Risk Analysis, Vol. 33, No.

2, 2013

DOI: 10.1111/j.1539-6924.2012.01854.x

Domino Effect Analysis Using Bayesian Networks

Nima Khakzad,1 Faisal Khan,1, Paul Amyotte,2 and Valerio Cozzani3

A new methodology is introduced based on Bayesian network both to model domino effect
propagation patterns and to estimate the domino effect probability at different levels. The
flexible structure and the unique modeling techniques offered by Bayesian network make it
possible to analyze domino effects through a probabilistic framework, considering synergistic effects, noisy probabilities, and common cause failures. Further, the uncertainties and the
complex interactions among the domino effect components are captured using Bayesian network. The probabilities of events are updated in the light of new information, and the most
probable path of the domino effect is determined on the basis of the new data gathered. This
study shows how probability updating helps to update the domino effect model either qualitatively or quantitatively. The methodology is applied to a hypothetical example and also to an
earlier-studied case study. These examples accentuate the effectiveness of Bayesian network
in modeling domino effects in processing facility.
KEY WORDS: Bayesian network; domino effect; risk analysis

1. INTRODUCTION

sequence of secondary accidents as nearby equipment items or units are involved in the accident by
means of heat, overpressure, and/or by the impact of
explosion-induced airborne fragments.
Although a remarkable progress in the risk and
safety analysis of individual accident scenarios limited to a single unit has been achieved in recent years,
domino accidents have gained less attention in the
context of quantitative risk assessment (QRA) both
because of their lower probability and higher complexity. However, frequent violent domino accidents
took place in the last decade(2,3) such as that occurred
in the BP Texas City refinery, where a vapor cloud
explosion (VCE) was followed by several other fires
and explosions.(4) These severe events have urgently
raised the demand for consideration of domino scenarios in quantitative risk analysis and safety reports.
Accordingly, the study of domino effects in the
literature has primarily been focused either on damage probability or on domino effect frequency estimation. Damage probability, alternatively known
as escalation probability, has been estimated using
distance-based models,(5) threshold values,(6) probit models,(79) combination of threshold values and

Domino effects or chains of accidents in which an

accident in a unit propagates into nearby units have
recently been recognized as a priority issue among
the risk and safety community experts (e.g., see the
requirements of the EU Seveso-II Directive(1) and
its amendments). This is partly owing to the fact
that todays ever growing industries are complex and
congested by dense pipelines, process equipment,
and storage tanks, most of which contain or transport hazardous material. Thus, it is not unlikely for
a primary event to evolve to a much more severe
1 Process

Engineering, Faculty of Engineering and Applied

Science, Memorial University of Newfoundland, St. Johns, NL,
Canada A1B 3X5.
2 Department of Process Engineering and Applied Science,
Dalhousie University, Halifax, Nova Scotia, Canada B3J 2X4.
3 Dipartimento di Ingegneria Chimica, Mineraria e delle Tecnologie Industriali, Alma Mater Studiorum, Universita` di Bologna,
via Terracini 28, 40131, Bologna, Italy.
Address correspondence to Faisal Khan Process Engineering,
Faculty of Engineering and Applied Science Memorial University of Newfoundland, St. Johns, NL, Canada A1B 3X5; tel:
+1 709 864 8939; fax: +1 709 864 6793; fikhan@mun.ca.

292

C 2012 Society for Risk Analysis

0272-4332/13/0100-0292$22.00/1 

Domino Effect Analysis

probit models,(10,11) and mathematical models based
on the characteristics of secondary units and the surrounding environment.(12,13)
Although the frequency estimation and the sequence of accidents in domino effects have been investigated using statistical surveys,(3,14,15) there are
few works devoted to domino modeling and accident propagation, particularly in the context of
QRA.(12,1620)
However, these works have drawbacks such as
being mostly deterministic or using oversimplified assumptions, limiting their application in the framework of QRA. More importantly, most of the previous research has neither recognized nor included the
higher levels of domino effects, but only the first level
of accidents where primary and secondary events are
taking place. This shortcoming not only gives rise
to an underestimation of the potential risk, but it
also leads to an improper allocation of safety measures (e.g., safety distances among adjacent units) because higher-order events (e.g., tertiary events) and
the synergistic effect of events of different orders are
not considered in the modeling. Furthermore, in almost all foregoing works, the evolution pattern of
domino accidents has not been taken into account,
leading to the analysis of a cluster of accidents rather
than a chain of accidents. Thus, a holistic probability
has been calculated for domino effects, neither specifying the actual time line of the escalation process
nor privileging the more likely time sequences of the
domino scenario.
For example, Cozzani et al.(16) took all possible
accident scenarios triggered by a primary event into
account to cope with the uncertainty arisen from the
lack of knowledge about the actual accident propagation pattern. In their work, each accident scenario is a combination of the failure and nonfailure
of all secondary units that are likely to be impacted
by the primary event, and frequency is estimated
as a multiplication of probabilities. Later, Cozzani
et al.(21) and Antonioni et al.(17) implemented the approach in a GIS-based software tool, Aripar-GIS, to
allow its application in the analysis of industrial facilities or extended industrial areas. Most recently,
Abdolhamidzadeh et al.(18) applied Monte Carlo simulation to capture the dependencies between the primary event and the secondary events. However, the
selection of secondary events was similar to that of
Cozzani et al.(16) and was based on randomly generated numbers, ignoring the actual accident propagation path.

293
It is worth noting that knowing the likely pattern
and time line of accident propagation not only results
in a more realistic and accurate probability calculation, but it also helps the analyst choose the most efficient placement of safety barriers, whether passive
or active, to impede the progress of an accident or
cease it in the early stages.
Bayesian network (BN) is a probabilistic graphical method for reasoning under uncertainty(22) that
has recently started to be used as a promising substitute for the majority of conventional methods in
risk analysis and reliability engineering. A comprehensive statistical review of BN application can be
found in Ref. 23, where the growing appeal of BN
in various areas of reliability, risk, and maintenance
engineering has been shown over the last decade.
The reason for the popularity of BN among analysts lies in the fact that it benefits from both qualitative and quantitative modeling techniques. On the
one hand, BN takes advantage of its highly flexible
graphical structure to show the causal relationships
among the nodes of the network. And, on the other
hand, it determines the strength of such causal relationships through conditional probabilities assigned
to the nodes. If the system under study (e.g., a chemical process plant comprising several units) could be
considered as a set of variables (i.e., each variable
stands for a unit or an equipment item, depending
on the level of detail of the analysis), BN would be
used to factorize the joint probability distribution of
variables using the chain rule and d-separation rule,
significantly reducing the system complexity.
This article introduces a new methodology based
on BN for probability estimation and propagation
path determination of domino effects. After the
propagation network is developed based on escalation vectors and threshold values, it is modified to estimate the probability of domino effect in different
levels. The study also takes into account the possible synergistic effects of the primary event and secondary events to examine the possibility of domino
effect escalation to higher-order events such as tertiary events and so forth.
As the main purpose of this work is to establish a methodology for modeling and risk assessment
of domino effects, it does not focus in detail on the
methods used either to estimate escalation probabilities or to calculate physical effects such as heat radiation or explosion overpressure needed for escalation probability estimation. The article benefits from
generic data available in the literature or applies

