This article was downloaded by: [Dip Studi Storici Sociali], [Maria Grazia Gnoni]On: 13 March 2012, At: 04:11Publisher: Taylor & FrancisInforma Ltd Registered in England and Wales Registered Number: 1072954 Registeredoffice: Mortimer House, 37-41 Mortimer Street, London W1T 3JH, UK

Chemical Engineering CommunicationsPublication details, including instructions for authors andsubscription information:http://www.tandfonline.com/loi/gcec20

A MULTI-CRITERIA DECISION MODEL FORCONTROLLING KNOCK-ON RISK INSIDECHEMICAL PLANTSMaria Grazia Gnoni a , Gianni Lettera a & Paolo Angelo Bragatto ba Department of Innovation Engineering, University of Salento,Lecce, Italyb INAIL Italian Workers' Compensation Authority, Research Center,ex-ISPESL, Monteporzio Catone (RM) – Italy

Available online: 08 Mar 2012

To cite this article: Maria Grazia Gnoni, Gianni Lettera & Paolo Angelo Bragatto (2012): A MULTI-CRITERIA DECISION MODEL FOR CONTROLLING KNOCK-ON RISK INSIDE CHEMICAL PLANTS, ChemicalEngineering Communications, 199:6, 798-811

To link to this article: http://dx.doi.org/10.1080/00986445.2011.626094

PLEASE SCROLL DOWN FOR ARTICLE

Full terms and conditions of use: http://www.tandfonline.com/page/terms-and-conditions

This article may be used for research, teaching, and private study purposes. Anysubstantial or systematic reproduction, redistribution, reselling, loan, sub-licensing,systematic supply, or distribution in any form to anyone is expressly forbidden.

The publisher does not give any warranty express or implied or make any representationthat the contents will be complete or accurate or up to date. The accuracy of anyinstructions, formulae, and drug doses should be independently verified with primarysources. The publisher shall not be liable for any loss, actions, claims, proceedings,demand, or costs or damages whatsoever or howsoever caused arising directly orindirectly in connection with or arising out of the use of this material.

A Multi-Criteria Decision Model for ControllingKnock-On Risk Inside Chemical Plants

MARIA GRAZIA GNONI,1 GIANNI LETTERA,1 ANDPAOLO ANGELO BRAGATTO2

1Department of Innovation Engineering, University of Salento,Lecce, Italy2INAIL Italian Workers’ Compensation Authority, Research Center,ex-ISPESL, Monteporzio Catone (RM) – Italy

The amplification of accident consequences should be deeply considered in riskassessment studies carried out at chemical plants where the European Union’s MajorAccident Hazard (MAH) legislation is enforced. Several approaches have beendiscussed and applied to evaluate external domino effects (i.e., where damage areasaffect external areas): these approaches are traditionally based on analytical modelsthat are usually time-consuming due to both the large amount of informationrequired and the inherent complexity characterizing analytical models. On the otherhand, if accident consequences are located within establishment boundaries—the socalled knock-on effect—the application of these models would be not suitable as theyare characterized by high complexity. This article proposes an effective and fastapproach for evaluating the most efficient actions to prevent internal knock-on risksby a structured approach: the model aims to support the competent authority forevaluating both technical and procedural control measures in chemical installations.A multi-criteria decision method, based on Saaty’s Analytic Hierarchy Process(AHP), has been proposed. The model structure has been developed starting fromthe well-known Mond index; moreover, it evaluates several criteria, including equip-ment and plant vulnerability. The proposed model has been tested in a real casestudy regarding a chemical warehouse.

Keywords Chemical installations; Decision support system; Knock-on effect;Major accident hazard; Multi-criteria technique

Introduction

Regulators (or the competent authority) in the framework of the European Union’sMajor Accident Hazard (MAH) legislation (e.g., the European ‘‘Seveso Directive’’)are faced with decisions about the adequacy of the organizational and technical safetymeasures adopted in a plant for preventingMAHs. A critical point is the consequenceamplification, due to the propagation of accident effects from one installation toanother: the so called ‘‘knock-on’’ and ‘‘domino effect.’’ Two types of phenomenahave to be discriminated: internal and external knock-on effects. An externalknock-on (or domino) accident amplifies its consequence by involving installationsand infrastructures outside the plant boundaries; internal knock-on accidents are

