Natech risk management
Guidance for operators ofhazardous industrial sites
and for national authorities
Necci A., Krausmann E.

2022

EUR 31122 EN

This publication is a Technical report by the Joint Research Centre (JRC), the European Commission’s science and knowledge
service. It aims to provide evidence-based scientific support to the European policymaking process. The scientific output
expressed does not imply a policy position of the European Commission. Neither the European Commission nor any person
acting on behalf of the Commission is responsible for the use that might be made of this publication. For information on themethodology and quality underlying the data used in this publication for which the source is neither Eurostat nor otherCommission services, users should contact the referenced source. The designations employed and the presentation of materialon the maps do not imply the expression of any opinion whatsoever on the part of the European Union concerning the legal
status of any country, territory, city or area or of its authorities, or concerning the delimitation of its frontiers or boundaries.

EU Science Hub
https://ec.europa.eu/jrc
JRC129450
EUR 31122 EN

PDF

ISBN 978-92-76-53493-8

ISSN 1831-9424

doi:10.2760/666413

Luxembourg: Publications Office of the European Union, 2022
© European Union, 2022

The reuse policy of the European Commission is implemented by the Commission Decision 2011/833/EU of 12 December 2011
on the reuse of Commission documents (OJ L 330, 14.12.2011, p. 39). Except otherwise noted, the reuse of this document isauthorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence(https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed provided appropriate credit is given and anychanges are indicated. For any use or reproduction of photos or other material that is not owned by the EU, permission must besought directly from the copyright holders.
All content © European Union, 2022 (unless otherwise specified). The source attribution is provided with the respective figuresin this report.
Cover photo: Oil tank swept off its foundation due to storm surge action during Hurricane Katrina in 2005 (Photo credit: B.
McMillan, FEMA).
How to cite this report: A. Necci, E. Krausmann, Natech risk management – Guidance for operators of hazardous industrial sites
and for national authorities, EUR 31122 EN, Publications Office of the European Union, Luxembourg, 2022, ISBN 978-92-7653493-8, doi:10.2760/666413, JRC129450.

Contents
Acknowledgements .................................................................................................................................1
Abstract....................................................................................................................................................2
1 Introduction .........................................................................................................................................3
2 Characteristics of Natech events and associated challenges ............................................................4
3 Introduction to Natech risk management............................................................................................6
3.1 Communication and consultation ...............................................................................................6
3.2 Establishing the context ..............................................................................................................6
3.3 Risk assessment .........................................................................................................................7
3.3.1

Risk identification..............................................................................................................7

3.3.2

Risk analysis .....................................................................................................................8

3.3.3

Risk evaluation .................................................................................................................8

3.4 Risk treatment .............................................................................................................................8
3.5 Monitoring and review.................................................................................................................8
4 Elements of Natech risk assessment .............................................................................................. 10
4.1 Natural hazard identification and characterization .................................................................. 10
4.2 Identification of critical equipment ........................................................................................... 13
4.3 Natural hazard damage to critical equipment .......................................................................... 14
4.4 Accident contributing factors: safety barriers and utilities ....................................................... 22
4.5 Natech hazard identification .................................................................................................... 24
4.5.1

Direct effects of the natural hazard ............................................................................... 24

4.5.2

Indirect causes .............................................................................................................. 24

4.6 Natech consequence analysis ................................................................................................. 25
4.6.1

Loss of containment and critical events ........................................................................ 25

4.6.1.1
4.6.2

LOC scenarios for damage states ......................................................................... 27

Natech consequence scenario modelling ..................................................................... 28

4.6.2.1

Natech chain of events .......................................................................................... 28

4.6.2.2

Simultaneous accidents ......................................................................................... 29

4.6.2.3

Environmental conditions ....................................................................................... 29

4.6.2.4

Exposure and vulnerability of endpoint receivers .................................................. 31

4.7 Natech likelihood assessment ................................................................................................. 31
4.7.1

Release/top event likelihood ......................................................................................... 32

4.7.1.1

Damage likelihood ................................................................................................. 32

4.7.1.2

Likelihood of critical events due to direct damage ................................................. 33

4.7.1.3

Probability of indirect Natech accidents ................................................................. 33

4.7.2

Natech-specific event trees ........................................................................................... 34

4.8 Natech risk evaluation ............................................................................................................. 35
5 Measures to reduce Natech risk ...................................................................................................... 36
5.1 Natural hazard impact mitigation ............................................................................................. 36i5.1.1

Physical measures ........................................................................................................ 36

5.1.2

Procedural measures .................................................................................................... 36

5.1.2.1

Before the event .................................................................................................... 37

5.1.2.2

After the event ....................................................................................................... 37

5.2 Equipment design and retrofitting ............................................................................................ 38
5.3 Safety barriers and auxiliary systems ...................................................................................... 39
5.4 Emergency planning and response to Natech accidents ........................................................ 40
5.5 Learning from past Natech accidents ...................................................................................... 40
References ........................................................................................................................................... 42
List of abbreviations and definitions ..................................................................................................... 45
List of boxes.......................................................................................................................................... 47
List of figures ........................................................................................................................................ 48
List of tables.......................................................................................................................................... 49ii

Acknowledgements
The authors thank Zsuzsanna Gyenes and Maureen Wood, both from the European Commission Joint
Research Centre, for the careful review of this guidance and their useful comments which helped to
improve this document.
Authors
Amos Necci
Elisabeth Krausmann1

Abstract
Natural hazards, such as earthquakes, floods or storms, can trigger the release of toxic substances,
fires and explosions when impacting industrial installations that process, store or transport hazardous
materials. This type of event is called Natech (natural hazard triggered technological) accident. Impacts
on industrial operations and hazardous infrastructure are a recurring but often overlooked feature inmany natural disaster situations. With climate change affecting the intensity and frequency of somenatural events, Natech risk has become a topic of concern for disaster risk management at local, national
and international levels.
Following a number of important accidents, awareness of Natech risk has increased in the European
Union, and the risk has been acknowledged in legal acts on chemical accident prevention. In 2012, an
amendment of the EU Seveso Directive on the control of major accident hazards involving dangerous
substances explicitly introduced Natech risk as an issue of concern that is required to be addressed.
To date the implementation of effective Natech risk management has been hampered by a general lackof guidance on how to conduct Natech risk assessment. In order to facilitate compliance with therequirements of the Seveso III Directive or similar legislation, this document aims to provide technicalguidance on Natech risk management for operators of hazardous installations and national authorities.
It outlines the necessary steps in the Natech risk management process and discusses the main
challenges that hamper its proper implementation. While emphasising the identification and modeling ofspecific scenarios for Natech risk assessment, the document also provides solutions for addressing
existing gaps in Natech risk assessment and the control of Natech risk.
Although this guidance focuses on Seveso requirements, the Natech risk management principles
discussed herein can also be adopted in other industry sectors that handle hazardous materials.

2

1

Introduction

Natural hazards can trigger the release of toxic substances, fires and explosions when impacting
industrial installations that process, store or transport hazardous materials. This type of event is called
Natech (natural hazard triggered technological) accident (Krausmann et al., 2017). Natech accidents
are therefore technological accidents, and the management of the associated risk is within the purview
of the operator of a hazardous site. With climate change affecting some natural hazard triggers and withincreasing human development (booming urbanization, rapid industrialization), Natech risk is expected
to increase in the future.
Experience shows that a large number of past Natech accidents could have been prevented if only
better awareness and understanding of the risk had existed. Following a number of important Natech
accidents, awareness of Natech risk has increased in the European Union (EU), and the risk is
acknowledged in legal acts on chemical accident prevention. The EU Seveso III Directive (2012/18/EC) 1
requires that national authorities oversee the implementation of effective safety policies for the controlof major accident hazards at industrial installations involving dangerous substances. In this framework,
operators of upper-tier establishments are obliged to present a safety report to their national authorities
to demonstrate that they have evaluated all risks, including those due to natural hazard impacts, andthat they have taken all measures to prevent major accidents. The safety measures implemented athazardous establishments should be based on the risks identified and assessed in the safety report.
The Directive explicitly states that safety reports must include “a description of the possible major
accident scenarios and their probability […], the causes being internal or external to the installation;
including in particular: […] natural causes, for example earthquakes and floods” (Annex II of the Seveso
III Directive).
A study by Krausmann and Baranzini (2012) on the status of Natech risk management in the EU foundthat the implementation of effective Natech risk management is hampered by a general lack of guidanceon Natech risk assessment, in the absence of which the measures taken by operators to reduce the risk
may be incomplete or inadequate. Since then, national and international initiatives have been launchedwhich have resulted in the preparation of natural hazard-specific or high-level guidance to raiseawareness of and better manage Natech risks (e.g., INERIS, 2014; OECD 2015; UNI, 2021; TRAS
310,320, 2022; DSB, 2022). This document complements these initiatives by providing the firstcomprehensive technical guidance for operators that describes the process of Natech risk analysis in asystematic way and which is applicable to all natural hazard triggers.
In order to facilitate compliance with the requirements of the Seveso III Directive, this document
introduces the main characteristics of Natech accidents, collected during years of observation and study,
and provides clear guidance on how to identify, analyse and treat Natech risks at industrial sites. In thiscontext, particular emphasis is given to the identification and modelling of specific scenarios for Natech
risk assessment. Using practical examples, the guidance also suggests solutions for better control of
the Natech risk.
While Natech risk management should be implemented both at local and territorial level, this guidance
focuses on the site level and addresses with priority the operators and inspectors of Seveso III
establishments. The information provided is, however, also directed at national authorities responsible
for ensuring compliance with major accident prevention legislation.
Although this guidance is centred on Seveso requirements, the Natech risk management principles
discussed herein can also be adopted in other sectors, such as in industry that handles quantities ofhazardous materials below the Seveso qualifying criteria, offshore oil extraction, critical infrastructure,
defence facilities, and the transport of hazardous materials.

1

https://ec.europa.eu/environment/seveso/legislation.htm

3

2

Characteristics of Natech events and associated challenges

Natech accidents are a class of cascading events that manifest when technological systems are affectedby the impact of natural hazards which in turn results in the release of hazardous materials. Natech
events have occurred during many past natural disasters and have often had significant impacts on
public health, the natural and built environment, and the economy (Krausmann et al., 2017). Contrary
to common belief, Natech events can also be triggered by “minor” natural hazards. For example, in astudy reviewing Natech risk management in the European Union, Krausmann and Baranzini (2012)
found that in contrast to risk perception the number of accidents caused by lightning and low temperature
was significantly higher than the number of accidents triggered by windstorms and earthquakes.
The characteristics of Natech events differ from those of other types of technological accidents. A lackof awareness and low preparedness levels can limit greatly the effectiveness of existing risk
management approaches against Natech accidents. Some recurrent characteristics that need to betaken into consideration in Natech risk management are:1.

Some natural hazards can affect large areas, hitting several hazardous industrial sites
and installations at the same time (e.g., earthquakes, floods, storms). They can trigger
multiple Natech accidents simultaneously, possibly leading to situations where theconsequences of multiple accidents overlap, thereby challenging limited emergency response
resources and hitting the affected area harder than any one accident alone would have done.

2.

Natural events can affect engineered protection barriers (e.g., containment dikes, gas
detectors, alarms, backup power generators, water sprinkler systems) that are meant to handle
hazardous situations, preventing their evolution into full-scale accidents. Similar to impacts on
installations, natural hazards can disrupt or destroy many safety barriers at the same time,effectively thwarting any effort to improve the reliability of safety systems via redundancy.

3.

Natural events can disrupt auxiliary systems and utilities (e.g., power, water,
communication lines), thereby triggering or aggravating an accident. In a process plant, the lossof utilities may result in a wide range of unwanted events, e.g., loss of control of an industrial
process, inoperability of safety equipment, or the inability to contact the local civil protection
authorities and to implement emergency plans correctly.

4.

Standard emergency response measures may not be functional or appropriate during an
accident caused by a major natural event. Procedures commonly used during conventional
technological accidents, like shelter in place or evacuation, may not be feasible. In the wake ofa natural disaster, roads are often impassable, e.g. due to flooding or fallen trees. Emergency
responders may not be able to access the site, thereby increasing the response time, whilepeople at risk, including the pant personnel, would be unable to evacuate (Steinberg et al.,2008). In addition, protection from chemical releases by staying indoors (“shelter-in-place”) may
not be a viable option when the structural integrity of a building is compromised by, e.g., anearthquake.

5.

Natural hazards can aggravate the consequences of Natech accidents by creating
secondary hazards or by expanding the accident’s impact zone. For example, releases intofloodwaters can spread hazardous materials over wide areas and therefore increase thepollution or fire risk. Also, some otherwise innocuous chemicals can change characteristics
upon contact with water (floodwaters, rain), creating toxic or flammable vapours that pose newhazards to the population and to emergency responders.

6.

Compared to other types of technological accidents, Natech accidents feature a higher
likelihood of domino effects (the process of the propagation of an accident to nearby units or
to other plants that produces an escalation of the consequence of the initial accident)(Krausmann et al., 2017, p. 4). This is mainly due to limitations in the mitigation of theconsequences of Natech accidents already mentioned in the previous bullets.

7.

Natural hazards can trigger cascading effects that may cause a secondary natural hazard
to affect the industrial site (e.g., heavy rain causing a landslide; earthquake triggering atsunami). Natural hazards and their cascading effects can cause damage and disruption
separately, but also due to their combined effects, which needs to be taken into account in the
Natech risk assessment. For instance, in the case of the 2011 Tohoku earthquake, the tsunami
was the main source of damage to several industries and contributed to spreading hazardous
materials in the environment (BARPI, 2013).

4

8.

Natural hazards are changing in time and location due to climate change, and anticipationof and adaptation to such changes are needed for effective Natech risk management. If there
are new insights into a specific natural hazard, previous Natech risk assessments and the risk
management measures implemented as a consequence need to be reviewed and revised if
necessary. Adaptation of risk management strategies to changing boundary conditions whichthemselves may be subject to uncertainty is challenging.

5

3

Introduction to Natech risk management“Risk management” is composed of all coordinated activities to direct and control an organisation withregard to risk. Risk management covers the whole process of identifying and assessing risks, setting
goals, and creating and operating systems for their control. Risk is generally defined as the likelihood ofa specific effect occurring within a specified period or in specified circumstances. In the context ofprocess safety, risk is a measure of the combination of the extent of consequences of an
accident and their likelihood. Generally, organisations use risk management to deal with internal andexternal factors that create uncertainties in the achievement of the organisation’s objectives. One of themain applications of risk management at hazardous process plants is major accident risk control. The
hazards with which risk management is concerned include those from natural events and those fromman-made systems that give rise to a range of physical, financial, legal, and societal risks (Mannan,2005). The risk management process is composed of a number of generic steps (Figure 1). This chapter
discusses these steps based on ISO-31000 2 in the context of a framework for Natech risk managementwith a focus on risk assessment and treatment.
Figure 1. The process of risk management.

