Since the total number of installations in the major-hazard industrial plant can be very large, a preliminary selection of critical components is a very important task of the methodology because it allows the selection of the most critical units, decreasing the amount of equipment to be considered in the following steps and drastically reducing the computational time. According to (Paolacci et al., 2013), the main equipment of a process plant can be classified into a restricted number of categories (Figure 2):

• Slim vessels: cylindrical equipment with a large height-to-diameter ratio (usually from 5 to 30). They can be vertical elements anchored to the foundation, both free and restrained along the height, or horizontal vessels on saddle supports. Columns, stacks, reactors, and horizontal vessels are also included.

Special attention should be paid to elements that have no direct consequences because, for example, they contain nonhazardous material but are crucial for the safety of the plant (e.g., firefighting water tank), or they represent secondary structural elements. In the first case, they should be clearly included in the ranking list, discussed in Section 3.6. In the second case, a specific structural analysis should be performed only in the further levels of analysis to account for the eventual influence on the seismic response of the main equipment. A special case is represented by nonhazardous equipment, whose collapse may induce failure in some surrounding elements, generating in turn accidents and triggering domino effects (Kikic et al., 1999).

The identification of the most critical equipment of a major-hazard industrial plant depends on several factors: 1) level of expected seismic hazard, 2) seismic design and vulnerability of the equipment, 3) conservation and maintenance status of the equipment, 4) physical effects related to the dangerousness of the stored material, 5) exposition to the external zones, and 6) domino effects.

A reasonable selection criterion should necessarily integrate all these aspects in a rational manner. At this end, the international literature provides at least three methods (Caputo et al., 2018):

• Preliminary calculation of the damage probability for each equipment, evaluation of the relevant consequences, and risk recomposition (Girgin and Krausmann, 2013).

The first two methods require a high level of information and analysis that generally is not suitable in this step for quick screening of numerous equipment. For this reason, a model based on risk indices appears more reasonable. Sometimes equipment design and other pieces of information are not available, especially in an older process plant, so that the choice of a simplified method such as Risk Index methods becomes mandatory. Starting from the definition of seismic risk, whose main ingredients are hazard, vulnerability, and exposure, a synthetic I _R index can be defined, which can be expressed in a conventional manner as follows: I R = I H × I V × I E (1) where

I _R is the Risk Index;

I _H is the Seismic Hazard Index;

I _V is the Seismic Vulnerability Index;

I _E is the Exposure Index.

Usually, the Seismic Hazard Index I _H should be used to characterize and compare the risk of different seismic zones. In the presence of a plant placed in a specific seismic zone, it becomes meaningless and can be omitted. Instead, in the case of very large industrial plants, which include areas with different seismic hazard conditions, the definition of a Hazard Index (I _H ) is recommended. I _H can be defined by assigning to the index a value between one and the maximum number of zones with different seismic hazards identified in the industrial site. This value should be assigned to each equipment based on the area where it is located.

The Seismic Vulnerability Index I _V depends on aspects of different nature, such as

• equipment typology;

The most direct way to define I _V is to identify vulnerability classes. Different from civil structures, for which the EMS-98 scale is available, which relates vulnerability classes to structural typologies, for industrial equipment, seismic vulnerability classes are not defined yet (Musson et al., 1998). For this reason, a simple method based on fragility curves is herein proposed. A fragility curve describes the probability of exceeding different damage LS given a certain level of ground motion intensity. Different methods can be employed to develop fragility curves in the field of earthquake engineering. When you need a very quick analysis or do not have much information about the equipment, the use of empirical curves or expert opinion-based curves is suggested. Empirical curves are based on observation of actual damage and postseismic surveys, while expert opinion-based curves are directly estimated by experts or based on Vulnerability Index models that use expert judgment. Both solutions are available in the literature for the different structural categories (HAZUS, 2001; Campedel et al., 2008; PEC, 2017).

Because the significant DS for the risk analysis of a process plant are those associable with a material release (LOC), it is reasonable to adopt fragility curves related to an “extensive DS” that could reasonably generate a LOC (HAZUS, 2001). If the plant manager can provide design material and other documentations, the fragility curves of the main equipment like tanks, columns, or horizontal vessels can be analytically evaluated with static or dynamic seismic analysis performed on lumped masses models with a few degrees of freedom. Whenever possible, a careful inspection of the equipment in an industrial plant is strongly recommended, even at this level. This allows us to directly observe some critical issues and to modify the Vulnerability Indexes if necessary, including the units deemed critical through an expert judgment. The vulnerability classes of equipment typologies could be related to fragility curves by simply setting limits on the probability of damage. In this respect, the damage frequency defined by EMS-98 can be adopted. Consequently, the first vulnerability class can be defined by a damage probability between 0 and 20%, while the second class is defined by a damage probability between 20 and 50%. The third and fourth classes are defined by the damage probability ranging from 50 to 70% and 70 to 100%, respectively. This latter differentiation, which is not included in the EMS-98, is here introduced to better distinguish the seismic vulnerability.

