Unit 4 Risk Assessment

Digital Twin and Risk Assessment

Digital Twins provide a chance to enhance the safety levels of operators involved in Human–
Machine Interaction (HMI). Moreover, the integration of digital models with the IoT has the
potential to generate the flexible interactive mode to enhance machine efficiency and process
safety [13]. Digital Twins are not new to the process industries, where they are used in various
forms, with the main intent of modeling a system, in line with the model-centric nature of
engineering practice [14]. However, scientific literature has focused only on some specific
topics, such as the main advantages of using digital models in industry or the role of Digital
Twins in helping maintenance activities. As far as the former point is concerned, the main
advantages of using digital models in industry have been discussed by [15] and include various
aspects. First, virtual models driven by real-time data are able to provide a very faithful
representation of the real environment and, as such, can be constructed to support immersive
interactions between humans and machines. Secondly, Digital Twin data can integrate real and
simulated data, allowing the user to get a comprehensive description of the whole environment
and a deeper understanding of the physical entities. Finally, digital models provide concise,
intuitive and easy-to-use platforms such as software and mobile Apps that could be adopted by
users in different fields. Maintenance activities are typical situations that require HMI. In
maintenance, the digital model can reflect the real-time status of machines. Through the
analysis of physical data, sensor data and maintenance methods, the digital model can easily
identify components and parts showing signs of damage; this enables data-driven analyses and
incremental risk assessment strategy starting from reporting of adverse events [16]. Triggering,
e.g., predictive maintenance activities could eliminate the risk of downtime events or
catastrophic failures, and related expenses [17]. Indeed, any loss or degradation of the function
of a real system can lead to process safety issues; inadequate hazard identification, in particular,
is the main cause of process fail, accounting for approximately 40% of process losses [14]. The
literature reports several examples of Digital Twin applications in maintenance (e.g.,
[15,17,18]); by contrast, the implementation of digital models for safety or risk assessment are
more limited in number. Nonetheless, ensuring process safety is of fundamental importance to
avoid multiple fatalities, environmental damage, business losses and damage to reputation [19].
The use of improved digital tools and dynamic models to conduct process hazard analysis has
the potential to address some of the main shortcomings of the traditional risk analysis
procedures [20]. Moreover, as shown by [14], Digital Twins can be successfully used to
enhance process safety in almost all phases of a process/plant lifecycle, ranging from the
conceptualization of the system to the model-building phase. Gabbar et al. [21] were the first
authors that proposed dynamic process modeling for process safety analysis for assisting
operators and assessing risk. They carried out a case study in a hydro-desulphurization unit and
demonstrated the capability of the model to identify some specific high-risk scenarios.
However, the proposed model did not attempt to systematically conduct a process hazard
analysis. Ramzan et al. [22] also proposed a dynamic simulation model for process hazard
analysis and applied it to a case study conducted on a distillation column with two products. In
the proposed approach, dynamic simulation is used to identify the consequences of possible
causes of process parameter deviations, assign severity and frequency rates for these
consequences and finally determine the tolerability of the resulting risk. A further study that
made use of dynamic simulation for conducting process hazard analysis was done by Wu et al.
[23]; these authors integrated qualitative models with dynamic simulation for conducting
process hazard analysis. To be more precise, at first their approach makes use of multilevel
flow modeling (MFM) to determine the causes and consequences of risks and classify them.
