The impact of the COVID-19 pandemic on the safety management in Italian Seveso industries

Abstract

The paper discusses the impact of the COVID-19 pandemic on the Italian chemical and process industries, where Directive 2012/18/EU Seveso III, for the control of Major Accident Hazard (MAH), is enforced. The Safety Management System (SMS) for the control of MAH, which has been mandatory for 20 years in Italian Seveso Establishments, has been highly stressed by the external pressure, related in some way to the COVID-19 pandemic. Fairly, most companies, in particular in oil and gas sectors, have demonstrated an adequate capability to reconcile operation continuity and health requirements. This experience is providing the establishment operators and the regulators with valuable suggestions for the improvements of the SMS-MAH. Within this framework, an innovative organisational resilience model is proposed, aiming at the development of a higher capability to face future new crisis. The current SMS-MAH already includes some basic pillars to enhance resilience, which were valuable during the pandemic crisis, but a full and rationale development is still needed. Starting from the first pandemic phase experience, this paper presents a novel tool to assess the degree of “resilience” of a SMS-MAH. It is based on a questionnaire, featuring 25 questions grouped into eight items, according to the typical SMS-MAH structure. A two level AHP model has been developed in order to define the weights to be assigned to each point. The AHP panel included industrial practitioners, regulators, authorities and researchers. The results are based on the COVID-19 experience and consequently the developed model is tailored to face health emergencies, but the approach may be easily transferred to other external crises.

1. Introduction

According to the scientific literature, Seveso establishments can be regarded as complex systems (Jain et al., 2018; Palazzi et al., 2014), i.e. composed by several sub-systems, processes, procedures, etc., whose overall management is more complicated than the management of the sum of each subsystem. The main criticality is the need of understanding the complex interactions amongst the single parts. In such a context, accidents and incidents are often due to lack in understanding of these interactions, or to the inability to deal with them. Nevertheless, the safety management of complex systems can be optimised by identifying and analysing all threats that undermine them (Bragatto and Milazzo, 2019). Amongst the various safety affecting threats, a matter of growing concern in the last decades is the impact of high severity external, unexpected or unanticipated events, e.g. Hurricane Katrina in 2005 and the Fukushima nuclear accident in 2011. Amongst unexpected threats and external environmental stressors, it should be included the potential impact of the COVID-19 pandemic on industrial settings where relevant inventories of hazardous materials are stored and/or processed. Starting from the actual experience gained during the emergency phase of the first 2020 pandemic wave, in this work COVID 19 impact is analysed with respect to the safety management of Italian Seveso sites. In Italy, the Seveso legislation concerns about one thousand establishments, equally including upper and lower tier plants. These industries include large multinational companies, which manage oil refineries and process plants, as well as smaller, highly competitive and dynamic companies, which produce high added value fine chemicals and parachemicals. Warehouses of chemicals and depots of petroleum products also fall under the Seveso legislation, but they are characterised by a lower level of organisational and engineering complexity than the process plants. Even if in the last decades the international natural gas market has been growing at a very high rate and continues to exhibit an increasing trend (Vairo et al., 2021), still particularly relevant is the LPG sector, which is featuring one hundred and more Seveso establishments, widespread in the whole country and managed by small and medium-sized enterprises. The number and distribution of these Seveso establishments in Italy have been fairly constant for twenty years and more. The legislation requires the establishments’ management to adopt a Safety Management System for the prevention of Major Accident Hazards (SMS-MAH), following scheduled inspection plans. This requirement created, in the last two decades, a good level of hazard awareness, reinforced safety culture, and contributed to reduce the number and severity of chemical accidents, as discussed in a number of papers, including Wood and Fabbri (2019) and Wood (2018). Additionally, it should be remarked that occupational accidents are much lower in Seveso sites than in similar sectors that are outside the Seveso scope (Di Francesco et al., 2020). The SMS-MAH is built upon the basis of the minimum requirements of national and European legislation. Only one hundred establishments follow the standard UNI-EN 10617 (2019), which defines the contents of the SMS-MAH in the risk management framework defined by ISO 31000 (2018). Other establishments include the prevention of major accidents within the ISO 45001 (2018) framework (which falls within the ISO 31000 risk management scheme). At last, there are some others, belonging to large multinational corporations, which adopt proprietary management systems inspired by approaches different from ISO 31000. None of these schemes includes resilience, although a “resilient management” is required to address emerging problems, such as equipment ageing obsolescence (Milazzo and Bragatto 2019). As recently commented by Pasman and Fabiano (2021) as an overall safety umbrella, resilience building to support business continuity should be further developed by proper teaming between industry, regulator and research. Despite the sector of critical infrastructure demonstrated a large attention to the resilience issue for a decade and more, the resilience assessment is not yet a common practice for Seveso industries, even though a number of research results are already available (Jafari et al., 2018; Jain et al., 2018; Palazzi et al., 2014). Additionally, several resilience research applications were limited to single units, or levels of industrial organisations (e.g. Pillay, 2016) and the key resilience concept of early detection was proposed in a tool for COVID 19 epidemiological risk management (Vianello et al., 2021). The reader is addressed to the seminal paper by Pasman et al. (2020) covering a review on review of a decade of development of plant resilience concepts and applications. Resilience is not included in the European Seveso legislation, or in the national implementation and its assessment is definitely out of the scope of mandatory Seveso inspections as well as of Seveso audits (Laurent et al., 2021). Even though the attention of Seveso Competent Authorities on resilience issues is still low, may be interesting to mention an early attempt made by HSE, the British Competent Authority. HSE published, some time ago, a research report (HSE, 2011), that reviewed the scientific literature on the High Reliability Organisation HRO and identified the key concepts suitable for the Seveso context, stressing a few concepts shared with resilience engineering, including “Containment of unexpected event”, “Problem Anticipation”, “Learning Orientation” and “Mindful Leadership”.

