Link to .pdf
Link to Seveso Inspection Series Home Page

CIC - Natech Risk Management

Definition and scope - Characteristics of Natech events - The role of inspections - Natech Information in safety reports - Natech Emergency Plans - The components of Natech Risk Information - Measures for Managing Natech Risk - Further questions and guidance for inspectors

This publication of Common Inspection Criteria is intended to share knowledge about technical and organisational measures and enforcement practices related to major hazard control and implementation of the Seveso Directive. The criteria were developed by Seveso inspectors to aid the dissemination of good enforcement and risk management practices for the control of major industrial hazards in Europe and elsewhere. This particular topic highlights the issues that are critical for Natech risk management. Note that this document is not intended as a technical standard nor as a summary or replacement of any existing standards on the matter.    

DEFINITION AND SCOPE

Natural hazards, such as earthquakes, floods, storms, extreme temperatures etc., can trigger major accidents involving fires, explosions and toxic releases at establishments that process, store or transport dangerous substances. These technological “side effects” of natural-hazard impacts are called “Natech” accidents or simply “Natechs” (from “natural-hazard triggered technological accident”).  Impacts on industrial operations and infrastructure are a recurring but often overlooked feature in many natural-disaster situations [1]. However, with the expected escalation in the intensity and frequency of natural events from climate change,  Natech risk is increasingly a focus of concern in disaster prevention and risk management at local, national and international level.

Prevention of the release of dangerous substances from chemical hazard sites as a result of a natural-hazard event has been recognised as a critical objective in Natech risk management.  For this reason, in 2012, modifications to the EU Seveso Directive explicitly introduced Natech risk as an important component of a hazardous site’s overall risk management strategy for upper tier sites in the safety report (Annex II of the Directive). As a consequence, the major-accident prevention policy (MAPP), the internal emergency plan, the information provided to the competent authorities for the definition of the external emergency plans, and the safety management system (SMS) should also consider this information.   The common inspection criteria presented here are intended to serve as a reference for inspectors of Seveso sites on  how to review these elements to ascertain the effectiveness  of the site’s Natech risk management approach. 

Figure 1. Oil slick formed after flood damage to storage tanks in
Coffeyville, USA, 2007 (Photo credit: Kansas Civil Air Patrol)

CHARACTERISTICS OF NATECH EVENTS

The characteristics of Natech events differ from those of conventional technological accidents and there are currently no well-established methodologies for the assessment of Natech risk. Natural hazards can cause multiple and simultaneous releases over extended areas, possibly overwhelming on- and off-site response capacities. Moreover, the safety measures in place to prevent conventional major accidents or mitigate their consequences are often ineffective or insufficient against Natechs as they are usually not designed to withstand a natural event [2]. For example, in case of hazardous-materials releases triggered by floods (Figure 1), flooded catchment bunds are typically unable to contain a release, allowing the unconstrained spreading of hazardous liquids in a larger area [3].

Utilities are also often disrupted during a natural event (e.g. power needed for process control or for safe shut down, water for fire-fighting or cooling). In such situations, domino events are more frequent than in conventional accident situations [3]. In addition, standard civil protection measures commonly used during conventional technological accidents with substance releases, like shelter in place or evacuation, may not be functional or appropriate during a Natech accident due to the damage caused by the natural event [4].

THE ROLE OF INSPECTIONS

The role of inspections is to verify that the operator is aware that the risk of a major accident could be increased by natural hazards at the location of the establishment and that measures have been taken to reduce the Natech risk. More specifically, the inspector should check that: 

• an analysis of possible natural hazards at the location and in the surroundings of the establishment has been carried out and its results are included in the safety report
• risks arising from major accidents caused by natural hazards are properly assessed in the safety report
• safety reports demonstrate that the operator has implemented adequate measures to prevent Natech scenarios and to mitigate their consequences
• information on Natech accident risk is accounted for in the MAPP and SMS, and measures are taken to reduce the Natech risk
• information on Natech accident risk is included in the preparation of the emergency plans
• the operator has informed the public of the Natech risk according to legal requirements
• the Natech information in the relevant documents is representative of the situation at the establishment

NATECH INFORMATION IN SAFETY REPORTS

In order to demonstrate that the Natech risk has been addressed properly, the following information should be included in the safety report [5, 6].

