- Email: [email protected]
Accidents, Causes of Accidents and Learning from SEVESO II Implementation
0957–5820/05/$30.00+0.00 # 2005 Institution of Chemical Engineers Trans IChemE, Part B, September 2005 Process Safety and Environmental Protection, 83(B5): 437– 442
www.icheme.org/journals doi: 10.1205/psep.04215
ACCIDENTS, CAUSES OF ACCIDENTS AND LEARNING FROM SEVESO II IMPLEMENTATION ´ NEK2 and V. FICBAUER2 F. BABINEC1 , L. IVA 1
Brno University of Technology, Faculty of Mechanical Engineering, Department of Metrology and Testing, Brno, Czech Republic 2 T –Risk, Ltd., Brno, Czech Republic
A
successful implementation of the SEVESO II Directive requires, apart from other things, the presence of real experts, i.e., authors of safety documentation and independent experts in reviewing the safety documentation, in the chemical process safety domain. The absence of such experts combined with continually escalating requirements of reviewing authorities (and IPPC Directive implementation) has major consequences for Czech industry. The result of such a state is a very low number of accepted safety documents, an absence of major risk insurance and a time delay in the implementation of process safety measures. The level of safety documentation reflects the level of the team that produces the documentation. For hazard identification assessment, inconsistent screening methods are often used. However, the demand for a detailed and demonstrative risk assessment within a complete safety documentation (programme, report, emergency plan) as expressed in SEVESO II Directive is a demand for a complex and detailed analytical safety study; a detailed hazard identification and risk assessment. Last major accidents in the Czech Republic certify the following significant problem: long-term absence of the 82/501/EEC—SEVESO (I) Council Directive in the Czech legislation, and, subsequently, a lack of safety culture (deficient sense of the necessity of prevention).
INTRODUCTION
. too broad a spectrum of various methods used for hazard identification and risk assessment (some of them inadequate and inconsistent).
EU countries have been implementing the Directive ‘On The Control of Major Accident Hazards Involving Dangerous Substances’ since 1982 (SEVESO Directive 82/501/EEC). New EU countries started implementing it recently. The Czech harmonized law No. 353/1999 Col. entered into force in January 2000. The principle of accident prevention lies in the background of the law in question. The detailed workout of the SEVESO Directives I and II and the experience of EU countries with the directives suggested that the introduction of the new law will not be a non-problematic matter. Czech experience with its implementation demonstrates justification of such a premise. The absence of the Council Directive 82/501/EEC— SEVESO (I) in the Czech legislation has the following long-term consequences:
Over and above, last major accidents in the Czech Republic certify a well-known, significant problem: the long-term absence of Council Directive 82/501/EEC—SEVESO I in the Czech legislation, and therefore a lack of a safety culture. The implementation of the prevention principles (via SEVESO II implementation) is a very important step for most Czech chemical establishments. For many companies, this directive presents a profound change in the safety securing and risk management.
ON THE DIRECTIVE IMPLEMENTATION On the basis of the sorely obtained experience it can be stated that the implementation of the SEVESO II Directive into the process and related industries is not a simple matter. This experience seems to be cognitive and, accordingly, very time-consuming, and therefore very expensive. Particularly for chemical and process establishments in the new EU countries, this directive represents a significant change in safety securing and risk management. However, its implementation is a complex and a complicated task not only from this point of view.
. a lack of a safety culture; . lack of real experts (experienced process safety engineers and simultaneously risk analysts);
Correspondence to: Dr F. Babinec, Brno University of Technology, Faculty of Mechanical Engineering, Department of Metrology and Testing, Technicka´ 2, 616 69 Brno, Czech Republic. E-mail: [email protected]
437
438
BABINEC et al.
To work out a detailed safety report (Papadakis and Amendola, 1997), a broad spectrum of information about management, quality, environment and safety is needed, so is a complex and detailed analytical study respecting one of the basic law of physics, the cause—consequence principle. Such a study represents a sequence of basic tasks in safety engineering: hazard identification, primary cause detection, scenarios identification, consequences estimation and quantitative risk assessment (Crowl and Louvar, 1990). The deadline for the implementation of the Czech SEVESO II Directive ‘On the Control of Major Accident Hazards Involving Dangerous Substances’ in the process and related industries was January 2002.
On Reviewing the Safety Documentation If the safety report produced by the SEVESO I Directive requirements was rather descriptive, then the purpose of the SEVESO II Directive safety report should be a detailed and demonstrative risk assessment with the use of generated accident scenarios. The first reviewing and assessing of the produced safety reports uncovered the following: . inadequate safety programmes (both content and conception) from the point of view of authorities; . description of major risk sources not satisfactorily detailed. After the first reviewing, all safety documentation (approximately 150 establishments) was returned to operators for updating and amendments. The following reviewing (the second and others) and assessing of the updated safety reports uncovered: . missing parts of the safety programmes, especially parts concerning — management of change, — check and audit, — human factor assessment; . description of major risk sources not satisfactorily detailed; . quantitative risk assessment not satisfactory — selection of major-accident risk sources missing, intuitive selection only (even though not all installations contribute significantly to the risk, it is worthwhile to include all of them), — basic input data for external emergency plan missing, — basic data for the land-use planning wanted, — inadequate consideration of causal conjunction cause-consequence (HAZOP, FMEA, What-If Analysis and so on wanted), — detailed risk sources identification missing, — hazardous scenarios identification wanted, — a survey of significant loss of containment events (a small loss of containment considered only), — generated scenarios represent operational problems rather than major-accident hazards, — consequences were considered with the use of screening methods only.