As previously anticipated, this paper outlines a model for the resilience evaluation of the SMS-MAH of Seveso industries by incorporating the experience gained during the emergency phase in the first COVID 19 wave of 2020. The manuscript is structured as follows: Section 2 summarises the Italian experience with the management of safety in major hazard establishments during COVID-19 pandemic; Section 3 reports some fundamental concepts about the Resilience Engineering theory; Section 4 presents the proposed methodology for the resilience assessment incorporating elements facing unexpected threats. Section 5 provides results and discussion about the pilot assessment of the methodology in the pandemic context. The conclusions and remarks for future perspectives are presented in Section 6.

2. Italian experience during first wave COVID-19 pandemic

The impact of the COVID-19 pandemic has been very strong in Italy and resulted in nearly two months national lockdown and closure of many non-essential production activities, starting from March 22nd, 2020. The shutdown and subsequent start-up of operations were conducted under hard conditions due to the external pressure of the infection risk and the interference between health precautions and safety procedures. Several upper and lower tier Seveso activities, included in the oil supply chain, were classified as essential, other ones were forced to stop by ensuring only the safety of stored chemical products. Finally, there were some other Seveso sectors that underwent to rapid plant and process modifications according to changes in the market demand caused by the sanitary emergency, i.e. a sharp contraction of the demand for fuels (gasoline and jet-fuel) was counterbalanced by a strong growth for sanitation products (e.g. ethanol, hypochlorite). The challenges faced by Seveso establishment operators included the safe shutdown and subsequent start-up of activities, the safety of stored chemical products during the closure of activities, the very rapid market changes and interference between the new pandemic-related hazards and the usual process hazards. Particular attention has to be payed to:

• ✓personnel reduction, which could affect both emergency management and maintenance management,
• ✓psychological stress of personnel, both employee and contractors, as well as transporters,
• ✓difficulties to stick to plans and programs, including safety training and inspection
• ✓difficulties in the procurements of spare parts, with effects on maintenance and safe operations.

These issues required the managers to reorganise production in a very short time, with changes that involved processes, plants, procedures and organisation. The following sub-sections outlines Italian experience during the COVID-19 pandemic focusing on two peculiar industrial sectors, i.e. oil downstream and LPG one, as well as on regulators action.

2.1. Seveso sectors

As previously anticipated, nearly one thousand Italian Seveso establishments demonstrated an overall adequate capability to face the crisis. A number of establishments continued to operate during the lockdown, because classified as “essential” by the Authorities. The activities deemed essential were indicated in the Prime Ministerial Decree of March 11, 2020 and the Ordinance of the Ministry of Health of March 20, 2020. The activities considered essential were those that provide public utility services or essential services for the community, and certainly among these many Seveso industries, including refineries, air separation plants, depots of petroleum products, industrial ports coastal depots and power stations. The activities were identified through the ATECO (ATtività ECOnomica in Italian) codes assigned by National Statistical Institute (ISTAT).

At the Seveso sites that continued the activity, just indispensable personnel remained at the plant, while non-essential personnel were placed in “smart-work”, supporting colleagues on the field via web. A few chemical plants continued operating, as they were able to convert very quickly towards the requested productions (e.g. disinfectants), to satisfy the market demand, which has dramatically increased in a very short time.

A number of Seveso establishments, considered as “non-essential” by the Authorities, were forced to stop the production during the pandemic peak time, maintaining at work only a few front line workers strictly necessary to manage the safety of the hazardous materials present at the site. In most cases, activities restarted at the first days of May, as soon as the government declared the end of the peak time and the so-called “phase 2” began. Even at all Seveso sites, production activities resumed and continued in the following months, always conditioned by the swinging trend of the pandemic and the consequent restrictive government measures.

2.2. Focus on oil industry

The oil industry is worthwhile of a special focus, due to its importance in the Seveso context. In Italy the oil industry is featuring 13 refineries and one hundred major petrol depots, all classified as Seveso sites (upper or lower tier). Not to mention the thousands of petrol pumps and the transport network, as well as thousands kilometres of pipelines. Operations had to continue even during the lockdown because considered strategic for the country. As far as possible, during that period, the staff was placed in “smart working”, but continuous cycle operating plants had the need to maintain a minimal number of operating personnel to activate the shutdown procedures in case of emergency (in larger systems 200–300 people with times up to 5/6 days). Three refineries were inside the “red area” (i.e. in the area at high infection risk) at the middle of the outbreak. In order to face the crisis, the oil industry association (UNEM) established a COVID-19 emergency task force with the Health, Safety and Environment managers. The task force met by videoconference, at least weekly, for both refineries and deposits. Specific videoconferences were organised for the distribution, transport and remediation network. Following long time implementation of Seveso legislation requirements, workers' representatives are used to provide effective contribution when consulted for industrial safety items. In this respect, upon formal agreement they contributed to the safety during the pandemic crisis, while in several instances the industrial management covered the key reference role for the whole community during the outbreak. Thanks to all these combined efforts, establishment operators were able to handle both usual safety procedures, aiming at preventing accidents and new health procedures, dealing with the fighting of the virus spread (Giacopetti, 2020). The oil industry reports no notable accident during the stricter lockdown period, and only a trivial near miss was reported during the “phase 2”.

