1. Major Hazard Facilities
Introduction to Safety Report

2. Some Abbreviations and Terms
AFAP - As far as practicable
BPCS – Basic process control system
Employer - Employer who has management control of the facility
FTA – Fault tree analysis
HAZOP – Hazard and operability study
HSR - Health and safety representative
LOPA – Layer of protection analysis
MHF - Major hazard facility – as defined in the regulations
MA - Major accident
OHS -Occupational health & safety
QRA – Quantitative Risk Assessment
SMS - Safety management system

3. Topics Covered in This Presentation
Introduction
Key principles and objectives of the MHF regulations
Why is a Safety Report needed?
What is the Safety Report?
What must the Safety Report do?
Main components of the Safety Report
Hazard identification
Safety assessment
Risk controls
Emergency response plans

4. Topics Covered in This Presentation
Demonstration (of adequacy)
What else is in the safety report?
MHF regulations versus process
Sources of additional information
Review and revise
Conclusion
Examples of major accidents

5. Introduction
This seminar is a basic introduction to the Safety Report that is required under the MHF Regulations.
It has been developed for the following purposes:
To provide a simple overview
To be suitable for new MHF Employers
Outline the reason for a safety report
Overview of all parts of a safety report
Show examples of major accidents

6. Key Principles of MHF Regulations
Focus on major hazards (catastrophic events i.e. typically high consequence and low frequency)
Requires a proactive risk based approach
Places the responsibility on the Employer
Employer has to actively demonstrate safe operation
Proactive risk based approach – in the past it has been prescriptive based.
Places responsibility on Employer

7. Key Principles of MHF Regulations
Consultation with different parties required at all critical stages
Facilitate culture change at major hazard facilities
Regulator ‘peer review’, tied to a licence
Addresses both on-site and off-site safety
Employer is expected to work closely with employees to actively seek to improve safety at the facility.

8. Focus of MHF Regulations
Increasing risk
Minor
risks
Very high risks
should already
be eliminated
after risk
assessment
Relative Frequency of Occurrence
OHS risks
already
regulated
Focus of MHF Regulations is
high consequence (catastrophic)
but low frequency incidents
Minor Risks – OHS
OHS risks already regulated – Insurance, Fire protection
Very high risks – high consequence, high frequency, failure likely
MHF Focus
Consequence Severity

9. Objective of the MHF Regulations
The objective of the MHF Regulations is to provide for the safe operation of major hazard facilities to:
Reduce the likelihood of an MA occurring
Reduce the consequences to health and safety and damage to property in the event of an MA occurring
Focus in both areas – prevention of the MA and also mitigating consequences should it occur.

10. MHF Regulations
Specific parts of the MHF Regulations relevant for this seminar are:
Hazard identification (9.43)
Risk assessment (9.44)
Risk control measures (9.45)
Safety management system (9.46)
Emergency planning (9.53)
Provision of information to the community (9.50)
These sections of the Regulations are covered in this presentation.

11. Why is a Safety Report Needed?
There is a need for specific control of major hazards due to:
Changing scale and complexity of specific facilities
Advances/changes in technology - unforeseen hazards
Changing community perceptions
Range of major accidents that have occurred
Prescriptive approach has proven inappropriate
These are some of the reasons why a safety report regime will be more effective than a prescriptive regulations approach.
Changing scale & complexity of facilities –
Old photo’s of industrial areas usually show no houses in vicinity. Now houses are on the boundary. Consequences can impact neighbouring facilities.
No distinction drawn between employees & neighbours.
Larger, more complex facilities mean more areas where things can go wrong.
Changing community perceptions –
Neighbour proximity has changed community expectations and perceptions about industry.