294
simple methods to obtain those data lacking in the
literature.
Because the domino effect definition, characteristics, components, and relevant case studies have
been comprehensively discussed in the literature,
only the terminology and main concepts used in this
article are recapitulated in Section 2. After a brief
review of the fundamentals of BN in Section 3, the
modeling framework of domino effect is presented
in Section 4, in which both propagation path and
probability estimation are modeled. In Section 5, a
practical application of the methodology is presented
whereas the conclusions from this work are discussed
in Section 6.

2. DOMINO EFFECT: TERMINOLOGY

AND CHARACTERISTICS
2.1. Accident Propagation
Domino effect takes place when an accident in
a unit, known as a primary event, triggers other
accidents in adjacent units by means of escalation
vectors. Escalation vectors are physical effects such
as fire impingement, fire engulfment, heat radiation,
overpressure, or explosion-induced projectile fragments, depending on a variety of factors such as the
type of the primary event and the distance between
the accident epicenter and nearby units. There are
several methods to calculate escalation vectors, such
as analytical models, integral models, and averaged
models, which are a combination of the two former
models.(2426)
To determine which nearby units are impacted,
the escalation vectors exerted by the primary event
on the nearby units are compared with predefined
threshold values (e.g., see Ref. 11 for threshold values of heat radiation and overpressure). The escalation vectors well above the relevant thresholds
are strong enough to cause credible damage to the
nearby units, resulting in loss of containment or loss
of physical integrity. Thus, based on a comparison
between escalation vectors and threshold values, a
preliminary screening of the nearby units is performed, leading to the specification of potential secondary targets. Fig. 1 shows the outset of a domino
effect in which the primary event in unit X 1 impacts
its neighboring units. It is assumed that based on
threshold values, units X 2 , X 3 , and X 4 are selected
as potential secondary target units.
In other words, potential secondary units are
those adjacent units that are more likely to con-

Khakzad et al.

X1

X2

X5

X4

X6

X3

Fig. 1. Domino effect where an accident in X 1 can trigger secondary accidents in X 2 , X 3 , and X 4 . According to threshold values, X 5 and X 6 are not impacted by X 1 .

tribute to the domino effect. The inclusion of secondary units in the domino effect not only intensifies the accident, causing more severe consequences,
but also helps the domino effect escalate to the next
level by impacting tertiary units. The escalation vectors originating from secondary events in turn trigger
other accidents in tertiary units either by themselves
or through synergistic effects.
Generally speaking, through synergistic effects,
the escalation vectors of newly engaged units (of order i) cooperate with those of already engaged units
(of order i 1) to impact the units of higher order
(of order i + 1) that had not passed the threshold
criteria in previous levels. For example, according to
Fig. 1, units X 5 and X 6 are more likely to be involved
in the domino effect as the escalation vectors of the
secondary units X 2 , X 3 , and X 4 are added to that
of the primary unit X 1 , promoting the domino effect
from the first level to the second level.
2.2. Escalation Probability
As mentioned earlier, the initial selection of
potentially vulnerable units in each level of domino
effect is performed based on a comparison between
escalation vectors and threshold values. By this procedure, although a qualitative propagation pattern of
the domino effect would be schematized, the model
cannot be quantitatively analyzed unless the escalation probabilities of vulnerable units are determined.
Among methods proposed in the literature,
probit methods(79,16,17) have been widely used to
estimate the escalation probability of equipment

Domino Effect Analysis

295

because of simplicity and flexibility, enabling application to a wide variety of equipment.(9) Probit methods may consider both the type of equipment (e.g.,
atmospheric or pressurized) and the type of escalation vector the equipment receives (e.g., heat radiation or explosion overpressure) to calculate the
probit value Y.(16)
Generally, Y can be obtained using Equation (1):
Y = a + b ln(V),

(1)

where a and b are probit coefficients determined using experimental data and regression methods, and
V is either the escalation vector (e.g., static overpressure P [kPa] in the case of explosion) or an
escalation-related parameter (e.g., time to failure
of the vulnerable equipment, ttf (s), in the case of
heat radiation). After Y is determined, the escalation
probability, PEscalation , could be calculated as:
PEscalation = (Y 5),

(2)

where is the cumulative density function of standard normal distribution. In this study, the probit
methods proposed by Cozzani et al.(16) are used to
obtain the probit values for overpressure and heat radiation.
Single-hit dose-response models such as probit
models express the escalation probabilities as a function of escalation vectors. However, significant uncertainty arising from the lack of information or the
extrapolation of escalation vectors has caused the
probit models to lead to different results.(27) Therefore, multi-hit dose-response models have been proposed to overcome such limitations with a promising
potential of application in domino effect modeling.
However, as the main aim of this work is to introduce
a new methodology based on BN, it does not further
discuss such models, which are an important area of
future exploration.
3. BAYESIAN NETWORKS
BN is a directed acyclic graph for reasoning under uncertainty in which the nodes represent variables and are connected by means of directed arcs.
The arcs denote dependencies or causal relationships
between the linked nodes, whereas the conditional
probability tables (CPTs) assigned to the nodes determine the type and strength of such dependencies.
In BN, nodes from which arcs are directed are called
parent nodes whereas nodes to which arcs are directed are called child nodes. In fact, a node can simultaneously be the child of a node and the parent

of another node. The nodes with no parent and the

nodes with no children are also called root nodes and
leaf nodes, respectively.(22)
Using the chain rule and the d-separation criterion, BN expands the joint probability distribution of
a set of linked nodes, e.g., U = {X1 , X2 , . . . , Xn }. In
other words, by considering only local dependencies,
BN factorizes the joint probability distribution as the
multiplication of the probabilities of the nodes given
their immediate parents:(22)
P(U) =

n


P(Xi |Pa(Xi )),

(3)

i=1

where P(U) is the joint probability distribution of

variables and Pa(Xi ) is the parent set of variable
Xi . The main application of BN is in probability
updating. BN takes advantage of Bayes theorem to
update the probability of variables given new observations, called evidence E, to yield the posterior
probability:
P(U |E) =

P(U, E)
P(U, E)
=
.
P(E)
P(U, E)

(4)

In addition to its capability for probability updating, the flexible structure and modeling techniques
of BN, which allow incorporating conditional probabilities, multistate variables, and common cause failures, have helped it emerge as a reliable alternative
to most conventional methods. Accordingly, it has
been applied as a substitute for reliability block diagrams,(28) fault trees,(29,30) event trees,(31) and bowties(32) in the context of risk assessment and safety
analysis.
However, the capability of BN in the modeling of
domino effects, where complex interactions of variables cannot be neglected, has not yet been examined. So, the next section is aimed at showing how
BN can be employed for either qualitative or quantitative investigation of domino effects.

