Microsoft Word - 476hernandez.docx CHEMICAL ENGINEERING TRANSACTIONS VOL. 43, 2015 A publication of The Italian Association of Chemical Engineering Online at www.aidic.it/cet Chief Editors: Sauro Pierucci, Jiří J. Klemeš Copyright © 2015, AIDIC Servizi S.r.l., ISBN 978-88-95608-34-1; ISSN 2283-9216 Consequence-Based Decision Making in a Risk-Based Regulated Regime Corina Glavana, Ekambaram Palaneeswaranb aAustralian Munitions, Mulwala, New South Wales 2647, Australia bFaculty of Science, Engineering and Technology, Swinburne University of Technology, Hawthorn, Victoria 3122, Australia corina.glavan@thalesgroup.com.au Fifteen contractor staff died in 2005 Texas City accident when a “350 feet” BP company rule was breached. Was the mandated rule adequate or was it a rule overruled by a bias on-site risk-based decision? Is it reasonable for such ineffective rules to override a potentially rational risk-based decision or can a converse overtake option still be acceptable? Whist a risk-based approach admits that risk is inevitable, a consequence-based approach disregards the likelihood of an event and thus rejects the concept of risk, known as a product of consequence and likelihood. Consequence-based decisions are mainly made to eliminate the risk rather than reducing it to an acceptable level. Should senior management in control of major accident/ high hazard facilities adopt any safety strategies based on consequence? How would such strategies differ under a risk based-model using high consequence, low frequency events and demonstrating that the risk is reduced to a level that is as low as reasonably practicable (ALARP) by a reasonable list of preventative and/ or mitigative controls, e.g. as regulated in the Safety Case regime and based on the concept of “duty of care”? A set of discussions from our research are outlined in this paper, which include key findings and comparisons between consequence estimations using the quantity distance rule and risk-based assessments in defining safety strategies in the manufacturing and storage of explosives in Australia. 1. BP Texas City incident Fifteen contractor personnel were killed and 170 employees at site were injured in the explosion incident that occurred at the Texas City refinery in 2005, during the start-up of an isomerisation column. The long list of causes include operators failing to follow the start-up procedure instructions, lack of communication, malfunction of critical alarms and control instrumentation as well as unsafe design of the blowdown system. It had never been connected to a flare system in order to safely contain liquids and combust flammable vapours that could have been released from the process. The flammable vapour was released and ignited, which resulted in injuries and fatalities of personnel who were working in and around temporary trailers that had been previously sited by BP as close as 121 feet (37 m) from the blowdown drum (CSB, 2007). A sitting analysis assessing risks involved in locating temporary buildings, with respect to process, called for a distance of 350 feet (107 m) from the process. BP engineers determined that at that distance the risk of a fatality was extremely low. A site-specific risk analysis was conducted to justify why the trailers could be located much closer from the vent, at one point at 120 feet. This introduced a confirmation bias into the decision-making process (Hopkins, 2011). BP allowed site-specific risk assessment (i.e. process hazard analysis) to overrule a general BP rule. The team members conducting process hazard analysis did not understand how to do the building siting analysis based on consequence modelling, yet they overruled the company rule, based on the American Petroleum Institute API 752 (1995) documentation. API 752 neither prescribed how temporary constructions could be closed (e.g. trailers placed in the proximity of process units handling high hazardous chemicals), nor established a minimum safe distance among various types of buildings and hazardous process units. API provided an assessment tool to determine the vulnerability of DOI: 10.3303/CET1543325 Please cite this article as: Glavan C., Palaneeswaran E., 2015, Consequence-based decision making in a risk-based regulated regime, Chemical Engineering Transactions, 43, 1945-1950 DOI: 10.3303/CET1543325 DOI: 10.3303/CET1543325 Please cite this article as: Glavan C., Palaneeswaran E., 2015, Consequence-based decision making in a risk-based regulated regime, Chemical Engineering Transactions, 43, 1945-1950 DOI: 10.3303/CET1543325 1945 building occupants during building collapse from events like earthquake, explosive blast and windstorm damage to buildings. But it failed to