EVALUATING THE SITE SAFETY REPORT Part 1 Ike van der Putte ike.van.der.putte@rps.nl

1. This project is funded by the European Union Projekat finansira Evropska Unija EVALUATING THE SITE SAFETY REPORT Part 1Ike van der Putteike.van.der.putte@rps.nl Project implemented by Human Dynamics Consortium Projekatrealizuje Human Dynamics Konzorcijum

2. Overview • Completeness, correctness and credibility check SR • Purpose and definitions in SR • Essential Elements of a SR

3. Complete, Correct andCredible. • Under “complete” questions for evaluation will verify the presence of the required, essential information that a safety report should contain; and • Under “correct” and “credible” will go questions that would be used to verify the ones in complete (to cross-check them).

4. • For every “no” checked, the Safety Report would not be acceptable, and should be immediately returned to operator for additional work; • For every “limited” checked, the Safety Report would still be acceptable, but will need further clarification It should be noted that some of the “complete” and “correct” questions might need to be verified during on-site inspection.

5. In Evaluating and assessment of Safety Reports by the authorities keep the purpose of a SR in mind !

6. Purpose of a Safety Report • WHY? Safety reports are intended to demonstrate that: • a major accident prevention policy (MAPP) and a safety management • system (SMS) have been put into effect; • major-accident hazards are identified and necessary measures have been • taken to prevent such accidents and to limit their consequences for man • and the environment; • adequate safety & reliability have been incorporated into the design, • construction, operation and maintenance of any installation; • internal emergency plans have been drawn up, supplying information to • enable the external emergency plan to be drawn up; • information for land-use planning decisions has been given.

7. HOW?:The safety report must include the following minimum data and Information that are specified in more detail in Annex II of the SevesoII Directive: • Information on the MAPP and on the SMS • Presentation of the environment of the establishment • Description of the installation(s) • Hazard identification, risk analysis and prevention methods • Measures of protection and intervention to limit the consequences of an accident

8. WHO?: The safety report must be submitted to the competent authority by the operator. It is up to the operator and within its responsibility to decide on the sufficiency of competence of the people and organisations involved in the preparation of the safety report. Relevant organisations entrusted with such tasks must be named in the safety report.

9. WHEN? The safety report must be submitted: • - in case of a new establishment a reasonable period of time prior to the start of • construction or operation; and • without delay after a periodic or necessary review. • The safety report must be reviewed and, if necessary, updated: • - in a regular period, which is laid down in the respective regulations (min. 5 year) or • - at the initiative of the Operator or at the request of the Competent Authority, where • justified by new facts, new technical knowledge about safety or about hazard • assessment, or • - in case of a modification of a site, this means modification of the establishment, the • installation, the storage facility, the (chemical) process, the nature of dangerous • substance(s) or the quantity of dangerous substance(s). The decision whether these • modifications would have an impact on safety and, therefore, would require a review • of the safety report should be taken by using a systematic analysis such as for • instance a screening method or a rapid ranking tool

10. SR Definitions • The safety report should demonstrate that necessary measures to prevent, controland limit the consequences of a possible major accident have been put in place and are fit for purpose.

11. The safety report should demonstrate that necessary measures to prevent, control and limit the consequences of a possible major accident have been put in place and are fit for purpose. A. “Demonstrate” For this specific purpose, “demonstrate” is intended in its meaning of: “justify” or “argue the case” but not “provide an absolute proof” The Competent Authoritieswilltake the information and conclusions in the report largely as presented, using professional judgement more generally to assess the credibility and logic of the conclusions reached in the report. An extensive in-depth scrutiny or exhaustive examination is not envisaged in most cases.

12. The safety report should demonstrate that necessary measures to prevent, control and limit the consequences of a possible major accident have been put in place and are fit for purpose. • The operator shall expect professional judgment from the assessor of a safety report and should base its demonstration on this assumption. • The demonstration must be “convincing”. This means that the rationale for deciding the completeness of hazard identification and the adequacy of the measures employed should be supported and accompanied by all assumptions made and conclusions drawn. • The demonstration should provide evidence that the process was systematic which means that it followed a fixed and pre-established scope. • The extent to which the demonstration is performed should be proportional to the associated risk.

13. The safety report should demonstratethat necessary measures to prevent, control and limit the consequences of a possible major accident have been put in place and are fit for purpose. B. “NecessaryMeasures” “Necessary measures” shall be taken in order to prevent, control and limit the consequences of a possible major-accident. • The efficiency and effectiveness of the measures should be proportionate to the risk reduction target (i.e. higher risks require higher risk reduction and, in turn, more stringent measures). • The current state of technical knowledge should be followed. Validated innovative technology might also be used. Relevant national safety requirements must berespected. • There should be a clear link between the adopted measures and the accident scenarios for which they are designed). • Inherent safety should be considered first, when feasible (i.e. hazards should always be removed or reduced at source).

