Comment is mandatory

Link to .pdf
Link to Seveso Inspection Series Home Page

CIC - Preparedness and On-site Response Planning for Toxic Dispersion Events

Publication of Common Inspection Criteria is intended to share knowledge about technical measures and enforcement practices related to major hazard control and implementation of the Seveso Directive. The criteria were developed by Seveso inspectors to aid the dissemination of good enforcement and risk management practices for the control of major industrial hazards in Europe and elsewhere. CIC #15 highlights the main elements of an effective inspection of an operator’s controls for managing toxic dispersion risks within the internal emergency plan. This document is not intended as a technical standard nor as a summary or replacement of any existing standards on the matter.      

DEFINITION AND SCOPE

The response to a toxic dispersion event consists of measures to be taken inside - and to some extent, outside - an establishment to prevent and respond in the event of a toxic release.  This document provides guidance to inspectors on assessing the adequacy of the operator’s measures for preparing and responding to a toxic dispersion consistent with requirements of the Seveso Directive and containing and controlling incidents so as to minimise the effects and limit damage to human health, the environment and property.

The criteria are divided into three sections.  The first section covers the identification of scenarios and detection measures that are in place to determine and support the elements of the internal emergency response plan specific to toxic dispersion.  The second section provides recommendations on how to evaluate the operator’s decisions regarding the use of shelter-in-place and evacuation to prevent harm to personnel onsite during a toxic release emergency.  The third section gives criteria to assess the operator’s performance in relation to the arrangements in the internal emergency response plan pertaining specifically to toxic release events. 
 

Notably, this CIC is focused on the internal emergency response although, as necessary, it also mentions relevant interfaces with external emergency response needs.

OBJECTIVE AND FOCUS OF THE INSPECTION

Using the performance criteria in this document, the inspector can assess whether the operator’s strategy for planning the onsite response to toxic dispersions has been properly calibrated to the nature and level of risk, and that the measures in place will effectively reduce the risk of exposure to persons onsite to a minimum level.

In this sense, the operator’s strategy should be aimed at meeting the criterion included in Article 5 of the Seveso Directive, that is to, limit the consequences to human health and the environment as well as, as much as possible, limit harm to the establishment itself.  

This inspection should at least cover the following elements

  • Strategic approach (Resilience)
  • Scenario identification
  • Detection and alarms
  • Mitigating and avoiding exposure of personnel
  • Shelter-in-place and evacuation strategies
  • Internal emergency response plans

STRATEGIC APPROACH (RESILIENCE)

Throughout examination of each element of the preparedness strategy, the inspection should seek evidence that the operator’s planning is resilient in the face of all foreseeable circumstances. Figure 2 shows a schematic of the process for preparing for a toxic dispersion event.  The starting point for the preparedness strategy starts is the moment the event occurs and continues until all personnel are safe and the release is controlled.  Meticulous planning for all possible “what-ifs”, from scenario identification through to completion of an effective response, can help assure that the preparedness strategy is sufficiently resilient to handle less than ideal situations and complex challenges. This approach requires that, for every reference scenario, the operator takes account of alternative circumstances, such as:

  • All possible initiating events and locations for the reference scenario
  • Likely and alternative sequences of events from the start of the dispersion to the end of the response
  • The range of locations where individuals may be located in space and time at different points and time and phases of operation, including personnel temporarily onsite (e.g., making a delivery)
  • All possible pathways that the release could take through the site from point of release
  • Domino effects and natural hazards, that could affect interfere with escape routes and rescue operations

In addition, expertise in consequence modeling is usually needed to accompany the planning of mitigation and response because of the need to predict the trajectory of the release as the emergency evolves. 

In addition, expertise in consequence modelling is usually needed to accompany the planning of mitigation and response because of the need to predict the trajectory of the release as the emergency evolves.

SCENARIO IDENTIFICATION AND DETECTION MEASURES

The operator should be able to justify selection of representative toxic scenarios, based on a systematic process for identifying hazards and evaluating risks. For upper tier sites, the selection process should already be described in the safety report. The inspector may also inspect the continuous release scenario if the release occurs frequently or for long periods. The inspector may also inspect the documentation generated through the hazard identification and consequence analysis steps of the risk assessment, e.g. what-if checklists, Hazard maps, Hazop reports, fault and event trees, Failure Modes and Effects Analysis (FMEA), and inputs and calculations associated with the reference consequence analyses and quantitative risk assessments (if any).  The use of competent expertise in consequence modelling and risk analysis is essential for scenario selection as well as planning mitigation and response.

