A Quantitative Framework for Propagation Paths of Natech Domino Effects in Chemical Industrial Parks: Part I—Failure Analysis

Abstract

Along with global climate change and industrialization, domino effects caused by Natech events occurred frequently in chemical industrial parks over the past decades. Previous research has not yet proposed a reliable method to obtain all possible paths of Natech domino effects, and moreover, a risk assessment and mitigation system has not been established. The present work aims to develop a quantitative framework for propagation paths of Natech domino effects, which can effectively safeguard the sustainable development of chemical industrial parks. The presentation of this work is divided into two parts: Part I (current paper) proposes a path probability calculation method that can simultaneously consider multiple primary accident scenarios and multi-level domino effects triggered by natural disasters. The proposed method transforms the propagation paths of domino effects into the paths of directed graph by constructing the equipment failure state transition matrix and the equipment failure state transition probability matrix. The depth-first traversal algorithm is used to obtain all possible propagation paths and their propagation probabilities, providing data support for the quantitative risk assessment and prevention and control measures presented in the accompanying paper (Part II). The case study shows that the probability of equipment failure caused by multi-level domino effects triggered by Natech accidents is higher than that of conventional accidents. However, the present work only considers the spatial propagation of domino effects, while their spatio-temporal propagation remains as a further direction for this area of inquiry.

1. Introduction

Chemical industrial parks usually have a large number of flammable and explosive hazardous substances, and large chemical installations are densely distributed in these locations [1,2]. Once a major accident occurs, it is likely to destroy adjacent plants or enterprises, leading to the occurrence of domino effects [3], which may have a serious negative impact on the sustainable development of chemical industrial parks [4]. Due to worldwide climate change and industrialization, technological accidents triggered by natural events have occurred frequently in recent years, which are commonly called Natech events (an abbreviation for natural disaster-induced technological accidents) [5,6,7,8]. Natural disasters can lead to the simultaneous destruction of multiple dangerous installations in chemical industrial parks, damage or destroy safety barriers, and block the lifelines required for emergency rescue [9,10,11]. A series of major accidents show that once a Natech event occurs, it will lead to more serious consequences than conventional accidents and is more likely to result in domino effects. For example, the 2011 Great East Japan earthquake caused serious damage to oil and gas storage tanks and other hazardous chemical facilities in some chemical industrial parks [12]. According to the investigation of the Fire and Disaster Management Agency (FDMA), a total of 3324 hazardous chemical facilities were damaged, and 42 fire accidents and 122 leakage accidents happened after the earthquake [13].

In recent decades, the increasing risk of domino effects and Natech events have attracted extensive attention from scholars, and the academic community has carried out a series of studies on domino effects and Natech events. In the field of domino effects, the current research mainly focuses on the following four aspects: statistical analysis of historical accidents [14,15,16], equipment vulnerability assessment model [17,18,19,20], risk assessment [21,22,23,24,25,26,27], and accident prevention and control [28,29,30,31]. For example, Darbra et al. analyzed 225 domino accidents and found that about 33% of domino accidents were caused by fire, explosion, lightning, flood, earthquake, and other external disasters [16]. Similarly with domino effects, the research on Natech events mainly focuses on the statistical analysis of historical accidents [32,33], equipment vulnerability assessment model for natural disasters [34,35,36], risk assessment [37,38,39], and risk mitigation [40,41]. Previous studies of accident statistics reported that floods and lightning have the highest frequency, while earthquake-related Natech events caused the most serious consequences of accidents among Natech accidents [42]. However, the above studies considered domino effects and Natech events separately and did not comprehensively study domino effects caused by natural disasters, which should be taken into account for a more realistic and comprehensive estimation.

Recently, some scholars have paid more attention to possible domino effects triggered by Natech events. Using a Bayesian Network, Yang et al. proposed a prediction method to evaluate the probability of domino effects triggered by lightning [43], while Misuri et al. carried out a quantitative risk assessment method for domino effects triggered by lightning [44]. However, the assessment method for lighting only considers a single primary accident scenario, but it is not suitable for assessing how earthquakes, floods, and other disasters may lead to multiple primary accident scenarios. Huang et al. developed a usable probabilistic analysis methodology for earthquake-induced domino effects based on a Monte Carlo simulation [45], while Zeng et al. proposed a novel methodology for quantitative risk analysis of domino effects triggered by floods [46]. Lan et al. used a network-based approach to carry out a Natech-related domino effects simulation involving a case study on a coastal oil storage base with respect to hurricanes and secondary flooding [47]. Khakzad developed a fire-spread model to obtain spread probabilities showing the most probable path of wildfire in wildland-industrial interfaces based on a dynamic Bayesian network [48]. The above research efforts have put forward solid ideas and have laid a strong foundation for the domino effects caused by natural disasters. However, these studies could not accurately identify the accident propagation paths of Natech-related domino effects, and quantitative risk assessment research has not been carried out, even though it plays an important role in effective accident prevention and control.

In order to solve the above shortcomings, Men et al. proposed an event-driven probabilistic methodology to simulate the spatial-temporal evolution of domino chains triggered by natural hazards, and the proposed method can quickly identify the critical system units and temporal intervals [49]. Chen et al. developed a three-dimensional visualization system for domino effects triggered by Natech events in oil-gas depots, which can be used to calculate the probability and evolution path of the accident chain [50]. However, these methods could not identify all the possible propagation paths and did not carry out quantitative risk assessment, which would thus lead to underestimated results. Yang et al. proposed a method for assessing all the propagation paths and probabilities of domino effects triggered by Natech events [51], but this method is only applicable to vapor cloud explosions, and not to fires or other scenarios.

