Emergency Planning for Industrial Hazards

EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Proceedings of the European Conference on Emergency Planning for Industrial Hazards, organised by the Commission of the European Communities (Directorate-General Environment, Consumer Protection and Nuclear Safety (DG XI) in collaboration with the Joint Research Centre (JRC) Ispra Establishment) and held at the Congress Centre, Villa Ponti, Varese, Italy, 4–6 November 1987. TECHNICAL COMMITTEE A.AMENDOLA A.BAUN G.CAPRIULO G.DEL BINO

CEC-JRC, Ispra, Italy National Police, Denmark Department of Civil Protection, Italy CEC-DG XI (Chairman), Bruxelles, Belgium M.GENESCO Ministry of the Interior, France J.HEFFERNAN Department of Labour, Ireland R.KAY Health and Safety Executive, Great Britain K.B.KRISTOFFERSEN Civil Defence Corp., Denmark P.LAGADEC Ecole Polytechnique, France L.ALCON Ministry of the Interior, Spain H.J.PETTELKAU Ministry of Environment Nature Protection and Reactor Safety, Federal Republic of Germany E.L.QUARANTELLI Disaster Research Center, USA A.SAMAIN Ministry of Public Health and Environment, Belgium H.SCHNADT TÜV Rheinland, Federal Republic of Germany J.NICOLAU National Service for Civil Protection, Portugal MRS P.TESTORI CEC-DG XI, Bruxelles, Belgium G.VOLTA CEC-JRC Ispra, Italy C.J.VAN KUIJEN Ministry of Housing, Physical Planning and Environment, The Netherlands M.VASSILOPOULOS Ministry of the Environment, Greece B.WYNNE University of Lancaster, Great Britain LOCAL ORGANISING COMMITTEE H.B.F.GOW MRS A.MANARA

CEC-JRC Ispra, Italy CEC-JRC Ispra, Public Press, Italy

Relations

and

iii

MRS M.P.MORETTI CEC-JRC Ispra, Public Relations Press, Italy T.SMYRNIOTIS CEC-DG XI, Bruxelles, Belgium

and

EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS Edited by

H.B.F.GOW CEC Joint Research Centre, Ispra Establishment, Ispra (VA), Italy and R.W.KAY Formerly Health and Safety Executive, London, UK

ELSEVIER APPLIED SCIENCE LONDON and NEW YORK

ELSEVIER SCIENCE PUBLISHERS LTD Crown House, Linton Road, Barking, Essex IG11 8JU, England This edition published in the Taylor & Francis e-Library, 2005. “To purchase your own copy of this or any of Taylor & Francis or Routledge’s collection of thousands of eBooks please go to www.eBookstore.tandf.co.uk.” Sole Distributor in the USA and Canada ELSEVIER SCIENCE PUBLISHING CO., INC. 52 Vanderbilt Avenue, New York, NY 10017, USA WITH 19 TABLES AND 39 ILLUSTRATIONS © 1988 ECSC, EEC, EAEC, BRUSSELS AND LUXEMBOURG British Library Cataloguing in Publication Data European Conference on Emergency Planning for Industrial Accidents. Emergency planning for industrial hazards. 1. Chemical engineering plants. Accidents. Emergency action I. Title II. Commission of the European Communities. Consumer Protection and Nuclear Safety. Commission of the European Communities. Joint Research Centre. Ispra Establishment. Gow, H.B.F. Kay, R.W. 363.1′1966028 ISBN 0-203-21605-9 Master e-book ISBN

ISBN 0-203-27238-2 (Adobe eReader Format) ISBN 1-85166-260-X (Print Edition) Library of Congress CIP data applied for Publication arrangements by Commission of the European Communities, Directorate-General Telecommunications, Information Industries and Innovation, Scientific and Technical Communications Service, Luxembourg. EUR 11591 EN LEGAL NOTICE Neither the Commission of the European Communities nor any person acting on behalf of the Commission is responsible for the use which might be made of the following information. No responsibility is assumed by the Publisher for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions or ideas contained in the material herein. Special regulations for readers in the USA This publication has been registered with the Copyright Clearance Center Inc. (CCC), Salem, Massachusetts. Information can be obtained from the CCC about conditions under which photocopies of parts of this publication may be made in

vi

the USA. All other copyright questions, including photocopying outside the USA, should be referred to the publisher. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher.

