This article was downloaded by: [roberto.cigolini@polimi.

it]
On: 11 March 2010
Access details: Access Details: [subscription number 919822292]
Publisher Taylor & Francis
Informa Ltd Registered in England and Wales Registered Number: 1072954 Registered office: Mortimer House, 37-
41 Mortimer Street, London W1T 3JH, UK

Production Planning & Control

Publication details, including instructions for authors and subscription information:
http://www.informaworld.com/smpp/title~content=t713737146

Managing operational risks along the oil supply chain

Roberto Cigolini a; Tommaso Rossi b
a
Department of Management, Economics and Industrial Engineering, Politecnico di Milano, Milan,
Italy b Institute of Technology, Università Carlo Cattaneo - LIUC, Castellanza, VA, Italy

First published on: 11 March 2010

To cite this Article Cigolini, Roberto and Rossi, Tommaso(2010) 'Managing operational risks along the oil supply chain',
Production Planning & Control,, First published on: 11 March 2010 (iFirst)
To link to this Article: DOI: 10.1080/09537280903453695
URL: http://dx.doi.org/10.1080/09537280903453695

PLEASE SCROLL DOWN FOR ARTICLE

Full terms and conditions of use: http://www.informaworld.com/terms-and-conditions-of-access.pdf

This article may be used for research, teaching and private study purposes. Any substantial or
systematic reproduction, re-distribution, re-selling, loan or sub-licensing, systematic supply or
distribution in any form to anyone is expressly forbidden.

The publisher does not give any warranty express or implied or make any representation that the contents
will be complete or accurate or up to date. The accuracy of any instructions, formulae and drug doses
should be independently verified with primary sources. The publisher shall not be liable for any loss,
actions, claims, proceedings, demand or costs or damages whatsoever or howsoever caused arising directly
or indirectly in connection with or arising out of the use of this material.
 Production Planning & Control
2010, 1–16, iFirst

Managing operational risks along the oil supply chain

Roberto Cigolinia* and Tommaso Rossib
a
Department of Management, Economics and Industrial Engineering, Politecnico di Milano, Milan, Italy;
b
Institute of Technology, Università Carlo Cattaneo – LIUC, Castellanza, VA, Italy
(Received 8 September 2008; final version received 20 October 2009)

Operational risk in the oil industry may lead to environmental disasters and to heavy loss of human lives.
However, the relationship between operational risk and oil supply chain management is poorly studied. This
article proposes a model (derived from the Eni’s supply chain) to analyse and to assess the operational risk at the
drilling, primary transport and refining stage of the oil supply chain. For the drilling stage, the model suggests
three sub-methods, one for each period of the plant life cycle (design, construction and production). For the
primary transport stage, two different risk management processes are proposed: the former one allows the risks
resulting from processes, procedures and physical components (other than oil-pipelines) to be identified, assessed
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010

and controlled, whereas the latter one allows risks arising from the pipeline breakdowns to be faced. Finally, for
the refining stage, a preliminary phase is recommended to prioritise each equipment of the refinery, and several
techniques and tools are suggested.
Keywords: supply chain; operational risk; oil industry

1. Introduction significant efficiency losses (Blackhurst et al. 2005)

In the recent years, supply chain risk has become a
major research subject, pushed to the fore by the
impacts on logistic networks of various events (Peck
2004): 11 September, war in the Middle East, millen-
nium bug, bovine spongiform encephalopathy (BSE)
outbreak, etc., have urged both academicians and
practitioners to investigate supply chain vulnerability,
and to assess risks in logistic networks.
Supply chain vulnerability is due to the supply
chain nature (Chapman et al. 2002, Rice and Caniato
2003). Dynamic networks of interconnected firms and
industries – driven towards efficiency over the last
decades – are more and more reliant on efficient and
reliable production, transport and communications.
So, in addition to terrorist attacks, natural disasters
and/or industrial disputes, day-by-day (operational)
risks may result in disruptions of the logistic network
operations (Tapiero and Grando 2006). According to
Tapiero (2004), supply chain operational risks can be
defined as the risks connected to the daily disturbances
that materials and information flows can suffer from.
Such disturbances can be either internal (failures in
operations and service management) or external (an
uncontrollable event the supply chain is not ready for).
In the end, operational risks lead to the supply
chain inability to satisfy customers’ needs as well as to
and, ultimately, to unpredictably high costs (Riddalls
and Bennett 2002). A company studied by Rice and
Caniato (2003) projected an increased cost by $ 50–100
million per day due to supply network disruptions.
Radjou (2002) stated that (in 1996) General Motors
did not receive components from a brake supplier
factory for 18 days, which idled workers at 26 assembly
plants and the estimated reduction in quarterly earn-
ings was around $0.9 billion. Boeing (in 1997) experi-
enced supplier delivery failure of two critical parts,
which caused an estimated loss of $2.6 billion.
In the oil industry, operational risk is ‘bull-
whipped’, in which it goes beyond the classical
effectiveness and efficiency reduction of either a
single firm or a group of production plants.
Operational risk may lead to environmental disasters
and heavy loss of human lives: in the Mediterranean
sea, on 10 April 1991 the Moby-Prince ferry rammed
the Agip-Abruzzo motor vessel causing 140 deaths and
25,000 tons of oil was poured into the sea. One day
later, a blaze on board the Haven oil-tanker resulted in
6 deaths and 50,000 tons of oil was poured, and 17
years later the environment reclamation operations are
still in progress. In Texas City (TX), on 25 March 2005
an explosion within the refining plant of the British
group BP (the third refining plant in the US) killed 15
people and caused serious environmental damage to

