Topic 7: Emergency planning

Introduction

Definition

A major emergency in a works is one which has the potential to cause

serious injury or loss of life. It may come extensive damage to property
and serious disruption both inside and outside the works. It would
normally require the assistance of outside emergency services to handle it
effectively. Although the emergency may be caused by a number of
different factors, e. g. plant failure, human error, earthquake, vehicle
crash or sabotage, it will normally manifest itself in three basic forms: fire,
explosion or toxic release.

7.1 Scope

Much of the earlier part of this manual has been concerned with
preventing accidents through good design, operation, maintenance and
inspection. Achieving all this will reduce the risk of an accident, but it will
not eliminate it altogether - absolute safety is not achievable, and an
essential part of major hazard control is concerned with mitigating the
effects of a major accident.

An important element of mitigation is emergency planning, i.e.

recognising that accidents are possible, assessing the consequences of
such accidents and deciding on the emergency procedures, both on site
and off site, that would need to be implemented in the event of an
emergency.

Emergency planning is just one aspect of safety and cannot be considered

in isolation. In particular, it is not a substitute for maintaining good

standards inside the works. Before starting to prepare the plan, works

managements should ensure that the necessary standards, appropriate to

their safety legislation, are in place. Emergency plans are likely to be

separate for on-site and off-site matters, but they must be consistent with
each other, i.e. they must be related to the same assessed emergency

conditions.

While an on-site plan will always be the responsibility of the works

management, different legislations may place the responsibility for the

offsite plan elsewhere: for example, the EC Seveso Directive requires the

local authority to prepare the off-site plan.

The overall objectives of an emergency plan are:

(a) to localise the emergency and, if possible, eliminate it; and

(b) to minimise the effects of the accident on people and property.

Elimination will require prompt action by operators and works emergency

staff using, for example, fire-fighting equipment, emergency shutoff

valves and water sprays. Minimising the effects may include rescue, first

aid, evacuation, rehabilitation and giving information promptly to people

living nearby.

7.1.4. Identification and assessment of hazards

This stage is crucial to both on-site and off-site emergency planning and

requires works managements systematically to identify what emergencies

could arise in their plants. These should range from small events which

can be dealt with by works personnel without outside help to the largest

event for which it is practical to have a plan. Experience has shown that

for every occasion that the full potential of an accident is realised, there

are many occasions when some lesser event occurs or when a developing

incident is made safe before reaching full potential.

Most major hazard accidents come within the following

categories:

(1) Events involving flammable materials

(a) major fires with no danger of explosion; hazards from prolonged high

levels of thermal radiation and smoke;

(b) fire threatening items of plant containing hazardous substances;

hazards from spread of fire, explosion or release of toxic substances;

(c) explosion with little or no warning; hazards from blast wave, flying

debris and high levels of thermal radiation.

(2) Events involving toxic materials

(a) slow or intermittent release of toxic substances, e.g. from a leaking

valve

(b) items of plant threatened by fire (Chemical Industries Association, 1976);

hazards from potential loss of containment;

(c) rapid release of limited duration, due to plant failure, e.g. fracture of pipe;
hazards from toxic cloud, limited in size, which may quickly disperse;

(d) massive release of toxic substance, due to failure of large storage or process
vessel or uncontrollable chemical reaction and failure of safety systems; the
exposure hazard would affect a wide area.

The assessment of possible incidents should produce a report indicating

–

(a) the worst events considered;

(b) the route to those worst events;

(c) the time-scale to lesser events along the way;

(d) the size of lesser events if their development is halted;

(e) the relative likelihood of events;

(5) the consequences of each event.

This report may be part of the hazard assessment report (Chapter 3) or may be
a separate exercise produced specifically for the purposes of emergency
planning. Incidents should be assessed in terms of the quantity of hazardous
materials which could be released, the rate of release and the effects of that
release - e.g. as thermal radiation from a fire or fireball or as a toxic gas cloud -
as a function of distance from the plant.

On-site emergency planning

Formulation of the plan and of emergency services

The assessment of the risks and hazards in a major hazard works leads
either to improvements being made to the plant, in the form, for example,
of additional safeguards or better procedures, or to the decision being
taken that the risk is sufficiently small to be accepted. The on-site
emergency plan must be related to the final assessment and it is the
responsibility of the works management to formulate it. The plan must
therefore be specific to the site. On very simple sites, the emergency plan
may consist merely of putting key personnel on stand-by and calling in
the emergency services.