Source: ISO 31000:2009(E)3.1

Communication and consultation

Communication and consultation with internal and external stakeholders should take place during all
stages of the risk management process. These activities should address all risks, including their causes
and consequences, and measures to treat the risks. Consultation ensures that all interests related to arisk are taken into account. This helps to establish the risk management context correctly and that theplans for risk treatment are endorsed. It is worth noting that perceptions of risks can vary among
stakeholders due to differences in values, interests, needs, assumptions, concepts, and concerns.

3.2

Establishing the context

In this step, the organisation articulates its objectives, defines the internal and external parameters to
be taken into account when managing risk, and sets the scope and risk criteria for the remaining process.
In this regard, for all European chemical enterprises with major accident risk, the main objective is tocontrol the risk to workers on site, to the nearby population and to the environment due to the presence2

ISO 31000:2009(E) Risk management - Principles and guidelines, 1st ed., 2009, International Organization forStandardization, Switzerland.

6

of hazardous materials in areas with natural hazards, in compliance with national rules that transpose
the requirements of the EU Seveso III Directive.
In the Seveso framework, operators are obliged to take action to prevent major accidents on site,
including Natech accidents, and to mitigate their consequences. To achieve this goal, the risks
associated with the release of dangerous substances must be identified, assessed and managed. To
this end, the operator should draw up a major accident prevention policy (MAPP) implemented by theappropriate means, structures and a safety management system (SMS). The information generated in
the context of Natech risk management is, i.a., used to draw up the site’s internal emergency plan whichis then also submitted to the competent authority to enable it to prepare the external emergency plan.
Land use planning (LUP) is a key component for accident risk management, as it aims to identify whether
the risks posed by a hazardous industrial site are compatible with the surrounding territory. In Seveso
III, this evaluation must take account of the presence of residential areas, commercial activities,
locations of public use (e.g., hospitals and schools), transport routes, other industries, agricultural areas,and environmentally protected areas. Each of these entities may be impacted differently in case of an
accident, therefore it is important to consider each risk receiver individually. For Natech risk
management, LUP is also relevant to determine if a hazardous site is or would be located in an area
subject to natural hazards. In this case, it may be decided to relocate a new plant project elsewhere or
to implement additional protection measures. When several hazardous sites are located in the same
natural hazard-prone area, they should cooperate in order to control risk due to possible domino effects
when accidents propagate from one site to the other.
Each operator should develop their own policy to ensure safety by controlling major accidents, incompliance with regulations, the strategic view of the organisation, and its business objectives. Since
the goals are manifold, the risk criteria and methodologies used by different businesses could differ
significantly. Also, within the same site, different methodologies may be applied when evaluating
different types of risk (for example, when calculating the risk to the environment or the risk to thebusiness). When defining risk criteria, the following factors should be taken into consideration (ISO
31000:2009(E)):
•
•
•
•
•
•
•

3.3

The nature and types of causes and consequences that can occur and how they will bemeasured;
How likelihood will be defined;
The timeframe(s) of the consequence(s);How the level of risk is to be determined;
The views of stakeholders;
The level at which risk becomes acceptable or tolerable; andWhether combinations of multiple risks should be taken into account and, if so, how and which
combinations should be considered.

Risk assessment

Risk assessment is a complex process composed of risk identification, risk analysis and risk evaluation.
Natech risk assessment, which requires extensions compared to conventional industrial risk
assessment, is discussed in detail in Chapter 4.

3.3.1

Risk identification

The organisation should identify sources of risk (hazards), areas of impacts, and events that can leadto risks (e.g., occurrence, causes and consequences of process upsets). The aim of this step is togenerate a comprehensive list of risks present at a hazardous site based on those events that might
create, enhance, prevent, degrade, accelerate or delay a risk. All significant event causes andconsequences should be identified. Identification should include risks whether or not their source isunder the control of the industrial site, even though the source of risk may not be evident. It should also
consider a wide range of event consequences.
NB: Risk and hazard identification are often used interchangeably in process safety. A hazard is a
generic source of risk (e.g., the presence of a flammable substance) while specific risks can begenerated from the hazard (e.g., presence of a flammable substance in the vicinity of a risk receptor).
The risk identification step does not assess the identified risks but should ascertain that all relevant risks
are captured before proceeding with their analysis. For the purpose of this guidance we use the term
hazard identification.

7

For Natech accidents, the risk source is two-fold: On the one hand, there are natural hazards that canthreaten a site; on the other hand, there are the hazards due to the presence of hazardous materials
and processes.

3.3.2

Risk analysis

Risk analysis is aimed at determining the risk, i.e., evaluating the severity and likelihood, associatedwith the main accident scenarios. The risk analysis uses various techniques to estimate these twoelements for each scenario. These methods can be qualitative, semi-quantitative or quantitative,
depending on a number of factors, such as data, time and resource availability, or scope of the analysis.
In this step, factors that affect consequences and likelihood must be analysed, in particular the causes
and sources of risk, and their positive and negative effects on both likelihood and consequences. The
results of the risk analysis should be framed in the context of uncertainties and assumptions that may
affect the robustness and credibility of the conclusions from the analysis.
Risk analysis provides the input to the risk evaluation and risk treatment steps. The decision to reduce
a risk is based on the results of the risk analysis. Risk analysis can also provide an input to decisionmaking where choices must be made about the relevance of different types of risk or the prioritisationof different risk reduction measures. Risk mitigation strategies and their effectiveness should also betaken into account in risk analysis.
For Natech risk analysis both the risks due to natural hazards and technological hazards must be
analysed and combined.

3.3.3

Risk evaluation

The purpose of risk evaluation is to assist in making decisions, based on the outcome of risk analysis,
about which risks need treatment and the priority for treatment implementation. In the evaluation, thelevel of risk obtained during the analysis is compared with risk criteria established during the contextsetting step. Based on this comparison, the need for risk treatment may be identified. Occasionally, therisk evaluation can lead to a decision to undertake further analysis.

3.4

Risk treatment

Risk treatment consists of the selection and implementation of one or more actions for reducing risks.
Risk treatment involves an iterative process of implementation, monitoring, and review that repeats until
a target goal is reached.
Some examples of risk treatment are:•

Avoiding the risk by deciding to stop (or not to start) the activity that gives rise to the risk;•

Removing the risk source;•

Reducing the likelihood;•

Mitigating the consequences;•

Sharing the risk with another party or parties (e.g., partnership, insurance);•

Making an informed decision to retain the risk.

Selection and implementation of a risk treatment option requires evaluating the benefits versus costs.
For example, some risk treatment options may be prohibitive on economic grounds, e.g., when highcosts would result in only a minimum reduction of the level of risk. Alternatively, some options, or
combinations of options, may have a low cost but have a greater impact on risk reduction than othermore expensive options.
Options for treating Natech risk are discussed in Chapter 5.

3.5

Monitoring and review

Both monitoring and review steps are an integral part of the risk management process. Monitoring andreview covers all aspects of the risk management process and can be periodic or ad hoc. This activity,
implemented, e.g., via inspections or audits, ensures that controls are effective while helping to obtain
additional information for risk assessment. It supports the analysis and learning of lessons from events,

8

successes and failures, and it facilitates the identification of changes in the established context of therisk assessment, or in the nature of risk, which would then translate into an adaptation of the risktreatment. This step also helps to measure the performance of the whole risk management process.

94Elements of Natech risk assessment

Natech risk combines risks due to natural hazards and those due to hazardous human activities. Natural
hazards can affect man-made risks in a particular area either by increasing the frequency (likelihood) ofmajor accidents in hazardous installations or by producing an array of accidents that would not occur
without the impact of an external force (e.g., displacement of a tank due to storm surge and release into
the floodwaters). In addition, when a natural disaster hits a region with industrial sites and technologicalhazards, the Natech accidents triggered may increase the severity of the impacts associated with thenatural disaster and hamper natural disaster response activities due to hazardous materials releases(Necci et al., 2018b).
Natech risk assessment requires the adaptation of conventional industrial risk analysis approaches toaccount for the specific characteristics of Natech risk (natural hazard trigger, potential for multiple andsimultaneous loss of containment events). It also requires the identification of Natech scenarios that are
representative of the impact of specific natural hazards on a specific site. Natech accident scenarios
feature a natural hazard scenario, a scenario of the potential effects on the installations (e.g., damage,disruption) that lead to a critical event (e.g., loss of containment), and a consequence scenario to assess
the extent of the damage. This chapter discusses the steps required to analyse (Steps 1-6) and evaluate(Step 7) Natech risks at an industrial site. These are:
1. Natural hazard identification and characterization;
2. Identification of critical equipment;
3. Analysis of natural hazard damage to critical equipment;
4. Natech hazard identification;
5. Natech consequence analysis;
6. Assessment of Natech event likelihood;
7. Evaluation of Natech risk.
Natech risk assessment requires a significant amount of input data, such as information on the natural
hazard, the vulnerable equipment, damage models and data linking damage to releases, consequence
analysis models, likelihood estimates and information on the risk receptors (Krausmann, 2017).
Box 1. Uncertainties and lack of data

Risk analysis invariably contains uncertainties introduced during the steps of the analysis process.
These uncertainties stem from uncertainties in models, input data and general analysis quality (CCPS,
2000). Natech risk analysis usually contains a larger number of uncertainties compared to the analysis
of other types of technological risks. This is due to a frequent lack of detailed data on the natural hazard
trigger (especially for very rare events), missing fragility data for certain types of equipment and specificnatural hazards, or the absence of consolidated models for Natech risk analysis. The analyst may resort
to using expert judgement that is - by nature - subjective to complete the missing information, adding
further uncertainty to the analysis. Transparency about the assumptions that went into the risk analysis
and the associated uncertainties helps the users of the analysis to apply its results cautiously.

4.1

Natural hazard identification and characterisation

This step consists of gathering and analysing data on the natural hazards (CCPS, 2019). Natech
accidents can be triggered by all types of natural hazards, including rapid-onset (e.g., earthquakes,
hydro-meteorological events) or slow-onset ones (e.g., sea-level rise, drought). It is important that all
types of natural hazard that have the potential to trigger an accident at an industrial site are
identified. At least one natural hazard scenario should be described for each site-relevant natural
hazard. Different criteria for the selection of the natural hazard scenarios can be used (most likely, worst
case, etc.); they are all viable provided that the choice is reasonable and can be justified.
The natural hazard description can be either probabilistic or deterministic. In the deterministic approach,experts identify a reference natural hazard scenario (e.g., credible worst case, most likely) that is
described through its intensity (e.g., peak ground acceleration, flood depth). In the probabilistic
approach, the hazard description includes an estimate of its frequency based on historical records inaddition to an intensity measure.

10

The natural hazard information can be described in two ways:
1. As a discrete event (a scenario), or as a set of discrete events (scenarios) with a specificintensity (e.g., wind speed, peak ground acceleration). Each such event (e.g., river flood,earthquake scenario) can occur with a given probability in a reference time interval. A typical
way to describe the probability of a scenario in a way that is easy to understand is assigning a“return period” to the scenario. A return period describes the average time between two
occurrences of the same event. A return period is high for events that are unlikely to occur andvice versa.
2. Associated with a variable (the intensity parameter) that has a range of values. The
probability that a given value of the intensity parameter will be equalled or exceeded in areference time interval is described by the use of continuous probability distribution functions,also known as hazard curves. For some hazards like earthquakes, volcanoes and tsunamis,
this information is typically displayed in hazard maps.
Analysts with adequate information at their disposal can adapt the approach they prefer to use. From a
set of scenarios with associated probabilities, hazard curves can be derived. Alternatively, from a hazard
curve one or more discrete events (scenarios) can be selected using values of the intensity parameterchosen at specific points of the distribution (e.g., the median value, quartiles, percentiles).
Figure 2 shows an example of a single scenario with a 100-year return period in the form of a flood
hazard map, while Figure 3 shows an example of a hazard curve built to represent the relationshipbetween ground shaking and probability at a specific location.
Location-specific data at the site of the industrial plant should be used for the description of the intensity
parameters of the natural hazards (e.g., mapping natural hazard scenarios, or using hazard maps),
allowing the identification of the exposed installations in the plant. Some natural hazard scenarios may
not affect just one part of the site, but several installations at once (or even all of them), although someparts may be more vulnerable to natural hazard impact.
Once the natural hazard scenario, or its relevant intensity parameter, is known, the effects of the natural
hazard on the site’s surroundings should be briefly evaluated, as well. In particular, macroscopic effects
on nearby electricity infrastructure and roads should be identified and used later in the assessment of
the Natech scenarios and the associated emergency response plans.
For each scenario, the natural hazard description should adhere to the following principles:
•
•
•
•
•
•

•
•
•
•
•

•

The type and characteristics of the natural hazard should be indicated.
Natural hazard scenarios should be detailed and complete and should be described according
to best practices.
The level of detail of the natural hazard information should be adequate for the analysis ofmajor accident risks.
The person, or agency, carrying out the assessment of the natural hazards at the industrial siteshould have the appropriate expert knowledge and competence.
The source documentation should be readily available for subsequent assessments.
The natural hazard description should be based on reliable and trusted sources. The
preferred sources of information are generally government authorities (e.g., civil protection, Met
office, geological survey) at the national, regional, or local level.
The natural hazard information should be as up-to-date as possible.
It should take into consideration the increasing frequency and intensity of some natural hazards
due to climate change.
It should also take into consideration other influencing factors, such as changes in land-use
over time and in the natural hazard management of the territory.
A list of the installations exposed to the harmful effects of the natural hazard should becreated.
The natural hazard information should be useful for assessing the potential damage toindustrial equipment (including auxiliary systems and safety barriers) and/or utility disruption (i.e.,
potential accident initiators).
This information should include references to historical natural hazard events that occurredat the site or in its vicinity.

11

Figure 2. Example of a water depth map associated to a 100-year return period flood.

Source: Fernandes et al., 2022

Figure 3. Example of an earthquake hazard curve showing the probability of exceedance of the peak groundacceleration at a given location.

Source: USGS, Unified Hazard Tool, 2022, https://earthquake.usgs.gov/hazards/interactive/

12

Box 2. Climate Change

The management of Natech risk requires anticipation of future changes of the climate and adaptation to
the foreseen new conditions. In fact, climate change has been linked to an increase of both frequency
and intensity of extreme hydro-meteorological events. Moreover, climate change is responsible for anumber of phenomena that can be a hazard for industrial plants located in certain regions. These are:- Sea level rise
- Snowmelt- Desertification- Wildfires- Permafrost thawing
Operators should acknowledge the hazards posed by climate change and the possibility of an increaseof the severity of some natural hazards. Several actions can help to cope with risks due to climatechange, for example:
1. Development of a climate adaptation strategy.
2. Analysis natural hazards that are specifically caused by climate change or worsened by it.
3. Acknowledgement that past natural hazard information is insufficient, on its own, to give an accurate
estimate of the natural hazards of a future that covers the whole operative lifetime of the site.
4. Keeping risk assessments updated and adaptation of preparedness measures as new natural hazard
information becomes available.
5. In the absence of a clear estimate of the effect of climate change on the expected severity of futurenatural hazards, representation of this additional uncertainty by applying corrective factors that increase
the expected severity of future natural hazards. This principle has been implemented in the German
Technical Rules for process safety TRAS 310 (2022) and TRAS 320 (2022). The adapted values should
be used for both Natech risk assessment and equipment design.