*Corresponding author. Email: roberto.cigolini@polimi.it

ISSN 0953–7287 print/ISSN 1366–5871 online

ß 2010 Taylor & Francis
DOI: 10.1080/09537280903453695
http://www.informaworld.com
 2 R. Cigolini and T. Rossi
the surrounding area. In Lagos (Nigeria), on 26
December 2006 a damaged oil-pipeline was burst: the
shock-wave caused the fire of the neighbouring houses
and the International Red Cross counted 269 deaths.
Indeed, several authors state that the relationship
between operational risk and oil supply chain man-
agement requires further investigation (Brandsaeter
2002, Cigolini et al. 2004, Dey et al. 2004, Cigolini and
Rossi 2006, Proth 2007).
This article proposes a model to analyse and to
assess the operational risk within the oil supply chain.
The model has been derived by the Eni’s (see
www.eni.it) supply chain and it is based on an active
involvement of the Exploration & Production division
and of the Refining & Marketing division, which are,
respectively, responsible for identifying and exploiting
oil-fields and for transporting and refining crude oil.
The methodologies applied here refer to the case
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010
study research and the action research (Westbrook
1995, Yin 2003). The case study methodology allowed
to understand the oil supply chain, its peculiarities and
problems by means of inspections to drilling and
refining plants as well to oil-pipelines and interviews.
The action research methodology allowed to build the
model through team-working with people responsible
for the risk management process at each stage of the oil
supply chain. The action research has been performed
through a recurrent approach involving critical reflec-
tion (at the beginning, on the current risk management
process, and then, on the modified risk management
process) and action (changes to iteratively improve
how to manage risks at each stage of the oil supply
chain).
This article is arranged as follows: Section 2
presents the background; Section 3 illustrates
approaches and tools to assess the operational risks
along the oil supply chain; and finally, Section 4
provides some concluding remarks and future research
paths.
2. Background
The oil supply chain can be divided into three main
stages: drilling, primary transport and refining.
2.1. The risks along the oil supply chain
In the drilling stage the activities that follow the
exploration (new oil fields identification) take place;
these activities deal with (Nguyen 1996): (i) oil and
natural gas extraction from onshore and offshore
fields; (ii) oil and gas leaching (with water and sand)
and elimination of any unwanted materials; and (iii) oil
transport from offshore fields to oil tankers and from
onshore fields to oil-pipelines.
The primary transport stage refers to the oil
transfer to refining plants and it involves – depending
on the oil field – either pipelines only or pipelines and
tankers. As a matter of fact, the global oil transport
system also involves either continent crossing pipelines
or super tankers and, since oil is often used far from
the extraction place, several combinations of transport
means can be used along the way. However, the
primary transport activity ends when the crude oil is
within the refining area and the responsibility of the
refining stage starts.
Refining is devoted to transform crude oil into
finished products and it can be summarised as follows:
after the removal of salts and other impurities, crude
oil is fractioned via primary distillation; then finished
products quality and mix is improved through the
reduction of the average molecular weight, the
upgrading, the blending and the finishing activities
(Castellano and Cigolini 2002, Nguyen et al. 2005).
Each of the three above-mentioned oil supply chain
stages is plagued by different operational risks
(Brandsaeter 2002, Khan et al. 2002, Novelli 2004,
Ross 2004, Nguyen et al. 2005), as outlined in Table 1.
Regardless of the differences among the stages of the oil
supply chain in terms of operational risks, processes,
plants and safety equipments, no specific risk manage-
ment approach has been conceived for the drilling,
primary transport and refining stage, respectively.
Oil industry adopts a traditional undifferentiated
risk management approach (Culp 2001, Omole et al.
2004; see also Figure 1) that can be divided into three
main consecutive phases so that the output of each
phase is the input of the following one: (i) risk analysis,
made up from the definition of the system’s bounds as
well of the incidents it can suffer from and risky events
identification; (ii) risk assessment, in terms of the
frequency of each event previously identified and of the
severity of its consequences and (iii) risk control, where
appropriate procedures to manage risk are selected.
2.2. Risk analysis
Within the risk analysis, risk identification can be
performed by means of either forward or backward or
even hybrid techniques (Vesely et al. 1981, Crawley et
al. 2000, Clifton and Ericson 2005). In particular, the
most popular forward techniques in the oil industry
are: (i) the hazard checklist, which consists of the plant
analysis to verify if risky events identified in previous
risk analyses or in similar plants can occur (Lees 1996);
(ii) the Events Tree Analysis (ETA) that allows to
 Production Planning & Control 3

Table 1. Taxonomy of the main operational risks at the different stages of the oil supply chain.

Drilling stage Primary transport stage Refining stage

Risk 1: Pouring and outflows of crude
oil which can result in serious
damages (spill or blowout)
Risk 2: Leaks from the tubing that
links the field to the oil-pipeline
Risk 3: Tubing and/or casing corrosion
Risk 4: Erosion or malfunctioning of
plant components (motors, gears,
mud circuit, safety and lifting
equipments) and of the auxiliary
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010
Risk 1: Collisions between tankers and
other ships, and between tankers
and docks, coastal terminals, rocks
Risk 2: Blazes and explosions on board
tankers
Risk 3: Oil-pipelines damages
Risk 1: Process blazes (flash-fire,
jet-fire, fireball, tank-fire)
Risk 2: Refining plant (or components)
explosion (distillation column,
heat-cracking and catalytic cracking
equipments) due to the status
modifications of treated elements
Risk 3: Fast combustions which can
result in high pressures and boiling
liquid expanding vapour explosion
(the so-called Bleve)
Risk 4: Outflow of process and
auxiliary elements (hydrofluoric
acid, sulphured hydrogen, sulphur-
ous anhydride, ozone)

plants to treat mud and oil

Risk 5: Blazes and explosions of oil
and other elements not directly
connected to the drilling process

System bounds
Start
identification

Critical events
identification
identification

Risky events
Risk analysis identification

Risk Risk
control assessment Valuation of risky events
End
likelihood and
likelihood impact
and impact

Give the users

Appropriate No Is the risk Yes
notice of the
procedures acceptable ?
residual risk

Figure 1. The risk management process.

determine the damages a potential risky event can
result in, due to the safety equipment and procedures
which the plant is characterised by.
Figure 2 outlines an events tree referring to an
unstoppable oil leak, which is a typical risky event of
the refining stage. By means of the risky event
frequency (and of the middle events), ETA allows the
damages occurrence probability to be estimated. In this
way the first step of the risk assessment phase can be
anticipated.
With reference to the backward-oriented
approaches, the most common technique is the
Faults Tree Analysis (FTA), which allows to identify
risks by linking the final events (damages) to the risky
events through logical connectors.
Figure 3 outlines a faults tree of a furnace of a
refinery vacuum plant: the considered damage (usually
called top-event) is a too high furnace temperature.
Also the hazard review belongs to the backward
techniques category – it consists in a qualitative
 4 R. Cigolini and T. Rossi

Legend Yes Water Yes Jet/pool-fire

Bleve: instantaneous outflow of expanding cooling not
vapour or boiling liquid, which causes an Impact on 25% 2% + Bleve
available
explosion caulked
Pool-fire: blaze of an oil pool sphere No 98%
Jet-fire: blaze of a high-speed gas or vapour jet
Flash-fire: blaze of a low speed Yes 2% No 75%
outflow of gas or vapour Water not
Jet/pool-fire
available No 98%
Yes 5%
Yes Water Yes Flash-fire +
Instantaneous cooling not jet/pool-fire
burning Impact on 25% 2%
available + Bleve
caulked
No 95% No 98%
sphere
Unstoppable Yes 2% No 75%
oil leak Water not Flash-fire +
available No 98% jet/pool-fire
Yes 30%
Delayed
Dispersion
burning No 70%
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010

Figure 2. Events tree example.