Preface

Recent events worldwide have again highlighted the need for effective emergency measures for hazards connected with the process industries and the large scale storage of dangerous substances. The Commission of the European Communities, DG XI, in collaboration with the JRC Ispra Establishment, has therefore organised the European Conference on Emergency Planning for Industrial Hazards in order to promote an exchange of information on the current situation. Within the European Communities, the Directive on the Major Accident Hazards of Certain Industrial Activities (82/501/EEC) requires that on-site and off-site emergency arrangements should be made for certain potentially hazardous industrial activities. However, the Directive does not specify the way in which these objectives are to be achieved and one aim of the conference was to discuss the approaches adopted by the different national authorities and other organisations. The conference also provided an opportunity to explore the considerable research effort which is going on throughout the world on the improvement of systems for emergency planning. The conference was arranged in six main sessions which dealt with organisational aspects, design of plans, exercises and auditing, appropriate techniques, lessons learned from past incidents and providing information for the public. H.B.F.Gow R.W.KAY

Contents

Preface Opening Addresses G.R.BISHOP G.DEL BINO Session 1:

vii xiii xv

Organisations Implementing Emergency Planning 1.

Protection of Areas in the Vicinity of Hazardous Industrial Plants in the Federal Republic of Germany H.J.UTH

2

2.

The Italian Situation Concerning the Monitoring of Industrial Activities with Significant Possibility of Risk and the Availability and Application of Associated Exterior Emergency Plans G.CAPRIULO and L.BINETTI

15

3.

Emergency Planning in the UK: A View from the Inside G.INNES

30

4.

Emergency Plans in France R.GROLLIER BARON

41

Session 2:

On-Site and Off-Site Emergency Planning Design 5.

Guide for the Establishment of an Emergency Plan J.BOISSIERAS

44

ix

Emergency Plan and Alert System at MONTEDIPE L.CORIGLIANO and F.ANTONELLO

57

7.

On-site Emergency Plans G.L.ESSERY

61

8.

Emergency Plans According to the Law for Protection against Catastrophes and On-site Hazard Protection Plans According to the Major Hazard Regulations W.STEUER

70

9.

Co-operation in Emergency Planning T.DICKIE

77

10.

Emergency Response Planning Off-site of Chemical Plants B.KIER and G.MÜLLER

82

11.

Industrial Emergency Planning in The Netherlands H.O.VAN DER KOOI and H.K.VUYK

90

12.

Emergency and Intervention Plans: The French Experience M.GENESCO

95

Session 3:

Exercises and Auditing of Emergency Planning 13.

Plan for Off-site Exercises A.M.PARANHOS TEIXEIRA

102

14.

Exercise Study for an Emergency of Chemical Origin G.MACCHI, A.MORICI and G.POILLUCCI

110

15.

Effective Organisation and Incident Control W.D.C.COONEY

127

x

16.

Assessing the Response Capability and Vulnerability of an Emergency Plan: Some Important Issues R.MAX-LINO, P.HARRISON and C.G.RAMSAY

140

17.

Exercises and Auditing: Experience Gained in the FRG S.NEUHOFF

147

18.

Auditing and Exercising of Emergency Plans for the Danish Oil and Natural Gas Transmission System, Including Fixed Installations H.HAGEN and P.JOHANSEN

154

Session 4:

Techniques for Emergency Plans 19.

The Computer Program TIGRE and its Application to the Planning of Chemical Emergencies A.SENYÉ, B.SIGALÉS and A.TRUJILLO

158

20.

Expert System Technology to Support Emergency Response: Its Prospects and Limitations S.BELARDO and W.A.WALLACE

161

21.

Improved Emergency Response after Release of Toxic Substances: Application of the System SMART D.HESEL, H.DE WITT, H.D.BRENK and A.G.KNAUP

175

22.

Emergency Management of a Gas Escape C.M.PIETERSEN

181

23.

Effective Emergency Planning Design by Means of Risk Analysis Models

190

xi

A.DONATI, L.LAMBARDI, V.SICILIANO and E.SILVESTRI 24.

Major Industrial Risks: Examples of the Technical and Predictive Basis for On- and Offsite Emergency Planning in the Context of UK Legislation K.CASSIDY

196

25.

Decision Support Systems for Emergency Management V.ANDERSEN and J.RASMUSSEN

211

Session 5:

Lessons Learnt from Emergency Management of Major Incidents 26.

Experience Gained from Recent Major Accidents in the Federal Republic of Germany S.NEUHOFF

235

27.

