A Quantitative Framework for Propagation Paths of Natech Domino Effects in Chemical Industrial Parks: Part II—Risk Assessment and Mitigation System

Abstract

This is the second part of the quantitative framework for the propagation paths of Natech domino effects in chemical industrial parks, which focuses on risk assessment and a mitigation system based on the propagation path probabilities obtained from Part I. In this paper, the risk assessment model for the propagation paths of the domino effects induced by natural disasters are developed, and the risk level is quantitatively analyzed using individual risk and social risk indexes and compared with the risk acceptance standard to determine whether the risk in the plant area is at the risk acceptance level. Furthermore, the chain-cutting disaster mitigation model for domino effects induced by Natech events and the full-life-cycle mitigation system are proposed, and the effectiveness of mitigation measures is also evaluated. The case analysis results show that Natech events and multi-level domino effects can increase the risk to an unacceptable level, and taking corresponding mitigation measures could reduce the risk to an acceptable level.

1. Introduction

As discussed in Part I (accompanying paper) of this work, once the Natech event occurs, it will lead to more serious consequences than conventional accidents, and they are more likely to result in domino effects. Previous studies on accident statistics reported that floods and lightning have the highest frequency, and earthquake-related Natech events have the most serious consequences among Natech accidents [1]. In addition to the direct damage caused by natural disasters, other infrastructure such as communication and power grids, pipelines, and road transport infrastructure are also damaged, hindering emergency response actions and thus aggravating the consequences and risks [2,3]. Quantitative risk assessment (QRA) is one of the most widely used tools and is used to provide quantitative information on the risks caused by conventional accidents in chemical and processing plants [4,5,6]. Currently, the methodologies, the models and the software tools available for QRA are continuously improving, and the extension of the conventional QRA methodology to high-impact low-probability accident scenarios, such as Natech events and domino effects, are also developing [7].

In the literature, several methodologies for performing a QRA of Natech scenarios are available and have been applied to various disasters, such as earthquakes [6,8,9,10], floods [11], lighting strikes [12], and wildfires [13,14,15]. In recent years, a common framework has been developed to include the assessment of natural disasters in risk assessment [16]. The research related to the quantitative risk assessment of domino effects emerged in the 1990s. Khan and Abbasi proposed a method that can comprehensively evaluate the escalation probability of domino effects, which considered the escalation of fire thermal radiation, explosion shock waves and explosion debris for the first time, and they developed the quantitative risk assessment software DOMIFFECT [17]. Cozzani et al. proposed a quantitative risk assessment framework for domino effects by integrating domino effects into the conventional quantitative risk assessment framework [5], and they developed the Aripar-GIS software for the quantitative assessment of domino effects [4]. However, the above risk assessment methods only consider the domino effects and the Natech events separately, without comprehensively considering the risk of domino effects triggered by Natech events. Misuri et al. proposed a methodology for the quantitative assessment of risk due to domino effects triggered by lightning, and the assessment results demonstrated that risk indexes may increase by about an order of magnitude when considering primary Natech scenarios induced by lightning, and of about a further order of magnitude when considering the possibility of domino effects [18]. Nevertheless, this method ignores the influence of multi-level domino effects and multiple primary accident scenarios.

In the research field of risk mitigation of Natech events and domino effects, several studies have proposed a series of measures in various areas. The previous measures for the prevention and control of Natech events mainly focused on land planning [19,20], safety barriers [21,22,23], emergency response [1,24], etc. For example, Galderisi et al. proposed a risk assessment method as a supporting tool for land use planning strategies aimed at reducing Natech risk [19]. Baser and Behnam proposed an emergency response plan for cascading post-earthquake fires in fuel storage facilities [24], and Misuri et al. developed a method for assessing the performance of the safety barrier in Natech scenarios [21]. To date, the mitigation measures for domino effects mainly include inherent safety [25,26,27], safety barriers [28,29,30], emergency response [31,32,33], etc. However, such studies remain narrow in focus, dealing only with Natech events or domino effects. Despite this, little progress has been made in the mitigation of domino effects triggered by Natech events. For example, Misuri et al. proposed a method for the assessment of safety barrier performance for the mitigation of domino scenarios caused by Natech events [34], and Zeng et al. developed a barrier management framework for dealing with Natech domino effects. However, these two studies only consider the role of safety barriers and do not systematically analyze other mitigation measures.

Based on the propagation path probabilities of domino effects induced by natural disasters, which are calculated in Part I, this paper develops a model for the assessment of the individual risks and social risks of domino effects induced by natural disasters. According to the propagation law of domino effects caused by natural disasters, the risk mitigation model of chain-cutting disaster mitigation is established, and the full-life-cycle mitigation system and corresponding prevention and control measures are proposed. In addition, the impact of Natech events and multi-level domino effects on individual risk and social risk are also analyzed through a case study, and the expansion effects of natural disasters and domino effects on risks to chemical industrial parks and the mitigation effects of accident mitigation measures are also revealed.