discuss the personnel vulnerability from events such as vapour cloud explosions. Adding to the failure to follow a company rule, BP failed to replace an out-dated blowdown system that had never been connected to a flare system. BP could not prove that the blowdown system was of a safe design (CSB, 2007), and failed to follow internal safe procedures1 developed by the previous plant owner, Amoco and later adopted by BP. The blowdown system should have been replaced for safety reasons. OSHA issued a number of citations to the Texas City refinery (Amoco owned) to reconfigure blowdown to a closed system with a flare. Amoco initiated a project to resolve the non-compliance issues, but later decided not to fund the project. At the time of the incident, an industry practice (API 521, 1997) discussed the design and selection of a disposal systems but was not specific to differentiate whether a flare system is an inherently safer design than an atmospheric vent stack, because it safely combusts flammable hydrocarbons before they are vented to atmosphere, thus preventing a serious fire or explosion hazard from flammable vapours. There are a number of issues identified that needed further discussion: a) BP "350 feet" rule - The assessment team used the wrong assumptions, failing to understand the behaviour of a vapour cloud explosion in congested spaces, that the more the congestion, the greater the overpressure and the generated shock wave (Hopkins, 2008). They wrongly assumed the vulnerability of the temporary buildings. The risk assessment conducted for the trailer location was undertaken by unqualified personnel, who did not understand the process and later concluded that the trailers could be located closer to the isomerisation unit. BP "350 feet " rule was only observed, according to the CSB investigation, and the BP risk assessment group decided to by-pass the rule because they started with the proposed location to determine the risk level, process known as confirmation bias (Hopkins, 2011). Blast modelling conducted following the incident identified that at 340 feet the damage would have consisted of significant deformation of walls and roof with internal debris damage, with the calculated overpressure in the range of 1.5 to 2.5 psi . The model demonstrated that the physical separation between the trailer area and the isomerisation unit did not reduce the blast pressures, as it would be expected in an open field. The pressure due to the change in ownership of the refinery and resultant re-organisation of the business somewhat caused dissociation of the chemical operations from the refinery and the division of the services group were considered organisational factors (Payne et al., 2009). b) OHSA oversight of the Texas City Refinery - The OSHA's regulation, "Process Safety Management of Highly Hazardous Chemicals," (PSM standard) contains broad requirements to implement management systems, identify and control hazards, and prevent "catastrophic releases of highly hazardous chemicals." Pertinent to the incident were: (1) deficient process hazard analysis, which failed to identify the scenario of splitter tower raffinate overfill; (2) deficient assessment of the management of change that includes assessment of the implications from changes to facilities and how budget cuts would impact on process safety, and (3) failure to maintain the integrity of process equipment. OSHA conducted fewer than expected program quality verifications because it concluded that the petrochemical industry had a lower accident frequency than the rest of manufacturing industries and because they had an insufficient number of qualified inspectors to conduct these verifications. A later audit conducted by OSHA after the incident identified in excess of 300 violations of OSHA standards (OSHA, 2012). c) API practices, although widely recognised, failed to provide critical information regarding a safe distance between the trailers and hazardous process areas, protection of personnel and specific details in selecting and designing pressure relief and disposal systems for hydrocarbons. 