14. The safety report should demonstratethat necessary measures to prevent, control and limit the consequences of a possible major accident have been put in place and are fit for purpose. C. “Prevent, Control and Limit” • Prevent: to reduce the likelihood of occurrence of the reference scenario (example: automated system to prevent overfilling; sometimes “avoid measures” are regarded to be a separate category as they refer to the total avoidance of a scenario, e.g. in case of the burying of a vessel) • Control: to reduce the extent of the dangerous phenomenon (example: gas detection that reduces intervention time and may prevent major release); • Limit: to reduce the extent of the consequences of a major accident (e.g. through emergency response arrangements, bunding or firewalls).

15. The safety report should demonstratethat necessary measures to prevent, control and limit the consequences of a possible major accident have been put in place and are fit for purpose. D. “Major Accidents” To qualify an accident as “major accident”, three criteria must be fulfilled: • the accident must be initiated by an “uncontrolled development”; • “one or more dangerous substances” listed in Annex I of the Directive must beinvolved; • the accident must lead to “serious danger” to human health, the environment, or the property. “seriousdanger”: • potential life-threatening consequences to one human (on-site or off-site); • potential health-threatening consequences and social disturbance involving a number of humans; • potential harmful consequences to the environment at a certain (larger) extent; • potential severe damage to property (on-site or off-site).

16. Essential Elements of a Safety Report

17. ESSENTIAL ELEMENTS OF A SAFETY REPORT Note: Structure is according to ANNEX II SEVESO II; In practice structure of Safety reports is not followed exactly

18. I. MAPP and SMS Major Accident Prevention Policy (MAPP), is a “self-commitment” by the operator of a Seveso type establishment to meet the requirements of Article 5. (operator obligations) A safety management system (SMS) is instead a set of activities that ensures that hazards are effectively identified, understood and minimised to a tolerable level. In this sense, it may be regarded as the transposition of the general goals identified in the MAPP into specific objectives and procedures.

19. MAPP and SMS should address the following issues: 1. organisationandpersonnel 2. identification and evaluation of major-accident hazards 3. operational control 4. management of change 5. planning foremergencies 6. monitoring performance 7. audit and review

20. In practice a SMS consists of a compilation of written principles, plans, formal organisationcharts, responsibilitydescriptions, proceduralrecommendations, instructions, data sets, etc. This does not mean that all of these documents do not have to be available in case of inspections but with respect to the safety report, most of them have the character of “underlying documents”. For the purpose of a safety report, the description of the SMS is of a summarising character and should address all the above seven subsets.

21. The MAPP is embedded in the overall management system of the company and sets the general goals for the SMS, the latter serving as basis for the risk/hazard analysis (as far as it concerns major accident hazards).

22. ESSENTIAL ELEMENTS OF A SAFETY REPORT Note: Structure is according to ANNEX II SEVESO II; In practice structure of Safety reports is not followed exactly

23. II. Presentation of the Environment of theEstablishment A. description of the site and its environment including the geographical location, meteorological, geological, hydrographical conditions and, if necessary, itshistory; B. identification of installations and other activities of the establishment which could present a major accident hazard; C. description of areas where a major accident may occur.

24. IIA.Description of the site and its environment (1) The safety report should contain an adequate description of the establishment to enable the authorities to have a clear picture of its purpose, location, activities, hazards, services and technical equipment An introductory section should contain general information on the establishment, i.e.: • purpose of the establishment; • mainactivitiesandproduction; • history and development of the activities, including the status of authorisations for operations already agreed and/or granted, when applicable; • the number of persons working at the establishments (i.e. internal and contractors’ personnel, specifying working times, possibility of visitors, etc.); • general statements characterising the establishment with respect to its main hazards as regards relevant substancesandprocesses.

25. IIA. Description of the site and its environment (2) Location The description of the location of the establishment should contain data on topography and accessibility to the site at a sufficient degree of detail ( in line with the extent of the hazards and the vulnerability of the surroundings). The description of the natural environment and the surroundings should demonstrate that the natural environment and surrounding activities have been sufficiently analyzed by the operator to identify both the hazards that they pose to safe operation and the vulnerability of the area to the impact of major accidents.