Address correspondence to Maria Grazia Gnoni, Department of Innovation Engineering,University of Salento, via per Monteroni, 73100 Lecce, Italy. E-mail: mariagrazia.gnoni@unisalento.it

Chem. Eng. Comm., 199:798–811, 2012Copyright # Taylor & Francis Group, LLCISSN: 0098-6445 print=1563-5201 onlineDOI: 10.1080/00986445.2011.626094

798

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

usually confined within the plant boundaries. The external domino effect is reportedjust in a few accidents, but it may have catastrophic effects on the entire safety level asit affects targets outside of the plant, such as installations, transport, or service infra-structures (Reniers et al., 2005). A recent article collected data about 224 events from1917 to 2009 and analyzed them according to different classification parameters suchas location, accident sequences, and consequences (Abdolhamidzadeh et al., 2011).Furthermore, external domino evaluation is mandatory under the MAH Directive;thus, quantitative methods have been widely discussed both in industrial practicesand in several scientific studies (Cozzani et al., 2006, 2007; Reniers et al., 2006;Van der Voort et al., 2007; Antonioni et al., 2009; Darbra et al., 2010). Quantitativerisk analysis is usually focused on physical effects of primary and secondary events onall targets, aiming to define potential damage areas due to a domino chain. Thus, finalassessment and decisions carried out by competent authorities are driven by resultsobtained from such a method.

Otherwise, the internal domino (or knock-on) is not infrequent: a study aboutaccidents in MAHs (Kourniotis et al., 2000) has pointed out that the rate of internalknock-on effect per total number of accidents is about 12% in the chemical industry;moreover, this value increases in the oil and gas industry. A quick survey of theMajor Accident Reporting System (MARS) database (European Union, n.d.) andCenter for Chemical Process Safety (CCPS) safety alerts (maintained by AIChE)basically confirmed these data. The domino effect has been studied for major estab-lishments and chemical industry parks; however, an internal knock-on scenario ispossible even for minor facilities characterized by congested layouts. These typesof establishments include chemical warehouses and plants for batch chemicalproduction (i.e., chemical specialties and pharmaceutics).

The internal knock-on effect is not explicitly mentioned by the European MAHlegislation; thus, less effort has been made to develop shared evaluation approachesand guidelines. Quantitative methods traditionally proposed for external dominoanalysis could be cumbersome for internal knock-on for several reasons. First ofall, quantitative methods usually require a high level of resources in terms of bothtime and cost, due to the large amount of information required and the inherentmodel complexity. Thus, their application could be unaffordable for a small ormedium size firm. Furthermore, as previously discussed, the main result of quantita-tive domino analysis is the accurate evaluation of damage areas. Organizational andeconomic issues are not integrated in these assessment models. These two aspectsare more critical in internal knock-on rather than in external domino, due to ainherently different level of risk. In the external domino effect, economic and organi-zational issues are overwhelmed by disastrous effects of a potential accident; thus, thedecision process carried out by the competent authority is different in knock-on risks.Where external domino effects could be evaluated, the decision process is basedmainly on results derived from quantitative risk assessment (i.e., based on analyticalmodels that are able to well represent physical phenomena). In knock-on risk analysis(internal domino), instead, the decision process usually involves several factors,balancing concurrent objectives of assuring profitable operations with health andsafety issues. Thus, multi-criteria analysis could represent a more efficient decisiontool as different issues may be easily integrated.

This article proposes a heuristic approach based on a multi-criteria decision toolfor preventing and controlling knock-on risks in the chemical context. The approachis based on the well-known Analytic Hierarchy Process (AHP) method developed by

Controlling Knock-On Risk in Chemical Plants 799

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

Saaty (1980): this approach employs structured hazard and risk knowledge in amulti-criteria decision making technique; it usually allows supporting a quantitativedecision process in uncertain contexts (Heller, 2006). The AHP method splits thedecision process according to a hierarchical model: several different types of para-meters (i.e., criteria), which could contribute to either increase or reduce knock-onconsequences, have been introduced in the model. Thus, it could represent aneffective tool for integrating interconnected factors that usually influence actionsto prevent knock-on risks. The proposed model has been designed to supportcompetent authority (CA) and regulatory bodies both in safety report assessmentand in periodical inspections carried out in MAH installations, in order to harmo-nize decisions about internal knock-on prevention measures. Two are the mainfeatures of the proposed tool: supporting the decision harmonization process andguaranteeing flexibility in its application. First, it supplies the CA with a commonmethod for evaluating procedures for preventing knock-on risks concerning installa-tions belonging to the same industrial (i.e., chemical) sector. Moreover, the modelflexibility, i.e., the evaluation of specific conditions relative to each installation, isguaranteed as values of final criteria in the hierarchy structure depend on specificcontext data.