On the Milestones of Reviewing It is well known that continual improvement is the basic attribute of the ISO standards. The implementation of the Directive is not a one-shot action, but a complicated procedure, and such a procedure needs milestones. Continual improvement without milestones gives zero possibility of accepting safety documentation, insuring major risk in establishments and starting the realization of safety measures as suggested in the safety documentation. In reality, the quantity of accepted safety reports in the Czech Republic (January 2002– March 2004) is approximately 25%. On the basis of the amending No. 82/2004 Col., of the law No. 353/2004 Col. (mining activities and waste treatment should be included (if dangerous substances are used). The number of establishments under SEVESO II Directive in the Czech Republic is relatively high, but the number of accepted safety reports is still relatively low. On the other hand, such implementation results are not strange, especially for real experts. While some safety reports should only be completed, others are of a very low level and their implementation should start practically from the beginning. The cause of such a state is, first, the lack of real experts in industry, in reviewing personnel, consulting offices, in local authorities and so on. An experienced safety engineer (chemical/process engineer with safety engineering knowledge) should be a member of every major reviewing working team. The Position of Process Industry It is very useful to discuss the attitude of the industry on the procedure of the SEVESO II Directive implementation in the Czech Republic. Real experts from the industry warn that the implementation of the SEVESO Directive is a difficult task, not a nonproblematic matter. The retrospection of the implementation shows that process industries establishments were not prepared for the implementation (experts, experience, guidelines, methods, scenarios, consequences, acceptability criteria). Repeated revision of safety documentation prefers a description of establishments and major risk sources, not a detailed risk assessment. The descriptive part of the safety report should be appropriate and not covering the establishments and major risk sources inadequately. The operator produces the safety report to demonstrate that major-accident hazards have been identified and the necessary measures have been taken to prevent such accidents and to limit their consequences for humans and the environment. To publish detailed information on major risk sources is not the main goal of the safety documentation. The main reminders on the part of the industry: . escalating requirements on detailed establishment description; . description is preferred to risk assessment (adequate description and adequate hazard identification/risk assessment); . structure of the documentation—information for the reviewer rather than measures for chemical process safety improvement.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2005, 83(B5): 437–442
ACCIDENTS, CAUSES OF ACCIDENTS AND LEARNING FROM SEVESO II IMPLEMENTATION The land-use planning (article 12) is a significant article of the SEVESO II Directive. The land-use policies and procedure for the implementation of land use policies take into account the need of maintaining appropriate distances between establishments (covered by this Directive) and residential areas, areas of public use and areas of particular natural sensitivity or interest. In the case of the existing establishments and the existing residential areas, additional technical measures are applied so as not to increase the risk to people. A potential problem for the industry is the building of new residential areas in the vicinity of the existing establishments. ON SYSTEMATIC HAZARD IDENTIFICATION Generally, the demand for a detailed and demonstrative risk assessment in the safety documentation (programme, report, emergency plan) expressed in SEVESO II Directive is in fact a demand for a complex and detailed analytical safety study, a detailed hazard identification and risk assessment. Major hazard identification is a very important task from the safety aspect. Uncovered primary fault as the source of major risk is very dangerous because of recurrence. In practice, consequences of undetected and not removed primary causes are well-known. Major accidents and learning from such accidents play a significant role in industrial loss prevention philosophy. The level of loss prevention should be reflected in the level of safety documentation work-out on the basis of the SEVESO II Directive. The effectiveness of this approach should be tested in the process of the safety report and the safety programme acceptation. The basic query of the implementation is relatively simple: how were the requirements of the Directive 96/81/EC (SEVESO II) fulfilled? Unfortunately, only experts and specialists who participate in regular systematic study, for example HAZOP study, profit from systematic and detailed safety study. The number of such experts is small rather than large. However, there is one more profit of systematic study which seems to be hidden. The HAZOP study is a source of detailed information needed for next steps of the complex safety study. Separate acquisition of such information is very time consuming, if possible at all. For example, generation of event tree for post-accident scenarios, parameters of apparatus, pipelines and so on, could be started from the HAZOP study, because specialists with the knowledge needed participate in the HAZOP study. The HAZOP study is an effective tool for human errors identification. This systematic and very careful approach to hazard identification is the way to identify human errors.
´ stı´ n/L Large fire (resins production)—Spolchemie U (21 November 2002) Nitrobenzene explosion—Ostrava (26 December 2002) SPOLANA Accident The SPOLANA establishment produces chlorine which is stored in cylindrical pressure vessels with capacity 80 tons each. In the year 2002, SPOLANA operated two storage houses, one new and one old; five cylindrical vessels were located in each storage house. The storage houses were designed and built up with the emphasis and with the respect to the level of flooding water in this locality (it means with respect to the so called ‘hundred years’ water—the level of flooding water with the indicated frequency). In this location, higher flooding water than the ‘hundred years’ water’ had never been experienced. In the case of such level of flooding water, both the storage houses were operated safely, but the antecedent experience of 15 August 2002, confirmed the justification of flooding water assumption in the design of chlorine storehouses. SPOLANA operated and operates emergency technology to convert gaseous chlorine to hypochlorite. This continually operated technology allows to exhaust gaseous chlorine from the storage houses and to convert the chlorine to safer hypochlorite. The production of the chlorine was stopped on 2 August 2002, because of complications on PVC production line.
