1. —InWEnt | Qualified to shape the future Christian Jochum (chr.jochum@t-online.de) InWEnt Senior Advisor (www.inwent.org) Director of Centre, European Process Safety Centre (www.epsc.org) Chairman, German Commission on Process Safety (www.kas-bmu.de) India, September 2010 Accident Models and Lessons Learnt from World Big Disasters 1

2. —InWEnt | Qualified to shape the future Professional Profile Christian Jochum –Born 1943 in Frankfurt a.M./Germany –PhD in Chemistry, certified Safety Engineer –Honorary Professor at Frankfurt University –28 years experience in large chemical/pharmaceutical company (Hoechst AG) 1969 – 1979 Pharmaceutical research and pilot plant operations 1979 – 1997 Safety department (Site and Corporate Safety Director and „Major Accident Officer“ since 1987) –EHS – and crisis management consulting for different types of businesses and administration since 1997 –Commission on Process Safety (formerly Major Hazard Commission) at the German Federal Minister for the Environment (Chairman since 1998) –European Process Safety Centre (Rugby/UK): Director of Centre since 2007 –InWEnt Senior Advisor since 2009 2

3. —InWEnt | Qualified to shape the future EPSC (European Process Safety Centre) Industry funded association of major chemical companies in Europe. Approx. 40 contributing enterprises Dedicated to sharing and improving best practice in Chemical Process Safety Study groups on –Safety Critical Systems (inc. IEC 61511) –Buncefield type facilities overfill protection –Layer of Protection Analysis (LOPA) –Auditing –Process Safety Incident and KPI reporting –ATEX –Senior Management Commitment Work in conjunction with European Commission on implementation and upgrading Seveso 2 Directive Partnerships with CEFIC (European Chemical Industry Council) and U.S. Center for Chemical Process Safety (CCPS) www.epsc.org 3

4. —InWEnt | Qualified to shape the future Mandated by the Federal Emission Control Act –Advises government as well as plant operators and state and local authorities on process safety –32 members with different professional and educational background representing different stakeholders (“Round Table”) –Any group needs “allies” to win votes –Consensus intended, but majority decisions possible About 55 guidelines issued on different topics, e.g. –Land Use Planning (Safety distances) –Risk evaluation and perception –Emergency Planning –Industrial parks –Provisions against terrorist attacks on chemical plants All publications of the Commission are available (partly in English) at www.kas-bmu.de Commission on Process Safety (Kommission fuer Anlagensicherheit [KAS]) 4

5. —InWEnt | Qualified to shape the future 1 1 Learning from Incidents in the EU: Seveso Guideline 2 2 Case Studies Content 3 3 Conclusion 5

6. —InWEnt | Qualified to shape the future 6 Industrial Disasters are seldom, but drive legislation Process Safety incidents typically are „low probability - high consequence“ events which … are difficult to evaluate statistically (“stochastic events”)  Process Safety Indicators (PSI) necessary with broader scope tend to get less attention by management (risk approach)  EPSC video “Process Safety Pays” tend to get high attention by other stakeholders (hazard approach)  strict regulations may jeopardise the existence of companies  Learning from incidents has top priority

7. —InWEnt | Qualified to shape the future ©Major Accident Hazards Bureau - SEVESEO Workshop 1st December 2009, Antwerp The Evolution of the Seveso Directive (1) —Seveso (I) —July 1976 —Flixboroug h (UK) —June 1974 —Beek (NL) —November 1975 —Directive 82/501/EEC —(Seveso I) —Directive 96/82/EC —(Seveso II) —Bhopal (India) —December 1984 —Mexico City (MEX) —November 1984 —Basel (CH) —November 1986 7

8. —InWEnt | Qualified to shape the future The Evolution of the Seveso Directive (2) —Enschede (NL) —May 2000 —Toulouse (F) —September 2001 —Texas City (USA) —March 2005 —?—? —Amended Directive “Seveso II” —(2003/105/EC) —Baia Mare (RO) —January 2000 —Buncefield (UK) —December 2005 —Jaipur (India) —October 2009 —Viareggio (Italy) —June 2009 8

9. —InWEnt | Qualified to shape the future Aim of the Seveso II Directive To ensure throughout the European Union a common high level of safety and protection against chemical accidents for the people and the environment. How? By preventing major accidents that involve dangerous substances; By mitigating the consequences of accidents on man and environment. 9

10. —InWEnt | Qualified to shape the future Scope of the Seveso II. Directive Mainly chemical and petrochemical industry, storage, logistical centre, big industrial production and energy installations; Criteria: Hazard-based: Quantity of dangerous substances present; Requirements proportionate to the risk: two tier approach, has to be implemented by Member States; ~ 10,000 establishments, 45 % upper tier; Goal-setting directive, contains no detailed procedures or guidelines for risk assessment and management. 10