The present article is structured as follows: after a brief critical review of how theAHP has been applied for risk analysis, the proposed model is detailed. Finally, anapplication is proposed aiming to validate the model effectiveness and its potential ina real case study regarding a chemical warehouse.

AHP Applications in MAH Analysis

Risk assessment usually represents a complex activity due to several parameters;objectivity and conflicting criteria represent focal points in all traditional models(Tesfamariam and Sadiq, 2006). InMAH analysis, several approaches have been pro-posed in the scientific literature. Models based on quantitative risk analysis have beenproposed for external domino effects (DEA) analysis (Cozzani et al., 2006, 2007;Reniers et al., 2006; Van der Voort et al., 2007; Antonioni et al., 2009; Darbraet al., 2010). Recently, few studies have faced with different types of approachesfor DEA (Abdolhamidzadeh et al., 2010; Reniers, 2010; Zhang and Chen, 2011)Innovative applications of Montecarlo analysis and game theory models have beenrecently proposed in by Abdolhamidzadeh and coworkers (Abdolhamidzadeh et al.,2010) and Reniers (2010) respectively. An heuristic method defined as a ‘‘discreteisolated island’’ (DII), developed to break up domino effect networks to single outthe installation, which could determine the highest contribution to a domino effectchain during an accident escalation process, is proposed by Zhang and Chen (2011).

Another innovative application is based on splitting the main problem intodifferent hierarchical levels aiming to reduce the overall problem complexity; a wide-spread method of this type is the well-known Analytical Hierarchy Process (AHP)proposed in early 1980s by Saaty (1980). It is a multi-criteria technique where theproblem evaluation is based on assessing the relative importance of each criterionwith the aim of ranking final alternatives, which usually represent different solutionsfor the analyzed problem. The AHP allows organizations to minimize commonpitfalls of the decision making process such as lack of knowledge and participation(Solnes, 2003). Interesting reviews of the AHPmodel application for managing differ-ent industrial problems have been recently carried out (Vaidya and Kumar, 2006; Ho,

800 M. G. Gnoni et al.

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

2008); these works showed that the AHP was effective in several contexts (such asquality control management and feasibility studies,) and it could be easily integratedwith other decision models. This approach has recently been shown to also be effec-tive in risk assessment analysis in the MAH field, even if few studies have beenreported in the scientific literature. An integration of the AHP with Bayesian beliefnetworks (BBN) has been proposed to deal with critical components in a nuclearpower plant, such as structures, equipment, or components, based on their actualsafety levels (Ha and Seong, 2004).

Finally, a ranking among different decision types, such as ‘‘major prescription,’’‘‘minor prescription,’’ and ‘‘no prescription,’’ is supplied by the model. The modelalso indicates the ‘‘most critical criterion’’ (i.e., the one that mainly contributed tothe final score): thus, the auditing team (AT) also has information about where pre-scriptions have to be assigned. Therefore, final alternatives are indirectly related toknock-on risk level (such as high, medium, and low level); the aim is not to providea risk assessment but to point out decision type and field of intervention to preventknock-on risks in the analyzed chemical installation (see Figure 1).

A follow-up procedure can be easily carried out by the CA, as the model couldbe updated both in its structure and in the specific weight of criteria.

Figure 1. The proposed model logic. (Figure provided in color online.)

Controlling Knock-On Risk in Chemical Plants 801

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

Model Development

The model development phases are detailed in the following. The AHP developmentstarts from structuring the decision problem into a hierarchical model (step 1:hierarchy development) as briefly defined above. The goal is to define decision typesfor preventing knock-on risks in a chemical installation. The proposed hierarchy isdescribed in Figure 2; five criteria levels have been evaluated. First-level criteriarepresent features that usually characterize the chemical industrial context; otherwise,final-level criteria depend on operational conditions that characterize the specificinstallation. Alternatives represent decision types supplied by the AT in order toprevent or control knock-on risks. The general structure of the proposed modelderives from the well-known ICI Mond Fire Explosion and Toxicity Index (ImperialChemical Industries, 1985); additional criteria have been introduced in the proposedstructure as the level 2 is composed of six criteria, as reported in Figure 2. In detail,four criteria have been introduced according to the ICI-Mond structure; the aim is

Figure 2. Hierarchical structure of the proposed AHP model.

