0957–5820/03/$23.50+0.

00
# Institution of Chemical Engineers
www.ingentaselect.com=titles=09575820.htm Trans IChemE, Vol 81, Part B, January 2003

THE NEW VERSION OF ARIPAR AND THE BENEFITS

GIVEN IN ASSESSING AND MANAGING MAJOR
RISKS IN INDUSTRIALISED AREAS
G. SPADONI 1 , S. CONTINI 2 and G. UGUCCIONI 3, *
1
University of Bologna, DICMA, Bologna, Italy
2
European Commission, Joint Research Centre, Ispra, Italy
3
Snamprogetti S.p.A., HSEQ, San Donato Milanese, Italy

T
he concentration of industrial activities located close to residential areas poses
problems of land use planning, risk control, emergency planning and responses to
public authorities. The decision-making process requires the analysis of a large amount
of information on risk sources, accident modelling, population distribution, etc. The treatment
of such information needs the support of informatic tools. ARIPAR version 3.0 is a software
package that implements a probabilistic methodology for the assessment of the risks of
complex industrial areas, including transport of dangerous substances, to obtain a number of
different risk measures. The paper illustrates the basis of the methodology and the main
features of the software; some elements from real applications on industrial areas in Italy are
presented as well.

Keywords: quantitative area risk analysis; accident scenario; accident consequences; local
risk; individual risk; societal risk; geographical information systems.

INTRODUCTION
Public authorities and private companies adopt quantitative
area risk analysis (QARA) when major risks posed by large
industrialized sites have to be examined and risk-related
decisions have to be taken. These decisions are related, for
example, to process safety, the identiŽ cation of preventive
and protective measures for risk reduction; land-use
planning, the ‘safe’ siting of residential quarters or new
industrial plants; territorial emergency planning, the deter-
mination of strategies to protect people, the environment and
assets during an accident.
This practice has recently been conŽ rmed and sanctioned
by the Community Directive 96=82=EC, as it is the basis
recommended by article 12 for setting out a correct policy of
Land Use Planning (LUP).
If a history should be made of the use of area risk studies,
Ž rst of all the Canvey and Rijnmond studies (Health and
Safety Executive, 1978; Rijnmond Public Authority, 1981)
should be introduced, since they represented the Ž rst attempt
to evaluate the risk from several plants. In this context, the
ARIPAR project (Egidi et al., 1995) was the Ž rst study
where the risk sources considered were a mixture of Ž xed
installations and of all transport systems (road, railway,
pipeline, and ship) and where the aim of the study was
explicitly to give support to LUP (Uguccioni et al., 1991).
Among the results obtained from the Project, whose maps
*Current address: D’Appolonia SpA, Milano, Italy.
and curves supported and still today give help to local
authorities in taking decisions (Spadoni et al., 1997), a
major achievement was the design and production of soft-
ware to support the risk analysts in performing the large
number of calculations required by QARA studies. The
software—to which the same acronym as the originating
project was given—has since then undergone a number of
improvements (Bellezza et al., 1998). It is today in Italy a
reference tool for the QARA and has been used in a number
of area risk assessment studies.
The paper describes the main scientiŽ c and technical
aspects of the software ARIPAR, the hypotheses and the
numerical methods implemented, and the main capabilities
of the tool. Some applications are brie y described to show
how the results can support authorities in taking decisions
on land use planning and on the adoption of risk reduction
measures. These studies give a good picture of the back-
ground of procedures and criteria, which in the near future
will be deŽ ned by the Italian regulatory process in an
application decree.
FUNDAMENTALS OF THE ARIPAR
METHODOLOGY
The quantitative assessment of the impact on a territory of
many risk sources, from process, storage and transport
systems, requires the assessment of speciŽ c risk measures,
most of them used in all European countries.
Risk contours for individual risk representation and F–N
graphs of societal risk are familiar to risk experts. Some

19
20 SPADONI et al.