On large multi process sites, the plan may well be a substantial document
including the following elements:

(a) assessment of the size and nature of the events foreseen and the
probability of their occurrence;
formulation of the plan and liaison(a person who establishes
communication) with outside authorities, including the
emergency services; procedures:
(i) raising the alarm;
(ii) communications both within and outside the works;
Appointment of key personnel and their duties and
responsibilities:

i. incident controller;
(iii) works main controller;
(iv) emergency control centre;
(v) action on site; action off site.

The plan should set out the way in which designated people at the site of
the incident can initiate supplementary action both inside o+r outside
the works at an appropriate time. An essential element of the plan must
be the provision for attempting to make safe the affected unit, for
example by shutting it down. On a complex site, the plan should contain
the full sequence of key personnel to be called in from other sections or
from off site.

It is particularly important that the requirements of the plan for

emergency resources, both personnel and equipment, are reasonable and
can be quickly assembled in the event of an emergency.

Management should consider whether sufficient resources exist at their

works to carry out the plan for the various assessed incidents in
conjunction with the emergency services.

Is there, for example, sufficient water for cooling and, if this water is
applied via hoses, are there sufficient people to operate them? Has the
time-scale been assessed correctly?

The time element is of great significance but is often overlooked. For

example, if a period of 15 minutes has elapsed between the start of the
incident and the arrival of the fire brigade, and if a further period of 15
minutes is needed for the firefighters and equipment to be deployed, will
the works resources be able to contain the incident in the meanwhile?

Although a large vessel may leak for a long period, a 1-tonne chlorine
vessel releasing liquid at full flow through an open valve will be empty in
about 10 minutes, and a cylinder in far less time.
If the possibility such a release is identified, the remedial action must be
appropriately quick if it is to be worth taking. The plan needs to take
account of absences due to sickness and holidays, and of shut-down
periods, for example when only security personnel may be present: in
other words, it must be applicable to all the variations in manning, and so
on, that could occur while the hazard exists.

7.2.2. Alarm and communication mechanism

Communication is a crucial factor in handling an emergency. It is the

practice at many works that any employee can raise an emergency alarm,
so allowing the earliest possible action to be taken to control the situation.
Alarm systems vary and will depend on the size of the works.

There should be an adequate number of points from which the alarm can
be raised either directly, by activating an audible warning, or indirectly,
via a signal or message to a permanently manned location. The alarm
should alert the incident controller, who should assess the situation and
implement appropriate emergency procedures.

In areas where there is a high level of noise, it may be necessary to install

more than one audible alarm transmitter or flashing lights. Automatic
alarms may be appropriate on some sites.

There should be a reliable system for informing the emergency services as

soon as the alarm is raised on site. The details of the communication
arrangements should be agreed locally; in some cases, it may be
advisable to have a direct line to the fire brigade. Predetermined code
words to indicate the scale and type of the emergency may be valuable.

7.2.3. Appointment of personnel and definition of duties

Effective emergency plans require that, in the event of an accident,

nominated individuals are given specific responsibilities, often separate
from their day-to-day activities. The two principal people are the site
incident controller and the site main controller. The site incident controller
will take control of handling the incident. He or she will often be the
person in charge of the plant at the time of the incident and should
provide 24-hour cover when shift operation applies.

The site incident controller may have to take decisions involving

neighbouring plant liable, perhaps, to be involved in an escalating
emergency if it is not shut down.

The responsibilities of the site incident controller include the

following:

 to assess the scale of the incident (both for internal and external
emergency services)
 to initiate the emergency procedures to secure the safety of
employees, minimise damage to plant and property and minimise
loss of material
 to direct rescue and fire-fighting operations until (if necessary) the
fire brigade arrives
 to search for casualties
 to arrange evacuation of non-essential workers to assembly areas
 to set up a communications point with the emergency control centre
 to assume the responsibilities of the site main controller pending his
or her arrival to provide advice and information as requested to the
emergency services.

It is important that the site incident controller is readily recognisable at

the scene of the incident. This is usually achieved by the wearing of a
distinctive safety helmet and jacket, which is known to all concerned. It
should contrast with equipment worn by the emergency services. The site
main controller is often chosen from the senior management of the works
and has the general responsibility of directing operations from the
emergency control centre after relieving the site incident controller of the
responsibility for overall control.

The specific responsibilities of the site main controller include:

(a) to decide (if not decided already) whether a major emergency exists or
is likely, requiring the emergency services and the off-site emergency
plan

(b) to exercise direct operational control of the works outside the affected
area;

continually to review and assess possible developments to determine the

most probable course of events
c. to direct the shutting down of plants and their evacuation, in
consultation with the site incident controller and key personnel
d. to ensure that casualties are receiving adequate attention
e. to liaise with chief officers of the fire and police services and with the
factory inspectorate
f. to control traffic movement within the works
g. to arrange for a log of the emergency to be maintained
h. to issue authorised statements to the news media
i. to control rehabilitation of affected areas after the emergency.