Then, high risk scenarios are rigorously analyzed and evaluated using dynamic simulation. The
approach was tested on an industrial process. Similarly, Paltrinieri and Reniers [24] have
developed a dynamic risk assessment model which uses Bayesian networks to provide real-
time risk assessment of a real plant, on the basis of the safety measures installed and the
probability of risk occurrence. The proposed approach is intended to provide quantitative
assessment of how cost-cutting measures can increase risks, as well as to evaluate the
probabilities of risk causes and the effectiveness of safety barriers. In recent years, the advent
of integrated software platforms has also offered the opportunity of coupling real-time data
with all the digital information that a company has on a certain process. Accordingly, in a recent
study, Kummer and Varga [25] developed an open software platform that allows generating
failures, assessing when the steady-state conditions of the real system are achieved and
generating sensitivities of critical variables to various disturbances. This tool was intended to
automate generation and assessment of disturbances to provide input to traditional hazard
analysis processes with the aim of reducing the duration and human error of the hazard analysis
process. The proposed tool was tested in a chemical process to evaluate the sensitivity of the
system to critical variable disturbances. All the studies described above provided very
interesting models for hazard analysis and risk assessment, based on specific tools. However,
as the above review shows, relevant papers are few in number. Moreover, papers published
before 2011 could not properly refer to Digital Twins, as Industry 4.0 concepts originated in
2011 and were formalized in 2013; rather, these papers describe general simulation models for
maintenance or safety management. In addition, most of the published research refers to
specific high-risk scenarios and aims to evaluate impacts rather than proposing general tools
for a systematic hazard analysis [26]. In particular, to the best of the authors’ knowledge, a
framework that fully explains how to design, develop and implement a Digital Twin
specifically dedicated to risk management still lacks in the literature. Indeed, all the studies
reviewed only cover one or some aspects (e.g., phase one or phase three—see Section 5) of the
methodological approach proposed in this study. This is why we believe that the framework
described in this paper can represent an interesting addition to the literature.
Digital Twin Reference Model
The reference model based on Digital Twin methodologies for risk reduction in process plants
is shown in Figure 1. This reference model allows a company to: (i) create a virtual process
parallel to the physical one—this virtual process will offer a tool for both static and dynamic
analysis of the physical industrial process; (ii) propagate this information to other
interconnected and achievable digital objects, in order to increase the safety of the involved
actors; and (iii) intercept anomalies at the beginning so as to be able to intervene promptly in
order to minimize the damage from breakage or support preventive Sustainability 2020
/predictive maintenance.
The reference model is made up of four main layers. Figure 1 should be read following the
sequence of layers, from top to bottom. The model outputs are in the last layer (User Space).
(1) Process industry physical space: this layer consists of all physical industry resources such
as product, personnel, equipment, material, process, environment, facility etc. This is the
primary environment of the Digital Twin reference model that the company aims to control.
With physical space, we refer to all observable plant elements in production that shall be
monitored and sensed and may be actuated and controlled.
(2) Communication system: the second layer is dedicated to transferring data or information
between Digital Twin and plant elements. Physical elements are monitored and sensed from
control devices and execution tools for data collecting and device controlling with various
devices such as sensors, cameras, actuators and other composite devices. This system connects
observable plant elements to digital entities, and vice versa, for their synchronization. To
complete the second layer, a 3D Model Representation and a Risk Identification and
Assessment Plan are needed in order to set up the simulation system and the Anomaly
Prediction and Detection Tool.
(3) Digital Twin: this is the third layer. From a conceptual point of view, the Digital Twin
infrastructure must be able to manage the following agents:
• Acquisition of data coming from sensors, actuators devices, etc. installed on the system;
• Visualization of the data coming from the field;
• Data analysis for anomaly detection purposes and related prediction;
• Integration of anomaly detection algorithm data to compare trends;
• Development of the Digital Twin that simulates the behavior of the plant (possibility of
developing what-if scenarios);
• Integration of the Digital Twin and relative comparison with the physical space in order
to determine anomalous behaviors;
• Identification of dangerous situations for the operator;
• Activation and management of alerts on the 3D model towards operators, plant
managers and other systems;
• Support for maintenance following anomalies.
(a) Control and Execution Tool The Control and Execution Tool allows the physical
system to communicate with the cyber system at the output through sensors,
transducers, etc. and at the input through the control of actuators, switches, etc.. This is
a computer system dedicated to the management or control of industrial processes. This
tool executes a program and elaborates digital and analog signals coming from sensors
and directed to the actuators present in an industrial plant. (b) Simulation Tool The
simulation tool allows the company to create virtual modeling of the processes. This is
an advanced vision of the Digital Twin that includes not only a simulation model, which
is coherent with the real plant, but also a behavioral and functional model through the
creation of Mock Units. The simulation tool can work on-line or off-line, i.e., the inputs
can come from the sensors (in the first case) or can be entered manually (in the second
case). When working off-line, through a virtual representation of the physical assets,
the tool allows managers to analyze what-if scenarios without the need to physically
realize them, thus avoiding potential situations of risk for operators. In this case, the
tool can be used, for example, to commission a new plant in a virtual way to identify
the risks for operators before actually activating the plant or to simulate a maintenance
activity and identify the risks associated with it.