Community and Organizational Preparations for and Re-sponses to Acute Chemical Emergencies and Disasters in the United States: Research Findings and their Wider Applicability E.L.QUARANTELLI

242

28.

Experience Gained from the Oil Pollution Control Operation at Læsø in 1985 F.LIND ARPE

267

29.

The Accident at DSM: Learning from a Major Accident in The Netherlands M.J.VAN DUIN

274

30.

Lessons Learnt from Major Fire Accidents in Greece M.VASSILOPOULOS

285

31.

Organizational Learning from Disasters B.A.TURNER and B.TOFT

289

xii

Session 6:

Information to the Public Prior to and During an Emergency 32.

Communicating Industrial Risk in The Netherlands: Principles and Practice P.J.M.STALLEN

308

33.

Hazard Protection Measures in the case of the Release of Toxic Gases: Principles and Description of the Concepts W.HALPAAP

318

34.

Industrial Risk and Information to the Public R.GROLLIER BARON

325

35.

Requirements for the Planning of Industrial Hazard Alarm Systems with a View to the Application of Modern Communi-cation Systems W.ULRICI and G.GUTMANN

334

Concluding Session: Panel Discussion and Conclusions 36.

Summary of the Concluding Session

350

List of Participants

357

Index

369

Opening Address G.R.BISHOP Director of the Ispra Establishment, Joint Research Centre

It is an honour and a pleasure to welcome you as participants to this ‘European Conference on Emergency Planning for Industrial Hazards’. As background to this event I remind you that the EEC directive on major hazards for certain industrial activities (Post Seveso Directive) imposes that Emergency Plans be prepared to mitigate the consequences of major industrial accidents. I do not need to regale you, the experts in these matters, with the steadily lengthening list of accidents which serve to alert public opinion and anxiety, but scarcely a week passes without some minor or major alarum underlining the need for a fresh approach towards effective actions. Since the consequences of industrial accidents are rarely confined to the location of their occurrence, and notoriously do not respect even national frontiers, the intervention of the Commission of the European Communities is natural and desirable. The Commission has the task of formulating those policies aimed at promoting the harmonious development of economic activity within the community of Member States, a good neighbours’ policy. Good neighbours do not throw their trash into each other’s backyards! As an initial step towards the definition of effective measures for dealing with such problems the Commission decided to organise this meeting at which experts can explain what their respective countries and organisations are doing to cope with hazards in their process industries. It was decided purposely to exclude discussion on disasters in the nuclear field and in the transport of dangerous materials; the former has been extensively ventilated, especially after the Chernobyl accident; the latter will be treated in another specialised conference to be organised later. Within the Commission the appropriate bodies are DirectorateGeneral XI for Environment, Consumer Protection and Nuclear Safety and Directorate-General XII-Joint Research Centre. In

xiv

broad terms the relationship between any DG and the JRC is that the DG is the policy-formulating body which can call upon the JRC for scientific and technical research support. Commission policies thus guide the JRC in the orientation of its research activities and in defining its priorities: these are not only the establishment of the Internal Market and its corollary the improvement of industrial competitiveness, but also the protection of the environment and improvement of safety. While the Commission is today the main client for JRC work, this does not imply an exclusive recourse to the JRC in the assignment of Community tasks. In fact the Commission has adopted expert reccomendations that the JRC look for other clients, by placing its specialised neutral and independent scientific potential at the disposal of organisations or industries in the Member States by means of research contracts, service work, cooperative projects industrial clubs and other suitable means. One of these means is illustrated by the present conference. In February of this year (1987) a call for papers was made after extensive publicity. Over one hundred papers were submitted and a selection made by the Technical Committee (whose composition is listed in the conference brochure) in Brussels last June for oral or poster presentation in Varese. The Technical Committee was chosen from Member State nominees, invited experts and staff members of DG XI and the JRC. They chose 36 papers for oral presentation and 11 for poster presentation. Similar care was exercised in proposing the session Chairmen and the session Rapporteurs to provide as large a representation as possible of the Member States. Attendance also surpasses expectation since more than two hundred registrations are made; there should be a healthy interest therefore in the Conference proceedings which will be published by Elsevier Applied Science Publishers Ltd. I wish you a successful and fruitful conference and trust that you will make durable new contacts or reinforce existing ones in an endeavour to render in concrete terms the intentions of the Commission policies.