The rest of this paper is organized as follows. Section 2 develops the framework and model of the QRA for domino effects triggered by Natech events. The risk mitigation models and mitigation system are proposed in Section 3, and a case study is illustrated in Section 4. Finally, the conclusions drawn from this study are presented in Section 5.

2. The Framework and Model of QRA

2.1. The Framework of QRA

Quantitative risk assessment includes two aspects: the probability calculation and the consequence assessment. Besides conventional accident scenarios, the risk assessment of domino effects induced by natural disasters also needs to consider the risks of Natech events and subsequent domino effects. The risk assessment process is shown in Figure 1, which mainly includes the following steps.

Step 1:

data collection

First of all, it is necessary to collect all the necessary data and information on the plants and equipment in the park, such as plant layout, equipment types, equipment parameters, stored substances, process conditions, technical parameters of safety management, emergency response information, and environmental parameters (temperature, wind direction, wind speed, humidity, etc.). Through the analysis of the above information, the following information can be identified: (i) the key equipment unit to be considered in the quantitative assessment—storage tanks are often selected as the key equipment units because they store a large number of hazardous substances and are usually most vulnerable to natural and technological disasters; (ii) the frequency and intensity parameters of reference natural disaster scenarios are determined based on the meteorological conditions and local natural disasters.

Step 2:

accident probability calculation

The probability calculation for the propagation paths of the domino effects caused by natural disasters in chemical industrial parks is mainly divided into three aspects: (i) The probability of conventional accident scenarios caused by internal defects or human factors in the plant, which can use the recommended value given in the TNO purple book (in the late 1990s, the Purple Book consolidated failure frequency values as a guideline for the Dutch quantitative risk assessment of process installations, and the default values have been agreed to in working groups between the Dutch government and industry representatives and summarized in the Purple Book) [35,36] and make corrections according to the actual situation. (ii) The probability of Natech events can be calculated using the vulnerability assessment model proposed by the previous studies [9,37,38] and Equation (2) in Part I. (iii) The probability of domino effects triggered by Natech events can be calculated by the path probability prediction method proposed in Part I.

Step 3:

accident consequence assessment

The accident consequence of each single accident scenario at the designated location can be calculated by the accident consequence assessment model, which is used to calculate the overpressure of an explosion, the thermal radiation of a fire, and toxic gas concentration. The death probability from the physical effect at the designated location can be calculated according to the accident consequence injury criteria, as shown in Equation (1):

$$V^{\mathrm{D}}=\frac{1}{\sqrt{2\pi }}{\displaystyle {\int }_{-\infty }^{Y-5}{e}^{-x^2/2}}dx$$

(1)

where V^D is the death probability and $Y$ is the probit value which can be obtained from

Table 1. Probability formulas of fatality [35].

Physical Effect	Probit Value $\mathit{Y}$
Thermal radiation	$Y=-36.38+2.56\ln (Q_{\mathrm{r}}{}^{4/3}\times t_{\mathrm{r}})$
Overpressure	$Y=5.31+1.37\ln (\mathrm{\Delta }P)$
Toxic gas concentration	$Y=a_{\mathrm{t}}+b_{\mathrm{t}}\ln (C_{\mathrm{t}}^{d_{\mathrm{t}}}\times t_{\mathrm{t}})$

Where Q_r is the thermal radiation intensity acting on humans, kW/m²; t_r is the time of thermal radiation acting on humans, s; $\mathrm{\Delta }P$ is the overpressure intensity acting on humans, kPa; a_t, b_t, d_t are constants describing the toxicity of substances; $t_{\mathrm{t}}$ is the time of exposure to toxic environment, min; $C_{\mathrm{t}}^{d_{\mathrm{t}}}$ is the concentration of toxic substances, mg/m³.

.

Step 4:

risk index calculation

A risk index mainly includes an individual risk index and a social risk index, which can be calculated by the models developed in Section 3.

Step 5:

risk mitigation measures

According to the results of the risk assessment, if the risk is higher than the risk’s acceptable level or is in the risk’s required reduction area, appropriate mitigation measures need to be taken to reduce the risk to an acceptable level, which are discussed in detail in Section 4.

2.2. The Individual Risk Assessment Model

An individual risk assessment mainly includes three aspects, namely, conventional risk, Natech risk and domino risk induced by Natech events. In Part I, the probability prediction method for the domino propagation paths induced by natural disasters is established to calculate probabilities of all possible propagation paths and equipment failure probabilities. The individual risk index is calculated by combining the accident consequence assessment model and the probability method proposed in Part I.

