CET vol 99 DOI: 10.3303/CET2399059 Paper Received: 4 December 2022; Revised: 27 March 2023; Accepted: 15 April 2023 Please cite this article as: Marroni G., Casini L., Kuipers S., Dentone D., Mossa Verre M., Overdijk W., Casson Moreno V., Landucci G., 2023, Real-time Assessment of Integrated Safety-security Scenarios Triggering Cascading Events in the Process Industries, Chemical Engineering Transactions, 99, 349-354 DOI:10.3303/CET2399059 CHEMICAL ENGINEERING TRANSACTIONS VOL. 99, 2023 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Sauro Pierucci, Flavio Manenti Copyright © 2023, AIDIC Servizi S.r.l. ISBN 978-88-95608-98-3; ISSN 2283-9216 Real-Time Assessment of Integrated Safety-Security Scenarios Triggering Cascading Events in the Process Industries Giulia Marroni a, Leonardo Casini a, Sanneke Kuipers b, Dino Dentone c, Marcello Mossa Verre d, Werner Overdijk e, Valeria Casson Moreno a, Gabriele Landucci a,* a Department of Civil and Industrial Engineering, University of Pisa, Largo Lucio Lazzarino 2, 56126 Pisa, Italy b Institute of Security and Global Affairs, Leiden University, Turfmarkt 99, 2211 DP Den Haag, the Netherlands c DataCH Technologies S.r.l., Via L. da Vinci 5, 57123 Livorno, Italy d Regional Agency for Environmental Protection of Tuscany (ARPAT), Via del Ponte alle Mosse 211, 50144 Firenze, Italy e Crisisplan BV, Frambozenweg 123, 2321 KA, Leiden, the Netherlands gabriele.landucci@unipi.it Industrial sites processing and storing hazardous chemicals can be attractive targets of malicious acts of interference. The consequences successful intentional attacks to chemical facilities can be severe and could escalate generating domino effects, potentially affecting people and the environment. Moreover, intentional attacks have a dynamic escalation that is not well depicted by conventional analyses, which are instead static. This works focuses on the development of a comprehensive tool for Integrated Safety-Security risk assessment and related domino effects based on a three-dimensional (3D) real-time approach. Firstly, the plant is inspected using a drone to generate the graphic interface of the tool, which is the 3D reconstruction of the plant. Real-time data are associated with each mapped element, e.g., pressure/temperature conditions. The tool allows for the evaluation of probabilities and 3D consequences of accidents given real time and/or user input data. Potential domino effects of integrated safety-security scenarios will also be included in the tool, allowing for the mapping of plant vulnerability, risk and supporting the evaluation of weaknesses and need of additional countermeasures. In order to provide a sample application, a simplified version of the tool was used on a case study. 1. Introduction Following the events of 09/11, protecting process facilities storing or processing high amounts of hazardous substances from malicious acts of interference became a concern for both industry and institutions (Baybutt and Ready, 2003). A successful intentional attack might generate the so-called domino effects, i.e., the propagation of the accident among multiple equipment and assets (Landucci et al., 2013). Security science applied to the protection of chemical installations examines the modes and effects of intentional attacks. Security assessment is regulated in Europe only for critical infrastructures or international port facilities; intentional attacks are in fact not explicitly contemplated in the European Seveso-III Directive 2012/18/EU on the control of major-accidents hazards involving dangerous substances in fixed process facilities. Still, security science is not unrelated to operational safety, which focuses on unintentional events. Indeed, these two disciplines are linked by the presence of domino effects and by the intervention of safety barriers in security scenarios. Nevertheless, the tools currently available for industrial application may not be adequate to cope with the challenge of managing safety and security concerns in a coordinated manner, as quantitative comprehensive approaches are still lacking. Therefore, the development of Integrated Safety-Security (ISS) approaches is necessary to reduce the vulnerability of people and the environment to these threats. Given the dynamic nature of domino effect accidents and the different kind of escalation of security events, ISS approaches may benefit from dynamic real-time approaches (Marroni et al., 2022), which can capture the detailed transient evolution of the scenario and its three-dimensional (3D) features. Dynamic and 3D approaches are also beneficial for the 349 management of emergency in case of a loss of containment, since a quick-running, real-time tool can help emergency squads in quickly detecting high-risk zones to secure. This work focuses on the development of a tool for