Opening Address G.DEL BINO Head of the Division of Chemical Control, Industrial Risks and Biotechnology (DG XI–A/2), Brussels, Belgium

INTRODUCTION I would like to welcome you today, to this European conference on Emergency Planning for Industrial Hazards, organised by the Directorate General for Environment, Consumer Protection and Nuclear Safety and the Joint Research Centre in Ispra (Italy). I must say that this conference could not have been timed any better. Last Thursday over 20 000 people had to be evacuated from their homes, near to Nantes (France) because there was a major threat from a poisonous gas cloud as a result of a fire. Apparently the fire broke out in an 850 ton storage silo containing ammonium nitrate compound fertilizer, which then led to a yellow gas cloud, 5 km wide and 15 km long, moving at 7 km per hour, 250 metres above the ground. Fortunately the wind direction was such that the gas cloud was pushed towards the sea, so the heavily populated city of Nantes was not at risk. Furthermore, only a year ago last Sunday, early in the morning of 1 November 1986 in Basel, a thousand tons of chemical products caught fire on the premises of Sandoz, and in the process of fighting the fire, somewhere between 10 and 30 tons of chemicals were washed into the Rhine—a major environmental accident if there ever was one, never mind the health hazard, a major accident can pose. It has been said many times, and I believe it is worth repeating here today, that the Sandoz accident has further confirmed the need for international, and in particular Community, action to prevent major accidents and to limit their consequences. This, of course, implies the necessity, and where appropriate an obligation, to have, to develop, to improve effective emergency measures both for hazards connected with process industries as well as large storage and transportation of dangerous substances.

xvi

THE DIRECTIVE ON MAJOR ACCIDENT HAZARDS As you are well aware, the Directive on Major Accident Hazards does request, in the notification to be submitted by the manufacturer to the national competent authorities, information relating to possible major accident situations, that is to say ‘emergency plans, including safety equipment, alarm system and resources available for use inside the establishments in dealing with a major accident’. On the other hand, the Directive also requires that the competent authority, account being taken of the responsibility of the manufacturer, is responsible for ‘ensuring that an emergency plan is drawn up for action outside the establishment in respect of the notified industrial activity’. Thus, on-site competence for emergency planning is clearly the responsibility of the manufacturer, while off-site emergency measures are for the administrative authorities responsible, whether they be local agencies, emergency services or regional or central government. EMERGENCY PLANNING The planning and experience which went into the development of the Directive on major accident hazards from all parties involved, was not entirely comprehensive enough to foresee all the problems, and furthermore, it was not appropriate to define all the necessary technical and scientific standards and details with regard to emergency planning. Thus, the Directive only establishes the general requirement that both on-site and off-site emergency planning measures should be taken, but it does not indicate the procedure and ways in which the emergency planning should be prepared and carried out. ON-SITE EMERGENCY PLANNING When the Directive was adopted in 1982, the Federal Republic of Germany and the Netherlands had legislation on on-site emergency planning. All the other Member States introduced new legislation or are in the process of adopting it in order to comply with the Directive in respect of on-site emergency planning. Many Member States have already a substantial number of onsite emergency plans in operation and the Commission hopes that

xvii

in the near future, all Member States will develop such plans for the industrial installations covered by Article 5 of the Directive. Most Member States have had to introduce new legislation in order to comply with the Directive’s provisions, since the Directive not only requires site-specific emergency plans which protect man, but also the environment. The level of responsibility for drawing up a plan varies from Member State to Member State—local, regional or central levels— while the competent authority may be an inspectorate (UK, Ireland) or a committee (Luxembourg, Italy) or a governmental department (Denmark, Greece, Belgium) or a local authority (Germany). CO-OPERATION AND COMMON UNDERSTANDING The Commission does see an essential need for an exchange of information, at Community level, on all matters concerning procedure and scientific and technical aspects of emergency planning. This is necessary in order to promote co-operation and common understanding and appreciation of the difficulties involved in planning emergency measures, and in the case of a major accident, tackling the problems. This will facilitate the development of common approaches throughout the Community. However, the Commission believes that it would not be correct or fruitful to turn its efforts towards achieving a complete harmonization of the varied kinds of emergency measures and of the different levels of authorities involved in the various Member States of the Community. IMPLEMENTATION OF THE DIRECTIVE At the same time the Commission is looking for an effective implementation of the Seveso Directive in all 12 Member States. There are, of course, problems which are to be expected where there are 12 different national realities and where administrative practices, scientific and economic measures and development are all rather heterogeneous. We, in the Commission, struggle to ensure the implementation in practice and in aiming to do this we undertake all kinds of activities: regular meetings with national authorities, technical workshops of national industrial inspectors, exchange of information at all levels, legal, administrative and scientific, research and training programmes, common data banks, investigations to monitor the national and local situations.