12. Why is a Safety Report Needed?
Some major accidents that have occurred
Coode Island, Australia – storage terminal fire, August 1991, 0 dead, 0 injured
Longford, Australia – explosion and fire, September 1998, 2 dead, led to the development of Victorian MHF legislation
Entschede, Holland – fireworks factory explosion, May 2000, 21 dead, 1,000 injured
Texas City, USA – fire and explosion, March 2005, 15 dead, over 170 injured
Very large consequences:
Coode Island - Community outrage even though no fatalities.
Longford – no gas for 10 days in Victoria

13. Why is a Safety Report Needed?
Port Kembla Ethanol Tank Fire, NSW, Australia, 28th January 2004
Points to failures in the management systems in place at the site.
Quote from the Coroner…“not a lack of adequate safety procedures but rather the failure to adhere to them”.
(Welding was carried out in an unsuitable area without a ‘hot work’ permit)

14. Why is a Safety Report Needed?
This has led to Regulations where:
The Employer knows what technical and human activities occur
The Employer decides on the appropriate means of major hazard control for the facility, and prepares a Safety Report explaining this
The Regulator assesses and audits performance adequacy against the safety report
The range of industries and complex technologies means that prescriptive style regulations (eg. specify controls) cannot work effectively. The regulations are based around general risk management processes.

15. Why is a Safety Report Needed?
The introduction of regulations were ‘fast tracked’ in Victoria primarily as a result of the Royal Commission into the incident at Longford in 1998.
The Victorian MHF regime is now mature and is working well.
Historical major accidents have often resulted in regulatory change.
The Longford accident is an example which triggered vast change to the major hazards regime in Victoria. The Victorian model is now mature and proving to be very successful.

16. What is the Safety Report?
The safety report must address all hazardous events that could result in MAs that pose serious danger or harm to:
Persons
The community
Property
The environment
Must consider on site and off site impacts
Harm to the environment
Property damage

17. What is the Safety Report?
A safety report is a detailed document that outlines:
The identification and control mechanisms in place to prevent and mitigate all MAs for the facility
The types of safety studies undertaken
The results obtained for such studies
The management arrangements in place
to ensure the continued safety of the facility and its people and the surrounding community.
The safety report must be prepared in consultation with employees and be a true reflection of the state of the safety arrangements for the facility.
Should contain all the information needed to show that the facility can be operated safely.
Focus on control measures that prevent or mitigate major accidents
Outline of the safety management systems at the site to ensure the control measures are properly managed.
Consultation is a key aspect of the MHF regulations.

18. What is the Safety Report?
The Role of the Safety Report
Regulatory role: The primary document used by an approved assessor to verify that the facility is operated safely to support the Employer’s licence application.
Information Repository: Contains all information about the safe operation of the facility which contributes to continuous improvement of safety at the facility.
The safety report will be the key document used by the assessor to determine compliance with the MHF regulations.

19. What Must the Safety Report Do?
Document the state of safety arrangements for the facility
Demonstrate to the satisfaction of the Commission, through content and supporting material, that:
The employer knows what technical and human activities occur
How activities are managed
How safety will be managed in the event of an emergency

20. What Must the Safety Report Do?
Identify methods to be used for monitoring and reviewing all activities for continual improvement of the safety arrangements of the facility over its lifetime.
Review
Monitor
Safer
Facility
Risk assessments done just to get approval for a new facility (“tick the box”) then ignored – often leads to failure.
If it becomes a living, breathing management document that is integrated with day-to-day management – usually leads to success.
Systems need to be in place to monitor and review how well the safety arrangements and controls are working and to implement improvements.
Improve

21. The Safety Report Should…
Reflect the facility safety culture
Contain information about the facility and interaction with its surroundings
Describe the systems used to achieve safety
Identify, assess and show controls for potential major accidents
Demonstrate ongoing consultation between the employer and workforce
Be integrated into the Employers management systems rather than a collection of separate individual safety studies
A safety report that imposes processes or methods that are not part of the regular approach used for safety management at the site will be difficult to maintain into the future.
‘Workforce’ includes contractors. Consultation needs to happen through Safety Report preparation, implementation and monitoring phases.
The safety report should be well integrated into the wider management systems of the facility rather than a stand-alone study.

22. Safety Report Timeline
Refer Guidance note for this information and further details.
Key Points:
Regulations in force on 15 Mar 2007
SRO required after 15 months (Jun 2008)
Safety report by 24 months (Mar 2009)
Refer Guidance Booklet 4 for this timeline

23. Main Components of a Safety Report
The main components of the safety report are:
Facility description
Risk assessment
Hazard and MA identification
Risk control measures
Safety management system description
Emergency response plan
Demonstration of adequacy
Control measures
Safety Management System
These topics will be covered in more detail over the next few slides
Aspects of demonstration:
Safety controls – are there enough, can they be proved to be working.
Safety management system – auditing to show that it is working effectively.