4. DOMINO MODELING
4.1. Propagation Pattern
To model the likely propagation path of domino
effect, the following steps are taken:
Step 1: According to the layout of the process
plant of concern, a node is assigned to each process
unit. These units are either susceptible to the accident or capable of escalating the accident, including

296

Khakzad et al.
(3)
X2

(1)

X1

(4)
X5

(2)
X3

(4)
(3)
X4

X6

Fig. 2. A likely propagation pattern of the domino effect. The

numbers in parentheses show the occurrence orders of events (step
4 of the methodology).

distillation columns and atmospheric and pressurized

storage tanks. For example, assume a process plant
with six units (Xi , with i ranging from 1 to 6. See
Fig. 2).
Step 2: Using safety reports usually available for
process plants or through risk assessment methods,
the primary unit where the domino accident is likely
to start is determined (e.g., X 1 in Fig. 2). It is worth
noting that considerations such as having a reasonably high occurrence probability and having enough
inventory of hazardous material to produce credible
escalation vectors should be taken into account when
choosing the primary unit.
Step 3: According to the type of possible accident scenarios in the primary unit, the escalation
vectors transmitted by the primary unit to nearby
units are specified(16,17) for different accident-related
escalation vectors) and calculated. Methods for
calculation of escalation vectors such as heat radiation and explosion overpressure can be found in
CCPS,(24) the TNO Yellow Book,(25) and Assael and
Kakosimos.(26)
Step 4.1: Based on a comparison between predefined threshold values and escalation vectors, those
nearby units for which the received escalation vectors
exceed the threshold values are defined as potential
secondary units (e.g., X 2 , X 3 , and X 4 in Fig. 2).
Step 4.2: In the case of fire or explosion, the probit values (Y) are calculated for the potential secondary units.
Step 4.3: Using the probit values, the escalation
probability of potential secondary units given the primary event, i.e., P(X2 |X1 ), P(X3 |X1 ), and P(X4 |X1 ),

is calculated. It should be noted that in the case of

fragment impact, conditional damage probabilities
may be calculated by other approaches, such as those
suggested by Nguyen et al.(33)
Step 4.4: Among the potential secondary units,
the one(s) with the highest escalation probability is
chosen as the secondary unit (for example, X 3 in
Fig. 2). Because the secondary events are caused by
the primary event, a causal arc must be directed from
X 1 to X 3 , showing that the occurrence of X 3 is conditional on the occurrence of X 1 .
Step 5: Given that the secondary units have been
damaged, potential accident scenarios and their occurrence probabilities for the secondary units are
specified. These accident scenarios can effectively be
identified using advanced hazard identification methods such as methodology for the identification of major accident hazards (MIMAH) considering the type
of equipment, type of substance released, type of
damage (e.g., catastrophic rupture, vessel collapse,
large breach on the shell, and pipe leakage), and the
vicinity of ignition source.(34,35)
Step 6: Substituting the secondary units for the
primary unit, steps 3 to 5 are repeated to determine
potential tertiary units (e.g., X 2 and X 4 ), potential
quaternary units (e.g., X 5 and X 6 ), and so forth. In
this case, it has been assumed because X 2 and X 4
(X 5 and X 6 ) have the same escalation probabilities,
they both are selected as tertiary (quaternary) units.
Fig. 3 illustrates the flow diagram consisting of the
above-mentioned steps, which are taken to develop
the propagation pattern of the domino effect.
It is worth noting that when repeating the same
procedure (i.e., steps 3 to 5) for either the secondary
units or higher-order units, synergistic effects should
be considered. For example, in Fig. 2, X 2 and X 3 cooperate with each other (i.e., their escalation vectors
are superimposed) to trigger an accident in X 5 . So,
causal arcs have to be directed from X 2 and X 3 to
X 5 , showing the conditional dependency of the latter on the former units. Accordingly, when assigning
the CPT of X 5 , the escalation probability of X 5 because of the synergistic effect is also considered as
P(X5 |X2 , X3 ).
After the likely propagation pattern of the
domino effect is developed as a BN, and the probability of the primary event and the conditional
probabilities of other events are calculated, the joint
probability distribution of the events contributing to
the domino effect can be derived. For instance, in
Fig. 2, the joint probability distribution of the events
contributing to the domino effect U = {X1 , . . . , X6 } is

Domino Effect Analysis

297

Step 1

P(X5 |X2 , X3 )P(X6 |X3 , X4 ).

Step 2

Specification of
primary unit
Step 5

Identification of
accident scenarios

Step 3

Calculation of
escalation vectors

Step 4.1

Propagation of domino
effect to the next level

Comparison with
threshold values

Step 4.2

Calculation of probit
values

Step 4.3

Estimation of escalation
probabilities

Step 4.4

Identification of
secondary units

(5)

It should be noted that choosing another starting point rather than X 1 would result in a BN different from that developed in Fig. 2 and consequently
a joint probability distribution different from that
shown in Equation (5). However, assuming X 1 as
the primary unit and according to Fig. 2 and Equation (5), the likely timeline or sequential order of the
events would be as X1 X3 X2 / X4 X5 / X6 .
4.2. Domino Probability
Knowing the propagation pattern of the domino
effect, the occurrence probability of the domino effect at different levels can be estimated. Generally,
the probability of the domino effect (PDomino ) is calculated as the multiplication of the probability of the
primary event (PPrimary ) and the escalation probability of the impacted units (PEscalation ):
PDomino = PPrimary PEscalation .

Identification of potential
secondary units

Step 6

calculated as:
P(U) = P(X1 )P(X3 |X1 )P(X2 |X1 , X3 )P(X4 |X1 , X3 )

Identification of
credible units

(6)

For a domino effect to be in the first level, it is

necessary that the accident in the primary unit propagates into at least one of the nearby units. For example, in Fig. 2, considering X 3 as the secondary unit,
the probability of the first-level domino effect is calculated as:
PFirst level = P(X1 )P(X3 |X1 ).