(b) application can allow a company to have the comparison between the various data
provided by the simulation system. The data is actually detected by the sensors in order
to activate warning signals if the discrepancy between the two values is beyond defined
thresholds. (c) Anomaly Detection and Prediction Tool This tool should predict why
faults are occurring, what the causes are (anomaly detection) and how long the system
can go on before it breaks down or goes out of the correct plant operating parameters
(anomaly prediction and residual life assessment). Figure 2 shows the rule of this tool
within the reference model. The tool is based on machine learning algorithms for the
analysis of anomaly detection and prediction in the execution of production and
maintenance processes within the IoT environment. Sustainability 2020, 12, x FO
(c) In the case where the tool works on-line it must be able to receive information from the
sensors on the physical asset and it modifies its parameters when the asset changes its
conditions. The on-line application can allow a company to have the comparison
between the various data provided by the simulation system. The data is actually
detected by the sensors in order to activate warning signals if the discrepancy between
the two values is beyond defined thresholds.
(d) Anomaly Detection and Prediction Tool This tool should predict why faults are
occurring, what the causes are (anomaly detection) and how long the system can go on
before it breaks down or goes out of the correct plant operating parameters (anomaly
prediction and residual life assessment). Figure 2 shows the rule of this tool within the
reference model. The tool is based on machine learning algorithms for the analysis of
anomaly detection and prediction in the execution of production and maintenance
processes within the IoT environment.
Typical anomalies to be predicted through machine learning in process plants are the
following:
• During the operative phase of the plant, the operator closes by mistake a shut-off
valve and the plant goes into overpressure, putting at risk the integrity of the piping
and the personnel. Before the safety valve intervenes (which would lead to a partial
emptying of the system with consequent stoppage of the system for a long time),
the tool detects an increase in pressure at certain points, identifies the problem and
warns the operator about the type of anomaly that is occurring;
• During a pump maintenance operation, the operator does not close the shut-off
valve and floods the area;
• The control valve downstream of the tank is blocked and closed due to a fault and
the system goes into overpressure;
•
• A pump vibrates abnormally due to bearing failure;
• A shut-off valve upstream of the pump closes by mistake and the pump goes into
cavitation.
(e) Cloud Server Platform The platform must acquire real-time data from the field.
Therefore, a normal server architecture would not be enough because, in the normal
operating environment, the enormous amount of data would not make its operation
stable. This is the same with classic relational databases which are not able to withstand
an excessive number of requests for simultaneous access to reading and writing. This
implies that the platform must be designed ad hoc for data acquisition, sorting and
visualization through a cloud solution
The platform provides APIs (Application Programming Interfaces) or external calls with
related authentication, to manage:
• Data input from the PLC;
• External engines for input data analysis (sensor readings);
• Elaborations carried out by the data analysis engines, after which they are visualized
for comparison;
• Data coming from the sensors to the simulated model of the plant;
• Data coming from the simulated model (what-if scenarios) and relative comparison
with the real one;
• Data coming from the sensors to the 3D model of the plant;
 • Data coming from the 3D model and its comparison with the real one.
In addition to the functions listed above, it is also necessary to manage the historical data
related to both field sensors and analysis. Moreover, the management of user permissions to
avoid inappropriate deletions in non-applicable areas.
User Space
This is the last layer. The term “user” in this context refers to a human, a device or a
system such as MES (Manufacturing Execution System) or an ERP (Enterprise Resource
Planning). The interface is offered to users through two solutions: • Activation of operational
instructions for the maintenance and safety management of the system through AR/VR; •
Activation of warning messages. In this layer, classes of advanced services must be defined;
for example, in the event that the machine learning system predicts risk situations, operators
may be warned of anomalies through wearable systems. In addition to signaling warning
situations, corrective actions and safety measures can also be taken.
Implementation of Digital Twin Reference Model

Every phase is connected to the other ones and they are carried out according to the following
sequence:
Phase 1: Development of the Risk Assessment plan During this phase, the risk is measured
or estimated for the operators involved in the maintenance and management of the process
industry. In particular, it is necessary to identify all possible adverse events, the causes of these
events and the internal and external risk factors, by observing the plant, its processes, the people
and dynamics that characterize it and the socio-economic context in which it operates.