24. Facility Description History Daily operations
Schedule 9 materials and their characteristics
Demographic description
Facility topography & meteorological data
Simplified process flow diagrams
Site layout drawings
Location plans, surrounding facilities and sensitive neighbours
Proposed changes
This is typical content for the Facility description.

25. Risk Assessment Requirements
Hazard identification – for determining MAs
Risk assessment studies – for determining controls
Risk evaluation - for determining risk acceptability
Recommendations and review – for continuous improvement
Aspects of the risk assessment process are shown.
First identify hazards and then which hazards may lead to potential major incidents
Risk assessments for potential MAs – determine the control measures that need to be managed and maintained to control the risk of the MA
Evaluate the risk vs risk tolerance criteria – can the risk with controls in place be accepted? Standard off site risk tolerance criteria are available. Tolerance criteria for on site risk need to be developed company by company – more on this follows.
Improvements will flow for the risk assessment to improve the effectiveness of existing controls or implement new controls to further reduce the risk.

26. Hazard and MA Identification
Hazards that can lead to major accidents are identified. From these, MA scenarios can be developed for further analysis.
Process Hazard Studies
(HAZOP/What If)
Past Risk Assessments
Unit Technical Review Input
(Specialist Review)
Incident History (internal / external)
Dangerous Goods Present and Material Properties
Major Accident Event
Grouping
These are just examples of the data sources for hazard identification. In most cases, hazard identification workshops will be needed to ensure the appropriate range of depth of experience is available.
HAZID will be covered in detail in a later session.

27. Outcomes Causes Risk Assessment Hazards Controls Preventative Controls
The information for assessment can be presented as a bow-tie diagram
Hazards
Controls
Preventative Controls
Mitigative Controls MA
Causes
Outcomes
Consequences
This is a bowtie diagram which is a very useful tool to visually link controls to hazards.
It is useful for training and communication.
Helps show adequacy of controls (ie..all hazards have more than one control, different types etc)

28. Example: Layer of Protection Analysis
Risk Assessment
Example: Layer of Protection Analysis
Analysing the safety measures and controls that are between an uncontrolled event and the worst potential consequence - risk reduction study
Documented risk assessment technique (Centre for Chemical Process Safety – USA)
This method requires a selection of controls from the different layers of the ‘onion’.
Requires more than one control. Requires different types of controls (engineering, administrative)
Most suited to process industries.

29. Risk Assessment Example Risk Matrix
For higher consequence events, the event likelihood must be driven lower (by having sufficient number of effective controls) for the risk to be at an acceptable level.
These are defined by the company. The likelihood shown is just an example.

30. Description of the Safety Management System
A comprehensive and integrated management system for all aspects of control measures adopted
Documented and describes how compliance is to be achieved
Site safety philosophy and how it is reflected in the SMS
Safety policy and safety objectives
Organisation and personnel responsible for the implementation and compliance with the SMS
Major features/elements of the SMS
SMS performance monitoring processes
Consultative processes used to develop and implement the SMS
The description of the SMS is required for the safety report.
These are some of the topics that would be expected to be covered in the SMS summary.
More information will be provided in the SMS seminar later today.

31. OH&S Management System Model – AS 4801
Overall vision, goals and commitment to improve
Suitable, adequate, effective
Changes needed?
Opportunities to improve?
Legal compliance
Objectives and targets
Implementation plans
In many cases, an SMS framework will already exist
If developing an SMS from scratch or looking to restructure an existing SMS, existing SMS models are a good starting point.
A commonly used ‘standard’ on which to base a safety management system is the AS 4801 model.
Major elements of the model are shown. The process is broken into the commonly referred to steps in the management cycle
PLAN – DO - CHECK - ACT
Resources
Leadership responsibility
Training and competency
Consultation and communication
Documentation
Hazard identification, risk assessment and controls
Emergency response
Monitoring and measurement
Incident investigation
Records management
Audits

32. Emergency Response Plans
Promote preparation
Ensure necessary equipment is available
Ensure personnel are trained and prepared to respond
Identify communication methods
Identify community resources
Consultation with emergency services, local council & community
Emergency response plans are control measures and need to be evaluated accordingly.
The key aspects of the emergency response plan are listed.
More information will be provided in a later seminar.