Apart from the two site controllers, other works personnel will have key
roles to play in the implementation of the emergency plan. These will
include senior managers of plants not directly involved in the emergency,
first aiders, atmospheric monitoring staff, casualty reception staff and
public relations staff to liaise with the media. All need to be aware at the
emergency pre-planning stage of the precise nature of their roles.
7.2.4. Emergency control centres
The emergency control centre is the place from which the operations to
handle the emergency are directed and co-ordinated. It will be attended
by the site main controller, key personnel and the senior officers of the
fire and police services. For a small works it may be a designated office
which converts to a control centre in the event of an emergency. For large
works, a purpose-built facility is advisable. In all cases, however, the
centre should be equipped to receive and transmit information and
directions from and to the incident controller and other areas of the
works, as well as outside.
Emergency control centres should therefore contain the following (as
applicable):
(a) an adequate number of external telephones;
 if possible, one should accept outgoing calls only, in order to bypass
jammed switchboards during an emergency
(b) an adequate number of internal telephones

(c) radio equipment

(d) a plan of the works, to show:

(i) areas where there are large inventories of hazardous materials

(ii) sources of safety equipment

(vi) the fire-fighting system and additional sources of water

(vii) site entrances and roadways, including upto-date information
on roadworks
(viii) assembly points
(ix) the location of the works in relation to the surrounding
community
(x) lorry parks and rail sidings (additional works plans should be
available to show affected areas, etc., during an emergency

(e) notepads, pens and pencils ; (0 a nominal roll of employees ;

(g) a list of key personnel, with addresses, telephone numbers, etc. The
emergency control centre should be sited in an area of minimum risk. For
large sites, or where toxic releases might be anticipated, consideration
should be given to setting up two control centres to ensure, as far as
possible, that one will always be available for use should the other be put
out of action.

7.2.5. Action on site

The primary purpose of the on-site emergency plan is to control and

contain the incident and so to prevent it from spreading to nearby plant.
It is not possible to cover every eventuality in the plan and the successful
handling of the emergency will depend on appropriate action and
decisions being taken on the spot.

Other important aspects needing to be considered include the following:

 (a) Evacuation. Non-essential personnel will usually be evacuated from
the incident area and also from adjacent areas.
(b) Evacuation should be to a predetermined assembly point in a safe
part of the works. In some cases, particularly where toxic releases
are being considered, alternative assembly points need to be
arranged to allow

Siting

The basis for needing a siting policy for major hazard works is straight
forward : since absolute safety cannot be guaranteed, major hazard works
should be separated from people living and working outside the factory.
The implementation of the policy is more difficult - possibly the hardest of
the components of a control system to achieve. Appendix 8 discusses this
aspect in more detail, together with suggested separation distances for
some typical hazardous inventories. Advice from the group of experts
(subsection 7.3.1) is llkely to be crucial in making progress in this area. As
a first priority, it may be appropriate to concentrate efforts on proposed
new major hazards and to try and prevent the encroachment of housing,
particularly shanty houses, which are a common feature in many
countries. This is likely to be an area requiring specific legislation,
although consideration is being given in some countries to the developers
of new works being required to buy additional land equivalent to the
separation distance in order that they can maintain control of this land
and prevent encroachment. This is an area of policy which will be
dependent on local circumstances and practices. It is particularly
important to remember that if the recommended separation distances
cannot be achieved in practice, substantial protection may be achieved by
applying somewhat smaller distances, although clearly with less
protection than by meeting the full distances.

7.3.5. Training of factory inspectors

The role of the factory inspectors is likely to be central in many countries
in implementing a major hazard control system. They may have licensed
the works before operations began and subsequently these works will
have to be inspected. Factory inspectors will have the knowledge that will
enable early identification of major hazards to take place (section 7.2).
Where they have specialist inspectors to call upon, factory inspectors will
be assisted in the often highly technical aspects of major hazard
inspection. In many countries, however, specialist inspectors are few and
inspectors having academy qualifications that are not directly relevant to
this work will be required to carry out complex inspections. The degree of
success that they achieve will determine to a large extent the success of
major hazard control in their country. Inspectors will need appropriate
training to aid them in this work. Fellowships to visit and work with more
experienced factory inspectors in other countries have proved very
successful, but this can be expensive although generally cost-effective.
The group of experts (subsection 7.3.1) will have an important part to play
in organising training courses for inspectors, either centrally or regionally.
As an interim measure, the group could draw up inspection check-lists for
the more commonly encountered hazardous materials for use by
inspectors as part of their enforcement duties. Industry itself is likely to be
the largest source of technical expertise within many countries, and may
be able to provide assistance in factory inspectorate training - for
example, in conjunction with its own internal training programmes.

7.3.6. Preparation of check-lists

A check-list is one of the more useful tools in hazard identification. Like a

code of practice, it is a means of passing on hard-won experience to less
experienced users. Check-lists are applicable to management systems in
general and to a project throughout all its stages, starting with check-lists
of the properties and process features of basic materials, continuing with
check-lists for detailed design, and finishing with operations audit
checklists. A check-list should be used as a final check that nothing has
been neglected (like the one a pilot uses just before take-off). Although
not generally produced for this purpose, check-lists can be used by factory
inspectors who are gaining experience in new technologies (subsection
7.3.5), but this should be done with caution. For check-lists to be effective,
they must be used and kept up to date. At the two extremes, there is a
risk either of leaving them on the shelf to gather dust or else blindly
adhering to a check-list which has been overtaken by a developing
technology. Both tendencies should be firmly avoided.

Detailed references are available for a range of check-lists, including

management systems, plant siting, plant layout, physical and chemical
properties, process design, fire precautions, training and incident
investigations (Lees, 1980).

7.3.7. Inspection of works by factory inspectors

This section describes aspects to be considered by inspectors at major

hazard works. Necessarily, it concentrates on the techniques of identifying
and inspecting items of plant which, in the event of a failure, would give
rise to a serious risk to the safety of personnel both on and off site. The
work of a generalist factory inspector will depend on whether he or she
has specialist inspectors (subsection 7.3.8) in support. Here it is assumed
that this is the case. Where it is not, this section and the next dealing with
the work of specialist inspectors should be read together. The majority of
serious incidents arise from the loss of containment of a hazardous
substance. Therefore, it is necessary in the first instance to identify those
items of plant which contain hazardous materials in sufficient quantity to
cause a serious incident. The responsibilities arising from major hazard
works fall on the works managements, and it is they who should provide
the expertise and resources to evaluate the risk of their own operations -
and to take precautions accordingly. The role of the factory inspector as
the enforcing authority is to make sufficient checks on what management
has done to be satisfied of its competence to operate the plant safely and
to maintain control in the event of an incident. Factory inspectorates
normally do not have the resources fully to inspect every item of plant
and every operational procedure at a major hazard works. These need to
be sampled, and the setting of priorities will be necessary, particularly at
the largest plants, in order that the appropriate sample selection is made.
Sampling here means the selection of a plant component (e.g. a pressure
vessel) as representing a number of similar components, and then
inspecting this sample in depth. A factory inspector faced with the
inspection of a large site must estimate the resources available to achieve
this and then planning the time carefully. It is likely that at each visit a
different sample will be selected for inspection, leading over time to a full
coverage of the site. With this in mind, and with inspectors changing over
the years, it is important to keep accurate records of what was inspected
and the actions which arose from that inspection. If the inspector then
moves job, his or her successor can look at the file and maintain
continuity with the overall strategy for that works. A key part of the
inspection will be to check that operators are familiar with the safety
aspects of the plant, both hardware and software, and have clear
operating instructions covering, for example, their required action in the
event of process deviation. Works inspection, testing and maintenance
schedules will need to be examined for the sample of plant selected. The
inspector would also need to check the emergency procedures for that
plant and their integration into the overall on-site emergency plan.

7.3.8. Inspection of works by specialists

Specialist inspectors will include electrical, mechanical, civil and chemical

engineers. Their role is likely to be to provide specialist support to the
generalist factory inspectors, including advice on the selection of samples
for inspection, and then to apply their specialist skills in the subsequent
inspection. Their work will include such procedures as :

(a) inspecting pressure vessels for design, operation and maintenance to

approved standards ;

(b) checking computer-controlled chemical plant for software integrity ;

(c) checking the layout of liquefied gas installations together with the
associated fire precautions ;
(d) checking the procedures for plant modifications to maintain the initial
integrity of the plant after modification ;

(e) checking the design and maintenance procedures for pipelines

carrying hazardous materials. Specialist inspectors should be aware of the
world-wide experience of accidents involving their particular discipline and
be able to advise factory inspectors and works management on that basis.
Above all, specialist inspectors, particularly those chemically based, would
be likely to have first-hand experience of some of the major hazard
substances. Their advice may be crucial when factory inspectors are faced
with licence applications to start a new major hazard works, particularly in
relation to conditions which may need to be applied, and to a
consideration of the potential off-site impact