Scenario Based Auditing Christo Zemering, General Electric Plastics Paul Swuste, Safety Science Group, TUD Specific way auditing. remains Toulouse disaster 5 y ago. Human tragedy, safety people like pictures Final project work MoSHE DUT Christo passed exam (1st), publishing, presenting

Outline Auditing High Risk Chemical Facilities Causes of major accidents and incidents How do we manage Process Safety ? Is there a mismatch….? Scenario Based Audit (SBA) Outline, high risk chemical facilities. Comments on causes (material damage ± human victims) 2nd Process Safety management, how we organize, what regulator want. Mismatch, room for SBA

Causes major accidents and incidents Major (chemical) incidents are rarely caused by single failures, but the result of interaction between multiple failures; a chain of errors Insufficient hazard recognition (design or operation) plays a role in many Incidents with reactive chemicals (CSB 2001) Prevention is too much focused on top events only (Kletz 2001) Major accidents are often preceded by a series of smaller accidents, near-misses, or accident precursors quotes accident causation, familiar, keywords: multiple failures, ≠ hazard recog, prev events, accident precursors Not efficient in preventing

Causes of major accidents (PSM) Type of causes explanation Physical causes hazards insufficient hazard recognition and evaluation maintenance failing mechanical integrity start-up inadequate per-start-up safety review emergency inadequate planning and response on emergencies hot work inadequate maintenance during high temperatures Organisational causes procedures incorrect procedures information inadequate or missing safety information training inadequate or missing safety training accidents repeating accidents following similar scenarios changes inadequate management of change Human factors workers insufficient workers participation human human factor Co’s US. List, OSHA – PSM, EPA – RMP PSM causes, physical, organisational and human causes.

Causes of 34 major accidents and incidents Database 2000-2003, 34/100 events (chlorine gas emissions, extruder fires, dust explosions), completeness Expert judgem 4 experts, 2 senior safety officers (HSE, PSM), 1 engineer 1 exp technician. Acc. Indiv, group (PSM list) Org = dominant

How do we manage Process Safety. OSHA 1910 How do we manage Process Safety? OSHA 1910.119 Process Safety Management of Highly Hazardous Chemicals 1 Employee Participation 2. Process Safety Information 3. Process Hazard Analysis 4. Operating Procedures 5. Training 6. Contractors 7. Pre-Start-Up Safety Review 8. Mechanical Integrity 9. Hot Work 10. Management of Change 11. Incident Investigation 12. Emergency Planning & Response 13. Compliance Audit 14. Trade Secrets How we manage PS, US 14 elements, independent saf experts audits regularly, ½ day/item, documentation, interview workers, assessing process conditions Score in % Different from Eu, Seveso II, PSM no scenario analysis.

PSM audit results Plant 1 Plant 2 Plant 3 Plant 4 Plant 5 Plant 6 1. EMPLOYEE PARTICIPATION 67% 50% 83% 2. PROCESS SAFETY INFORMATION 77% 69% 70% 64% 3. PROCESS HAZARD ANALYSIS 62% 54% 74% 48% 4. OPERATING PROCEDURES 80% 60% 56% 84% 20% 88% 5. TRAINING 90% 55% 65% 6. CONTRACTORS 98% 87% 7. PRE-STARTUP SAFETY REVIEW 47% 85% 8. MECHANICAL INTEGRITY 94% 63% 9. HOT WORK PERMIT 96% 92% 68% 10. MANAGEMENT OF CHANGE 11. INCIDENT INVESTIGATIONS 100% 12. EMERGENCY PLANNING AND RESPONSE 76% 61% 13. COMPLIANCE AUDITS 86% 93% Total PSM score 79% 73% 66% 71% Results PSM audit, same protocol compare plants green OK, red bad, plant 5

What do these audits tell ? are processes in place that cover the intention of the described elements? how robust are these processes implemented? representative number of Field Checks confirm if the elements are implemented in practice interviews with Employees give background to how well the organization is involved and how knowledgeable the people are score of audit and the number of findings give a “good” or a “bad” feeling (++ rating) Lot energy org. Audit = robustness processes (paper, shop floor)

What does this say about the risk for a potential major event? essential question

Is there a mismatch.…? Audits focus on implementation of SMS, and is performed per element, using standard questionnaires no multiple failure scenario’s no focus on detailed scenario’s no focus on process disturbances no identification of early precursors audit findings are ‘single ticket’ items per element no integral assessment audit results are poor communication tool mismatch PSM audit - current knowledge causes no focus scenarios, process disturbances potentially disastrous events. audit findings = ‘single ticket’ items, no integral approach. Audits = % compliance, no info scenario management. Upper management no relevant questions.

SBA, bow tie model F1 F3 F11 F4 F2 F10 F9 F12 F6 F8 F13 F7 F5 and or People Equipment Reputation Environment Central event Fault tree, scenario’s and primary barriers Event tree, scenario and effect reducing barriers bow-tie, familiar model on conference. bow-tie = audit tool, prevent accidents Knot = central event (CE), Lines = scenario’s, blocked by barriers Hazard to CE (years), CE - losses (seconds) Barriers: safety barriers (hardware) + man factors, blocking E stream, quality = man factors (SMS), which barrier, install, maintain, training

SBA, how does it work? Team selection Select a major event, a ‘central event’ Construct the left side of the bow-tie Define barriers Audit barriers format SBA simple. After CE selection bow rtie construction. Process disturbances.

SBA, resources per central event Audit team 2 auditors 1 plant engineer Plant team PSM engineer Process engineer Operator Maintenance technician Day 1 Introduction Create scenarios/bow-tie Define barriers Day 2 Define teams Audit barriers Day 3 Gather inputs, report out Left = manpower, right = time (GEP experience)

Dust explosion outside powder processing equipment Mechanical sparks Hot surfaces Static electricity OR Powder spills Insufficient cleaning AND Explosion outside equipment Dust Air ignition Equipment not tightly closed Improper loading of blender Uncontrolled hot work Area classification failure Dust fire/ explosion Electr eqp In area not dust tight equip not dust tight, el eq not dust, ignition source. inadequate housekeeping. Conditions met, man factors insp, main monit inadequate.

Conclusions, advantages of SBA improved hazard recognition multiple failure scenarios focus on barriers further away from a top event (the early precursors) focus on management factors, link with SMS effective communication tool to management advantages SBA clear, hazard recogn, scen early precursors, part model. man factors, quality barriers, more effective comm tool for man