The present work focuses on two research topics to fill the gap mentioned in the current research, which is divided into two parts. Part I (current paper) develops a probability calculation method to obtain all possible propagation paths and their probabilities and to identify the most dangerous equipment units and propagation paths of domino effects triggered by Natech events, which provides data support for the quantitative risk assessment and prevention and control methods presented in Part II of this work. Part II (accompanying paper) proposes an individual risk and social risk assessment model for domino effects triggered by Natech events, and a full-life cycle prevention and control system is studied considering the influence of natural disasters and multi-level domino effects simultaneously. The individual risks and social risks of natural disasters and multi-level domino effects are compared and analyzed through a case study, to reveal the propagation principles of natural disasters and domino effects for increased risk in chemical industrial parks, and to quantify the effects of accident prevention and control with the proposed risk assessment models, so as to provide a theoretical basis for optimizing prevention and control strategies. Therefore, the current work can not only improve the safety level of chemical industrial parks and protect the safety of humans and property, but also simultaneously improve the sustainable production of chemical industrial parks, producing a double benefit [4,52]. The rest of the current paper is organized as follows: The propagation rules of domino effects triggered by Natech events are stated in Section 2. The methodology procedures and corresponding equations and algorithms are demonstrated in Section 3. The application of the proposed methodology to a case study is illustrated in Section 4. Finally, the conclusions drawn from the present work are formulated in Section 5. This work includes additional Supplementary Materials. Some models proposed by other authors, alongside tables of some calculations. are available in the Supplementary Materials.

2. Propagation Rules of Domino Effects Triggered by Natech Events

Natural disasters have a wide range of impacts and are highly destructive, usually destroying multiple equipment units [6]. In addition to the direct damage caused by natural disasters, other infrastructure such as communication and power grids, pipelines, and road transport infrastructure are oftentimes also damaged, which hinders emergency response actions, thus aggravating the severity of the consequences and resulting in domino effects [38]. According to the type of equipment and stored hazardous substances, damaged equipment may potentially lead to fires or explosions, which are escalation vectors resulting in domino effects. When a primary equipment unit is damaged by a natural disaster, the fire or explosion generated by the primary unit may lead to the destruction of adjacent target equipment units, thus triggering an accident chain of domino effects.

The domino effects triggered by natural disasters are essentially propagated by taking the dangerous equipment units as the carrier, and the domino effects escalation vectors as the medium, such as fires and explosions generated by the damaged equipment units. The propagation rules are mainly divided into two parts: the interaction relationship between equipment units and the synergistic effects between escalation vectors [3]. For illustrative purposes, the accidental chains of domino effects among four tanks affected by natural disasters are illustrated in Figure 1.

2.1. Interaction between Equipment Units

The primary accident scenarios caused by natural disasters are uncertain. When the primary equipment unit is undetermined, there are three possible interaction relationships between the two dangerous equipment units:

(i)

Bidirectional-acting relationship. The intensity of the escalation vector generated by an equipment unit is larger than the escalation threshold of the target equipment unit, as is shown by T1 and T3 in Figure 1a. When T1 first occurs in an accident, it may damage T3, and when T3 first occurs in an accident, it may cause T1 to be damaged.

(ii)

Single-acting relationship. The intensity of the escalation vector generated by one equipment unit is larger than the escalation threshold of the target equipment unit, while the intensity of the escalation vector generated by the other equipment unit is less than the escalation threshold of the target equipment unit, as is shown by T1 and T4 in Figure 1a. When T1 occurs first in an accident, it may damage T4, while when T4 occurs first in an accident, it will not lead to the destruction of T1.

(iii)

No interaction relationship. The intensity of the escalation vector generated by the two equipment units is less than the escalation threshold of the target equipment unit. For example, T1 and T2 in Figure 1a cannot damage each other in the case of an accident.

In the propagation process, the first damaged equipment unit will affect the target equipment unit as the primary equipment unit, and the later damaged equipment unit will not affect the already damaged equipment unit. For example, as shown in Figure 1b, if T1 and T2 are assumed to be the primary equipment units that are damaged by natural disasters, then T1 may affect T3 after T1 is damaged, but T3 cannot have an impact on T1.

From the above analysis, it can be seen that due to the uncertainty in accident propagation, the propagation process of domino effects has many possible propagation paths. For example, as shown in Figure 1b, both T3 and T4 have the possibility of failure. However, when the first-level domino effect is propagated to Figure 1c, only T3 has a fire accident after becoming damaged, and T4 is still not damaged. Therefore, for the analysis of accident propagation process, in addition to the most possible propagation paths, all other possible propagation paths should also be considered.

2.2. Synergistic Effects

During the propagation process of domino effects, the thermal radiation of fires may have synergistic effects, which may strengthen the resulting impacts on the target equipment. For example, a fire usually lasts for a long time (usually lasting for hours or even days). If multiple equipment units are subject to fire accidents simultaneously, the generated thermal radiation will act on the same target equipment unit at the same time, resulting in an increase in the damage probability of the target equipment unit. For example, as shown in Figure 1c, both T1 and T3 are subject to fire accidents, and the generated thermal radiation acts together on T4. At this time, the thermal radiation effects of T1 and T3 need to be considered simultaneously; that is, the thermal radiation intensity of T4 is the superposition of thermal radiation intensity from T1 and T3.