(7)

Similarly, the domino effect could proceed to the

second level only if at least one of the tertiary units
X 2 and X 4 is impacted by the first-level domino accident (i.e., by a combination of X 1 and X 2 ). Accordingly, the probability of the second-level domino effect is calculated as:
PSecond level = P(X1 )P(X3 |X1 )P(X2 X4 |X1 , X3 ). (8)

Yes

Are there other

units?
No
Propagation
termination

Fig. 3. Procedure to develop the propagation pattern of domino

effect.

To account for the union of X 2 and X 4 represented in Equation (8), Fig. 2 can be modified by
adding the auxiliary node L1 such that L1 = X2 X4
(Fig. 4). So, X 2 and X 4 are connected to L1 using
OR-gate causal arcs,(29,30) resulting in the CPT shown
in Table I for the node L1 . It should be noted that
the probability of L1 equals the propagation probability of the domino effect to the second level, i.e.,
the probability that at least one of the tertiary units
X 2 and X 4 is involved in the accident.
Similarly, for the domino effect to proceed to the
third level, it is necessary that the accident in the

298

Khakzad et al.

X2

X1

X3

X5

L1

L2

X4

X6

Table I. The CPT Assigned to the Auxiliary Node L1 Showing

that it is Conditionally Dependent on its Parents Through an
OR-Gate
P (L1 | X 2 , X 4 )
X2
Accident
Accident
Safe
Safe

X4

Accident

Safe

Accident
Safe
Accident
Safe

1
1
1
0

0
0
0
1

Table II. The AND-Gate CPT for Node DL1

P (DL1 | X 1 , X 3 )
X1
Accident
Accident
Safe
Safe

Fig. 4. Modified BN to incorporate the

union of tertiary and quaternary events
using auxiliary nodes L1 and L2 ,
respectively.

X3

Accident

Safe

Accident
Safe
Accident
Safe

1
0
0
0

0
1
1
1

tertiary units propagate into at least one of the quaternary units. For example, according to Fig. 2, either X 5 or X 6 has to be impacted by the second-level
domino effect to have a third-level domino effect. In
this way, the probability of the third-level domino effect is:
PThird level = P(X1 )P(X3 |X1 )P(X2 X4 |X1 , X3 )
(9)
P(X5 X6 |X2 , X3 , X4 ).
As for X 2 and X 4 , the union of X 5 and X 6 could
be accounted for by adding another auxiliary node
L2 to the BN (Fig. 4) such that L2 = X5 X6 .

Fig. 4 can further be developed to directly render

the probabilities of different-level domino effects. To
this end, the nodes DL1 , DL2 , and DL3 are added to
the BN, standing for the three sequential levels of the
domino effect, i.e., the first, the second, and the third
level, respectively (Fig. 5).
According to Equation (7), the probability of the
first-level domino effect can be estimated as the product of P(X1 ) and P(X3 |X1 ). So, if DL1 is connected to
X 1 and X 3 by AND-gate causal arcs, P(DL1 ) would
be equal to the probability of the first-level domino
effect. This implies that for the first-level domino effect to occur, not only the primary event X 1 , but also
the secondary event X 3 is needed.
Similarly, according to Equation (8), if DL2 is
connected to nodes DL1 and L1 by AND-gate causal
arcs, P(DL2 ) would be equal to the probability of the
second-level domino effect. This indicates that for
the second-level domino effect to occur, not only the
first-level domino effect (i.e., DL1 ), but at least one
of the tertiary events is also needed, i.e., L1 . Table II
shows the CPT that has to be assigned to DL1 (and
also DL2 ) to model intersection dependencies. In the
same way, according to Equation (9), if DL3 is connected to nodes DL2 and L2 by AND-gate causal
arcs, P(DL3 ) would be equal to the probability of the
third-level domino effect.
In addition to the domino effect probability, the
probability of each event because of the domino
effect can be calculated by marginalizing the joint
probability distribution of the domino effect propagation network (i.e., Equation (5)). For example, according to Fig. 2, the probability of accident in X 3

Domino Effect Analysis

299

DL1

DL2

DL3

X2

X5

Fig. 5. The complete BN for propagation

pattern and occurrence probability
estimation of the domino effect.

X1

X3

L1

L2

X4

caused exclusively by the domino effect is calculated

as:


P(X3 ) =
P(U) =
P(X1 )P(X3 |X1 ), (10)
U\X3

X1

where U/X3 states that the marginalization should be

implemented over all variables except X 3 .(24) Equation (10) can be used either to estimate the dominoderived probability of X 3 or to estimate the dominoaffected probability of X 3 . In the first case, it is
assumed that there would be an accident in X 3 only
if there is an accident in X 1 , i.e., only because of
the domino effect (domino-derived probability). In
this way, the CPT of X 3 is such as that illustrated in
Table III, in which P13 is the escalation probability of X 3 given the primary event in X 1 , i.e., P13 =
P(X3 |X1 ).
In the second case, however, it is supposed that
there would be an accident probability for X 3 even
Table III. CPT of X 3 to Estimate the Domino-Derived
Probability, Where P13 = P(X3 |X1 )

X6

if the domino effect does not occur, that is, the

primary probability of X 3 . Thus, given the domino
effect, the probability of X 3 would increase (dominoaffected probability). In this regard, one of the BN
modeling techniques, known as the noisy-OR gate,
can be used to incorporate the primary probability of
X 3 as a leak probability in the analysis.(29) Using the
noisy-OR technique, if a child node is influenced by
its parents independently of one another (disjunctive
interaction), the total effect of all the parents on the
child can be estimated as:
P(X|Pa(X)) = 1

(11)

in which Pi is the probability of X given that its ith

parent is true and the rest is false. Assuming the
primary probability of X, PLeak , as an independent
parent, the probability of X, considering its parents
and also its primary probability, would be as:
P(X|Pa(X)) = 1 (1 PLeak )

X3

(1 Pi ),

iPa(X)

(1 Pi ). (12)

iPa(X)

X1
Accident
Safe

Accident

Safe

P13
0

1 P13
1

In this regard, the CPT of X 3 is such as that illustrated in Table IV.

300

Khakzad et al.

Table IV. CPT of X 3 to Estimate the Domino-Affected

Probability; the Primary Probability of X 3 is Considered as a
Leak Probability

DL1

X3
X1
Accident
Safe

Accident

Safe

1 (1 PLeak )(1 P13 )

PLeak

(1 PLeak )(1 P13 )

(1 PLeak )

T1

T2

DL2

50 m

T2

T1

T3

Fig. 7. BN developed for the example in Fig. 6.

