Fig. 2.1 shows the development of two different cases, both starting from a condition of unawareness of accident risk and lack of related information (point 1). In an ideal case, a reasonable doubt would grow in the minds of safety professionals of an organization once they come across some examples of early warnings, such as unwanted events occurring in their site, historical data, and literature studies from external sources. Thus, their risk awareness would progressively increase with the availability of related information (point 2), which is used to increase the knowledge of the potential scenario to a condition of relative confidence about accident risk (point 3), where only loss of organizational memory may reduce awareness. According to the Table 2.1 definitions, the ideal case depicts proactive management of accident risk, where the accident is initially an “unknown unknown” (point 1) that first evolves into a “known unknown” (point 2) and is finally and successfully classified as a “known known” (point 3).

In the “atypical accident” case, available information on risk accident is disregarded. The situation develops in a condition of unawareness despite the succession of related early warnings (point 4), and the only development is the passage from the risk of “unknown unknowns” to “unknown knowns” that may be potentially understood through the available information (Table 2.1). It is only when the atypical accident occurs that risk awareness suddenly increases and compensation measures are taken.

The literature shows several examples of atypical accidents that occurred or may have the potential to occur (Table 2.2). The former are cases of hazard identification failure: The respective safety reports identified relatively less critical accident scenarios, despite the occurrence of previous similar events in the past. The latter are related to new and emerging technologies: Related hazards may be well known to specialists but still a gray area for safety professionals, who nonetheless have the opportunity to learn from early warnings.

These principles may lead to the degradation of predictability and the need for robustness against negative black swans and for learning from positive ones. In fact, they are not only adverse events but also rare unplanned opportunities from which we should learn. Taleb [13] affirms that these kinds of events are the result of epistemic limitations (or distortions), demonstrating a clear overlapping with the definition of atypical events [1]. In fact, Aven and Aven and Krohn [14,15] refer to a black swan as a surprisingly extreme event relative to one's belief/knowledge, defining and giving examples of three types of black swans (partially according to the concept of unknowns/knowns previously introduced; see Table 2.1): unknown unknowns, unknown knowns, and events judged negligible.

An example of a black swan of the unknown unknown type is represented by the swine flu spread in 2009 caused by the H1N1 virus, for which a vaccine was quickly developed. In some countries the authorities aimed at vaccinating the entire population. The influenza turned out to be relatively mild; however, the vaccination had severe side effects, which were previously unknown [16]. A black swan of the unknown known type might have been the disaster involving the Deepwater Horizon drilling rig, where a worker did not alert others on the rig as pressure increased in the drilling pipe, a sign of possible gas/fluid entry into the wellbore (kick), which can lead to blowout [17]. The Fukushima nuclear disaster, because of its low probability of occurrence, was judged as a negligible event. This third type of black swan was preceded in past centuries by extreme natural events (tsunamis of heights beyond the design criterion of the nuclear plant), which were not accounted for during the design of the nuclear reactors [18].

Black swans are addressed by Paté-Cornell [18] in comparison with another definition of rare event: the perfect storm. This kind of event involves mostly aleatory uncertainties (randomness) in conjunction with rare but known events. It takes its name from the devastating storm in the northern Atlantic described by Junger [17], which caught some boats by surprise and killed 12 people in 1991. It was the result of the conjunction of a storm from the North American mainland, a cold front from the north, and a tropical storm from the south. Paté-Cornell affirms that black swans represent the ultimate epistemic uncertainty or lack of fundamental knowledge, where not only the distribution of a parameter but also, in the extreme, the very existence of the phenomenon itself is unknown. However, in reality, most scenarios involve both aleatory and epistemic uncertainties, and a clear distinction cannot be outlined.