3. Methodology

3.1. Failure State Combination of Primary Equipment Units Caused by Natural Disasters

Once a natural disaster occurs, it is very likely to cause multiple primary equipment units to be destroyed simultaneously. If there are n key equipment units in a chemical industrial park, assuming that each equipment unit is independent from the impact of natural disasters, the failure probability of any equipment unit affected by natural disasters is independent from the failure probability of other n − 1 equipment units. Therefore, when n key equipment units are affected by natural disasters or fires and explosions, there are Ns different failure state combinations, and Ns can be calculated by Equation (1) [53,54].

$$N_{\mathrm{s}}={\displaystyle \sum _{k=1}^n{C}_n^k}={\displaystyle \sum _{k=1}^n\frac{n!}{(n-k)!k!}}=2^n-1$$

(1)

where k is the number of damaged equipment units in different failure state combinations (1 ≤ k ≤ n).

If a numerical index (1 − n) is assigned to each of the n equipment units that may be triggered by natural disasters, a single overall Natech scenario may thus be identified as a Boolean matrix $S(i)$, which represents the i-th failure state combination ($i=1,\hspace{0.33em}2,\hspace{0.33em}\cdots ,\hspace{0.33em}{N}_{\mathrm{S}}$), $S{(i)}_j$ is the j-th element of $S(i)$ (j = 1, 2, ···, n), which represents the failure state of the j-th equipment unit in the i-th failure state combination. If the j-th equipment unit is in the undamaged state in $S(i)$, $S{(i)}_j=0$; if the j-th equipment unit is in the damaged state, then $S{(i)}_j=1$.

If $P_j^{\mathrm{N}}$ represents the failure probability of the j-th equipment unit due to the influence of a given natural disaster (which can be obtained by the vulnerability assessment model in the previous studies [34,36,55]), the probability of the i-th failure state combination suffering from natural disasters can be expressed by Equation (2) [53,54].

$$P_i^{\mathrm{S}}=f_{\mathrm{Na}}{\displaystyle \prod _j^n[1-P_{{}_j}^{\mathrm{N}}+\delta (j,S(i))(2P_{{}_j}^{\mathrm{N}}-1)]},\hspace{0.33em}i=1,\hspace{0.33em}2,\hspace{0.33em}\cdots ,\hspace{0.33em}{N}_{\mathrm{S}},j=1,\hspace{0.33em}2,\hspace{0.33em}\cdots ,\hspace{0.33em}n$$

(2)

where $f_{\mathrm{Na}}$ represents the frequency of natural disasters; $\delta (j,S(i))$ is the combination index, which represents the failure state of the j-th equipment in the i-th failure state combination, and its judgment rule is shown in Equation (3):

$$\delta (j,S(i))=\left\{\begin{array}{l}1,\mathrm{if}\mathrm{the}j\mathrm{-th}\mathrm{equipment}\mathrm{unit}\mathrm{in}S(i)\mathrm{is}\mathrm{damaged}\\ 0,\mathrm{if}\mathrm{the}j\mathrm{-th}\mathrm{equipment}\mathrm{unit}\mathrm{in}S(i)\mathrm{is}\mathrm{undamaged}\end{array}\right.$$

(3)

Assuming that each failure state combination is fixed, this combination may be the failure state combination of the primary equipment unit caused by natural disasters or domino effects caused by fires or explosions. If equipment unit j will not be affected by natural disasters, but may be affected by domino effects triggered by natural disasters, then $P_j^{\mathrm{N}}=0$, it can be seen from Equation (2) that even if the j-th equipment unit in the failure state combination $S(i)$ is in a damaged state, the probability of failure state combination as the primary accident scenario is $P_i^{\mathrm{S}}=0$, indicating that the failure state combination will not be used as the primary failure state combination, and it can only be used as a combination of subsequent domino effect failure states.

3.2. Propagation Path Probabilities of Domino Effects Triggered by Natural Disasters

3.2.1. Equipment Escalation Matrix and Escalation Probability Matrix

When an equipment unit is damaged, a variety of accident scenarios may occur according to the leaked material and the ignition time, and the occurrence conditions of each accident scenario have great uncertainty. This paper assumes that only a single accident scenario will occur after each equipment unit is damaged, and the probability of each scenario can be obtained by referring to the event tree analysis [56]. If there is at least one accident scenario in the event tree of equipment unit i that can cause the target equipment unit j to be damaged, it indicates that the primary equipment unit i can damage the target equipment unit j. If the equipment unit i is damaged, there may be $K(i)$ accident scenario, and the probability of the k-th accident scenario is $P_{\mathrm{i}}^k$, and the probability of the k-th accident scenario after the equipment unit i is damaged resulting in the failure of the equipment unit j is $P_{i,j}^{\mathrm{E}}$ (can be calculated by the probit model [22,54], which is widely used to cope with the uncertainties in the escalation process and to express the damage potential with a set of those related variables in domino effects [57], as shown in the Supplementary Material S1), then the failure probability of the equipment unit j after the equipment unit i damaged can be calculated by Equation (4):

$$P_{ij}^{\mathrm{E}}=1-{\displaystyle \prod _{k=1}^{K(i)}(1-P_i^k\cdot P_{i,j}^k)}$$

(4)

The interaction relationship between the damaged equipment units is represented by the equipment escalation matrix $EQ=(E{Q}_{ij}{)}_{n\times n}$. If there is at least one accident scenario that can damage the target equipment unit j after the damage of the equipment unit i, it means that the damaged equipment unit i can damage the target equipment unit j, then EQ_ij = 1, otherwise EQ_ij = 0.