60 m
75 m
T3

Fig. 6. Case study for domino accident analysis.

4.3. An Example
For the sake of clarity, the application of the
methodology developed in the previous sections is
shown using a simple example. Fig. 6 depicts a tank
farm consisting of three atmospheric storage tanks
(Step 1). The characteristics of the tanks are listed
in Table V.
Because of the illustrative purpose, only one accident scenario (i.e., pool fire [PF]) and escalation
vector (i.e., heat radiation) are assumed for the units.
Because the primary probabilities are identical for all
three units, T 1 is selected as the primary unit (Step 2)
because it can produce stronger escalation vectors
(because of the larger inventory of hazardous substance). Also, the threshold value for radiation ef-

fect on atmospheric vessels is selected as Qth = 15

kW/m.(16)
To determine the possible secondary units, the
intensity of heat radiation received by T 2 and T 3 in
the case of a PF in T 1 is calculated as Q12 = 19.3
kW/m2 and Q13 = 8.3 kW/m2 , respectively (Step 3).
As can be seen, based on a comparison between the
received heat intensity and the relevant threshold
value (i.e., Qth ), T 2 is more likely to be the secondary
unit impacted by T 1 (Step 4.1). Accordingly, in the
corresponding BN, a causal arc is directed from node
T 1 to node T 2 (Fig. 7). To form the CPT of node
T 2 , the escalation probability of T 2 given the PF in
T 1 is calculated using the probit functions proposed
in Ref. 16 as P(T2 |T1 ) = 3.041 106 (Steps 4.2
and 4.3).
As noted previously, based on a comparison between Qth and Q13 , T 3 did not exceed the threshold
criteria; thus it is not selected as a secondary unit.
However, to examine the possibility of T 3 being impacted as a tertiary unit, the received radiation intensity by T 3 because of T 2 is calculated as Q23 =
9.3 kW/m2 . Compared to Qth , the PF in T 2 does not
produce sufficiently intense heat radiation to impact
T 3 . Nevertheless, considering the synergistic effect of

Table V. Vessel Characteristic

Vessel
T1
T2
T3

Type

Substance

Content (t)

Accident Scenario

Primary Probability

Escalation Vector

Atmospheric
Atmospheric
Atmospheric

Gasoline
Xylene
Gasoline

500
200
200

Pool fire
Pool fire
Pool fire

1.0E-05
1.0E-05
1.0E-05

Heat radiation
Heat radiation
Heat radiation

Domino Effect Analysis

T 1 and T 2 , it can be seen that the total heat radiation
received by T 3 because of both T 1 and T 2 would be
sufficiently above the threshold value to damage T 3
(i.e., Q13 + Q23 = 17.6 kW/m2 ). So, T 3 is a tertiary
unit involved in the domino accident, enabling the
domino effect to proceed to the second level (Step 6).
Accordingly, because T 3 is influenced by T 1 and T 2
together, it is connected to both of these nodes in
the corresponding BN in Fig. 7. Again, to populate
the CPT of node T 3 , its escalation probability given
the PFs in T 1 and T 2 is calculated using the probit
method as P(T3 |T1 , T2 ) = 1.197 106 .
It should be noted that Step 4.4 was skipped because the only available potential secondary unit is
T 2 . So, there would be no need to make a comparison among competitive potential units to select the
secondary unit. Step 5 has also been neglected in
this example as the primary and secondary accidents
of all units are determined in Table V. To estimate
the probability of the domino effect at different levels, nodes DL1 and DL2 are added to the network.
It should be noted that because there is only one
secondary and one tertiary event, auxiliary nodes to
model the union of the same order units need not
be added to the network. To account for the firstlevel domino effect, DL1 is connected to the primary unit T 1 and the secondary unit T 2 such that
P(DL1 ) = P(T1 )P(T2 |T1 ). Similarly, to consider the
second-level domino effect, DL2 is connected to the
first-level domino effect node DL1 and the tertiary
unit T 3 such that P(DL2 ) = P(DL1 )P(T3 ). After the
BN is modeled using the HUGIN software tool,(36)
the probability values 3.04E-11 and 3.64E-17 are obtained for the first- and the second-level domino effects, respectively. So, as opposed to the probabilities
listed in Table V, the occurrence of domino effects
seems unlikely, particularly the second-level domino
effect.
5. APPLICATION
5.1. Case Study
To apply the current methodology to domino
effects including a wider range of accident scenarios
than in the example previously discussed (Section
4.3), a case study from Ref. 35 is adapted and modeled in this section. Fig. 8 illustrates the schematic of
a tank farm comprised of eight atmospheric storage
tanks with fixed roofs (D1 D8 ). The tanks contain
gasoline with the capacity of 2,000 metric tons, each.
Table VI shows the distances among the storage
tanks.

301

D4

D1

D2

D5

D3

D6

D7

D8

Fig. 8. Schematic of storage tanks on a tank farm.

Table VI. Center-to-Center Distances (m) Among the Units in
the Tank Farm Layout Shown in Fig. 8

D1
D2
D3
D4
D5
D6
D7
D8

D1

D2

D3

D4

D5

D6

D7

D8

50
100
50
71
112
100
112

50

50
71
50
71
112
100

100
50

112
71
50
142
112

50
71
112

50
100
50
71

71
50
71
50

50
71
50

112
71
50
100
50

112
71

100
112
142
50
71
112

50

112
100
112
71
50
71
50

To consider the influence of different accident

scenarios on the domino effect modeling, it is assumed that either a PF or VCE can be envisaged
as the likely accident scenario for a damaged storage tank. In this regard, the primary probability values assumed for PF and VCE are 1E-05 and 2E-06,
respectively.(37) However, after a storage tank is impacted through the domino effect, its likelihood to
develop a PF or VCE is assumed to be equal, i.e., 0.5.
To commence modeling, the following assumptions are made:
The storage tank D1 is determined as the primary unit, from which the domino effect modeling starts.
The events of the same order, e.g., secondary
events, take place simultaneously. Therefore,
it is not possible for them to impact one another. In other words, in the corresponding
BN, there is no causal arc between units of the
same order.