2.3. Focus on LPG sector

The LPG sector is a relevant part of the petrochemical sector: in Italy there are 365 authorised storage facilities, 211 of them with bottling system, with an overall operating capacity of 632,197.36 m³. Among those, 145 plants are classified as Seveso lower tier and 110 as higher tier. The strategic plants for the country in this sector did not stop the operations throughout the lockdown period. The operational and technical staff were always present in the plants, to ensure safety and operability, while the administrative staff made use of agile work. From the initial stage, the sector guaranteed continuity in the provision of the service, essential for over one million of civil buildings. The trade associations issued provisions to ensure the health and safety of all subjects in the supply chain, users, citizens, industries, tourist and commercial activities. Not even the work necessary for the maintenance and safety of the networks and individual users has been stopped.

2.4. Actions of regulators

Authorities and regulators made an effort to support Seveso operators during the peak time. In detail, a few procedures have been developed to allow the verification via streaming of repaired pressurised equipment, installed at critical establishments and essential for operations. Even the new equipment certification according to the Pressure Equipment Directive (European Commission, 2014) has been executed via streaming, avoiding the inspector access the establishment. The new procedures are quite strict and allow the full inspection of the equipment without significant lack in quality. The technological details of the augmented/immersive reality solutions adopted in the procedure may be found in a recent paper (Augugliaro et al., 2020). In this regard, it must be mentioned the proactive role of the National Accreditation Institute (Accredia), which immediately authorised the new certification procedure adopted by the certification bodies, thanks to a document previously issued by the international forum of the accreditation body (IAF, 2018).

Seveso authorities suspended at all inspective activities during the peak time, but during the “phase 2” they developed and adopted an inspective procedure, which allows the execution of the most required duties via streaming, thus, reducing by 80% and more the time spent by the inspection team at the site. At the end of the year, almost all inspections planned for 2020 have been successfully completed, thanks to the new procedure, except for the emergency tests, which must necessarily take place on site and, consequently, have been postponed.

These novel verification and inspection modes, based on remote streaming technologies, can be interesting even after pandemic, to improve the efficiency of many control activities (Giacobbe and Bemporad, 2020).

3. Theoretical concepts of resilience engineering

Resilience is defined as the intrinsic capability of a system to modify its functioning before, during and following a disturbance, to continue operating both in expected and unexpected conditions. As reported by Hollnagel et al. (2006), resilience includes four aspects:

• ⁃Anticipation: the capability to prevent hazards and modify functioning to adapt to changes;
• ⁃Monitoring: the capability to control and supervises the system performance and its operating status by searching for potential weak signals;
• ⁃Reaction: the capability to immediately respond to changes, regulate operations and avoid major damage;
• ⁃Learning: the capability to learn from past events in order to increase the level of safety.

Fig. 1 schematically depicts the effects of the various aspects of the resilience on the overall performance trend.

Fig. 1.

Performance trend at a Seveso Establishments affected by a disruptive event. The graph provides a visual comparison of standard firm SMS adoption vs. resilience enhanced SMS implementation.

The Organisational Resilience is the capability of an organisation to anticipate, prepare for, respond and adapt to incremental changes and sudden disruptions in order to survive and prosper. Different distinct phases can be identified, with apparently conflicting perspectives:

• 1.Preventative control (defensive consistency). It is achieved by means of risk management, physical barriers, redundancy (spare capacity), systems back-ups and standardised procedures, which protect the organisation from threats and allow it to ‘bounce back’ from disruptions to restore a stable state.
• 2.Mindful action (defensive flexibility). People, who notice and react to threats and effectively respond to unfamiliar, or challenging situations enforce this property. In fact, it is recognised that Organisational Resilience is not only about learning to bounce back (Wildavsky, 1988), but also includes the ability to ‘bounce forward’ (Manyena et al., 2011), to grow and prosper in the future (Reich, 2006).
• 3.Performance optimisation (progressive consistency). It relies on continuously improving, refining and extending existing competencies, enhancing ways of working and exploiting current technologies to serve present customers and markets.
• 4.Adaptive innovation (progressive flexibility). Creating, inventing and exploring unknown markets and new technologies are the pillars of this topic.

These properties split Organisational Resilience between behaviours that are defensive (i.e. stopping bad things happen) and those that are progressive (i.e. making good things happen), as well as between behaviours that are consistent and those that are flexible. These four viewpoints define a framework, which is represented in the resilience “Tension Quadrant”, as depicted in Fig. 2 . The differences between these perspectives and behaviours caused many disagreement and misunderstanding. More recently, in the literature a new fifth strand of thinking on Organisational Resilience has emerged (Duchek, 2020), which integrates, balances and seeks fit (fitness for purpose). A paradoxical thinking is clearly required for a truly resilient organisation, with leaders effectively managing the tensions between the four approaches.

Fig. 2.

The resilience tension quadrant, derived from Hollnagel (2011).