ISS risk assessment and related domino effects. The graphical interface of the tool is the 3D reconstruction of the plant, in which critical equipment, safety and security barriers are mapped. Real-time input data are associated with each equipment. The tool evaluates frequencies, 3D consequences and risk of accidents by relying either on real-time data or user inputs. Specific procedures are implemented in order to evaluate domino effects associated with ISS scenarios. Additionally, the 3D interface can serve as a functional tool to organize data and documents for each equipment, and to promote a better and integrated management of information in the plant. The preliminary version of the tool has been used in this work to analyze a case study. The results show the benefits of the present approach, as quantitative contributions of safety and security barriers and emergency management are discussed. 2. Methodology 2.1 Overview Figure 1 shows the flowchart of the methodology used in this work to develop the tool for ISS assessment. Step 1 of the methodology consists in a preliminary analysis of the site. Reference documents are analysed, e.g., process flow diagrams, equipment datasheets, plant layout, etc. Based on the gathered information, critical equipment is identified through a hazard-based method, which is described in Section 2.2. Figure 1: Flowchart of the methodological approach used in this work to develop the tool for ISS assessment. Step 2 is composed of two sub-steps: Sub-step 2a is the 3D reconstruction of the site under analysis, which is done through a specific approach detailed in Section 2.3; Sub-step 2b is the development of ISS algorithms for risk assessment, which is described in Section 2.4. Finally, Step 3 is the visualization of risk or vulnerability contours on the 3D reconstruction of the plant. In this work, vulnerability is intended as the cumulative probability of death from all possible final scenarios. This includes the primary scenario, namely the scenario directly triggered by the attack, and the secondary scenarios, i.e., the scenarios caused from the escalation of the primary scenario. 2.2 Mapping criteria for critical asset The preliminary analysis of the site (Step 1 in Figure 1) entails selecting critical equipment. This work adopts a hazard-based screening method, which is based on a previous work (Sabatini et al., 2009) and is elaborated producing the reference hazard chart shown in Figure 2. Figure 2: Hazard-based equipment screening to support the mapping of critical asset. On-field quality check 3D reconstruction of the site 3D visualization of vulnerability/risk Development of ISS algorithms Preliminary analysis of site Evaluation of ISS barriers performance Threshold-based risk approach Integral models for consequence assessment Drone inspections 1 2b 2a 3 Post processing Reference loss of containement scenarios Hazard-based equipment screening Collect reference documents Equipment type → Physical conditions of inventory ↓ Aboveground tanks Indoor warehouse Aboveground pipelines Elongated process equipment Reactors Heat Exchangers Buried tank Underground pipelines Liquefied gas stored under pressure 4 4 3 3 3 2 1 Fluids with low vapour pressure stored in liquid phase 3 3 2 2 2 2 1 Gas/liquid stored in gas phase 3 2 2 2 2 1 1 Cryogenic storage 2 2 2 2 1 1 1 Liquid phase 1 1 1 1 1 1 1 350 Critical equipment is selected based on the equipment type and the physical condition of the substance using a scoring system ranging from 1 (lowest) to 4 (highest). Taking into account intentional attack scenarios, a further distinction among equipment is made based on the visibility; indeed, visible targets, e.g., aboveground tanks, are more attractive for malicious acts of interference compared to less visible equipment, such as buried tanks or underground pipelines. The most critical equipment is therefore obtained by assigning a score to each equipment in the plant under analysis and selecting those with the highest score. 2.3 3D layout preparation Step 2a of the methodology in Figure 1 is the 3D reconstruction of the plant, which is made using aerial photogrammetry. This technique allows the creation of the 3D model from aerial photographs. In this work, outdoor aerial photographs are obtained using a drone while flying over the site under analysis. As for indoor areas, such as warehouses storing hazardous substances, the pictures are instead taken using a camera as the drone movement would be drastically hindered. Each picture taken contains all the necessary parameters for the 3D reconstruction, such as latitude, longitude, elevation, and inclination. The 3D reconstruction of the plant is obtained by processing all pictures by the 3D rendering software Agisoft Metashape. A first test of the 3D reconstruction is directly carried out on-field. The “on-field” 3D reconstruction helps the technicians to verify the general quality of the 3D, as pictures can be influenced by meteorological conditions, e.g., sunlight. Moreover, the “on-field” 3D guides further inspections by identifying areas that are not well represented. When the quality is considered sufficient, the technician begins with the “high-resolution” 3D reconstruction. Additionally, post-processing is done in order to enhance important details, e.g., critical equipment and barriers. The interface of the tool is constituted by the 3D reconstruction of the plant, as shown in Figure 3. Critical equipment and barriers are interactive elements. By clicking on the element, a dedicated tab opens, an example of which is shown in Figure 3. The user can consult or upload equipment technical documentation in the dedicated tab, such as data-sheets or maintenance reports. Figure 3: Example of graphical interface and equipment tab. 2.4 Real-time assessment of safety-security scenarios Step 2b in Figure 1 is the development of algorithms for ISS risk assessment. The tool operates in two different modes. In the “default” mode, the leak diameter for intentional attacks with firearms, explosives or arson were adapted from conventional release diameters (API, 2008). The same reference was used to evaluate the loss of containment scenarios of conventional safety events. On the other hand, the “custom” version allows more advances users to set the preferred values of leak diameters. Release conditions can be either set by the user or, when possible, are directly retrieved from the control system of the analyzed equipment in order to obtain a real-time scenario. As for meteorological conditions, wind speed and stability conditions can be either retrieved from available meteorological stations nearby or are set to the default conditions 2F and 5D. The preliminary version of the tool includes the evaluation of physical effects of fires. A compromise was reached between computational time and accuracy of physical effects, as the tool should also be able to support emergency squads in coordinating actions after a major accident. For this reason, integral models based on a multi-point source approach (Hankinson and Lowesmith, 2012) were preferred for pool and jet fires to conventional integral models; the conventional point-source model was instead implemented for fireball heat radiation (van den Bosch and Weterings, 2005). 351 The frequency fFO of the final outcomes included in the preliminary version of the tool was obtained by applying Eq. 1: fFO = fA ∙PS ∙PI (1) where fA is the frequency of the intentional attack or unintentional loss of containment, PS is the probability of success of the attack and PI is the probability of ignition. The frequency fA of intentional attacks was taken from (API, 2013), while fA for accidental scenarios was retrieved from (API, 2008). PS and PI were evaluated by applying the Event Tree Analysis. Specific gates were developed to account for the performance of security barriers, e.g., fences, closed-circuit television (CCTV), and they were implemented along with conventional safety barriers to generate ISS Event Trees (Casson Moreno et al., 2022). Moreover, specific Event Trees were created for domino effects caused by primary final scenarios, e.g., release scenarios originating from a pressurized tank impinged in flames. The probability of ignition for unintentional scenarios were gathered from the results of the ARAMIS project (de Dianous and Fiévez, 2006); the same values were used for intentional attack scenarios, since dedicated values are currently lacking in the literature. The tool can display the 3D contours of both risk and vulnerability. The compatibility matrix of the Italian land- use planning legislation (Laurent et al. 2021), which is shown in Table 1, has been used for risk assessment. Territorial categories are assigned for each combination of frequency and impact zone ranging from A (densely populated residential areas) to F (industrial establishments and non-built respect area). The Reader is referred to (Laurent et al. 2021) for more details on the definition of the Italian territorial categories. Impact zones → Pool/jet fire → Fireball → Frequency fFO ↓ High lethality 12.5 kW/m2 Fireball radius Starting lethality 7.5 kW/m2 350 kJ/m2 Irreversible injuries 5 kW/m2 200 kJ/m2 Reversible injuries 3 kW/m2 125 kJ/m2 fFO < 10-6 DEF CDEF BCDEF ABCDEF 10-6 < fFO ≤ 10-4 EF DEF CDEF BCDEF 10-4 < fFO ≤ 10-3 F EF DEF CDEF fFO > 10-3 F F EF DEF Table 1: Compatibility matrix used for risk assessment, adapted from (Laurent et al. 2021) 3. Application to a case study A preliminary version of the tool was used to examine a case study. The analyzed plant is shown in Figure 4. The plant was active in the last 30 years and is situated in a country with a