302

Khakzad et al.
Table VII. Overpressure Escalation Vectors (kPa)(37)

D1
D2
D3
D4
D5
D6
D7
D8

D1

D2

D3

D4

D5

D6

D7

D8

10
4
10
8
4
4
4

10

10
8
10
8
4
4

4
10

4
8
10
2
4

10
8
4

10
4
10
8

8
10
8
10

10
8
10

4
8
10
4
10

4
8

4
4
2
10
8
4

10

4
4
4
8
10
8
10

Table VIII. Heat Radiation Escalation Vectors (kW/m2 )

D1
D2
D3
D4
D5
D6
D7
D8

D1

D2

D3

D4

D5

D6

D7

D8

19.3
4.6
19.3
9.3
3.6
4.6
3.6

19.3

19.3
9.3
19.3
9.3
3.6
4.6

4.6
19.3

3.6
9.3
19.3
2.2
3.6

19.3
9.3
3.6

19.3
4.6
19.3
9.3

9.3
19.3
9.3
19.3

19.3
9.3
19.3

3.6
9.3
19.3
4.6
19.3

3.6
9.3

4.6
3.6
2.2
19.3
9.3
3.6

19.3

3.6
4.6
3.6
9.3
19.3
9.3
19.3

Unlike PF accidents, which may last for several

hours or even days (based on the amount of
fuel and the burning rate), the shock waves resulting from explosions (responsible for overpressure damages) last for at most several seconds.(38) To consider the synergistic effect of
overpressure, the assumption of the concurrence of events of the same order is inevitable.
The threshold values of heat radiation and
overpressure are selected as Qth = 15 kW/m2
and Pth = 7 kPa for atmospheric storage
tanks with fixed roofs.
To specify the propagation pattern and escalation probabilities, the overpressure(37) and heat radiation escalation vectors are calculated and illustrated
in Tables VII and VIII, respectively. It should be
noted that overpressure values listed in Table VII are
calculated considering a highly stable meteorological condition, i.e., stability class F and wind speed of
2 m/sec. Also, for the sake of simplicity, the center of
explosion and the center of vapor cloud are assumed
to be coincident.
5.2. Results and Discussion
Because the likely accident scenarios for D1 are
PF and VCE, D1 can impact nearby units by means
of either heat radiation or overpressure. Based on a

comparison among the threshold values and the escalation vectors in Tables VII and VIII, D1 can impact
D2 and D4 by either heat radiation or overpressure
although it affects D5 only by overpressure. Thus, D2
and D4 are selected as the secondary units because
of their higher escalation probabilities, which in turn
can result in PF or VCE (with equal probabilities).
In this regard, causal arcs are directed from D1 to
the aforementioned nodes in the corresponding BN
in Fig. 9.
Similarly, the secondary units are likely to
trigger other accidents in the tertiary or quaternary
units. In this case study, regardless of the type of
accidents in D2 and D4 , units D3 , D5 , and D7 can be
involved in the domino effect as tertiary units. It is
worth noting that among the tertiary units, only D5
is impacted by the synergistic effect of the primary
and the secondary units. Similarly, units D6 and
D8 are impacted as quaternary units in the domino
effect. Drawing causal arcs from the parent units to
the associated children units, the likely propagation
pattern of the domino effect in the tank farm would
be as shown in Fig. 9.
To calculate the probability of the domino effect,
the escalation probabilities of units D2 to D8 for every state combination of their parents are calculated
using the probit models suggested in Ref. 16, considering synergistic effect and noisy gates. For example, the escalation probability of D5 given VCE in
D1 , PF in D2 , and also VCE in D4 , i.e., P(D5 |D1 =
VCE, D2 = PF, D4 = VCE), can be calculated using
the noisy-OR gate probability as follows.
P(D5 |D2 =
If
P(D5 |D1 = VCE) = 0.0211,
PF) = 5.43 106 , and P(D5 |D4 = VCE) = 0.0685,
then P(D5 |D1 = VCE, D2 = PF, D4 = VCE) = 1
(1 0.0211)(1 5.43 106 )(1 0.0685), of which
there is a 50% probability to have either a PF or
VCE, i.e., 4.408E 02.
To calculate the domino effect probabilities,
nodes L1 , L2 , L3 , DL1 , DL2 , and DL3 are added to
the BN (Fig. 10). After the CPTs are assigned to the
nodes, the BN is analyzed using HUGIN software.(36)
The accident probabilities and the probability of
the domino effect at sequential levels are listed in
Table IX (columns 2 and 3). It should be remarked
that in Table IX, the values listed for DL0 , DL1, DL2 ,
and DL3 include both the probabilities of PF and
VCE. It should be noted that the probability of the
zero-level domino effect, P(DL0 ), equals the probability of the primary event, P(D1 ).
According to the prior probabilities in columns
2 and 3 of Table IX, among the tertiary events, i.e.,
D3 , D5 , and D7 , the probability of D5 is an order of

Domino Effect Analysis

303

Fig. 9. Propagation pattern of the

domino effect on the tank farm.

Fig. 10. BN to model domino effect on

the tank farm.

magnitude higher than the others. This is because of

the fact that, unlike D3 and D7 , which are impacted
only by the secondary units, D5 benefits from the escalation vectors of both the primary unit D1 and the
secondary units. Its escalation probability is therefore expected to be higher as opposed to that of D3
and D7 .
On the other hand, the escalation probabilities
of the quaternary units D6 and D8 are of the same
order. The reason is that all these units are likely to
be triggered by either heat radiation or overpressure
emitted by the tertiary units, exposing them to almost
the same level of vulnerability.

Comparing the domino effect probabilities at different levels, it is also noted that except for P(DL0 )
and P(DL1 ), which differ in amount by two orders of magnitude, the difference between sequential domino levels is one order of magnitude. This
implies that even though the probability of the firstlevel domino effect given the primary event is not
very high, its propagation from the first level to
the second level and from the second level to the
third level is significant and cannot be neglected.
Consequently, in the allocation of safety measures,
multi-level domino effects should be taken into
consideration.

304

Khakzad et al.
Table IX. Domino Effect Probabilities
First Modeling

Second Modeling

Posteriors given D6 = PF

Priors

Posteriors given D6 = PF

Priors

Unit

PF

VCE

PF

VCE

PF

VCE

PF

VCE

D1
D2
D3
D4
D5
D6
D7
D8

DL0
DL1
DL2
DL3

1.00E-05
6.86E-08
2.35E-09
6.86E-08
2.62E-08
1.72E-09
2.35E-09
1.72E-09
1.20E-05
2.65E-07
2.42E-08
1.92E-09

2.00E-06
6.86E-08
2.35E-09
6.86E-08
2.62E-08
1.72E-09
2.35E-09
1.72E-09

2.00E-04
1.60E-02
1.68E-02
3.23E-02
2.46E-02
1.00E+00
3.10E-03
2.07E-02
1.00E+00
6.36E-01
2.87E-01
2.87E-01

9.99E-01
5.51E-01
7.80E-02
9.04E-02
5.59E-01
0.00E+00
3.10E-03
2.07E-02

1.00E-05
6.86E-08
2.71E-09
6.86E-08
2.11E-08
1.59E-09
2.71E-09
1.59E-09
1.20E-05
3.02E-07
1.63E-08

2.00E-06
6.86E-08
2.71E-09
6.86E-08
2.11E-08
1.59E-09
2.71E-09
1.59E-09

2.00E-04
1.57E-02
4.62E-02
3.43E-02
4.90E-03
1.00E+00
1.06E-02
2.28E-02
1.00E+00
1.00E+00
1.00E+00

9.99E-01
5.60E-01
4.62E-02
3.43E-02
5.49E-01
0.00E+00
1.06E-02
2.28E-02

The

probability of the zero-level domino effect, P(DL0 ), equals the sum of the probability of the different accident scenarios (PF and
VCE) of the primary event, i.e., P(D1 = PF) + P(D1 = VCE).