In this paper, when calculating the impact of accidents on casualties, it is assumed that each accident scenario is independent of each other, and their accident consequences are in the form of superposition. The individual risk from a piece of equipment at a certain location (x, y) can be obtained by multiplying the accident consequence at a certain location by the accident scenario probability and adding the risks of all possible accident scenarios. Furthermore, the overall individual risk at the location (x, y) can be obtained by adding the individual risk indexes of all equipment units at that location, as shown in Equation (2). Relevant research shows that the error of adopting a superimposed accident consequence on the overall risk is within the acceptable extent, which means that accident consequences may be analyzed by superimposing the physical effects (radiation, overpressure, toxic gas concentration) separately calculated for each of the primary and secondary events that may take place [5,16].

$$\begin{array}{rr}I{R}_{\mathrm{N}}(x,y)& ={\displaystyle \sum _{i=1}^{n}I{R}_i(x,y)}+{\displaystyle \sum _{i=1}^{n}I{R}_i^{\mathrm{Na}}(x,y)}+{\displaystyle \sum _{i=1}^{n}I{R}_i^{\mathrm{ND}}(x,y)}\\ & ={\displaystyle \sum _{i=1}^n{\displaystyle \sum _{j=1}^m(f_i+f_{i,\mathrm{Na}}+f_{i,}{}_{\mathrm{ND}})P_i^j{V}_{{}_{i,j}}^{\mathrm{D}}(x,y)}}\hfill \end{array}$$

(2)

where $I{R}_i(x,y)$ is the individual risk contributed by equipment i at location (x, y) under the conventional scenario; $I{R}_i^{\mathrm{Na}}(x,y)$ is the individual risk contributed by equipment i at location (x, y) under the Natech scenario; $I{R}_i^{\mathrm{ND}}(x,y)$ is the individual risk contributed by equipment i at location (x, y) under the domino scenario trigged by the Natech event; $f_i$ is the failure probability of equipment i in the conventional scenario;$f_{i,\mathrm{Na}}$ is the failure probability of equipment i under the Natech scenario; $f_{i,}{}_{\mathrm{ND}}$ is the cumulative failure probability of equipment i in the domino scenario induced by the Natech event, which can be calculated by the path probability calculation method proposed in Part I; $P_i^j$ is the probability of the j-th accident scenario after the i-th equipment damaged; $V_{{}_{i,j}}^{\mathrm{D}}(x,y)$ is the death probability of the i-th equipment in location (x, y) in the j-th scenario.

2.3. The Social Risk Assessment Model

Compared to individual risk, social risk is also related to the population density of the assessed area. When considering the Natech scenarios and subsequent domino effects, the social risk FN in the area concerned can be expressed as the cumulative probability that the number of deaths in the conventional scenarios, the Natech scenarios, and the domino scenarios triggered by Natech events (which is larger than N and FN) can be expressed by Equation (3).

$$FN=F{N}_0+F{N}_{\mathrm{Na}}+F{N}_{\mathrm{D}}$$

(3)

$$F{N}_0={\displaystyle \sum _i^n{f}_i},N_i^0\ge N$$

(4)

$$F{N}_{\mathrm{N}}={\displaystyle \sum _m^{N_{\mathrm{s}}}{f}_m^{\mathrm{Na}}},N_m^{\mathrm{Na}}\ge N$$

(5)

$$F{N}_{\mathrm{D}}={\displaystyle \sum _m^{N_{\mathrm{s}}}{\displaystyle \sum _k^{N_{\mathrm{P}}}{f}_{m,k}^{\mathrm{P}}}},N_{m,k}^{\mathrm{P}}\ge N$$

(6)

where $F{N}_0$ is the cumulative probability that the number of fatalities in the conventional accident scenarios is larger than N; $F{N}_{\mathrm{Na}}$ is the cumulative probability that the number of fatalities in the Natech scenarios is larger than N; $F{N}_{\mathrm{D}}$ is the cumulative probability that the number of fatalities in the domino scenarios triggered by Natech events is larger than N; $N_i^0$ is the number of fatalities caused by the i-th conventional scenario; $N_m^{\mathrm{Na}}$ is the number of fatalities caused by the m-th Natech scenario; $N_{m,k}^{\mathrm{P}}$ is the number of fatalities caused by the accident scenario in the k-th domino path induced by the m-th Natech primary accident scenario; $f_m^{\mathrm{Na}}$ is the probability of the m-th Natech scenario; $f_{m,k}^{\mathrm{P}}$ is the probability of the k-th domino path induced by the m-th Natech primary accident scenario; $N_{\mathrm{s}}$ is the number of primary accident scenarios caused by the Natech events; and N_P is the number of domino paths induced by the m-th Natech accident scenario.

3. Risk Mitigation Model and Mitigation System

3.1. Chain-Cutting Disaster Mitigation Model

If the quantitative risk assessment results of a certain area are in an unacceptable risk area or as low as possible in an area, corresponding mitigation measures need to be taken to reduce the risk to an acceptable level. Natech events and their induced subsequent domino effects are propagated in the form of accident chains. Through the analysis of the probability and risk of domino propagation paths in Part I of this work, the most possible propagation paths, the primary equipment units that are most likely to be affected by natural disasters, and the most dangerous target equipment units in the domino propagation paths can be identified. Based on the theory of chain-cutting disaster mitigation, targeted mitigation measures can be taken for these key equipment units and for the whole process of accident evolution to effectively prevent accidents.