The Organisational Resilience is obtained by balancing preventative control, mindful action, performance optimisation and adaptive innovation, as well as managing the tensions inherent to these distinct perspectives. The performance optimisation is reduced by a long period of success of organisations resulting in the underestimation of the possibility of future failures (Hollnagel et al., 2006). Even a short-term productivity gain could be detrimental to medium-term missions and sustainable performance as the primary goal. Over the time, organisations create the illusion that “failure can't happen there” (Woods and Cook, 2002). The adaptive innovation is inhibited if the organisation feels the threat of impending crisis. Organisations tend to control expenditures and resources and focus on what they do well (e.g. their core product or service), known as a threat-rigidity effect (Staw et al., 1981). Hence, the range of options opens to the organisation narrows and it becomes progressively more difficult to reverse decisions, and the organisation can become ‘path dependent’ getting locked, it loses its capability to adopt better alternatives (Sydow et al., 2009). The preventative control is diminished over the time; this has been described by Reason (1990). Reason argued that each defensive layer has many holes like a slice of Swiss cheese. The holes in the defences arise because of latent problems, such as defective maintenance, poor training, when local practice takes over from written procedures (Snook, 2000) and ‘deviant acts’ become normalised (Vaughan, 1996). When the holes in many layers momentarily line up, an incident can occur. The mindful action is weakened when organisations stop investing in the competence of their people, maintaining efficacy and encouraging growth (Sutcliffe and Vogus, 2003), as well as the structures and practices people become inattentive (Simons and Chabris, 1999), mindless (Langer, 1989) and lose situational awareness (Klein, 2008). In hierarchical organisations, those with expertise who are closest to the problem are not empowered to act (Weick and Sutcliffe, 2007) and people diffuse responsibility for taking action (Latané and Darley, 1970). Threats can undermine the Organisational Resilience, as these factors can combine to create blind drift and organisations can sleepwalk into disaster. Once failure does occur most organisations respond by bolstering preventative control by adding new safeguards, reinforcing barriers and redoubling training efforts but rarely engage in fundamental changes to the adaptive innovation or mindful action aspects of resilience (Denyer and Pilbeam, 2015).

4. Methodology

The conceptual framework for the methodology is developed starting from the definition of the resilience model and its harmonisation within the safety management system. An evaluation approach to Resilience performances is the defined, including suitable assessment criteria retrieved by expert elicitation and calculation of the relative rankings and correlations.

4.1. Harmonising resilience model within SMS-MAH

This sub-section provides a detailed description of the resilience elements to be implemented within the firm SMS-MAH, according to the model outlined in Section 3.

4.1.1. Structures and standard for the SMS-MAH

The SMS-MAH is constructed and verified based on a guideline, issued by the public regulators and updated several times in Italy (Decree Law no. 105, 2015), within the wide body of regulations issued in the European Union to control major accident hazards (European Commission, 2012). The guideline includes eight points: Policy, Resources and Leadership, Risk Assessment, Operational Control, Management of Change, Emergency Management, Performance Evaluation, Review and Improvement. Only a number of establishments implements the SMS-MAH on the basis of recognised standards, falling within the general framework defined by ISO 31000 for risk management, that includes seven points (Context, Leadership, Planning, Support, Operating Control, Performance Evaluation and Improvement).

4.1.2. Sources of resilience already included in the SMS-MAH

The application of the SMS-MAH can be conceived in the form defined by the previously mentioned Italian guidelines, or according to the definitions enforced by ISO 31000 approach. Both frameworks implicitly introduce a number of elements that still allows the system reacting even to face unexpected difficulties by always maintaining a certain level of safety and restoring the previous safety conditions or equivalent conditions. The practice of the inspection visit strongly encourages the analysis of accidents, near miss and anomalies in order to continuously adapt the management system to changing risk situations. An intelligent use of training, management of changes and emergency simulations has also favoured the development of a safety culture, if not exactly resilient, at least flexible and adaptive. The aptitude of the inspection groups has very often privileged a proactive approach over the more prescriptive one, typical of specific areas, such as occupational safety. For several years, the inspectors have promoted the active involvement of personnel in major accident prevention and currently in general there is an adequate safety culture in most Seveso establishments, which is due to the efforts done by both operators and inspectors. This represents a huge driving-force, for the industrial sectors, to cope even with the unexpected difficulties, as discussed in Section 2.

4.1.3. Sources of resilience to be introduced in SMS-MAH

The hidden sources of resilience, already present in the SMS-MAH, should be underlined. Then, a few further sources may be added. Table 1 summarises all resilience sources, discriminating the actually present ones and those to be added, keeping in mind the resilience engineering model outlined in Section 3. The source of information is the Coordination Group for the uniform application on the national territory of the Seveso Directive, to which two of the authors of this paper belong, as representatives of the respective institutions. Table 1 gives the structure of the SMS-MAH and resilience sources by using the Annex B of the Decree Law no. 105 as reference, as it is much more popular in Italian Seveso establishments than the ISO 3100 scheme.

Table 1.

The structure of the SMS-MAH according to Annex B and the sources of resilience.