11. —11 — Plateau’d since 2004 ! 11

12. Learning from Incidents is mandated by Seveso II Traditional approach (at least in “old Europe”): lessons learnt as trigger and basis for detailed regulations (“written with blood”) EU “New Approach” since about 1990 put focus on operator risk assessment Regulations now define protection targets, but not the way how to reach them –Tailor-made solutions possible –Easy adoption to and consideration of new developments –Risk assessment core duty of operator –Requires more expertise at operator and authority than detailed regulations In addition Seveso II requires constant monitoring of learning experiences: –Article 9 (5): The safety report shall be periodically reviewed and where necessary updated … to take account of new technical knowledge about safety matters, for example arising from analysis of accidents or, as far as possible, “near misses” … 12

13. —InWEnt | Qualified to shape the future “Swiss Cheese”/Layer of Protection Models are accident models, too —Lagging Indicator —Leading Indicator “Swiss Cheese Model” (after J. Reason, modified by Mike Broadribb, BP) 13

14. —InWEnt | Qualified to shape the future Accidents are no “act of god” Accidents are failures of one or more defences (protection layers) Accidents therefore can be completely avoided in principle (“zero accident goal”) Although in reality this goal may not completely reached, it should be the target (otherwise: how many fatalities do you accept??) Root Cause Analysis identifies failures on all layers of protection This allows comprehensive learning and corrective measures, leading to optimal prevention of iDRM 14

15. —InWEnt | Qualified to shape the future iDRM: Use existing knowledge Most accidents and eco – incidents have a previous history –Preliminary events leading up to the accidents (failure of protection layers) have not been identified –Prior to most major accidents similar smaller incidents or near misses have happened, but not evaluated... which should be used for prevention –Raise the awareness of the workers –Use the experience of workers Encourage reporting of deviations, near misses and even minor incidents as well as suggestions for improvements. Consider contests and awards for groups working together Have a system for following up such reports/suggestions 15

16. —InWEnt | Qualified to shape the future 1 1 Learning from Incidents in the EU: Seveso Guideline 2 2 Case Studies Content 3 3 Conclusion 16

17. —InWEnt | Qualified to shape the future Case Study: Hoechst/Germany 1993 In 1993 three major incidents occurred at 2 Hoechst sites near Frankfurt/Germany within 6 weeks –Feb. 22 Runaway reaction after an unnoticed stirrer failure. Emission of 10 tons methanol containing a possibly carcinogenic substance, contaminating a large residential area –March 15 Explosion of methanol – air – mixture during maintenance in a process plant. 1 worker killed, 1 seriously burnt –April 2 Major sulphur trioxide emission in a process plant The series of incidents caused a lot of public concern and nationwide media coverage. 17

18. 18 —ca. 10t release —Schwanheim —Goldstein

19. —InWEnt | Qualified to shape the future Hoechst Incidents: Severe Consequences Although the Feb. 22 emission did not cause serious injuries, it led to the most serious consequences for the company and the most “lessons learnt”: –Direct cause: failure of worker to switch on stirrer –Root cause: insufficient risk analysis did not identify major risk, which could have been avoided by a simple safety device (stirrer control acting on charging valve) –Confidence in the company´s competence in emergency response was torn down by Gross underestimation of the affected area Incomplete knowledge of the hazardous properties of the emitted substance Inadequate wording in the first press conference –Aggravation of adverse reactions by neighbours, media and authorities by arrogant behaviour of site representatives long before the incident 19

20. Hoechst/Griesheim February 1993 20

21. Hoechst/Griesheim 1993: a few days later 21

22. Hoechst/Griesheim 1993: 1 year later 22

23. Hoechst/Griesheim 1993: “evacuation” of children 23

24. —InWEnt | Qualified to shape the future Hoechst Incidents: Lessons Learnt Crisis management assessment should cover all parts of emergency- and crisis- management... identify hazards comprehensively avoid or control risks communicate remaining risks mitigate consequences remediate damages restore trust... pursuing the goal to define and train as much as possible in advance 24

25. —InWEnt | Qualified to shape the future Case Study: Texas City/U.S.A. 2005 One of the best investigated accidents in (petro-)chemical industry ( BP; U.S. Chemical Safety and Hazard Investigation Board (CSB); „Baker“-Report) 25 If time permits, the CSB video will be shown

