkering Operation