other measures can be added to complete the risk picture. amounts of transported substances and above all the routes
The societal risk may also be represented by of an I–N used is more complex.
histogram, showing how the population of the reference area The assessment of risks posed by each single source
(the geographical area that undergoes impact by risk begins with the identiŽ cation of a set of likely accidental
sources) can be grouped into categories of individual risk events and continues with the evaluation of all occurrence
I. The risk related to the geographical location can be frequencies and consequences. It is not necessary to recall
properly depicted by local risk, which does not contain well-known procedures and tools for risk quantiŽ cation;
any probability of presence of population or allowance for however, mention must be made of the rules to guarantee
indoor protection, so that the pertinent distribution map is a the technical validity of the results. In particular a common
sort of property of the industrialized area. set of methods for identifying sources and simulating
Essentially three types of information are contained in a physical consequences should be used to compare results
risk measure: the occurrence frequency=probability of an and rank source importance.
accident or of the event chain which causes the accident; the This last evaluation step transforms the results of safety
kind and distribution of physical effects responsible for the analyses of plants and transports into a large set of pairs of
reference damage; and the relation between physical effect frequencies and consequences of accident scenarios: it is up
and damage extent. When the societal risk is considered, the to the reassembling model to combine them in order to
information on the impact area must include the population produce risk measures for the whole impact area.
distribution and the location of vulnerability centres Equations combining such pairs are different if point
(hospitals, commercial centres, schools, etc.) in order to sources (plant top events) or linear sources (transport
evaluate the number of human beings suffering damage. routes) are considered, because the location of accidents
Territorial information, such as land use (urban, residential, ‘travels’, in the second case, on roads, railways, pipelines or
rural) and average meteorological conditions, is implicitly shipping routes.
considered in deŽ ning the population distribution and If P is an area point, the local risk is evaluated as follows:
frequencies and consequences of accident scenarios
for point sources
(for instance roughness, conŽ nement degree, ignition
probability). Note that information on soil composition N
X NST
X NI …i†
X
and stratiŽ cation or surface or underground water typologies RL…P† ˆ li pi;s ai;j
are not requested because the risk measures mentioned do iˆ1 sˆ1 jˆ1
not permit description of damages to the environment. N yv
Ncv X
X
Recently legislation has requested that safety reports include £ pcv;yv =s v· i;j;cv;yv …xS!P † …1†
evidence on such types of damage, but at present no index is cvˆ1 yv ˆ1
generally accepted to describe global effects on human
beings and environmental components. Indexes based on a for linear sources
fuzzy set approach, which put together the severity of Ni NST NI …i†
damage to different resources, have been proposed, but X X X
they are not widely accepted. Similarly, chronic effects of RLt …P† ˆ li pi;s ai;j
iˆ1 sˆ1 jˆ1
long-term releases and occupational health issues are not
included in the adopted risk measures. … X Ny v
Ncv X

These introductory statements make it clear that, when £ pcv;yv =s v· i;j;cv;yv …xdl! P † dl …2†
l cvˆ1 y ˆ1
the risk assessment of an industrial area is performed, the v

requested evaluations are not simply the sum of the risk

analysis of each industrial plant, but the complexity
introduced by the interactions between all risk sources and
the territory is taken into account.
In a QARA procedure the choice of the impact area is the
Ž rst step: the preliminary choice has to be veriŽ ed and, if
necessary, corrected after executing the analyses. Apparently
this implies an iterative procedure, but in practice the Ž rst
choice is conservative and often includes residential areas
that are not subjected to signiŽ cant risks. Obviously the
impact area due to the transport of hazardous substances is
larger, since it involves crossed territories, but the trafŽ c
density and hence the associated risk is surely higher near
industrial sites.
On the cartography of the impact area plants, roads,
harbour, railways, pipelines needs to be shown and, as
outlined above, information on population. The risk sources
inventory is the second step of the QARA. A complete
quantitative knowledge of hazardous substances processed
and transported in the area allows collection of data that are
useful in performing source risk analyses. The collection of
information on plants is relatively simple when safety
reports are available, whereas the task of Ž nding the
In equations (1) and (2) v· is the average vulnerability (the
fatality probability) in P due to all accident scenarios whose
direction is included in a sector of the wind rose having yv as
bisector. It follows that the deŽ nition of an average accident
scenario, whose vulnerability is given by
…
1
v· i;j;cv;yv …xS…dl†! P † ˆ v dy …3†
yset¢v yset¢v i;j;cv;yv
It is worth noting that equations (1) and (2) do not contain
any information on the population at risk, which, on the
contrary, will be included in the corresponding individual
risk evaluation. In fact each location of the geographical area
can be occupied by people who can or cannot be present in a
given season, during day or night, and, if present, can be
outdoors or indoors. These conditions deŽ ne ‘categories’ of
population, sharing the same probability of presence.
Because the presence probability may signiŽ cantly reduce
the vulnerability of a category in each scenario, a correct
evaluation of individual risk requires explicit consideration
of how the top event depends on day=night, through the
probability pg, and what the probability is of a person being
indoors or outdoors during a speciŽ c season, during day or