xviii

However, this process only started a few years ago and we are continually making progress. Indeed, the idea for a conference of this kind arose out of discussions in the Committee of National Competent Authorities responsible for the Directive on major accident hazards. While the Commission, together with this Committee, looks at the practical and legal aspects, we look on the technical side to exchange information and explore new ideas and avenues in order to identify areas of possible future action. As I look at the programme in front of me and all of you here today, I am sure that over the next few days there will, indeed, be interesting discussion, and fruitful ideas. Thank you, good luck.

SESSION I Organisations Implementing Emergency Planning Chairman: A.BAUN (Danish National Police, Denmark) Rapporteur: H.B.F.Gow (Joint Research Center Ispra, Italy)

1 Protection of Areas in the Vicinity of Hazardous Industrial Plants in the Federal Republic of Germany HANS-JOACHIM UTH Umweltbundesamt (Federal Environment Agency), Berlin, FRG 1 INTRODUCTION Spectacular industrial accidents, such as the ones in Bhopal, Mexico City and Basle, have in recent times made the risks associated with the modern chemicals industry unmistakably evident. An analysis of events showed that when on-site safety precautions fail effective emergency plans for the people living in the vicinity of an installation become particularly important [1–3]. Emergency plans can be a matter of life and death. For quite some time now they have been part of a comprehensive system to protect areas in the vicinity of hazardous industrial installations from the harmful effects which can result from a major accident. The most important elements of this system were laid down in the ‘Regulation on major industrial accidents’ (Störfallverordnung [4]; a regulation which implements on a national level the EEC Directive 82/501/EEC, the Seveso Directive) which will be briefly described here. Neither the legal basis of the emergency plan system nor specifie problems connected with it will be discussed here since this will be covered in the course of the conference by other speakers from the Federal Republic of Germany. 2 HAZARD ANALYSIS In order to provide protection from risks it is first necessary to know what they are. Man and the environment in the vicinity of hazardous industrial installations can be endangered by fires, explosions and/or the release of toxic substance.

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 3

The potential hazard is directly linked to the specific properties of chemical substances. This threat can become reality in the event of uncontrolled release of such a substance. In order to prevent this a number of on-site safety precautions are taken. These precautions can, however, become less effective due to interaction with internal and external influences (e.g. flooding, earthquakes, explosions, fire). In the event of accidental release of a dangerous substance the consequences depend upon — the quantity released; — the dispersion behaviour of the substance; — the conditions in the surrounding area (e.g. population density, state of the ecosystem). A comprehensive analysis of the threat posed to man and the environment therefore requires — identification of industrial installations using dangerous substances and processes; — identification of the influences which can lead to uncontrolled release of substances (hazard sources); — analysis of the structure of the area which could be affected. 2.1 Identification of hazardous industrial installations in the Federal Republic of Germany In accordance with the stipulations of the Seveso Directive the actual scope of the ‘Regulation on major industrial accidents’ [4] is established by drawing up a list of the installations and substances in question. Only installations subject to licensing procedures, which are included in the list and in which substances included on the substance list are handled or could be formed in the event of an accident, are regarded as hazardous installations. At present 17 types of installation are listed. The substance list includes 142 individual substances as well as 3 groups of substances which comprise some 150 further individual substances. The ‘Regulation on major industrial accidents’ may only be applied to installations in which the given substances exceed a certain threshold quantity [5].

4 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

2.2 Installation structure In all, approximately 850 installations were registered with the authorities (as of autumn 1985). This number corresponds to approximately 1–5% of the total number of installations subject to

FIG. 1. Types of hazardous installation in the FRG; StöVO refers to Störfallverordnung (German hazardous incident ordinance) [4].

licensing in the Federal Republic of Germany under the Federal Immission Control Act (BImSchG). The majority (99%) come under the regulation due to the fact that dangerous substances are present under normal operating conditions. In only 1 % of installations are dangerous substances not formed unless a major accident occurs (as was the case in Seveso). Of the installations registered, the registration obligation was waived for around 10% because their stock of dangerous substances was below the threshold quantity laid down. Figure 1 gives an overview. Around

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 5

95% of all registered installations can be assigned to 4 categories of installation. The proportion of installations which belong to the chemicals industry heads the list with around 60%. Approximately one-third of all installations which could be subject to registration on the basis of the installation list are not registered. 2.3 Categories of substances Of the 145 substances/groups of substances (positions) which could be subject to registration on the basis of the list of substances, only 61 have been registered (approx. 43%); 50% of the installations are registered under 5 positions, 85% under 20 positions (Table 1). Approximately 30% of all installations registered fall into the groups of substances ‘flammable gases’ and ‘highly flammable liquids’. The major dangers connected with these installations are fire and explosion. In particular, the combination of toxic substances and substances which pose a fire hazard, as present in installations in the chemicals industry and the petroleum refining industry, can lead to moments of acute danger in these installations [6]. Table 1 Relative placings of 20 of the most common substances

a

Appendix II, Accident decree [4].

6 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 2. Average distribution of fire hazard substances in the chemical and petroleum refining industry.

In the chemical industry, all substances listed in Table 1, with the exception of explosive substances, have been registered. The most frequently occurring substances are — chlorine (14%); — hydrogen sulphide (11%); — bromine (8%); — alkali cyanide (7%). Figure 2 shows the ratio of the stocks of substances which pose a fire hazard and those which are toxic in those installation categories with the highest potential danger. This is based upon the overall installation structure, not on individual installations.

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 7

FIG. 3. Average inventory in relation to the threshold B according to Ref. 5.

In view of the fact that the 850 installations registered under the Regulation are located on only 150 sites, installations where there is a fire or explosion hazard and those where there is a hazard posed by toxic substances are often in close proximity to one another. This must be taken into account when planning safety precautions (domino effect). An indication of potential danger is also the quantities handled. It is estimated that some 30000 tonnes of toxic substances are

8 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

held in stock in the installations in question (not including potentially toxic substances in the groups ‘highly flammable liquids’ and ‘flammable gases’). If one determines the mean volume of substances per installation in relation to the threshold quantity B (for a definition of B see Ref. 5) it can be seen that the threshold quantity is in practice exceeded to a great extent (Fig. 3). By definition this implies a high potential danger [7]. 2.4 Distribution The 850 installations are located at 150 sites. Those within the chemicals industry are concentrated in the areas traditional to the industry in North Rhine Westphalia, Hesse, Rhineland Palatinate and Bavaria. Here there are often several installations in one larger complex. The large storage plants for highly flammable liquids are, in those cases where they are not operated directly by the refineries, situated mostly in the northern regions of the country (on the coast). Many individual installations outside the industrial centres are distribution points for liquid petroleum gas [8]. 3 SAFETY CONCEPT IN THE FEDERAL REPUBLIC OF GERMANY The first point to be considered is the substitution of dangerous substances by innocuous or at least less harmful ones. This basic approach has its roots in Germany in the federal legislation on chemicals [9]; it will not be discussed in depth here but it should nevertheless be seen as part of a comprehensive safety concept. From the elements of a hazard analysis mentioned above, a comprehensive, integrated three-stage safety concept was developed, which formed the basis for the ‘Regulation on major industrial accidents’ (see Fig. 4): Stage 1 includes all measures in the installation which assure the safe containment of dangerous substances and the prevention of inadmissible operating conditions. Stage 2 brings together all measures designed to limit the effects of fire, explosion or the release of chemicals, which might occur as the result of a major industrial accident. Stage 3 includes the measures taken off-site to protect the surroundings. They limit the effects of harmful

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 9

FIG. 4. Scheme of the 3-step security system.

Specification Safe enclosure of inventory Restriction of emission Restriction of adsorption

Step I II III

substances, heat radiation or the consequences of an explosion on the objects to be protected. In view of the fact that detailed safety measures are dependent on the specifie requirements of the plant and its location, every installation has to be regarded individually. This takes place in the form of the safety analysis required by the ‘Regulation on major industrial accidents’. In it all factors relevant to the safety of the installation must be analysed and proof provided that the safety obligations have been fulfilled. (For requirements regarding the form and content of the safety analysis see Ref. 10.)

10 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

3.1 On-site safety precautions (Stages 1 and 2) On-site safety precautions are designed to prevent major industrial accidents from occurring or, if they do occur, to limit their effects. The precautions can be of a technical or organizational nature. Their basis is to be found in the ‘technical compendium of regulations’ which has to be taken into account when planning, constructing and operating engineering plant. Included in it are — state regulations, e.g. the Commercial Activity Act (Gewerbeordnung) and the Regulations issued under it, the Federal Emission Control Act and its Regulations, the Chemicals Act, the Dangerous Machinery Act, etc.; — regulations made by the employer’s liability insurance associations (accident prevention stipulations); — regulations made by trade associations such as DIN, Vdt, VDI, VDE; — internal regulations. The safety aspects begin with the planning of an installation and end with the organization of the operating procedure. The amount of regulations depends upon the safety stage in question. The density of regulations tends to decrease from one stage to the next and general principles take the place of concrete stipulations. Most problems are posed by the regulations in Stage 2, the limitation of the effects of a major industrial accident. Only in exceptional cases is any mention made of this problem in the technical compendium of regulations. The crux of the problem is that a hypothetical accident has to be assumed in order to design the parts of an installation correspondingly. Economic considerations are an important factor here (cf. Ref. 2). 3.2 Off-site safety precautions (Stage 3) In the event that the precautions taken under Stages 1 and 2 fail, the dangers then posed to man and the environment can be limited if precautionary measures are taken. This begins with actions such as location of industry, i.e. separation of industrial and residential areas, licensing of dangerous production plants only if they are at a certain distance from residential buildings, etc. These principles are laid down in the Federal Republic of

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 11

Germany in the Town and Country Planning legislation (see e.g. Ref. 11). Further precautionary measures are taken within the scope of emergency plans which begin off-site. The relevant stipulations within the technical compendium of regulations require alarm plans to be established for the employees which include descriptions of appropriate behaviour. In incidents in which internal emergency plans no longer suffice to control the accident off-site, emergency plans have to be implemented. The point at which the responsibility of the plant operator ends and that of the authorities in charge of emergency plans in the area surrounding the plant begins must be accorded special importance. On-site and off-site emergency plans must be carefully co-ordinated. Any emergency plans must take account of the type of danger, e.g. fire/ explosion, release of toxic substances, etc. This means in particular that suitable substances for extinguishing fires, measuring equipment, first aid provisions, etc. must be readily available. When drawing up plans, use can be made of the data given in the safety analysis as prescribed by the ‘Regulation on major industrial accidents’ and of the description of possible areas of danger which can be expected in the event of an accident. For emergency plans to be effective the participation of people living in the vicinity who could be affected by an accident at the plant is essential. The local population must be prepared in advance so that they would know what action to take in the event of an accident. This necessitates honest explanation of possible dangers and maybe involvement of the public in the plans [12–14, 16 ]. 3.3 Flanking safety precautions Experience has shown that it is not sufficient to issue safety regulations and bans in order to achieve in practice an optimal safety standard. Control instruments are also necessary, so as to monitor whether the regulations are being adhered to, as well as measures to increase the motivation of the employees to act in a safety conscious manner (including training schemes). There are various possible ways of monitoring adherence to the regulations. They begin with the licensing procedure, in which checks are made to ensure that an installation complies with the latest technological developments, and extend to individual assessments of the safety of special components.

12 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The analysis of accidents is extremely important for the further development of safety technology [15, 16]. This necessitates provisions requiring the notification of accidents in industrial installations. Work is being carried out at present to set up a system for the central evaluation of these incidents. 4 EVALUATION OF CURRENT PRACTICE Since the ‘Regulation on major industrial accidents’ came into force 6 years ago the discussion of industrial safety has intensified and the safety concept behind the Regulation has started to be accepted as a general principle. In particular, the obligation to compile safety analyses which also applied to ‘existing installations’ (those already in operation before the Regulation came into force) meant that all installations within the scope of the Regulation were looked at from a safety point of view. In the course of this process a number of defects were corrected. In some cases the stocks of dangerous substances were reduced and in other cases harmless substances were substituted. Furthermore certain concrete principles of the Regulation had an effect on other areas to which they were not formally applicable (e.g. safety precautions for the storage of liquid petroleum gas. in smaller quantities). There are several problems of a legal and technical nature which can be observed in practice regarding emergency plans. The local and regional authorities bear the responsibility for disaster precautions. Special precautionary plans for protection from dangerous installations are the exception rather than the rule. Apart from a few exemplary plans for large chemical works which take special account of the specific dangers connected with particular chemicals, it must be said that emergency plans are often inadequate, especially in rural areas. In many cases disaster control teams are ill-equipped and inadequately trained. The necessity to make specific emergency plans has not yet become generally accepted. This is particularly true regarding the willingness to provide the public with frank and comprehensive information and involve them in the establishment of the plans. As far as Town and Country Planning is concerned it must be said that in older, ‘traditionally evolved areas’ there is still often insufficient separation of industrial and residential areas [17]. In larger industrial complexes, any particularly dangerous plants are situated as far away from housing as possible.