SMS POINT		RESILIENCE SOURCE	STATUS	Resilience Cornerstones
Policy		See for details § 4.1.4		ANTICIPATE
1.Resources and Leadership		Resilience is a non technical skill, which can be taught and learnt. It is essential to include in safety training program, mandatory in SMS-MAH, resilience classes for plant managers and safety managers. (Agnello et al., 2017)	Sometimes present;to improve	ANTICIPATE
2.Risk Assessment		The bow-tie method has been adopted for a decades to have an immediate understanding of preventive and protective barriers. The redundancy of barriers is essential also to allow safe operations also in the event of the failure of a barrier due to unexpected changes in external context. (Agnello et al., 2012)	Already Present	REACT
3.Operating Control	Service	Procedures for the safe shutdown and start-up in the event of unexpected and prolonged suspensions of the service. For instance, many hazardous materials degrade over time. Their quantities in storage must be kept to a minimum and their situation must be monitored. Nitrogen inerting must be maintained to protect against explosive atmospheres. It is important that the plant is inspected and tested before rebooting and that the boot process is duly monitored. The formation of hazardous vapours should be considered in chemical warehous, in the event of prolonged service interruption.	Sometimes present;to improve	MONITORING
	Maintenance	A safety walk consists of an “advanced” inspection of one or more equipment, logical units or the whole establishment. For each equipment item, through the data provided by a netwok of sensors, the inspector determines information about ageing, in the form of probability of failure, as well as the expected residual lifetime. (Milazzo et al., 2019)	Sometimes present,to improve	MONITORING
4.Management of Change		The definition of safe limits for process conditions, variables and activities and training of the staff to recognise significant changes. Combined with knowledge of established operating procedures, this additional training will allow the staff to activate the Management of Changes system when appropriate (Han Siog et al., 2017)	Sometimes present,to improve	MONITORING
5.Emergency Management		Emergency Training is usually based on the simualtion of accidental scenarios as described in the risk analysis. It is essential to include in the training programs unexpected scenarios or, better, unexpected disturbance to expected scenarios to verify the robusteness of the system	Sometimes present,to improve	ANTICIPATE
6.Performance Evaluation		The duly registration and discussion of minor accidents and near misses has been for years a pillar of the SMS. Learning from experience is essential to improve the SMS and adapt it to changes in the context. Including anomalies in the near-misses management allow increasing the attention to the weak signals, anticipating potential weaknesses, which could jeopardise the SMS (Bragatto et al., 2015)	Already Present	LEARNING
7.Review and Improvement		In general, a revision of the SMS-MAH should include the concept of resilience, promoting awareness of the risks deriving from the external context, which are not always a priori foreseeable, but to which an organisation must be able to react ensuring the continuity of the activities and a rapid recovery in the event of forced service interruption, adaptation to new models, in the event of changes in the external context are permanent. (Podgórski, 2015)	Sometimes present,to improve	REACT

4.1.4. Resilience commitment of higher management

The SMS-MAH should include a context analysis (geologic, climatic, social, sanitary, politic, legal, economic, and financial) and specific actions to respond to changes, in order to prevent accidents triggered or amplified by external causes, as outlined in the Annex B, not mandatory but recalled in ISO 3100 scheme. It is essential for the policy, adopted by the higher decision level, to include the awareness about the context, which could quickly change with negative effects on the SMS. To anticipate difficulties coming from the economic and financial context, the higher management must define priorities to be addressed, in the cases of drastic budget reductions, reasonable cuts of less important safety activities. In general, it is not possible predicting all threats that may arise from a quickly evolving context, but the executive management must always be ready, paying attention also to minor aspects, which may be early signals of negative trends, according to “Anticipation” guideword for a resilient performance. An effective organisational structure allows that precursor and other convincing early signals quickly reach the top management to take prompt decisions. In fact, when dealing with an external crisis, it is crucial to understand its impact on the probability of accidents, on the capability consequence mitigation and on the context vulnerability. To cope with crisis, the establishment operators should adopt, with the utmost rapidity, countermeasures not compromising pre-existing safety, assign priorities, suspend non-essential and non-urgent activities, guarantee essential safety needs, prepare reasonable plans for recovery and get back to normal business. It stands to reason that for the response to imminent threat in addition to organisational structure, also corporate culture plays a determining role.

4.1.5. Regulator role in resilience promotion

In Italy, the Seveso inspections’ protocol includes both a classical audit of a SMS through a detailed checklist and a more dynamic analysis based on the study of the near misses and the study of failing barriers, according to the bow-tie model (Bragatto et al., 2017). In this regard, it should be evidenced that the dynamic approach represents an essential step to promote and enforce a resilience culture within Seveso establishments.

4.2. Resilience performance assessment

To assess the resilience of systems as a combination of the four cornerstones, an original questionnaire-based tool is developed and tailored on the system under analysis, following the reasoning of Hollnagel (2011).

4.2.1. The role of AHP method in the assessment

As detailed in the following sub-sections, the resilience assessment of the SMS-MAH of Seveso relies on the combination of a questionnaire-based evaluation of SMS and the Analytic Hierarchy Process (AHP) to decide the assignment of the weights. The questionnaire allows investigating the aspects that make the system resilient, assigning a score to each item. The AHP originally developed by Saaty (1980), allows the inclusion of a weights to the score. AHP method takes the subjective judgement of each assessor as an input and quantifies the weight of each judgement as output, as already made in several fields (Vargas, 1990; Saaty, 1994; Podgórski, 2015; Peciłło, 2016; Patriarca et al., 2018; Abrahamsen et al., 2020). Mathematically, the method is based on the solution of an eigenvalue problem. The results of the pairwise comparisons are arranged in a matrix. The first (dominant) normalised right eigenvector of the matrix gives the ratio scale (weighting), the eigenvalue determines the consistency ratio. A minimal level of inconsistency is acceptable, above a fixed threshold (typically 3%) results are considered not very stable and trustable. A further indicator to reduce the uncertainties in AHP is the consensus indicator. As discussed by Goepel (2018), it is derived from the concept of diversity based on Shannon alpha and beta entropy. It is a measure of homogeneity of priorities between the participants and can also be interpreted as a measure of overlap between priorities of the group members. A threshold limit of 65% is commonly assumed to define acceptable results, whereas high reliable consistency corresponds to index higher than 80%.