802 M. G. Gnoni et al.

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

to introduce information about potential hazards related to a knock-on event inchemical installations: operative conditions, substance type, layout and safetymeasures.

The criteria are:

. Operative conditions (OP) criterion involves information about the inter-relationships between different process parameters such as process types, waste,temperatures, pressures, and frequency of operations. Moreover, processreliability and human intervention have been also introduced in such a processphase.

. Substance (S) criterion defines information (e.g., quantity and storage modality)about dangerous substances used and=or developed during process phases.

. Layout (L) criterion characterizes how each plant location could ‘‘interact’’ withseveral targets during a potential knock-on event.

. Safety measures (SM) criterion identifies organizational and technical activitiesand systems for preventing and protecting processes that usually characterizechemical installations. Security issues are not been introduced in this analysis.

Moreover, in order to integrate the traditional index method structure, conse-quence analysis has been introduced at the second level by two criteria: target andplant vulnerability. Different from traditional risk assessment models, these twocriteria are critical for an effective knock-on analysis since the accident chain couldbe amplified as the whole vulnerability level increases due to both target and plantfeatures.

. Target vulnerability (TV) criterion characterizes the ‘‘surroundings’’ of the specificunit where a potential knock-on event has to be evaluated. A specific event coulddevelop different conditions (accident chains) depending on the ‘‘complexity’’ levelcharacterizing the area contour in terms of infrastructure (roads, railways, etc.),installations (depots, industrial installations), environmentally vulnerable areas(river, sea, etc.), and safety devices.

. Plant vulnerability (PV) criterion supplies information about consequences of aknock-on event for the whole installation, not only for the specific plant unit.Potential consequences are evaluated in terms of production interruptions, assetdamages, or potentially exposed workers.

The third level is made up of 18 criteria, and, finally, the fourth level is made upof 41 evaluation criteria; the structure is not perfectly symmetric. The AHP modelhas been developed by a software tool, Expert Choice rel.11.

After the development of the hierarchical structure, the quantitative phase ofthe model development is carried out (step 2: criteria assessment). Criteria arecompared pairwise at each level with respect to the criteria in the level immediatelyabove. The pairwise comparison activity is carried out according to expertjudgments.

Finally, the results analysis phase has to be carried out (step 3: results validationand analysis). First, a preliminary validation activity has to be done at each level ofthe AHP structure to point out inconstancies in such a single judgement. Saaty(1980) proposes estimating a Consistency Index (CI) that characterizes the compari-son matrix developed at the previous step:

CI ¼ ðkmax � nÞ=ðn� 1Þ ð1Þ

Controlling Knock-On Risk in Chemical Plants 803

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

where kmax is the maximum eigenvalue characterizing the matrix and n is the matrixdimension. Analogously, the Consistency Ratio (CR) parameter could be estimated:

CR ¼ CI=RI ð2Þ

where the RI parameter is defined by Saaty (1977) as the random index, representingthe average CI value estimated for 500 randomly filled matrices. Thus, if the esti-mated CR value is less than 10%, the current matrix could be characterized by anacceptable level of consistency (Saaty, 2000); otherwise, the decision makers shouldreview and revise the pairwise comparisons. Once all pairwise comparisons areproved to be consistent by the CR analysis, the overall actual ranking is available.Then, a sensitivity analysis should be carried out to evaluate how different parametercould affect the main goal definition; the purpose is to point out critical equipmentor procedures where safety improvement actions could be introduced to reduce and=or control knock-on risks at a specific chemical installation.

Model Application

Case Study Description

The proposed model has been applied in a real case study regarding a large chemicalwarehouse whose schematic layout is shown in Figure 3. The plant unit analyzed isthe storage unit (M): this is a critical area in terms of knock-on risk due to both dif-ferent potential top events (such as pool fire, flash fire, flammable liquid release, andtoxic gas release) and a crowded layout. The proposed model application aims toevaluate which type of decision the AT could make during the periodic inspection(i.e., major prescription, minor prescription, no prescription) in order to reduceand control the knock-on risk level.

The case study features are discussed according to criteria introduced in theprevious AHP structure. According to the OP criterion, the main process activitiesregard hazardous materials handling (i.e., receiving, storing, and shipping activities);furthermore, a filling unit allowsmixing and diluting hazardous substances. Thus, spe-cific plant areas are dedicated to materials handling (i.e., by referring to the Lcriterion); storage is carried out in separate units, and different drum types are used

Figure 3. Layout scheme of the chemical warehouse. (Figure provided in color online.)

804 M. G. Gnoni et al.

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

for a temporary storage according to hazard substance types. Several hazardoussubstance types are in the plant (which affect the S criterion judgements): toxics, flam-mables, and environmentally dangerous materials; furthermore, a few of them couldeasily react with water and releasing toxic gases. Specific safety measures, defined bythe SM criterion, are applied to avoid fire ignition, gas and liquid releases, and the devel-opment of explosive atmospheres. As an example, skin vessels with pressurized nitrogeninsulation are applied; containment basins are used to avoid hazardous releases, andelectrical equipotentiality is guaranteed in all material handling operations. Fire protec-tion is installed and a safety management system is implemented. According to the TLcriterion, potential targets in a proximity area (i.e., in a range of about 500m) are otherinstallations, residential areas, a public school, a gas station, and a river. A highway anda railway are about 2000m from the plant area. By evaluating the PV criterion, about150 employees work in the installation in a single work shift; about 20 operators work inthe storage unit under analysis. More details are reported in Table I.

Quantitative Model Development

As defined above, the quantitative AHP model application has to be carried out forthe proposed case study. The procedure starts from step 2 (criteria assessment), sincethe general hierarchy structure (step 1) has just been developed.

In order to develop quantitative judgments, a group of 10 experts of the ItalianInstitute for Occupational Safety and Prevention, usually involved in inspectionactivities carried out by CAs on MAH establishments, has supplied judgments (bycompiling a specific questionnaire) for developing criteria comparison matrixes.Based on their knowledge and experience the experts give an answer with quantitativevalues; thus, a pair-wise comparison matrix (i.e., Ai versus Aj criteria) among thegiven criteria has been developed for each level of the proposed hierarchical structure.Each single expert judgment has been integrated according to the procedure proposedby Saaty (2000), which aims to aggregate individual judgments into a representativegroup judgment. The AHP applies a scale of absolute numbers from 1 to 9 (defined asthe fundamental scale) to express judgments; a brief description is in Table II.

First, criteria are compared pairwise with respect to the goal, i.e., actions forpreventing knock-on risk in chemical installations; next, comparisons are developedfor each level. Results estimated by the group of experts are shown in Tables III andIV according to first- and second-criteria level comparisons respectively. Third-levelcriteria have been evaluated according to the structure reported in Figure 2; the pair-wise evaluation with respect to operative conditions, substance, layout, and safetymeasure criteria are reported in Table III. The priority vector, obtained from thenormalized eigenvector estimated for the first pairwise comparison matrix, is equalto f0.118, 0.072, 0.230, 0.358, 0.174, 0.048g.

Finally, the third criteria evaluation (i.e., level 4 versus alternatives) has beendeveloped for the case study according to the data synthetized in Table IV. Then,results validation has been carried out (i.e., step 3: results validation and analysis).The overall estimated CR is 3.7%, lower than 10%; thus, the model is consistent.RI values applied for the CR calculation are in Table V.

First results supplied by the proposed model are overall alternatives’ ranking;final values are reported in Figure 4. The model application shows that the decisiontype for preventing knock-on risk should be a minor prescription, as this final alter-native is characterized by the highest percentage (i.e., 37.4%).

Controlling Knock-On Risk in Chemical Plants 805

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

Table

I.Data

characterizingthecase

studyapplied

forcriterioncomparision

Second-level

criteria

Third-level

criteria

Fourth-level

criteria—

Main

data

reporting

Operative

condition

Process

phase

Faultinform

ation

Raw

materialsare

hazardouschem

icalsthatare

storedin

severalstoringsystem

s;noreactionandprocess

wastehavebeenconsidered.Faultscould

beaffectedbyhumanerrorasmaterialsare

usuallyhandledby

forklifts,andbywearasfew

containersare

pressurizedandtemperature

sensible.

Substance

Substance

type

Substance

quantity

Reactortype

Flammable

andeasily

flammable

substancesare

storedin

theplant,over

30tin

ayear.Reactortypes

are

containersforstoringchem

icals.

Layout

Materialhandling

Layoutschem

eContainersare

usuallyhandledbyforkliftswithanaveragefrequency

of600operationsin

ayear.A

storage

unitislocatedin

anisolatedareacovered

byashed

andopen

onthreesides

(infrastructure);itsextensionis

about800m

2(areaextension).A

depotareawhereflammableliquidsare

storedisnextto

thisunit;afilling

unitandatoxic

storagetankare

locatedin

proxim

ity(target

vulnerability).

Safety

measures

Technicalmeasures

Organizationalmeasures

Foam

sprinklerheadsystem

andextinguishersare

installed

(fireprotection).A

liquid

loss

monitorandblock

system

isinstalled

(automatedcontrol).Theflooriswaterproofto

avoid

infiltrationofreleasedliquidsinto

thesoilanditsslopeguarantees

aconfinem

entofliquid

releasedin

anadequate

basin.Inspectionactivities

are

conducted

toverifycontainers’integrity

when

they

enterin

theplantandperiodicallyduringtheyear

(plantsurveillance).Aninternalem

ergency

planisdesigned

andverified.

Plant

vulnerability

Loss

production

Asset

damage

Employee

density

Aknock-oneventcould

determineproductioninterruptionasboth

thefillingunitandother

depotsare

inthe

proxim

ityofthestorageunit(productionloss).Thus,amedium

levelofvulnerabilitycould

beestimatedin

term

sofasset

damage.

More

than20operators

are

constantlyin

thestorageunit,butinternalroadsare

usedbyother

operators

toreach

other

plantunits(employee

density).

Target

vulnerability

Infrastructures,

installations,

environmental

vulnerable

item

s,etc.

Nearthestorageunitbutoutsidetheplant,thereare

other

installations(industrialinstallations);public

serviceandresidentialareasare

locatedabout500m

from

theunit.Internalroadssurroundtheunit;no

railwaysandenvironmentallyvulnerable

areasare

inproxim

ity.Plantsafety

devices

anddepots

could

be

damaged

byaknock-onevent.

806

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

The advantage of the proposed model arises from the sensitivity analysis, whichallows singling out critical issues that have predominantly influenced the final scor-ing. Therefore, the model supplies prescription type and also the most effective areaof intervention in order to ‘‘optimize’’ resources to prevent and control knock-onrisks inside chemical installations. Thus, a ranking analysis of the estimated weightof each criterion on the final alternatives has been developed; the weight percentage(i.e., the score) of each second criterion on each final alternative is reported inFigure 5, even if this analysis has been carried out for every level of the proposedhierarchy. Estimated results show that the PV and L criteria affect mainly the finalalternative of minor prescription (characterized by the highest score). Thus, sug-gested interventions could be oriented to modify plant layout or handling proceduresthat contribute to increase substantially the knock-on risk. The model supported arelevant analysis: the introduction of vulnerability criteria in the proposed AHPstructure, differently from the Mond index, revealed the actual potential of amplifi-cation due to a knock-on event; thus, the model allows integrating intrinsic risks dueto the plant unit with external features that could contribute to amplify accident con-sequences characterizing the whole installation. The model could also be a dynamictool to control safety levels; if such a condition changes, the overall ranking could bemodified. As an example, if a decrease in the safety management system is verified inan inspection, the overall alternative ranking could be influenced. Thus, the model

Table II. Pairwise comparison scheme for data collection

Quantitativejudgment Qualitative judgment Description

1 Equal importance Elements Ai and Aj are equally important3 Moderate importance Experience and judgment slightly favor Ai

over Aj

5 Strong importance Experience and judgment strongly favor Ai

over Aj

7 Very strong Ai is very strongly favored over Aj

9 Extreme importance The evidence favoring Ai over Aj is of thehighest possible order of affirmation

2, 4, 6, 8 Interval values betweentwo adjacent choices

When compromise is needed, valuesbetween two adjacent judgments are used

Table III. First criteria comparison (level 2 versus goal)

Level 2 OP S L SM TV PV

OP 1 3 1=3 1=5 1=2 4S 1=3 1 1=3 1=5 1=3 3L 3 3 1 1 1 3SM 5 5 1 1 3 5TV 2 3 1 1=3 1 3PV 1=4 1=3 1=3 1=5 1=3 1

Value order reading is ‘‘row to column.’’

Controlling Knock-On Risk in Chemical Plants 807

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

could be also applied by plant operators in order to control their performance inpreventing knock-on risks.