• Safety reports should include information on the natural hazards that could affect the location of an establishment, for example extreme temperatures, high winds, floods, tsunamis, landslides, extreme precipitation, storms, lightning, earthquakes, wildfires
• Safety reports should demonstrate that the operator has identified and adequately described major-accident scenarios triggered by the identified natural hazards
• Safety reports should include information on the Natech risk analysis’s assumptions, limitations and uncertainties. The effects of climate change on worsening future natural hazards should be considered.
• Safety reports should include information on the safety measures implemented to prevent or mitigate major accidents triggered by natural hazards. The safety measures should be able to survive the impact of the natural hazard(s) that could trigger the Natech accident they are intended to mitigate
• The design specifications of utilities and safety equipment affected by any potential natural hazard should be clearly stated in the safety report, as well as the conditions under which they fail (e.g. limit states, critical flood with water depths).
• Land use and/or topographic maps presented in the safety report should include the risks of major accidents triggered by natural hazards
• Safety reports of existing establishments should be revised when new information about potential natural hazards that could trigger a major chemical accident becomes available (e.g., due to climate change or updates in natural-hazard modelling).

NATECH EMERGENCY PLANS

The risk of major accidents triggered by natural hazards should be taken into consideration in emergency planning. Accident prevention and mitigation measures should be effective even during natural-hazard conditions, e.g., during earthquakes, floods, heavy precipitation, high winds or extreme temperatures. Measures that are not effective under such conditions should be considered ineffective also in the emergency plans for major Natech accidents.

In particular, stand-alone utilities, such as back-up power generators and water reservoirs, should be available even after the impact of a natural hazard has occurred. If this is not possible, emergency plans should clearly state which utilities can be guaranteed to remain available and which may be unavailable for the response in the event a natural hazard strikes. Emergency plans should discuss possible response strategies to adopt when the main utilities are unavailable.

THE COMPONENTS OF NATECH RISK INFORMATION

Assessment of natural hazards in the area of the establishment

It is important that the operator has identified the types of natural hazard that have the potential to trigger an accident. For each, the operator should describe at least one natural-hazard scenario (see Annex 1). Whenever available, the operators should use location-specific data for the description of the intensity parameters of the natural hazards. This allows the identification of the exposed facilities in the establishment and the effects of the natural hazard on the establishment’s surroundings. Some natural hazard scenarios may be a “common cause” phenomenon, that is, the event does not affect just one part of the site, but several facilities at once (or even all of them), although some parts may be more vulnerable. The operator may use different criteria for the identification of the natural-hazard scenarios (most likely, worst case, etc.), provided that this choice can be reasonably justified. For each scenario, the natural hazard description should adhere to the following principles:

• The type and main characteristics of the natural hazard should be indicated.
• The person, or agency, carrying out the assessment of the natural hazards at the industrial site should have the appropriate expert knowledge and competence.
• The source documentation should be readily available.
• The natural-hazard description should be based on reliable and trusted sources. The preferred sources of information are generally government authorities, for example civil protection, at the national or local level.
• A list of the facilities exposed to the natural hazard should be indicated.
• Natural-hazard scenarios should be detailed and complete and should be described according to best practices.
• The level of detail of the natural-hazard information should be adequate for the analysis of risks of major accidents.
• The information should be useful to assess the potential damage to industrial equipment and/or utility disruption (i.e., potential accident initiators).
• The information should include past natural-hazard events that occurred at the site.
• The natural hazard information should be recent (up to date).
• It should take into consideration the increasing frequency and intensity of some natural hazards due to climate change.

See also Annex 2 for further information on natural hazard assessment in design.

Identification of equipment damage and vulnerability

For every facility exposed to a natural hazard, the operator should assess the possibility that parts of the installation suffer damage. The operator should focus on equipment and technical systems whose sudden failure may result in accidents or hazardous situations. In particular, storage tanks have proven to be vulnerable to different natural hazards. For every natural hazard, it is important that the operator identify the main damage modes of each item belonging to an exposed facility. Damage modes that could lead to hazardous situations or loss of containment (LOC) should be considered (e.g. storage tank rupture with leakage). LOCs are commonly considered as “critical events” and the beginning of the actual Natech accidents. It is also important to identify the operative conditions under which natural-hazard damage is more likely to occur. For example, storage tanks with a high filling level are more likely to fail in earthquakes due to liquid sloshing [7], while tanks with lower filling level are more likely to fail in flood events due to buoyancy [8]. See also Annex 3 for additional information on typical damage modes.