4.2.2. The development of the method

The present research has developed a scoring questionnaire, which, at the end, provides a sort of resilience index. The questionnaire is aimed to be distributed at the Seveso sites, to be filled in by the “establishment's operator”, as defined by the Seveso Legislation. In fact, the questionnaire can be effectively used as a research method since it allows eliciting quantitative description of trends, opinions and attitudes from a sample of a given population (Creswell, 2014).

The prerequisites for the method development are the definition of a hierarchical structure that highlights the objective of the study and the criteria for evaluation and the elements to be analysed. From the operational point of view, four steps are identified:

• 1.Selection of the critical items impacting the system resilience and requiring evaluation under impact of a specifc threat.
• 2.Evaluation of each item by proper choice on a 4-point Likert scale.
• 3.Quantitative weighting of each item to be performed by expert elicitation.
• 4.Final test validation of the method (questionnaire and weights).

In step 1), for any resilience cornerstone, (Anticipate, Monitor, React and Learn), the relevant items have been properly selected during focus group sessions, with a panel of experts, including industrial practitioners, regulators, authorities and researchers.

In step 2) for any identified item, a question was prepared, with relevant score, ranging from 1 to 4.

In step 3) an extended panel of experts of different nationalities was required to provide separate evaluation of the relative importance of the prosed questions, according to the AHP method. The panel included twenty three experts (from Italy and other European Countries and US), with different skills and representatives from different industrial sectors (gas, oil and chemical industry), from control bodies, as well as researchers in the field of loss prevention and process safety from academia. The authors contacted the experts through different channels, using both interviews, web meetings and paper forms to be filled in.

The weights, as defined by the panel, are essential to merge the scores gathered at each point and get a few “resilience indicators”, as discussed in the detail is section 5.3.

In step 4) the questionnaire, with the various weights well defined, was ready to be proposed to all HSE managers for a self-assessment of the “resilience” of their Seveso site. An Excel© sheet is provided to the potential users, in order to facilitate the computation of the weighted average, required to get the Resilience Indexes. A test for a sample site has be done, in order to verify its usability, before to propose it to the industrial users.

5. Results

In order to evidence the applicability of the methodology, in the following sub-sections a detailed discussion of results is presented according to the step-by-step approach previously detailed.

5.1. Indicator definition

25 basic indicators have been identified as relevant items to the health emergency management at Seveso sites. They have been arranged to refer to the eight points of the SMS-MAH. The first reason of this choice is very practical as the classical 8 points SMS-MAH scheme was much more familiar and easier to understand and manage from the experts of the panel. A further reason is the compatibility with the classical SMS-MAH checklist, which is definitely essential to promote the adoption of the proposed method and spreads it throughout the Seveso industries. Table 2 summarises the selected indicators and related references to both schemes. Even though the attention is more on the classical SMS-MAH scheme, the two complementary criteria help widening the understanding on the actual system resilience, as illustrated in Fig. 3 .

Table 2.

Indicators for a “resilience” assessment in the framework of the inspections at Seveso Sites. The 25 indicators are reported according to the SMS-MAH scheme, with the link to the four corners.

SMS POINT	Health Emergency Resilience Indicators	Four Corners
1. Policy	1.Higher level strategies, including health plan 2.Business continuity plan (activities essential for safety, recovery times, etc.) in the event of emergencies outside the plant 3.Financial studies on organisational impacts of health emergency	ANTICPATE
		REACT
		ANTICIPATE
2. Resources & Leadership	4.Identification of the resources necessary to support critical activities (people, processes, equipment) 5.Define face-to-face and remote meetings 6.Policies for employees infected or suspected of being infected 7.Agile/flexible work policies and flexibility of working time, including permits, temporary leaves and travel restrictions	MONITOR
		REACT
		REACT
		REACT
3. Risk Assessment	8.Identification of key sources of information on the epidemic, including trade associations, research institutes, experts 9.Identification of critical activities that cannot be suspended 10.Identification of circumstances in which it may be necessary to suspend operations 11.Possibility of remote process control (e.g. SCADA)	ANTICIPATE
		MONITOR
		MONITOR
		MONITOR
4. Operating Control, (including maintenance)	12.Timely documentation of the activities carried out for health emergencies 13.Specific attention to work permits, with extension of measures also to third parties 14.Specific measures for a safe shutdown for a longer or indeterminate period of time, taking into account the degradation of hazardous materials 15.Measures for a safe restart after prolonged shutdown, including warehouses	LEARN
		MONITOR
		LEARN
		LEARN
5. Management of Changes	16.Assessment of the effects on safety of the procedural changes introduced to meet the needs of the health plan 17.Assessment of the safety impact of organisational changes, including selected staff and supply outage 18.Assessment of collective and personal protective equipment (C/PPE)	MONITOR
		MONITOR
		MONITOR
6. Emergency Management	19.Assigning responsibility for planning in the event of an epidemic 20.Communications to personnel and other interested parties on the progress of the emergency and the repercussions on the management system 21.Availability of individual and collective protection equipment 22.Sanitation of work environments	ANTICIPATE
		REACT
		REACT
		REACT
7. Performance Evaluation	23.Analysis of the system's reactions to the pressures of the external context (evaluation of strengths and weaknesses) and sharing with all staff 24.Staff behaviour observation system	LEARN
		LEARN
8. Review & Improvement	25.The review takes into account in particular the response of the safety management system to the health emergency	REACT

Fig. 3.