2. Risk-Based approach and consequence-based assessment BP’s risk based assessment accepted that risk was inevitable and identified the likelihood and consequence (fatalities) determining that the risk was sufficiently low and accepted to place people in light construction buildings, in close proximity of hazardous operations. In a risk-based approach, it is accepted that the risk of harm is inevitable and risk is calculated as the probability of the event occurring and multiplied with the severity of the outcome. The risk would reduce to a level that would be deemed as acceptable by either reducing the event likelihood, the severity of the consequence, or both. A consequence based assessment considers the most severe outcome, disregarding the estimation of the event likelihood, thus the idea of an acceptable risk. The philosophy of the consequence-based assessment is 1 Amoco’s Process Safety Standard (PSS) No. 6 1946 to protect people from harm, and in the example of Texas City refinery, the buildings located near a potential explosion zone should have been built to withstand the blast damage (Hopkins, 2008). The concept of consequence based assessment is applied not only to chemical plants, but also to hazardous areas associated with Explosive Ordnance (EO), including manufacture and storage of explosives. 3. Explosive ordnance and quantity distance (QD) In Australia, the explosives manufacture and storage industry is regulated through Australian Federal, State and Territory legislations, which define general requirements that the EO areas must adopt. In addition to these legislative requirements, organisations that manufacture explosives products intended for defence markets are specifically regulated by defence regulations (eDEOP, 2011) based on the principles outlined in various North Atlantic Treaty Organisation manuals of Safety Principles for Military Ammunition and Explosives. The manufacture, storage and handling EO present a level of inherent risk. One of the key differentiators between chemical and explosives manufacture is that vapours, gases or dusts of explosives do not require air to form an explosive mixture as they are inherently explosive because the oxygen required for the combustion is provided from within the molecule. To provide an additional level of assurance against an escalation of an explosive event to nearby inhabited or un-inhabited infrastructure, public traffic routes and buildings of vulnerable construction, quantity distance (QD) rules were developed. QD are defined as a minimum permissible distance between a potential explosive site (PES) containing a given quantity of explosive ordnance and an exposed site (ES). QD are determined in accordance with the eDEOP and are based on an expected level of damage. These distances apply specific mathematical calculations developed from the knowledge extracted from several extensive trials and analyses of explosive accidents throughout the world. Whilst QD calculations take into consideration maximum consequence from blast overpressure, they are still a risk-based tool, which repudiates the concept of zero risk of damage (from zero consequence), but rather an acceptable level of damage from the effects of a mass fire or explosion. QD apply within and beyond the boundaries of a facility, which due to the investment and strategic implications must ensure long-term viability and guard against incompatible developments. Factors that influence the QD calculations are (1) the type of construction of the ES and PES, (2) the protection level at the ES, (3) the net explosive quantity and the type of explosives contained in the PES, (4) the level and type of activity undertaken at both ES and PES and other relevant technical factors. For existing buildings, QD rules specify the maximum net explosive quantity in a process or storage in a PES that would limit the escalation of an explosion to the nearby ES. For future development where exposed sites do not yet exist, the QD term was replaced with Safeguard (circular) Lines which delineate concentrically located Safeguarding Zones. There are three Safeguarding zones, defined as: (1) the outermost, Green Zone at the Public Traffic Route Distance and beyond, where debris form a fire or explosion (consequence) would pose a significant risk to those exposed; (2) the Yellow Zone contains the Inhabited Building Distance from each PES within the facility where a fire or explosion would produce serious structural damage to buildings and serious injury to occupants, (3) the Purple Zone contains twice the Inhabited Building Distance from each PES. The Purple Line restricts the construction of buildings or facilities which have the potential to facilitate the aggregation of large number of people. The control of Safeguarding Zones is established though consultation between stakeholders and facilitated by the planning authorities in control of local land development and act as a base for the approval of land development. QD are pressure calculations based on a cube root scaling, which means that in order to keep the pressure level constant, the required distance increases proportional to the cube-root of the net explosives quantity. The QD calculations fail to provide information on debris formed from an explosion and require additional QRA