After the equipment escalation matrix is obtained, the escalation probability between each damaged equipment unit can be expressed by the equipment escalation probability matrix $P^E={(P_{ij}^E)}_{n\times n}$, as shown in Equation (5).

$$P^E=\left[\begin{array}{c}0\\ P_{21}^E\\ ⋮\\ P_{n1}^E\end{array}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\begin{array}{c}{P}_{12}^E\\ 0\\ ⋮\\ P_{n2}^E\end{array}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\begin{array}{c}\cdots \\ \cdots \\ \ddots \\ \cdots \end{array}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\begin{array}{c}{P}_{1n}^E\\ P_{2n}^E\\ ⋮\\ 0\end{array}\right]$$

(5)

where the element $P_{ij}^E$ in the matrix can be obtained by Equation (4).

3.2.2. Failure State Transition Probability Matrix

When multiple primary equipment units are damaged by natural disasters, the remaining undamaged equipment units may be damaged by the impact of fire heat radiation and explosion shock wave generated by the primary equipment units, which may lead to domino effects. As time goes on, the fire thermal radiation, explosion shock wave, and other escalation vectors generated after the destruction of the secondary equipment unit may damage the tertiary equipment unit, and then the high-level domino effect will happen successively, leading to more serious consequences. In the multi-level propagation process of domino effects induced by natural disasters, there is the possibility that one primary equipment unit can act on multiple target equipment units, or multiple primary equipment units can act on the same target equipment unit simultaneously. Each escalation event may only produce one or more damaged equipment units simultaneously. The possible combination of newly damaged equipment units is related to the combination of failure states before the escalation, which increases the uncertainty and complexity in the propagation process of domino effects.

According to the analysis in Section 3.1, there are $N_{\mathrm{S}}=2^n-1$ failure state combinations in n key equipment units, and each failure state combination can be expressed by a Boolean matrix representing the safety (0) and failure (1) states of the equipment unit. For illustrative purposes, Figure 2 displays the failure states and possible propagation paths of three equipment units in a certain area, and each equipment unit can affect each other; that is, if any equipment unit is damaged, the other two undamaged equipment units can be used as potential target equipment units. According to Equation (1), there are seven failure state combinations.

The multi-level propagation process of domino effects can be simplified as a series of events that escalate and transform between different failure state combinations. In order to evaluate the possibility of a specific failure state combination occurring in the propagation process of domino effects, the escalation probability from other failure state combinations to that specific failure state combination must be evaluated first. Assuming that only the first level of domino effects is considered, it can be reasonably considered that the failure of each secondary equipment unit is an independent event. However, in the case of multi-level domino effects, the escalation of failure states is mutually restricted. The probability of each failure state depends on the occurrence or non-occurrence of other failure states, and the subsequent failure states are related to the previous failure states. The escalation relationship between failure states can be expressed by the failure state transition matrix $ST={(S{T}_{ij})}_{N_S\times N_S}$. $S{T}_{ij}=1$ which means that the failure state combination $S(i)$ can be escalated to the failure state combination $S(j)$ or otherwise to $S{T}_{ij}=0$.

The escalation of failure states caused by natural disasters have the following rules:

(i)

The primary failure state combination caused by natural disasters is uncertain, as shown in Figure 2, and all seven failure state combinations have the possibility to be the primary failure state.

(ii)

Only undamaged equipment units can be escalated to damaged equipment units, but damaged equipment units cannot be escalated to undamaged equipment units; that is, they are non-maintainable equipment units in the propagation process. For example, as shown in Figure 2, T2 is not damaged in S1 failure state, and can be damaged when escalating to S4, but S4 cannot be converted to S1.

(iii)

The failure state with a large number of damaged equipment units cannot be converted into a failure state with a smaller number of damaged equipment units. For example, S7 cannot be converted to S5, and S5 cannot be converted to S2.

(iv)

The failure states of the same number of damaged equipment units cannot be mutually converted, such as S4, S5, and S6.

(v)

The state combination with a small number of damaged equipment units will escalate to the state combination with a larger number of damaged equipment units, and the state combination with a larger number of damaged equipment units may escalate directly from the primary state combination (such as S1 → S7), or from the intermediate state combination with a smaller number of damaged equipment units (such as S1 → S4 → S7). The specific possible evolution path is shown in Figure 2 (a total of 18 possible paths, as listed in Supplementary Material S2).

In order to analyze the propagation process and causal relationship of each failure state combination, the escalation transformation between different failure state combinations can be intuitively expressed in the form of a directed acyclic graph. In the directed graph, each node represents different failure state combinations, the directed arc between nodes represents the escalation relationship between two nodes, the node from the directed arc is the parent node, and the node from the directed graph is the child node, which indicates that the failure state combination of the parent node may be escalated to the failure state combination of the child node. Assuming that a damaged equipment unit in a certain failure state combination may affect multiple undamaged target equipment units at the same time, the failure state combination node will serve as the parent node and point to all the failure state child nodes that may lead to escalation. The transition relationship of each node in the directed graph can be expressed by the failure state transition matrix ST, also known as the adjacency matrix of the directed graph. According to the propagation rules, the state transition matrix in Figure 2 is shown in Equation (6):

$$ST=\left(\begin{array}{ccccccc}0& 0& 0& 1& 1& 0& 1\\ 0& 0& 0& 0& 1& 1& 1\\ 0& 0& 0& 0& 0& 0& 1\\ 0& 0& 0& 0& 0& 0& 1\\ 0& 0& 0& 0& 0& 0& 1\\ 0& 0& 0& 0& 0& 0& 1\\ 0& 0& 0& 0& 0& 0& 0\end{array}\right)$$