System's hierarchy to be used for the application of the AHP.

5.2. Questionnaire development

In this step, for each relevant indicator, a question has been defined. An effort has been done to define a direct question as sharp as possible, in order to avoid any subjectivity in the answers and consequently minimise the uncertainty. Fig. 4 shows the questions, in the form suitable to be proposed to the management of a Seveso site.

Fig. 4.

“The questionnaire”, as proposed to the management of the Seveso establishments: a screenshot.

5.3. Items prioritisation

Results from individual expert evaluations were elaborated according to the Analytical Hierarchical Process (AHP) by proper implementation of the original tool developed by Goepel (2018). The overall results were subsequently split into two graphs: the former shown in Fig. 5 provides a visual representation of the indicator priorities grouped according the eight points of SMS-MAH. The latter visually depicts the priority of the same indicators grouped according to the four cornerstones of the resilience. In fact, even though the hierarchy used for AHP was based on the SMS-MAH scheme, it is worthwhile evaluating the results by proper aggregation according to the resilience cornerstone (see Fig. 6 ). It should be noticed that in both graphs, each rectangular area is proportional to the relative weight of the indicator (or indicator group) according to the performed AHP evaluation.

Fig. 5.

Results of the AHP: weights for the 25 indicators grouped according the eight points in SMS-MAH.

Fig. 6.

Weights for the indicators, grouped according the four corners of resilience.

In Table 3, the 25 indicators are listed and associated with their weights, as derived from the AHP application.

Table 3.

The 25 indicators listed according their weight, as defined by the experts panel.

SMS MAH	weight	Indicators	weight
I POLICY	10.4%	1 Health plan	7.1%
		2 Business continuity	2.2%
		3 Financial studies	1.1%
II RESOURCES	14.5%	4 Critical resources	5.6%
		5 Meetings	2.0%
		6 Infected policy	3.1%
		7 Agile work	3.7%
III RISK ASSESSMENT	24.3%	8 Sources of information	9.0%
		9 Critical activities	7.8%
		10 Operation suspension	3.6%
		11 Remote control	3.9%
IV OPERATING CONTROL	22.1%	12 Documentation of the activities	3.8%
		13 Permit to work	5.7%
		14 Safe shutdown	7.6%
		15 Safe Start-up	5.1%
V MANAGEMENT OF CHANGES (MoC)	11.6%	16 Procedures impact assessment	4.2%
		17 Organisation impact assessment	4.8%
		18 PPE Impact assessment PPE	2.5%
VI EMERGENCY	10.3%	19 Assigning responsibility	4.4%
		20 Communication	2.4%
		21 PPE	1.8%
		22 Sanitation	1.7%
VII PERFORMANCE	3.6%	23 System response evaluation	2.5%
		24 Staff behaviour	1.1%
VIII REVIEW	3.2%	25 Review	3.2%

5.3.1. Discussion on AHP results

The “ratio of consistency” and the “index of consensus”, discussed in §4.2.1, have been exploited to reduce uncertainties in the judgment. The AHP panel includes different experts, such a scholars and practitioners, regulators and industrialists, with different cultures and points of view. Table 4 shows the AHP consistency and consensus values. Consistency is very good and that may explained by the competency and the attention given by the experts to the matter. As expected, there are many differences of opinions, due to the different profiles of the panelists. Thus, consensus index is a bit lower in a few points (namely points 7 and 4), but the overall consensus is certainly within the acceptability thresholds and, for the overall results, definitely satisfactory. Of course, consensus index is not applicable for point 8 “Review”, because there is a single option. Thus, uncertainties introduced by experts’ individual opinions is balanced by the calculated consensus and consistency indexes. At the end, the weights chosen for the 25 items, as resulting from AHP application are credible, because the panel was representative of different stakeholders and consensus and consistency were both adequate.

Table 4.

AHP Consistency and consensus indicators. The value marked with asterisk* have an inadequate consensus.

Details Node:	Consistency Ratio	AHP group consensus
Acceptability thresholds	3%	65%
1 POLICY	1.01%	84.05%
2 RESOURCES	0.08%	67.34%
3 RISKASSESMENT	0.66%	65.06%
4 OPERATINGCONTROL	0.15%	59.18% *
5 MOC	0.11%	68.93%
6 EMERGENCY	0.58%	64.81%
7 PERFORMANCE	0.00%	47.87% *
8 REVIEW	n.a.	n.a.
Resilience Assessment	0.63%	69.46%

5.3.2. Resilience index

The weights w _i, derived from the AHP, has been used to assign s _i a weight to each score gathered through the questionnaire. The Resilience Index I _R is defined as the weighted average of the 25 scores:

$$I_R=\sum _{i=1}^{25}{s}_i\cdot w_i/\sum _{i=1}^{25}{w}_i$$ (1)

As the scores ranges from 1 to 4, also the resulting I _R ranges from 1 to 4. The interpretation of the I _R is summarized in Table 5.