33. Emergency Incident Scenario Plans
Analysis of the consequences of specific MA’s to determine fire fighting access and to identify affected areas
Determination of firewater and foam requirements for extinguishing the fire and/or protecting affected equipment
Available as a resource for training
These are specific plans/procedures for an individual MA.
Provides additional information specific to the MA such as fire hydrant locations, heat contours (for fire fighting), evacuation routes etc.
These are tested in emergency exercises and valuable for training.

34. Demonstration of Adequacy
The safety report must demonstrate that the Employer is achieving safe operation of the facility by :
Use of adequate control measures
Satisfactory management systems
Each of these is dealt with.
The SMS must ensure the control measures are being adequately managed and also ensure the SMS itself is working effectively (i.e.. through auditing programs)

35. Demonstration of Adequacy of Control Measures
Controls linked to hazards and proportionate to risk
Depth and breadth of control measures
Performance indicators defined and performance monitored
Risk has been reduced AFAP
Standards, industry practices
Decisions are documented and justifiable
Improvement programs – past and future
Controls are:
Appropriate to the hazard
Sufficient number
A range of different types
Effective at preventing or mitigating the hazard
Monitored, maintained and improved
More information is available in the Comcare guidance Booklet 3 (control measures).

36. Demonstration of Adequacy of SMS
Comprehensive and Integrated
Performance standards for the control measures are defined
Control measures are monitored and failures are addressed
Adequate education and training is provided for employees
Processes are provided for review and revision of control measures
Sufficient resources are provided, responsibilities, accountabilities defined
Planning, implementation and monitoring processes are provided for control measures and the system as a whole
More information is available in Booklet 3 (SMS)
Does the SMS adequately manage the control measures such that it can be demonstrated that they are properly identified, implemented, effective and improved.
Does the SMS ensure that the SMS itself is working effectively through defining audit programs and continuous improvement.
These are a few of the important check points to ensure that the SMS is working effectively.

37. What Else is in a Safety Report?
Detailed Risk Assessment Records
Risk analysis of the hazards on site. E.g.
LOPA
FTA
Risk matrix
QRA
Provides a more detailed analysis of causes/frequency/consequences/controls for each identified MA
Assessment of off-site risk
Comparison of risk reduction options
Often provided a Appendices in the safety report. A summary of the risk assessment may be provided.

38. What Else is in a Safety Report?
Occupied Buildings Risk Assessment
Analysis of the impact of MAs on occupied buildings
Mainly risks (due to flame impingement, explosions, toxic gas) from other buildings/operations
Important where buildings are subject to MA impact because of the likelihood of high exposure of people.
Appropriate building design is an important factor.
Likely to be an important analysis for explosions.

39. What Else is in a Safety Report?
Risk Assessment Procedures
Details of all the hazard and risk assessment work documented in procedures and referenced
Procedures provide step by step guidance on how the assessments were undertaken – enables corporate memory retention
Consistency of approach for all assessments
Justification for selection of risk assessment processes
Resources/guidance for the conduct of future assessments
Risk assessment procedures are usually defined in an element of the SMS to ensure a consistent approach both during the safety report development and then into the future.

40. What Else is in a Safety Report?
Community Consultation
Community consultation philosophy
Summary of Safety Report information for community
Community bulletins
Community has to be made aware of what they are exposed to.
EPA requires consultation with community.

41. What Else is in a Safety Report?
Recommendations and Improvements
Identification of opportunities to reduce risk via risk assessments
Recommendations are assessed and prioritised
Recommendations from risk assessments
Cost/benefit analysis may help to prioritise
Feed into facility overall improvement plan => integration.

42. MHF Regulation vs. Suggested Process
Reg No.
Regulation
Process
9.43
Identify, in consultation with employees, all:
Hazards that could cause or contribute to causing a potential Major Accident
Potential Major Accidents
Hazard identification workshop using What If / HAZOP, checklists or other suitable methods
9.44
The Employer, in consultation with employees, must ensure that any risks associated with the hazards or potential major accidents are assessed
Risk assessment workshop using structured risk assessment process (for example fault tree analysis or LOPA)
No definitive view on what process should be used. The Employer decides.