The following step is the risk analysis. This step will estimate the probability of occurrence
and the impact generated by adverse events, on the basis of quantitative and/or qualitative
techniques. Finally, risk weighting must be carried out in order to support the organization in
deciding which risks to deal with using the Digital Twin system and the risk treatment. This
step will allow maintenance managers to identify and choose solutions to prevent or mitigate
undesirable risks.
Phase 2: Development of the Communication and Control System
According to the risk analysis carried out in the first phase, the communication system is
developed. The identification of the most important entities is needed in order to uniquely
identify them and make, for example, the link between the real and digital entity of a Digital
Twin. The main part of the development of a Digital Twin is to have a complete information
set, including the real-time data acquisition coming from a wide range of sensors and/or IoT
devices. In order to increase the collection of this information, some common strategies are
performed:
(1) Use Existing Connected Sensors: This is a standard first step since it does not require the
modification of existing physical installation adding new sensors. This approach requires only
an application engineering and a software project to connect the gathering of data to the upper
level where the Digital Twin is deployed. In this step, the development of new software is
required in order to acquire information from existing supervision infrastructure, like
Supervisory Control And Data Acquisition (SCADA), PLC, etc.
(2) Insertion of New Sensors into Existing Infrastructure Based on PLCs and
Controllers: The second step is to evaluate if there are available hardware slots on the system
controller, in order to add acquisition modules into which a new set of sensors can be plugged.
Although this approach could be simple, it requires the modification of the existing software,
developing new functions that manage the new sensors with the risk of making changes in the
controller and creating performance and operating issues.
(3) Add Edge Devices: Another important support for developing a Digital Twin is the Internet
of Things (IoT) with the Wireless Sensor Network. New edge devices have been introduced
into the industrial field, and these are designed to capture and transmit information directly to
enterprise systems and cloud applications. Many new sensors are not directly integrated into
the control and automation system, operating separately and independently from them in order
to monitor operating parameters for a complete Digital Twin and close the information loop.
Many wireless or cabled edge devices directly communicate with the Cloud or private IT
network. One of the best advantages of using this solution is that it has a very minimal impact
on existing control software architecture because it works in a parallel backbone of the main
infrastructure.
(4) Effect of Actuators: When a Digital Twin needs to produce an action in the real-world by
way of actuators, it will generally use the support of the operator or a control system, which
will interact with the real process. The action is usually associated with the operative decision,
such as those used in a dynamic control system.
Phase 3: Development of Digital Twin Tools This phase focuses on the design and
development of the tools used in the Digital Twin. In this work, machine learning algorithms
have been used for anomaly detection and prediction. The development of a machine learning
model relies on the following steps:
• Analysis of the context of application. It is important to understand the environment, the
boundaries and the dependencies of the analyzed processes. In fact, this step defines the
structureof the machine learning model and its target. For example, the reduction of the
operators’ risk requires the definition of the specific risks that can affect the operators.
• Monitoring of the process and data records. The data must be prepared to make them suitable
for use by the machine learning model;
• Set up the parameters of the machine learning model;
• Training of the model with training data from the real production process;
• Testing the model on different data, for verifying its effectiveness. This is the conclusion of
the real development of the machine learning model;
• Improvement of the capacities of the machine learning model using the Digital Twin, as
explained above.
In parallel to the machine learning tool, the simulation tool is also developed at this stage. The
first step in designing this tool is the definition of the aspects to be simulated. Typical aspects
to be considered are thermal behavior and physical, mechanical, chemical, electrical and
organizational processes. It is then necessary to understand the behavior of the system or
evaluate strategies for the operation of the system. The final step is the design of the model of
a real system and conducting experiments with that model.