From the risk assessment documentation, the operator should be able to demonstrate that the reference scenarios for managing toxic dispersion events reflect realistic worst case conditions in which the scenarios could occur.  These scenarios should not only include loss of containment of a toxic substance, but also possible toxic releases generated by reactions, e.g., from a process error, loading or unloading error, or when a substance is released and reacts with a nearby substance.  Location and possible release of toxic substances in the event of a worst case fire scenario should also be taken into account.

Parameters that should be examined include:

  • Physical and chemical conditions
  • Type of equipment and process involved as well as relevant safety instrumentation
  • Relevant interfaces with other equipment (pipes, etc.), including their dimensions, functionality, relevant safety components, and role in the sequence of events
  • Process conditions, e.g., temperature, pressure
  • Source term, e.g., leak or rupture diameter, continuous or not continuous, maximum potential volume, phase type, pool size (if applicable)
  • Ambient conditions
  • Wind speed and wind direction
  • Atmospheric stability
  • Surface roughness
  • Bund dimensions and capacity

DETECTION AND ALARMS

The ability to react to a toxic release is highly dependent on the planning and implementation of a detection and alarm system.  The system must function reliably and in time to activate emergency shutdown features and alert personnel.  The elements of a well-functioning detection and alarm strategy for toxic dispersion events are described in this section.

Detection.  The operator should have established appropriate detection measures for any process unit and/or functions (e.g., loading and unloading) that can be a source of a potential toxic dispersion scenario, usually verifiable from the hazard identification documentation.  For every such process, the operator should have established appropriate detection measures.  Gas detection instrumentation should be located in an appropriate location relevant to the likely area of release and close to the source, with the detection level calibrated to trigger an alarm and allow timely activation of an appropriate passive or active mitigation to stop the release and remove the danger. Other types of detectors, e.g., wind direction and intensity detectors, may also be installed at suitable locations on or around the site. Individual characteristics of the gas also should be taken into account (e.g., hydrogen sulphide is heavier than air, methane rises, propane sinks, etc. and their behaviour may change under high pressure or other conditions.)  

Reliability of detection systems. The operator should also have taken into consideration issues affecting reliability of the gas monitoring systems, including the generation of false alarms.  In particular, the operator should understand technology limitations and take decisions that aim to maximize of the monitoring system, for example, by taking measures to reduce potential system degradation over time and avoiding as much as possible cross-interference of other gases (e.g., emergency generators, vehicle exhaust and cleaning chemicals).

The Common Inspection Criteria for Safety-Instrumented Functions of the JRC Seveso Inspection Series provides comprehensive advice on selecting location, trip levels, fault tolerance, response to failure, and testing and maintenance procedures that can be used by inspectors also to evaluate the operators gas monitoring systems.  This subset of criteria in the CIC is universally applicable to all sensor equipment, regardless of whether the sensor also activates a safety function.

Managing alerts. The operator should also have a system for documenting alerts that provides a historic reference that can serve as a source of information to guide decisions for selecting, locating and calibrating sensors, and making modifications to existing sensors.  This archive should include information that will be useful for future decisions, such as gas concentration at time of detection, location and distance travelled, time of day, volume of release when detected. 

False alarms should also be documented, especially information on what might have caused them, and corrective action that has been taken to avoid the false alarm in future.  The inspector can also use the record of false alarms as evidence of the effectiveness of the gas monitoring system.

Early warning and process monitoring.  In addition to gas detection alarms, the operator should also have the means to detect vulnerabilities prior to a toxic release via an early warning monitoring system.  The early warning system can be used to detect a releases, or conditions leading to a release, through a combination of monitoring systems, including routine process monitoring, programmable safety instrumentation, and physical observation.  Digitized process monitoring systems are generally present on most sites involved in chemicals manufacture or processing but some downstream chemicals users may not have them, e.g., food producers, warehouses.  They may have programmable logic controllers (PLCs) built into equipment, however, that can detect and correct conditions with potential to cause a toxic release (e.g., detection of excessive heat triggers cooling, etc.)

Some sites may also supplement warning systems via a risk-based inspection system and physical observation that automatically generate a physical verification of the integrity of critical equipment at regular intervals. 

MITIGATING AND AVOIDING EXPOSURE OF PERSONNEL

An essential part of preparedness is the ongoing protection of personnel from exposure throughout the release.  As shown in Figures 3 and 4, the risk of exposure for each individual may vary as they move through the site towards the designated shelter-in-place or in the process of evacuation.  Key considerations are highlighted below.