Table 5.

Meaning of resilience indicator.

1≤ IR < 1.5	1.5≤ IR < 2.5	2.5≤ IR < 3.5	3.5≤ IR
Bad	Poor	Adequate	Good

It is also possible to evaluate if each of the eight points of the SMS-MAH is more or less oriented to the “resilience”. That may be interesting in order to understand the weak points of the SMS-MAH and consequently address improvements. The definition of the partial index for the jth point in the SMS-MAH is quite simple:

$$I_{R,SMSj}=\sum _{i=k_j}^{k_{j+1}}{s}_j\cdot w_i/\sum _{i=k_j}^{k_{j+1}}{w}_i$$ (2)

kj for j ranging from 1 to 8 (j corresponds to the items 1, 4, 8, 12, 16, 19, 23 and 25 of Table 5).

A further use of the scores and the weights is the evaluation of partial resilience indexes, which may be done by splitting the overall index in four values according to the four corners of the model.

$$I_{R,Anticipation}=\sum _i{s}_i\cdot w_i/\sum _i{w}_{i}i=items\mathrm{1,3,8,14,15,19}$$ (3)

$$I_{R,Monitoring}=\sum _i{s}_i\cdot w_i/\sum _i{w}_{i}i=items\mathrm{4,9,10,11,13,16,17,18}$$ (4)

$$I_{R,\mathrm{Re}act}=\sum _i{s}_i\cdot w_i/\sum _i{w}_{i}i=items\mathrm{2,5,6,7,20,21,22,25}$$ (5)

$$I_{R,Learn}=\sum _i{s}_i\cdot w_i/\sum _i{w}_{i}i=items\mathrm{12,23,24}$$ (6)

Of course, both total a partial indicators will be useful for the management to make decisions (and possibly investment) aimed at the improvement ot the resilience of the safety management system.

5.4. Reference case-study

In order to show the methodology application, a simple example of evaluation for a typical Seveso establishment is summarised for the sake of brevity in Fig. 7 . All partial I _R indexes are shown, both related to the SMS and to the four corners. The case-study shows a well-organised system, with an adequate degree of resilience. As demonstrated during pandemic crisis, the system is adequate to anticipate and monitor difficult situations and it is ready to react and to learn from difficulties. For all points in the SMS, there is an adequate level of resilience, but for point 2 “resource” should be strengthened.

Fig. 7.

The calculation of the Resilence indexes (partial and total) for a sample Seveso site.

A certain degree of uncertainty has to be included in the result. As discussed in §5.3.1, the weights are affected by a little uncertainty, due to a relatively lower consensus at two points (“Operating Control” and “Performance”). Looking in eq. (1), it can be seen that a unitary error in one of the weights (1%) propagates in the final result as an absolute error not higher than 0.04. Compared to the sample case in Fig. 7, this value is very far to invalidate the results and to push to wrong decisions. Further uncertainties due to score assignment are possible, but the question have been organised to control them for the better, as discussed in the detail in §5.2.

Even if the approach requires further validation, the proposed overall index can provide a benchmark and be exploited to address future improvements. Upon proper further refinement and field validation, following the definition provided by Mendonça (2008), it is believed that the overall framework can help in “monitoring and managing performance at the boundaries of competence under changing demands” and environmental stressor such as Covid 19 pandemics.

6. Conclusion

The simple methodology discussed in this paper trust on the consensus of a qualified panel of experts scoring an acceptable margin of uncertainty. Its main appeal is that it is based on actual data, verified during the pandemic crisis. Contrarily to the conventional performance indicators available in the literature, the framework is not restricted at investigating the potential of the system. It stands to reason that the approach does not neglect the “resilience” sources already inherent into the SMS-MAH, which exerted a determining role under pandemic time to face pretty well the crisis, as demonstrated by the performances of Italian oil and gas companies. Thus, the approach is ready to be integrated in a normal audit at a Seveso site and could also be eventually considered from Seveso Competent Authorities and Regulators. Even though there is an obvious focus on health issues, the proposed approach could be applied to further different crisis liable to hit the Seveso industries. In this regard, even if it is not possible controlling external events that could jeopardise the safety system, the resilience approach can enhance the capability to face unexpected crisis, overcome them and become stronger and stronger again. The current version of the model is fully compatible with the structure of SMS-MAH, as defined in Italian legislation, which in turn is very close to the requirements of EU Directive. It is, anyway, pretty easy to transfer the present approach into other SMS standards based on the structure defined in the general framework of the standard ISO 3100 (2018) for the risk management, such as ISO 45001 (2018) for safety at work or UNI 10617 (2019) for the major accident prevention. The new ISO 31000 version, which overcomes the 2009 version, already include a few basic resilience principles, therefore an integration would be even more suitable.

Authors contributed

All the authors contributed, each in their own field, to the data collection, through interviews with operators and experts. Bragatto led the working group and developed the software part, Vairo developed the resilience part, Milazzo developed the multifactorial analysis, Fabiano took care of the scientific framing, revision and data quality verification.

Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Appendix A. Supplementary data

The following is the Supplementary data to this article: