—inwent | qualified to shape the future christian jochum ([email protected]) inwent senior...

—InWEnt | Qualified to shape the future

Christian Jochum ([email protected])

InWEnt Senior Advisor (www.inwent.org)

Director of Centre, European Process Safety Centre (www.epsc.org)

Chairman, German Commission on Process Safety (www.kas-bmu.de)

India, September 2010

Accident Models and Lessons Learnt from World Big Disasters

1


Professional Profile Christian Jochum

– Born 1943 in Frankfurt a.M./Germany

– PhD in Chemistry, certified Safety Engineer

– Honorary Professor at Frankfurt University

– 28 years experience in large chemical/pharmaceutical company (Hoechst AG)

• 1969 – 1979 Pharmaceutical research and pilot plant operations• 1979 – 1997 Safety department (Site and Corporate Safety Director and „Major

Accident Officer“ since 1987)

– EHS – and crisis management consulting for different types of businesses and administration since 1997

– Commission on Process Safety (formerly Major Hazard Commission) at the German Federal Minister for the Environment (Chairman since 1998)

– European Process Safety Centre (Rugby/UK): Director of Centre since 2007

– InWEnt Senior Advisor since 2009

2


EPSC (European Process Safety Centre)

• Industry funded association of major chemical companies in Europe.• Approx. 40 contributing enterprises• Dedicated to sharing and improving best practice in Chemical Process

Safety• Study groups on

– Safety Critical Systems (inc. IEC 61511)– Buncefield type facilities overfill protection– Layer of Protection Analysis (LOPA)– Auditing– Process Safety Incident and KPI reporting– ATEX– Senior Management Commitment

• Work in conjunction with European Commission on implementation and upgrading Seveso 2 Directive

• Partnerships with CEFIC (European Chemical Industry Council) and U.S. Center for Chemical Process Safety (CCPS)

www.epsc.org

3


• Mandated by the Federal Emission Control Act

– Advises government as well as plant operators and state and local authorities on process safety

– 32 members with different professional and educational background representing different stakeholders (“Round Table”)

– Any group needs “allies” to win votes

– Consensus intended, but majority decisions possible

• About 55 guidelines issued on different topics, e.g.

– Land Use Planning (Safety distances)

– Risk evaluation and perception

– Emergency Planning

– Industrial parks

– Provisions against terrorist attacks on chemical plants

• All publications of the Commission are available (partly in English) at

• www.kas-bmu.de

Commission on Process Safety (Kommission fuer Anlagensicherheit [KAS])

4


11Learning from Incidents in the EU: Seveso

Guideline

Learning from Incidents in the EU: Seveso Guideline

22 Case StudiesCase Studies

Content

33 ConclusionConclusion

5

—InWEnt | Qualified to shape the future 6

Industrial Disasters are seldom, but drive legislation

Process Safety incidents typically are „low probability - high consequence“ events which …

• are difficult to evaluate statistically (“stochastic events”) Process Safety Indicators (PSI) necessary with broader scope

• tend to get less attention by management (risk approach) EPSC video “Process Safety Pays”

• tend to get high attention by other stakeholders (hazard approach) strict regulations

• may jeopardise the existence of companies

Learning from incidents has top priority


©Major Accident Hazards Bureau - SEVESEO Workshop 1st December 2009, Antwerp

The Evolution of the Seveso Directive (1)

—Seveso (I)

—July 1976

—Flixborough (UK)

—June 1974

—Beek (NL)

—November 1975

—Directive 82/501/EEC

—(Seveso I)—Directive 96/82/EC

—(Seveso II)

—Bhopal (India)

—December 1984

—Mexico City (MEX)

—November 1984

—Basel (CH)

—November 1986

7


The Evolution of the Seveso Directive (2)

—Enschede (NL)

—May 2000

—Toulouse (F)

—September 2001

—Texas City (USA)

—March 2005

—?

—Amended Directive “Seveso II”

—(2003/105/EC)

—Baia Mare (RO)

—January 2000

—Buncefield (UK)

—December 2005

—Jaipur (India)

—October 2009

—Viareggio (Italy)

—June 2009

8


Aim of the Seveso II Directive

To ensure throughout the European Union a common high level of safety and protection against chemical accidents for the people and the environment.

How?

• By preventing major accidents that involve dangerous substances; • By mitigating the consequences of accidents on man and environment.