Identification of contributing factors

Another effect that characterises Natech accidents is natural-hazard induced disruption to control systems, instrumentation, utilities, safety systems, and other equipment [3, 5]. Natech accidents often occur when components of safety systems (e.g. leak/fire detection, fire suppression, automatic shutdown) are disrupted or when the main utilities (e.g. electric power supply, compressed air, steam, cooling water) are unavailable. As a result, accidents receive no mitigation and hazardous situations can easily turn into an accident. The possibility of damage or disruption to utilities, safety equipment, instrumentation and auxiliary systems should also be assessed. Typical disruption to these is:

• Loss of electric power
• Short circuit
• Alarm failure
• Instrument failure
• Pump/compressor failure

Identification and description of Natech accident scenarios

The identification of Natech hazards serves the purpose of finding and analysing the potential sources of adverse effects involving the release of hazardous materials following the impact of natural hazards [11]. The potential hazard sources in the establishments could be ranked on the basis of three factors:

1. The type of hazard (toxic, fire, explosion) and amount of substance (or mixture) in a unit;
2. The physical state of the substance;
3. The structural vulnerability of the unit with respect to the natural event that determines damage and release modes.

While in principle (using these three factors) operators could describe Natech scenarios in the same way as “conventional” accident scenarios, Natech-specific conditions should be considered (if applicable) for accident scenario modelling. These may affect both the Natech critical events (hazardous-materials releases) and the Natech scenarios in different ways. Examples of Natech-specific conditions are:

• Exceptional environmental/meteorological conditions (e.g. strong winds, floods)
• Loss of safety barriers (e.g. damaged firefighting equipment, alarms and detectors, flooded containment dikes)
• Loss of utilities (e.g. power, water supply, communication lines)
• Damage to buildings and infrastructure (e.g. houses, roads, power grids)
• Multiple and simultaneous accidents due to natural-hazard impact

Natech-specific conditions could affect the hazardous-materials release size, provide a new medium for the substances to reach the risk receptors (e.g. via floodwater dispersion), be an ignition source (e.g. lightning), or increase the risk receptors’ vulnerability (e.g. by preventing shelter in place or evacuation).

It should be noted that some conditions can aggravate the accident’s consequences (e.g. loss of secondary containment) while others may have mitigating effects (e.g. strong winds can help to disperse flammable clouds). Given the high degree of uncertainty, the use of the worst-case assumption among the possible modelling choices is recommended. After careful consideration, if no specific conditions can affect a Natech scenario, it may be assessed like any other “conventional” accident scenario.

Annex 4 provides additional information for those countries that require an assessment of accident scenario likelihood.

Figure 2. The bracing system of this LPG tank was reinforced after the 2011 Great East Japan earthquake
and tsunami (Photo credit: E. Krausmann)

MEASURES FOR MANAGING NATECH RISK

Seveso establishments should implement technical and operational measures to prevent Natech accidents and to mitigate their consequences. This section discusses the resources and procedures necessary for operators to manage Natech risk at Seveso establishments.

Improving the resistance of equipment and structures

Risk can be reduced by protecting the establishments from natural-hazard damage. Process and storage units, as well as safety equipment and critical instrumentation should be designed to withstand natural-hazard impacts. Existing equipment units that may be damaged by natural hazards, causing a significant Natech risk, should be retrofitted (example in Figure 2) to improve their ability to survive natural-hazard impacts (e.g. installation of flexible connections, anchoring of equipment, elevated supports, waterproof shelter for electrical equipment [14]). 

Alternatively, the site itself could be configured to mitigate specific natural hazards in areas with critical facilities (e.g. building of levees, erection of elevated dry areas, soil compaction, and installation of lightning protection systems). Operators of existing establishments may consider relocating individual processes and the storage of hazardous substances to areas less exposed to natural hazards.

Preparing for natural-hazard impact

In addition to Natech emergency procedures for y (see “Natech emergency plans” section) operators should identify specific procedures to prevent Natech accidents or to mitigate their consequences in response to natural-hazard impacts and early warnings. These procedures should be put into action before any Natech accidents occur. In particular, the procedures should clarify:

• the roles and responsibilities within the establishment’s staff;
• the actions to be performed when a natural hazard hits;
• how much time each action takes;
• the exact conditions that initiate the procedure.

Every procedure should include actions meant to prevent Natech accidents or to mitigate their consequences. Several types of actions have been proven effective in preventing Natech accidents or mitigating their consequences in case of natural-hazard impact, for example:

• Natural hazard monitoring: The operator follows the evolution of natural hazards
• Emergency shut-down: The operator identifies the conditions under which emergency shut-down should be performed
• Ride-out crew: Removing all unnecessary site personnel helps to reduce the potential impact of Natech events. The operator should identify a ride-out crew to secure the facility and to activate all emergency procedures
• Securing floating objects: Accidents can be caused by objects floating on floodwaters and impacting critical facilities. This can be prevented by securing floating objects, or by removing them from the site in case of a flood;
• Securing equipment: Light equipment are vulnerable to the uplift force exerted by floods. They should be secured with anchors. Empty tanks can be filled with water to increase their resistance to flood
• Communication with the authorities: Authorities should be warned when a natural event is occurring and the operator suspects that Natech accidents could occur
• Training: ensure that employees are aware of the natural hazard(s) at the site and that they are properly trained in the procedures to cope with their impacts

Improving the preparedness to Natech events

It is common that emergency services called to respond to a Natech accident may not be available as they are busy combatting the consequences of the natural disaster that caused the accident. Preparedness should therefore consider the unavailability of personnel on site (e.g. due to the natural disaster, panic and flight behaviour), which could result in a failure to take protective actions [5]. Seveso establishments in natural-hazard zones should have back-up utilities, safety systems, and emergency resources that could operate until offsite emergency services become available. The operator should evaluate the timing of natural hazards and compare it against the timing of the emergency procedures in place at the site, with the view to address any potential gaps between when an emergency measure is needed and when it might be available.

In addition, natural hazards can hamper access to the facilities in many ways. The establishments’ access could be obstructed by debris, the roads destroyed or submerged. In this case, the operators should consider purchasing specific emergency equipment (e.g. boats, lifejackets) to better respond to major accidents (both Natech and not Natech) during exceptional conditions (e.g. storms, earthquakes, floods). The type of equipment should be chosen carefully to ensure responders’ effectiveness and safety taking into account the actual on-site natural hazards (e.g. life jackets and boats in case of floods or tsunamis; tractors and machinery for debris removal in case of earthquakes or windstorms). 

Actions following natural-hazard impact

Even if a Natech accident does not occur immediately after the natural-hazard impact, facilities should restore normal operations safely. The start-up of major industrial processes is a hazardous phase in itself, even more so after the impact of a natural hazard. It is conceivable that some damage caused by the event may not be immediately noticeable, or that conditions are not safe for a restart (e.g. equipment soaked in water). It is therefore extremely important that procedures for start-up include actions that take into account possible prior natural-hazard damage, such as [15], in particular:

• checking for damaged equipment, tanks, and instrumentation before starting-up
• wait until all essential personnel who suffered injuries have recovered or have been replaced

As with other procedures, post-natural-hazard start-up procedures should be kept up-to-date.

Annex 1. Natural hazard assessment: deterministic or probabilistic

The natural hazard description can be either probabilistic or deterministic. In the deterministic approach, experts identify a reference natural-hazard scenario that is described through its intensity (e.g. peak ground acceleration, flood depth). In the probabilistic approach, the hazard description includes an estimate of its frequency (likelihood) based on historical records.  The hazard can (1) be described as a discrete event that either occurs or that does not occur (e.g. levee rupture) with a given probability; (2) can be associated with a variable (the intensity) that has a range of values (e.g. wind speed). In the latter case, what is needed is an estimate of the probability that a given value will be equaled or exceeded.