26. IIA.Description of the site and its environment (3) Location/topography The topographic maps submitted should be of an adequate scale and should include the establishment as well as all development in the surrounding area within the impact range of the accidents identified. On such maps the land-use pattern (i.e. industry, agriculture, urban settlements, environmentally sensitive locations, etc.), the location of the most important buildings, infrastructure elements (i.e. hospitals, schools, other industrial sites, motorway and railway networks, stations and marshalling yards, airports, harbours, etc.) and access routes to and from the establishment must beindicated. The land-use pattern of the area surrounding the establishment may be presented according to the specification of the official land-use plan of the greater area.

27. IIA. Description of the site and its environment (4) Location/natural environment As the natural environment of an establishment may present potential hazard sources and may influence the development and consequences of an accident, data will be needed for the description of these relevant environmental factors. In general, this type of data includes: meteorological data (wind, thunderstorms, precipitation, stability classes, temperature) geological, hydrological and hydrographical site data (flooding likelyhood, seismic data etc. other site specific natural factors (water quality, sensitive ecosystems, protected natural areas

28. IIA. Description of the site and its environment (5) Location/layout of the establishment The lay-out should adequately identify installations and other activities of the establishment including: • main storage facilities; • processinstallations; • location of relevant substances and their quantities; • relevant equipment (including vessels and pipes); • spacing of the installations and their main sections; • utilities, services and internal infrastructure equipment • location of key abatement systems; • location of occupied buildings (with an indication of the numbers of persons likelytobe present); • other units if relevant for the safety report conclusions

29. IIB.Identification of installations and other activities of the establishment which could present a major accident hazard The installations of an establishment to be submitted to risk analysis have to be possibly selected through a screening method. The selection may follow the use of index methods or threshold criteria for hazardous substances or other suitablemethods. The result of this screening process should be indicated in a separate form in the safety report, e.g. a list of the installations and activities of concern or a specific indication in the respective maps.

30. Additional element SEVESO III, Annex II Safety Report (c) on the basis of available information, identification of neighbouring establishments, as well as sites that fall outside the scope of this Directive, areas and developments that could be the source of, or increase the risk or consequences of a major accident and of domino effects; IIC. Description of areas where a major accident may occur Issue is linked with II/A and IV/B and may be demonstrated together

31. Summary: Contents of Safety Report - Description of establishment and its environment • Presentation of the Environment of Establishment (location, meteo data, hydrographical, vulnerable receptors etc : EIA) • Identification of Units of the establishment which could present a major accident hazard (Safety Critical Units) • Description of the Units (layout, activities, products, safety critical processes, source terms of major-accidents, LOC) • Outline of safety procedures in all stages, safety relevant systems and components, fire fighting • Dangerous substances ( Inventory of equipment, substance characteristics: SDS / CLP ) References to : EIA, Emergency Plans, regional LUPlans Maps with Land Uses in the environment (the greater area that can be affected by the major accident consequences ) __________________________________________________________________________________ Ref. G. PAPADAKIS - SEVESO SERBIA 24th June 2013

32. ESSENTIAL ELEMENTS OF A SAFETY REPORT Note: Structure is according to ANNEX II SEVESO II; In practice structure of Safety reports is not followed exactly

33. III. Description of the InstallationS“screened out” A. description of the main activities and products of the parts of the establishment which are important from the point of view of safety and sources of major-accident risks and conditions under which such a major accident could happen, together with a description of proposed preventive measures; B. description of processes, in particular the operating methods; C. description of dangeroussubstances

34. IIIA/B. Hazardous installations and activities and processes Sufficient information should be provided in the safety report to permit the competent authority to assess the adequacy of the controls in place or foreseen in the hazardous installations identified through the screening process. Reference can be made to other, more detailed documents available to the authority on request and/or on-site (the “underlying documents” already mentioned in the section about the SMS).

35. IIIA/B. Hazardous installations and activities and processes(2) Description: The description of hazardous activities (processes/storage) and equipment parts shall indicate the purpose and the basic features of the related operations within the establishment which are important to safety and may be sources of major risks. This should cover: a) basic operations; b) chemical reactions, physical and biological conversions and transformations; c) on-site interim storage; d) other storage related activities i.e. loading-unloading, transport including pipe work, etc.; e) discharge, retention, re-use and recycling or disposal of residues and wastes including discharge and treatment of waste gases; f) other process stages, especially treatment and processing operations.

36. IIIC. Dangerous Substances The safety report should give information on types and quantities of dangerous substances to which the Directive applies at the establishment. The substances can fall into any of the following categories: • rawmaterials; • intermediateproducts; • finishedproducts; • by-products, wastes and auxiliary products; • products formed as a result of loss of control of chemical processes.