9


Scope of the Seveso II. Directive

• Mainly chemical and petrochemical industry, storage, logistical centre, big industrial production and energy installations;

• Criteria: Hazard-based: Quantity of dangerous substances present;

• Requirements proportionate to the risk: two tier approach, has to be implemented by Member States;

• ~ 10,000 establishments, 45 % upper tier;

• Goal-setting directive, contains no detailed procedures or guidelines for risk assessment and management.

10

—11

— Plateau’d since 2004 ! 11

Learning from Incidents is mandated by Seveso II

• Traditional approach (at least in “old Europe”): lessons learnt as trigger and basis for detailed regulations (“written with blood”)

• EU “New Approach” since about 1990 put focus on operator risk assessment

• Regulations now define protection targets, but not the way how to reach them

– Tailor-made solutions possible

– Easy adoption to and consideration of new developments

– Risk assessment core duty of operator

– Requires more expertise at operator and authority than detailed regulations

• In addition Seveso II requires constant monitoring of learning experiences:

– Article 9 (5): The safety report shall be periodically reviewed and where necessary updated … to take account of new technical knowledge about safety matters, for example arising from analysis of accidents or, as far as possible, “near misses” …

12


HAZARD

CONSEQUENCE

BARRIERSBARRIERS

ESCALATION CONTROLSESCALATION CONTROLS

TOP EVENT

HAZARD

CONSEQUENCE

BARRIERSBARRIERS

ESCALATION CONTROLSESCALATION CONTROLS

TOP EVENT

“Swiss Cheese”/Layer of Protection Models are accident models, too

—Lagging Indicator

—Leading Indicator

“Swiss Cheese Model” (after J. Reason, modified by Mike Broadribb, BP)

13


Accidents are no “act of god”

• Accidents are failures of one or more defences (protection layers)

• Accidents therefore can be completely avoided in principle (“zero accident goal”)

• Although in reality this goal may not completely reached, it should be the target (otherwise: how many fatalities do you accept??)

• Root Cause Analysis identifies failures on all layers of protection

• This allows comprehensive learning and corrective measures, leading to optimal prevention of iDRM

14


iDRM: Use existing knowledge

• Most accidents and eco – incidents have a previous history– Preliminary events leading up to the accidents (failure of

protection layers) have not been identified

– Prior to most major accidents similar smaller incidents or near misses have happened, but not evaluated

• ... which should be used for prevention– Raise the awareness of the workers

– Use the experience of workers

• Encourage reporting of deviations, near misses and even minor incidents as well as suggestions for improvements. Consider contests and awards for groups working together

• Have a system for following up such reports/suggestions

15



Guideline



Content


16


Case Study: Hoechst/Germany 1993

• In 1993 three major incidents occurred at 2 Hoechst sites near Frankfurt/Germany within 6 weeks– Feb. 22

Runaway reaction after an unnoticed stirrer failure. Emission of 10 tons methanol containing a possibly carcinogenic substance, contaminating a large residential area

– March 15

Explosion of methanol – air – mixture during maintenance in a process plant. 1 worker killed, 1 seriously burnt

– April 2

Major sulphur trioxide emission in a process plant

• The series of incidents caused a lot of public concern and nationwide media coverage.

17

18

—ca. 10t release

—Schwanheim

—Goldstein


Hoechst Incidents: Severe Consequences

• Although the Feb. 22 emission did not cause serious injuries, it led to the most serious consequences for the company and the most “lessons learnt”:

– Direct cause: failure of worker to switch on stirrer

– Root cause: insufficient risk analysis did not identify major risk, which could have been avoided by a simple safety device (stirrer control acting on charging valve)

– Confidence in the company´s competence in emergency response was torn down by

• Gross underestimation of the affected area

• Incomplete knowledge of the hazardous properties of the emitted substance

• Inadequate wording in the first press conference

– Aggravation of adverse reactions by neighbours, media and authorities by arrogant behaviour of site representatives long before the incident

19

Hoechst/Griesheim February 1993

20

Hoechst/Griesheim 1993: a few days later

21

Hoechst/Griesheim 1993: 1 year later

22

Hoechst/Griesheim 1993: “evacuation” of children

23


Hoechst Incidents: Lessons Learnt

Crisis management assessment should cover all parts of emergency- and crisis- management ...