Trans IChemE, Vol 81, Part B, January 2003

 NEW VERSION OF ARIPAR
night, through pio=s=g . Obviously, the indoor exposure miti-
gates the physical effect of the scenario, so that a speciŽ c
factor has to be deŽ ned bi;j;cv;yv ;io .
With these considerations, the following equation holds:
N NST 2 NI …i†
X X X X
RI cat …P† ˆ li pi;s pi;g ai;j
iˆ1 sˆ1 gˆ1 jˆ1
Nyv
Ncv X
X gating contributions of plants, substances, risk sources, etc.,
£ pcv;yv =s v· i;j;cv;yv …xS! P †
cvˆ1 yv ˆ1
X
£ pcat
io=s=g bi;j;io
io
which describes the geographic distribution of the individual
risk for each population category.
As previously said, societal risk can be represented by
F=N curves, a measure of the societal impact of all accident
scenarios; in order to build the different contributions,
attention has to be focused on an average accidental scenario
occurring in S; its frequency is given by:
Fsc …i; j; s; g; cv; yv † ˆ li pi;s pi;g ai;j pcv;yv =s
The population subject to damages is distributed on the
impact area or concentrated into ‘vulnerability centres’, e.g.
hospitals, churches, stadiums, supermarkets. In order to
perform the risk calculation the distributed population is
also represented on a grid and the number of fatalities results
from:
Ncat
XX
Nsc…i;j;s;g;cv;yv † ˆ Nk v· i; j;cv;yv …xS! Pef †
Pef kˆ1
X sent pipes, roads, pipelines or electric power lines. Polygons
£ pkio=s=g bi;j;io
io
where Pef is the set of points where the physical effect of the
scenario is not negligible (an effect is negligible if threshold
values are not exceeded).
The pairs of Fsc and Nsc so obtained are the basic elements
for producing the cumulative F–N curve. Analogously, the
F–N curves for transports can be calculated too, after
partitioning each linear source into segments.
A complete and detailed procedure of reassembling risks
due to many sources cannot neglect the importance of domino
effects, because new accidents in the industrial area may be
produced by an initiating accident. The chain of events:
Physical explosion of a vessel
) overpressure
) damage to an atmospheric tank
) release of a toxic liquid
) pool evaporation and dispersion of a toxic cloud
is an example of different effects (overpressure and toxic
load) and consequently of different probabilities of fatality
in the impact area.
A simple way to consider domino effects has been
suggested from the outlined procedure. The top events of
plants are assumed as the vulnerable locations of the plant
themselves and only these locations are considered as source
or target of domino events through the use of interaction
curves. Each curve is deŽ ned as a ‘locus of points whose
Trans IChemE, Vol 81, Part B, January 2003
21
distance from a physical location of a top event is the
greatest among those resulting from deŽ ned threshold
values of effects of radiation and overpressure’.
Equations (1)–(6) give an artiŽ cial picture of the risk
measures, clearly showing the large amount of information
to be dealt with. The global impact on the territory could be
changed if it does not satisfy tolerability criteria and the
changes can take advantage of the possibility of disaggre-
and all the parameters which strongly in uence the results,
as will be shown below.
…4†
THE ARIPAR SOFTWARE TOOL
Spatial Data in Risk Analysis
The methodology presented in the previous section has
been implemented into ARIPAR, a software tool running on
a Windows PC platform and using the ESRI desktop
Geographical Information System ArcView 3.2.
A geographical information system (GIS) is a software
…5† system for capturing, checking, storing, retrieving, manipu-
lating, analysing and displaying spatial data, i.e. data that are
characterized by their location on the Earth. The method of
representing spatial data is through maps, a two-dimensional
collection of graphical features (objects) characterized by
their x–y co-ordinates (Heywood et al., 1998). Spatial data
can be represented in vector or raster formats. The funda-
mental types of entities in a vector format are points, lines and
polygons. These three entities are used to portray real-life
objects. For instance, in a chemical facility points may
represent entrance gates or stacks, whereas lines may repre-
…6†
may represent site fences, plant units, buildings, vessels, etc.
Raster data record spatial data in a matrix data-structure in
which the smallest logical unit represents a pixel, i.e. a dot on
the screen. Raster data formats are typical of scanned maps,
digital photos and satellite images. The information stored in
a pixel depends on what the picture represents, e.g. it may
represent the light re ected by the object in a satellite image
or the brightness value in a scanned map. The combined use
of raster and vector data formats increases the powerfulness
of a GIS in modelling and solving problems requiring spatial
data representation and analysis.
A set of graphical objects of the same type, i.e. characteri-
zed by the same attributes, represents a thematic map, also
referred to as theme or layer; road networks, accident
locations, damage zones and risk contours are all examples
of thematic maps. More complete maps, referred to as
topographical maps, can be obtained by applying the overlay
operation to two or more thematic maps having the same
coordinate system.
The analysis of spatial data is fundamental in supporting
decision-making, and it can be performed on both raster and
vector formats. Spatial analysis, i.e. the analysis of spatial
data, is based on map algebra (Tomlin and Dana, 1990), a
special algebra applicable to thematic maps. Overlay and
map algebra allows thematic map composition for problem
solving to be made. For example, the thematic map of the
population distribution combined with the accident damage
zones gives a new map showing the spatial distribution of
the population at risk. Spatial data used in industrial risk
analysis are listed in Table 1 (Contini et al., 2000).
22 SPADONI et al.

Table 1. Main geo-referenced data and results in industrial risk studies.

Phase Geo-referenced data Geo-referenced results

Hazard identiŽ cation Plant layout Accident location
Accident frequency analysis — —
Accident consequence analysis Plant layout Damage zones
Road, rail, water courses, pipeline networks Accident location
Accident location
Topographic map of the area
Risk assessment Plant layout Damage zones
Road, rail, water courses, pipeline networks Accident location
Topographic map of the area Local risk contours
Land use and population distribution Individual risk contours
Vulnerability centres
Risk management Local risk contours Risk zoning
Individual risk contours Land-use zoning
Topographic map of the area Preferred transport paths
Plant layout
Road, rail, channel, pipeline networks

In ARIPAR, overlay and map algebra are extensively
applied to the spatial data listed in Table 1, to offer the
analyst a powerful tool for area risk analysis and risk control
over time.
The ARIPAR Analysis Procedure
The area risk analysis procedure, shown in Figure 1, may
be subdivided into four phases concerning: (1) territorial
data; (2) conŽ guration data; (3) accident scenario evaluation;
and (4) risk calculation and representation.
Phase 1. Territorial data
This phase starts with the deŽ nition of both the source
area and the impact area. Maps used have generally a scale
1:25,000 or greater, depending on the extension of the
effects of accident scenarios.