These results have been compared with real decision carried out by the AT forthe proposed case study in order to validate the approach. The type of prescriptionsupplied by the AHP model is strictly in accordance with the actual decision suppliedby regulators: the AT had proposed a new operative procedure forbidding plasticbarrels being deposited near the storage unit in order to reduce propagation effectsin the event of a fire accident.

Table IV. Second criteria comparison (i.e., level 3 versus level 2)

Level 3Processphase

Faultinformation Level 3

Materialhandling

Layoutscheme

Process phase 1 1=3 Material handling 1 1=3Faultinformation

3 1 Layout scheme 3 1

Level 3Substance

typeSubstancequantity

Reactortype Level 3

Technicalmeasures

Managementmeasures

Substancetype

1 1 1=3 Technicalmeasures

1 1=2

Substancequantity

1 1 1=3 Managementmeasures

2 1

Table V. Suggested values for the RI parameter (defined in Saaty, 1977)

n parameter values

1 2 3 4 5 6 7 8 9

RI 0 0 0.58 0.90 1.12 1.24 1.32 1.41 1.45

Figure 4. Overall alternatives’ ranking evaluated by the proposed model.

808 M. G. Gnoni et al.

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

Furthermore, the area of intervention proposed by the AT could belong tointervention areas highlighted by the AHP model as it could affect both plant vulner-ability and layout criteria. It has to be noted that the AT applied no structured toolor guidelines for evaluating its final decisions. but based them only on qualitativeknowledge. On the other hand, the proposed approach could supply a more struc-tured and transparent method based on quantitative analysis.

According to overall results supplied, the proposed AHP model was revealed asa suitable tool for supporting decision making for preventing and controllingknock-on risk level in the chemical context.

Conclusion

A multi-criteria model based on the AHP technique has been developed to supportcompetent authorities (CAs) in evaluating effective decisions for preventing andcontrolling internal knock-on risk in chemical installations, as required by the MajorAccident Hazard (MAH) legislation. The proposed model has been designed tosupport an auditing team (AT), which represents the CA in inspections, in anMAH chemical installation in evaluating the effectiveness of equipment and=or aprocedure and=or the whole safety management system. Usually, this procedure iscarried out based only on experience of the AT. The proposed approach aims to sup-port the AT (or CA) in identifying an ‘‘optimal’’ decision according to a multi-criteriaanalysis; the results supplied regard both decision type and main areas of interventionfor reducing knock-on. This last potential is essential for the AT, which usuallyinvests great effort in highlighting areas of intervention. Furthermore, the applicationof a multi-criteria method, which has simultaneously involved intrinsic hazards,

Figure 5. Alternative score trends versus final second criteria scores for the case study.

Controlling Knock-On Risk in Chemical Plants 809

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

amplification effects, and consequence analysis has been shown to be effective inanalyzing prevention actions for knock-on risks. The strength of this tool is thestructured and transparent identification of the most effective prescription to preventand control knock-on risks; it supports the AT in pointing out prescription typeand intervention areas, thus allowing it to share decisions with plant operators moreeasily.

The proposed AHP model has been applied in a real case study and its adequacyhas been demonstrated for controlling knock-on risk, since the estimated modelresults are quite in accordance with the actual decision. In addition, the decisionmaking process could become more transparent by adopting the proposed method;final decisions could be more effectively shared between plant operators andcompetent authorities, as well as other stakeholders, including nongovernmentalorganizations and local government. Finally, the proposed approach could supporta more harmonized evaluation carried out by the CA as judgments (excluding thelast level of the hierarchy) could be shared by different ATs in order to definecommon estimations for MAH chemical installations. The developed method is flex-ible enough to be used in all countries with a major accident legislation. It has to benoted that the method is not suitable for external domino scenarios, where a quan-titative approach must be used in order to respond to legislative burdens.

Acknowledgments

The authors are grateful to the two anonymous reviewers for their effective sugges-tions. This research activity has been funded by the Italian Ministry of Labour,Health and Social Policies, Research Grant PMS40=06-P7.

References

Abdolhamidzadeh, B., Abbasi, T., Rashtchian, D., and Abbasi, S. A. (2010). A new methodfor assessing domino effect in chemical process industry, J. Hazard. Mater., 182, 416–426.

Abdolhamidzadeh, B., Abbasi, T., Rashtchian, D., and Abbasi, S. A. (2011). Domino effectin process-industry accidents—An inventory of past events and identification of somepatterns, J. Loss Prev. Process Ind., 24, 575–593.