The propagation paths of the Natech events and the subsequent possible domino effects are extremely complex and have high uncertainty. Therefore, a single mitigation measure cannot effectively suppress the loss caused by such accidents. Through comprehensive mitigation measures based on the theory of chain-cutting disaster mitigation, the possibility of various disasters and their consequences can be reduced as much as possible, which becomes an effective way to prevent and control such accidents and disasters. The mitigation of domino effects induced by Natech accidents needs to be carried out for two reasons. On the one hand, it needs to prevent natural disasters from damaging the primary equipment units and causing serious consequences such as fires and explosions; on the other hand, it needs to prevent the subsequent domino effects caused by the Natech events from aggravating the severity of the accident consequences. Figure 2 is the schematic diagram of the chain-cutting disaster mitigation model presented in this paper for domino effects induced by natural disasters. As shown in Figure 2, the accident consequences become more and more serious with the propagation and evolution of the accidents. Therefore, according to the principle of prevention first, the earlier the mitigation measures are taken, the lower the losses.

It can be seen from Figure 2 that the mitigation of Natech events need to be carried out from three perspectives: (i) taking measures to reduce the impact of natural disasters on equipment units; (ii) improving the ability of primary equipment units to resist natural disasters so that they can still maintain equipment integrity when affected by natural disasters; (iii) taking measures to prevent or reduce accident consequences after primary equipment units are damaged. Moreover, the mitigation of domino effects should be carried out with the following two aspects: (i) taking measures to reduce the impact of technical disasters and mitigate the severity of consequences after equipment units are damaged; (ii) improving the ability of the target equipment units to resist technical disasters so as to avoid failure when affected by fires, explosions and other technical disasters.

3.2. Full-Life-Cycle Mitigation System

Based on the proposed chain-cutting disaster mitigation model, this paper proposes a full-life cycle mitigation system for domino effects induced by Natech events divided into the following stages: site selection and layout, design, production and operation, emergency response, and post-disaster recovery in chemical industrial parks, as shown in Figure 3 (the contents in brackets in Figure 3 indicate the accident scenarios applicable to each mitigation measure). For each stage, specific mitigation strategies and key prevention and control points for domino effects induced by Natech events are proposed, and the mitigation measures in the post-sequence stage are the supplementary measures taken when the measures in the pre-sequence stage are not well working.

Since there are many dangerous sources in chemical industrial parks, it is costly to take strict accident mitigation measures for all equipment units. Therefore, targeted mitigation measures can be taken for the key equipment units and key paths identified in Part I to achieve the goal of reducing costs while ensuring safety.

3.2.1. The Stage of Site Selection and Layout

The best way to prevent the impact of natural disasters in the chemical industrial park is to keep hazardous installations away from natural-disaster-prone areas at the site selection stage through appropriate land use planning. When formulating land use planning and policies related to hazardous chemical facilities, the government should take into account natural disasters such as floods, earthquakes, typhoons, lightings and the potential risk of climate change.

Avoiding the building of chemical industrial parks or chemical plants in areas with frequent natural disasters is the most effective mitigation measure, but this measure is not always feasible, especially for already existing chemical industrial parks or chemical plants; the cumulative risk of the Natech events and their domino effects in the communities near the facilities should be considered in the stage of site selection and layout to determine the location for the most effective and economic plan for reducing risk. Nowadays, Natech risk has not been specifically included in land use planning; planners only consider avoiding the areas with frequent natural disasters to prevent secondary accidents from said natural disasters, and the impact of Natech events and subsequent domino effects that can enlarge the accident consequences have not been quantitatively assessed. The key mitigation measures taken during the site selection and layout stage are shown in

Table 2. Mitigation measures in the stage of site selection and layout.

Mitigation Strategy	Specific Measures
Avoid natural-disaster-prone areas	(1) Chemical industrial parks or chemical plants should keep away from areas with frequent natural disasters at the site selection stage. (2) The government can designate some areas that are not suitable for hazardous chemical production activities or natural-disaster-prone areas that require additional safety measures or more stringent design, construction and operation requirements.
Reasonable layout	(1) The equipment containing hazardous chemicals or other key safety components shall be arranged at the location with such to minimize the impact of natural disasters. (2) The government and chemical enterprises should carry out a risk analysis of Natech events and domino effects before constructing new hazardous chemical facilities, and they should select the best scheme on the premise of ensuring safety.
Safety distance	(1) The safety distance and safety capacity of the chemical industrial park or chemical plant should be controlled within the safety scope [39]. (2) Based on the simplified assessment of the primary accident scenario, the safety distance can be used to carry out the domino effect propagation analysis, and the threshold and safety distance can be used to identify the escalation target to ensure that the surrounding equipment will not be affected [40].

.

3.2.2. The Stage of Design

Placing chemical industrial parks or chemical plants in areas far away from natural disasters can minimize the impact related to potential natural disasters and domino effects. However, it is often difficult to take such measures for existing plants or new plants with limited land planning. In this case, supplementary measures need to be taken at the design stage to protect the dangerous installations from being affected.

In the design stage, based on the inherent safety design idea, various methods can be adopted to reduce the technical disaster risk caused by natural disasters [27,41], mainly including (i) measures to reduce the impact of natural disasters; (ii) measures to improve the ability of equipment to resist natural disasters; (iii) measures to reduce the impact of technical disasters; (iv) measures to increase the equipment’s ability to resist technical disasters, as shown in

Table 3. Mitigation measures in the design stage.