mild socio-economic and political climate. The plant is located in an industrial context and confines with a railway on the North side. The plant stores Liquefied Petroleum Gases (LPG) in two 50 m3 aboveground tanks and ethanol in three 10 m3 buried tanks. Figure 4: Layout of the demonstrational case study. According to Figure 2, LPG storage tanks are more critical compared to the buried storage of a fluid with low vapor pressure, i.e., ethanol. For this reason, the analysis focuses on the LPG tanks. Figure 4 also shows an exemplifying intrusion path for the LPG tanks. The attacker enters the plant during night shift by trespassing the Ethanol buried storage Waste treatment Process area 1 LPG storage Perimetral fence Intrusion path N 352 external perimetral fence. Then, the attacker runs towards one LPG tank, and sabotages a connection flange, leading to a 1’’ (25.4 mm) leak of LPG. For the sake of exemplification, the unmitigated scenario is hereby analyzed, i.e., the scenario in which the attacker carries out completely the attack. A release of the duration of 3 minutes was assumed in case of successful attack, as the intervention of safety barriers was neglected for this simplified case. Security guards are highly trained; therefore, a time of 4 minutes is assumed to be necessary to neutralize the attacker. Nominal storage conditions were used to evaluate impact zones and the wind blows from South direction at a speed of 2 m/s. 4. Results and discussion The release of LPG caused by the sabotage is assumed to lead to a pool fire scenario, conservatively assuming a unitary probability of ignition PI = 1.0 because of the heat and sparks generated during the sabotage. The first step for risk assessment is the evaluation of the frequency of the scenario, which is composed by different factors. The frequency of the intentional attack is assumed as once in the life of the plant, leading to fA = 0.03 events/y, i.e., the second to last value possible according to the references in Section 2.4. Figure 5a shows the ISS Event Tree created with the methodology outlined in Section 2.4. It should be mentioned that the attack can be successful through many combinations of events. In this simplified case, it is assumed that the attacker trespasses the fence, but is caught by the employees on the night shift. However, the emergency squad fails to act, leading to an unmitigated escalation. Therefore, the attack success frequency is fA ∙PS = 5.22∙10-6 events/y. The pool fire frequency can be evaluated using Eq.1, leading to fFO = 5.22∙10-6 events/y. It can be noticed that the frequency of final outcomes from intentional attacks is comparable with the frequencies of final outcomes from unintentional accidents. Then, the second step for risk assessment is the evaluation of impact zones of the generated pool fire, which can be done by applying the models shown in Section 2.4. The final step is the combination of impact zones and frequency to obtain the compatible territorial categories. Figure 5b shows the pool fire originated by the 1’’ leak and its risk contours in the 3D interface of the tool. Figure 5: a) Event tree for the attack scenario; b) 3D risk contours for the pool fire generated by a 1’’ LPG leak. The 3D visualization allows to visualize the actual physical effect. Figure 5b show the contour of the pool fire, which is represented by a cylinder which is tilted due to wind effect. The different parts of the pool fire are also represented: in orange is the luminous part of the flame, while in dark grey is the sooty part. Moreover, the 3D allows to take into consideration the difference of height among different equipment, which is not possible for standard risk assessment tools. By observing the pool fire contour, it is noticeable that the second LPG tank is engulfed in the flames. This could damage the tank and lead to potential domino effects, amplifying the consequences of the primary event. This chain of events is part of the future development of the tool, which will include the entire accident chain from the primary scenario triggered by the attack to secondary scenarios derived from the escalation of the primary one. Figure 5b also shows the risk-based contours and territorial vulnerability classification, which are in the 3D representation are spheres. The reversible effect zone reaches part of the railway. This highlights the criticality of intentional attack scenarios and the need to further improve the security barriers in place. BCDEF CDEF DEF EF b) SECURITY ATTACK Perimetral fence Employees Emergency squad ATTACK SUCCESS a) fA = 3E-2 1/y SUCCESS FAIL NEUTRALIZATION WEAKENED ATTACK FAIL 4.67E-5 SUCCESS 6.94E-6 FAIL 5.22E-6 POOL FIRE IMMEDIATE IGNITION 5.22E-6 353 5. Conclusions and future works The integration of safety and security scenarios is a critical issue for the protection of process facilities. This work explored a methodology for 3D real-time assessment of ISS scenarios. A specific tool was developed as part of the methodology. The tool allows the evaluation of ISS scenarios and related domino effects. The tool has an additional functionality which allows users to store documents and data related to critical equipment. In this way, documentation can be easily retrieved and consulted by the user. A simplified version of the tool was used to highlight the potentialities of the present methodology. The 3D visualization of the scenarios has multiple advantages. The first one is that emergency squads have a quick tool to visualize impact zones and therefore better assess evacuation and mitigation measures. The second advantage is that the management has a tool that quicky allows to visualize the risk of either conventional or customized scenarios. This can be of support in decisional processes, for example while deciding which safety or security barriers to improve in the site. Moreover, the tool could be used for the training of employees. Emergency scenarios can be simulated in the 3D tool in order to show emergency procedures and critical barriers or equipment to employees. The drawback of having a risk-assessment with low running times is related to the accuracy of physical models. The integral models used in the tool are less accurate compared to others available; however, considering the scope of the tool (especially for the management of emergency), the lower accuracy is considered acceptable to enhance the run-time speed of the tool. Future works include the overall improvement of the algorithms of the tool. Procedures for the evaluation of domino effects based on type of equipment and stored substance will be implemented in order to assess the risk of the whole accidental chain. Additionally, the 3D evaluation of vulnerability will be implemented on the tool. Other metrics for risk assessment will be added, such as the 3D evaluation of the Local Specific Individual Risk. In conclusion, the full version of the tool will support managers and analysists in addressing ISS issues. Acknowledgments This study was in part developed within the project LIFE20 ENV/IT/000436 –LIFE SECURDOMINO “Seveso sites: assessment of integrated safety-security hazards and risks and related domino effects” with the contribution of LIFE program of the European Union. References American Petroleum Institute (API), 2008, ANSI/API Standard 581 – Risk-Based Inspection Technology, American Petroleum Institute, Washington D.C., U.S. American Petroleum Institute (API), 2013, ANSI/API Standard 780 – Security Risk Assessment Methodology for the Petroleum and Petrochemical Industries, American Petroleum Institute, Washington D.C., U.S. Baybutt P., Ready V., 2003, Strategies for protecting process plants against terrorism, sabotage and other criminal acts, Homeland Defense Journal, 2, 1. Casson Moreno V., Marroni G., Landucci G., 2022, Probabilistic assessment aimed at the evaluation of escalating scenarios in process facilities combining safety and security barriers, Reliability Engineering and System Safety, 228, 108762 de Dianous V., Fiévez C., 2006, ARAMIS project: A more explicit demonstration of risk control through the use of the bow-tie diagrams and the evaluation of safety barrier performance, Journal of Hazardous Materials, 130, 220-233 Hankinson G., Lowesmith B.J., 2012, A consideration of methods of determining the radiative characteristics of jet fires, Combustion and Flame, 159, 1165-1177. Landucci G., Cozzani V., Birk M., 2013, Heat Radiation Effects, Chapter In: Reniers G., Cozzani V. (Eds.), Domino Effects in the Process Industries: Modelling, Prevention and Managing, 70-115 Laurent A., Pey A., Gurtel P., Fabiano B., 2021, A critical perspective on the implementation of the EU Council Seveso Directive in France, Germany, Italy and Spain, Process Safety and Environmental Protection, 148, 47-74 Marroni G., Piemonte A., Tamburini F., Caroti G., Pannocchia G., Landucci G., 2022, An Interdisciplinary Approach Towards the Integrated Safety-Security Assessment of Process Facilities Operating in the Maghreb Context, Chemical Engineering Transactions, 91, 517-522 Sabatini M., Zanelli S., Ganapini S., Bonvicini S., Cozzani V., 2009, Ranking the attractiveness of industrial plants to external acts of interference, Safety, Reliability and Risk Analysis: Theory, Methods and Applications - Proceedings of the Joint ESREL and SRA—Europe Conference, 1199–1205. van den Bosch C.J.H., Weterings R.A.P.M., 2005, Methods for the calculation of physical effects (Yellow Book), Committee for the Prevention of Disasters, The Hague, The Netherlands. 354 325marroni.pdf Real-Time Assessment of Integrated Safety-Security Scenarios Triggering Cascading Events in the Process Industries