Figure 1. Flow diagram of the risk analysis procedure implemented in ARIPAR.

Trans IChemE, Vol 81, Part B, January 2003

 NEW VERSION OF ARIPAR 23

The basic cartography, which is generally available on
paper, must be scanned and its scale assigned so that
distances can be measured and areas calculated. The map
may already be georeferenced and available in digital form.
Georeferencing is the assignment of geographical coordi-
nates to each pixel of the map. High-resolution satellite
images (e.g. SPOT, LANDSAT) may be used when the
topographical map of the impact area is not up to date.
The raster map (or, alternatively, the satellite image) of
the impact area is used as a background image to draw all
thematic maps of interest. ARIPAR considers thematic maps
on risk sources (Ž xed plant and transport of substances on
road, rail, water courses or pipelines), population distribu-
tion and population concentrated into vulnerability centres.
The generation of thematic maps is straightforward.
The population distribution on the impact area must be
described with care due to its importance for the determina-
tion of both individual and societal risk measures.
For the description of such a distribution, polygons
are drawn representing different land uses, e.g. residential
(high, medium and low density), industrial, agricultural, etc.
Each polygon is assigned either the number of people or the
population density. The population density can be assigned
to each land use category and the number of people is
automatically calculated through the surface of the polygon.
This feature makes the description of the population
distribution a simple and fast operation.
Furthermore, a number of singular points representing the
vulnerability centres can be added. The data to be given to
each vulnerability centre are the number of people present
and the probability that people are present during a speciŽ ed
time interval (day=night, season). The number of people is
deŽ ned on the basis of two sets of data.
(1) Census data obtained by local authorities. These
comprise the total number of people present over a
sub-area (these sub-areas are normally deŽ ned by the
municipalities). This total number of people is dis-
tributed over the grid covering the sub-area taking into
account the fact that not all residents are found in built-
up areas (in recent studies it has been assumed that 90%
of people are present in built-up areas, 10% outside).
(2) Data from local Ž re protection authorities for the total
number of people present in vulnerability centres. These
comprise the maximum number of people allowed by
Ž re protection regulations in a speciŽ ed building or
structure. The location and identiŽ cation of the vulner-
ability centres is done with the support of the local
authorities.
The population is also classiŽ ed according to the prob-
ability of being present in the polygon. The probability of
presence (indoor and outdoor) is calculated from the number
of days per week and hours per day of presence in the
speciŽ c polygon for each ‘population category’, i.e. class of
population deŽ ned by the same presence time.
Examples of population categories are ‘residents’ (present
the whole week, mostly indoor), ‘students’ (present mostly
indoor for some of the time), ‘commercial centre users’ etc.
The categories appropriate for each situation and the data
for the calculation of the probability of presence are deŽ ned
in strict consultation with local authorities.
As previously mentioned, the risk is calculated with
reference to a grid, which is automatically generated in
each polygon describing the population layer. The centre of
each cell is assigned the population automatically calcu-
lated with reference to the density and the cell area. The
maximum number of grid points for the whole impact area
is set to 10,000. The user can assign the grid cell dimen-
sion to each land-use category, e.g. 100 £ 100 metres close
to risk sources and high-density residential areas,
200 £ 200 meters for low-density population areas, and
so on. Generally the cell dimension increases with distance
from the risk sources.
Figure 2 is an example of possible representations of the
population distribution. In the Ž rst example a dot represents
a given number of people (the relation between dot and
number of people is deŽ ned by the analyst). In the second
case coloured polygons represent the different land uses, to
which a given population density and a given cell dimension
are assigned.
This Ž gure also shows the different risk sources: three
plants, two roads, a railway and a pipeline. These thematic
maps can easily be generated using the ARIPAR editing tools.
The graphical objects making up thematic maps are
described by attributes stored in the geodatabase. This
description can be enhanced with drawings, photos, docu-
ments of any type (with extensions doc, ppt, pdf, xls, tif,
bmp, jpg, etc), as well as satellite images, video clips, web
addresses, and even user applications. These are all types of

Figure 2. Screen dump of ARIPAR showing territorial data and risk sources.

Trans IChemE, Vol 81, Part B, January 2003

24
information that can be linked to graphical objects on
any theme.
Phase 2. ConŽ guration data
These data concern: (1) the parameters of vulnerability
models; (2) default values for the automatic computation
of road transport frequencies; (3) population categories
with the associated probability of being present vs season,
day=night, indoor=outdoor; (4) meteorological data.
The parameters of vulnerability models (either Probit
equations or threshold values) can be deŽ ned by the user,
for up to 98 different substances. The data for the road
transport frequency calculation are the accident frequency
and the probability of release given the accident, for
different ‘road categories’ (This feature allows site-speciŽ c
statistical values for the accident frequency of road transport
to be taken into account.). ARIPAR then, on the basis of the
length of each road of a given category, calculates the
accident frequency.
The number of population categories and the data required
for their characterization can be deŽ ned as appropriate to the
speciŽ c site.
Meteorological data can be aggregated into a maximum
of Ž ve categories. Each category is characterized by the
couple ‘Pasquill stability class–wind speed’. Up to 16 wind
directions can be deŽ ned with their associated yearly
frequency of occurrence.
Phase 3. Accident consequence analysis
A speciŽ c feature of the ARIPAR software is that it does
not perform any hazard identiŽ cation and has no frequency
or consequence analysis model embedded: all the data
relevant to the analysis are obtained off-line. This
allows the user to choose the data and modelling that
best suit the speciŽ c case. This feature derives from the
decision, developed during the original ARIPAR project, to
Figure 3. Dialogue interface for the description of accident scenarios.
SPADONI et al.
use as far as possible information available in Safety
Reports to ensure consistency of the overall area risk
analysis with the criteria and results already approved by
the competent authorities and considered in emergency
planning.
Therefore, each accident scenario with related frequency
and consequence is associated with the accident location in
the area map. The data needed for the complete description
of the risk sources are the geographical location of the
sources, the list of the accident scenarios, the frequency of
occurrence, and the spatial distribution of the consequences
associated with each scenario.
For Ž xed installations the data describing the scenarios
are taken from the Safety Reports issued under the major
hazards legislation. For transport systems, for which no
safety reports are generally available, the risk assessment
has to be carried out on the basis of data collected from the
companies shipping or receiving hazardous substances.
These data refer to hazardous substances involved, the
number of transports per year, the physical conditions of
transports and the origin=destination locations. The route
(for road transport) cannot be deŽ ned with certainty, being
to some extent dependent on individual drivers’ choices.
The information on origin or destination, however, allows a
most probable route to be inferred, considering the road and
trafŽ c patterns in the area.
Concerning the quantiŽ cation of transport accidents,
frequency data are taken from international literature
(Bonvicini et al., 2001; EGIG, 1998; CONCAWE, 1994).
Three reference leak sizes are assumed: typically a small
leak ranging from 0.5 to 1 inch; a large rupture ranging from
2 to 4 inches; and a full bore or catastrophic rupture. The
accident scenarios deriving from the analysis are deŽ ned
through the application of the event-tree approach adapted
for each type of substance involved. The consequence
analysis of signiŽ cant scenarios is performed by means of
user-selected models. The deŽ nition of all scenarios is
Trans IChemE, Vol 81, Part B, January 2003
 NEW VERSION OF ARIPAR
therefore completely under the control of the user, who can
use the set of data, assumptions and criteria most suited for
the speciŽ c case.
This phase (deŽ nition of risk source data and additional
calculations) is the most signiŽ cant phase of a QARA,
involving at least 50% of the total project resources.
Accident scenarios that can be considered in ARIPAR are:
° unconŽ ned vapour cloud explosion;
° physical explosion;
° Ž reball;
° jet Ž re;
° pool Ž re;
° jet dispersion;
° heavy gas continuous release;
° heavy gas instantaneous release;
° Gaussian dispersion.
For each scenario, the frequency of initiating event and
the probability of occurrence are entered in the window
shown in Figure 3.
An important feature of the software is related to the
calculation of the vulnerability in each point of the grid and
for each vulnerability centre. Three sets of information are
needed for each scenario:
° vulnerability models (Probit equations, threshold
values);
° data for the calculation of the consequences on each
point and for each reference meteorological condition;
° exposure times.
The present version of the software allows the preferred
vulnerability model for heat radiation, overpressure and
concentration of up to 98 different toxic substances to be
input.
Since the consequence analysis is performed off-line
using user-selected consequence analysis models, the
results must be made available in a predeŽ ned format
containing the distance, value of the effect and, depending
on the scenario modelled, other information required to
simulate the effect pattern (e.g. plume width, plume
height etc.).
Figure 4. Fitting the calculated results of a given scenario with interpolating functions implemented in ARIPAR.
Trans IChemE, Vol 81, Part B, January 2003
25
On importing these Ž les ARIPAR calculates interpolating
coefŽ cients on the basis of predeŽ ned functions that repre-
sent a typical shape for each scenario. From these coefŽ -
cients a good approximation of the effect values that would
be obtained with the user’s original model can be calculated
for each grid point.
To help the user in assessing the correctness of the
interpolation, the values of the effect vs distance are
graphically represented, together with the points read from
the input Ž le. If the interpolation curve generated is not
satisfactory the user can modify the coefŽ cients to obtain a
better Ž tting and checking the results of each choice in the
control window (see Figure 4).
The exposure time is related to the duration of the
accident and to the time needed for the implementation of
emergency measures. ARIPAR allows an exposure time to
be deŽ ned that is different for each scenario. This exposure
time is kept constant over the whole study area and set
as the minimum between the duration of the scenario and
the time assumed to be necessary for a person to Ž nd an
effective shelter.
Phase 4. Area risk calculation
The risk calculation is performed over the whole impact
area, i.e. for each cell of the grid. The risk sources to be
considered can be deŽ ned by the user; the analysis can
therefore be made for the whole risk sources or for a speciŽ c
subset of them. This feature allows new risk sources to be
added and analysed without recalculating previously
analysed sources.
The speed of the calculation, together with the facility of
retrieving and modifying data on scenarios, exposure
times, vulnerability models, etc., allows the user to inter-
actively perform sensitivity analysis to verify the effects,
on the area risk indicators, of changes in assumptions
and data.
Typically, the whole phase of running the program and
performing the sensitivity analyses requires a minor fraction
of the total resources involved in a project, of the order of
less than 20%.
26
Figure 5. Local risk contours over the impact area.
The following results are obtained for any selected set of
risk sources:
° local=individual risk contours represented as points,
polylines or grid;
° local risk values on a predeŽ ned point the area with the
ranking of major contributors;
° F–N curves;
° I–N histograms;
° histograms of the importance of the risk typologies;
° histograms of the importance of the risk sources vs the
number of fatalities.
Furthermore, it is possible to display, for any accident, the
damage curves corresponding to three different effect
values.
Figure 6. Histogram showing the ranking of sources over the whole area.
SPADONI et al.
These results are available for selected substances, risk
sources or population category. This means that as many
risk maps can be straightforwardly generated as the number
of selections made by the analyst.
Figure 5 is an example of representation of the local=indivi-
individual risk contours; another useful representation is
through the use of coloured surfaces for different risk levels.
Figure 6 gives the importance of the sources, with
reference to a speciŽ c number of fatalities. From this
histogram attention is drawn to the sources where mitigation
measures can be most effective in reducing the overall risk.
Figure 7 is the classical representation of the societal
risk as F–N plots. These curves are generated for each risk
category and for the total risk. These results are useful for
identifying the major contributors and consequently for
taking decisions about intervention for risk reduction.
Other useful information is the importance of the risk
sources in the overall local risk level in a speciŽ c point, as
shown in Figure 8. This histogram gives the ranking of the
risk sources that contribute to the risk at a speciŽ c point, e.g.
a vulnerability centre. Hence the most appropriate measures
for risk reduction can be identiŽ ed.
Finally, considering that the risk changes over time as a
consequence of variation in risk sources (old plants are
closed, new plants are constructed, quantity=type of
substances change, new transport paths are used, etc.), it is
useful to be able to compare area risk maps. From the
comparison of two risk maps a new map is generated showing
risk changes (increase–reduction) over the impact area.
Status and Availability of ARIPAR
The Ž rst two versions of ARIPAR had an Italian interface,
because of their exclusive use in Italy, whereas the latest
version (ARIPAR Team, 2002) has an English interface.
It has been developed for distribution to the competent
authorities and supporting organizations of the candidate
countries participating in JRC’s PECO Project 26
Trans IChemE, Vol 81, Part B, January 2003
 NEW VERSION OF ARIPAR 27

Figure 7. Plot of the F–N curves for the different typology of risk, including the total risk.

‘Management of technological and natural disasters in
Central and Eastern European countries (PECO)’. This
project aims at the design and creation of compatible
regional and national central information systems for
supporting authorities in the management of risk and
emergency situations owing to natural and technological
hazards and the existence of heavily polluted sites.
The countries participating in the project are Bulgaria,
Czech Republic, Estonia, Hungary, Latvia, Lithuania,
Poland, Romania, Slovakia and Slovenia. ARIPAR is avail-
able free of charge to the competent authorities of EU
member countries and to the Directorate General for Envi-
ronment (DG-ENV) of the Commission.
All users can beneŽ t from the ARIPAR web site (www.
aripar.it), where they can Ž nd assistance, pose questions,
propose further improvements of the tool, etc.
Since interest has also been shown by some industrial users,
the Emilia Romagna Region and the Joint Research Centre
have been setting up a suitable procedure to make ARIPAR
available to them. This procedure should be completed soon
and the software should be delivered to all industrial users,
under licence agreement, by the end of 2002.
The ARIPAR working group is continuously involved in
the implementation of new capabilities with the aim of
further improvement of the tool, in particular from the
decision-making point of view.
APPLICATIONS
Table 2 summarises the main QARA studies performed
with ARIPAR in Italy (Egidi et al., 1995; Uguccioni et al.,
1999; Vanni, 2000; Regione Emilia-Romagna, 1999;

Figure 8. Example of local risk source ranking for a selected point.

Trans IChemE, Vol 81, Part B, January 2003

 28

Table 2. Main data of the Italian area risk analysis studies performed using ARIPAR.

Hazardous materials transports

Scenarios (Ž xed Gnjless Study area Study developed

Area Industry=plant installations) Trucks=year wagons=year Ships=year Pipelines (km2) by: On behalf of: Status
Ravenna . . .=47 379 128,000 2500 3500 21 205 Snamprogetti– Civil Protection Completed 1990
NIER–DAM Department–
and University Emilia Romagna
of Bologna Region
Livorno 11=35 306 136,800 3800 3800 12 45 Snamprogetti National Research Completed 1999
Committee
Piombino 3=5 46 7300 — — — 3 University of Regional Completed 1999
Pisa Environmental
Protection
Agency–Tuscany
(ARPAT)
SPADONI et al.