As previously mentioned, the BN takes new information into account to update the prior probabilities (see Equation (4)). This way, the posterior
probability of events given an item of evidence (e.g.,
the knowledge about the state of a node), and
also the most probable configuration of events leading to the evidence, are often of significant importance.(29,30,32)
To perform probability updating in this case
study, the updated probabilities of events (posteriors) are calculated given that a PF has been observed
in D6 , i.e., P(Di |D6 = PF) in which i = 6. The posteriors are listed in Table IX (columns 4 and 5). Also,
the most probable configuration of events leading to
the PF in D6 is determined as (D1 = VCE) (D5 =
VCE) (D6 = PF) whereas the other units are in
the safe state.
Considering the most probable configuration, it
can be seen that the domino effect has proceeded
to the second level, escalating D5 , without passing
through the first level, resulting in no escalation of
D2 or D4 . This is also evident from the posterior
probabilities of the sequential levels of the domino
effect (the last four numbers in column 3 of Table
IX); despite the observation of a PF in D6 , which implies that the domino effect must be in its third level
(i.e., P(DL3 ) = 1.0), the probability of the third-level
domino effect is noticeably below 1.0, i.e., P(DL3 ) =
2.871 101 . Furthermore, being in the third level
necessitates the domino effect having already passed
the first and second levels, i.e., P(DL1 ) = P(DL2 ) =
1.0. However, according to Table IX, these values
also differ from what is expected.

Fig. 11. Modified propagation pattern of the domino effect.

As mentioned previously, the primary unit, D1 ,

is capable of impacting D5 by means of overpressure
even if D2 or D4 do not contribute through the synergistic effect. This fact and also the above-mentioned
most probable configuration of events, where D5 occurs after D1 , increase the possibility of D5 being involved in the domino effect as a secondary unit. Accordingly, shifting D5 to the set of secondary events,
the updated propagation pattern of the domino effect
would be as shown in Fig. 11.
In this way, D2 , D4 , and D5 are involved in
the domino effect as secondary events whereas D3 ,
D6 , D7 , and D8 contribute to the domino effect as
tertiary events. Modeling the modified network in
HUGIN,(36) the new prior probabilities shown in
Table IX (columns 5 and 6) are obtained. It also
should be noted that by adding D5 to the secondary
events, the highest level of the domino effect is reduced in the second level. Using the posterior probabilities to verify the modified network, the most
probable configuration of the events causing the

Domino Effect Analysis

305

PF in D6 is determined as (D1 = VCE) (D2 =

VCE) (D6 = PF), showing that a logical sequence
of events of different orders has been fulfilled. The
posterior probabilities of the modified network given
the PF in D6 are also displayed in columns 7 and 8 of
Table IX. It is worth noting that the posterior probabilities of the sequential levels of the domino effect
equal unity.

sidering posterior probabilities as well as the most

probable configuration, the most likely propagation
path of the domino effect can be identified. This
study showed that using the new information, not
only the quantitative part but also the qualitative part
of the domino model can be updated.

6. CONCLUSION

The authors gratefully acknowledge the financial

support provided by the Natural Sciences and Engineering Research Council (NSERC) of Canada.

This study has introduced a new methodology

for probabilistic analysis of domino effects in chemical process plants based on BNs. The likely propagation pattern of domino effect starting from a primary
event was developed in the form of a BN. The BN
was then further modified to account for the probability of the domino effect at subsequent levels. To
take the complex interactions among adjacent equipment into account, the CPTs assigned to events were
populated considering synergistic effects and noisy
probabilities.
The application of the methodology to a real case
study showed that the BN is effectively suitable for
the analysis of domino effects from both qualitative
and quantitative points of view. From a qualitative
perspective, the flexible structure of BN makes it
possible to fit to a wide range of accident scenarios
and also to embed versatile types of information in
the network by adding auxiliary nodes. The graphical representation of units and escalation vectors by
means of nodes and causal arcs through BN remarkably helps to visualize the propagation pattern of the
domino effect, which is not easy with most deterministic and probabilistic methods.
From a quantitative point of view, BN takes advantage of robust CPTs to model different types of
causal relationships among events. CPTs help in considering the synergistic effect of contributing events
by either adding similar escalation vectors or using noisy probabilities in the case of different escalation vectors. Considering the complex interaction
and conditional dependencies among the units involved in the domino effect, several limiting assumptions such as independent events or random or binomial selection of target units can be relaxed.
More importantly, using new observations as evidence, BN employs Bayess theorem to update the
prior probabilities. Consequently, the posterior probabilities are obtained in the light of new observations
and also the most probable configuration of events
leading to that observation can be determined. Con-