Time axis 12 August 2002, 19:05 13 August 2002, 17:15 10:21
14 August 2002, 02:56 10:32 19:00 20:00 15 August 2002
ON LAST MAJOR ACCIDENTS IN THE CZECH REPUBLIC The process of the SEVESO II Directive implementation was significantly influenced by the following major accidents in the process industry: Flood, large release of chlorine—Spolana Neratovice (15 August 2002)
439
First degree of flood activity, forecast: max. ‘hundred years’ water’ Second degree of flood activity Confirmation from the ‘River-basin Elbe Agency’—max. ‘hundred years’ water’ Third degree of flood activity Regular electric power disconnection River level measurement out of operation 90% of the SPOLANA area under flood water afflux velocity: 30 40 cm/hour Flood water culmination, level approximately 1.3 m higher than the ‘hundred years’ water’
Release of chlorine 15 August 2002, 10:00 12:10
Storage tank No. 10 under water, other tanks float on water Large release (80 tons) of chlorine from tank No. 10
Trans IChemE, Part B, Process Safety and Environmental Protection, 2005, 83(B5): 437–442
440
BABINEC et al.
Consequences
Consequences
Storage house completely destroyed Release of chlorine from tank No. 10 No fatal accident (whole area evacuated because of the flooding)
. UP II building and technology completely destroyed. . Demolition and decontamination of the UP II building necessary. . Business interrupted.
Measures taken after the accident Storehouse reconstruction New arrangement for chlorine storage vessels (individually flooding vessel) Pipeline reconstruction Stop button in control room and at the workplace for operating personnel Installation of remotely operated valves Gas-proof (tight) input doors SPOLCHEMIE Accident The Spolchemie Corporation is one of the oldest chemical establishments in the Czech Republic. The site of Spolchemie has been occupied since 1856. Over the years, the area near the site developed, and now Spolchemie lies practically in the centre of the city of ´ stı´ nad Labem. The site is used for manufacturing inorU ganic chemical products, epichlorohydrin, epoxy, polyester and alkyd resins, organic colouring substances and special products such as mono-crystals. Significant productions are those of various resins. The production of low molecular epoxy resins with low viscosity CHS Epoxy RR 700 was located in U II building. The first step in the RR 700 manufacturing is the addition reaction between epichlorohydrin and hexandiol þ catalyst. This exothermic chemical reaction is considered as moderately exothermic. A significant apparatus in this technology is reactor R. Because of epichlorohydrin properties (carcinogen category 2), all the input material is batched at the beginning of the first step. The accident occurred at the beginning of the addition reaction, after batching and heating of the reaction mixture. Sequence:
Nitrobenzene Accident The nitrobenzene production plant is commercially operated in Ostrava. The technology of the adiabatic nitrobenzene production consist of the following main stages: benzene feeding, nitration (production of nitrobenzene from benzene and nitric acid), separation þ discharge of nitrobenzene and sulphuric acid re-concentration and circulation. After the reaction, the mixture consists of nitrobenzene þ acid (two phases: nitrobenzene/benzene phase and sulphuric acid phase). Due to lower density, the organic phase is separated by gravity from sulphuric acid and leaves the separator at the top. Sulphuric acid with traces of the nitrobenzene/benzene is discharged to the circulation stage at the bottom of the separator. The significant equipment concerning the circulation stage is the drain/buffer tank (glasslined steel), which is connected to the sulphuric acid circulation line. Sulphuric acid is drained from the vacuum system into the drain/ buffer tank, which compensates for the thermal expansion of the acid and acid losses in the system. Due to the temperature differences in the technological process, organic compounds may separate in the upper phase of the drain/ buffer tank. Course of accident: 24 December 2002, morning 24 December 2002, evening
Unit in normal operation Regular hot shut-down, benzene insufficiency Monitoring of the temperature in drain/buffer tank normal
. Non-standard technological procedure in the charge of epichlorohydrin from vessel H to reactor R, because of the content of water in epichlorohydrin. . Distillation of epichlorohydrin ! from reactor R to storage/separator ! returned to reactor R (amount of anhydrous epichlorohydrin in reactor higher than batch). . The overcharge of epichlorohydrin transported from reactor R to vessel/receiver H. . After this operation output valves (butterfly and ball valve) remained open, human error (in heated part of the output piping—epichlorohydrin). . Catalyst þ hexandiol þ heated epichlorohydrin in piping. . Extremely exothermic reaction, rupture of output piping from reactor. . Release of the batch on the floor, from the small fire— fire engulfing the UP II building. Time: 21 January 2002, 20:52—first signal 22 January 2002, 05:00—fire localized
Figure 1. Simplified flow diagram.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2005, 83(B5): 437–442
ACCIDENTS, CAUSES OF ACCIDENTS AND LEARNING FROM SEVESO II IMPLEMENTATION Climatic conditions: 25 December 2002, afternoon
Very low temperature (– 208C), snow cover Regular cold shut-down, benzene insufficiency All apparatus drain to the drain/ buffer tank Pipeline frozen from the heat exchanger to buffer tank (failure—steam valve leakage) Uncontrollable water overflow to drain/buffer tank Increasing temperature in drain/ buffer tank (heat of dilution, water to concentrated sulphuric acid) Explosion of drain/buffer tank (nitrobenzene, nitrophenol in the organic level, exothermic decomposition, higher temperature—higher speed of decomposition, gaseous products of decomposition. Increased pressure—rupture of the drain/buffer vessel).