37. IIIC. Dangerous Substances (2) • For the eligible dangerous substances, data to be provided should include: • type and origin of the substance (i.e. CAS Number, IUPAC Name • b) physical and chemical properties (i.e. characteristic temperatures and • pressures, • c) toxicological, flammability and explosive characteristics (i.e. toxicity, • persistence, irritant effects, • d) substance characteristics under loss of control of process or storage • conditions(e.g. information on possibletransformationinto new substanceswith other properties of toxicity, degradability, etc.) • e) others (e.g. corrosion characteristics in particular relating to the • containmentmaterial, etc.); • the latter two only when relevant for the safety report conclusions or • specificallyaddressedthere.

38. ESSENTIAL ELEMENTS OF A SAFETY REPORT Note: Structure is according to ANNEX II SEVESO II; In practice structure of Safety reports is not followed exactly

39. IV. Identification and Accidental Risks Analysisand Prevention Methods A. detailed description of the possible major-accident scenarios and their probability or the conditions under which they occur, including a summary of the events that may play a role in triggering each of these scenarios, the causes being internal or external to the installation; B. assessment of the extent and severity of the consequences of identified major accidents, including maps, images or, as appropriate, equivalent descriptions, showing areas that are liable to be affected by those accidents, subject to the provisions of Articles 13(4) and 20; C. description of technical parameters and equipment used for the safety of installations.

40. Risk assessment Risk analysis is teamwork Ideally risk analysis should be done by bringing together experts with different backgrounds: • chemicals • human error • process equipment Risk assessment is a continuous process!

41. System definition Hazard identification Analysis of accident scenarios Estimation of accident frequencies Consequence analysis and modelling Risk estimation Risk Assessment • Scheme for qualitative and quantitative assessments • At all steps, risk reducing measures need to be considered

42. Risk Analysis Hazard Identification • ”What if” • Checklists • HAZOP • Task analysis • Index (Dow, Mond) Hazard & Scenario Analysis Likelihood Consequences Risk Risk Analysis – Main Steps

43. HAZARD ANALYSIS: Hazard Level and Source Term • Selection of safety critical equipment / Units and identification of Source term : the possible amount of release estimated under realistic conditions (e.g. operat. pressure, release rates, release duration, area where the fuel can be accumulated , etc) • The F& E Index (DOW Index), • The (Sub)Selection Method of Major Accident Scenarios for QRA (Purple Book/TNO) based on the distance of critical equipment from vulnerable receptors, • Rapid ranking methods based on hazard indices and frequencies of past accident • The IAEA classification method for chemical hazards • HAZID method i.e. checklists, What-if, systematic methods as HAZOP, etc. __________________________________________________________________________________ G. PAPADAKIS - SEVESO SERBIA 24th June 2013

44. Risk Analysis Hazard Identification Hazard & Scenario Analysis • Fault tree analysis • Event tree analysis • Bowties • Barrier diagrams • Reliability data • Human reliability • Consequence models Likelihood Consequences Risk Risk Analysis – Main Steps

45. Initiating events Major Events Critical Event IE ME IE And AE IE ME IE AE OR IE IE AE OR IE CE OR IE ME IE AE And ME IE IE AE OR IE ME IE AE OR IE ME Event Tree Preventive Barriers Mitigative Barriers FaultTree Bow-tie SCENARIO

46. Risk Analysis Hazard Identification Identify Safety Barriers Hazard & Scenario Analysis Likelihood Consequences Risk Risk Analysis – Main Steps

47. Based on historical data and Guidelines for Process Equipment Reliability Data, Centre for Chemical Process Safety (CCPS) of the AIChE, 1989. Ref. RPS/BKH/PM report REAP 2002

48. The main elements in any risk analysis process are as follows: • hazard identification; • accident scenario selection; • scenarios’ likelihood assessment; • scenarios’ consequence assessment; • risk ranking; • reliability and availability of safety systems With regard to the hazard identification, a range of tools exists for systematic assessments, which are selected depending on the complexity of the individual case. The identification of hazards is followed by designation of reference accident scenarios which form the basis for determining whether the safety measures in place or foreseen are appropriate.

49. For the scenarios’ likelihood and consequence assessment, which are essential steps in the risk analysis process, quite different approaches can be followed. These assessments make use of methodologies that are generally subdivided into different categories, in particular: • qualitative - (semi)quantitativeand • deterministic - probabilistic.

50. Qualitative/ (semi)Quantitative: The likelihood of occurrence and the consequences of a major accident scenario could be assessed either: • in qualitative terms using ranges , for example highly likely to extremely unlikely for likelihood, and very severe to negligible for consequences or • in (semi) quantitative terms by providing numerical figures (e.g. occurrence per year, number of fatalities per year). In general, the choice of either a qualitative or quantitative approach is strongly influenced by the specific safety culture philosophy within each individual Member State.