modelling (Tatom, 2014). QD rules are used both as control in a risk-based management decision to license explosives storage or manufacturing building, but they are also used in a consequence based assessment for to establish the proposed location of new buildings. The QD rule is used to demonstrate legal compliance in the Safety Case regime while providing the community with the confidence that public is protected from explosive incidents at a MHF. 4. Goal-setting legislation Although regulated by a number of general and industry specific regulations, explosives manufactures operate as major hazard facilities (MHFs) and would be required to meet the requirements of the Australian Work and Safety (WHS) Act and Regulations (2011). These regulations set broad safety goals to be attained by the operators of MHFs, and in turn, the operator must develop the most appropriate methods of achieving those goals implementing guidance and model codes of practice with examples to demonstrate the minimum legal standard to be attained (Reason, 2004). The goal setting type of legislation that Australia adopted is based on 1947 the UK legislation. A goal-setting legislation and the Safety Case regime were developed to address the shortfalls of the prescriptive legislation including an in-depth reliance on past experience, inability to cope with a diversity of design solutions and the implementation of good engineering practices available at one given time, and finally increased cost of technical solutions (Glavan and Palaneeswaran, 2010). By comparison, the goal-based approach does not specify the means of achieving compliance, but sets goals that allow alternative ways of achieving compliance, offering greater freedom in adopting technical solutions in order to providing a coherent and convincing safety justification to attain a pre-determined goal. Assurance is provided to the regulator by demonstrating that the risks are tolerable and reduced to a level that is As Low As Reasonably Practicable (ALARP). This can be achieved by providing the regulator, though reasoned and supporting arguments that there are no other practical way that could reasonably be taken to reduce the risk any further. In determining that the risk has been reduced ALARP, the operator must assess the risk to avoided and must conduct an assessment of the sacrifice in averting the risk. The comparison is submitted to a test “gross disproportion” (SafeWork Australia, 2011) to determine whether a measure that is practicable and cannot be shown that the cost of the measure is grossly disproportioned (to the benefit gained should be implemented NOPESMA, 2014). There is a fundamental distinction between “practicable” which focuses on the practicality of the risk reduction measure regarding considerations of its technical feasibility, without consideration of the cost, while “reasonably practicable” considers cost in relation to the risk reduction. In a goal-setting regime the onus is placed on the duty holder to identify all practicable measures for risk reduction or foreseeable hazards. In determining what constitutes reasonably practicable, the operators must consider the likelihood of the hazard, the degree of harm that it would generate, what a person concerned knows or ought reasonably to know about the hazard or risk and any ways of eliminating or minimise the risk, the availability and suitability of ways and cost to eliminate or minimise the risk. Interestingly, the Australian legislation in control of MHF remained fragmented (Glavan and Palaneeswaran, 2012), with different regulatory bodies enforcing different legislation even after the Model WHS Act was enacted in some of the jurisdictions (SafeWork Australia, 2014). Compared to the Directive 96/82/EC (EC 1996) which was adopted in various European jurisdictions like the Italian Government (Constantini and Valenzano, 2012), Australian MHF legislation still fails to prescribe or provide guidance regarding the minimum safety requirements concerning land use planning for major hazard facilities in order to determine the vulnerability of the surrounding natural and built environment and the vulnerability of people living in those areas. Consequently, facilities that manufacture, store and handle EO undertake additional assessments to protect the vulnerable community and the environment at risk. 5. Decision making in a high hazard organisations High hazard organisations involve technologies and activities where if things go wrong, they have the potential to injure and kill numerous people (e.g. Glavan and Palaneeswaran, 2010; Harrick et al, 2012). In general, the decision making process in these organisations is based on the risk itself and