The definition of dragon kings also refers to the existence of a transient organization into extreme events that are statistically different from the rest of their smaller siblings. This realization opens the way for a systematic theory of predictability of catastrophes, contrasting with the definition of black swans. The concept is rooted in geophysics [20]. One of Sornette's earlier works was related to the prediction of earthquakes. He saw that some degrees of organization and coordination could serve to amplify fractures, which are always present and forming in the tectonic plates. Organization and coordination may turn small causes into large effects, ie, explosive ruptures such as earthquakes, which are characterized by low probability. This physical model suggests the possibility of predicting such events. In fact, if time between these smaller fracture events decreases with a specific log-periodic pattern, earthquake probabilities are much higher.

Dragon kings may represent an answer to Paté-Cornell [18] and Haugen and Vinnem [21], who warn against the misuse of the concept of the black swan as a reason for ignoring potential scenarios or waiting until a disaster happens to take safety measures and issue regulations against a predictable situation.

An example of dragon king was searched for among the accidents recorded in the MHIDAS (major hazard incident data service) database [22], which collected about 1500 events from 1916 to 1992. The accidents were ranked on the basis of the number of fatalities they caused and plotted in a double logarithmic ranking/fatalities diagram (Fig. 2.2). The distribution of the events follows the power law with regularity, as shown by their good approximation to the straight line in Fig. 2.2. However, the recorded accident beyond the power law, causing the highest number of fatalities, may be the disaster that occurred in Bhopal in 1984, if it is considered to have caused all 16,000 fatalities claimed [23]. (Other sources report the number of fatalities to be around 3400 [24].)

If the Bhopal disaster can be defined as a dragon king, then an emerging organization of small previous “fractures” into the system of the chemical plant should be recognized. Several authors have identified a “list of things that went wrong simultaneously at Bhopal” [24–28]:

These fractures led to an extraordinary amplification of the event, turning it into a large-scale effect. Their coordination could potentially have been identified, however, and such an accident predicted, as theorized by Sornette.

This is demonstrated by Paltrinieri et al. [1] in the identification of the chain of events that led to the atypical accident in Buncefield in 2005 (see Table 2.2). For instance, one cause was the frequent oil tank overfilling events as a result of operators often not informing others about the changes in the incoming fuel flow rate [29]. Although Taleb [13] points at the consequentiality of black swans, Aven [30] reports the events and conditions that combined to lead to the Deepwater Horizon accident, previously mentioned as an example of a black swan. Paté-Cornell [18], in describing perfect storms, refers to a “conjunction of known phenomena,” which is “an alignment of factors whose possibilities are known separately but whose simultaneity seems extremely unlikely.” Finally, Sornette [19] bases his theory on the aggregation of relatively smaller events leading to extreme consequences, because “in the theory of complex systems and in statistical physics big disruptions do not need large perturbations to occur.” As complexity of a system increases, it enhances system susceptibility means, and minute changes would have disproportional consequences.

Preventing small things from happening might be the key to breaking this chain of events, because there are always potential accident scenarios that we are not aware we do not know–unknown unknowns. Awareness of their likelihood should always be present, and appropriate precautions to consciously face our relative ignorance (shifting from prevention of unknown unknowns to the prevention of known unknowns) would probably lower the probability of extreme events. Small things might be represented by recurring old issues in a plant or an organization, which do not need imaginative definitions to be prevented but perhaps only compliance with already present procedures. Thus, on one hand, we should avoid excessive focus on uncertainties in risk analysis that may have the side effect of disregarding our consolidated knowledge. On the other hand, new definitions to attribute to major accidents are the expression of the need for continuous improvement and adaptation with increasingly complex systems, such as today's chemical process industry. Emerging technologies, tighter interdependencies with critical infrastructures, and increasing volumes of handled hazardous substances may potentially hide unexperienced risks. Management of such risks requires high levels of risk awareness, opening to dynamic updating, and capability of reorienteering industrial activities toward intrinsically safer conditions. This approach may be described in a few words with “learning from experience,” a relatively small thing (conceptually less complex) with dramatically heighted implications.