Mitigation Strategy	Specific Measures
Measures to reduce the impact of natural disasters	(1) Earthquakes: Earthquake disasters cannot be completely avoided because it is difficult to accurately predict earthquake disasters, and the earthquake warning time is extremely short. Therefore, in the design stage, it is necessary to plan and set up isolation zones, green areas and disaster relief spaces and to take anti-seismic measures for the foundation of large equipment to mitigate the impact of an earthquake [42]. (2) Floods: Measures for mitigating flood disasters can be taken by designing forests, ditches, slopes and embankments around flood-prone areas or major protective facilities to slow and limit the flow rate of flood and debris carried by a flood; diversion technology can also be used to divert the flood away from sensitive areas by setting flood control walls, flood control channels, etc; in addition, the impact of a flood can be reduced by heightening the foundations of the plants or key facilities [3]. (3) Lightning: A lightning protection system is usually required according to standard specifications, such as equipment grounding, lightning rods or circuit breakers [43].
Measures to increase the ability of equipment to resist natural disasters	(1) New hazardous chemical facilities can improve to the design codes and standards for natural disasters, and the already-existing facilities need to be reconstructed to meet the latest design codes and standards. (2) The capacity of storage tanks to resist natural disasters such as earthquakes and floods can be increased by anchoring to a certain extent [44]. (3) Flexible pipe joints and flexible pipes can reduce damage to tank flanges and connecting pipes [45].
Measures to reduce the impact of technical disasters	(1) Active safety barriers such as fire early warning systems, pressure relief valves, automatic emergency shutdown valves, high-pressure water guns, fire foam systems, automatic sprinkler systems, fire hydrants, etc. [23,46]. (2) Passive safety barriers such as a blast wall, protective net, protective dike, etc [47]. (3) For the design of safety barriers, the impact of natural disasters should be considered, the ability of the safety barrier to resist natural disasters should be strengthened, and the emergency response when the safety barrier is unavailable due to natural disasters should also be considered [46]. (4) Safety barriers should be inspected and maintained regularly [47].
Measures to increase the ability of equipment to resist technical disasters	(1) The passive safety barriers, such as thermal insulation, fireproof coating, and flame-retardant materials for process equipment, can be used to strengthen the equipment’s resistance to technical disasters [22,34,47]. (2) The design standards of equipment should be improved.

.

In addition, in view of the rapid development of science and technology in the world and the continuous emergence of new technologies and new equipment, in order to meet the development needs of the era of Industry 4.0, the Internet of Things, big data, cloud computing and other technologies should also be combined in the design stage. In the new reconstruction and expansion projects of a park, the safety level of the park can be improved by gradually realizing automation and intelligent development so as to effectively prevent domino effects caused by natural disasters [48].

3.2.3. The Stage of Operation

Because the risks caused by natural disasters will change over time, and because the operation life of industrial facilities and the infrastructure of a chemical industrial park is long, natural disasters and their subsequent domino effects should be considered not only in the design stage, but also during the operation stage. The risk-reduction measures of Natech events and domino effects in the operation stage mainly include engineering technical measures and organizational management measures. The engineering technical measures mainly include the monitoring and early warning of natural disasters and hazard sources, and the organizational management measures are to reduce the risk to people, including safety management and education, regular inspections, risk assessments, emergency plans and emergency drills. The specific measures are shown in

Table 4. Mitigation measures in the stage of production management.

