A Multi-Objective Model to Optimal Selection of Safety Measures in Oil and Gas Facilities