 

Annex 2. Structures designed to withstand natural hazards

Some facilities could be designed to withstand natural hazards, in compliance with existing codes or standards. In these cases, the operators may be tempted to claim that nothing can happen since the facility was designed to resist natural hazards. This approach can be misleading, since the reference design intensity may be exceeded in case of extreme natural events. The design procedures of industrial structures are based on the identification of “limit states”, which are values of the natural hazard intensity parameter that the structure is able to withstand without experiencing damage. However, the structures cannot resist all possible natural hazards, because some of them inevitably occur with an intensity exceeding that of the limit states. Even where not explicitly stated in the documentation, the selection of limit states is, in fact, based on the occurrence frequency (or return period) of the natural hazard. For this reason, the design procedure can only achieve a reduction of the risk for the structure, but it cannot erase the risk completely. This also means that some residual risk is always present for any structure, even when the structure has been designed to resist natural hazards. However, the extent of this residual risk is typically not considered when the major-accident risk is assessed. The structural risk is neglected, because of the low occurrence frequency of the limit state. But what may appear to be a negligible rupture frequency for the structural engineer can, in fact, be a significant frequency for critical events (top events). In this case, it is important that the operator records the natural-hazard information used during the design phase, for it to be available later for risk assessment. Natural-hazard scenarios with frequencies lower than that of the limit state should also be considered in the assessment of Natech accidents. Only after Natech scenarios have been analysed and evaluated should those natural-hazard scenarios be discarded if still considered negligible, not before. When using a deterministic approach, the experts should choose the highest available natural-hazard intensity as the worst-case natural-hazard scenario, even if it is higher than the design intensity.

 

Annex 3. Typical damage modes of pipes and equipment

Buckling damage: deformation of metal enclosures is typical for many types of natural hazards when a sudden load affects the structure. Buckling alone does not typically cause loss of containment. However, it may cause structural instability and may be accompanied by other damage types, such as the rupture of pipes and connections, tearing of metal plates or detachment of the shell-to-bottom connection. Buckling damage is often observed in the lower part of atmospheric storage tanks following strong earthquakes, and is called “elephant foot” buckling [7]. Rupture of pipes, flanges, and connections: pipes, flanges, and fittings are vulnerable to a number of natural phenomena. Damage to piping typically results in loss of containment. Earthquakes and floods have been responsible for deformation and rupture of pipes by displacement of units connected to them [7]. Lightning strikes have punctured pipes both on the ground and underground. Strong winds have caused tall objects (like stacks or chimneys) to fall onto pipes and pipe racks, severing them [9]. Low temperatures have caused several accidents due to solidification (freezing) of content inside the pipes, thereby choking the flow. Tearing of metal enclosures: when the deformation is sufficiently large, the metal sheets that compose the shell of a vessel may fall apart and cause LOC. This phenomenon is more frequent for equipment whose plate shells have been riveted or bolted together [7]. Detachment of the shell’s wall to bottom connection: the shell walls and bottom can be composed of two separate metal sheets. When buckling affects the bottom of a vessel, the annular connection between the wall and the bottom is heavily stressed. Tearing of the vessel at this location can cause loss of containment of hazardous materials. It is often associated with the “elephant foot” buckling of atmospheric storage tanks in earthquakes [7]. Support leg failure: many units have support legs to sustain their weight. Those legs are typically designed to sustain the equipment’s own weight and some horizontal excitation. In the case of earthquakes, lateral loads can exceed the design specification of support legs and cause their failure, resulting in the entire equipment to collapse on the ground below [7]. This damage mode can cause a loss of containment. Rupture of tank roof: when the storage tank has a fixed roof, this can be vulnerable to the impact of a natural hazard, being the part of the equipment with the lowest weight and thickness. Strong winds can cause the roof to buckle [8] without loss of containment. Liquid sloshing caused by seismic events may cause the roof to buckle and portions of the liquid to spill outside the tank through vents and through newly created tears on the roof [7]. Floating roof failure: some of the largest atmospheric storage tanks, designed to hold enormous amounts of liquid product do not have a fixed roof, but a metal deck that floats on the liquid surface. When the roof sustains damage, it may sink into the liquid below. When this happens, the liquid surface is exposed to the air and the product starts evaporating with the release of vapours into the atmosphere [9]. In addition, the rainwater drains installed on the roof (now submerged) may allow the release of the liquid through the drain and outside the tank. The main causes of floating roof damage are water accumulation due to heavy precipitation and liquid sloshing due to earthquakes. When the liquid substance is flammable, natural hazards may ignite the material at the rim seal between the roof and the shell wall. This type of fire may escalate to full surface tank fire. Lightning strikes and earthquakes have been responsible for a number of floating roof fires [9, 10]. Displacement and overturning: a natural hazard can exert strong loads on equipment, creating translation and rotation phenomena. When this happens, units can be pushed one against the other or topple over [5]. This damage type can cause collision damage and ruptures in the attached pipe network, both of which can result in loss of containment. Displaced and toppled storage tanks have been observed in earthquakes due to strong lateral acceleration [7]. In floods and tsunamis, the uplifting buoyancy force, wave slamming, and water drag have produced this type of damage [9]. Puncturing damage: sharp objects pushed against the equipment may produce buckling and holes in the shell with a potential for loss of containment [9].  Both heavy low-speed objects carried by floods or tsunamis and lighter high-speed objects projected by strong winds can produce puncturing damage. Puncturing damage can affect both equipment and pipes, especially those with low shell (or pipe) thickness. Overfilling: water can pour into important units containing hazardous materials during flooding and heavy rain events. When the amount of water exceeds the capacity of the unit, it overflows, carrying part of the unit’s content with it. This is a frequent LOC event for parts of process plants that are open, such as the drains and some water treatment plants [9].