Mitigation Strategy	Specific Measures
Monitoring and early warning	(1) Government organizations should use ground sensing, satellite remote sensing, aviation monitoring and other data to establish a monitoring and early warning system for potential natural disaster areas with the functions of regular regional monitoring and identification, remote fixed-point strengthening, and real-time ground monitoring to solve existing problems such as too many blind spots for natural disaster monitoring and untimely early warning for potential natural disaster areas in key regions [1]. (2) Government organizations should keep in touch with enterprises and the public on regarding the current situation for natural disasters, such as earthquake risk maps and flood risk maps, and they should issue timely meteorological early warnings during high temperatures, typhoons and rainstorms. (3) Chemical parks or chemical plants should strengthen their monitoring and early warning systems for natural disasters such as typhoons, lightings, floods, debris flow and landslides, and they should predict the safety risks induced by natural disasters in advance. (4) Risk monitoring of the hazard sources of chemical enterprises can be implemented, which can be used to realize the 24 h online real-time monitoring and remote data transmission of major hazard warning parameters, such as temperature, pressure, liquid level, flow, flammable and toxic gas leakage, and to effectively control the production process and monitor abnormal behaviors [49]. (5) Chemical enterprises can use the Internet of Things, 5G, big data and other technologies to monitor natural disasters and major hazard sources, and they can conduct data mining and analysis through big data and artificial intelligence, realize situation awareness and scenario deduction, and realize real-time risk monitoring and early warning for enterprises, key sites, major hazard sources and infrastructures in the park with the help of intelligent early warning and emergency platforms. (6) The early warning system should be regularly tested, maintained and updated to inform enterprises and communities of impending natural disasters. Furthermore, the emergency plan should take into account the existing early warning system, and it should formulate in advance what actions should be taken to respond to the natural disaster warning [49].
Safety management and education	(1) Chemical enterprises should pay more attention to the safety management of the Natech events and their domino effects. On the one hand, they should establish safety management regulations to deal with such emerging risks; on the other hand, the publicity and education of such risk management systems should be strengthened to improve the staff’s awareness of such risks. (2) Government organizations and plants should provide factory managers and employees with sufficient knowledge about natural disaster-related accidents so that they can understand natural disasters and the subsequent domino effect risks and master the prevention and control ability of such accidents.
Regular inspection	(1) Safety facilities and equipment that prevent natural and technological disasters should be regularly inspected to ensure that they can still operate under adverse conditions. (2) The effectiveness of existing protective measures and safety barriers should be regularly tested to ensure that they can work normally under natural disasters [47].
Risk assessment	(1) The risk of the Natech events and their domino effects should be considered in the quantitative risk assessment, and countermeasures to eliminate, reduce and control the safety risk should be proposed according to the risk assessment results. (2) The safety production management organization of the chemical industrial park shall delimit the planned land safety control line around the chemical industrial park according to the overall risk assessment results and the requirements of relevant laws and regulations.
Emergency plan and emergency drill	(1) The existing emergency plans should be revised to ensure that they take into account the possible consequences of earthquakes, floods, lightning, hurricanes and other natural disasters [24]. (2) The emergency plans for natural and technological disasters should be integrated to cope with the Natech events and their domino effects simultaneously. (3) The emergency plans should take into account the worst and most likely situations, as well as the possible impact of climate change on natural disasters. (4) The emergency plans should take into account the possible impact of natural disasters on infrastructure and emergency rescue capacity, including the potential impact on water and power supply, road traffic and communication systems. (5) Chemical enterprises should focus on the creation of emergency response teams, carry out special emergency drills for Natech events, improve the emergency response plans, and strengthen the reserve of emergency equipment and materials. (6) Natech emergency response personnel need to receive special education and training to master complex accident-handling procedures.
Auxiliary stand-by systems	(1) Chemical enterprises should establish a duplicate power supply system and regularly inspect and maintain it to ensure the normal operation of the dual power supply system. (2) Control systems must be equipped with industrial-grade UPS power supply products to ensure an uninterrupted power supply.

.

3.2.4. The Stage of Emergency Response

Emergency response is a series of safety technology and safety management measures taken to minimize fatalities and property losses when the accident occurs. The emergency response of Natech events and their domino effects is to control the further escalation and reduce losses so as to minimize the risk [24]. The specific measures are shown in

Table 5. Mitigation measures in the stage of emergency response.

Mitigation Strategy	Specific Measures
Emergency rescue force	Due to the impact of natural disasters on a large area, the emergency rescue forces from all parties, including rescue forces from government authorities and social rescue forces, need to be coordinated according to the state of the Natech events. For example, the participants include rescue personnel, fire brigades, medical teams, park information management personnel, logistics support personnel, communication experts, etc. Furthermore, the intelligent emergency decision support system can be established to assist in the rapid and accurate distribution and coordination of emergency rescue forces and rescue equipment.
Emergency rescue equipment	When carrying out an emergency response to Natech accidents and their subsequent domino effects, the possibility of the unavailability of these on-site fire-fighting facilities should be considered, and more fire-fighting and rescue materials need to be transferred from outside. Intelligent emergency rescue equipment is also suggested, such as search and rescue robots, intelligent wearable equipment and communication equipment.
Lifeline project	Helicopters, unmanned aerial vehicles and other equipment can be considered during rescue when the lifeline project is unavailable.
Auxiliary stand-by systems	During a main circuit power outage, use of a backup circuit or UPS power supply can be attempted during an emergency shutdown.
Emergency evacuation	Emergency evacuation is an effective measure to prevent damage caused by Natech events and their domino effects.

.

In natural-disaster-prone area, the emergency response to a Natech event needs to consider the possibility of leakage of hazardous substances caused by natural disasters, and it needs to consider the impact of fires and explosions caused by the subsequent domino effects on rescue personnel and rescue operations. These emergency response needs to consider the challenges of road access barriers caused by earthquakes and flooding. In addition, it is also necessary to consider the possible violent reaction between the released hazardous substances and floods, as well as the impact of toxic gases that may be generated after the combustion of chemicals.

At present, the design of a safety barrier seldom considers the impact of natural disasters, so these safety measures, such as fire protection systems and protective dikes, may not be available during natural disasters [30]. Therefore, when carrying out an emergency response to a Natech event and its subsequent domino effects, it is necessary to consider the unavailability of these on-site firefighting facilities, and more firefighting and rescue equipment and materials need to be transferred from outside [50]. Natural disasters may also affect the power grid, water supply, and communication systems, thus weakening the emergency response capacity, which is a major challenge for the emergency response.