Identifying potential for exposure at the start of the release.   For all reference scenarios, the operator should consider all possible locations of personnel from the start of the release.  For those in the vicinity of the release, the strategy should consider the potential of a harmful exposure at the time of release and take measures to avoid a toxic exposure.  When and what concentration will reach personnel in the downstream path must also be taken into account. The operator should demonstrate that appropriate prevention measures, such as ventilation, access to protective equipment in these locations, have been taken.  Figure 2 depicts an example of how a toxic dispersion response can evolve over time marked by time intervals that could represent different exposure intervals. 

Minimising personnel exposure throughout the event.  Once possible starting locations have been identified, the possible movement of personnel towards shelters, collection points and evacuation exits should be traced.  In this way, routes that are in the pathway of the release can be avoided. Consequence modelling can help with identifying the movement of the toxic plume across the site in time.

Releases inside buildings.  If a release happens inside a building, the trajectory of different release scenarios should be taken into account in planning evacuation scenarios, with also possible mitigation measures to avoid a toxic exposure along the escape route.  The scenario of a wrong mixture or a released substance reacting with another substance in the vicinity of the release, or in the downstream path (a common warehouse scenario), is a particularly relevant consideration for releases inside buildings or partially confined spaces.  Other potential exposure pathways, e.g., air conditioning system, that could carry smoke or toxic fumes from the incident, at the location of the release or along the escape route, should also be assessed.

SHELTER-IN-PLACE AND EVACUATION STRATEGIES

Regardless of the operation, tools and equipment, brought into the area, clothing and personal protective equipment, and working procedures must be compatible with ATEX protocols. 

The decision to shelter-in-place vs. evacuate depends on a number of factors, including the toxic substance released, the size and location of the release, and how the incident evolves, or is predicted to evolve, in time and space.  

Designating a shelter-in-place.  In some circumstances, directing people to a shelter-in-place location may not be as effective as evacuating them to a safe outdoor muster point.  In particular, substances such as hydrogen sulphide, that are both flammable and toxic, and hence, sheltering onsite may not protect them sufficiently from thermal or blast effects.  The option for sheltering also depends on the availability of buildings that are appropriate for sheltering, taking into consideration their isolation from outdoor air intake and the ease of evacuation from these locations should it be
necessary. 

Depending on the scenario, there also may be a fallback plan or progressive evacuation foreseen, in which case designated shelters-in-place on-site may require sufficient personal protective equipment (e.g., 10-minute escape packs) to allow escape of all personnel in the shelter.  Shelters should also have permanent lighting so that they are visible and generally paths to the shelters should be marked and unobstructed.  There should be enough shelters on the site to accommodate the maximum presence onsite, taking into account maintenance turnarounds and other similar peak periods for staff presence.  Alternatively, shelters-in-place can be used in combination with progressive evacuation.

Determining evacuation strategy.   The evacuation strategy should also be determined by the characteristics of the relevant scenarios.   They should take into consideration possible locations and pathways to be avoided depending on the direction of the release, such as partially confined areas around buildings that might create pockets of concentration, or spaces in between buildings that could serve to channel the release.    Designation of evacuation routes should follow standard guidelines for emergencies of any kind, and as with pathways to shelters, they should be marked with appropriate signage, free of obstruction at all times, and appropriately lighted.  A minimum of two evacuation routes are generally required for any kind of emergency, but larger sites may require more, especially since the source and the direction of the toxic release depends on circumstances.   Alternative pathways also should consider plausible natural hazard events that could cause one or more escape route to be blocked or dangerous. INTERNAL EMERGENCY RESPONSE PLANS)

The operator should have procedures in place defining actions, roles and responsibilities that should automatically once a toxic gas alarm has been activated.  In addition to mitigation procedures, the notification of a toxic release should set in motion the internal emergency plan for toxic dispersion scenarios.  The plan should have appropriate procedures in place for verification, crisis management and communication, and guiding personnel safety in response to a toxic gas release,
using appropriate technologies and equipment to facilitate an effective response.  

Verification. There should be a verification procedure to determine the source, nature and status of the release.  Depending on the specific scenarios, this information may already be available in the alarm control panel and via closed circuit cameras.  Procedures for physical detection should also be in place as an option, with at least two persons, portable detection and personal protective equipment available for this purpose.  Some sites, e.g., refineries may also have a detection system integrated with a PLC that automatically triggers a verification process.