(6)

When the failure state transition matrix and the equipment escalation probability matrix are obtained, the transition probability between each failure state combination can be evaluated; that is, the failure state transition probability matrix $P^S={(P_{i,j}^{\mathrm{S}})}_{N_{\mathrm{S}}\times N_{\mathrm{S}}}$. $P_{i,j}^{\mathrm{S}}$ indicates the possibility of directly leading to the failure state combination $S(j)$ when the failure state combination $S(i)$ occurs. If $S{(i)}_k$ and $S{(j)}_k$ represent the k-th equipment unit in the failure status combination $S(i)$ and failure state combination $S(j)$, respectively, then the value of the k-th element in the new comparison vector CR_ij(k) depends on the comparison result of the failure state of the k-th equipment unit in the two failure state combinations $S(i)$ and $S(j)$, as shown in

Table 1. The possible results of the comparison of the k-th units of the Boolean vectors $S(i)$ and $S(j)$.

$\mathit{S}{(\mathit{i})}_{\mathit{k}}$	$\mathit{S}{(\mathit{j})}_{\mathit{k}}$	CRij(k)	State Description
1	0	0	Impossible to escalate
1	1	1	Damaged, no impact
0	1	$P_k^i$	Damaged probability
0	0	1 − $P_k^i$	Undamaged probability

.

In Table 1, $P_k^i$ is the probability that the damaged equipment unit in failure state combination $S(i)$ damages the k-th equipment unit, which can be expressed by Equation (7):

$$P_k^i=1-{\displaystyle \prod _{s\in S^{\mathrm{F}}(i)}(1-P_{sk}^{\mathrm{E}})}$$

(7)

where $S^{\mathrm{F}}(i)$ represents the set of all damaged equipment units in failure state combination $S(i)$, as shown in Equation (8):

$$S^{\mathrm{F}}(i)=\left\{j\right|S{(i)}_j=1\},\hspace{0.33em}i=1,\hspace{0.33em}2,\hspace{0.33em}\cdots ,N_{\mathrm{S}},j=1,\hspace{0.33em}2,\hspace{0.33em}\cdots ,n$$

(8)

The failure state transition probability $P_{i,j}^S$ represents the probability that failure state combination $S(i)$ will directly escalate to failure state combination $S(j)$ due to domino effects, which is actually a conditional probability, because they are dependent on the occurrence of their parent node, and it can be calculated by Equation (9).

$$P_{i,j}^S={\displaystyle \prod _{i=1}^{n}C{R}_{ij}}(k)$$

(9)

According to the failure state transition matrix $ST$ and the failure state transition probability calculated in Equation (9), the failure state transition probability matrix $P^S$ can be obtained, as shown in Equation (10).

$$P^S=\left[\begin{array}{c}0\\ P_{2,1}^{\mathrm{S}}\\ ⋮\\ P_{N_{\mathrm{S}},1}^{\mathrm{S}}\end{array}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\begin{array}{c}{P}_{1,2}^{\mathrm{S}}\\ 0\\ ⋮\\ P_{N_S,2}^{\mathrm{S}}\end{array}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\begin{array}{c}\cdots \\ \cdots \\ \ddots \\ \cdots \end{array}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\begin{array}{c}{P}_{1,N_S}^S\\ P_{2,N_{\mathrm{S}}}^{\mathrm{S}}\\ ⋮\\ 0\end{array}\right]$$

(10)

3.2.3. Propagation Path Probabilities of Domino Effects Based on Directed Graph

When the state transition matrix and the state transition probability matrix are obtained, all possible propagation paths of domino effects can be solved by searching all paths in the directed graph, and the path search of the directed graph can be solved based on the depth-first traversal algorithm in Figure 3, which is developed by a Matlab program.

• The failure state combination S(i), i = 1, is set as the primary scenario, and the path sets are stored in the path cell array RA, which is initialized to a null set.
• The main path matrix MP is used to store the ID of primary failure state combination i, and its adjacent node set matrix is obtained by the function successors (ST, MP(end)), which is stored in the cell array AP.
• If the main path matrix MP is not a null set, the last item of MP will be pushed onto the top of matrix AT, which indicates the un-accessed adjacency failure states, while the primary failure state will otherwise be reset to S(i + 1).
• If AT is a null set, whereby namely there is no adjacent failure states or all the adjacent failure states have been visited, such that the path cell array RA will be used to store the new path in main path MP, and its corresponding path probability will be obtained and put in PR, then the last items of MP and AP will be deleted, and the algorithm program will continue.
• If AT is a null set, the last item of AT will be the top item of MP, and other items of AT will be put in AP, then the adjacent failure states of the new items in MP will be put in the top item of AP.
• If all the primary failure states have been visited, the algorithm program will be terminated, and all the possible paths and their probabilities can be obtained from the cell arrays RA and PR.

After all possible paths are obtained, if MP is the ID number set of failure state combinations, the probability of each propagation path PR can be expressed as follows:

$$PR=P_{MP(1)}^{\mathrm{S}}·{\displaystyle \prod _{k=1}^x{P}_{MP(k),MP(k+1)}^{\mathrm{S}}}$$

(11)

where x is the number of propagation level for path MP, $x=1,\hspace{0.33em}2,\hspace{0.33em}\cdots ,\hspace{0.33em}n-1$; k is the level of failure state; $P_{MP(1)}^{\mathrm{S}}$ represents the probability of the primary failure state combination induced by natural disasters in this path; $P_{MP(k),MP(k+1)}^{\mathrm{S}}$ represents the probability that the k-level failure state combination escalates to the (k + 1)-level failure state combination in this path.

4. Case Study

4.1. Overview of the Case Study

The proposed method is demonstrated by a case study with a tank farm located in a coastal area of China, and the layout of the tank farm is shown in Figure 4. Since the filling coefficient of the storage liquid in the tank constantly varied during the operation stage, the filling coefficient of the storage liquid in this case is a randomly assumed parameter in accordance with standard specifications. The characteristic parameters and storage liquid parameters of each tank are shown in

Table 2. Characteristic parameters and failure probabilities of tanks.

Tank ID	Volume (m3)	Diameter (m)	Height (m)	Inventory	Tank Type	$\mathbf{Density}({\mathbf{kg}/\mathbf{m}}^3)$	Filling Level	Failure Probability
T1	10,173	30	14.4	Gasoline	Internal floating roof	750	0.58	$5.21\times {10}^{-6}$
T2	10,173	30	14.4	Gasoline	Internal floating roof	750	0.36	0.0343
T3	10,173	30	14.4	Gasoline	Internal floating roof	750	0.28	0.6564
T4	11,434	34	12.6	Naphtha	Internal floating roof	750	0.56	$1.69\times {10}^{-4}$
T5	11,434	34	12.6	Naphtha	Internal floating roof	750	0.73	$4.51\times {10}^{-7}$
T6	18,086	40	14.4	Crude oil	External floating roof	810	0.23	0.9576
T7	18,086	40	14.4	Crude oil	External floating roof	810	0.45	$4.59\times {10}^{-4}$
T8	18,086	40	14.4	Crude oil	External floating roof	810	0.64	$2.39\times {10}^{-7}$

. According to the predominant meteorological conditions in the chemical industrial park, the wind speed is selected as 5 m/s with stability class B from the northwest, while the ambient temperature is 22 °C, and relative humidity is 0.67. The chemical industrial park is located in a flood-prone area; thus the catastrophic flood scenario with a return period of 200 years (i.e., the flood frequency is 0.005 times/year), having last occurred in 1915, is selected as the referenced natural disaster event. The maximum flood submergence depth is about 3.5 m, and the flood velocity is about 0.5 m/s. In the case study, the vulnerability assessment model for flooding proposed by the author is adopted (See Supplementary Material S3 for detailed model) [34], and the failure probability of each tank due to flooding is shown in Table 2.

4.2. Accident Consequence Analysis and Accident Escalation Probability

Due to the great uncertainty of equipment damage and leakage intensity caused by natural and technical disasters, on the premise of ensuring safety, this paper adopts the worst-case accident scenario, assuming that the equipment failure caused by natural and technical disasters is catastrophic failure, and the leakage scenario is instantaneous leakage.

Gasoline and naphtha are volatile and flammable liquids, according to the event tree analysis, which may result in pool fire or vapor cloud explosion. Crude oil is a non-volatile flammable liquid, which may cause pool fire. The accident consequence can be calculated by the PHAST 8.21 software, which is one of the most famous and widely used software tools available in the field of risk analysis [58], and the intensities of thermal radiation and overpressure received by the target tank from the primary tank are listed in Supplementary Material S4.

The equipment escalation probability of a single accident scenario can be calculated by the probit model in Supplementary Material S1. The escalation probability of the target equipment unit after the primary equipment unit is damaged can be calculated by Equation (4), and the equipment escalation probability matrix is shown in Equation (12), which takes into account the tank failure probabilities due to overpressure and thermal radiation in the subsequent calculations based on the probit model in Supplementary Material S1 and accident consequences in Supplementary Material S4.

$$\left(\begin{array}{l}\begin{array}{cccc}0& 0.28& 0.20& 0.30\\ 0.42& 0& 0.42& 0.30\\ 0.25& 0.42& 0& 0.21\\ 0.28& 0.28& 0.18& 0\end{array}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\begin{array}{cccc}0.28& 0& 0& \hspace{0.33em}\hspace{0.33em}0\\ 0.28& 0& 0& \hspace{0.33em}\hspace{0.33em}0\\ 028& 0.35& 0.35& \hspace{0.33em}\hspace{0.33em}0\\ 0.42& 0& 0& \hspace{0.33em}\hspace{0.33em}0\end{array}\\ \begin{array}{cccc}0.28& 0.28& 0.28& 0.44\\ 0& 0& 0.43& 0\\ 0& 0& 0.38& 0\\ 0& 0& 0& 0\end{array}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\begin{array}{cccc}0& 0& 0.35& 0.35\\ 0& 0& 0.57& 0\\ 0.32& 0.57& 0& 0.57\\ 0.43& 0& 0.57& 0\end{array}\end{array}\right)$$

(12)

4.3. Primary Failure State Assessment

Natural disasters may destroy multiple primary equipment units simultaneously. For the tank farm of eight tanks in this case study, there are 255 different failure state combinations. The failure state combinations and their identifications are shown in Supplementary Material S5. The probability of each primary failure state combination can be calculated by Equation (2). Since a failure state combination with a probability of less than 10⁻¹⁰ is considered almost impossible and its impact on risk can be neglected [38], this paper only considers the failure state combinations with primary failure probabilities larger than 10⁻¹⁰. There are thirty-five primary accident scenarios with probabilities larger than 10⁻¹⁰, and the top ten most likely primary failure state combinations are shown in

Table 3. The most likely combinations of primary failure states.

NO.	Primary Failure State	Primary Equipment	Probability of Primary Failure State	NO.	Primary Failure State	Primary Equipment	Probability of Primary Failure State
1	S24	T3, T6	$3.03\times {10}^{-3}$	6	S16	T2, T3	$4.77\times {10}^{-6}$
2	S6	T6	$1.59\times {10}^{-3}$	7	S2	T2	$2.50\times {10}^{-6}$
3	S3	T3	$1.34\times {10}^{-3}$	8	S80	T3, T6, T7	$1.39\times {10}^{-6}$
4	S60	T2, T3, T6	$1.08\times {10}^{-3}$	9	S34	T6, T7	$7.29\times {10}^{-7}$
5	S19	T2, T6	$5.64\times {10}^{-5}$	10	S74	T3, T4, T6	$5.13\times {10}^{-7}$

. It can be seen from Table 3 that the most likely primary failure state combination is S24. In this combination, T3 and T6 have the highest probability of being damaged by flood, so T3 and T6 being simultaneously damaged has the highest probability, which is $3.03\times {10}^{-3}$. Among the top ten most likely primary accident scenarios, the probability ranges from 10⁻³ to 10⁻⁷, and most of the combinations have T3 or T6 tanks, indicating that these two tanks have a large impact on the primary failure scenario, which can be considered as the most likely primary equipment unit.

4.4. Propagation Path Analysis

4.4.1. Most Likely Propagation Path

Analyzing the propagation path probability of domino effects caused by natural disasters can identify the most likely propagation path and probability and provide a data basis for quantitative risk assessment and mitigation.

Table 4. The most likely propagation paths and their probabilities.

NO.	Propagation Path	Path Probability	NO.	Propagation Path	Path Probability
1	S24 → S80	$5.41\times {10}^{-4}$	6	S24 → S154	$2.10\times {10}^{-4}$
2	S6 → S34	$5.16\times {10}^{-4}$	7	S24 → S115	$1.80\times {10}^{-4}$
3	S24 → S135	$3.92\times {10}^{-4}$	8	S24 → S204	$1.52\times {10}^{-4}$
4	S6 → S80	$3.89\times {10}^{-4}$	9	S24 → S60	$1.51\times {10}^{-4}$
5	S6 → S24	$2.94\times {10}^{-4}$	10	S24 → S151	$1.44\times {10}^{-4}$

lists the top ten most likely propagation paths with probability ranges from $1.44\times {10}^{-4}$ to $5.41\times {10}^{-4}$. The primary failure state combination of these ten propagation paths is S24 or S6, indicating that a primary failure state combination with high occurrence probability is most likely to trigger domino effects.

4.4.2. Propagation Paths at All Levels

Table 5. The number and probability distribution of propagation paths at each level.

Level	Number of Paths	Path Cumulative Probability	Maximum Path Probability	Maximum Path	Minimum Path Probability
L1	873	$4.30\times {10}^{-3}$	$5.41\times {10}^{-4}$	S24 → S80	$4.75\times {10}^{-13}$
L2	8222	$4.10\times {10}^{-3}$	$1.29\times {10}^{-4}$	S6 → S34 → S157	$7.44\times {10}^{-15}$
L3	33,553	$3.30\times {10}^{-3}$	$3.54\times {10}^{-5}$	S24 → S135 → S251 → S255	$1.50\times {10}^{-16}$
L4	69,644	$1.50\times {10}^{-3}$	$1.10\times {10}^{-5}$	S6 → S34 → S157 → S244 → S255	$2.49\times {10}^{-18}$
L5	77,536	$3.95\times {10}^{-4}$	$4.35\times {10}^{-6}$	S6 → S34 → S157 → S217 → S254 → S255	$2.45\times {10}^{-19}$
L6	44,238	$5.12\times {10}^{-5}$	$8.48\times {10}^{-7}$	S6 → S34 → S157 → S217 → S246 → S254 → S255	$6.57\times {10}^{-20}$
L7	10,176	$2.45\times {10}^{-6}$	$1.16\times {10}^{-7}$	S6 → S34 → S92 → S157 → S217 → S246 → S254 → S255	$6.06\times {10}^{-20}$

lists the number and probability of propagation paths at each level to analyze the impact of domino effects at different levels.

It can be seen from Table 5 that the number of paths with single-level domino effects is the smallest, and the number of domino effect paths at 3–6th levels is up to the tens of thousands, but their cumulative probabilities are less than that of the first and second levels. The maximum path probability at each level decreases gradually from $5.41\times {10}^{-4}$ to $1.16\times {10}^{-7}$ with the increase of levels, indicating that the occurrence probability of the high-level domino effect cannot be ignored. The minimum path probability of each level gradually decreases from $4.75\times {10}^{-13}$ to $6.06\times {10}^{-20}$, and these path probabilities are less than the cutoff value of 10⁻¹⁰.

4.4.3. Failure Probability Distribution of Tanks at All Levels

Figure 5 shows the total failure probability and cumulative failure probability of tanks at different levels, and the total failure probability of T7 and T5 is the highest due to how they are adjacent to the T3 and T6 tanks that are susceptible to natural disasters, followed by T1, T4, T8, and T2. However, the failure probability of the above tanks is similar, at about 89–90% of the failure probability of T7. The total failure probability of T3 and T6 is the lowest, which is 28% and 2.8% of the failure probability of T7, respectively, because these two tanks are served as primary equipment units and are less affected by the domino effects of other tanks. The failure probability of the T2, T3, T6, and T7 tanks at the first level of domino effects is larger than that of other levels, because these four tanks are adjacent to the most likely primary equipment unit T3 or T6. Therefore, those tanks are susceptible to the influence of T3 or T6. However, the T1, T4, T5, and T8 tanks are susceptible to the domino effects of the T2, T3, T6, and T7 tanks, resulting in a high probability of a second level of domino effects. The proportion of domino effects occurring at or above three levels in these tanks is less than 20%, and the impact on the overall domino effect is relatively small compared to accidents at other levels.

4.5. Accident Scenario Analysis

In order to analyze the impact of different scenarios on the failure probability of each tank, four situations are analyzed: (a) Natech events and conventional accident scenarios; (b) multi-level domino effects triggered by Natech events and conventional accident scenarios; (c) single-level domino effects triggered by Natech events and conventional accident scenarios; (d) only conventional accident scenarios.

Table 6. Combination of different accident scenarios.

Accident Scenarios	Natech Events	Multi-Level Domino Effects	Single-Level Domino Effects	Conventional Accident Scenarios
a	√	×	×	√
b	√	√	×	√
c	√	×	√	√
d	×	×	×	√

Note: √ indicates that the scenario is included; × indicates that the scenario is not included.

lists the combination of different accident scenarios, and Figure 6 shows the failure probability of each tank under different accident scenarios.

• Impact of Natech events

By the comparative analysis of failure probability of A and D accident scenarios, it is shown that when considering the Natech scenario, the failure probability of T2, T3, and T6 is significantly increased compared with the conventional accident scenario, by about two to three orders of magnitude, and the increased risk for other tanks is less than one order of magnitude. It shows that natural disasters can significantly increase the failure probability of some tanks, such as T2, T3, and T6 in this case, and ignoring the impact of natural disasters will cause the risk to be underestimated.

2.

Impact of domino effects

Comparing the failure probability of accident scenarios A and B, it can be seen that the failure probability of the T1, T2, T4, T5, T7, and T8 tanks increases by about three orders of magnitude when considering multi-level domino effects, which indicates that the occurrence of domino effects have a great impact on the failure probability of these tanks. Due to the impact of natural disasters, the other tanks are mostly served as primary equipment units and are relatively less affected by domino effects. It shows that domino effects will also lead to the destruction of tanks that are less affected by natural disasters, significantly increasing the risk for the chemical industrial park.

3.

Impact of multi-level domino effects

In order to compare and analyze the impact of multi-level domino effects and single-level domino effects, the failure probabilities of B and C accident scenarios are shown in Figure 6. It can be seen that multi-level domino effects will lead to the most significant increase in the failure probability of T8, at about three orders of magnitude. The failure probability of T1, T2, T4, and T5 also increased significantly, with an increase range of about one to three times. It shows that considering multi-level domino effects can have a larger impact on the failure probability of some tanks and ignoring multi-level domino effects will cause the risk of some tanks to be underestimated.

5. Conclusions

This paper presents a probability analysis method for predicting all the possible propagation paths of Natech domino effects, which considers multiple primary equipment units and multi-level domino effects simultaneously. A chemical tank farm located in a flood prone area of China is selected as a case study to demonstrate the application of the proposed method, and the case application shows that this method can effectively identify all possible propagation paths and calculate their probabilities.

In the case study, the probability analysis of primary failure state combinations shows that the probability of the top ten most likely primary accident scenarios decreases from 10⁻³ to 10⁻⁷, and most of the top ten primary failure state combinations contain T3 or T6 tanks, indicating that these two tanks can be considered as the most likely primary equipment unit. The probability analysis of the propagation path of the domino effects induced by natural disasters in the case study shows that the primary failure state has the greatest impact on the propagation probability of domino effects, and the cumulative failure probability of each tank is greatly affected by the primary failure state. The number of propagation paths of the single-level domino effect is the least, but the cumulative failure probability is the largest, and the influence of the multi-level domino effect cannot be ignored. The failure probability analysis of each tank in different scenarios shows that Natech events and multi-level domino effects have a significant impact on the failure probability of tanks, even resulting in the failure probability of some tanks increasing by several orders of magnitude. Ignoring the impacts both of natural disasters and the multi-level domino effect will lead the failure probability of tanks to be underestimated.

The equipment failure probability calculated in this paper can be used for quantitative risk assessment, and the most dangerous propagation path and equipment unit identified can provide a reference for the optimizing risk mitigation measures proposed in Part II of the present work. It can be concluded that the results and mitigation measures proposed in this work play a critical role in safety production in chemical industrial parks, and improving safety performance will produce two-pronged benefits: reducing the safety risks of chemical industrial parks and simultaneously improving sustainability performance.

Nonetheless, it should be remarked that this paper only considers the possibility of the spatial propagation of domino effects and does not focus on the temporal evolution of domino effects. However, equipment failure caused by fire may take some time, and safety barriers and fire rescue actions have a delayed or even eliminative effect on the evolution of domino effects. Therefore, the accuracy of results may increase by considering the temporal factor of domino effects caused by fire, and future research should comprehensively consider the spatio-temporal evolution law of accident propagation and dynamic risk assessment method.