Phase 4: Tools Integration in a Digital Twin Perspective The developed tools will then be
integrated into an ad-hoc software platform. The platform will perform the following activities:
data acquisition, data manipulation, detection state, health assessment, prognostic assessment
and advice generation. The platform has to meet the requirements listed below:
(1) Multimodal information: the platform has to be able to integrate multimodal information,
such as sounds, videos, texts, 3D animations etc. into the platform;
(2) Browsing and editing: the platform must enable the creation, modification and navigation
of cyber-physical systems, which means modifying and creating environments that integrate
the physical and virtual space;
(3) Detection: through a grid of sensors, the platform must have the ability to monitor and store
activities that occur in the work environment;
(4) Heterogeneity: the platform should support different types of sensors and actuators;
(5) Semantic abstraction and modularity: the platform should be able to provide a semantic
abstraction, allowing easy communication between the elements of the environment;
(6) Verification, validation and simulation: the platform must be able to simulate the behavior
of the physical units present in the productive world. This will allow a company to predict and
control the highest-risk events and to formulate alternative scenarios.
Phase 5: Models and Platform Validation Scenarios of the process industry in which the
reliability of the plants has an impact on the safety of the operators and on business efficiency
have been used to validate the developed systems. This phase involves the verification of the
platform’s functionalities and testing activities. The testing phase will allow researchers to
collect quantitative data to evaluate the performance of the solution and estimate the main
advantages, with particular attention to the benefits in terms of operator safety. The collection
of feedback from the experimentation will be used for the revision/optimization of the tools
and the platform.
Criticality in Reference Model Implementation
The critical aspects involving Digital Twin technologies can be summarized in the following
points:
• IoT is not perfectly IIoT (Industrial IoT). The industrial version of devices requires resilient,
robust and reliable solutions, which are subject to industry regulations and standards (e.g.,
watchdog systems, certified code). Today, the solutions on the market, in many cases, do not
perfectly meet the needs, in terms of performance and flexibility, compared to the industrial
reality.
• The need for deterministic transactions. Real-time implies determinism, i.e., the guarantee
that an action by an actor is implemented, not necessarily at high speed. This means that
processing must be based on suitable (operating) systems designed for real-time. The design
of embedded systems, by definition, is aimed at applications with specific performance and
guaranteed stability.
• For embedded systems, the usual concept that computing devices will soon be more powerful
and less expensive is no longer valid. Programming paradigms must take into account a new
dimension where resources are limited “by design”.
• When the number of pervasive devices is large, factors such as energy consumption and
energy supply (energy scavenging/harvesting techniques), life cycle and maintenance of
components (dispersion of pollutants, recovery at the end of life, maintenance, recycling and/or
reuse) become critical. Rapid wake-up systems (e.g., non-volatile memories) after minimum
consumption sleep cycles.
• Targeted design of human–machine interfaces (new, small but expressive interactive displays,
low power consumption, e.g., Organic Light-Emitting Diode (OLED), e-paper), which are
minimally invasive and disturbing (calm technology).
Moreover, different relevant standardization issues need to be addressed. For instance, the
standardization regarding the synchronization of the physical object and its Digital Twin, the
syntax and semantic interoperability to ensure interoperability across Digital Twins and the
security protection of secrecy and integrity of the physical entity and its associated
characteristics.
Practical Implications
The cyber-physical system approach will allow maintenance managers to detect, identify and
develop corrective actions that can affect the safety of operators, the reduction of maintenance
and operating costs and more general improvements of the company business by intervening
both in strictly “technological” and organizational terms. Through wearable systems, it will be
possible to monitor, for example, the distance of the operator from the plant and send alerts in
case the cyber-physical system foresees risk situations (a burst, an unwanted emission, etc.).
The cyber-physical system will anticipate these risk situations by dissipating residual energy;
for example, discharging condensers, hydraulic and pneumatic circuits and accumulators, but
also preventing the risks of lower dead body movements and blocking loads at height. An
important outcome is linked to the definition of a complex and integrated control system that
uses the network of cyber-physical elements, in order to ensure continuity of shared monitoring
even in the event of abnormal operation of the machinery itself, thus providing control and
monitoring logic by the operators. The following effects of the proposed solutions can also be
highlighted:
• Enable maintenance technicians to make their repair decisions based on actual data and
forecasting of future scenarios, as opposed to the traditional approach to maintenance based on
predefined activities or just on conjecture, by knowing about upcoming problems;
• Provide a tool with high added value, allowing company managers to make increasingly
reliable forecasts about the evolution of risk events. This functionality perfectly fits within the
digital continuity required by modern industrial paradigms;
• Helping business leaders in decision-making activities not only from an economic but also
from an organizational point of view: resources can, therefore, be managed at their optimum
level to obtain maximum p