For each unit, the vulnerability class and the corresponding Vulnerability Index (I _V ), which assumes values between I _V = 1 and I _V = 4, are assigned by identifying, on the fragility curve, the range of damage probability measured at the peak ground acceleration (PGA), corresponding to the considered damage LS.

According to Figure 3, which represents some fragility curves of industrial equipment available in the literature, Table 1 proposes the association between structural categories and the seismic vulnerably class, considering a PGA range, whose lower and upper bounds correspond to the OBE and SSE damage LS, with values related to the seismic zone. According to past seismic damage surveys (Krausmann et al., 2017), reasonable values for the lower and upper limits can be assumed to be 0.3 and 0.8 g, respectively.

The highest class represents structures with the highest seismic vulnerability. Given that each structural category could be characterized by a certain geometrical and mechanical variability, it has been deemed necessary to individuate, for each structural category, adjacent vulnerability classes. For example, the highest columns are typically more vulnerable than the other (PEC, 2017).

Finally, the Exposure Index I _E is defined in such a way to account for the criteria related to the standard major-hazard accidental conditions. The Seveso III European directive on the Control of Major-Accident Hazards Involving Dangerous Substances (Directive 2012/18/EU, S. I, 2012) suggests a preliminary screening based on the standard safety report of the major-hazard plants. Consequently, I _E can be determined using standard technological accidental conditions. For events with limited impact on the surrounding area, it can be assumed that I _E = 1 and I _E = 2 are assigned to events confined in the reference area of the units (distance D < 50 m), I _E = 3 is assigned to events with impact on large zones of the plant (distance D > 50 m), and finally, I _E = 4 is assigned to events with consequences on the surrounding community.

In order to identify and complete the preliminary identification of the most critical units, the Risk Index values of Table 2 are proposed. Once the equipment with medium/high-risk level is selected, the quantitative evaluation of their seismic risk is performed to recognize structural and nonstructural deficiencies that could generate severe consequences. In this paper, such evaluation is confined to structures that can be directly damaged by the earthquake, neglecting eventual damage propagation effects (Kalemi et al., 2016).

The seismic hazard of a site is usually derived through a full PSHA, which is expressed as a mean annual frequency of exceeding a certain intensity measure (IM) (Cornell, 1968). In addition, local seismic analyses are often performed to better characterize soil class and thus account for possible amplification phenomena. In this respect, OpenQuake, an open-source software developed by the Global Earthquake Model Foundation, can be profitably used (Pagani et al., 2014). In the present work, the Matlab script MatHazard, developed by the research group of the Roma Tre University, has been adopted, whose typical interface is illustrated in Figure 4A. As a matter of fact, an example of a hazard curve for the city of Viggiano (Italy) located in the Basilicata Region is shown in Figure 4B, which has been built for soil class C. In this case, the seismogenic zones 926 and 927 have been used, which are identified in the Italian zonation ZS9 (INGV, 2014).

As a simplified alternative, many technical codes, as the Italian one (NTC 2018, 2018) or the Eurocodes (CEN, 1998), provide, for different LS, the return period of the earthquake and thus the mean annual frequency of exceeding the PGA. Consequently, a simplified linear piece-wise seismic hazard curve representation can be used. However, in the light of the risk assessment method that will be illustrated inSection 3.5, it is convenient to linearize the hazard curve in the log-log plane, whose equation in the ordinary plan can be expressed as (Jalayer and Cornell, 2003) λ ( P G A ) = k 0 P G A − k (2) where k ₀ and k are the regression line parameters in the log-log plane. According to (Jalayer and Cornell, 2003), the lower and upper bound of the seismic intensity, to perform the linearization, should correspond to the Design Basis Earthquake (DBE) and Maximum Credible Earthquake (MCE) intensity levels, with 10 and 2% probabilities of exceedance in 50 years, respectively, whereas Cornell, 1968, suggests fitting between two points: one equal to the targeted mean annual frequency (MAF) and one with a MAF ten times higher. Both suggestions appear reasonable as investigated in (Gkimprixis et al., 2019). However, given that OBE and DBE are comparable LS as well as SSE and MCE, adopting OBE and SSE as the lower and upper bound is herein suggested.

A crucial aspect is the local seismic response that could strongly affect the risk assessment. Consequently, the local seismic response should be always conducted, including the soil effects. This is possible by adopting a frequency-dependent amplification factor or directly integrating the site effects into PSHA (Aristizábal et al., 2018). The code-compliant approach is instead simplified because a constant amplification factor is applied to all IM. Such an approach is suitable for a rapid risk assessment, where the resources are limited.

The seismic vulnerability of a process plant equipment can be effectively quantified using the fragility curves. Fragility functions provide the probability of exceeding a certain LS, given a ground-shaking intensity. For this type of structure, the PGA is usually considered an efficient and sufficient IM (Kaynia, 2013; Phan and Paolacci, 2016), fully consistent with the seismic hazard analysis. One of the most diffused techniques for fragility functions analysis, which conjugate reduced computational effort and easiness, is the so-called “Cloud Analysis” (Mackie and Stojadinovic, 2005). This technique utilizes the results of proper numerical models to build a probabilistic model based on a regression analysis. Usually, a lognormal distribution is adopted so that the probability of exceeding a specific LS; i.e., the probability that an engineering demand parameter (EDP) exceeds LS, given that IM = x, can be estimated adopting a normal standard cumulative distribution function: P ( D E D P > L S | I M = x ) = 1 − ϕ ln ( L S m ) − ln ( D m ) ( β D | I M 2 + β L S 2 ) (3) where ϕ is the standard normal distribution function;

LS _m is the median value of the LS;

D _m is the median value of the demand;

β _D|IM is the std. dev of the response;

β _LS is the std. dev of the capacity.

Static or dynamic seismic analysis carried out with proper low-fidelity or high-fidelity models can be used to build fragility curves. For a given number of return periods, consistent with the expected damage, a minimum number of seven accelerograms (CEN, 1998) should be selected and used to derive the parameters of the linear regression in the log-log plane as follows: D m = a I M b (4) β D | I M = ∑ i = 1 n [ ln ( d i ) − ln ( D m ) ] 2 n − 2 (5) where a and b represent the linear regression coefficients evaluated by recording the maximum values of a certain EDP, produced by each accelerogram. The LS of the different equipment have been defined according to both the structural behavior and the possible loss of hazardous containment in the several pipe-equipment connections. Concerning the first ones, particular attention should be paid to the collapse LS, which could lead to a catastrophic failure of the equipment and therefore the instantaneous release of the full content (liquid or gas).

The collapse condition, as defined in the codes, refers to conditions that potentially could cause a structural collapse. Specific collapse fragility curves have been introduced recently, which are based on models able to follow step-by-step the structural collapse. Therefore, the term “collapse” must be intended as a condition of potential collapse. This conservative choice guarantees appropriate margins with respect to phenomena considered more disastrous of the mere collapse, being involved in potentially catastrophic consequences with the release of hazardous material. The collapse LS for each category of equipment are listed in Table 3. In the same table, the EDP, through which each LS can be analytically evaluated, is also individuated.

Concerning the LS associated with the failure of pipes connected to the equipment and coming from other units, literature definitions have been adopted, which are associated with standard LOC conditions often used in the QRA of process industries. Three different LOC events are herein adopted, whose definition is reported in Table 4. The first level (LOC1) is associated with the plasticization of the pipe flange joint at the connection to the equipment, able to produce a moderate loss from a small break. A serious loss (LOC2) is associated with the excessive rotation of the flanged joints of pipes connected to the equipment. Finally, the instantaneous release of full content, here identified as LOC3, is associated with the collapse of LS.

For the definition of LOC events from pipes, the results of experimental tests can be used; for example, in (Karamanos et al., 2013), different types of flange joints have been tested to identify the levels of damage corresponding to LOC. Accordingly, the rotation of pipes with a large diameter (8–14 inches), corresponding to the first release of materials, is around 0.01 rad, while the complete breaking of the joint occurs for 0.03 rad. These values can be considered rather conservative because of the high dispersion of the results. These values are referred to conditions in which the pipes are considered rigidly connected to equipment. In different conditions, these limits should be appropriately increased.

In case of process plants, the risk calculation necessary involves the effects of the content release from a critical unit (tank, pipe, etc.\enleadertwodots), which can cause important effects on the surrounding equipment and community. Thus, only DS involving the release of dangerous substances (toxic, flammable, explosive, or polluting) or critical equipment for emergency phases (e.g., firefighting water tanks) are important in seismic risk analysis, while the other DS can be neglected. As stated before, nonhazardous equipment, whose collapse may induce failure in some surrounding elements, should be included in the list of elements at risk.

The aim of this part of the framework is to use a reasonable criterion to correlate seismic DS and LOC resulting from the structural damage analysis for different categories of industrial equipment. In this respect, the probability of LOC for a given level of seismic damage should be calculated. Nevertheless, the contributions in this direction have been particularly limited. The few contributions present in literature are typically based on empirical approaches (Fabbrocino et al., 2005), in which the relationship between LOC and seismic damage is defined on accident databases and is generally considered as deterministic. A probabilistic approach for the assessment of LOC event in steel storage tanks under seismic loading has been proposed in (Paolacci et al., 2018). Since further developments in this regard are necessary, only deterministic DS/LOC correlation matrices are herein considered, leaving more refined approaches to future investigations. In this respect, Table 3 collects all possible DS/LOC correlations for the structural typologies defined in (Paolacci et al., 2013).

In case of slim vessels category, LOC may occur due to the excessive rotation of bolted flange joints or to the failure of the anchorage; the first one is caused by the structure deformation and the plasticization of the base plate and/or of the skirt, while the second one is due to the excessive rotation and stresses in the anchorage systems. Squat equipment placed on the ground is mainly represented by storage tanks. For this kind of equipment, LOC may occur due to the following DS: elastic buckling (EB), elephant-foot buckling (EFB), sliding, and overturning. The first three DS can cause the pipes’ detachment, while the overturning DS can generate a complete release of the full content. For the equipment on support structures, the DS mainly related to the LOC are the excessive rotation of pipe connection and the failure of the support structure, with following overturning and loss of the whole content.

The definition of DS for pipe racks is carried out in terms of lateral deformation (Paolacci et al., 2011), considering the maximum drift as a reference parameter, in accordance with the provisions of the codes. The LS can be defined assuming the reference values in the FEMA-356, 2000, standard.

The MAF of exceeding a given DS can be performed by applying the total probability theorem, combining the seismic hazard curve with the fragility curves. The general equation is as follows: λ D S = P [ D S > d ] = ∫ P [ D > d | P G A = P G A 0 ] d λ ( P G A ) (6) where λ _DS is the MAF of exceeding the damage d, P (D > d|PGA = PGA ₀) is the fragility curve, and dλ is the differential of the seismic hazard curve. Considering that the fragility curve can be expressed analytically using the Cloud Analysis, as well as the hazard curve using Eq. 2, the previous integral assumes the following closed form, as suggested by (Jalayer and Cornell, 2003): λ D S ( d ) = λ ( P G A 50 % ) e 1 2 k β E D 2 (7) where λ (PGA50%) represents the hazard corresponding to a probability of 50% of exceeding the damage d, which is derived by the fragility curves, whereas k represents the slope of the linearized seismic hazard curve. β _ED represents the logarithmic standard deviation of the response due to the seismic action. This latter can be increased to account for epistemic uncertainty β _U (e.g., model imprecision). The total standard deviation β _TOT becomes β T O T = β E D 2 + β U 2 (8)

Consequently, the risk calculation can be estimated using the following formula: λ D S ( d ) = λ ( P G A 50 % ) e 1 2 β T O T 2 (9)

Thus, the calculation of the MAF of exceeding the damage can be immediately derived. Finally, by means of the above-mentioned DS/LOC matrices, it is possible to obtain the annual frequency of exceeding the LOC events (LOC1, LOC2, and LOC3) and thus to evaluate the degree of exposure of the equipment.

From the calculation of the MAF of exceeding the LOCs, it is possible to derive the ranking of the most critical components, identifying the ones for which it may be necessary to intervene with appropriate mitigation systems. The reference values of the LOC probability are not easily identifiable from the literature. In the present work, it is suggested to evaluate the consequences of a given LOC event through the correlated event tree. Once the frequency of the different scenarios is known, it is possible to evaluate a consequence-based risk level. For this purpose, it may refer to the probability classes characterized by the Probability Class Index (PI) shown in Table 5 (CPS, 1992).

By associating each PI with a Consequence Index (CI), it is possible to derive a Global Risk Index (GRI) product of the first two, which provides a measure of the severity of the scenario. The definition of the CI is provided in Table 6 in terms of damage thresholds and accidental scenarios Table 5 (TNO, 1992). Since each LOC event is associated with different possible (mutually exclusive) events, a total GRI can be defined as the sum of the indexes of each of the scenarios. This index can be used to derive a ranking of events with decreasing level of risk and draw up a list of priorities. These priorities can be further refined by identifying some additional parameters, for example, the impact of the intervention, including implementation time and plant shutdown, leading to the calculation of the plant resilience as well.

The ranking and the related priorities can be established in the form of a risk matrix (Duijm, 2015). In the present paper, the following one is proposed, where the likelihood is represented by the PI and the consequence by the CI, whose product represents the already defined GRI. Observing the probability classes, we defined, according to Table 5, the likelihood as limited when PI ≤ 2, moderate when 2 < PI ≤ 3, and high when PI ≥ 4. Analogously, the consequence, according to Table 6, is deemed limited when CI ≤ 2, moderate when 2 < CI ≤ 3, and high when CI ≥ 4. Consequently, the risk matrix illustrated in Figure 5 can be profitably employed for the decision-making analysis and thus for the selection of the proper mitigation measures.