4.2

Identification of critical equipment

For every industrial site exposed to a natural hazard, potential damage to all installations that
contain hazardous materials should be assessed. It is therefore important to identify all the criticalequipment that could lead to Natech accidents. The analysis should focus on equipment whose
sudden failure may result in a foreseeable chain of events that leads to hazardous situations 3.
For example, storage tanks have proven to be vulnerable to many natural hazards. In addition, theconsequences of accidents at large storage tanks can be very severe due to the large quantity ofhazardous materials they contain.
Past studies provide pragmatic methods for a preliminary ranking of different types of equipment, basedon their Natech consequence potential. The preliminary criteria use operating conditions, volume, andphysical state of hazardous materials for the ranking. In fact, Natech accidents can be all the more
severe depending on the amount of hazardous materials involved, and on their storage or process
conditions.
Storage and process conditions that affect the accident consequences are:•3

Temperature: At high temperature, even combustible substances classified as non-flammable
can reach their flash point and pose the same fire hazard as flammable substances would do.
When the temperature is sufficiently high, the self-ignition temperature can be reached. Also, aliquid stored at high temperature is more volatile than a liquid at low temperature (affecting both
flammable and toxic substances). As a result, a cloud formed from evaporation (or boiling) at
high temperature contains more hazardous material than a cloud formed at low temperature. A
superheated liquid may “flash” upon release, generating a vapour cloud much faster than it
would do through evaporation. High temperature also directly translates into high storage

A hazardous situation is a circumstance that exposes people, property or the environment to one or morehazards (ISO 14971).

13

pressure for pressurised gas (the pressure increase is almost proportional to temperature andfollows the equation of state) or gas liquefied under pressure (the pressure increase is almost
exponential with temperature and follows the Antoine equation).
•

Pressure: High pressure produces a driving force that translates into a high release rate ofhazardous material in case of rupture or leak of the container. For a gas, higher pressure alsomeans more material in the storage. Pressurised vessels also produce a blast when ruptured
and are likely to project fragments of the broken vessel in all directions.

•

State of matter: State of matter influences the quantity of hazardous material and the operative
conditions. Liquids contain a larger quantity of hazardous material per unit of volume comparedto gases, but they take time to evaporate. However, gases have other properties that makethem dangerous. They are usually stored and processed under high pressure (see Pressure)and upon release they become immediately airborne. Gases liquefied under pressure havehazardous properties of both liquids and gases. They have high density, comparable to thoseof liquids, are stored under pressure, and flash immediately upon release. Superheated liquids
behave similarly to gas liquefied under pressure. Gases liquefied at very low temperature havethe same behaviour as liquids and they typically do not flash upon release. However, theyevaporate much more quickly than most liquids.

•

Volume: Some processes are inherently larger than others, meaning that they contain higher
amounts of hazardous materials. Storage vessels are usually the largest vessels and aredesigned to contain high substance quantities. Pipelines and piping can also contain a large
amount of substance. Similarly, separators and columns also contain a large amount of
hazardous material although they are usually smaller than a storage unit and are typically only
partially filled. Reactors are usually the smallest process units. Other units that may contain aconsiderable amount of hazardous material are heat exchangers, furnaces, ovens, and boilers.

Table 1 shows an example of the application of this approach to obtain a preliminary ranking of criticalequipment units. The method that was applied by Antonioni et al. (2009) takes into account the maximum
damage distances (calculated taking into account lethal effects for humans) expected for different unit
types and substances, with similar release scenarios (equal hole diameters through which the releaseoccurs).
It is important to note that the ranking of equipment in terms of their criticality may have different
outcomes depending on the type of risks considered. In fact, the results of the ranking may change
when the target of the assessment changes. Likewise, some units that may have a high score for one
type of risk may not be considered critical at all for a different risk. For instance, storage vessels of liquid
lubricant may rank high when the damage distances are calculated taking into account the impact on
the environment, particularly on water bodies. However, the same unit is not critical at all when
considering the risk to people or assets since lubricant oil is neither flammable nor toxic for humans.
Table 1. Example criteria for the identification and ranking of critical equipment items (Antonioni et al., 2009).

Storage vessels

Large-diameter
pipes

Columns

Reactors, heatexchangers

Pressurizedliquefied gas

4

4

3

3

Superheatedliquid

3

3

2

2

Gas
(compressed)

3

2

2

1

Cryogenic liquid

2

2

2

1

Liquid

1

1

1

1

4.3

Natural hazard damage to critical equipment

For every natural hazard, it is important that the main damage modes of each critical equipment
belonging to an exposed plant are identified. Damage modes that could lead to hazardous situations or

14

loss of containment (LOC) should be considered (e.g. storage tank rupture with leakage). The main
damage modes for the most common types of equipment units are described below.
Buckling damage: Deformation of metal enclosures is typical for many types of natural hazards whena sudden load affects the structure. Buckling alone does not typically cause loss of containment.
However, it may cause structural instability and may be accompanied by other damage types, such as
the rupture of pipes and connections, tearing of metal plates or detachment of the shell-to-bottom
connection. Buckling damage is often observed in the lower part of atmospheric storage tanks following
strong earthquakes, and manifests as “elephant foot” buckling or “diamond” buckling of the tank wall
(Eidinger et al., 2001; Cooper, 1997). Buckling damage can also occur due to debris impact, e.g. during
flooding, landslides or high winds, or due to wind buckling in empty tanks. Figure 4 shows an exampleof buckling damage due to earthquake.
Rupture of pipes and fittings: Damage to piping typically results in loss of containment. Earthquakes
and floods have been responsible for deformation and rupture of pipe networks especially at flanges
and other types of connections by displacement of units connected to the network (see Displacement
and overturning). Rupture often occurs because the pipe network is usually not designed to allow forplastic deformation when the natural event causes large displacements. Lightning strikes havepunctured pipes both on the ground and underground. Strong winds have caused tall objects (like stacks
or chimneys) to fall onto pipes and pipe racks, severing them (Necci et al., 2018a). Low temperatures
have triggered several accidents due to solidification (freezing) of content inside the pipes, thereby
choking the flow. Figure 5 shows an example of a pipe break at a flange connection during anearthquake.
Figure 4. Buckling damage due to an earthquake at silos.

Photo credit: E. Krausmann

15Figure 5. Pipe break at flange connection during an earthquake.

Photo credit: A.M. Cruz

Tearing of metal shell: When the deformation is sufficiently large, the metal sheets that compose theshell of a vessel may fall apart and cause a LOC. This phenomenon is more frequent for equipment
whose shell plates have been riveted or bolted together (Eidinger et al., 2001; Cooper, 1997).
Detachment of the shell-to-bottom connection: In most atmospheric storage tanks the shell walls
and bottom can be composed of two separate metal sheets. When buckling affects the lower part of avessel, the annular connection between the wall and the bottom is heavily stressed. Tearing of thevessel at this location can cause loss of containment of hazardous materials. This damage mode isoften associated with elephant foot buckling of atmospheric storage tanks in earthquakes (Eidinger etal., 2001; Cooper, 1997). Figure 6 shows an example of shell-to-bottom detachment during a hurricane,likely due to storm surge and wind action (including possible debris impact).
Support leg failure: Many equipment units have support legs to sustain their weight. These legs are
typically designed to sustain the equipment’s own weight including its content and some horizontal
excitation. In the case of earthquakes, lateral loads can exceed the design specification of support legs
and cause their failure, resulting in the entire equipment to collapse on the ground (Eidinger et al., 2001;
Cooper, 1997).This damage mode can cause loss of containment. Figure 7 shows an example ofsupport leg failure in the wake of an earthquake.
Rupture of fixed tank roof: When a storage tank has a fixed roof, it can be vulnerable to the impact ofa natural hazard, being the part of the equipment with the lowest weight and thickness. Strong winds
can cause the roof to buckle (Godoy, 2007) without loss of containment. Liquid sloshing caused byearthquakes may cause the roof to buckle and portions of the liquid to spill outside the tank throughvents and through newly created tears on the roof (Eidinger et al., 2001; Cooper, 1997). Figure 8 shows
an example of wind damage to a storage tank’s fixed roof.

16

Figure 6. Shell-to-bottom detachment of an atmospheric storage tank during a hurricane. The insulation of thetank was also stripped away.

Photo credit: M. Nauman, FEMA

Figure 7. Support leg failure of a spherical storage tank due to earthquake.

Photo credit: H. Nishi

17

Figure 8. Damage to the fixed roof of an atmospheric storage tank caused by strong wind.

Source: NOAA

Floating roof failure: Some of the biggest atmospheric storage tanks, designed to hold large amountsof liquid product, do not have a fixed roof, but a metal deck that floats on the liquid surface. When theroof sustains damage, it may sink into the liquid below. When this happens, the liquid surface is exposedto the air and the product starts to evaporate with the release of vapours into the atmosphere (Necci etal., 2018a). In addition, the rainwater drains installed on the roof (now submerged) may cause the liquid
to be released through the drain and outside the tank. The main causes of floating roof damage arewater accumulation due to heavy precipitation and liquid sloshing due to earthquakes. When the liquid
substance is flammable, natural hazards may ignite the material at the rim seal between the roof andthe shell wall. This type of fire may escalate to a full surface tank fire. Lightning strikes and earthquakes
have been responsible for a number of floating roof fires (Necci et al., 2018a; Girgin, 2011) (See also
Ignition and sparking).
Displacement and overturning: A natural hazard can exert strong forces on equipment, creatingtranslation and rotation phenomena. When this happens, units can be pushed against each other ortopple (Krausmann and Salzano, 2017). This can cause collision damage and ruptures in the attachedpipe network, both of which can result in loss of containment. Displaced and toppled storage tanks havebeen observed in earthquakes due to strong lateral acceleration (Eidinger et al., 2001). In floods andtsunamis, the uplifting buoyancy force, wave slamming, and water drag have also produced this type ofdamage (Necci et al., 2018a). Figure 9 and Figure 10 show examples of displacement and overturningof storage tanks due to storm surge.
Puncturing damage: Sharp objects pushed against the equipment may produce buckling and holes inthe shell with a potential for loss of containment (Necci et al., 2018a). Both heavy low-speed objects
carried by floods or tsunamis and lighter high-speed objects projected by strong winds can produce
puncturing damage. Puncturing damage can affect equipment and pipes, especially those with low shell(or pipe) thickness.

18

Figure 9. Atmospheric storage tank displacement and damage from storm surge due to a hurricane, including
displacement of a pipe.

Source: NOAA Office of Response and Restoration

Figure 10. Overturned and damaged atmospheric storage tank due to storm surge from a hurricane.

Source: NOAA Office of Response and Restoration

19

Ignition and sparking: Some natural hazards can directly ignite flammable and combustible materials,
e.g. lightning and wildfires, causing fires at hazardous installations. Areas in process plants that contain
flammable or explosive atmospheres are exposed to this damage mode. In these cases, the equipment
units are not damaged by the natural hazard itself; instead, fires or explosions triggered by the natural
hazard damage them. The most typical example of the result of ignition damage are fires at large
atmospheric tanks that store oil and hydrocarbons. The most common natural source of ignition islightning. A study on fires in atmospheric storage tanks (Chang and Lin, 2006) concluded that lightning
strikes have caused over 90% of all tank fires. The lightning ignites the flammable vapour often present
in some units (e.g., in the space above the floating roof or at vents of atmospheric storage tanks).
Another cause of ignition are earthquakes. They can induce violent motion of metal parts that can collide
or brush against each other generating sparks as a result. This phenomenon has been observed mainly
at the seal between atmospheric storage tank walls and metal roofs floating on the liquid surface via
liquid sloshing (Girgin, 2011). The increasing risk of wildfires may also pose an as yet little known risk
to industrial equipment containing flammable substances.
Overfilling: Water can pour into important units containing hazardous materials during flooding andheavy rain events. When the amount of water exceeds the capacity of the unit, it overflows, carrying
part of the unit’s content with it. In this case, the unit is not technically damaged but its function andcontainment are compromised nonetheless. This is a frequent LOC event for parts of process plantsthat are open but contain residues or larger amounts of hazardous materials, such as drains, sewers,
and some waste treatment facilities like tailings ponds and dikes (Necci et al., 2018a).
Table 2 shows the relationship between the natural hazards and the listed damage modes, while Table
3 shows the relevance of the listed damage modes for a selection of type of equipment unit.
Table 2. Typical damage modes classified by selected natural hazard triggers.

Flash flood(2)WindLandslide

Low temperature

X

X

X

X

X

X

Tearing

X

X

X

X

Shell-to-bottom detachment

X

X

Support leg failure

X

X

Fixed roof damage

X

X

X

X

Floating roof damage

X

X

X

X

Displacement

X

X

X

X

X

Overturning

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

Puncturing damage
Ignition and sparking
Overfilling

X

X

X

(1) Slow-onset floods like coastal floods and river floods.
(2) Rapid-onset floods, including dam failures and tsunamis.

20

X

Lightning

Flood(1)Rupture of pipes andconnections

Buckling

Heavy
precipitation

Earthquake

Damage mode

X

X

X

X

X

Heat exchanger

Phase separator

Column

X

X

X

X

X

X

X

X

X

X

X

X

X

Overturning

X

X

X

X

Puncturing
damageX

Ignition andsparking

X

Overfilling

X

Rupture of pipes
and connections
TearingX

Shell-to-bottom
detachment

X

Support leg failure

X

Fixed roof damage

X

Floating roof
damageX

Displacement

X

X

SewersPressurised vessel(sphere)X

X

Dike/Pond

Pressurised vessel(bullet)X

Buckling

Stack

Atmospheric storage
tank

Table 3. Typical damage modes of relevance for selected process and storage equipment/facilities.

X

X
X

X

Box 3. Damage modes and operating conditions

It is also important to identify the operating conditions under which natural hazard damage is more likely
to occur. For example, storage tanks with a high filling level are more likely to fail in earthquakes due toliquid sloshing (Eidinger et al., 2001), while tanks with lower filling level are more likely to fail in flood
events because a lower weight increases the lift force due to buoyancy (Godoy, 2007).