mainly using the societal acceptance criteria, which define the cumulative frequency of events as a function of the number of fatalities among the population in any incident. Basic disadvantages of making risk-based decisions are driven by following factors: (a) hazard analysis and risk calculations are inherently unrepeatable, (b) the risk criteria are be subjective, particularly in determining low probability events, (c) a tendency to take no action if the risk is below the acceptability or tolerability limit and (d) there is a temptation to implement controls that reach the target, without formally considering the hierarchy of controls (Francis and Robinson, 2011). The ALARP principle creates a paradox situation which is better described by Hopkins (2005): “At law, employers must drive down risks as far as is reasonably practicable and there is no level of risk which, a priori, can be said to be acceptable. Moreover, the law has a well-defined set of principles for determining whether risks are as low as reasonably practicable, and despite the indeterminacy of these principles, it is by no means clear that QRA and the tolerability / acceptability framework offers a better way of deciding how low is low enough”. This leads to an opinion that it is better to have in place all reasonably practicable precautions rather than achieving an indefensible target level (ALARP) of tolerable or acceptable level of risk. The transition from a hazard based risk assessment approach to a precautionary “due-diligence” approach described in the WHS Act (2011) suggests replacing the hazard-oriented assessments and determinations of acceptability or tolerability level of risk with a precaution-oriented system that would test all practicable precautions for being reasonable, (on the balance of the risk versus the effort needed to reduce it). Risk aversion is one way to protect an organisation against uncertainty. Another way is to adopt scale aversion (HSE, 2009) which is defined as “the tendency to want greater protection where consequences are high”. Major hazards are quoted (Enander and Lajkjo, 2003) to have other negative effects in society, beside consequential damage. This is because of the fact that the confidence of the society placed on the activities undertaken at these facilities was undermined by incidents. The authors quote that, depending on the impact 1948 of the incident the population intuitively assesses “damage” differently and recovers quicker from minor incidents than from major incidents. Hazardous events are communicated a wide range of media and have a multiplying effect beyond the initial impact of the event, with lasting effects, type of harm caused and the type of loss experienced by the affected groups, which is significantly greater than anticipated and of different nature than the loss and consequence, as measured in traditional risk terms. The concept of High Reliability Organisations (HRO) (Weick et al, 1999) was associated with to high hazard organisations and influences the decision making process. Under conventional approaches, safety decisions in high hazard organisations use a quantitative risk assessment (QRA) and associated decision making principles including ALARP. Basically, the QRA method resolves uncertainties and provides an answer to choices between two or more courses of actions, based on numerical ranking of options. Thus, the conventional/ classical decision making in the form of risk assessment provides the basis for a relationship between the regulator and the regulated in the context of the Safety Case Regime. It is recognised (Marais et al., 2004) that HRO oversimplify the problems that engineers and engineers and organisations face in building safety-critical systems and proposes an alternative system approach, in which safety is a system property not a component property. For example, determining if a complex plant is acceptably safe is not based on examining a single valve in the plant. 6. Conclusion Prevention of major incidents is a complex process and cannot be accomplished without the input from competent process safety engineers to making the correct assumptions in determining the risk of major incidents events using appropriate assessment methods and using multiple assessment methods to resolve uncertainty. High hazard organisations must have a robust decision making process based on rigorous risk assessment and the ALARP principle. It becomes obvious that understanding and preventing incidents requires to identify a system of controls that are necessary to prevent incidents, understand how the safety controls could be disobeyed, design a system to enforce controls able to protect the system against unsafe