Consequences: . adiabatic nitrobenzene production line destroyed; . no fatal accident. Explosion: Fragments of equipment—area up to 90 m, with one exception up to 300 m. Pressure wave—broken windows, following roof flashing defects.
TO LAST ACCIDENTS It can be stated that some of the establishments mentioned in this article were systematically analysed. HAZOP itself is the toll for a systematic and careful hazard identification (Kletz, 1992). However, it should be considered that HAZOP also has a frame. In the case of SPOLANA accident, the flooding water was considered with respect to the ‘hundred years’ water’. Storage houses were designed and safely operated with respect to this level of flooding water.
441
The consideration of a higher level of flooding water (or other extreme weather conditions) is a problematic matter. If we talk about a ‘higher’ flooding water than known (a hundred years’ water), the question is what level should be considered. In the case of Spolana, a half a metre higher flooding water is still relatively safe. However, a level about 1.3 m higher suggests a qualitatively different situation and, unfortunately, a major accident. The confirmation of the ‘River-Basin Elbe Agency’ (maximum ‘a hundred years’ water’) had a vital impact on the Spolana management decision at the time of the on-coming flooding water. Technical solution of the problem in question is known and was applied in the storage house reconstruction. Finally, systematic hazard identification should also consider extreme weather conditions. A possible way is the identification of extreme conditions when the process safety is changed and the preparation of organizational and technical procedures to minimize the consequences. The Spolchemie accident is probably a typical example of human error. In the case of batch processes and variability in technology of production, human factor seems to be very significant. The installed water monitors were very effective in the case of fire; the escalation of large fire was under control. Accident investigation in chemical process safety domain is work for a team of experts, not for individuals. Procedures for accident investigation are well-known and the application of recommended methods is based on team work. A hidden problem in all the accidents is probably the management of change. The implementation of the rules for hazard identification and risk assessment in the cases of process modification and changes in production technology is a very current but also a very time-consuming task. Last major accidents in the Czech Republic certify a well-known significant problem: the long-term absence of Council Directive 82/501/EEC—SEVESO I in Czech legislation, and therefore a deficient sense of prevention necessity. The prevention is the only possible and rational approach of enterprises. Management edification is needed, especially for medium enterprises. A very significant role in the Directive application is played by district appointments. Education and edification of responsible personnel remains to be a current problem.
CONCLUSION The number of establishments under SEVESO II Directive in the Czech Republic is relatively high. It cannot be expected that the level of safety documentation will be excellent in all the establishments. Nevertheless, the number of accepted safety reports is very low. The level of the safety documentation differs from establishment to establishment. However, the management of the establishment can select one of the following approaches to upgrade safety documentation:
Figure 2. The frame of the HAZOP study.
. internal specialists in establishment; . external service of suppliers with good references; . combination of both (e.g., using consultations).
Trans IChemE, Part B, Process Safety and Environmental Protection, 2005, 83(B5): 437–442
442
BABINEC et al.
The amending of Czech version of SEVESO II Directive (law No. 353/1999 Col.) calls for safety documentation updating. However, finance is needed for new or updated safety documentation. The general level of safety documentation reflects also the level of the reviewers. There is low guarantee of qualified assessment. Simply, there are no additional reviewing experts. The assessment of the basic goal of safety documentation—the identification of major accident risk—is a very difficult task. A formal review and assessment of documentation cannot guarantee this goal. An entirely different task is the so-called management of change, which occurs at the moment of requirement for a new safety assessment (a modification of technology, new apparatus, technological upgrades, and so on). A totally new assessment is time-consuming and expensive, but social, economical and environmental losses would certainly be much more expensive. The detailed workout of the SEVESO directives and the EU countries’ experience with the directives suggest that the implementation of the SEVESO II directive in the Czech process industry is a problematic matter, especially as: . it is necessary to guarantee education in the field of hazard identification and hazard evaluation for the supervisors;
. education of the responsible persons in industry may be now considered a necessary step in support of the safety culture improvement. REFERENCES Crowl, A.D. and Louvar, J.F., 1990, Chemical Process Safety. Fundamentals with Applications (Prentice Hall, New Jersey, USA). Kletz, T.A., 1992, Hazop and Hazan, Identifying and Assessing Process Industry Hazards, 3rd edition (Institution of Chemical Engineers, Rugby, UK). Lees, F.P., 1996, Loss Prevention in the Process Industries, 2nd edition (Butterworths, Heinemann, London, UK). Papadakis, G.A. and Amendola, A., 1997, Guidance on the Preparation of a Safety Report to Meet the Requirements of Council Directive 96/82/EC (Joint Research Centre European Commission, Italy). No. 353/1999 Col., Czech Law ‘On The Control of Major Accident Hazards Involving Dangerous Substances and on the Changes in District Offices’, Vol. 111, 7609. No. 82/2004 Col., Czech Law ‘On The Control of Major Accident Hazards Involving Dangerous Substances and on the Changes in District Offices’, Vol. 25, 1217. 82/501/EEC SEVESO Directive, ‘On the Major Accident Hazards of Certain Industrial Activities’, Official Journal of the European Communities, No. 1, 230/1. 96/82/EC SEVESO II Directive, ‘On The Control of Major Accident Hazards Involving Dangerous Substances’, Official Journal of the European Communities, No. 1, 10/13. The manuscript was received 13 August 2004 and accepted for publication after revision 6 July 2005.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2005, 83(B5): 437–442
www.icheme.org/journals doi: 10.1205/psep.04215
ACCIDENTS, CAUSES OF ACCIDENTS AND LEARNING FROM SEVESO II IMPLEMENTATION ´ NEK2 and V. FICBAUER2 F. BABINEC1 , L. IVA 1
Brno University of Technology, Faculty of Mechanical Engineering, Department of Metrology and Testing, Brno, Czech Republic 2 T –Risk, Ltd., Brno, Czech Republic
A
successful implementation of the SEVESO II Directive requires, apart from other things, the presence of real experts, i.e., authors of safety documentation and independent experts in reviewing the safety documentation, in the chemical process safety domain. The absence of such experts combined with continually escalating requirements of reviewing authorities (and IPPC Directive implementation) has major consequences for Czech industry. The result of such a state is a very low number of accepted safety documents, an absence of major risk insurance and a time delay in the implementation of process safety measures. The level of safety documentation reflects the level of the team that produces the documentation. For hazard identification assessment, inconsistent screening methods are often used. However, the demand for a detailed and demonstrative risk assessment within a complete safety documentation (programme, report, emergency plan) as expressed in SEVESO II Directive is a demand for a complex and detailed analytical safety study; a detailed hazard identification and risk assessment. Last major accidents in the Czech Republic certify the following significant problem: long-term absence of the 82/501/EEC—SEVESO (I) Council Directive in the Czech legislation, and, subsequently, a lack of safety culture (deficient sense of the necessity of prevention).