21

Box 4. Structures designed to withstand natural hazard impact

Some installations are designed to withstand the natural hazards of relevance at an industrial
site, in compliance with existing codes or standards. In these cases, the operators may be tempted
to claim that Natech accidents cannot occur since the installation was designed to resist natural
hazards. This approach can be misleading as the reference design intensity used may be exceededin case of natural events that are more severe than design specifications.
Why?
Design procedures for industrial structures are based on the identification of “limit states”, which arevalues of the natural hazard intensity parameter that the structure is able to withstand without
experiencing damage. The selection of limit states is, in fact, based on the occurrence frequency (orreturn period) of the natural hazard. However, the structures do not resist all natural hazard
severities possible but only those with an intensity lower than the chosen limit states. There is a rangeof potential natural hazard severities (those with a larger return period than the scenario used for thedesign intensity) which exceed the design intensity of the structure. For this reason, the design
procedure can only achieve a reduction of the risk for the structure, but it cannot erase the risk
completely. This also means that some residual risk is always present for any structure, even when
the structure has been designed to resist natural hazards. However, the extent of this residual risk istypically not considered when the major accident risk is assessed. The structural risk is neglected,
because of the low occurrence frequency of the limit state. But what may appear to be a negligible
rupture frequency for the structural engineer can, in fact, be a significant frequency for the occurrenceof critical events (i.e., top events).
What should be done instead?
Operators should acknowledge that Natech accidents are possible even if the equipment has been
designed to withstand some natural hazard severities, following the principle of “accidents despite
precautions” described in the German rule TRAS 310 (2022). If possible, the same natural hazard
information source used during the definition of limit states should be employed for Natech risk
assessment. Natural hazard scenarios with frequencies lower than that of the limit state should
also be considered in the assessment of Natech accidents. Only after the Natech scenarios havebeen analysed and evaluated should those natural hazard scenarios be discarded whose overall impact,
considering also Natech accidents, is still considered negligible. When using a deterministic approach,the experts should choose the highest available natural hazard intensity as the worst-case natural
hazard scenario, especially if it is the only value higher than the design intensity.

4.4

Accident contributing factors: safety barriers and utilities

One of the main features that characterises Natech accidents is natural hazard induced damage or
disruption to control systems, instrumentation, safety barriers, and other equipment that do not containhazardous materials but whose functioning may still be safety critical (Necci et al., 2018b; Krausmann
and Salzano, 2017). Similarly, natural hazards can disrupt auxiliary systems and down utilities that aremeant to ensure the correct functioning of the process plant. Since these systems may influence theoutcome of an accident, their damage and disruption can be considered a contributing factor to
Natech accidents. Under some conditions, contributing factors can become indirect Natech accident
triggers, but typically they can change (usually for the worse) the outcome of Natech accidents by, e.g.,
reducing the performance of existing safety barriers.
This can produce either of the two following outcomes, or both:
1. Safety systems (e.g. leak/fire detection, fire suppression, automatic shutdown) are disrupted
due to natural hazard impact. As a result, hazardous situations can be created and easily
turn into an accident which may then receive no mitigation. This can lead to a higher
likelihood of Natech accidents, and to unmitigated consequences with potentially aggravatedimpacts both inside and outside the boundaries of the site.
2. Essential auxiliary systems or utilities (e.g. electric power supply, compressed air, steam,cooling water) are disrupted, leading to uncontrolled process upsets that can become
hazardous situations, and, eventually, turn into full-scale accidents (see also Section 4.5.2).
Although several studies have documented the vulnerability of auxiliary and safety systems to natural
hazards (e.g., Necci et al., 2018a,b; Misuri et al., 2021; Girgin, 2011) there is still little to no quantitative
data that can be used for risk assessment. A worst-case approach is therefore recommended. When22

considering the vulnerability of safety and auxiliary systems to a specific natural hazard scenario, thegeneral rule is to consider unavailable any system that is not specifically designed to withstandthe intensity of the chosen natural hazard scenario. Work has been launched to provide a more
realistic assessment of safety barrier performance under natural hazard loading (Misuri and Cozzani,2021).
The following list shows the most critical systems whose disruption can be dangerous at a process plant:
Power loss: Analysis of past accidents demonstrated that failure of the power supply is a recurrent
feature of Natech accidents that can be caused by different types of natural hazards, e.g., via thedisruption of overhead lines in storms or earthquakes or inundation of substations during floods. Power
loss alone should not normally be sufficient to cause serious consequences, given that process plants
usually have backup power sources that kick in should the primary power source fail, and that drive theinstallations to a safe shutdown. However, past Natech events showed that backup power equipment(e.g., UPS, backup generator) was often rendered unavailable by the same natural event that disrupted
the main power supply. Many other systems also rely on electric power, e.g., control systems, pumps,
compressors, agitators, and lighting.
Loss of water: Water is crucial for a number of functions in a process plant. Natural hazards can disrupt
the water network by damaging water tanks and reservoirs, breaking/dislodging piping, or rendering thepumps unavailable. Water is essential to keep critical equipment (e.g., chemical reactors) refrigerated.
When water is unavailable, the operator can lose control over critical processes, such as exothermic
chemical reactions, potentially leading to runaway reactions and loss of containment. Additionally,
firefighting systems require large quantities of water to control and extinguish fires.
Loss of steam: Steam is the main vector for providing heat to the installations in a process plant. Natural
hazards can disrupt the steam network by damaging water tanks and reservoirs, disrupting or damaging
boilers, breaking/dislodging piping, or causing leaks with subsequent depressurisation in the network.
Similar to water loss, loss of steam may generate process upsets that can be difficult to control. In someinstallations, steam is used to cause a phase transition or to maintain the correct phase of the processedmaterial. Process lines are also often traced with steam lines, which aim at preventing temperaturedrops between one process unit and another. This feature is extremely important in winter and in cold
environments in general. When this feature is lost, temperature drops may cause the solidification of
products in the process lines and the subsequent choking of the pipes. Eventually, these events may
even cause a pressure increase in the lines that can cause the pipes to fail and leak.
Loss of compressed air: Compressed air is used in many installations to power pneumatic tools, aswell as for automation equipment and conveyors. Compressed air is one of the key elements of industrial
process control. Natural hazards can disrupt the compressed air network by damaging air tanks,
breaking/dislodging piping, or causing leaks with subsequent depressurisation in the network. Loss ofcompressed air may result in loss of process control and hazardous process upsets.
Control systems failure: Control is an essential feature of all industrial processes. Process control
systems consist of one or more control loops made of several different items: a sensor that measures
the process variable(s), a transmitter that transports the information, the actual controller that elaborates
the information, and the actuator that translates the signal into action. Damage to any of these items
results in the failure of the whole control system. Large processes typically have a distributed control
system (DCS) that contains many control loops. It is very common that control systems have one ormore levels of redundancy to increase reliability. However, natural hazard impacts can affect both themain control system and the backup systems at the same time.
Instrument failure: Instruments for the detection and measurement of process variables can bedamaged by natural hazards and as a consequence return incorrect data or no data at all to the control
systems. For example, compromised gas, smoke and fire detectors on the site’s premises may fail todetect a hazardous situation or an accident, or fail to activate alarms, thus increasing the time to respondto the threat. Similarly, faulty instruments can cause dangerous process variations.
Pump/compressor failure: Pumps and compressors may fail in different ways during a natural hazard
impact; for example, they may stop working because of a lack of electricity due to a blackout, their motor
could be submerged by floodwater, or flood- or wind-driven debris may have hit them. Their failure canproduce depressurisation of process units or cause the interruption of flow (or reverse flow) in important
process lines, thus producing uncontrolled process fluctuations that may lead to loss of containment.
Flare failure: Natural hazards can cause damage to or malfunction of the flare. Many industrial plants
go into emergency shut down in response to some natural hazards, or if the natural hazard impact has
23caused damage, and the content of process units is blown to the flare to be safely disposed of. Flarefailure means that the hazardous material is not combusted and instead released directly into theenvironment. Typical natural hazard impacts to the flare are malfunction of the pilot light, damage to theblowdown line, and damage to the flare stack.
Box 5. Common cause of failure

Natural hazards can disrupt, damage or destroy utilities, auxiliary systems and safety barriers at thesame time. This can lead to scenarios that are normally considered impossible, where all safetymeasures fail at the same time, e.g., like in the 2017 Arkema accident that followed Hurricane Harvey(Necci et al., 2018a). It is therefore important that natural hazards be accounted for as common causesof failure for those items that may be impacted by them.

4.5

Natech hazard identification

Natech accidents are caused by the loss of containment of hazardous materials due to the impact ofnatural events that are external to the process. Natech events can be caused via direct natural hazard
damage to critical equipment that contains hazardous materials or indirectly due to natural hazard
induced process variations, loss of utilities or protection and control system malfunctions.

4.5.1

Direct effects of the natural hazard

Hazardous materials may be released when the primary unit they are contained in is damaged or
destroyed by a natural event. The types of damage and damage modes for the most common equipment
types have been discussed in Section 4.3. In this section we will discuss the possible accidents that can
result from direct damage and their consequences. There are two main accident types that can betriggered by a natural hazard directly affecting hazardous materials and their containers:
1. Damage to the container with release of hazardous materials;
2. Ignition of flammable substances.
For the first accident type, the main objective is to determine whether or not the natural hazard scenario
has the potential to damage the analysed system and if so what the extent of the damage will be. The
best way to asses if and how the unit fails is to engage with the mechanical designer of the unit who canprovide insight into the unit’s performance under the loads exerted by the natural hazard. The simplest
method to assess damage is to consider that containment has failed when the design specifications are
exceeded with a “Yes/No” logic. Another classical method for assessing damage is the use of damage
states coupled with fragility curves (Eidinger et al., 2001; FEMA, 2015). Damage states are usuallydivided into qualitative damage classes (e.g. none, minor, moderate, major, catastrophic). Classes canbe specific or generic, depending on the data source of the fragility curve. In most cases each damage
state represents a vast array of damage types and damage modes. Fragility curves provide values ofprobabilities that can be used for the assessment of the damage likelihood (see Section 4.7).
The second accident type is linked to the presence of areas with explosive atmospheres in the process
or storage facilities at a hazardous site. An explosive atmosphere is a mixture of hazardous materials
with air, under atmospheric conditions, in the form of gases, vapours, dusts or fibres in which, after
ignition has occurred, combustion spreads to the entire mixture. The resulting fire or explosion often
generates a major accident. However, frequently this also causes extensive damage to containers withthe subsequent release of hazardous materials. When this happens, the resulting fire or explosion istypically much larger than the original fire initiated by the natural hazard. In addition, fires and explosions
can extend to nearby installations or sites and produce a so-called “domino effect” (Reniers andCozzani, 2013).

4.5.2

Indirect causes

Indirect causes of Natech accidents concern the identification of accident scenarios deriving from natural
hazards induced uncontrolled process variations that may push industrial processes outside their safe
operating routine. As mentioned in Section 3.4, the failure of utilities or of auxiliary support systems canalso lead to hazardous situations or Natech accidents, even during or after a successful process
shutdown. Past accident analysis showed that Natech accidents with indirect causes can occur also
when redundant safety systems are in place as they can all be affected simultaneously by a natural

24

hazard (Misuri and Cozzani, 2021). Consequently, indirect causes of Natech accidents should also be
included in the risk assessment.
In principle, Natech accident scenarios with indirect causes can be identified with an analysis of theprocesses and of the relationship between the different process variables. There are a number of tools
used for this purpose in conventional major accident hazard identification and analysis (e.g., HAZOP,FMEA, FMECA, LOPA, Checklists, What-If analysis). However, there are several factors that increase
the complexity of accident hazard identification when Natech accidents are involved.
One of the main difficulties to overcome is the tendency of risk analysts to simplify. Althoughsimplification is necessary to complete any risk analysis, oversimplification can lead to the loss ofimportant information. For example, some scenarios may be considered as extremely unlikely or even
impossible under normal conditions since they require the contemporary failure of many systems at thesame time. These scenarios are usually neglected in conventional accident risk analysis for the sake ofsimplicity and perceived cost effectiveness (Krausmann and Necci, 2021). However, the failure ofmultiple systems at the same time is exactly what characterises Natech accidents. Natural hazards are
therefore an important common cause of failure in many systems. In order to identify indirect Natech
hazard scenarios in this phase, risk analysts should not exclude accident scenarios from the risk
analysis based on their “presumed impossibility”, unless a detailed study of the potential impactof natural hazards on the affected systems has excluded a natural hazard trigger as truly
inconsequential.

4.6

Natech consequence analysis

One of the main challenges for Natech risk management is the identification and analysis of soundNatech consequence scenarios. Consequences and their likelihood can be determined by modelling theoutcomes of an event or set of events, by extrapolation from experimental studies or from available data.
A consequence scenario consists of a loss of containment and a chain of events that leads to a physicaleffect (e.g., a fire, an explosion or a toxic dispersion) that has the potential to harm people, damage theenvironment or destroy assets.
Natech scenarios differ from those of other types of technological risks (cf. Natech characteristics in
Chapter 2), and it is usually misleading to reuse non-Natech consequence scenarios for analysing
Natech events unless it has been verified that the scenario conditions are the same. The loss ofcontainment of hazardous materials that follows natural hazard damage should be assessed tosuccessfully model Natech scenarios. Conversely, models for the assessment of the physical effects of
Natech accidents do not differ from those used for the analysis of the consequences of non-Natech
accidents. Dedicated technical information and guidance is available in Mannan (2005) and van den
Bosch and Weterings (2005).

4.6.1

Loss of containment and critical events

Critical events (or top events) are at the beginning of the process that leads to the actual Natech
accident. There are two types of critical events that can be triggered by natural hazards:•

Critical events due to direct damage to a vessel or a pipe that contains hazardous materials;•

Critical events following a process upset and the subsequent equipment rupture or system
malfunction.

Most critical events result in the loss of containment of hazardous materials but there are other types ofcritical events as well, such as runaway reactions, deflagrations, or fire. However, for the sake of brevity,
we will refer to all the immediate outcomes of critical events as LOCs. The most common types of LOC
scenario can be borrowed from the scenarios used to model non-Natech types of technologicalaccidents. Examples of typical loss of containment scenarios are reported in Table 4.

25

Table 4. Generic LOCs for different types of systems.

LOC eventDescription

Systems that present thisLOC type

Instantaneous release

Instantaneous release of the complete
inventory of hazardous material

Atmospheric storage andprocess vessels, pressurised
storage and process vessels,
heat exchangers

Continuous release in 10
minutesContinuous release of the complete
inventory of hazardous material in 10
minutes at a constant rate

Atmospheric storage andprocess vessels, pressurised
storage and process vessels,
heat exchangers

Continuous release from ahole in the vesselContinuous release of hazardous
material from a hole with a known size

Atmospheric storage andprocess vessels, pressurised
storage and process vessels,
heat exchangers

Full bore ruptureContinuous release of hazardous
material from a pipe that has been torn
in two halves (effective release
diameter equal to the nominal diameterof the pipe). Release occurs usuallyfrom both sides.

Pipes, pumps, heatexchangers

Leak

Continuous release of hazardous
material from a pipe that is leaking(e.g. effective release diameter equal
to a fraction of the nominal diameter ofthe pipe).

Pipes, pumps, heatexchangers

Release from pressure
relief device

Discharge from a pressure relief
device with maximum discharge rate

Pressure relief devices

Dispersion of stored
powderDispersion of a fraction of the
packaging unit inventory as abreathable powder

Warehouses

Dispersion of stored liquids

Spill of the complete packaging unit
inventory

Warehouses

Emission of toxic
combustion products

Emission of unburned toxics and toxics
produced in the fire

Warehouses

Mass detonation

Mass detonation in a storage unit

Explosive storages

Fire in the storage

Fire in a storage unit

Explosive storages

Source: Uijt de Haag and Ale, 2005.

26

A major challenge in Natech risk assessment is how to associate a typical chemical accident LOC
scenario to a specific natural hazard damage. There is no definitive guidance on how to perform thistask and currently this association relies on expert judgement. When the damage model used is simple
and specific to one damage mode, the expected damage can be easily associated with a LOC. However,specific models are scarce and not available for most equipment types. For this reason, Natech risk
assessment is often performed using more generic damage models like damage states and fragility
curves. In this case, the task of assigning a LOC scenario to the natural hazard damage becomes muchharder.
4.6.1.1

LOC scenarios for damage states

One common way to assess natural hazard damage to process systems affected by a known natural
hazard impact is to use damage states as discussed in Section 4.5.1 (FEMA, 2015). Damage states do
not provide a specific description of the damage, but a generic and qualitative description of the overall
equipment status after the natural hazard impact. However, there is a recognized knowledge gap in thisregard, since the statistics of natural hazard damage used to build damage states do not cover top
events and LOCs, and vice versa. The task gets more complex when the damage model used provides
many possible damage states resulting from the same natural hazard impact. When the only available
damage estimation model is based on multiple damage states, there are three possible approaches tocope with the additional complexity:
1. Assign the same LOC scenario to multiple damage states. This solution is the simplest although
the least accurate. Two categories of damage states are created: those than can produce a LOC
and those that cannot. A frequent assumption is that damage states of the type “no damage” and“minor damage” would not result in a release, while all others would. The same LOC scenario isthen linked to all damage states that can produce a release regardless of the extent of damage (e.g.
LOC is “Continuous release in 10 min” for all damage states of moderate severity or greater). Thisapproach has been applied in scientific studies on Natech risk assessment over the past years(Salzano et al., 2003, Antonioni et al., 2009)
2. Assign a different LOC scenario to each damage state. This approach is slightly more complex.
Every damage state has its own LOC scenario (although there could still be two or more damage
states with the same LOC). For example, LOC is “Continuous release from a hole in the vessel of
10 mm” for minor damage, “Continuous release from a hole in the vessel of 50 mm” for moderate
Damage, “Continuous release in 10 minutes” for major damage and “Instantaneous release” forcatastrophic damage. This approach has been implemented in the Natech risk analysis andmapping tool RAPID-N 4 (Girgin and Necci, 2018).
3. Assign multiple LOC scenarios to each damage state. This solution is the most complex,
although it is also the most accurate. The hypothesis is that every damage state can result in many,or even, all possible LOC scenarios. However, the likelihood of each LOC scenario is taken into
account with the use of probabilities. The probability of major LOC events is higher for severe
damage states, while the probability of minor LOC events is higher for minor damage states. If
damage states are incompatible with LOC scenarios (for example, a LOC scenario “leak” usually
does not match with the “collapse” damage state), probability 0 should be assigned to that specificcombination of damage state and LOC. This approach has never been used so far due to theadditional complexity that it brings to the analysis. Moreover, to date, no statistical data is available
to associate probabilities to LOC events and damage states.
The three approaches are summarised in Figure 11.

4

RAPID-N is available free at https://rapidn.jrc.ec.europa.eu

27

Figure 11. Examples of the three approaches for the assignment of LOC scenarios to damage states.

4.6.2

Natech consequence scenario modelling

As mentioned in Section 4.4, natural hazard impacts can disrupt, damage or destroy control and auxiliary
systems, as well as utilities, generating contributing factors to Natech accidents. Section 4.5.2 discussed
how such damage can cause LOC and initiate an accident. This section discusses the repercussions ofsystem unavailability on the outcome of the accident and provides indications on how to build soundNatech consequence scenarios that take into account the Natech characteristics listed in Chapter 2 andthe contributing factors.
4.6.2.1

Natech chain of events

Safety barriers are physical or non-physical means implemented to prevent, control or mitigate
hazardous situations or accidents (Sklet, 2005). Safety barriers may fail, or their performance can be
reduced, during natural hazard impact because: 1) one or more of its components are damaged orrendered unavailable by the impact of the natural hazard, and 2) utilities and auxiliary systems, that are
not part of the safety barrier but are required for its correct activation, are damaged or disrupted. Whensafety barriers function according to their design, the accident may be avoided altogether or its
consequences are mitigated. When they fail to perform as planned, the result is an accident withunmitigated consequences (Misuri et al., 2021). In Natech risk assessment, unmitigated accident
scenarios should be considered when safety barriers are vulnerable to a natural hazard.
Safety barriers also prevent accidents, like fires and explosions, from spreading to nearby installations.
When a Natech accident propagates to nearby sites or installations causing one, or more, “secondary”
accidents, the process is known as domino effect (Reniers and Cozzani, 2013). When the consequencesof a secondary accident are larger than those of the “primary” accident, the accident has “escalated”. In
Natech risk assessment, the possibility of escalated scenarios should be considered whensafety barriers are vulnerable to natural hazard impact. Escalated scenarios often feature28

simultaneous accidents even when the primary Natech scenario is a single release scenario (seeSection 4.6.2.2).
4.6.2.2

Simultaneous accidents

One of the main complications of Natech accidents is the possible presence of multiple LOC eventsat the same time. This can be addressed by considering all possible accidents that may follow thenatural hazard impact. In order to do so, all scenario combinations composed of all couples, triplets,
quadruplets, etc. must be considered. Each combination represents a different Natech accident
scenario that can be assessed. However, the complexity of this approach increases exponentially with
the number of scenarios considered. In general, the higher the number of the accidents in a given
combination, the lower is its probability. This approach has been demonstrated by, e.g., Antonioni
et al. (2009) who calculated the combinations for the simplest case using a Boolean logic (1 = Natech
accident occurred; 0 = Natech accident did not occur). Once all the combinations are identified, thescenarios (combinations) that are the most relevant for risk assessment are considered, while the others
are discarded. Establishing which combinations are the most relevant is not an easy task. In general,
combinations that are more relevant are those with a higher probability of occurrence. However,combination of events that may result in catastrophic consequences with low probability should not be
carelessly dismissed as they may represent high-impact low-probability (HILP) events.
In addition, in some combinations one accident may be significantly more prominent than the other(s).
In these cases, the consequences of a combination of accidents or of the most serious accident alone
would be very similar or even the same. In such cases, no scenario combinations are needed but it issufficient to consider only the scenario with the largest consequences.
Another issue of simultaneous scenarios is how to consider the impact of two or more different effects
on the same target, for instance an individual person. As discussed in Antonioni et al. (2007), the impactof two or more accidents can be assessed in different ways by a) adding the values of the harmful
physical effects (e.g. thermal radiation), b) adding the doses (e.g. toxic dose) to which individuals are
exposed, or c) adding the vulnerabilities of the target (e.g. death probability). Of these approaches, thethird allows the assessment of combined vulnerabilities that are given by the different types of events(e.g. fires and toxic dispersions), while the first two can add the effects of accidents of the same type(e.g. two fires) (Cozzani et al., 2005). Using the third method, the combined vulnerability of N individual
events as the union of vulnerabilities of all events is:𝑉𝑉com = ⋃𝑁𝑁
𝑖𝑖=1 𝑉𝑉𝑖𝑖(1)

𝑉𝑉com = 𝑉𝑉a + 𝑉𝑉b − 𝑉𝑉a ∙ 𝑉𝑉b(2)

where 𝑉𝑉com is the combined vulnerability of the N accidents and 𝑉𝑉𝑖𝑖 is the vulnerability of each single
accident i. It must be noted that, in principle, the values of the vulnerabilities are dependent on eachother (e.g. a person may be more likely to die if she survived the impact of one accident, since she may
have suffered injuries or been poisoned). However, data to support the impact of cumulative effects ofdifferent accidents on potential targets (e.g. humans) are scarce or missing. Therefore, the mostcommon approach is to consider all events as independent. An example of the use of the independence
hypothesis in the case of two separate accidents, a and b, is given by the following equation:

4.6.2.3

Environmental conditions

When determining the accident’s consequences, standard models are used that assume reference
environmental conditions. However, some natural hazards can change the environmental conditions
around industrial plants and it is important that the scenarios are modelled using appropriate values forthe environmental parameters. These values must be coherent with the conditions of the triggering
natural hazard scenario. For accidents triggered by flood, not only the intensity of the natural hazard(flood depth and speed) needs to be known, but also the direction in which the water is flowing. Released
flammable and toxic substances can be carried over large distances by the floodwaters, possibly
spreading fires or pollution to areas at a notable distance from the spill location (see Figure 12).
Examples of the parameters used in standard models for accident consequence analysis and that may
change during natural hazard impact are reported in Table 5.

29

Figure 12. Fire spreading on the water surface and dispersal with the floodwaters.

Source: USGS

Table 5. Examples of the effects of natural hazard impacts on environmental parameters used for consequencemodelling.

Environmental parameter

Possible effects of natural hazards

Ambient temperature

Some natural hazards, like heat waves or freeze can only occur at
specific (extreme) values of ambient temperature.

Wind speed

Storms and tornadoes require high values for the wind speed
parameter.

Atmospheric stability

For storms and other atmospheric phenomena, one must choose
values of the atmospheric stability from among the unstable classes.

Terrain roughness

Buildings and other obstacles (e.g. trees) can be destroyed by natural
hazards like earthquakes, thereby possibly affecting the atmosphericdispersion of hazardous materials. Similarly, other natural hazards,
like floods and storm surge may sweep new obstacles inland (e.g.,silos, ships, barges), changing the surface roughness.

Soil/ground conditions

Ground can rupture or liquefy under the effect of earthquakes,
increasing or decreasing its granularity. In the case of floods, theground is assumed to be covered with water, which also changes the
granularity. Snow and ice also affect the ground conditions
significantly, as well as the presence of debris scattered all over theplace.

30

4.6.2.4

Exposure and vulnerability of endpoint receivers

Compared to other types of technological accidents, endpoint Natech risk receivers are also influenced
by the natural hazard. While typically only extreme natural events have a major impact on the population,
the effects of natural hazards vary case by case, depending on the nature of the hazard and its intensity.
These effects should be evaluated separately for each natural hazard that may involve the industrialsite. Examples of effects of natural hazards on endpoint receivers are:•

The number of people at risk may be reduced compared to a regular day. On the one hand, thenatural hazard may cause mass evacuation before the Natech accident happens. On the other hand,
there may already have been fatalities due to natural hazard impact.

•

The exposure of the population might be increased, as they might not have any possibility toshelter in place, as buildings may have collapsed or been heavily damaged. Also, people trapped
under collapsed buildings are unable to escape and get to safety, while their families and the rescue
teams may be unwilling to leave them behind.

•

The environment may be more susceptible to pollution due to chemicals or hydrocarbons when
it has already been damaged by the natural hazard.

To understand how the calculated physical effects of a LOC affect the population, standard vulnerability
models can be used and no Natech-specific models are needed. For example, toxic effect models
quantify the impact on human health of exposure to toxic gases, using thresholds, such as Median
Lethal Concentration, Median Lethal Dose, or Immediately Dangerous for Life and Health (IDLH)
concentration. Thermal radiation models assess the impact of radiation intensity on people (e.g., burninjuries, damage to structures), while shock-wave overpressure models aim to quantify the effects ofoverpressure from explosions (TNO, 1992). For all three types of phenomena, probit functions can also
be used to quantify the vulnerability of the population to the effects of a LOC. Where data are insufficient
for a quantitative analysis, qualitative consequence categories (e.g., minor, serious, very serious, major,
catastrophic) can be defined and used instead.

4.7

Natech likelihood assessment

Risk analysis is by definition the analysis of the likelihood of an unwanted event. In process safety
unwanted events are not all equal. This is the reason why risk is typically considered as a function ofboth likelihood and consequences. Here, the unwanted events are Natech accidents and their potential
consequences. Assessing the likelihood is crucial for the evaluation of the risk and the prioritisation of
investments for cost-effective Natech risk reduction. The most common way to assess Natech likelihood
is to use probabilities but for some hazards, where uncertainties are large, qualitative likelihood
descriptors are adopted. For Natech accidents, the Natech accident probability and the natural hazard
probability are inherently linked. In fact, the probability of a Natech scenario is bigger if the natural hazard
is a frequent event. Moreover, the probability of a Natech accident can never exceed that of the triggering
natural hazard scenario.
Natech scenarios are complex events that are composed of a natural hazard scenario, a top event (orcritical event) scenario and a consequence scenario. The probability of the Natech scenario is calculated
as the joint probability of all these three events combined. Therefore, Natech probability assessment iscomposed of the following steps: First, the probability of the natural hazard is assessed using natural
hazard statistics or modelling. Then the probability of the top events (e.g. LOC for a specific equipment)
for the given natural hazard scenario is assessed using ad-hoc methodologies and the probability of thenatural hazard as input. Finally, the probability of the Natech consequence scenarios can be determinedwith the use of event trees or equivalent methods. These methods allow the assessment of theprobability of the many Natech consequence scenarios that may result from every critical event whenconditions change (e.g., ignition/no ignition, safety barrier availability/unavailability). Equations (3) – (5)summarise the relationship between the probabilities of a specific Natech accident scenario, theprobability of the critical event and the probability of the natural hazard scenario:(3)

P(Top) = P(Haz) ∙ P(Top|Haz)
P(Nat) = P(Top) ∙ P(Nat|Top)(4)

P(Nat) = P(Haz) ∙ P(Top|Haz) ∙ P(Nat|Top)(5)or combining Equations (3) and (4):31where P(Nat) is the probability of a specific Natech accident scenario, P(Top) is the top event (or LOC)
probability, P(Haz) is the probability of the natural hazard, P(Top|Haz) is the conditional probability of a
top event for a given natural hazard, and P(Nat|Top) is the conditional probability of the Natech scenario
given the critical event.

As discussed in the previous sections, conducting Natech risk analysis is challenging as data availability
is still insufficient. For this reason it may be difficult or even impossible to find reliable data for the
calculation of the Natech scenario probability. In this case, it may be preferable to provide a qualitativedescription of the Natech scenario likelihood (e.g., very likely, likely, possible, unlikely, rare) that helps
to establish a relative ranking among the identified Natech scenarios.

4.7.1

Release/top event likelihood

There are two main categories of top events:•

Natech accidents that result from direct natural hazard effects (damage) on the container
structure (see Section 4.5.1);•

Natech accidents that are produced by indirect causes, e.g., due to natural hazard induced lossof utilities (for example blackouts) (see Section 4.5.2).

For the first category, the top event likelihood can be directly related to the probability that the equipment
is damaged by the natural hazard impact. In this case, damage usually results in a LOC immediately,
although sometimes the damaged equipment may maintain containment. The probability of loss ofcontainment should consider this possibility. Equations (6) and (7) summarise the composition of the
top event probability for a given damage scenario that may or may not result in a top event:(6)

P(Top) = P(Dam) ∙ P(Top|Dam)(7)

P(Dam) = P(Haz) ∙ P(Dam|Haz)

where P(Top) is the top event probability, P(Dam) is the damage probability, P(Top|Dam) is theconditional probability of a top event for a given damage, and P(Dam|Haz) is the conditional damage
probability for a given natural hazard. While damage probability is typically not difficult to assess, there
are almost no data relative to the conditional probability of top events given the damage. For this reason,
the most common assumption is to consider the top event probability equal to the damage probability.
The assessment of the damage likelihood is discussed in more detail in Section 4.7.1.1.
For the second category, the critical event probability can be assessed using known methods like
HAZOP, LOPA, fault trees, FMEA, FMECA, etc. The challenge is to build the relations in a way that the
Natech characteristics mentioned in Chapter 2 are properly considered. For this purpose in particular, it
is crucial to consider the failure of safety barriers and auxiliary systems, the simultaneous failure of units
and systems, and the inadequacy of some of the most common response strategies and activities.
4.7.1.1

Damage likelihood

Damage likelihood is always assessed using the relevant intensity parameter of the natural hazard (e.g.,peak ground acceleration, water height, wind speed). This parameter must be linked with one, or more,damage modes. The simplest method to assess that damage has occurred is to consider that
containment has failed when the design specifications of the unit are exceeded by the natural hazard
intensity parameter with a “Yes/No” logic. In this case, the failure likelihood can be assessed as theprobability of occurrence of a natural event that exceeds the design specification of the equipment.
When the natural event is described as one discrete scenario, the probability of damage for a specificnatural hazard scenario P(Dam|Haz) is equal to 1 if the value of the intensity parameter of the naturalhazard scenario exceeds the design specifications, while P(Dam|Haz) is equal to 0 if the design
specifications are more stringent than the value of the intensity parameter.

A typical method for assessing damage probability for a specific natural hazard scenario is the use ofdamage states and fragility curves (Eidinger et al., 2001; FEMA, 2015). Different curves are available
for assessing the damage probability of industrial equipment, instrumentation, and utilities in case ofnatural hazard impact (FEMA, 2015). Fragility curves and damage modes for common equipment types
have been provided in several studies (FEMA, 2015; Eidinger et al., 2001; Cooper, 1997; Landucci etal., 2012).

Fragility curves may be associated with a vast array of damage types. For the sake of simplicity, allthese types of damage are usually divided into damage classes (see Section 4.6.1.1). Fragility curves32typically provide probability values for each damage state. Some or all damage states may result in one
or more critical event(s).
One possible method to reduce the complexity of the analysis is to consider only one reference LOC
scenario (see Approach 1 in Figure 11). In this case all damage states that equal or exceed a certain
damage level (e.g. moderate damage or greater) will be considered as triggering the selected LOC
scenario and their probabilities are added. This method has been applied in past studies (e.g. Antonioni
et al. 2007; 2009; Salzano et al., 2003).
4.7.1.2

Likelihood of critical events due to direct damage

As mentioned in Section 4.6.1. it is difficult to assign one type of critical event to one specific damage
type, let alone to assign a probability value to it. Analysis of past accidents showed that not all damage
caused by natural hazards has actually triggered a release. As of today, no study has everinvestigated the statistical relationship between damage and release; all available data is qualitative.
Moreover, there are certain types of damage that inevitably result in a release. For example, pipe
network rupture (or detachment), total collapse of a vessel, and detachment of the shell-to-bottom
connection of a tank result in release 100% of the time (P(Top|Dam) = 1), provided that the damaged
equipment is at least partially full. On the other hand, there are types of damage that, on its own, neverresults in a release (P(Top|Dam) = 0). For example, some types of roof damage or buckling damage
may never produce a release.

This type of assessment becomes even more complex when damage states and fragility curves areused to assess equipment damage and its probability. For some types of equipment, even a damage
state that is considered “minor” can result in a release. Also, damage levels that are more severe are
more likely to result in a release. With these uncertainties, it is recommended to use a value of 100%for the critical event probability whenever doubt exists. Generally, experts in process safety, aided bystructural engineers, are the best qualified to assess the critical event likelihood.
4.7.1.3

Probability of indirect Natech accidents

Indirect accidents can be triggered via process upsets caused by the impact of a natural hazard on theindustrial plant. Process upsets are also routinely evaluated as a cause of (non-Natech) technologicalaccidents. Accordingly, the same methods can be used to identify critical events (e.g. checklists, whatif analysis, HAZOP, FMEA/FMECA) and to assess the damage/failure probability (e.g. fault trees, bowties). However, one or more components of a system may be damaged by a natural hazard, disrupting
important control and auxiliary systems. Therefore, particular attention should be paid to theidentification of the “cut sets” in which one (or more) component is vulnerable to natural
hazards. In this case, the reference reliability values of components (typically retrieved from common
reliability data sources) and systems may change significantly due to the possibility of natural hazard
damage.
It is challenging to estimate the damage probability for systems (and their components) because
structured and systematic studies on equipment vulnerability exist only for some of the most common
equipment types, in particular storage tanks (Cooper, 1997; Landucci et al. 2012; Eidinger et al., 2001).
In this regard, reliability values of components hit by a natural event should be chosen carefully. Many
protection and control systems are unreliable or unavailable during natural hazard impact. Systems
unable to survive the natural event should be considered as failed (reliability equal to 0) in any
critical event probability assessment (e.g., using fault trees or similar methods). When theassessment of the components’ survivability is uncertain, the most conservative approach is to consider
the system (or component) failed, unless it has been specifically designed to withstand the natural
hazard, and the scenario used for the design has an intensity equal or higher than that used in theassessment.
Whenever available, fragility curves should be used to estimate the probability of damage to theanalysed component or system (e.g. tailored fragility curves for the affected components). This
probability value could be used to assess the system reliability (or availability). One simple way to assess
the reliability using the damage probability is to consider the lower value between the reference valueof the component’s reliability (retrieved from reliability databases, e.g., European Safety, Reliability &Data Association (ESReDA), Offshore and Onshore Reliability Data (OREDA)) and the complement to
1 of the estimated damage probability.

33Box 6. Example: Simple reliability estimate

A hypothetical blowdown system is attached to a flare which has a reliability of 99%. There are twonatural hazards of concern at the site, earthquakes and strong winds. According to the analysis
performed for the earthquake scenario, the flare has a damage probability of 10-3 if this scenario occurs.
This means that the system is less likely to fail due to the earthquake than on its own. The reliability ofthe system would still be 99% for the earthquake scenario. According to the analysis performed for thestrong wind scenario, the flare has a damage probability of 10-1 if this scenario occurs, which means thatthe system is more likely to fail due to strong wind than by other generic causes. For the strong windscenario, the reliability of the system should be considered as 90% instead of 99%.

4.7.2

Natech-specific event trees

Event trees can be used when assessing the likelihood of Natech consequence scenarios that may arise
from every Natech critical event. These logic graphs are typically used when many scenarios can result
from a single event (the critical event). Each scenario is derived considering the occurrence, or nonoccurrence, of one or more intermediate events. One example of event that may change the outcomeof the Natech accident is the activation of a safety barrier. Successful safety barrier performance results
in a mitigated scenario, while unsuccessful performance results in an unmitigated scenario. Other
examples of events that determine the outcome of the scenario can be, e.g., the occurrence of ignitionor the presence of a secondary containment. While determining the event trees, the specificconditions of the Natech scenarios should be taken into account, including all the contributing
factors. This applies to the types of events that are relevant in the event tree, but it also applies to theprobabilities assigned to the successful and unsuccessful occurrence of each event.
For instance, the value of the ignition probability of flammable substances can be considered equal to 1
in case of accidents triggered by lightning strikes, as lightning itself is an ignition source. Similarly, for
Natech scenarios triggered by major floods, secondary containment (e.g. a dike) – even if present –should be considered absent since it would be filled with water and could not contain the spilled
substance.
When the success of the event is determined by the activation of a complex system (i.e., composed ofmany different components that could fail to activate), fault trees may be used to assess the overall
reliability of the system. In this case, the overall reliability of the system should take into account boththe natural hazard scenario and the Natech critical event. In particular, due to the natural hazard, somecomponents may have one (or more) common cause(s) of failure. Furthermore, all components thatare considered failed as condition for the Natech critical event to occur should also be considered failed
in the event tree.
Given any Natech critical event, all components that were considered as failed (or unavailable) whenassessing the Natech critical event must be considered failed also for all other events that follow. For
instance, if one critical event is caused by power loss, then all events that follow that critical event mustalso consider power loss as a fact (probability equal to 1). The reliability (i.e. the survivability) of all othercomponents of the safety systems that are affected by the natural hazard should be analysed as well,
as standard reliability values may not apply.
Box 7. Examples of event trees affected by natural hazard impact

Systems are unavailable
In one hypothetical scenario, the water network that feeds the firefighting system has been damaged byan earthquake, allowing a tank to be damaged by a nearby small electric fire and release flammable
fuel (top event). Normally, the fire resulting from the spill of flammable fuel could be mitigated by thefirefighting system; however, because the firefighting system is considered failed as a condition for thecritical event to occur, it cannot mitigate the consequence of a possible second larger fire.
Failure on demand is increased because of loss of redundancy
In one hypothetical scenario, the natural hazard has damaged the power network of a chemical plant,
leading to a process upset and ultimately to the release of a flammable liquid. The firefighting system
uses two redundant pumps, one powered by an electric engine and one powered by a diesel engine.
The fire resulting from the spill of flammable fuel can be mitigated by the firefighting system; however,since the power network is down, the firefighting system can only rely on its diesel-powered pump. As
a result, the firefighting system has a higher chance to fail on demand.

34

Failure on demand is increased because of possibility of damage
In one hypothetical scenario, a shut-down valve is vulnerable to an earthquake scenario, however, its
failure is uncertain. A damage probability is calculated for the component as high as 10%. Its reliability
in normal circumstances would be 99.9%. Because of the very concrete chances for damage, theanalyst reconsiders the valve reliability to be only 90% (see Section 4.7.1.3).

4.8

Natech risk evaluation

The likelihood and consequence information calculated in the previous sections of Chapter 4 needs tobe combined to present the total risk in a format that is useful for the decision-making process. This isoften referred to as risk integration. This process is the same for Natech or non-Natech types of risk andonly depends on the risk analysis approach chosen. If a quantitative risk analysis has been performed,
the resulting risk measures are usually individual risk (e.g., the risk to an individual at a particular location– individual risk curves) and societal risk (the risk of, e.g., 100 or more fatalities – F-N curves). If theanalysis carried out is qualitative, the likelihood and consequence severity classes are combined in arisk matrix. For a more detailed discussion of risk integration approaches, as well as their advantages
and disadvantages, the reader is referred to Cox (1998).
Natech risk analysis helps the operators to detect system weaknesses and set priorities for risk
reduction, e.g. via the ranking of identified risks. At the same time, the outcome of the risk analysis canbe used for comparison with accepted risk targets or criteria (risk evaluation) in compliance with acountry’s regulatory requirements. Should these criteria not be met, risk reduction measures need to be
implemented. In the European Union such risk criteria are not uniform and they can be risk-based (e.g.,
acceptable levels of individual risk) or consequence-based (e.g., permissible levels of overpressure,heat radiation or toxic concentration). For Natech risk evaluation, approaches typically used for chemical
accident scenarios can also be applied and no Natech-specific extensions are needed.

35

5

Measures to reduce Natech risk

Hazardous industrial sites with a relevant Natech risk should implement both technical and operational
measures to prevent Natech accidents that they have identified in their risk analysis and to mitigate theirconsequences. Priority should be given to the prevention and mitigation of the Natech accidents whose
risks are higher, or for which the uncertainties in the assessment are large. This section discusses theresources and procedures necessary for operators to manage Natech risk at hazardous sites.

5.1

Natural hazard impact mitigation

One of the main strategies for mitigating Natech risk is to protect the sites, or their critical installations
from the impact of all relevant natural hazards. This is achieved by reducing the severity of the natural
hazard that is expected on the site via implementing physical or procedural prevention measures.

5.1.1

Physical measures

Examples of possible strategies to mitigate natural hazard impact are:•

Building of levees around exposed sites to protect them from floods;•

Building of artificial channels that convey flood waters away from the site;•

Erection of sea walls that mitigate the effects of coastal floods, storm surge, and tsunamis;•

Riverbank stabilisation to prevent erosion and spill-over when a river swells;•

Soil compaction/stabilisation to mitigate the potential ground motion effect of earthquakes;•

Rearranging of the plant layout by moving critical equipment to areas where it is less exposed
to natural hazards (e.g. outside the floodplain area);•

Erection of elevated dry areas where safety-critical systems should be placed in case the site
is located in an area with flood or tsunami hazard (e.g., control rooms, electric substations,firewater reservoirs and pumping rooms, backup power generators);•

Installation of lightning protection systems to protect the power network and the installations
where flammable substances are stored;•

Selecting the location of the site outside of natural hazard zones or where the natural hazard
severity is the lowest (e.g. outside floodplains, at a distance from known earthquake fault lines).

Some of these actions can be taken during the operational phase of an industrial plant’s life, while others
are restricted to the design phase. In general, it is safer and cheaper to avoid natural hazards, rather
than to protect the installations from impacts.

5.1.2

Procedural measures

Natural hazards can generate large losses and threaten the life of the personnel inside an installation.
Operators should identify specific procedures that define the actions to be taken in response to natural
hazard impacts and early warning provided by the relevant authorities.
Procedures to cope with natural events should include:•

The roles and responsibilities of personnel within the installation;•

The list of actions to be performed by each role;•

The amount of time each action takes;•

The exact conditions that initiate the procedure.

Personnel should be aware of the natural hazards the site may be subject to. Also, they should betrained in the procedures to adopt in case of natural hazard impact. Procedures should be aimed atincreasing the chance of survival for staff, especially for those that cover key roles in the response to
Natech accidents, while at the same time preventing the occurrence of Natech accidents.