ACKNOWLEDGMENTS

REFERENCES
1. Council Directive 96/82/EC of 9 December 1996 on the
control of major-accident hazards involving dangerous substances. Official Journal of the European Communities, L
10/13, Brussels, January 14, 1997, 00130033.
2. Abdolhamidzadeh B, Abbasi T, Rashtchian D, Abbasi SA.
Domino effect in process industry accidentsAn inventory
of past events and identification of some patterns. Journal of Loss Prevention in the Process Industries, 2011; 24:
575593.
3. Darbra, RM, Palacios A, Casal J. Domino effect in chemical
accidents: Main features and accident sequences. Journal of
Hazardous Materials, 2010; 183:565573.
4. CSB. Refinery Explosion and Fire. Investigation Report
No. 200504-I-TX, Washington, DC, 2007. Available at:
http://www.csb.gov/assets/document/CSBFinalReportBP.pdf,
Accessed on January 1, 2012.
5. Bagster DF, Pitblado RM. The estimation of domino incident
frequenciesAn approach. Process Safety and Environmental Protection, 1991; 69:195199.
6. Gledhill J, Lines I. Development of Methods to Assess the
Significance of Domino Effects from Major Hazard Sites. CR
Report 183, Sudbury, UK: Health and Safety Executive, 1998.
7. Eisenberg NA, Lynch CJ, Breeding RJ. Vulnerability Model:
A Simulation System for Assessing Damage Resulting from
Marine Spills, Report CG-D-13675. Rockville, MD: Enviro
Control Inc., 1975.
8. Vilchez AJ, Montiel H, Casal J. Arnaldos J. Analytical expressions for the calculation of damage percentage using the
probit methodology. Journal of Loss Prevention in the Process Industries, 2001; 14:193197.
9. Cozzani V, Salzano E. The quantitative assessment of domino
effects caused by overpressure part I. probit models. Journal
of Hazardous Materials, 2004; A107:6780.
10. Khan F, Abbasi SA. Models for domino analysis in chemical process industries. Process Safety Progress, 1998; 17:
107123.
11. Cozzani V, Gubinelli G, Salzano E. Escalation thresholds
in the assessment of domino accidental events. Journal of
Hazardous Materials, 2006; 129:121.
12. Khan F, Abbasi SA. DOMIFFECT (DOMIno eFFECT):
User-friendly software for domino effect analysis. Environmental Modeling and Software, 1998; 13:163177.
13. Landucci G, Gubinelli G, Antonioni G, Cozzani V. The
assessment of the damage probability of storage tanks in
domino events. Accident Analysis and Prevention, 2009;
41:12061215.
14. Vilchez AJ, Sevilla S, Montiel H, Casal J. Historical analysis
of accidents in chemical plants and in the transportation of

306

15.
16.

17.

18.

19.

20.
21.

22.
23.

24.
25.

26.

Khakzad et al.
hazardous materials. Journal of Loss Prevention in Process
Industries, 1995; 8:8796.
Kourniotis SP, Kiranoudis CD, Markatos NC. Statistical analysis of domino chemical accidents. Journal of Hazardous Materials, 2000; 71:239252.
Cozzani V, Gubinelli G, Antonioni G, Spadoni G, Zanelli S.
The assessment of risk caused by domino effect in quantitative area risk analysis. Journal of Hazardous Materials, 2005;
A127:1430.
Antonioni G, Spadoni G, Cozzani V. Application of domino
effect quantitative risk assessment to an extended industrial
area. Journal of Loss Prevention in Process Industries, 2009;
22:614624.
Abdolhamidzadeh B, Abbasi T, Rashtchian D, Abbasi SA.
A new method for assessing domino effect in chemical process industry. Journal of Hazardous Materials, 2010; 182:
416426.
Reniers GLL, Dullaert W, Ale BJM, Soudan K. The use of
current risk analysis tools evaluated towards preventing external domino accidents. Journal of Loss Prevention in Process Industries, 2005; 18:119126.
Reniers GLL, Dullaert W. DomPrevPlanning: User-friendly
software for planning domino effects prevention. Safety Science, 2007; 45:10601081.
Cozzani V, Antonioni G, Spadoni G. Quantitative assessment of domino scenarios by a GIS-based software tool. Journal of Loss Prevention in the Process Industry, 2006; 19:
463477.
Jensen FV, Nielsen TD. Bayesian Networks and Decision
Graphs, 2nd ed. New York: Springer, 2007.
Weber P, Medina-Oliva G, Simon C, Iung B. Overview on
Bayesian networks applications for dependability, risk analysis and maintenance areas. Engineering Application of Artificial Intelligence, 2010; 25: 671682.
CCPS. Guidelines for Chemical Process Quantitative Risk
Analysis, 2nd ed. New York: AIChE, 2000.
Van Den Bosh CJH, Weterings RAMP. Methods for
the Calculation of Physical Effects (Yellow Book). The
Hague, NL: Committee for the Prevention of Disasters,
1997.
Assael MJ, Kakosimos KE. Fires, Explosions, and Toxic
Gas Dispersions: Effects Calculation and Risk Analysis. NW:
CRC Press, Taylor and Francis Group, 2010.

27. Rai K, Van Ryzin J. A generalized multihit dose-response

model for low-dose extrapolation. Biometrics, 1981; 37:
341352.
28. Torres-Toledano JG, Sucar LE. Bayesian networks for reliability analysis of complex systems. Lecture Notes in Computer
Science, 1998; 1484:195206.
29. Bobbio A, Portinale L, Minichino M, Ciancamerla E. Improving the analysis of dependable systems by mapping fault trees
into Bayesian networks. Journal of Reliability Engineering
and System Safety, 2001; 71:249260.
30. Khakzad N, Khan F, Amyotte P. Safety analysis in process
facilities: Comparison of fault tree and Bayesian network
approaches. Journal of Reliability Engineering and System
Safety, 2011; 96:925932.
31. Bearfield G, Marsh W. Generalizing event trees using
Bayesian networks with a case study of train derailment. Lecture Notes in Computer Science, 2005; 3688:5266.
32. Khakzad N, Khan F, Amyotte P. Dynamic Safety analysis
of process systems by mapping bow-tie into Bayesian network. Journal of Process Safety and Environmental Protection, 2012; doi: 10.1016/j.psep.2012.01.005.
33. Nguyen QB, Mebarki A, Ami Saada R, Reimeringer M. Integrated probabilistic framework for domino effect and risk
analysis. Journal of Advances in Engineering Software, 2009;
40:892901.
34. Delvosalle C, Fievez C, Pipart A, Debray B. ARAMIS
project: A comprehensive methodology for the identification
of reference accident scenarios in process industries. Journal
of Hazardous Materials, 2006; 130:200219.
35. Paltrinieri N, Dechy N, Salzano E, Wardman M, Cozzani
V. Lessons learned from Toulouse and Buncefield disasters:
From risk analysis failures to the identification of atypical scenarios through a better knowledge management. Risk Analysis, 2011; doi: 10.1111/j.1539-6924.2011.01749.x.
36. HUGIN Expert Software version 7.4, 2010. Available at:
http://www.hugin.com.
37. Cozzani V, Salzano E. The quantitative assessment of domino
effects caused by overpressure part II. Case studies. Journal
of Hazardous Materials, 2004; A107:8194.
38. Khan F, Abbasi SA. Assessment of risks posed by chemical industries-application of a new computer automated tool
MAXCRED III. Journal of Loss Prevention in the Process
Industries, 1999; 12:455469.

Copyright of Risk Analysis: An International Journal is the property of Wiley-Blackwell and its content may
not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written
permission. However, users may print, download, or email articles for individual use.