26. 26

27. —InWEnt | Qualified to shape the future Baker Report The Baker Report is an unique source esp. for issues of process safety culture far beyond the specific incident in Texas City The recommendations of the Baker report have been evaluated by the German Commission on Process Safety (KAS) in the context of common management and human factor practices in German process industries The 260 pages of the Baker Report have been condensed to a 13 page report with recommendations focussed on German needs, illustrated by best practice examples. Although the discussion often was controversial, eventually a broad consensus between all stakeholder groups could be achieved. The report is available (shortly in English, too) as “KAS-7” at www.kas-bmu.de: KAS recommendations on advancing the safety culture – Lessons learnt from Texas City 2005 27

28. —InWEnt | Qualified to shape the future The main “lessons learnt” (1) High Risk Industries need a well established “pervasive Process Safety Culture” as a basis for an effective Safety Management System –Policy statement on process safety culture –Development of indicators for process safety culture, regular assessment (internal/external) –Involvement of all stakeholders in developing process safety culture Leading from the top –Clear and visible commitment –Independent “Process Safety Officer” reporting to the Board –Regular Process Safety Management review by the Board –Clear definition of roles and responsibilities on all levels –Process safety performance as part of personal goals/bonus systems –Process safety as mandatory part of all relevant decisions (M&A, investments, recruitment,...) –Open, positive and trusting communication culture 28

29. —InWEnt | Qualified to shape the future The main “lessons learnt” (2) Managing Process Safety –Clear and unambiguous implementation of Annex III/Seveso II Process Safety competence and training –Developing deficiencies in graduate education are highlighted –Task-specific definition of process safety competence (and manpower!) –Regular Process Safety training –Contractors have to be included in these measures accordingly Process Safety assessment, learning from incidents –Develop/implement Process Safety reporting system (open, trusting!) and KPIs 29

30. —InWEnt | Qualified to shape the future The main “lessons learnt” (3) Process Safety support for line management –Sufficient number of qualified and independent experts Process Safety assessment, learning from incidents –Develop/implement Process Safety reporting system (open, trusting!) and KPIs Process Safety audit and review –Develop/implement systems with high involvement of top management Process Safety inspections by authorities –Roles, responsibilities and competence requirements for inspectors 30

31. —InWEnt | Qualified to shape the future Implementation of “Baker recommendations”: Status and outlook Germany –Some recommendations are yet regulated or “good practice” –“New” recommendations are (slowly) implemented on basis of the guidance –The KAS guidance is on soft issues and aims at changing of a mindset – this needs time! EU –Some recommendations are yet regulated (Seveso II Annex III) or “good practice” –EU Major Accident Hazards Bureau (MAHB) had 3-day workshop in March 2010 “illustrating linkages between safety leadership, culture and performance indicators and identifying potential benefits and drawbacks of applying these concepts in an inspection and enforcement context.” –Will probably be considered in future revisions of Seveso II 31

32. —32 Senior Management and Process Safety – not only a BP Problem Process Safety needs strong leadership right from the top Baker Report stresses the old truth that in hierarchical organisations the direction is from the top Senior Management and Board –Increasingly focused on short term results –Increasingly without operating experience –May never have experienced a (low probability) major accident in the short shelf life of their jobs –May believe that Process Safety is a cost driver and puts brakes on investments –May not fully understand their direct accountability 32

33. —33 EPSC/EFCE project “Fostering senior management commitment for process safety” DVD package with video and template for PowerPoint presentation To be presented by senior process safety specialist at e.g. Management Board meeting, duration 30-60 minutes Video “Process Safety Pays” as “opener” or “teaser” to achieve positive emotions for process safety for non-technical senior management Max. 10 minutes High quality (“image film”) Process safety correlated to high integrity organisations such as airlines Testimonials by peers (e.g. CEO, CFO) Followed by PowerPoint presentation focussing on the specific issues of the company (based on template provided by EPSC WP) The whole package is available via www.epsc.org 33 If time permits, the video will be shown

34. —InWEnt | Qualified to shape the future Case Study: Buncefield/UK 2005 The Buncefield accident has been described as the biggest fire in Europe since the Second World War. It has been thoroughly analysed by: –the Major Incident Investigation Board (MIIB), set up by the U.K. Government – the Buncefield Standards Technical Group (BSTG) and the Process Safety Leadership Group by the U.K. Health and Safety Executive (HSE), science and industry The companies involved have been found guilty by court in 2010, trial against workers is still pending 34

35. —InWEnt | Qualified to shape the future Buncefield: the facts –Dec. 10, 19:00 hrs: unleaded motor fuel was being pumped into storage tank 912 via pipeline (550m³/h). –Dec. 11, since approx. 03:00 hrs no change of level indication despite of continuous filling. –approx. 05:20 hrs overfilling of tank 912 starts, independent “high-high” level switch does not work. Fuel escapes with 550m³/h through roof openings. A total of approx. 300m³ flows first in bund and then outside. –Since 05:38 hrs increasing “fog” (fuel fume) visible in security video, vapour cloud 250,000M3 –At 06:01 hrs several strong explosions, followed by huge fire, destroying 20 tanks in different bunds as well as stationary fire fighting equipment. –Until Dec. 15 fighting the fire with mobile high performance pumps. –43 persons injured (no fatalities only due to time of accident!); immense property damage also outside the tank farm; huge cloud; contamination of groundwater and soil by fuels and foam concentrate. –Stable weather conditions 35

36. The Buncefield Fuel Storage facility —Fed by refinery pipelines from different locations. —Feeding users including Heathrow Airport via road and distribution lines 36

37. 37

38. Access hatch for dipping Servo level Indicator ATG Independent level switch Funnel for dip Gasoline Vented ullage In/out atmos. vents Int. floating roof T912 ‘high-high’ 38

39. 39

40. 40

41. 41

42. 42

43. 43

44. 44

45. Explosion overpressure Ignition leads to deflagration proceeding to detonation Overpressures >2bar over a radius of 250M 45

46. 46

47. —InWEnt | Qualified to shape the future Environmental Effects to Air (eventually negligible) 47

48. —InWEnt | Qualified to shape the future Environmental effects to ground (fuel + 800 m³ foam concentrate + 68,000 m³ fire water) 48

49. —InWEnt | Qualified to shape the future Buncefield Evaluation: Main “lessons learnt” High reliability overfill protection systems necessary, partly going beyond existing regulations Review of scope and frequency of inspections Apply best practice for fuel storage management as preventive measure Number of workers at fuel storage sites must guarantee safety during serious operational breakdowns, too Review of leakage detection (early warning) and product retention (soil & water protection) systems Prevention of turbulence and other critical dispersion effects in case of overfilling Review best practice for fire fighting and emergency planning (esp. high performance pumps, mutual aid agreements) Review hazard zones around tank farms, possibly review of explosion overpressure models 49

50. —InWEnt | Qualified to shape the future U.K. The Health and Safety Executive (HSE) issued guidance and requested 15 similar facilities to carry out LOPA. –The results showed inconsistency which caused concern for the regulator and for LOPA practitioners in the European Process Safety Centre (EPSC). –HSE asked EPSC to chair a group of specialists to SOLVE this problem. Land use planning (safety distances) around tank farms have been reassessed Germany Commission on Process Safety issued guidance (KAS-13, as interim report also available in English on www.kas-bmu.de) Consequences drawn in Europe 50

51. U.K. Hazardous Zones for a Buncefield-type Explosion Zone Nam e Zone Size (measured from the tank wall) Comment Ar < 250m The probability of fatality should be taken as 1.0 due to overpressure and thermal effects unless the exposed person is within a protective building B 250m < r < 400m The expected overpressures are 5-25 kPa. Occupants of buildings that are not designed for potential overpressures are more vulnerable than those in the open air. Cr > 400m The probability of fatality of a typical population can be assumed to be zero. The probability of fatality for members of a sensitive population can be assumed to be low. HSE research on the Buncefield Explosion Mechanism indicates that overpressure may have exceeded 2 bar (200 kPa) up to 250m from the tank that overflowed. 51

52. —InWEnt | Qualified to shape the future Überschrift 1 1 Learning from Incidents in the EU: Seveso Guideline 2 2 Case Studies Content 3 3 Conclusion 52

53. Conclusion: Sharing “Lessons Learnt” Although learning from incidents is an individual obligation of any operator, the burden can be shared 1.Voluntary cooperation within and between companies –Company guidelines –Cross-sectoral cooperation (e.g. European Process Safety Centre, U.S. Centre of Chemical Process Safety) 2.Cooperation in given legal framework, e.g. –German Commission on Process Safety  “sub-legal” guidelines –U.S. Chemical Safety Board  Incident investigation reports, videos 3.Consideration in (the amendment of) regulations, e.g. Seveso II/2003: –Enschede fireworks explosion  reclassification of explosive substances –Toulouse Explosion  reclassification of Ammoniumnitrate, land use planning –Baia Mare environmental incident  redefinition of interface to mining regulations Effective cooperation as in (1) and (2) can avoid (3)! 53

54. —InWEnt | Qualified to shape the future Thank you for your attention!... and special thanks to Richard Gowland, EPSC Technical Director, who contributed a number of slides 54