36

5.1.2.1

Before the event

When forecasts predict a natural hazard in the following days or hours, actions can be taken to prepare
the site for a possible impact. Natural hazards have different onset times, depending on their nature.
While a hurricane can be forecast several days before its landfall, other types of storms and atmosphericphenomena may only offer a lead-time of a few hours. In general, earthquakes cannot be anticipated inadvance. Nevertheless, if the epicentre is sufficiently distant from the industrial plant, operators may
have a very short warning time (usually seconds, sometimes more than one minute) to react before thesite is hit by the earthquake’s shockwaves. Procedures can be effective in avoiding or mitigating Natech
accidents if actions are taken in a timely manner.
For each natural hazard, the conditions under which emergency procedures should be activated must
be clearly identified (e.g. when a nearby river swells above a critical threshold, when a hurricane warning
is called). It should be noted that different actions may activate under different conditions. The following
list shows some of the most recurrent and effective actions that can be taken in preparation for naturalhazard impact:
Emergency shut-down: The operator evaluates the need to shut down the installations. If theprocesses are halted when the natural hazard hits, Natech accidents are less likely to occur.
Ride-out crew: Removing all unnecessary site personnel before a natural hazard hits helps to reduce
the potential loss of life associated with Natech events. This includes, in particular, all external
contractors. The operator should identify a ride-out crew with the minimum amount of personnel needed
to secure the site and to implement emergency procedures. Since some natural hazards can last fordays, operators should organise the workload in shifts to guarantee the turnover of the ride-out crew
and to ensure that the needed response activities are not interrupted in the middle of the emergency.
Securing floating objects: Accidents can be caused by objects floating on floodwaters and impacting
critical installations. This can be prevented by securing floating objects, e.g. with straps, or by removing
them from the site in case of a flood.
Securing equipment: Light equipment is vulnerable to the uplift force exerted by floods. Someequipment could be secured with bolts anchored to the ground. Empty tanks could be filled with water
to increase their resistance to floating due to flooding.
Applying temporary natural hazard defences: Some installations can be protected from the impactof the natural hazard by applying defences that mitigate the natural hazard impact in the protected area
(e.g., set up portable dikes, barricade windows with plywood shields, seal doors of rooms with electric
equipment).
Communication with the authorities: Authorities responsible for the external emergency plans should
be warned when a natural event is about to occur, or is already occurring, and the operator suspects
that Natech accidents could be triggered.
Training: Ensure that employees are aware of the natural hazard(s) at the site and that they are properly
trained in the procedures to cope with their impacts.
Natural hazard monitoring: The operator follows the formation and evolution of natural hazards in theirarea. Those of atmospheric origin, like storms, snow and extreme temperatures, can be easily monitored
via weather forecast services and following the early warning from the local civil protection entities.
Likewise, authorities that already monitor natural hazards through dedicated agencies should be proactive in warning sites with major accident potential of approaching natural hazards in a timely mannerto allow operators to take effective preventive action and to prepare.
5.1.2.2

After the event

Even if a natural hazard did not trigger a Natech accident immediately, industrial plants should be extra
careful in the aftermath of an impact and when resuming normal operations. Natural disasters may leavein their wake damaged equipment, contamination to clean up, and failures that may have goneunnoticed. Moreover, under such conditions, staff is usually more stressed and distracted. The start-up
of major industrial processes is a hazardous phase in itself, even more so after the impact of a natural
hazard. It is conceivable that some damage caused by the event may not be immediately noticeable, orthat conditions are not safe for a restart (e.g. equipment soaked in water). It is therefore extremely
important that procedures for start-up include actions that take into account possible prior natural hazard
damage, such as (USCSB, 2005; CCPS, 2019):

37

•

Inspecting damaged equipment and instrumentation to spot hidden failures before starting-up;•

Securing all units and restoring all safety systems that were turned off;•

Completing the required repair, maintenance, and clean-up operations, including the removal of
rubble and debris produced as a result of the damage or brought on site by the natural event;•Managing the workforce effectively and in particular waiting with start up until all essential personnel
who suffered harm, injuries or losses (including taking care of their houses and family members)
have recovered or have been replaced (including training of new personnel);•

Making sure that the site has all the necessary supplies, as there may be a scarcity of construction
materials after a disaster;•

Recommissioning is needed for sites or installations that suffered extensive damage.

5.2

Equipment design and retrofitting

Risk can be reduced by increasing the resistance of the installations and preventing natural hazard
damage. Critical process and storage units should be designed to withstand natural hazard impacts.
Existing equipment units that may be damaged by natural hazards, causing a significant Natech
risk, should be retrofitted to improve their ability to survive natural events (e.g. installation offlexible pipe-tank-pump connections, anchoring of equipment, elevated supports, waterproof shelter forelectrical equipment). Figure 13 and Figure 14 show examples of implemented retrofitting strategies.
When the Natech risk has been analysed and it is evaluated as unacceptable, despite the units having
been designed according to state-of-the-art standards, then the criteria used for the equipment design
should be changed. One way to do this is to change the way designers choose values of the “limit states”
used in equipment design (see Section 4.3) by considering the results of a preceding Natech risk
assessment. Setting higher values of the limit states means that the unit can survive natural hazards
with higher intensity than before and that failures are less frequent. Values of the limit states could, forexample, be chosen using a risk-based approach that takes into consideration the results of the Natech
risk assessment and which ensures that the risk of Natech accidents remains below a specific target
level.
Figure 13. Additional bracings to reinforce the support legs of a spherical storage tank against earthquakes.

Photo credit: E. Krausmann38Figure 14. Installation of a flexible steel pipe at a large oil tank to allow for displacement of the tank and piping.

Photo credit: A.M. Cruz

5.3

Safety barriers and auxiliary systems

The same consideration applies to safety barriers and auxiliary systems that are critical for Natech
accident prevention or consequence mitigation. Such safety barriers and auxiliary systems should
be designed to withstand the particular natural hazard that is the Natech trigger. It is importantthat critical systems are identified and assessed. Priority should be given to the systems that are involvedin the accident scenarios that provide the largest contribution to the Natech risk. The reliability of safetybarriers and auxiliary systems with respect to natural hazard impact can be improved in different ways,
such as:
System design: Systems can be designed to resist natural hazard impact. The design goal should bethat the system as a whole does not lose its function during a natural hazard impact. For example, afirefighting system in a seismic area should be designed in such a way that it performs reliably evenduring a strong earthquake.
Retrofitting: When not designed specifically for a natural hazard, systems can be retrofitted to performbetter when hit by a natural hazard.
Redundancy: Systems can be made more reliable with redundancy. The redundancy can be included
within the system for its most critical parts, or the entire system can be redundant. In order to prevent
Natech accidents effectively, redundant systems should not fail under the same natural hazard
conditions which is, however, not easy to do for sites with multiple hazards. For instance, in a systemwith two redundant pumps one can be mounted on an elevated support, away from the flood hazard,
while the other one can be built at ground level with a sturdy foundation which is a better arrangementin case of earthquakes.
Mitigating the natural hazard impact: Auxiliary systems and safety barriers can be shielded from theeffect of natural hazards in a similar manner as discussed for the main equipment units (Section 5.1).

39

5.4

Emergency planning and response to Natech accidents

Emergency plans for Natech accidents may include particular actions due to the characteristics of
Natech accidents which are important to consider for response to be effective. Some of the strategies
used for responding to other types of technological accidents may not be effective or appropriate during
a natural hazard impact, meaning that Natech accidents require targeted emergency planning. In
particular, operators should ensure that the implemented accident prevention and mitigation measures
will be effective even during natural hazard conditions, e.g., during earthquakes, floods, heavy
precipitation, high winds or extreme temperatures. When this is not possible, measures that are noteffective in an emergency situation should be considered unavailable, and the emergency plans
should not rely on such measures.
Since many natural hazards have the potential to down utilities, such as the power grid, or the local
aqueduct, stand-alone utilities at site level (e.g., power generators, onsite water networks andreservoirs) should remain available even after the impact of a natural hazard has occurred. For thisreason, hazardous sites in natural hazard zones should have back-up utilities and sufficient
emergency resources to keep the operation running until offsite services become available
again, or until the installations have all shut down safely. Emergency plans should clearly state
which utilities can be guaranteed to remain available. If their continued service cannot be assured, theemergency plan should not rely on it. Accordingly, emergency plans should include response
strategies to adopt when both the main and backup utilities are unavailable.
The operator should evaluate the timing of natural hazard impact and compare it to the timing of theemergency procedures in place at the site, with a view to address potential time gaps between whenan emergency measure is needed and when it might be available. This should include potential
sources of delay that the natural event itself may impose. For instance, the main communication
networks (e.g., phone lines, the internet, SMS) may be disrupted during a natural event. This can create
delays when contacting the local authorities for the initiation of the external emergency plans.
Furthermore, natural hazards can hamper access to the site (e.g., roads destroyed, inundated or
obstructed by debris), delaying the intervention of external responders.
Plant personnel and responders should be protected from both the natural hazard impact and the effectsof Natech accidents, using specific personal protection equipment (PPE). Furthermore, the operators
should consider purchasing specific emergency equipment to better respond to major accidents(both Natech and not Natech) during exceptional conditions (e.g. storms, earthquakes, floods).
The type of equipment should be chosen carefully to ensure responders’ effectiveness and safety, taking
into account the actual on-site natural hazards (e.g. life jackets and boats in case of floods or tsunamis;
tractors and machinery for debris removal in case of earthquakes or windstorms).
When a natural hazard with the potential to down lifelines is identified, the operator should have readyalternative means of communication with the authorities should a major accident occur. For example,
operators could use portable radios with autonomous power source, and a reserved direct radio channel
should be open to reach the authorities under any conditions.
Plant personnel may themselves fall victim to the effects of natural disasters. Moreover, the duration of
the emergency situation could extend over hours or days, adding burden on exhausted staff that may
be asked to work during several shifts in a row. Preparedness should therefore aim at training personnel
to effectively respond to natural disasters, maximising their chances of survival and allowing them tojoin the response activities against Natech accidents. Emergency plans should, however, also
consider the unavailability of personnel on site (e.g. due to the natural disaster, panic and flightbehaviour) and designate adequate replacement for the manpower lost in the natural disaster(Krausmann and Salzano, 2017). Plans should include procedures to ensure constant turnover of fresh
responders.

5.5

Learning from past Natech accidents

Accident analysis is an essential tool in which information on the causes, dynamics and consequencesof past accidents, including all circumstances that facilitated their occurrence, is used to prevent or better
mitigate such accidents in the future. One of the reasons that accidents keep occurring is that lessons
from past events have not been learned or were disregarded (Krausmann and Necci, 2021).
Accident analyses provide insights into the most common equipment damage and failure modes after
natural hazard impact, hazardous materials release paths and consequences, or types of process andstorage equipment that are particularly vulnerable. For example, in-depth studies of a pool of available

40

Natech accident data have shown that atmospheric storage tanks (and especially those with floatingroofs) are particularly vulnerable to earthquake, flood and lightning impact. Individual case histories also
indicate a high susceptibility to damage from heavy rain and high wind. Such studies also suggest thatduring Natech accidents the ignition probability is higher than during accidents caused by human or
technical error (Krausmann et al., 2017). Similarly, accident analysis allows the identification ofcontributing factors that may have led to the accident in the first place or resulted in the aggravation of
its consequences (e.g. Necci et al., 2018b).
Learning lessons requires the systematic collection and analysis of past accident data, including of nearmisses. Operators should collect detailed information about past Natech incidents at theirplant(s), store it in an interactive database that can be interrogated, and carefully analyse thedata sets to help them prepare updated scenarios and design appropriate risk reduction
measures. Analysis of a single accident provides immediate lessons for that specific event; it might,
however, miss accident causal patterns not easily recognisable within a single accident. Analysis of aset of accidents from a broader data pool provides lessons that are more widely applicable (Krausmann
et al., 2017). This may, for example, help to identify organisational weaknesses that are systemic andrequire improvement, or causes associated with certain types of substances or industrial activities.
General accident data can also be retrieved from industrial accident databases but the quality of Natech
accident data is not uniform and frequently lacks the necessary details (e.g. natural hazard information- flood height, wind speed, earthquake intensity at the location of the hazardous installation or site). This
makes it difficult to reconstruct the dynamics of a Natech event. To support Natech data collection andanalysis, the Joint Research Centre has developed a dedicated Natech incident database (eNATECH 5)
that reflects the advanced accident representation needed to capture the characteristics of Natech
events (e.g. multiple accident sequences occurring in parallel or sequentially).

5

eNATECH is available free at https://enatech.jrc.ec.europa.eu

41

References
Antonioni, G., Spadoni, G., Cozzani, V. (2007) A methodology for the quantitative risk assessment ofmajor accidents triggered by seismic events Journal of Hazardous Materials, 147, pp. 48-59.
Antonioni, G., Bonvicini, S., Spadoni, G., Cozzani, V. (2009) Development of a frame work for the risk
assessment of Na-Tech accidental events Reliability Engineering & System Safety, 94, pp. 1442-1450.
BARPI (2013) Overview of the industrial accidents caused by the great Tohoku Earthquake and tsunami,
Bureau for analysis of industrial risks and pollution, Ministry of Ecology, Sustainable Development andEnergy, France. https://www.aria.developpement-durable.gouv.fr/wpcontent/files_mf/Overview_japan_mars_2013_GB.pdf
CCPS (2000) Guidelines for chemical process quantitative risk analysis, 2nd ed., Center for Chemical
Process Safety, American Institute of Chemical Engineers, New York.
CCPS (2019) CCPS Monograph: Assessment of and planning for natural hazards, Center for Chemical
Process Safety, American Institute of Chemical Engineers, New York.
Chang, J.I., Lin, C.-C. (2006) A study of storage tank accidents, Journal of Loss Prevention in theProcess Industries, 19, pp. 51–59.
Cooper, T.W. (1997) A study of the performance of petroleum storage tanks during earthquakes, 19331995, NIST GCR 97-720, NIST, US National Institute of Standards and Technology.
Cox, T. (1998) Risk integration and decision-making, In: Kirchsteiger, C., Christou, M.D., Papadakis,
G.A. (eds.) Risk assessment and management in the context of the Seveso II Directive, Elsevier,
Amsterdam.
Cozzani, V., Gubinelli, G., Antonioni, G., Spadoni, G., Zanelli, S. (2005) The assessment of risk causedby domino effect in quantitative area risk analysis, Journal of Hazardous Materials, 127(1-3), pp. 14-30.
DSB (2022) Veiledning om vurdering av naturfarer som kan gi risiko for kjemikalieulykker (Natech),
Norwegian Directorate for Civil Protection, in preparation (in Norwegian).
Eidinger, J. M., Avila, E. A., Ballantyne, D., Cheng, L., der Kiureghian, A., Maison, B. F., O'Rourke, T.
D., Power, M. (2001) Seismic fragility formulation for water systems, American Lifelines Alliance (ALA),USA.
FEMA (2015) Multi-hazard Loss Estimation Methodology: Earthquake Model, Hazus®–MH 2.1:
Technical Manual, Federal Emergency Management Agency, US Department of Homeland Security,
USA.
Fernandes, R., Necci, A., Krausmann, E. (2022) Model(s) for the dispersion of hazardous materials infloodwaters for RAPID-N, EUR 30968 EN, European Union, Luxembourg, ISBN 978-92-76-46707-6,
doi:10.2760/849778, JRC127375.
Girgin, S. (2011) The natech events during the 17 August 1999 Kocaeli earthquake: aftermath andlessons learned, Natural Hazards & Earth System Sciences, 11(4), pp. 1129-1140.
https://doi.org/10.5194/nhess-11-1129-2011.
Girgin, S., Necci, A. (2018) Introduction to RAPID-N for Natech Risk Analysis and Mapping: A Beginner’s
Guide, EUR 29511 EN, European Commission, ISBN 978-92-79-98277-4, doi:10.2760/78743,
JRC114363.
Godoy, L.A. (2007) Performance of Storage Tanks in Oil Facilities Damaged by Hurricanes Katrina andRita. Journal of Performance of Constructed Facilities, Vol. 21, No. 6, pp. 441-449.
INERIS (2014) Référentiel méthodologique concernant la maîtrise du risque inondation dans lesinstallations classées, INERIS-DRA-14-141515-03596A, National Institute for Industrial Environment
and Risks, France (in French).
Krausmann, E., Necci, A. (2021) Thinking the unthinkable: A perspective on Natech risks and Black
Swans, Safety Science, 139, 105255.
Krausmann, E. (2017) Natech risk and its management, In: Krausmann, E., Cruz, A.M., Salzano, E.
(Eds.) Natech risk assessment and management, Elsevier, Amsterdam, pp. 105-118.
Krausmann, E., Cruz, A.M., Salzano, E. (2017) Natech risk assessment and management – Reducing
the risk of natural hazard impact on hazardous installations, Elsevier, Amsterdam.
42