• identify hazards comprehensively

• avoid or control risks

• communicate remaining risks

• mitigate consequences

• remediate damages

• restore trust

... pursuing the goal to define and train as much as possible in advance

24


Case Study: Texas City/U.S.A. 2005

One of the best investigated accidents in (petro-)chemical industry(BP; U.S. Chemical Safety and Hazard Investigation Board (CSB); „Baker“-Report)

25

If time permits, the CSB video will be shown


Baker Report

• The Baker Report is an unique source esp. for issues of process safety culture far beyond the specific incident in Texas City

• The recommendations of the Baker report have been evaluated by the German Commission on Process Safety (KAS) in the context of common management and human factor practices in German process industries

• The 260 pages of the Baker Report have been condensed to a 13 page report with recommendations focussed on German needs, illustrated by best practice examples.

• Although the discussion often was controversial, eventually a broad consensus between all stakeholder groups could be achieved.

• The report is available (shortly in English, too) as “KAS-7” at www.kas-bmu.de: KAS recommendations on advancing the safety culture – Lessons learnt from Texas City 2005

27


The main “lessons learnt” (1)

• High Risk Industries need a well established “pervasive Process Safety Culture” as a basis for an effective Safety Management System

– Policy statement on process safety culture– Development of indicators for process safety culture,

regular assessment (internal/external) – Involvement of all stakeholders in developing process

safety culture• Leading from the top

– Clear and visible commitment– Independent “Process Safety Officer” reporting to the

Board– Regular Process Safety Management review by the Board– Clear definition of roles and responsibilities on all levels– Process safety performance as part of personal

goals/bonus systems– Process safety as mandatory part of all relevant decisions

(M&A, investments, recruitment, ...)– Open, positive and trusting communication culture

28



• Managing Process Safety– Clear and unambiguous implementation of Annex

III/Seveso II

• Process Safety competence and training– Developing deficiencies in graduate education are

highlighted– Task-specific definition of process safety competence (and

manpower!)– Regular Process Safety training – Contractors have to be included in these measures

accordingly

• Process Safety assessment, learning from incidents– Develop/implement Process Safety reporting system (open,

trusting!) and KPIs

29



• Process Safety support for line management– Sufficient number of qualified and independent experts

• Process Safety assessment, learning from incidents– Develop/implement Process Safety reporting system (open,

trusting!) and KPIs

• Process Safety audit and review– Develop/implement systems with high involvement of top

management

• Process Safety inspections by authorities– Roles, responsibilities and competence requirements for

inspectors

30


Implementation of “Baker recommendations”: Status and outlook

• Germany– Some recommendations are yet regulated or “good practice”– “New” recommendations are (slowly) implemented on basis

of the guidance– The KAS guidance is on soft issues and aims at changing of a

mindset – this needs time!• EU

– Some recommendations are yet regulated (Seveso II Annex III) or “good practice”

– EU Major Accident Hazards Bureau (MAHB) had 3-day workshop in March 2010• “illustrating linkages between safety leadership, culture

and performance indicators and identifying potential benefits and drawbacks of applying these concepts in an inspection and enforcement context.”

– Will probably be considered in future revisions of Seveso II

31

—32

Senior Management and Process Safety – not only a BP Problem

Process Safety needs strong leadership right from the top

Baker Report stresses the old truth that in hierarchical organisations the direction is from the top

• Senior Management and Board

– Increasingly focused on short term results

– Increasingly without operating experience

– May never have experienced a (low probability) major accident in the short shelf life of their jobs

– May believe that Process Safety is a cost driver and puts brakes on investments

– May not fully understand their direct accountability

32

—33

EPSC/EFCE project “Fostering senior management commitment for process safety”

• DVD package with video and template for PowerPoint presentation

• To be presented by senior process safety specialist at e.g. Management Board meeting, duration 30-60 minutes

• Video “Process Safety Pays” as “opener” or “teaser” to achieve positive emotions for process safety for non-technical senior management

• Max. 10 minutes

• High quality (“image film”)

• Process safety correlated to high integrity organisations such as airlines

• Testimonials by peers (e.g. CEO, CFO)

• Followed by PowerPoint presentation focussing on the specific issues of the company (based on template provided by EPSC WP)

The whole package is available via www.epsc.org

33

If time permits, the video will be shown


Case Study: Buncefield/UK 2005

• The Buncefield accident has been described as the biggest fire in Europe since the Second World War.

• It has been thoroughly analysed by: – the Major Incident Investigation Board (MIIB), set up by

the U.K. Government– the Buncefield Standards Technical Group (BSTG) and

the Process Safety Leadership Group by the U.K. Health and Safety Executive (HSE), science and industry

• The companies involved have been found guilty by court in 2010, trial against workers is still pending

34


Buncefield: the facts

– Dec. 10, 19:00 hrs: unleaded motor fuel was being pumped into storage tank 912 via pipeline (550m³/h).