Antonioni, G., Spadoni, G., and Cozzani, V. (2009). Application of domino effect quantitativerisk assessment to an extended industrial area, J. Loss Prev. Process Ind., 22(5), 614–624.

Cozzani, V., Antonioni, G., and Spadoni, G. (2006). Quantitative assessment of dominoscenarios by a GIS-based software tool, J. Loss Prev. Process Ind., 19, 463–477.

Cozzani, V., Tugnoli, A., and Salzano, E. (2007). Prevention of domino effect: From activeand passive strategies to inherently safer design, J. Hazard. Mater., A139, 209–219.

Darbra, R. M., Palacios, A., and Casal, J. (2010). Domino effect in chemical accidents: Mainfeatures and accident sequences, J. Hazard. Mater., 183, 565–573.

European Union. Major Accident Reporting System, MARS. Available at http://mahbsrv.jrc.it/mars/Default.html

Ha, J. S., and Seong, P. H. (2004). A method for risk-informed safety significance categoriza-tion using the analytic hierarchy process and Bayesian belief networks, Reliab. Eng. Syst.Saf., 83(1), 1–15.

Heller, S. (2006). Managing industrial risk—Having a tested and proven system to prevent andassess risk, J. Hazard. Mater., 130, 58–63.

Ho, W. (2008). Integrated analytic hierarchy process and its applications—A literature review,Eur. J. Oper. Res., 186, 211–228.

810 M. G. Gnoni et al.

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2

Imperial Chemical Industries (ICI), Explosion Hazard Section. (1985). The Mond Index:How to Identify, Assess and Minimize Potential Hazards on Chemical Plant Units, ICI,Norwich, UK.

Kourniotis, S. P., Kiranoudis, C. T., and Markatos, N. C. (2000). Statistical analysis of dom-ino chemical accidents, J. Hazard. Mater., 71(1–3), 239–252.

Reniers, G. (2010). An external domino effects investment approach to improve cross-plantsafety within chemical clusters, J. Hazard. Mater., 177(1–3), 167–174.

Reniers, G. L. L., Ale, B. J. M., Dullaert, W., and Foubert, B. (2006). Decision support systemsfor major accident prevention in the chemical process industry: A developers’ survey,J. Loss Prev. Process Ind., 19, 604–620.

Reniers, G. L. L., Dullaert, W., Ale, B. J. M., and Soudan, K. (2005). The use of current riskanalysis tools evaluated towards preventing external domino accidents, J. Loss Prev.Process Ind., 18, 119–126.

Saaty, T. (1977). A scaling method for priorities in hierarchical structures, J. Math. Psychol.,15(3), 234–281.

Saaty, T. L. (1980). The Analytic Hierarchy Process, McGraw-Hill, New York.Saaty, T. L. (2000). Fundamentals of Decision Making and Priority Theory with the Analytic

Hierarchy Process, RWS Publications, Pittsburgh.Saaty, T. L., and Peniwati, K. (2008). Group Decision Making: Drawing Out and Reconciling

Differences, RWS Publications, Pittsburgh.Solnes, J. (2003). Environmental quality indexing of large industrial development alternatives

using AHP, Environ. Impact Asses. Rev., 23(3), 283–303.Tesfamariam, S., and Sadiq R. (2006). Risk-based environmental decision-making using fuzzy

analytic hierarchy process (F-AHP), Stoch. Environ. Res. Risk Asses., 21(1), 35–50.Vaidya, O. S., and Kumar, S. (2006). Analytic hierarchy process: An overview of applications,

Eur. J. Oper. Res., 169, 1–29.Van der Voort, M. M., Klein, A. J. J., de Maaijer, M., van den Berg, A. C., van Deursen, J. R.,

and Versloot, N. H. A. (2007). A quantitative risk assessment tool for the external safetyof industrial plants with a dust explosion hazard, J. Loss Prev. Process Ind., 20, 375–386.

Zhang, X.-M., and Chen, G.-H. (2011). Modeling and algorithm of domino effect in chemicalindustrial parks using discrete isolated island method, Saf. Sci., 49, 463–467.

Controlling Knock-On Risk in Chemical Plants 811

Dow

nloa

ded

by [

Dip

Stu

di S

tori

ci S

ocia

li], [

Mar

ia G

razi

a G

noni

] at

04:

11 1

3 M

arch

201

2