  

Annex 4. Assessment of the Natech scenario likelihood

For Natech accidents, the accident likelihood and the natural-hazard likelihood are inherently linked. In fact, the likelihood of a Natech scenario can never exceed that of the triggering natural-hazard scenario. First, the likelihood of the critical events (top events) should be assessed using natural-hazard statistics, then the likelihood of the Natech scenarios can be analysed with the use of event trees or equivalent methods. Natech critical event likelihood There are two main categories of critical events: Natechs that result from physical damage of a containment structure, Natechs that are produced by uncontrolled process upsets, e.g., due to blackouts. For the first category, the critical-event likelihood can be directly related to the likelihood of damage to the equipment. The simplest method is to consider that containment has failed when the design specifications are exceeded with a yes/no logic. The failure likelihood can be assessed as the probability of occurrence of a natural event that exceeds the design specification of the equipment unit. Another classical method for assessing damage likelihood is the use of fragility curves [7, 12]. Different curves are available for assessing the damage probability of industrial equipment, instrumentation, and utilities in case of natural-hazard impact [12]. Fragility curves may be associated with a vast array of damage types. For the sake of simplicity, all these types of damage are usually divided into damage classes (e.g. minor, moderate, major, severe damage) known as “damage states”. Fragility curves typically provide probability values for each damage state. Some or all damage states may result in one or more critical events. One possible method to reduce the complexity of the analysis is to consider only one damage state exceeding a certain value (e.g. moderate damage or greater) for each component [13]. The second category is accidents caused by a process upset due to a natural event. In this case, the Natech critical event is similar to the critical events considered in the conventional industrial risk analysis, with the difference that some process components may be damaged and important systems disrupted. Accordingly, the same methods can be used to identify critical events (e.g. check list, HAZOP, FMEA/FMECA) and to assess the damage/failure likelihood (e.g. fault tree, bow-tie). However, particular attention should be paid to the identification of the cut sets in which one (or more) component is vulnerable to natural hazards. It is also important to remark that the reliability values of components and systems may change significantly due to the possibility of natural-hazard damage. These values should be chosen carefully. The reliability of the systems should be assessed by considering those unable to survive the natural event as failed. When the assessment of the components’ survivability is uncertain, a conditional probability of damage that considers the occurrence of the natural-hazard scenario should be used (e.g. tailored fragility curves for the affected components). Natech scenario likelihood Logic trees can be used when assessing the likelihood of Natech scenarios that may arise from every Natech critical event (e.g. event trees, Bayesian networks). The specific conditions of the Natech scenarios should also be taken into account, including all the contributing factors. For instance, the value of the ignition probability of flammable substances should be higher in case of accidents triggered by lightning strikes (as lightning is an ignition source in itself), or if contributing factors include short circuits due to flood-induced electrical equipment damage. Similarly, for Natech scenarios, the probability of secondary containment failure should also be higher (even 100% in case of major floods) compared to the conventional accident scenarios. Given any Natech critical event, all the components that were considered as failed (or unavailable) during the Natech critical-event assessment (see “Natech critical event likelihood” section), and that are, therefore, a necessary condition for that Natech critical event to occur, should be checked. If the same components play a role in the development of any Natech scenario that may arise from the Natech critical event, they should be considered as failed also in the likelihood-assessment procedure. The reliability (i.e. the survivability) of all other components of the safety systems that are affected by the natural hazard should be analysed as well.

