Major Hazard Facilities Control Measures and Adequacy

1. Major Hazard FacilitiesControl Measures and Adequacy

2. Overview The seminar has been developed to provide: • Context with MHF Regulations • An overview of what is required • An overview of the steps required • Examples of control measures and their adequacy

3. Some Abbreviations and Terms • AFAP - As far as (reasonably) practicable • DG - Dangerous goods • Employer - Employer who has management control of the facility • ER or ERP - Emergency response or Emergency response plan • Facility - any building or structure at which Schedule 9 materials are present or likely to be present for any purpose • HAZID - Hazard identification • HAZOP - Hazard and operability study • HSR - Health and safety representative • LOC - Loss of containment • LOPA - Layers of protection analysis

4. Some Abbreviations and Terms • MHF - Major hazard facility • MA - Major accident • OHS - Occupational health & safety • PFD - Probability of failure on demand • PSV – Pressure safety valve • SMS - Safety management system

5. Topics Covered In This Presentation • Regulations • Introduction • Regulatory requirements • What does this mean? • Identify all control measures • Development of assessment • Control category and examples • Hierarchy of controls • AFAP

6. Topics Covered In This Presentation • Effectiveness of control measures • Control types • Opportunities available to reduce risk • Assessment and adequacy • Sources of additional information • Review and revision

7. Regulations Basic outline • Hazard identification (R9.43) • Risk assessment (R9.44) • Risk control (i.e. control measures) (R9.45, S9A 210) • Safety Management System (R9.46) • Safety report (R9.47, S9A 212, 213) • Emergency plan (R9.53) • Consultation

8. Hazards causing an MA The controls preventing or mitigating consequences of an MA The controls in place and assess their effectiveness and adequacy Introduction In order to deliver safe operation the Employer needs to understand the relationship between

9. Introduction • At least 23 workers were killed • 74 were injured • $800,000,000 (U.S.) estimated property damage Controls DO fail and the consequences can be devastating (Skikda, Algiers, 20 January, 2004)

10. Introduction • Control measures are the features of a facility that: • Eliminate • Prevent • Reduce • Mitigate . . . the risks associated with potential MAs • They are the means by which the Employer ensures the operation satisfies the Regulations and the AFAP requirement • A number of control options maybe considered and applied individually or in combination

11. Introduction • In undertaking control measure identification and assessment, the Employer should seek to attain an understanding of: • The processes involved in control measure identification/selection and assessment • The control measures used to reduce the risk of potential major accidents to AFAP

12. Introduction • At the end of the controls and adequacy evaluation process, the Employer should know: • The identity of all existing and potential control measures • The relationships between the hazards, control measures, MAs and outcomes • The effectiveness of control measures in managing risk • The opportunities that are available to reduce risk • The monitoring regime necessary to ensure the ongoing effectiveness of the control measures

13. Regulation Requirements • After the HAZID and Risk Assessment evaluations, the Employer will have identified all of the hazards that can lead to MAs and the controls in place, including independence, reliability, effectiveness, robustness and applicability • A determination of the adequacy of the controls in managing the hazards then needs to be undertaken

14. What Does This Mean? • The opportunities present that are available to reduce risk need to be assessed, including additional or alternative controls • The monitoring regime necessary to ensure the ongoing effectiveness of the control measures for managing the hazards need to be assessed • Control measures and adequacy assessment will need to be revised as necessary, using performance monitoring results and other relevant new information

15. 50 45 Petroleum 40 Utilities 35 Logistics No of Incidents 30 Chemicals & Plastics 25 20 15 10 5 0 Chemical First Aid Onsite LOC First Aid Offsite Environ Explosion Fire Release Exposure What Does This Mean? Reported incidents by results involving Schedule 9 materials in Victoria (from VWA)

16. What Does This Mean? • This accident happened during the filling of a 2000 m3 LPG sphere • Its legs collapsed. • One person was killed and one seriously injured

17. Identity of All Control Measures • All of the MAs should be documented in an appropriate format that clearly identifies: • The MA (the release modes and the consequences of the release) • All hazards that, if realised, can cause an MA • The controls in place to manage the hazard and any recommended controls as a result of the HAZID process

18. Identity of All Control Measures Example, consider a chlorine drum handling operation

19. Identity of All Control Measures

20. Identity of All Control Measures • Control measures are not only physical equipment, but may include: • Engineered devices (physical barriers such as impact protection bollards) or systems (high integrity trip systems) • High-level procedures or detailed operating instructions • Information systems (incident reporting systems) • Personnel training (i.e. the actions people should take in an emergency)

21. Development of Assessment • It is important to understand how controls are arranged in a manner that eliminate or minimise the hazards leading to an MA occurring, and any interdependence • Control measures may be pro-active, in that they eliminate, prevent or reduce the likelihood of incidents • They may be reactive, in that they reduce or mitigate the consequences of an MA

22. Development of Assessment • Control measures may be considered as “barriers” and are located between the intrinsic hazards that could lead to an MA • Control measures can also reduce the harm that may be caused to people and property in the event of an MA • Hazards can result in an MA harming people or property only if controls have failed to function as intended, or have been bypassed/defeated