Mantova — — 85,180 24,700 — — 5 University of Completed 2001

Pisa Istituto
Superiore
Sanità
Priolo 15=>200 To be deŽ ned To be deŽ ned To be deŽ ned To be deŽ ned >60 >100 Snamprogetti Ministry of the In progress
Environment
Milazzo 1=43 191 12,120 — 732 — 20 University of In progress
Messina
Gela 4=4 27 19,766 3654 1500 — 30 University of In progress
Messina

Trans IChemE, Vol 81, Part B, January 2003

 NEW VERSION OF ARIPAR
Regione Toscana, 2000). Some other areas have been partially
examined with the tool described: transport of dangerous sub-
stances by road and rail in the territories of Parma, Priolo-
Augusta and Brindisi have been evaluated and compared.
The complexity of these cases is variable both in the
extension of the impact area and in the number of risk
sources considered. The area extension varies from 3 to
more than 200 km2; the number of Ž xed installations varies
from 10 to around 200; road, rail, ship and pipeline transport
varies from a few units to about 50 pipelines and some
hundreds of thousands of transportations of dangerous
substances per year.
All studies were promoted by public authorities interested
in extending the quantitative knowledge of risks which
always are present in territories where large industrialized
areas are located.
In order to give samples of the practical conclusions of
some studies, mention is made of the industrial areas of
Ravenna and Livorno and the concerned territories, which
are undergoing management and structural modiŽ cations
resulting from the QARA results.
As far as the Ravenna territory is concerned, the follow-
ing list shows the interventions in progress, most of them
partially funded by the Ministry of the Environment
(Regione Emilia-Romagne, 1999):
° decommissioning of LPG sphere storage and building of
new buried storage (16 vessels with a total capacity of
39,000 t);
° movement of the marshalling yard from the old location
(near the Ravenna town) to a new and safer location;
° new layout of roads used for transporting dangerous
substances to=from the industrialized area to assure risk
mitigation; and
° implementing a radar system (Port Approach Control) to
govern a safe entrance and navigation in the Candiano
Canal.
The risk assessment of the Livorno industrialized area, its
results and intervention strategies are documented in
Regione Toscana (2000). Several actions have been sched-
uled and are now being realized. Some of them are:
° revamping of LPG storage (spherical vessels replaced by
buried horizontal cylindrical vessels);
° mitigation of risks due to road transport of dangerous
substances (new motorway intersections, dangerous
amounts moved from road to rail); and
° new regulations to manage transport of LPG by ships
(only cryogenic transportation permitted).
These two studies and a comprehensive view of the
results of all the studies listed in Table 2 show that most
of them have been used by public authorities in:
° verifying the relative importance of risk sources (Ž xed
installations or typologies of transport) in order to
address new distributions of dangerous substances  ows;
° planning the territory taking into account major accident
hazards (displacement of the marshalling yard in the
Ravenna area, scheduling of relocation of houses in the
Livorno area, etc);
° planning for improvement of transport infrastructure
(new roads mainly devoted to industrial trafŽ c in the
area of Ravenna); and
Trans IChemE, Vol 81, Part B, January 2003
29
° Ž nancing interventions to improve the safety of Ž xed
installations (revamping or new design of storage).
The interest shown by public authorities in the quantita-
tive knowledge of risks has anticipated the Italian regulatory
process.
The Italian regulatory process has recently become based
on authorization given to individual plants on the basis of a
safety case, in which safety issues of plants are considered,
besides their relation with the surrounding territory.
Recently the Italian implementation of the Seveso 2 EU
Directive principles (Law 334 of 1999) has led to the
explicit introduction in the regulatory process of land use
planning that is based on the results of the industrial
installation safety cases. The procedures and criteria for
risk-based land use planning were set in a Ministry decree in
2001.
In addition, the Law 334 asks for a risk assessment at
industrial area level to be performed when the authorities
declare an area to be of high-risk-potential. The area risk
assessment has to be developed by the operators of the area
involved, under the supervision of the competent authorities.
The application decree detailing procedures and criteria for
area risk assessment study has not yet (as of October 2002)
been issued.
ARIPAR has been applied until now on request from local
authorities for local planning purposes or as research
exercises; this, however, has allowed wide experience and
know-how on area risk studies to be acquired and many
Italian authorities are now familiar with the principles and
procedures of the ARIPAR methodology.
In mid 2002 the Ž rst ofŽ cial application of the Italian
Law 334 requirement for area risk analysis has started, with
the request by the Ministry of the Environment to the
operators of one of the major industrial areas in Italy (near
Siracusa, Sicily) to perform an area risk assessement.
ARIPAR has been chosen as the methodology and
tool to be adopted in the study, which is scheduled to be
completed in mid 2003. The application decree to be issued
will largely beneŽ t from the experience of this area risk
assessment study so that, even if the ARIPAR methodology
and tool, as any other tool, will not be the ‘ofŽ cial’ tool for