INTRODUCTION
. too broad a spectrum of various methods used for hazard identification and risk assessment (some of them inadequate and inconsistent).
EU countries have been implementing the Directive ‘On The Control of Major Accident Hazards Involving Dangerous Substances’ since 1982 (SEVESO Directive 82/501/EEC). New EU countries started implementing it recently. The Czech harmonized law No. 353/1999 Col. entered into force in January 2000. The principle of accident prevention lies in the background of the law in question. The detailed workout of the SEVESO Directives I and II and the experience of EU countries with the directives suggested that the introduction of the new law will not be a non-problematic matter. Czech experience with its implementation demonstrates justification of such a premise. The absence of the Council Directive 82/501/EEC— SEVESO (I) in the Czech legislation has the following long-term consequences:
Over and above, last major accidents in the Czech Republic certify a well-known, significant problem: the long-term absence of Council Directive 82/501/EEC—SEVESO I in the Czech legislation, and therefore a lack of a safety culture. The implementation of the prevention principles (via SEVESO II implementation) is a very important step for most Czech chemical establishments. For many companies, this directive presents a profound change in the safety securing and risk management.
ON THE DIRECTIVE IMPLEMENTATION On the basis of the sorely obtained experience it can be stated that the implementation of the SEVESO II Directive into the process and related industries is not a simple matter. This experience seems to be cognitive and, accordingly, very time-consuming, and therefore very expensive. Particularly for chemical and process establishments in the new EU countries, this directive represents a significant change in safety securing and risk management. However, its implementation is a complex and a complicated task not only from this point of view.
. a lack of a safety culture; . lack of real experts (experienced process safety engineers and simultaneously risk analysts);
Correspondence to: Dr F. Babinec, Brno University of Technology, Faculty of Mechanical Engineering, Department of Metrology and Testing, Technicka´ 2, 616 69 Brno, Czech Republic. E-mail: [email protected]
437
438
BABINEC et al.
To work out a detailed safety report (Papadakis and Amendola, 1997), a broad spectrum of information about management, quality, environment and safety is needed, so is a complex and detailed analytical study respecting one of the basic law of physics, the cause—consequence principle. Such a study represents a sequence of basic tasks in safety engineering: hazard identification, primary cause detection, scenarios identification, consequences estimation and quantitative risk assessment (Crowl and Louvar, 1990). The deadline for the implementation of the Czech SEVESO II Directive ‘On the Control of Major Accident Hazards Involving Dangerous Substances’ in the process and related industries was January 2002.
On Reviewing the Safety Documentation If the safety report produced by the SEVESO I Directive requirements was rather descriptive, then the purpose of the SEVESO II Directive safety report should be a detailed and demonstrative risk assessment with the use of generated accident scenarios. The first reviewing and assessing of the produced safety reports uncovered the following: . inadequate safety programmes (both content and conception) from the point of view of authorities; . description of major risk sources not satisfactorily detailed. After the first reviewing, all safety documentation (approximately 150 establishments) was returned to operators for updating and amendments. The following reviewing (the second and others) and assessing of the updated safety reports uncovered: . missing parts of the safety programmes, especially parts concerning — management of change, — check and audit, — human factor assessment; . description of major risk sources not satisfactorily detailed; . quantitative risk assessment not satisfactory — selection of major-accident risk sources missing, intuitive selection only (even though not all installations contribute significantly to the risk, it is worthwhile to include all of them), — basic input data for external emergency plan missing, — basic data for the land-use planning wanted, — inadequate consideration of causal conjunction cause-consequence (HAZOP, FMEA, What-If Analysis and so on wanted), — detailed risk sources identification missing, — hazardous scenarios identification wanted, — a survey of significant loss of containment events (a small loss of containment considered only), — generated scenarios represent operational problems rather than major-accident hazards, — consequences were considered with the use of screening methods only.