REFERENCES

[1]    Krausmann, E., Cruz, A.M., Salzano, E., 2017. Natech risk assessment and management: reducing the risk of natural-Hazard impact on hazardous installations, Elsevier.

[2]    Krausmann, E., Girgin, S., Necci, A., 2019. Natural hazard impacts on industry and critical infrastructure: Natech risk drivers and risk management performance indicators, International Journal of Disaster Risk Reduction, 40, 101163.

[3]    Necci, A., Krausmann, E., Girgin, S., 2018. Emergency planning and response for Natech accidents, In: Towards an all-hazards approach to emergency preparedness and response: Lessons learnt from non-nuclear events, NEA, OECD Publishing, Paris.

[4]    Steinberg, L.J., Sengul, H., Cruz, A.M., 2008. Natech risk and management: an assessment of the state of the art, Natural Hazards, 46 (2), pp. 143-152. 

[5]    Krausmann, E., Salzano, E., 2017. Lessons Learned From Natech events, In: Krausmann, E., Cruz, A.M., Salzano, E. (Eds.) Natech risk assessment and management, Elsevier, Amsterdam, pp. 33-52.

[6]    OECD, 2015. Addendum Number 2 to the OECD Guiding Principles for Chemical Accident Prevention, Preparedness and Response (2^nd ed.) to Address Natural Hazards Triggering Technological Accidents, Organisation for Economic Co-operation and Development, Paris.

 [7]   Eidinger, J. M., Avila, E. A., Ballantyne, D., Cheng, L., der Kiureghian, A., Maison, B. F., O'Rourke, T. D., Power, M., 2001. Seismic fragility formulation for water systems, American Lifelines Alliance (ALA), USA.

[8]    Godoy, L.A., 2007. Performance of Storage Tanks in Oil Facilities Damaged by Hurricanes Katrina and Rita. Journal of Performance of Constructed Facilities, Vol. 21, No. 6, pp. 441-449

[9]    Necci, A., Girgin, S., and Krausmann, E., 2018. Understanding Natech Risk Due to Storms – Lessons learned and recommendations, EUR 29507 EN, European Union.

[10] Girgin, S., 2011. The natech events during the 17 August 1999 Kocaeli earthquake: aftermath and lessons learned. Nat. Hazards Earth Syst. Sci., 11 (4) (2011), pp. 1129-1140. https://doi.org/10.5194/nhess-11-1129-2011.

[11] Cozzani, V., Salzano, E., 2017. Technological Hazard Characterization, In: Krausmann, E., Cruz, A.M., Salzano, E. (Eds.) Natech risk assessment and management, Elsevier, Amsterdam, pp. 91-105.

[12] FEMA, Multi-hazard Loss Estimation Methodology: Earthquake Model, Hazus®–MH 2.1: Technical Manual, Federal Emergency Management Agency, US Department of Homeland Security, USA, 2015. http://www.fema.gov/

[13] Salzano, E., Iervolino, I., Fabbrocino, G., 2003. Seismic risk of atmospheric storage tanks in the framework of quantitative risk analysis. Journal of Loss Prevention in the Process Industries, 16, pp. 403-409.

[14] Krausmann, E., Renni, E., Campedel, M., Cozzani, V., 2011. Industrial accidents triggered by earthquakes, floods and lightning: lessons learned from a database analysis, Natural Hazards, 59, pp. 285–300.

[15] USCSB, 2005. After Katrina: Precautions Needed During Oil and Chemical Facility Startup, Safety Bulletin No. 2005-01-S, U.S. Chemical Safety and Hazard Investigation Board, Available at: https://www.csb.gov/after-katrina-special-precautions-needed-during-oil-and-chemical-facility-startup/

PDF Version for printing

No. 10 Natech Risk Management

Natech Inspection Checklist Questions and Guidance from EU Seveso authorities
French inspectorate Natech Guide (French) - French Inspectorate Natech Template (French)
French Inspectorate Natech Guide (English) - French Inspectorate Natech Template (English)

Go back to the Common Inspection Criteria website