Too high furnace

temperature

And

Ineffective temperature High furnace Ineffective furnace

control equipment temperature stop equipment

Or Or

Temperature Temperature Alarm Ineffective Safety Ineffective

sensors out threshold out of operators equipment stop
of order incorrect order intervention out of order actions

Figure 3. Faults tree example.

check of the plant to define, on the basis of the
reviewer’s experience and personal judgement, the risks
it can suffer from.
Finally, the most popular techniques in the oil
industry are the hybrid ones: the Hazard and
Operability (HazOp) study, the procedural HazOp
and the emergency systems survivability analysis.
HazOp consists in verifying, in a systematic way, the
plant and its design to detect causes and effects of
the deviations from the plant normal operating. The
procedural HazOp is the HazOp applied to critical
systems from the safety point of view (drilling plant,
lifting equipments and mud circuit). The third technique
allows to identify the ability of an emergency system to
resist incident statuses. An example of HazOp study for
an element of the primary transport system is outlined
in Table 2. The considered node is given by the booster
pumps of an oil-pipeline and the main process
parameters for which a deviation from the standard
values can occur are ‘flow’ and ‘containment’, while the
possible deviations, expressed by couples of keywords
and process parameters are: no-flow, reverse-flow and
loss-of-containment.
2.3. Risk assessment
The risk assessment is performed (for each previously
identified risky event) by estimating the magnitude of
the corresponding damages and the damages
 Production Planning & Control 5

Table 2. Example of HazOp analysis assuming the booster pumps as HazOp node.

Protections and/or
# Deviation Causes Consequences indications Recommendation

1 No-Flow Closed valves on the Lines overpressure and Valves on the delivery Inhibit the booster
delivery lines pumps overheating lines provided with pumps start or, during
limit blocks. Operator the use, stop pumps
always present when when the delivery lines
pumps start. Lines are intercepted
designed to resist
booster pumps shut
off pressure
2 No-Flow Valves on the delivery Closed valves condition Install limit blocks and
lines not provided not detected alarms on the valves
with limit blocks
3 Reverse-Flow Valves not closed Due to gravity, the Operational procedures Install limit blocks and
when needed; liquid flows from the to open & close valves alarms on the transfer
the two cisterns higher level cistern to before and after the lines (between cisterns
become connected the lower level cistern product transfer and booster pumps)
with product
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010

contamination
4 Loss-of- Booster pumps seal Oil or gasoline leaks Install booster pumps
Containment damaged or (which can result in provided with a
broken blazes) double seal

occurrence probability (or frequency) on condition
that the risky event occurs, so that the risk is measured
as the product between magnitude and probability.
The two most popular approaches to estimate the
frequency in the oil industry are based on historical
data and qualitative judgements: historical time-series
can be obtained from ad hoc plant-related or
sector-related databases, while qualitative judgements
of experts can be converted into synthetic values of
probability occurrence by means of linguistic variables
and corresponding fuzzy sets (see, among others,
Cigolini and Rossi (2007)).
The magnitude estimation can be performed by
means of (Molak 1997): (i) plant-related or
industry-related databases that report the damages
occurred in the past to the considered plant or to
similar ones; (ii) experts’ judgements to be converted
into synthetic magnitude values (through fuzzy theory)
and (iii) simulation techniques to test on a model the
damages caused by each risky event under different
environmental conditions (wind speed, air temperature
and other weather conditions).
2.4. Risk control
With reference to risk control, the oil industry is
characterised by prevention practices to reduce the
probability of damage occurrence and by protection
practices to limit the damage magnitude. Such
practices, popular as loss control techniques, involve
both actions (maintenance activities, safety equipments
and operators training) and financial tools (insurance
and not insurance transfers).
Actions, which represent the so-called technologi-
cal instruments, aim at reducing risks according to a
prevention or an avoidance approach. An oil company
can decide to completely eliminate a risk by harvesting
the business activities or (more often) the geographical
areas where the risk can rise from.
The financial tools aim at reducing risks according
to a protection approach. An effective risk analysis and
risk assessment activity is very important since insur-
ance companies are more and more reluctant to ensure
full cover when dealing with oil plants (Pizzurno and
Rossi 2007). The not insurance transfer allows the oil
company to transfer risks to companies different from
insurance companies and it takes place by outsourcing
the business activities that originate risks, typically the
transport by tankers.
2.5. Need for action
Due to the differences (outlined in Section 2.1) among
plants, processes and operational risks within each
stage of the oil supply chain and due to that the risk
management process is undifferentiated along the oil
supply chain, a need for action arises in order to
identify specific approaches and tools to be used
for risk management at the drilling, transport and
refining levels.
 6 R. Cigolini and T. Rossi

A more accurate risk management processes spe-
cifically conceived for each stage of the oil supply chain
allows: (i) to identify all the risky events a drilling plant
or a transport system or a refining plant can suffer
from; (ii) to better evaluate the probability and the
magnitude of each risky event and (iii) to activate the
most appropriate control actions for the highest
priority risks. A careful risk management is particu-
larly relevant in the oil industry where underrated risks
can lead to environmental disasters and to heavy loss
of human lives.
Section 3 is devoted to present approaches and tools
specific for each stage of the oil supply chain. Such
approaches and tools have been identified through
team-working with Eni Corporation managers of the
divisions Exploration & Production (for the drilling
stage) and Refining & Marketing (for the transport and
the refining stages). For this reason, the items related to
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010
management process and methods for the transport
and refining stages, respectively: risk analysis, risk
assessment and risk control are treated with reference
to the production phase only and the object of the risk
management process at the transport stage is given by
oil-pipelines, which represent the transport resources
under the direct responsibility of the oil company.
3.1. The drilling stage
The construction of new production plants is quite
common at the drilling stage, so the risk management
process has to be conceived for the plant life cycle up
to production. Since various criticalities characterise
each plant life-cycle phase, specific risk analysis, risk
assessment and risk control techniques have to be
proposed for each stage (Figure 4). The risk manage-

ment process during the design phase depends on the

risks and activities the oil company is responsible for are
mainly considered in the following.
3. The proposed model
As stated above, this section is aimed at presenting
specific approaches and tools to manage risks at each
stage of the oil supply chain. Such a section is
structured according to the matrix depicted in
Table 3. Section 3.1 is devoted to provide some insights
on the risk management process and methods at the
drilling stage and it treats risk analysis, risk assessment
and risk control with reference to the whole drilling
plant life cycle. In particular, the risk management
process during the design and construction phases is
focused on the drilling plants designed by the oil
company and by an outsourcer, respectively. Sections
3.2 and 3.3 aim at identifying the most proper risk
design type: if the drilling plant is a standard one (the
plant is similar to others formerly designed and built in
terms of functional and dimensional features as well of
context where the plant will operate), risk analysis and
risk assessment should not be executed since the design
will be performed according to the best practices
established over the years (as a result of the risk
analysis and risk assessment performed with reference
to the first plants of the series). In other words, risk
management is limited to risk control.
If the drilling plant to be designed is significantly
different from the ones previously designed (e.g. an
off-shore plant aimed at drilling a deeper field than the
ones currently exploited), risky events identification
(risk analysis) and the estimation of the damages
magnitude and occurrence probability (risk assess-
ment) are needed. The hazard checklist technique is
suggested, since neither the ETA nor a backward

Table 3. Scheme of Section 3.