– Dec. 11, since approx. 03:00 hrs no change of level indication despite of continuous filling.

– approx. 05:20 hrs overfilling of tank 912 starts, independent “high-high” level switch does not work. Fuel escapes with 550m³/h through roof openings. A total of approx. 300m³ flows first in bund and then outside.

– Since 05:38 hrs increasing “fog” (fuel fume) visible in security video, vapour cloud 250,000M3

– At 06:01 hrs several strong explosions, followed by huge fire, destroying 20 tanks in different bunds as well as stationary fire fighting equipment.

– Until Dec. 15 fighting the fire with mobile high performance pumps.

– 43 persons injured (no fatalities only due to time of accident!); immense property damage also outside the tank farm; huge cloud; contamination of groundwater and soil by fuels and foam concentrate.

– Stable weather conditions

35

The Buncefield Fuel Storage facility

—Fed by refinery pipelines from different locations.

—Feeding users including Heathrow Airport via road

and distribution lines36

Access hatch for dippingServo level IndicatorATG

Independent level switch

Funnel for dip

Gasoline

Vented ullage

In/out

atmos. vents

Int. floatingroof

T912

‘high-high’

38

Explosion overpressure

• Ignition leads to deflagration proceeding to detonation

• Overpressures >2bar over a radius of 250M

45


Environmental Effects to Air (eventually negligible)

47


Environmental effects to ground (fuel + 800 m³ foam concentrate + 68,000 m³ fire water)

48


Buncefield Evaluation: Main “lessons learnt”

• High reliability overfill protection systems necessary, partly going beyond existing regulations

• Review of scope and frequency of inspections

• Apply best practice for fuel storage management as preventive measure

• Number of workers at fuel storage sites must guarantee safety during serious operational breakdowns, too

• Review of leakage detection (early warning) and product retention (soil & water protection) systems

• Prevention of turbulence and other critical dispersion effects in case of overfilling

• Review best practice for fire fighting and emergency planning (esp. high performance pumps, mutual aid agreements)

• Review hazard zones around tank farms, possibly review of explosion overpressure models

49


U.K.• The Health and Safety Executive (HSE) issued guidance and

requested 15 similar facilities to carry out LOPA. – The results showed inconsistency which caused concern for the

regulator and for LOPA practitioners in the European Process Safety Centre (EPSC).

– HSE asked EPSC to chair a group of specialists to SOLVE this problem.

• Land use planning (safety distances) around tank farms have been reassessed

Germany• Commission on Process Safety issued guidance (KAS-13, as

interim report also available in English on www.kas-bmu.de)

Consequences drawn in Europe

50

U.K. Hazardous Zones for a Buncefield-type Explosion

Zone Name

Zone Size (measured from the

tank wall)

Comment

A r < 250m

The probability of fatality should be taken as 1.0 due to overpressure and thermal effects unless the exposed person is within a protective building

B250m < r <

400m

The expected overpressures are 5-25 kPa. Occupants of buildings that are not designed for potential overpressures are more vulnerable than those in the open air.

C r > 400m

The probability of fatality of a typical population can be assumed to be zero. The probability of fatality for members of a sensitive population can be assumed to be low.

HSE research on the Buncefield Explosion Mechanism indicates that overpressure may have exceeded 2 bar (200 kPa) up to 250m from the tank that overflowed.

51


Überschrift


Guideline



Content


52

Conclusion: Sharing “Lessons Learnt”

Although learning from incidents is an individual obligation of any operator, the burden can be shared

1. Voluntary cooperation within and between companies

– Company guidelines

– Cross-sectoral cooperation (e.g. European Process Safety Centre, U.S. Centre of Chemical Process Safety)

2. Cooperation in given legal framework, e.g.

– German Commission on Process Safety “sub-legal” guidelines

– U.S. Chemical Safety Board Incident investigation reports, videos

3. Consideration in (the amendment of) regulations, e.g. Seveso II/2003:

– Enschede fireworks explosion reclassification of explosive substances

– Toulouse Explosion reclassification of Ammoniumnitrate, land use planning

– Baia Mare environmental incident redefinition of interface to mining regulations

• Effective cooperation as in (1) and (2) can avoid (3)!

53


Thank you for your attention!

... and special thanks to Richard Gowland, EPSC Technical Director, who contributed a number of slides

54

—inwent | qualified to shape the future christian jochum ([email protected]) inwent senior...

Documents

chemical process safety

corporate safety director

safety critical systems

safety department site

european commission

inwent senior advisor

director of centre

german commission