On the Milestones of Reviewing It is well known that continual improvement is the basic attribute of the ISO standards. The implementation of the Directive is not a one-shot action, but a complicated procedure, and such a procedure needs milestones. Continual improvement without milestones gives zero possibility of accepting safety documentation, insuring major risk in establishments and starting the realization of safety measures as suggested in the safety documentation. In reality, the quantity of accepted safety reports in the Czech Republic (January 2002– March 2004) is approximately 25%. On the basis of the amending No. 82/2004 Col., of the law No. 353/2004 Col. (mining activities and waste treatment should be included (if dangerous substances are used). The number of establishments under SEVESO II Directive in the Czech Republic is relatively high, but the number of accepted safety reports is still relatively low. On the other hand, such implementation results are not strange, especially for real experts. While some safety reports should only be completed, others are of a very low level and their implementation should start practically from the beginning. The cause of such a state is, first, the lack of real experts in industry, in reviewing personnel, consulting offices, in local authorities and so on. An experienced safety engineer (chemical/process engineer with safety engineering knowledge) should be a member of every major reviewing working team. The Position of Process Industry It is very useful to discuss the attitude of the industry on the procedure of the SEVESO II Directive implementation in the Czech Republic. Real experts from the industry warn that the implementation of the SEVESO Directive is a difficult task, not a nonproblematic matter. The retrospection of the implementation shows that process industries establishments were not prepared for the implementation (experts, experience, guidelines, methods, scenarios, consequences, acceptability criteria). Repeated revision of safety documentation prefers a description of establishments and major risk sources, not a detailed risk assessment. The descriptive part of the safety report should be appropriate and not covering the establishments and major risk sources inadequately. The operator produces the safety report to demonstrate that major-accident hazards have been identified and the necessary measures have been taken to prevent such accidents and to limit their consequences for humans and the environment. To publish detailed information on major risk sources is not the main goal of the safety documentation. The main reminders on the part of the industry: . escalating requirements on detailed establishment description; . description is preferred to risk assessment (adequate description and adequate hazard identification/risk assessment); . structure of the documentation—information for the reviewer rather than measures for chemical process safety improvement.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2005, 83(B5): 437–442
ACCIDENTS, CAUSES OF ACCIDENTS AND LEARNING FROM SEVESO II IMPLEMENTATION The land-use planning (article 12) is a significant article of the SEVESO II Directive. The land-use policies and procedure for the implementation of land use policies take into account the need of maintaining appropriate distances between establishments (covered by this Directive) and residential areas, areas of public use and areas of particular natural sensitivity or interest. In the case of the existing establishments and the existing residential areas, additional technical measures are applied so as not to increase the risk to people. A potential problem for the industry is the building of new residential areas in the vicinity of the existing establishments. ON SYSTEMATIC HAZARD IDENTIFICATION Generally, the demand for a detailed and demonstrative risk assessment in the safety documentation (programme, report, emergency plan) expressed in SEVESO II Directive is in fact a demand for a complex and detailed analytical safety study, a detailed hazard identification and risk assessment. Major hazard identification is a very important task from the safety aspect. Uncovered primary fault as the source of major risk is very dangerous because of recurrence. In practice, consequences of undetected and not removed primary causes are well-known. Major accidents and learning from such accidents play a significant role in industrial loss prevention philosophy. The level of loss prevention should be reflected in the level of safety documentation work-out on the basis of the SEVESO II Directive. The effectiveness of this approach should be tested in the process of the safety report and the safety programme acceptation. The basic query of the implementation is relatively simple: how were the requirements of the Directive 96/81/EC (SEVESO II) fulfilled? Unfortunately, only experts and specialists who participate in regular systematic study, for example HAZOP study, profit from systematic and detailed safety study. The number of such experts is small rather than large. However, there is one more profit of systematic study which seems to be hidden. The HAZOP study is a source of detailed information needed for next steps of the complex safety study. Separate acquisition of such information is very time consuming, if possible at all. For example, generation of event tree for post-accident scenarios, parameters of apparatus, pipelines and so on, could be started from the HAZOP study, because specialists with the knowledge needed participate in the HAZOP study. The HAZOP study is an effective tool for human errors identification. This systematic and very careful approach to hazard identification is the way to identify human errors.
´ stı´ n/L Large fire (resins production)—Spolchemie U (21 November 2002) Nitrobenzene explosion—Ostrava (26 December 2002) SPOLANA Accident The SPOLANA establishment produces chlorine which is stored in cylindrical pressure vessels with capacity 80 tons each. In the year 2002, SPOLANA operated two storage houses, one new and one old; five cylindrical vessels were located in each storage house. The storage houses were designed and built up with the emphasis and with the respect to the level of flooding water in this locality (it means with respect to the so called ‘hundred years’ water—the level of flooding water with the indicated frequency). In this location, higher flooding water than the ‘hundred years’ water’ had never been experienced. In the case of such level of flooding water, both the storage houses were operated safely, but the antecedent experience of 15 August 2002, confirmed the justification of flooding water assumption in the design of chlorine storehouses. SPOLANA operated and operates emergency technology to convert gaseous chlorine to hypochlorite. This continually operated technology allows to exhaust gaseous chlorine from the storage houses and to convert the chlorine to safer hypochlorite. The production of the chlorine was stopped on 2 August 2002, because of complications on PVC production line.
