Safety cases major accident event

Although a Safety Case can and should cover aU aspects of safety (occupational, process, and technical, as described in Chapter 1) the focus tends to be on identifying and avoiding what are known as Major Accident Events (MAE), i.e., catastrophic events such as fires, explosions, and the release of toxic chemicals. Associated with Major Accident Events are Safety Critical Elements and Performance Standards. 

Demonstrate that all reasonably practicable steps have been taken to ensure the safety of employees in the event of an emergency and during their transit to a place of safety. It should be demonstrated in particular that the integrity of the temporary refuge (TR), escape, and evacuation routes are maintained in the case of a major accident event, and that all reasonably practicable steps have been taken to ensure the safety of employees in the event of an emergency and during transit to a place of safety. 

Seismic action can cause serious accidents to industrial plants as shown in several occasions. The actual worldwide situation of major-hazard plants against earthquakes should be considered as critical. For instance, in Italy about 30% of industrial plants with major-accident hazards are located in areas with a high seismic risk. In addition, in case of a seismic event, the earthquake can induce the simultaneous damage of different apparatus, whose effects can be amplified because of the failure of safety systems or the simultaneous generation of multiple accidental chains. 

The Railway Inspectorate has also been criticized for its use of risk assessment. The main criticism was an insufficient emphasis upon risk assessment procedures, for example, in its data collection and analysis and also in its approach to safety cases (HSE, 2000 t). The validity of this criticism is borne out by recent events. The Southall and Ladbroke Grove accidents demonstrate how cautiously we should approach railway statistics because of their vulnerability to major disasters. Related to this should be some caution in basing future predictions on past performance and most particularly in using this as a basis for arguing against effecting improvements. So it is important that these analyses... 

In other words, companies which have a good occupational safety record can still experience a catastrophic process safety-related event. Improvements in personal safety do not necessarily reduce the chance of a major accident from occurring, although the reverse is less likely to be the case a company that has a strong process safety program is likely to also have good occupational safety results. 

But the impact of Deepwater Horizon/Macondo went beyond the United States the accident caused oil companies all over the world to think through the effectiveness of their safety management programs. Moreover, events such as the Montara blowout in Australian waters in the year 2009 showed that these events are not confined to one place. The contents of this book therefore go beyond the United States regulatory environment. The book describes some of the major offshore incidents that have occurred over the last 40 years or so, some of which occurred onshore, that led to the development of modem safety management systems and regulations. So, for example, it contains a thorough discussion of the Safety Case approach—a system that was first used in the North Sea but that has now spread to many international locations. 

It is clear, therefore, that both styles of major hazard regulation would have averted the accident, had they been in place. A safety case regime would have mandated a systematic hazard identification procedure which would have identified and controlled the hazard of cold temperature embrittlement. An incident report system which required the reporting and investigation of abnormal temperature events and leaks would also have resulted the discovery and control of the danger of embrittlement. 

Significant advances have also been made in reactor safety. Earlier reactors rely on a series of active measures, such as water pumps, that come into play to keep the reactor core cool in the event of an accident. A major drawback is that these safety devices are subject to failure, thereby requiring backups and, in some cases, backups to the backups The Generation IV reactor designs provide for what is called passive stability, in which natural processes, such as evaporation, are used to keep the reactor core cool. Furthermore, the core has a negative temperature coefficient, which means the reactor shuts itself down as its temperature rises owing to a number of physical effects, such as any swelling of the control rods. 

Detailed investigation of accident scenarios modeled in Czech PSA projects has led to the conclusion that, at least for major subset of aU actions performed in response to initiating event occurrence and driven by symptom based procedures, lack of time should not be relevant issue. Thus, the time-versus-reliabiUty curves (for short time windows) are used just in some few very special cases of potential lack of time (with time windows shorter than 30 minutes), mostly connected with necessity to recover plant critical safety functions. 

The CSB web site is an excellent source for reading thorough reports about major chemical accidents. It is often the case that the list of what went wrong is, in retrospect, a list of completely preventable errors and usually there are several errors that act in combination to lead to catastrophic events. All of this can be applied to much smaller, academic lab projects, however. Applying the basic questions of PHA to all laboratory experiments will prevent accidents and incidents almost 100% of the time. Reading through the various incidents that serve as introductions to most sections of this book invariably leads to the observations that that could have easily been prevented if basic safety rules had been followed. 

The emphasis in design has been to incorporate inherent and passive safety features to the maximum extent as a part of the defence in depth strategy. The main objective has been to establish a case for the elimination of evacuation planning following credible accident scenarios in the plant. Another major objective has been to provide a grace period for the absence of any operator or powered action in the event of a credible accident scenario. 

There is also an addendum to the second assumption, that has been mentioned in the discussion of the myths of Safety-1. This is the notion that there must be a kind of congruence or proportionality between causes and effects. If the effects are minor or trivial - a slight incident or a near miss - then we tacitly assume that the cause also is minor. Conversely, if the effects are major - such as a serious accident or disaster - then we expect that the causes somehow match that, or at least that they are not trivial. (A consequence of that is the assumption that the more serious an event is, the more we can learn from it this is discussed further in Chapter 8.) In both cases the assumption about proportionality may clearly bias the search for causes, so that we look either for something trivial or something significant. 

Sharing of past major incidents with other oil and gas industries provides useful input data for similar process industries in order to identify the most critical barriers and improve their safety processes. One poignant example highlights this matter. In 1998 there was an accident in the gas compression stage of a Middle East oil and gas plant which caused 7 dead as a result of fuel accumulation and vapor cloud explosion which was very similar to the Texas City Refinery disaster on March 23, 2005 in which a distillation tower was overfilled and an uncontrolled release of hydrocarbons led to a major explosion and fires. Fifteen people were killed and 180 were injured in the worst disaster in the United States in a decade. In both incidents, excess hydrocarbons were diverted into a pressure relief system that included a blowdown stack. In the Iranian case, it was equipped with a flare, but one which the operator didn t ignite in Texas City the blowdown stack was not equipped with a flare to burn off hydrocarbons as they were released. As a result, the flammable overflow from the tower entered the atmosphere. Ignition of the escaped hydrocarbons was enabled by startup of a nearby vehicle resulted in the explosion and subsequent fires (Hopkins, 2008). This example shows the repetitive patterns of accidents, and root causes of events all over the world in this sector. The lesson of this paper is that accidents in one country, where the scenarios are very similar, can and should serve as lessons to prevent the same scenario being actualized in other countries. 

---