43. MHF Regulation vs. Suggested Process
Reg No.
Regulation
Process
9.45
The Employer, in consultation with employees, must adopt control measures that eliminate or reduce as far as practicable the risk to health and safety. This relates to both the likelihood of the potential Major Accident and the severity of the consequences.
Risk assessment workshop using suitable risk assessment process and risk register.
Workshops are an excellent tool to demonstrate involvement of employees and HSRs

44. Review & Revision
Employers must review (and revise) the safety report for an MHF to ensure risks remain reduced AFAP:
Prior to modification
When new information becomes available regarding possible MA hazards previously unknown
Upon licence renewal conditions or at least every 5 years
At the direction of the Commission
After a major accident

45. Conclusion
The safety report must demonstrate adequacy of all Safety Duties required by the MHF regulations
Safety Duties are ongoing requirements
An Employer at a MHF who fails to comply with the MHF regulations may be subject to civil proceedings or criminal prosecution under the OHS Act.
Employers may go to jail.

46. Sources of Additional Information
Part 9 of the Occupational Health and Safety (Safety Standards) Regulations 1994
Major Hazard Facility Guidance Material – Comcare website
WorkSafe Victoria
NSW Major Industry Hazard Advisory Papers 1 to 9
Centre for Chemical Process Safety
UK Health and Safety Executive,

47. Questions?

48. Publicly Available Data/Incidents
Several examples of incidents are available. These include:
Tosco Avon refinery fire incident, Martinez California, 23rd February 1999 (source: U.S. Chemical Safety and Hazard Investigation Board, Report No CA, issue date March 200)
Buncefield fire, December 2005 (source: UK HSE)
Dubai Dry Dock Incident (source: Web site, US Naval Sea Systems Command)

49. Buncefield Incident (UK) – December 2005.
In the early hours of Sunday 11 December 2005, a number of explosions occurred at Buncefield Oil Storage Depot, Hemel Hempstead, Hertfordshire
At least one of the initial explosions was of massive proportions and there was a large fire, which engulfed a high proportion of the site
Over 40 people were injured; fortunately there were no fatalities

50. Buncefield Incident Off-Site Consequences
“Significant damage” to commercial and residential neighbours
2000 people evacuated
Sections of M1 Motorway closed
Very large smoke plume over Southern England → Air pollution
Large quantities of foam and water → contaminated water courses and ground water

51. Buncefield Incident
HSE/EA investigation determined the direct cause (initiating event) as follows:
“Tank 912 ……. overflowed at around hours …….. while being filled at a high rate”
Large vapour cloud formed and flowed off-site
First explosion at hours
There were multiple root causes (failures) identified
Many related to management system failures
Still some unanswered questions
Why was there so much explosive force?

52. Buncefield Fuel Storage – before incident

53. Buncefield – during the incident

54. Buncefield – after the incident
We’ll follow the Buncefield incident in later seminars.

55. Dubai Dry Dock Incident
On 27 March, 2002 in Dubai there was a breach and failure in one of the dock gates that caused uncontrolled flooding in the dry dock.
Several vessels were set on blocks inside the dry dock at the time of the failure. The vessels included the large vessel "Key Burmuda," a cargo barge and the accommodation barge "SEP 350“.

56. Dubai Dry Dock Incident
The dry dock gates failed at during a working day.
The dock is 500 metres long by 100 metres wide and 11 metres deep.

57. Dubai Dry Dock Incident
Everything looks normal!!

58. Dubai Dry Dock Incident
Moments after the first breach at 09:30 on

59. Dubai Dry Dock Incident
Larger vessels coming off the blocks

60. Dubai Dry Dock Incident
Cargo barge getting ready to roll. Many trapped inside, a few on deck getting ready to jump

61. Dubai Dry Dock Incident
“KEY BERMUDA” coming off blocks. “INDRA-1”
swinging towards rig

62. Dubai Dry Dock Incident
Accommodation barge “SEP 350” sinking

63. Dubai Dry Dock Incident
“SEP 350” touching bottom

64. Dubai Dry Dock Incident
The aftermath. Official reports account for 26
persons killed.