Time axis 12 August 2002, 19:05 13 August 2002, 17:15 10:21
14 August 2002, 02:56 10:32 19:00 20:00 15 August 2002
ON LAST MAJOR ACCIDENTS IN THE CZECH REPUBLIC The process of the SEVESO II Directive implementation was significantly influenced by the following major accidents in the process industry: Flood, large release of chlorine—Spolana Neratovice (15 August 2002)
439
First degree of flood activity, forecast: max. ‘hundred years’ water’ Second degree of flood activity Confirmation from the ‘River-basin Elbe Agency’—max. ‘hundred years’ water’ Third degree of flood activity Regular electric power disconnection River level measurement out of operation 90% of the SPOLANA area under flood water afflux velocity: 30 40 cm/hour Flood water culmination, level approximately 1.3 m higher than the ‘hundred years’ water’
Release of chlorine 15 August 2002, 10:00 12:10
Storage tank No. 10 under water, other tanks float on water Large release (80 tons) of chlorine from tank No. 10
Trans IChemE, Part B, Process Safety and Environmental Protection, 2005, 83(B5): 437–442
440
BABINEC et al.
Consequences
Consequences
Storage house completely destroyed Release of chlorine from tank No. 10 No fatal accident (whole area evacuated because of the flooding)
. UP II building and technology completely destroyed. . Demolition and decontamination of the UP II building necessary. . Business interrupted.
Measures taken after the accident Storehouse reconstruction New arrangement for chlorine storage vessels (individually flooding vessel) Pipeline reconstruction Stop button in control room and at the workplace for operating personnel Installation of remotely operated valves Gas-proof (tight) input doors SPOLCHEMIE Accident The Spolchemie Corporation is one of the oldest chemical establishments in the Czech Republic. The site of Spolchemie has been occupied since 1856. Over the years, the area near the site developed, and now Spolchemie lies practically in the centre of the city of ´ stı´ nad Labem. The site is used for manufacturing inorU ganic chemical products, epichlorohydrin, epoxy, polyester and alkyd resins, organic colouring substances and special products such as mono-crystals. Significant productions are those of various resins. The production of low molecular epoxy resins with low viscosity CHS Epoxy RR 700 was located in U II building. The first step in the RR 700 manufacturing is the addition reaction between epichlorohydrin and hexandiol þ catalyst. This exothermic chemical reaction is considered as moderately exothermic. A significant apparatus in this technology is reactor R. Because of epichlorohydrin properties (carcinogen category 2), all the input material is batched at the beginning of the first step. The accident occurred at the beginning of the addition reaction, after batching and heating of the reaction mixture. Sequence:
Nitrobenzene Accident The nitrobenzene production plant is commercially operated in Ostrava. The technology of the adiabatic nitrobenzene production consist of the following main stages: benzene feeding, nitration (production of nitrobenzene from benzene and nitric acid), separation þ discharge of nitrobenzene and sulphuric acid re-concentration and circulation. After the reaction, the mixture consists of nitrobenzene þ acid (two phases: nitrobenzene/benzene phase and sulphuric acid phase). Due to lower density, the organic phase is separated by gravity from sulphuric acid and leaves the separator at the top. Sulphuric acid with traces of the nitrobenzene/benzene is discharged to the circulation stage at the bottom of the separator. The significant equipment concerning the circulation stage is the drain/buffer tank (glasslined steel), which is connected to the sulphuric acid circulation line. Sulphuric acid is drained from the vacuum system into the drain/ buffer tank, which compensates for the thermal expansion of the acid and acid losses in the system. Due to the temperature differences in the technological process, organic compounds may separate in the upper phase of the drain/ buffer tank. Course of accident: 24 December 2002, morning 24 December 2002, evening
Unit in normal operation Regular hot shut-down, benzene insufficiency Monitoring of the temperature in drain/buffer tank normal
. Non-standard technological procedure in the charge of epichlorohydrin from vessel H to reactor R, because of the content of water in epichlorohydrin. . Distillation of epichlorohydrin ! from reactor R to storage/separator ! returned to reactor R (amount of anhydrous epichlorohydrin in reactor higher than batch). . The overcharge of epichlorohydrin transported from reactor R to vessel/receiver H. . After this operation output valves (butterfly and ball valve) remained open, human error (in heated part of the output piping—epichlorohydrin). . Catalyst þ hexandiol þ heated epichlorohydrin in piping. . Extremely exothermic reaction, rupture of output piping from reactor. . Release of the batch on the floor, from the small fire— fire engulfing the UP II building. Time: 21 January 2002, 20:52—first signal 22 January 2002, 05:00—fire localized
Figure 1. Simplified flow diagram.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2005, 83(B5): 437–442
ACCIDENTS, CAUSES OF ACCIDENTS AND LEARNING FROM SEVESO II IMPLEMENTATION Climatic conditions: 25 December 2002, afternoon
Very low temperature (– 208C), snow cover Regular cold shut-down, benzene insufficiency All apparatus drain to the drain/ buffer tank Pipeline frozen from the heat exchanger to buffer tank (failure—steam valve leakage) Uncontrollable water overflow to drain/buffer tank Increasing temperature in drain/ buffer tank (heat of dilution, water to concentrated sulphuric acid) Explosion of drain/buffer tank (nitrobenzene, nitrophenol in the organic level, exothermic decomposition, higher temperature—higher speed of decomposition, gaseous products of decomposition. Increased pressure—rupture of the drain/buffer vessel).