Krausmann, E., Salzano, E. (2017). Lessons Learned From Natech events, In: Krausmann, E., Cruz,
A.M., Salzano, E. (Eds.) Natech risk assessment and management, Elsevier, Amsterdam, pp. 33-52.
Krausmann, E., Baranzini, D. (2012) Natech risk reduction in the European Union, Journal of Risk
Research, 15(8), pp. 1027-1047, DOI: 10.1080/13669877.2012.666761.
Landucci, G., Antonioni, G., Tugnoli, A., Cozzani, V. (2012) Release of hazardous materials in flood
events: Damage model for atmospheric storage tanks, Reliability Engineering & System Safety 106, pp.
200-216.
Mannan, S. (2005) Lees' Loss Prevention in the Process Industries, Third edition, Elsevier, UK.
Misuri, A., Landucci, G., Cozzani, V. (2021) Assessment of safety barrier performance in the mitigationof domino scenarios caused by Natech events, Reliability Engineering & System Safety, 205, 107278.
Misuri, A., Cozzani, V. (2021) A paradigm shift in the assessment of Natech scenarios in chemical andprocess facilities. Process Safety and Environmental Protection, 152, pp. 338-351.
Necci, A., Girgin, S., Krausmann, E. (2018a) Understanding Natech Risk Due to Storms – Lessons
learned and recommendations, EUR 29507 EN, European Union.
Necci, A., Krausmann, E., Girgin, S. (2018b) Emergency planning and response for Natech accidents,
In: Towards an all-hazards approach to emergency preparedness and response: Lessons learnt from
non-nuclear events, NEA, OECD Publishing, Paris.
OECD (2015) Addendum No. 2 to the OECD Guiding Principles for Chemical Accident Prevention,
Preparedness and Response (2nd ed.) to address natural hazards triggering technological accidents(Natechs), ENV/JM/MONO(2015)1, Organisation for Economic Co-operation and Development, Paris.
Rendiers G., Cozzani, V. (2013) Domino Effects in the Process Industries - Modelling, Prevention andManaging, Elsevier, UK.
Salzano, E., Iervolino, I., Fabbrocino, G. (2003) Seismic risk of atmospheric storage tanks in theframework of quantitative risk analysis. Journal of Loss Prevention in the Process Industries, 16, pp.
403-409.
Sklet S. (2005) Safety Barriers on Oil and Gas Platforms - Means to Prevent Hydrocarbon Releases,
Doctoral Thesis, NTNU.
Steinberg, L.J., Sengul, H., Cruz, A.M. (2008) Natech risk and management: an assessment of the stateof the art, Natural Hazards 46 (2), pp. 143-152.
TNO (1992) Methods for the determination of possible damage to people and objects resulting fromreleases of hazardous materials (Green Book), CPR 16E, Committee for the Prevention of Disasters,
The Netherlands.
TRAS 310 (2022) Technische Regel für Anlagensicherheit: Niederschläge und Hochwasser (TechnicalRule for Process Safety: Precipitation and Floods) (under revision), Commission on Process Safety(KAS), Federal Ministry for the Environment, Nature Conservation, Nuclear Safety and Consumer
Protection, Germany (in German). https://www.kas-bmu.de/tras-endgueltige-version.html
TRAS 320 (2022) Technische Regel für Anlagensicherheit: Wind, Schnee- und Eislasten (TechnicalRule for Process Safety: Wind, Snow- and Iceload), in print, Commission on Process Safety (KAS),
Federal Ministry for the Environment, Nature Conservation, Building and Nuclear Safety, Germany (inGemran). https://www.kas-bmu.de/tras-endgueltige-version.html
Uijt de Haag, P.A.M., Ale, B.J.M. (2005) Guidelines for quantitative risk assessment (Purple book), CPR
18E, VROM, The Netherlands.
UNI (2021) Linee guida per la gestione di eventi NaTech nell’ambito degli stabilimenti con pericolo di
incidente rilevante - Parte 1: Requisiti generali e sisma, UNI/TS 11816-1:2021, Ente Italiano diNormazione (in Italian).
USCSB (2005) After Katrina: Precautions Needed During Oil and Chemical Facility Startup, Safety
Bulletin No. 2005-01-S, U.S. Chemical Safety and Hazard Investigation Board.
https://www.csb.gov/after-katrina-special-precautions-needed-during-oil-and-chemical-facility-startup/43

van den Bosch, C.J.H, Weterings, R.A.P.M. (eds.) (2005) Methods for the calculation of physical effects– Due to releases of hazardous materials (liquids and gases) (Yellow book), CPR 14E, 2nd ed., VROM,The Netherlands.

44

List of abbreviations and definitions
Critical event

See Top event.

Cut setA set of primary events, i.e., of basic or undeveloped faults, which give rise to the
top event.

Damage distance

The maximum distance at which an accident can cause a specific adverse effect(e.g., injuries).

Domino effect

The process of propagation of an industrial accident from one site (or installation)
to another that results in an escalation of the accident consequences.

Equipment

Machines, components and systems required for an industrial process. Examples
of process equipment used in the process industry are pumps, valves, vessels,
filters, coolers, heat exchangers, columns, and piping.

Establishment

The whole location under the control of an operator where dangerous substances
are present in one or more installations, including common or related
infrastructures or activities; establishments are either lower-tier establishments orupper-tier establishments. This term is used in the context of the Seveso Directive.
For the purpose of this guidance we use the term (industrial) site or (industrial)
plant.

Event tree analysis A modelling technique that identifies possible outcomes, and if required theirprobabilities, following an initiating event. It is used to identify the sequence of
events leading to specified consequences, assuming that each event in thesequence is either a success or a failure.
Fault tree analysis

A top-down failure analysis method in which an undesired state of a system isanalysed using a graphical representation of the combination of faults and Boolean
logic. This analysis method aims to understand how systems can fail by reverseengineering the root causes of the failure.

FMEA

Failure Mode and Effects Analysis. The process of reviewing as many components,
assemblies, and subsystems as possible to identify potential failure modes in asystem and their causes and effects. FMEA is often the first step of a system
reliability study.

FMECA

Failure Mode, Effects, and Criticality Analysis. An analysis method which involves
quantitative failure analysis. FMECA is an extension of FMEA that includes a
criticality analysis to chart the failure mode probability against the severity of theirconsequences.

HazardCondition, event, or circumstance that could lead to or contribute to an unplannedor undesirable event. The intrinsic property of a hazardous material or physicalsituation, with a potential for creating damage to human health or the environment.

Hazard map

A map that highlights areas that are affected by or are vulnerable to a particularhazard. It is typically created for natural hazards, such as earthquakes, volcanoes,
landslides, flooding and tsunamis.

Hazardous material Hazardous substance or mixture that poses a threat to human health and theenvironment. Hazardous materials are toxic, corrosive, ignitable, explosive or
chemically reactive. This term is equivalent to dangerous substance used in theframe of the Seveso Directive.
HAZOP

Hazard and Operability study. A qualitative technique for process hazard analysis
which consists of a structured and systematic examination of an industrial processthat aims to identify hazards and evaluate problems that may represent risks. The
complex process is divided into a number of simpler sections called “nodes” which
are then individually reviewed with the help of standardised guidewords.

Installation

A technical unit within an establishment and whether at or below ground level, in
which dangerous substances are produced, used, handled or stored; it includes all
the equipment, structures, pipework, machinery, tools, private railway sidings,
docks, unloading quays serving the installation, jetties, warehouses or similar

45

structures, floating or otherwise, necessary for the operation of that installation.
This term is used in the context of the Seveso Directive.
LOC

Loss of Containment of a hazardous substance.

LUP

Land Use Planning.

Major accident

An occurrence such as a major emission, fire, or explosion resulting fromuncontrolled developments in the course of the operation of any establishment,
and leading to serious danger to human health or the environment, immediate ordelayed, inside or outside the establishment, and involving one or more dangerous
substances.

MAPP

Major Accident Prevention Policy. Sets out the operator’s overall approach andmeasures, including appropriate safety management systems, for controlling major
accident hazards. This term is used in the context of the Seveso Directive.

Minimum cut set

A cut set that does not contain within itself another cut set.

NatechNatural hazard triggered technological accident.

Natural hazard

A natural process or phenomenon, including all geological, hydrological, climaticand meteorological phenomena that, because of their location, severity, andfrequency, might have a negative impact on human health, the natural and built
environment, and the economy.

Operator

Any natural or legal person who operates or controls an establishment or
installation or, where provided for by national legislation, to whom the decisive
economic or decision-making power over the technical functioning of theestablishment or installation has been delegated.

Process unit

A unit that performs operations that involve a physical change or chemicaltransformation, such as separation, crystallization, evaporation, filtration, reaction,etc. Such operations are connected to create the overall process.

Reliability

The ability of an item to perform a required function under stated conditions for astated period of time.

Risk

The likelihood of a specific effect occurring within a specified period or in specified
circumstances.

Safety report

A safety report should contain details of the establishment, the dangerous
substances present, the installation or storage facilities, possible major-accident
scenarios and risk analysis, prevention and intervention measures and the
management systems available, in order to prevent and reduce the risk of major
accidents and to enable the necessary steps to be taken to limit the consequences
thereof. The term safety report is equivalent to safety case outside the EU or inindustrial sectors other than those falling under the Seveso Directive.

Scenario

A projection of a possible future event. Scenarios are used to consider alternative
possible outcomes.

Site

See establishment.

SMS

Safety Management System. The SMS provides a systematic way to identify
hazards and provide assurance the controls remain effective. An SMS should be
systematic, comprehensive, and integrated with other processes within the facility.
Like all management systems, the SMS provides for setting goals, planning,measuring performance, and support for a culture of continual improvement.

Top event

An undesired event, such as a hazardous situation or equipment failure. Typical
top events are releases of flammable or toxic substances, fires, explosions andfailures of some kind.

What-if analysis

What-if analysis is a structured brainstorming technique that aims to determine
what can go wrong in a given scenario. A team generates What-if questions relating
to each step of the process and each component to determine possible sources oferrors and failures.

46

List of boxes
Box 1. Uncertainties and lack of data .........................................................................10
Box 2. Climate Change ............................................................................................13
Box 3. Damage modes and operating conditions ..........................................................21
Box 4. Structures designed to withstand natural hazard impact .......................................22
Box 5. Common cause of failure................................................................................24
Box 6. Example: Simple reliability estimate .................................................................34
Box 7. Examples of event trees affected by natural hazard impact ....................................34

47

List of figures
Figure 1. The process of risk management ...................................................................... 6
Figure 2. Example of a water depth map associated to a 100-year return period flood..................12
Figure 3. Example of an earthquake hazard curve showing the probability of exceedance of the peakground acceleration at a given location...........................................................................12
Figure 4. Buckling damage due to an earthquake at silos. ...................................................15
Figure 5. Pipe break at flange connection during an earthquake. ...........................................16
Figure 6. Shell-to-bottom detachment of an atmospheric storage tank during a hurricane. The
insulation of the tank was also stripped away. ..................................................................17
Figure 7. Support leg failure of a spherical storage tank due to earthquake. ..............................17
Figure 8. Damage to the fixed roof of an atmospheric storage tank caused by strong wind. ...........18
Figure 9. Atmospheric storage tank displacement and damage from storm surge due to a hurricane,including displacement of a pipe...................................................................................19
Figure 10. Overturned and damaged atmospheric storage tank due to storm surge from a hurricane.
..........................................................................................................................19
Figure 11. Examples of the three approaches for the assignment of LOC scenarios to damage states.
..........................................................................................................................28
Figure 12. Fire spreading on the water surface and dispersal with the floodwaters. .....................30
Figure 13. Additional bracings to reinforce the support legs of a spherical storage tank against
earthquakes. ..........................................................................................................38
Figure 14. Installation of a flexible steel pipe at a large oil tank to allow for displacement of the tankand piping. ............................................................................................................3948

List of tables
Table 1. Example criteria for the identification and ranking of critical equipment items (Antonioni et al.,2009). ..................................................................................................................14
Table 2. Typical damage modes classified by selected natural hazard triggers. ..........................20
Table 3. Typical damage modes of relevance for selected process and storage equipment/facilities. 21
Table 4. Generic LOCs for different types of systems. ........................................................26
Table 5. Examples of the effects of natural hazard impacts on environmental parameters used forconsequence modelling. ............................................................................................30

49

GETTING IN TOUCH WITH THE EU
In person
All over the European Union there are hundreds of Europe Direct information centres. You can find the address of thecentre nearest you at: https://europa.eu/european-union/contact_en
On the phone or by email
Europe Direct is a service that answers your questions about the European Union. You can contact this service:- by freephone: 00 800 6 7 8 9 10 11 (certain operators may charge for these calls),- at the following standard number: +32 22999696, or- by electronic mail via: https://europa.eu/european-union/contact_en
FINDING INFORMATION ABOUT THE EU
OnlineInformation about the European Union in all the official languages of the EU is available on the Europa website at:https://europa.eu/european-union/index_en
EU publications
You can download or order free and priced EU publications from EU Bookshop at:https://publications.europa.eu/en/publications. Multiple copies of free publications may be obtained by contacting Europe
Direct or your local information centre (see https://europa.eu/european-union/contact_en).

KJ-NA-31122-EN-N

doi:10.2760/666413
ISBN 978-92-76-53493-8