3.2.5. The Stage of Post-Disaster Recovery

After a disaster occurs, government organizations should investigate the accident sites, carefully summarize the accident experiences and lessons, and conduct an accident investigation and case analysis so as to find out and fill in the gaps, prevent the occurrence of such accidents in the future, and reduce the accident consequences. Currently, accident investigations and recording are mostly concentrated on technical disasters, and there is no detailed record of Natech events and domino effects. Therefore, it is necessary to collect information related to natural disasters and domino effects, such as the reasons for equipment failure and failure modes caused by natural disasters, and the propagation sequences of the domino effects, etc., in order to provide basic data for subsequent accident statistics and analysis [51].

After the accident investigation, the accident sites should be cleaned, and the damaged equipment and facilities should be repaired. In addition, after the occurrence of natural disasters, epidemic prevention and control should be strengthened, the damaged equipment should be replaced or reinforced, and the key equipment units should be reinforced according to the new design standards.

Finally, the hazard factors and weak spots in the chemical industrial park should be evaluated, and improved prevention and control measures should be put forward at the stages of site selection, design, production and operation, and emergency response. After taking corresponding mitigation measures, the risk level should also be reassessed to ensure that the risk is at an acceptable level.

4. Case Study

In order to discuss the feasibility of applying the path probability prediction method proposed in Part I to quantitative risk assessment and mitigation, the developed risk assessment model and mitigation system were applied to an illustrative tank farm that is consistent with the tank farm in Part I, wherein the total number of employees around the tank farm is 86. As for the internal risk in the plant, the international large petrochemical companies generally adopt the standard of individual risk contour as $1\times {10}^{-3}$ per year [35], so this paper also takes the individual risk contour of $1\times {10}^{-3}$ per year as the internal risk acceptance standard for plants.

According to the risk assessment model of domino effects induced by natural disasters proposed in this paper, their risk mainly includes risk of conventional scenarios and risk of Natech events and the subsequent domino effects induced by said Natech events, and risk is represented by the product of accident probability and accident consequence. The equipment failure probability in the conventional scenario can be determined by referring to the recommended value in the TNO purple book [35], which can be appropriately modified according to the actual situation of the plant. The equipment failure probability during Natech events can be determined by combining the vulnerability assessment model with the frequency of natural disasters, and the equipment failure probability of a domino effect induced by the Natech event can be obtained from the cumulative failure probability calculated in Part I.

The accident consequence can be calculated by the accident consequence analysis model in the SAFETI 8.21 risk assessment software, in which quantitative risks are obtained with a combination of consequence and frequency analysis [52], but the SAFETI 8.21 software can only calculate the risk level of the conventional accident scenario [53]. In this paper, combined with the quantitative risk assessment model proposed in Section 2, the revised probability value is input into the SAFETI 8.21 software, and the risk assessment module of SAFETI 8.21 is used to realize the risk assessment of the domino effects induced by natural disasters.

4.1. Individual Risk

In order to evaluate the individual risk of a tank farm in the case under different scenarios corresponding to the scenarios presented in Table 6 of Part I (the first paper of this work), the individual risk contours of four different scenarios are shown in Figure 4, which were obtained using the equipment failure probability data calculated in Part I and the SAFETI 8.21 risk assessment software. Figure 4d shows the individual risk contours under the conventional scenario; the maximum risk contour is 10⁻⁶, and its profile is around T1–T5, which is still within the plant. Compared to the maximum individual acceptable risk criteria of 10⁻³ within a chemical plant, the individual risk is within the acceptable range under the conventional scenario.

Figure 4a shows the individual risk contours under a Natech scenario. It can be seen from Figure 4a that the scopes of the individual risk contours are larger compared to the conventional scenario, and new individual risk contours of 10⁻⁵–10⁻³ appear. The risk contour of 10⁻³ around T2, T3 and T5 exceeded the risk acceptable standard, indicating that the Natech scenario in this case significantly increased the individual risk level, resulting in an individual risk in an unacceptable range, and corresponding mitigation measures had to be taken to reduce the risk of such a Natech event.

Figure 4b presents the individual risk contours when considering the Natech scenario and its subsequent multi-level domino effects. It can be seen from Figure 4b that when considering the multi-level domino effects, the ranges of risk contours are further expanded; in particular, the unacceptable risk area represented by the individual risk contour is further expanded, indicating the risk-aggravating effect of the multi-level domino effects. Therefore, mitigation measures must be taken to reduce the risk caused by the domino effects while mitigating the Natech events.

Figure 4c shows the individual risk contours in a scenario of single-level domino effects induced by Natech events. Compared to Figure 4a,b, the range of the individual risk contours in the scenario with single-level domino effects is larger than that in the Natech scenario but smaller than that in the scenario with multi-level domino effects; thus, it can be concluded that ignoring the multi-level domino effects will lead to the underestimation of risk.

4.2. Social Risk

Figure 5 shows the social risk curves considering only a conventional accident scenario. It can be seen from Figure 5 that the social risk under the conventional scenario is almost in the risk acceptable range, indicating that the social risk of the conventional scenario is at an acceptable level.

Figure 6 shows the social risk when considering a Natech scenario. It can be seen from Figure 6 that Natech events will significantly increase the social risk level, resulting in a social risk in the unacceptable zone, indicating that mitigation measures must be taken to mitigate Natech events to prevent such accidents and ensure risk within the acceptable range.

Figure 7 shows the social risk curve under the scenario with multi-level domino effects induced by Natech events. Compared to only considering a Natech scenario, the risk of multi-level domino effects caused by the Natech events has slightly increased, but the increase is not obvious. The main social risk is mostly caused by the Natech scenario, indicating that the prevention and control of such accidents should be mainly based on the mitigation of Natech events and supplemented by domino effects.

4.3. Quantitative Assessment of Risk Mitigation Effects

According to the results of the quantitative risk assessment and considering the influence of Natech events and the subsequent multi-level domino effects, both the individual risk and the social risk of the tank farm in that case are at an unacceptable level, so mitigation measures must be taken to reduce the risk level. Due to the large number of dangerous equipment units in the chemical industrial park, it is costly and impractical to take strict mitigation measures for all the equipment units. Therefore, targeted mitigation measures should be taken for the key equipment units identified in Part I to achieve cost savings while ensuring acceptable risks.

According to the results in Part I, it can be seen that T2, T3 and T6 are the equipment units with the highest probability of failure in a flood scenario; that is, these equipment units are most vulnerable to natural disasters or the most dangerous primary equipment units. If the targeted mitigation measures of Section 3 are adopted for these dangerous tanks and if the propagation paths in the domino effects are cut off from the accident source—i.e., if the most dangerous primary equipment units are protected— then the probability of a Natech accident can be effectively reduced. It is assumed that T2, T3 and T6 will not be affected by natural disasters after taking targeted mitigation measures; that is, the failure probability caused by natural disasters is 0. Their individual risk contours and social risk curve are shown in Figure 8a and Figure 9, respectively.

As can be seen from Figure 8a and Figure 9, after taking mitigation measures for these three equipment units, the individual risk can be significantly reduced to an acceptable level, and the social risk can also be reduced to the area where risk needs to be reduced as much as possible, indicating that cutting off the propagation paths at the primary stage is the most effective mitigation strategy. In order to further reduce social risk to the acceptable level, it is also necessary to take targeted mitigation measures for the most dangerous target equipment units from the perspective of domino effects.

If only taking mitigation measures to reduce the risk from the perspective of domino effects, it is known from the analysis in Part I that T5 and T7 are affected by domino effects and have the highest failure probability during domino effects, which can be considered as the most dangerous target equipment units. If the mitigation measures proposed in Section 3 are applied to prevent domino effects for T5 and T7, and if the accident consequences of T5 and T7 are limited by these mitigation measures, then the two tanks will not be affected nor will they affect other tanks. The individual risk contours and social risk curve are shown in Figure 8b and Figure 10, respectively, and reveal that the individual risk and the social risk are still in the unacceptable area, indicating that the risk level cannot be effectively reduced only from the mitigation perspective of the domino effects, which is consistent with the conclusion drawn in Section 4 of Part I, wherein the primary accident scenario had a great influence on the equipment failure probability. Therefore, it is necessary to study the mitigation measures for Natech events and their domino effects simultaneously, the Natech mitigation measures should be the main measures, and the domino mitigation measures should be supplemented measures so as to effectively reduce the risk of chemical industrial park.

5. Conclusions

In this paper, the assessment models of the individual risk and the social risk of domino effects induced by Natech events were developed. The case analysis shows that the risk of the case tank farm in the conventional scenario is at an acceptable level, but the risk will significantly increase to the unacceptable area when considering the impact of Natech events and multi-level domino effects, indicating that the impact of Natech events and multi-level domino effects cannot be ignored.

Furthermore, this paper puts forward a chain-cutting disaster mitigation model of domino effects induced by natural disasters, and the full-life-cycle mitigation system and corresponding countermeasures are proposed based on this model at each stage—site selection and layout, design, production and operation, emergency response and post-disaster recovery—so as to open up a new way for the prevention and control of the Natech events and their domino effects. After taking mitigation measures for the most dangerous primary equipment units, the risk reduction effect is better than that of the most critical target equipment units, indicating that the mitigation of domino effects induced by natural disasters should be based on the mitigation of Natech events and supplemented by the mitigation of domino effects, and the desired goal can be achieved with the combination of the two measures together.

It should be noted that with the full-life-cycle mitigation system based on the model of chain-cutting disaster mitigation proposed in this paper, most of the measures only analyzed the prevention and control measures and the key points of the domino effects induced by the Natech events from a qualitative perspective, and it did not fully quantify the effectiveness of the mitigation measures, such as the impact of safety barriers. In addition, this work only considers the most dangerous or frequent natural disaster scenarios, such as earthquakes, floods, and lightning, while other disasters such as wildfires are not currently considered. In future research, a quantitative mitigation system and other disasters such as wildfires can be considered.