Consequences: . adiabatic nitrobenzene production line destroyed; . no fatal accident. Explosion: Fragments of equipment—area up to 90 m, with one exception up to 300 m. Pressure wave—broken windows, following roof flashing defects.
TO LAST ACCIDENTS It can be stated that some of the establishments mentioned in this article were systematically analysed. HAZOP itself is the toll for a systematic and careful hazard identification (Kletz, 1992). However, it should be considered that HAZOP also has a frame. In the case of SPOLANA accident, the flooding water was considered with respect to the ‘hundred years’ water’. Storage houses were designed and safely operated with respect to this level of flooding water.
441
The consideration of a higher level of flooding water (or other extreme weather conditions) is a problematic matter. If we talk about a ‘higher’ flooding water than known (a hundred years’ water), the question is what level should be considered. In the case of Spolana, a half a metre higher flooding water is still relatively safe. However, a level about 1.3 m higher suggests a qualitatively different situation and, unfortunately, a major accident. The confirmation of the ‘River-Basin Elbe Agency’ (maximum ‘a hundred years’ water’) had a vital impact on the Spolana management decision at the time of the on-coming flooding water. Technical solution of the problem in question is known and was applied in the storage house reconstruction. Finally, systematic hazard identification should also consider extreme weather conditions. A possible way is the identification of extreme conditions when the process safety is changed and the preparation of organizational and technical procedures to minimize the consequences. The Spolchemie accident is probably a typical example of human error. In the case of batch processes and variability in technology of production, human factor seems to be very significant. The installed water monitors were very effective in the case of fire; the escalation of large fire was under control. Accident investigation in chemical process safety domain is work for a team of experts, not for individuals. Procedures for accident investigation are well-known and the application of recommended methods is based on team work. A hidden problem in all the accidents is probably the management of change. The implementation of the rules for hazard identification and risk assessment in the cases of process modification and changes in production technology is a very current but also a very time-consuming task. Last major accidents in the Czech Republic certify a well-known significant problem: the long-term absence of Council Directive 82/501/EEC—SEVESO I in Czech legislation, and therefore a deficient sense of prevention necessity. The prevention is the only possible and rational approach of enterprises. Management edification is needed, especially for medium enterprises. A very significant role in the Directive application is played by district appointments. Education and edification of responsible personnel remains to be a current problem.
CONCLUSION The number of establishments under SEVESO II Directive in the Czech Republic is relatively high. It cannot be expected that the level of safety documentation will be excellent in all the establishments. Nevertheless, the number of accepted safety reports is very low. The level of the safety documentation differs from establishment to establishment. However, the management of the establishment can select one of the following approaches to upgrade safety documentation:
Figure 2. The frame of the HAZOP study.
. internal specialists in establishment; . external service of suppliers with good references; . combination of both (e.g., using consultations).
Trans IChemE, Part B, Process Safety and Environmental Protection, 2005, 83(B5): 437–442
442
BABINEC et al.
The amending of Czech version of SEVESO II Directive (law No. 353/1999 Col.) calls for safety documentation updating. However, finance is needed for new or updated safety documentation. The general level of safety documentation reflects also the level of the reviewers. There is low guarantee of qualified assessment. Simply, there are no additional reviewing experts. The assessment of the basic goal of safety documentation—the identification of major accident risk—is a very difficult task. A formal review and assessment of documentation cannot guarantee this goal. An entirely different task is the so-called management of change, which occurs at the moment of requirement for a new safety assessment (a modification of technology, new apparatus, technological upgrades, and so on). A totally new assessment is time-consuming and expensive, but social, economical and environmental losses would certainly be much more expensive. The detailed workout of the SEVESO directives and the EU countries’ experience with the directives suggest that the implementation of the SEVESO II directive in the Czech process industry is a problematic matter, especially as: . it is necessary to guarantee education in the field of hazard identification and hazard evaluation for the supervisors;
. education of the responsible persons in industry may be now considered a necessary step in support of the safety culture improvement. REFERENCES Crowl, A.D. and Louvar, J.F., 1990, Chemical Process Safety. Fundamentals with Applications (Prentice Hall, New Jersey, USA). Kletz, T.A., 1992, Hazop and Hazan, Identifying and Assessing Process Industry Hazards, 3rd edition (Institution of Chemical Engineers, Rugby, UK). Lees, F.P., 1996, Loss Prevention in the Process Industries, 2nd edition (Butterworths, Heinemann, London, UK). Papadakis, G.A. and Amendola, A., 1997, Guidance on the Preparation of a Safety Report to Meet the Requirements of Council Directive 96/82/EC (Joint Research Centre European Commission, Italy). No. 353/1999 Col., Czech Law ‘On The Control of Major Accident Hazards Involving Dangerous Substances and on the Changes in District Offices’, Vol. 111, 7609. No. 82/2004 Col., Czech Law ‘On The Control of Major Accident Hazards Involving Dangerous Substances and on the Changes in District Offices’, Vol. 25, 1217. 82/501/EEC SEVESO Directive, ‘On the Major Accident Hazards of Certain Industrial Activities’, Official Journal of the European Communities, No. 1, 230/1. 96/82/EC SEVESO II Directive, ‘On The Control of Major Accident Hazards Involving Dangerous Substances’, Official Journal of the European Communities, No. 1, 10/13. The manuscript was received 13 August 2004 and accepted for publication after revision 6 July 2005.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2005, 83(B5): 437–442