regulatory purposes for land use planning in Italy, it will in
practice be seen as the benchmark and ‘de facto’ standard
for QARA studies.
CONCLUSIONS
The described features of ARIPAR clearly show the
capability of the software in managing the large amount
of data which characterize the risk analysis of a complex
industrial area, where Ž xed installations and transportation
of hazardous substances are involved. A risk-oriented
approach is mainly addressed. Risk measures are evaluated
and their importance is judged on the basis of both
frequencies and consequences of all accidents identiŽ ed.
In addition, since the scenarios identiŽ ed in risk analysis
can be considered independently, the consequence-oriented
approach could also be supported.
The results of the application of ARIPAR to some Italian
industrial areas have proved that the tool is particularly
useful in supporting decisions-making in risk assessment
and management.
30 SPADONI et al.
Further software improvements are in progress concern-
ing the implementation of new functionality to further
enhance the sensitivity analysis phase and the presentation
of results for decision-making purposes.
NOMENCLATURE
ai;j occurrence probability of accident j, conditioned to occur-
rence of top incident i [i ˆ 1; . . . ; N; j ˆ 1; . . . ; NI …i†]
li occurrence frequency of top incident i
pi;s probability that top incident i occurs in season s (the value is
equal to 1=4 if a uniform annual distribution is considered),
s ˆ 1; . . . ; Ns .
pcv;yv =s occurrence probability of the cv (cv ˆ 1; . . . ; Ncv ) pair ‘wind
velocity–stability class’ in direction yv conditioned to season
s; yv ˆ 1; . . . ; Nyv
vI ; j;cv;yv …xS! P † vulnerability in an area point P, caused by accident j of top
incident i occurring in meteorological condition cv with a
wind direction yv ; S is the accident source and x the distance
from S to P.
REFERENCES
ARIPAR Team, 2002, ARIPAR System for Area Risk Analysis and Control,
Main User’s Guide, Version 3.0, Report S.P.I.02.103, July 2002; ARIPAR-
GIS Reference Guide, Report S.P.I.02.104, July 2002; ARIPAR-DB
Reference Guide, Report S.P.I.02.105, July 2002.
Bellezza, F., Contini, S., Binda, and Spadoni, G., 1998, A GIS based
software tool for risk assessment and management in industrial areas.
ESREL 98 Conference, Trondheim.
Bonvicini, Vanni and Cozzani, 2001, The importance of modelling assump-
tions in hazardous material transportation risk analysis. ESREL 2001
Conference, Torino.
CONCAWE, 1994, Performance of Oil Industry Cross-country Pipelines in
Western Europe.
Contini, S., Bellezza, F., Christou, M. and Kirchsteiger, C., 2000, The use of
geographical information systems in major accident risk assessment and
management. J Hazard Mater, 78: 223–245.
EGIG, 1998, Positive Trends in European Gas Pipeline Incidents (European
Gas Pipeline Incident Data Group).
Egidi, D., Foraboschi, F.P., Spadoni, G. and Amendola, A., 1995, The
ARIPAR Project: analysis of the major accident risks connected with
industrial and transportation activities in the Ravenna area, Reliability
Engng Syst Safety 49: 75–79.
Health and Safety Executive, 1978, Canvey: an Investigation of Potential
Hazards from Operations in the Canvey Island=Thurrock Area (HM
Stationery OfŽ ce, London, UK).
Heywood, I., Cornelius, S. and Carver, S., 1998, An Introduction to
Geographical Information Systems (Addison Wesley Longman, Essex,
UK).
Regione, E.-R., 1999, Piano di risanamento dell’area industriale e portuale
ravennate.
Regione, T., 2000, ARPAT, Analisi del rischio per l’area di Livorno e
strategie d’intervento.
Rijnmond Public Authority, 1981, Risk Analysis of Six Potentially Hazar-
dous Industrial Objects in the Rijnmond Area. A Pilot Study (Reidel,
Dordrecht, The Netherlands).
Spadoni, G., Leonelli, P. and Egidi, D., 1997, Quantitative risk analysis of
industrial and transportation activities in the Ravenna area: a second
report. ESREL 97 Conference, Lisbon.
Tomlin, C. and Dana, 1990, Geographic Information Systems and
Cartographic Modeling (Prentice Hall, Englewood Cliffs, USA).
Uguccioni, G., Senni, S., De Sanctis, S., Vestrucci, P. and Zappellini, G.,
1991, Industrial area risk management through risk analysis technique,
PSAM Conference, Beverly Hills.
Uguccioni, G., Bellocchi, C., Russo, G., Spadoni, G. and Zanelli, S., 1999,
ARIPAL–a project for risk assessment of an industrial area. Seveso 2000
Conference, Athens 1999.
Vanni, L., 2000, Aggiornamento della Valutazione del Rischio nelle Aree
Industriali di Livorno e Piombino. Tesi in Ingegneria Chimica, Università
di Pisa, Pisa.
ACKNOWLEDGEMENTS
Thanks are due to D. Egidi, head of Civil Protection of the Emilia-
Romagna Region, who promoted the ARIPAR project, and to the Italian
Department of Civil Protection which, has helped the dissemination
of area risk studies with Ž nancial support. Authors are also grateful to A.
C. Lucia, and A. Poucet, unit heads of the Institute for the Protection and
Security of the Citizen of the JRC, for the support given during
the development of the new English version of the software ARIPAR.
Furthermore, the tool could not have been implemented without the
fundamental work of F. Bellezza (JRC), and M. Binda (THS Informatica)
in the software development phase.
ADDRESS
Correspondence concerning this paper should be addressed to Dr S.
Contini, European Commission, Joint Research Centre, Institute for the
Protection and Security of Citizens, TP 361, 21020 Ispra (VA), Italy.
E-mail: sergio.contini@jrc.it
The manuscript was received 10 June 2002 and accepted for publication
after revision 16 October 2002.
Trans IChemE, Vol 81, Part B, January 2003