Stage Object Risk analysis Risk assessment Risk control

Drilling Design of drilling plant Hazard checklists, Judgements, ETA Databases

(Section 3.1) (designed by the oil HazOp
company)
Construction of drilling HazOp ETA, simulation Standards, equipments
plant (designed by an
outsourcer)
Production at drilling Judgements ETA, Simulation Operational procedures
plant
Transport Transport resources Judgements, HazOp Judgements, HazOp, HazOp, Costs/benefits,
(Section 3.2) belonging to the oil Costs/benefits, Equipments
company simulation
(oil-pipelines)
Refining Refining plant Literature, Field Databases, ETA, Equipments, Insurances
(Section 3.3) experience, Simulation
HazOp, Databases
 Production Planning & Control
technique nor a hybrid one is suitable, given that the
drilling plant has not been designed yet. Within the risk
assessment phase, the magnitude and the occurrence
probability of the damages corresponding to the risky
events can be estimated in a qualitative way, by having
to resort to experts’ judgements (to be translated into
synthetic values of magnitude and probability through
fuzzy sets).
Once the design is finished, the plant has to be
verified from the risk point of view. Through a HazOp
analysis, the risky events can be identified and, starting
from the reliability data of each component, the
frequency of each risk event is estimated. Then, by
means of ETA, the different damages and the corre-
sponding probabilities can be figured out. Finally,
simulation techniques help to outline the magnitude of
each damage. If the design is unsatisfactory under
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010
given combinations of probability and magnitude, it
will be modified to reduce damages effects and/or
frequency and new checks will be done until the
impacts of all damages are acceptable.
The risk management process during the drilling
plant construction depends on the designer: if the
designer is the oil company, risk analysis and risk
assessment should not be executed since the plant will
be built according to the best practices established over
many years. Risk management is limited to risk control
and the plant is built according to good construction
practices that derive from the oil company experience
and/or they are suggested by third parties (e.g. the Det
Norske Veritas foundation). If an outsourcer designed
the plant, the design is checked by the oil company to
verify whether to install (during construction)
Project Standard
specifications project ?
No
Risk analysis
(hazard checklists) and
risk assessment
(experts’
(experts’ judgements)
judgments)
Plant
design
Risk analysis
(HazOp) and
risk assessment
(ETA &
simulation)
Plant design (made
by an outsourcer)
Figure 4. Overall view of the risk management activities and tools (in grey) for the drilling stage.
7
additional prevention and/or protection equipment.
Such precautionary check is always carried out not-
withstanding the oil company transfers risks resulting
from incorrect design decisions to the outsourcer
(Section 2.4) and notwithstanding the outsourcers
analysis, assess and control risks when they design
the drilling plant. The check pattern is the same as the
one to be used for non standard plants.
During plant production, risk management follows
two paths. The former one concerns the drilling
activity: risk management (analysis, assessment and
control) is aimed at preventing and at facing blowout,
which is the most relevant damage that can be
triggered. Risk management has to be performed
periodically and is composed of four steps: (i) identi-
fication (on the basis of experts’ opinions) of risky
events which can result in blowout; (ii) for each risky
event, by means of historical data and/or data obtained
from industry data bases, the corresponding events tree
is drawn and the damages which the risk event can
actually result in are detected (the events tree allows
also the damages occurrence probability to be esti-
mated); (iii) the magnitude of each damage is deter-
mined through simulation; (iv) loss control measures
are taken to prevent blowout (through the substitu-
tion of components and by increasing maintenance
frequency) and/or to reduce its consequences (by
defining and implementing safety procedures and
insurances).
The latter path of the risk management concerns
the production and/or the plant itself, which represent
the other activities that can cause damages to the
operators. The risk management is limited to risk
Production phase
Design
Yes phase Risk analysis and
Plant design risk assessment
(experts’ judgements,
according to
Constru- ETA & simulation)
standards
ction
phase
Drilling
Plant
construction
Other
activities
Operative
Risk analysis
procedures
(HazOp) and
definition
risk assessment
(ETA & simulation)
 8 R. Cigolini and T. Rossi
control. Detailed operative procedures (such as how to
execute maintenance in high sulphur concentration
environments) are defined to minimise the possible
harmful consequences for operators during the pro-
duction and/or the plant maintenance.
3.2. The transport stage
Within the transport stage, pipelines represent the
main transportation resources which directly involve
oil companies, given that the transport by tankers is
usually performed by third parties (responsible for the
damages such as loss of human lives, tankers founder-
ing and oil pouring). According to this perspective, the
risk management is divided into two areas: on the one
hand, risks resulting from processes, procedures and
physical components (other than piping but connected
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010
with it) of the transport system; on the other hand,
risks arising from pipeline breakdowns – this area is
devoted to quantify oil leaks and to identify actions to
minimise consequences.
With reference to the former area, risk analysis and
risk assessment are completely overlapped and they
consist of the following steps: (i) identification of the
so-called HazOp nodes (booster pumps, retaining
valves, etc.), which divide the transport system into
sub-systems to be analysed separately; (ii) execution of
HazOp analysis on each sub-system to figure out
criticalities, possible causes (hazards) and effects
(damages), recommendations (from the plant and/or
process viewpoint) to reduce or to eliminate the above
mentioned criticalities; then the risk value of each
criticality (and of the corresponding recommendations)
is given by the product between hazard frequency and
damage magnitude – both of them can be expressed by
means of indexes drawn by experts from a Likert scale
and (iii) costs-benefits evaluation of each recommen-
dation – before versus after evaluation costs and
damages related to the implementation of the recom-
mendation. Risk control consists of defining the
recommendations to be implemented according to the
priorities expressed by the criticalities risk values
(obtained after the HazOp analysis) and by the
outcomes of the costs-benefits analysis.
With reference to the area linked to pipeline
breakdowns, risk management is composed of risk
assessment and risk control only. In particular, in this
case, the risk management process is aimed at
estimating leaks due to oil-pipeline possible breaks,
defining activities to keep down environmental con-
sequences of such leaks and reducing the probability of
explosive atmospheres into the tanks. The leaks
estimation and the valuation of explosive atmospheres
into tanks depend on oil-pipeline elevation profile and
on safety and control equipments positioning; the
analyses are done through ad hoc simulation software
tools.
For the primary transport stage, the risk manage-
ment process has been faced with reference to the
production phase only, while both design and con-
struction are not taken into account. This is due to that
oil companies are used to establish a new drilling plant
for exploiting an oil-field, while seldom oil companies
start to exploit completely new fields and/or to build
new refining plants. For this reason, the management
of risks in designing and building oil-pipelines has been
overlooked.
3.3. The refining stage
A refinery is composed of several plants, areas and
equipments, so that an early identification of the most
relevant risk sources should be advisable. First of all,
practitioners figure out (for each refinery component)
the main risk factors: operative procedures and/or
plant physical parts, which often originate critical
situations, according to literature and field experience.
Then, the risk of each previously identified factor is
estimated, according to industry databases and acci-
dents that both occurred and were avoided over a
relevant time horizon (10 years). Finally, risk levels are
adjusted to take into account safety and control
equipments, and each plant, area and equipment of
the refinery is prioritised (according to the risk
management perspective) on the basis of the adjusted
risk levels of the factors it is characterised by.
With reference to the risk management process at
the refining stage, risk analysis consists of a HazOp
analysis which studies the behaviour of each plant,
area and equipment due to the risk factors it is
characterised by and under various process parameters
settings (temperature, pressure and flow). Such an
analysis allows both the causes or ‘primary events’
(typically concatenation of failures, operational errors,
process anomalies, leaks) and the effects of the risk
factors to be identified.
Risk assessment is composed of three sub-phases:
(i) estimate of the primary events frequency on the
basis of literature (Health and Safety Executive 1978,
Rijnmond Public Authority 1982, Lees 1996) and/or
industry databases (the Center for Chemical Process
Safety data base, among others); (ii) outline of the
consequences of each significant (characterised by a
rate greater than 106 times per year) primary event
and of the related frequency. ETA is used and only the
significant (characterised by a frequency higher than
 Production Planning & Control
108 times per year) damages are used as inputs of the
subsequent sub-phase and (iii) assessing the magnitude
of the previously identified significant damages –
ad hoc simulation tools are suggested to evaluate the
damages severity in terms of operational variables
(toxic substance concentration and heat density); by
combining the damages occurrence frequency and
magnitude, the highest priority risks are identified.
The remaining risks are faced in the risk control
step by means of both actions aimed at preventing the
damages occurrence (maintenance activities, control
equipments installation and operational procedures
definition) and technological and/or financial instru-
ments aimed at reducing the damages consequences
(safety equipments and insurances).
Similarly, as for the transport stage, also for the
refining stage the risk management process has been
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010
faced with reference to the production only, while
design and construction have been overlooked. This is
due to that oil companies seldom build new refining
plants, which does not make a priority the investiga-
tion of risks in designing and building refining plants.
Appendix 1 synthesises the suggested pattern to
perform the risk management process in the oil
supply chain.
Table 4. Compensated general risk indexes (G0 ) for the
vacuum plant units.
Unit G0 Corresponding risk level
Preheat exchanger 34.41 Low
Furnace 33.45 Low
Vacuum column 206.78 Medium
Table 5. HazOp analysis on the in parallel-flow heat exchangers and the feeding line of the preheat exchanger train under the
following conditions: 8/4 bar pressure; 170/250/290 C temperature; 3  105 kg/h flow rate.
Key word Causes
No/less Failure in closing the inflow
valve of the furnace
Failure in locking the inflow
valve of the furnace
More Failure in opening the inflow
valve of the furnace
Leaking Leaking through the flange of
the exchanger (primary
event #1, see Table 6)
9
4. Applications
The model proposed here has been applied to the
three stages of the Eni’s supply chain. In particular,
the application has dealt with one of the oil-fields
in Kazakhstan (at the production stage), the
Sannazzaro refinery (at the refining stage) and
the oil-pipeline connecting the Livorno refinery to the
Cadenzano depot (at the transport stage).
Unfortunately, intellectual property constraints have
prevented from providing in-depth details about the
production stage.
With reference to the refining stage, the model has
been applied to the vacuum plant which allows to
produce light, middle and heavy distillates. This plant
is composed of three units: the preheat exchanger train,
the furnace and the vacuum column. The first step of
the risk analysis requests to identify the risk factors of
each unit: according to the field experience of the
refinery staff, such factors are represented by hydro-
carbon fractions for the exchanger and for the furnace,
and gas oil for the column.
For the preliminary identification of the most
critical areas of the plant, the so-called compensated
general risk index (G0 ) has been used. Such index,
defined by the Italian law,1 takes into account both the
inherent risk of the substance and factors that can
either increase or decrease such risk (e.g. plant layout,
prevention and protection measures). In this way, G0
index allows the second and the third sub-phases of the
risk analysis to be fused. Table 4 reports the G0 s for the
three units of the vacuum plant, while Appendix 2
highlights the calculation algorithm.
According to Table 4, different vacuum plant units
are ranked to perform the primary events identification
(the last sub-phase of the risk analysis). Table 5
reports the HazOp referred to the part of the
Effects Protection measures
The pressure of the inflow line You should add a device to
leads to equals pump prevent the valve form the
shut-off complete closing
The pressure of the line You should add a controller
decreases that closes the auxiliary line,
thus allowing the flow to be
incremented as needed
The valve has to be closed to You should provide the valve
keep adequate pressure with a system preventing it
from complete opening
Outflow of hot substances; You should section the line and
maybe vapours cloud and take measures against fire
fire
 10 R. Cigolini and T. Rossi

Table 6. Primary events together with their frequencies and sources.

ID Primary event Frequency (times/year) Source

1 The exchanger leaks 2  104 Industry database

2 The heating coil of the furnace cracks 1  102 Industry database
3 The outflow line of the furnace overheats 2  109 FTA
4 Superheated hydrocarbon outflows at the end of 2  102 Industry database
the vacuum column
5 The vacuum column is over-pressured 4  109 FTA

Maximum pressure value exceeded

And

The column is over pressured Lock valve

016 broken Lock valve 020
down broken down
Or
λ = 2.1 x 10–4 λ = 2.1 x 10–4
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010

The XV-007 Incorrect locking of waste Incorrect locking of the manual

valve is locked gas line not detected valve on the gas outflow line
λ = 9.3 x 10–6 λ = 2.8 x 10–8
Or

Incorrect locking Warning failed

of waste gas line
λ = 3.4 x 10–7 And

Prevention device 163 ineffective Prevention device 164 ineffective

Or Or

Detector 163 Alarm out The operator does Detector 164 Alarm out The operator does
not properly not properly
out of order of order operate out of order of order operate
λ = 8.3 x 10–6 λ = 2 x 10–6 λ = 0.01 λ = 2.5 x 10–5 λ = 2 x 10–6 λ = 0.01
TT = 3.5 x 104 TT = 720 TT = 3.5 x 104 TT = 720

Figure 5. Fault tree for the primary event #5 (see Table 6) ‘the vacuum column is over-pressured’.

preheat exchanger train composed of the in
parallel-flow heat exchangers and the feeding line,
while the first column of Table 6 shows the results of
the HazOp for all the three units the vacuum plant is
composed of.
Now, the calculation of the primary events
frequency (the first step of the risk assessment
phase) can be performed through either literature or
industry databases or FTA. Table 6 reports the
primary events together with their frequencies and
sources, while Figure 5 highlights the fault tree
corresponding to the primary event #5 (Table 6). The
failure rates of the base faults () and the interval (in
hours) between two consecutive tests (test time, TT)
are drawn from the Performance Equipment
Reliability Database (PERD) of the Centre for
Chemical Process Safety.2
Now, the last two steps of the proposed risk
assessment methodology are to be applied to all the
primary events whose occurrence frequency is higher
than the threshold value (1  106 times per year), i.e.
#1, #2 and #4 (see also Table 6). For the sake of
simplicity, the remainder of the paragraph is focused
on the primary event #1 only.
As for the identification of the effects for
the considered primary event and the valuation of the
corresponding frequencies, the suggested tool is
the ETA. Figure 6 depicts the event tree concerning
the primary event #1 (Table 6). By multiplying the
conditional occurrence probabilities of the effects
 Production Planning & Control 11

Pool-fire oil and it is characterised by a 175 m3/h flow rate. For

Instantaneous Yes 5%
burning the sake of simplicity, the remainder is focused on the
No white pipeline only.
The 95% Yes 15% Flash-fire According to the proposed methodology, the risk
exchanger + pool-fire analysis is unnecessary, given that the only risky event
Delayed
Delayed
leaks
burning
burning No 85% is represented by oil leaking from the pipelines. As
Dispersion
suggested in Section 3.2, the risk assessment phase has
Figure 6. Event tree for the primary event #1 (see Table 6). been carried on by means of simulation techniques to
verify if and where along the pipeline the possible
petrol outflow could be greater than the maximum
Table 7. Effects frequencies for the primary event #1 admissible value for Eni (150 m3). By setting the proper
(Table 6). input data (pipeline lay-out and profile, pressure and
flow rate, positions of the valves, etc.) on the simula-
A. B. tion software package Pipeline SimulatorTM,4 the
Primary Occurrence outflows of petrol in the case of a break can be
event #1 probability AB calculated in each point of the pipeline.
frequency (according to Frequency
Effect (times/year) the ETA) (times/year) Figure 7 shows the simulation output. Notice that
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010

only in one point of the white pipeline, the petrol

Pool-fire 2.00  104 0.05 1.00  105 outflow exceeds the maximum threshold value. Such a
Flash-fire þ Pool-fire 0.95  0.15 2.85  105 point belongs to the final part of the white pipeline
where the course is descending and the simulation
software estimates 190 m3 petrol outflow in the case of
a pipeline break. As a consequence, in this point
Table 8. Effects magnitude.
prevention measures (e.g. periodical checks of the
Effect Threshold Wind: 5 m/s Wind: 2 m/s pipeline status and preventive maintenance actions) as
well as protection measures (such as the installation of
Pool-fire 12.5 kW/m2 7m 7m both equipments for detecting the outflow occurrence
7.0 kW/m2 8m 9m and motorised valves upstream the considered point)
5.0 kW/m2 10 m 10 m
3.0 kW/m2 11 m 12 m must be adopted, while neither prevention nor protec-
Flash-fire þ LFL 51 m 51 m tion measures are needed elsewhere along the white
Pool fire pipeline.
LFL/2 51 m 51 m

(calculated on the basis of the event tree) by the
frequency of the primary event, the frequency of each
effect is obtained, as shown in Table 7.
The latter step refers to the valuation of the effects
magnitude by means of simulation techniques. In
particular, by setting the proper input data (wind
speed, outflow rate, temperature, pressure, etc.) on the
simulation software package PHASTTM Professional,3
the severity of the effects of the considered primary
event can be calculated. These effects are expressed in
terms of the distance reached by the thermal radiation
and in terms of the concentration of the vapours cloud
at the Lower Flammability Level (LFL, see Table 8).
At the transport stage, the oil-pipeline connecting
the Livorno refinery to the Cadenzano depot is
composed of two pipelines: the former one (called
white pipeline) is devoted to transport petrol and it is
characterised by 220 m3/h flow rate, while the latter
one (called black pipeline) is devoted to transport gas
5. Concluding remarks
The study of risk management processes along the oil
supply chain highlights that nowadays risk analysis,
risk assessment and risk control at the drilling, primary
transport and refining stage do not show significant
differences in terms of neither approaches, nor
techniques and tools. However, the different stages
are affected by various operational risks, basically
according to the differences in plants and, as a
consequence, each plant should be provided with a
specifically conceived risk management process.
For the drilling stage, the model proposed here
suggests three sub-methods, one for each period of the
drilling plant life cycle (design, construction and
production). Different patterns of risk management
sub-methods are proposed to take into account the
type of the drilling plant to be designed, who designs
the plant and the operative activities performed within
the plant.
 12 R. Cigolini and T. Rossi

200

Petrol outflow in m3
150

100

50

0
0 10 20 30 40 50 60 70 80 90
Point of the pipeline (distance from the origin, in km)

Figure 7. Outflow level along the white pipeline.

For the primary transport stage, two different risk plants and oil-pipelines the activities which refer to the
management processes are proposed. The former one risks connected to the end of their life cycle, that is
allows the risks resulting from processes, procedures referred to the drilling plant tapping out, the refining
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010

and physical components (other than oil-pipelines) to plant shut down and the oil-pipeline dismantling.
be identified, assessed and controlled, whereas the
latter one allows risks arising from the pipeline
breakdowns to be faced. Acknowledgements
Finally, for the refining stage, a preliminary phase The authors wish to acknowledge Dr E. Pizzurno of Eni
is recommended to identify the priority according to Corporate University for his contribution and Fondazione
which each plant, area and equipment of the refinery Cariplo for the financial support. The authors also express
their gratitude to the anonymous referees and to the Editor
has to be submitted to the risk management process,
of Production Planning & Control for their suggestions.
and several techniques and tools (HazOp, historical
data analysis, ETA and simulation) are suggested.
The effectiveness of the methodology presented Notes
here has been tested by directly applying it in field. In 1. DPCM 31.3.89, i.e. Prime Minister Decree dated 31
particular, three case studies involving, respectively, March 1989
one of the Eni oil-fields in Kazakhstan (not reported 2. See: http://www.aiche.org/ccps
3. See Det Norske Veritas (DNV) and the related website:
here in depth for intellectual-property-related con- http://www.dnv.com/services/software
straints), the Eni Sannazzaro refinery and the Eni 4. See Pipeline Systems Incorporated (PSI) and the website:
oil-pipeline connecting the Livorno refinery to the http://www.pipesys.com/app_simulator.html
Cadenzano depot have been carried on. This applica-
tion has proved the model’s usefulness in field to
support the risk management process at different levels Notes on contributors
of the oil supply chain. Roberto Cigolini is Professor of
In particular, the main strength connected to more ‘Quality Facility Management’ and
of ‘Operations Management’ at the
effective (able to take into account the specificities of School of Management of Politecnico
each stage) risk analysis and assessment phases lies in di Milano. His main interests are
the possibility to pinpoint the actual high-priority primarily related to business planning
risks. This is crucial for the subsequent risk control and control, supply chain manage-
phase, in which it allows to focus the control effort ment, facility management contracts
negotiation and real estate manage-
only on the most prominent risks. ment. He graduated cum laude in
Finally, future research steps will deal with: (i) Management Engineering at Politecnico di Milano in 1994.
investigating the risk management process performed From 1999 to 2002 he has been co-Director of the MBA
by outsourcers in the drilling plants design phase as program at the MIP – Politecnico di Milano Business
well as by third parties with reference to the transport School and now he is co-Director of the Facility, Property
& Asset Management Master Course. He is also founding
by tankers; (ii) including into the risk management member (2001) of the Technical Committee on
process of the transport and refining stages also the Semiconductor Factory Automation (IEEE Robotics and
unusual design and construction phases; and (iii) Automation Society) and member of the McKinsey executive
highlighting in the design of drilling and refining panel.
 Production Planning & Control
Tommaso Rossi graduated
Management Engineering
Politecnico di Milano in 2000. Since
2001 to 2004 he attended the PhD
course in Industrial Engineering at the
Politecnico di Milano, spending his
abroad period at the MIT (Boston,
MA). Since 2002 he is Researcher
at the Institute of Technology of
Università Cattaneo – LIUC (Castellanza, Italy), where he
holds the courses of Operations Management and Supply
Chain Management. He is member of the National
Association for Industrial Plants and the National
Association for Quality. His research interests concern
production planning, network design, simulation, hybrid
production systems and risk assessment.
References
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010
13
in Khan, F., Sadiq, R., and Husain, T., 2002. Risk-based
at
process safety assessment and control measures design for
off-shore process facilities. Journal of Hazardous
Materials, 94 (1), 1–36.
Lees, F.P., 1996. Loss prevention in process industries. Hazard
identification, assessment and control. Heinemann, Oxford:
Butterworth.
Molak, V., 1997. Fundamentals of risk analysis and risk
management. Boca Raton, FL: Lewis Publishers.
Nguyen, J.P., 1996. Drilling: oil and gas field development
techniques. Paris, France: Editions Technip.
Nguyen, J.P., et al., 2005. Variety and the evolution of the
refinery processing. Industrial and Corporate Change, 14
(3), 469–500.
Novelli, L., 2004. Oil and natural gas: exploration and
production. Rome, Italy: Eni internal publication (in
Italian).
Omole, O., Borisade, T.A., and Muhammad, A., 2004. Risk
impact on the economic performance of oil and gas

projects in Nigeria. OPEC Review, 24 (4), 247–274.

Blackhurst, J., et al., 2005. An empirically derived agenda of
critical research issues for managing supply-chain disrup-
tions. International Journal of Production Research, 43
(19), 4067–4081.
Brandsaeter, A., 2002. Risk assessment in off-shore industry.
Safety Science, 40 (1), 231–269.
Castellano, A. and Cigolini, R., 2002. Using modularization
to manage construction projects of onshore process plants:
a theoretical approach and a case study. Project
Management Journal, 33 (2), 29–40.
Chapman, P., et al., 2002. Identifying and managing supply
chain vulnerability. Logistics and Transport Focus, 4 (4),
59–64.
Cigolini, R., Cozzi, M., and Perona, M., 2004. A new
framework for supply chain strategies: conceptual models
and empirical test. International Journal of Operations and
Production Management, 24 (1), 7–41.
Cigolini, R. and Rossi, T., 2006. A note on supply risk and
inventory outsourcing. Production Planning and Control,
17 (4), 424–437.
Cigolini, R. and Rossi, T., 2007. Evaluating supply chain
integration: a case study using fuzzy logic. Production
Planning and Control, 19 (3), 242–255.
Clifton, A. and Ericson, I.I., 2005. Hazard analysis techniques
for system safety. New York: Wiley.
Crawley, F., Preston, M., and Tyler, B., 2000. HAZOP:
guide to best practice: guidelines to best practice for the
process and chemical industries, Railway Terrace. Rugby,
UK: IChemE.
Culp, C.L., 2001. The risk management process: business
strategy and tactics. New York: Wiley.
Dey, P.K., Ogunlana, S.O., and Naksuksakul, S., 2004. Risk-
based maintenance model for off-shore oil and gas
pipelines: a case study. Journal of Quality in Maintenance
Engineering, 10 (3), 169–183.
Health and Safety Executive, 1978. Canvey: an investigation
of the potential hazards from operations in the Canvey
Island – Thurrock area. London: HMSO.
Peck, H., 2004. Interesting times. Freight Transport Review,
Spring (2), 1–3.
Pizzurno, E. and Rossi, T., 2007. Introduction to the
operational risks in the oil supply chain. Working Paper
No. 5. Eni Corporate University, Rome, Italy (in Italian).
Proth, J.M., 2007. Supply chains: measure, evaluation and
specific risks. International Journal of Business
Performance Management, 9 (2), 127–144.
Radjou, N., 2002. Adapting to supply network change.
March 2002 Forrester Research Technology Strategy
Report, Forrester Research, Cambridge, MA.
Rice, J. and Caniato, F., 2003. Building a secure and resilient
supply chain. Supply Chain Management Review, 7 (5),
22–30.
Riddalls, C. and Bennett, S., 2002. Production – inventory
system controller design and supply chain dynamics.
International Journal of Systems Science, 33 (3), 181–196.
Rijnmond Public Authority, 1982. Risk analysis of six
potentially hazardous industrial objects in the Rijnmond
area; a pilot study. Dordrecht, The Netherlands: Kluwer,
Reidel.
Ross, J.G., 2004. Risk and uncertainty in portfolio char-
acterization. Journal of Petroleum Science and Engineering,
44 (1–2), 41–53.
Tapiero C.S., 2004. Risk measurement and supply chains. In:
International Workshop on Performance and Risk
Measurement, Milan, Italy, 113–129.
Tapiero, C.S. and Grando, A., 2006. Supply risk and
inventory outsourcing. Production Planning and Control,
17 (5), 534–539.
Vesely, W.E., et al., 1981. Fault tree handbook. Washington,
DC: US Nuclear Regulatory Commission.
Westbrook, R., 1995. Action research: a new paradigm for
research in production and operations management.
International Journal of Operations & Production
Management, 15 (12), 6–20.
Yin, R.K., 2003. Case study research: designs and methods.
Thousand Oaks, CA: Sage.
 Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010

14

Appendix 1
Table A1. Taxonomy of techniques and tools to manage risk along the oil supply chain.

Risk analysis Risk assessment Risk control

Sub-phases Tools Sub-phases Tools Sub-phases Tools

Drilling Design Standard project Standard project Standard project

– –
Non standard project
Risky events identifica-
tion (before the
design)
Risky events identifica-
tion (after the design)
Construction Design made by the oil
company
Plant design according to Data base of
standards (best practices) similar
projects
Non standard project Non standard project
Hazard checklist Damages severity and Experts’ Plant design for reducing
frequency valuation judgements the damages severity
(before the design) and/or frequency
HazOp analysis Damages severity and ETA and Plant re-design for reducing
frequency valuation simulation the damages severity
(after the design) techniques and/or frequency
Design made by the oil Design made by the oil
company company
R. Cigolini and T. Rossi

– – Plant construction Constructive

according to the standards
standards (best practices)
Design made by an Design made by an Design made by an
outsourcer outsourcer outsourcer
Risky events HazOp analysis Damages severity and ETA and simula- Damages severity and/or Control and/or
identification frequency valuation tion frequency reduction by safety
techniques means of the installation equipments
prevention and/or
protection equipments
Production Drilling activities Drilling activities Drilling activities
Risky events Experts’ Damage (blow-out) severity ETA and Actions for reducing the Substitution of
identification judgements and frequency valuation simulation blow-out occurrence components,
probability as well as the maintenance,
blow-out consequences safety
equipments,
insurances
Other activities Other activities Other activities
– – Definition of detailed
operative procedures
 Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010

Transport Processes, procedures Processes, procedures and Processes, procedures and

and physical compo- physical components physical components
nents (other than (other than pipelines) (other than pipelines)
pipelines)
HazOp nodes Experts’ Damages identification, HazOp analysis Recommendation Outcomes of the
identification judgements valuation of their mag- and experts’ implementation HazOp and
nitude and frequency judgements cost/ benefit
and recommendation analysis
definition
Risky events HazOp analysis Damages and correspond- Cost/ benefit
identification ing risky events analysis
prioritisation
Oil-pipeline Oil-pipeline Oil-pipeline
– Leaks and explosive atmo- Simulation Installation of physical Control and
sphere in tanks valuation components for reducing safety
leaks equipments
Refining Risk factors Literature & field Primary events frequency Literature, Actions for preventing Maintenance,
identification for experience valuation industry data damages control
each refinery area bases and equipments
FTA
Valuation of the risk Literature & his- Identification of the ETA Technological and financial Safety
level of each factor torical data primary events instruments for reducing equipments,
consequences and their damages magnitude insurances
frequency valuation
Risk level adjustment Adjusted risk Consequences magnitude Simulation
due to the presence of levels valuation
control and safety
equipments
Refinery areas
prioritisation
Primary events HazOp analysis
Production Planning & Control

identification
15
 16 R. Cigolini and T. Rossi

Appendix 2. Calculation algorithm of the into account the conditions of pressure, tempera-
compensated general risk index (G0 ) ture, etc. at which the process takes place;
. Q is the quantity risk index. It is given by literature
The compensated general risk index G0 is calculated and it is a function of the quantity of substance
according to Equation (1): treated during the process;
G 0 ¼ G  k1  k2  k3  k4  k5  k6 , ð1Þ . L is the lay-out risk index. It is obtained by
summing up the plant’s height (h), the plant’s
where G is the general risk index and k1. . .6 are coefficients surface (N) and five other sub-indexes, which refer
(whose values range from 0 to 1) that allow to take into to other characteristics of the area where the
account prevention and protection measures, e.g. to retain process takes place (e.g. the presence of tunnels
substances, to control the process, to train operators, to and/or catch basins under the plant); the values to
isolate the substances in case of outflow occurs, etc.; the more the five sub-indexes are assigned from pre-defined
intense the actions, the closer to 0 k1. . .6 are. scales and on the basis of how the area performs
The general risk index G is given by Equation (2), where with reference to the corresponding characteristics;
A, C, D and F are indexes . s is the health risk index. It ranges from 0 to 100. In
pffiffiffiffiffiffiffiffiffiffi the case of accident, if operators can lose their lives,
G ¼ D  ð1 þ 0:2  C  A  FÞ ð2Þ
s ¼ 100; otherwise, if the accident cannot have any
D index is the Dow equivalent index and it is calculated consequence for the operators’ health, s ¼ 0.
according to Equation (3)
C index is the explosion in a bordered environment index and
     
M P SþQþLþs it is given by Equation (4)
D¼B 1þ  1þ  1þ
Downloaded By: [roberto.cigolini@polimi.it] At: 16:53 11 March 2010

ð3Þ
100 100 100 mþpþs
C¼1þ ð4Þ
where 100
. B is the substance factor, that is a measure of the where
potential energy that can be released when an . m is the sub-index of M that expresses the mixing
outflow of the considered substance occurs; and dispersion characteristics of the substance; its
. M is the substance specific risk index. It is value ranges from 60 to þ100;
composed of 10 sub-indexes that refer to 10 . p is the sub-index of S that expresses whether the
substance characteristics (e.g. oxidising or non- process takes place at a high pressure or not. Its
oxidising substance). Each sub-index is assigned a value ranges from 0 to 160.
value drawn from a pre-defined scale on the basis of
how the substance performs with reference to the A index is the explosion in an open environment index and it
corresponding characteristic; is calculated according to Equation (5)
. P is the process general risk index and it is  
composed of six sub-indexes that refer to how the M Q  h  C t þ 273
A¼B 1þ  ð1 þ pÞ   ð5Þ
substance is manipulated and behaves along the 100 1000 300
process. Each sub-index is assigned a value drawn
from a certain range. Such a value is determined on where t is the temperature at which the process takes place.
the basis of qualitative judgements about the Finally, F is the fire index and it is given by Equation (6)
procedures according to which the substance is
manipulated or on the behaviour of the substance K
F ¼B ð6Þ
during the production process; N
. S is the process specific risk index and it is
composed of 14 sub-indexes that allow to take where K is the quantity (in tons) of the processed substance.