23. Development of Assessment 1st barrier 2nd barrier 3rd barrier

24. Development of Assessment • There are methods for the control assessment process • The size, complexity and knowledge of the MHF could determine which approach to use • Several methods can be used, e.g.: • LOPA • Fault tree and event tree • Risk matrix

25. Controltype Effectiveness Effectiveness Increasing Reliability Eliminate Hazard 100% Minimize hazard 90% Physical controls Procedures 50% Decreasing Reliability Personnel Skills &Training 30% Control Measure Hierarchy The hierarchy of controls & effectiveness guidelines

26. Control Measure Hierarchy • Elimination/substitution controls • Prevention controls • Reduction controls • Mitigation controls

27. Control Measure Hierarchy

28. Control Measure Hierarchy

29. Control Measure Hierarchy

30. Control Measure Hierarchy

31. Control Measure Hierarchy

32. Control Measure Hierarchy

33. AFAP • It is the risk assessment that provides the information necessary to test this requirement, and this information must be included in the safety report • The risk assessment must address hazards and risk both individually and cumulatively • Consequently the demonstration that risks are eliminated or reduced to AFAP may need to be made for control measures individually, in groups and as a whole

34. AFAP • The AFAP approach is not simply about satisfying a single criterion of whether the risk of an MA is less than a specific number or position on a risk matrix • It is about evaluation of all controls, their proportionality for controlling the risk of an MA occurring and if additional controls can reasonably have an effect on reducing the risk of an MA further

35. AFAP • The likelihood of the hazard or risk actually occurring • That is, the probability that someone could be injured or harmed through the work being done • The degree of harm that would result if the hazard or risk occurred • For example fatality, multiple injuries, medical or first aid treatment, long or short term health effects • The availability and suitability of ways to eliminate or reduce the hazard or risk

36. AFAP • What is known, or ought reasonably be known, about the hazard or risk and any ways of eliminating or reducing it • The cost of eliminating or reducing the hazard or risk • That is, control measures should be implemented unless the risk is insignificant compared with the cost of implementing the measures

37. AFAP • The balance between benefits in terms of reduced risk and the costs of further control measures will play a part in achieving and demonstrating AFAP • Every safety report will need to develop an approach as to how the AFAP argument is to be applied to the facility • The AFAP approach then needs to be applied consistently to every MA in order for demonstration of adequacy to be satisfied

38. High Benefit (Risk Reduction) Low Should be implemented. Little analysis required unless rejected. More detailed justification required to reject High More detailed justification required to reject (lower priority) Simple justification to reject Sacrifice (cost, time, effort and inconvenience) Low AFAP – Cost/Benefit & Rejecting Controls

39. Effectiveness of Control Measures • There are controls and safeguards • A control is considered to be a device, system, or action that is capable of preventing a cause from proceeding to its undesired consequence, independent of the initiating event or the action of any other layer of protection associated with the scenario • A safeguard is any device, system or action that would likely interrupt the chain of events following an initiating event

40. Preventing the consequences when it functions as designed Applicable For the initiating event Effective Independent Of the components of any other control already claimed for the same scenario Reliable The reliability, effectiveness and independence of a control must be auditable Effectiveness of Control Measures To be considered a control, it must be:

41. Effectiveness of Control Measures • As an example, consider an employee action to read a level gauge and a pressure gauge - both taken off the same tapping point • Is a single tapping point for two different information streams applicable, independent and reliable? • Will the employee reliably report the correct information?

42. Effective Independent Reliable Applicable Effectiveness of Control Measures These have been built into a system - but are they: The answer - NO

43. Effectiveness of Control Measures • Every designer, Employer and manager desires to have controls that are: • Robust • Reliable • Can survive harsh environments • Not dependent upon rigorous inspection and testing regimes that involve manpower and cost • Unfortunately this is not reality

44. Effectiveness of Control Measures Controls do fail and accidents occur as a result Result of a fire at a bulk storage facility – was there adequate separation and fire protection?

45. Effectiveness of Control Measures • Impact on: • Environment • People • Business interruption • Cost of inventory • Reputation • Legal cost

46. Effectiveness of Control Measures A good management system

47. Effectiveness of Control Measures With adequate risk control measures

48. Effectiveness of Control Measures Reduces the risk of loss

49. Effectiveness of Control Measures • These controls are important to analyse in a structured manner so that their effectiveness can be assessed • For this to occur the Employer needs to know: • What type • How many • How reliable are the controls • Are there sufficient to reduce MA risk to AFAP? • Each control needs to be fit for purpose and designed into the system as independent

50. Control Types • In each evaluation the type of service being evaluated needs to be taken into consideration critically to ensure the control type is effective and will perform its intended duty • For example consider an instrumented level gauge with high level and high high level independent alarms for controlling the level in a process tower • The alarms are not tested and the high high level is known to be in fault mode • Is this control reliable, effective and applicable?