Mitigation.  The operator should establish appropriate actions to mitigate a toxic release and reduce its danger. Ideally, there should be a specific mitigation action, or actions, that are triggered by the gas alarm, e.g., remote controlled sectioning valves for lines, water curtains, vapour barriers, water cooling, foam extinguishing system equipment. Detection sensors may also include PLCs that trigger mitigation measures, e.g., detection of a dangerous concentration results in diversion of a gas stream to the flare.  Appropriate mitigation measures should also be available also for realistic worst case scenarios in which the toxic dispersion moves beyond the localised area leading to potential exposure to humans or the natural environment.

Crisis management and communication procedures for chemical emergencies should be established.  The Common Inspection Criteria for Internal Emergency Planning provides detailed advice on criteria that inspectors can use to evaluate the operator’s crisis management and communication procedures in case of a toxic release.  For example, for each accident scenario, it is advisable to prepare an operating instruction describing methods and steps to follow to complete an action for all personnel (both internal and external) involved in executing the emergency plan.   There should be an emergency response card for each type of accident scenario (e.g., gas leak, pool fire, etc.) with instructions for the intervention team on what to do should such an incident occur.

Management of personnel safety.  As indicated in the CIC for Internal Emergency Planning Plan, there should be a personnel safety coordinator that oversees evacuation or shelter-in-place onsite, as well as all responsibilities associated with tracking and optimizing staff location and medical condition.  A specific team (minimum of two people, but potentially more on large sites) should be trained to handle personnel safety, directing the flow of workers and visitors to points of safety and exits as appropriate, and obtaining care and assistance for injured and disabled individuals.

The CIC for Internal Emergency Planning contains detailed criteria for conducting emergency drills and associated training.

Real-time crisis monitoring and decision-making.  The crisis management team should have specific criteria for making decisions regarding safety of personnel, in particular, whether to shelter-in-place or evacuate, and for that purpose, to identify safe vs. unsafe locations and buildings as well as safe exit pathways.  These criteria would be based primarily on actual or predicted concentrations reaching dangerous load levels in certain (or all) locations, but could also be supplemented by practical considerations, e.g., weather conditions, time of day, response activities going on simultaneously, etc. 

For this purpose, the operator should have the capability to monitor the evolution of the toxic dispersion on site, in particular the concentration and direction of the plume, via gas sensors in appropriate locations, with access to outputs via the control room but also remotely (e.g., via mobile phone).   In addition, the operator should have arrangements to ensure ongoing updates of weather conditions as well as specialists on hand that can calculate the future path and concentration levels at certain distances.   This information should also be used to determine when to alert the surrounding community and to assist the external authorities in making decisions about whether to activate shelter-in-place or evacuation orders.

Alarming the on-site and off-site population. The operator should have established an effective emergency warning system for the on-site population, and in many cases, depending on arrangements with external authorities, also the off-site population.  There should be training for on-site personnel on behavior in the case of a toxic release and also information provided to visitors on entering the site.   The system should be appropriately designed to be quickly transmitted during an emergency and to reach all personnel on site.

There are a variety of means for alerting the offsite population of a toxic release, and usually, a combination of warning mechanisms are used in order to maximize the ability to reach most or all of the affected population.  Typical mechanisms include sirens, voice-over broadcasts, radio broadcasts, and direct communication, e.g. neighbourhood-specific broadcasts or door-to-door communication. The operator should employ a strategy that is appropriate to the site’s location, e.g. its proximity to residents and businesses, and that is also well-coordinated with the external emergency authorities.  The offsite alert system should be supported by an education programme that teaches the general public how to recognize an alert or what to do if a warning is broadcast (as is already required for upper tier sites under Article XIV of the Seveso Directive). Taking into consideration the relevant reference scenarios, the operator should have identified the communities that should be alerted in its internal emergency response plan, if it has this responsibility.

There should be a clear understanding within the site about the difference between the gas alarm system and other alarm systems, such as fire alarms. In order to support the pre-defined evacuation/shelter-in-place actions, the workers should be able primarily to decide, what kind of alarm they hear.

 

REFERENCES

Wang, J., X. Yu, and R. Zong, 2020, A dynamic approach for evaluating the consequences of toxic gas dispersion in the chemical plants using CFD and evacuation modelling, Journal of Loss Prevention in the Process Industries, Volume 65, May 2020, 104156, https://doi.org/10.1016/j.jlp.2020.104156

 

 
   
Latest update: 5/12/2023 | Top | About this site | Legal notice | Privacy Statement | Accessibility | Cookies | Contacts | Search