behaviours and determine how changes in the process over time, due to internal and external influences, or change of controls reliability could increase the risk. Moreover, regulators have also the obligation to conduct assessments involving competent assessors that are able to probe the demonstration of reasonably practicable. Legislators have a responsibility to review and update legislation to provide broader protection to the community and the environment. Preventing catastrophic events from major incidents, in a goal setting legislation, is specific to each organisation, and therefore it cannot be copied from others, but it can be still learned from others. References API (American Petroleum Institute) 521, 1997, “Guide for Pressure-Relieving and Depressuring Systems”, 2nd Ed., Washington, DC, USA API 752, 1995, “Management of Hazards Associated with Location of Process Plant Permanent Buildings”, 2nd Ed., Washington, DC, USA Constantini A., Valenzano B., 2012, Integrated Approach Proposal for Evaluation of both Environmental and Accidental Risk in Industrial Management, Chemical Engineering Transactions, ISSN 1974-9791 26, 453- 458. CSB (Chemical Safety and Hazard Investigation Board), 2007, Investigation Report – Refinery Explosion and Fire, Report No. 2005-04-I-TX, USA EC, 1996, Council Directive 96/82/EC of December 1996 on the control of major-accident hazards involving dangerous substances. Official Journal, L 010, 13-33 eDEOP (Department of Defence Explosives Regulations) 2011, Explosives Storage and Transport, Directorate of Ordnance Safety, Directorate of Ordnance Safety, Department of Defence, Australian Government, Canberra, Australia Enander A., Lajksjo O., 2003, Risk Aversion: The term and the phenomena related to complex risk issues – Swedish Rescue Service Agency (SRSA). 91-7253-206-8. Francis G., Robinson R.M., 2013, Implications for Designers of the Engineers Australia Safety Case Guideline 3rd Ed., presented to Electrical Regulatory Compliance Forum, 25-26 Sept. 2013, Brisbane, Australia accessed 01/12/14 1949 Glavan C., Palaneeswaran E., 2010, Towards effective management of major hazards facilities, presented at the CHEMECA 2010 Conference, 26-29 Sept. 2010, Adelaide, Australia, ISBN 978 085 825 9713, 1709- 1720. Glavan C., Palaneeswaran E., 2012, “Price and Complications of Safety Compliance”, Chemical Engineering Transactions, ISSN 1974-9791 26, 429-434. Harrick P., Palaneeswaran E., Newton M., 2012. High hazard risks and safety climate in offshore oil and gas facilities. Proceedings of CIB W099 International Safety Conference on Modelling and Building Safety, 10- 11 September 2012, ISBN 9789810714215, Singapore, 398-406. Hopkins A., 2005, Safety Culture and Risk. The Organisational Causes of Disasters, CCH, Sydney, NSW, Australia. Hopkins A., 2008, Failure to Learn: The BP Texas City Refinery Disaster, CCH, Sydney, NSW, Australia. Hopkins A., 2011, Risk Management and Rule-Compliance: Decision-Making in Hazardous Industries, Safety Science, 49, 110-120 HSE UK, 2009, Evidence or Otherwise of Scale Aversion: Public Reactions to Major Disasters, Technical Note 03, < www.hse.gov.uk/societalrisk/evidence-or-otherwise-of-scale-aversion.pdf> accessed 01/12/14 Marais K., Dulac N., Leveson N., 2004. Beyond normal accidents and high reliability organizations: The need for an alternative approach to safety in complex systems, paper presented to Engineering Systems Division Symposium, MIT, Cambridge, MA, USA, 29-31. NOPESMA (National Offshore Petroleum Safety and Environmental Management Authority), 2014, ALARP, Guidance Note-GN0166 < www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0166-ALARP.pdf> accessed 01/12/14 OSHA (Occupational Safety and Health Administration), 2014, BP Texas City Violations and Settling Agreements accessed 01/12/2014. Payne S.C., Redriguez J.M., Bergman M.E., 2009, The Impact of the BP Baker Report and Process, AIChE accessed 01/12/2014. Reason J., 1997, Managing the Risk of Organisational Accidents, Ashgate, England, UK, reprinted 2009. SafeWork Australia 2011, Interpretative Guideline – Model Work Health and Safety Act, The meaning of “Reasonably Practicable” accessed 01/12/2014. SafeWork Australia, 2014, Jurisdictional progress on the model work health and safety laws, accessed 01/12/2014. Tatom J., 2014, Evaluating Debris Hazard, Safex, 50, 6-10 accessed 01/12/14 Weick K.E., Sutcliffe K.M., Obstfeld D., 1999, Organising for High Reliability: Process of Collective Mindfulness, Research in Organisational Behaviour, 21, 81-124 WHS (Work Health and Safety) Act and Regulations, 2011, ComLaw, Australian Government, Canberra, Australia < www.comlaw.gov.au/Details/F2011L02664> accessed 01/12/14 1950