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 13

5 OUTLOOK Recent experience with major or more minor accidents in the chemicals industry has shown that the discussion about safety and protection of areas in the vicinity of industrial installations was not definitively concluded when the ‘Regulation on major industrial accidents’ was issued. These incidents have shown up very clearly where the limitations of the Regulation lie. Whilst the Regulation’s main aim was to protect society from acute dangers (fire, explosion, pollution of the atmosphere by toxic pollutants), these accidents have made it clear that the Regulation must be revised to include protection of the ecosystems (water, soil) [18]. In particular, it would seem necessary to extend the scope of the Regulation, to improve the stipulations requiring notification of major accidents and to tackle the problem of compiling a compendium of safety regulations which take account of the specific nature of individual plants. Instructions should be issued to the competent authorities to clear up the concrete difficulties involved with implementing the ‘Regulation on major industrial accidents’ [19, 20]. In doing this, care must be taken to ensure that the general principle of regarding systems as a whole and not just a sum of parts must be adhered to in all stages of the safety legislation, that the emergency plans and disaster precautions are tailored to the specific (chemical) hazard, and that accidents which are notified are systematically recorded and centrally evaluated in order to be of use in the further development of safety technology. The up-dating of the ‘Regulation on major industrial accidents’, which is at present being undertaken in the Federal Republic of Germany, and the compilation of instructions for the competent authorities will contribute to better emergency plans for the protection of areas in the vicinity of industrial installations. REFERENCES 1. 2. 3.

4.

The Chemical Industry after Bhopal, International Symposium, London, 7–8 November 1985. UTH, H.-J. (1986). 1st Bhopal in der BRD möglich? Sicker ist Sicher, 37(6), 298–306. PIETERSEN, C.M. et al. (1985). Analysis of the LPG Incident in San Juan Ixhuatepec, Mexico City, 19 November 1984, TNO-Dossier 8727– 13325, 6 May. 12. Verordnung zur Durchführung des Bundesimmissionsschutzgesetzes, 27.6.1980, BGB1.1, Nr. 32, Seite 772,1980, zuletzt geändert durch Verordnung zur Neufassung und

14 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

5. 6. 7. 8. 9. 10. 11.

12. 13. 14. 15. 16. 17.

18.

19. 20.

Änderung von Verordnungen zur Durchfüuhrung des BImSchG, 24. 7.1985, BGB1. I, Nr. 41, Seite 1586, 1985. 1. Verwaltungsvorschrift zur Störfallverordnung, 23.04.1981, GMB1. (12), 32, Seite 178, 1981. LEES, F.P. (1980). Loss Prevention in the Process Industries, Butterworths, London. SCHÄFER, K. Kommentar zur Störfallverordnung, Kohlhammer. DEUTSCHER FLÜSSIGGASVERBAND eV (1986). Jahresbericht 1985, Kronberg. Gesetz zum Schutz vor gefährlichen Stoffen (Chemikaliengesetz), 16 September 1980, BGB1. I, Seite 1718, 1980. 2. Allgemeine Verwaltungsvorschrift zur Störfallverordnung, 27 April 1982, BMB1, Ausgabe A, Nr. 14, Seite 205, 1982. Abstände zwischen Industrie—bzw. Gewerbegebieten und Wohngebieten im Rahmen der Bauleitplanung Runderlass v. MAGS, 25.7.1974/2.11.1977 MB1. NW Seite 1688/SMB1. NW 280, 1978. ALBRECHT, H.G. (1981). Sonderschutzpläne—warum und wofür? ZS-Magazin, November, p. 17. METREVELI, S. (1976), Katastrophenstrategie und Partizipation. 18. Deutscher Soziologentag, 28.9–1.10, Bielefeld. CLAUSEN, L. et al. (1983). Einführung in die Soziologie der Katastrophen, Bonn. KUHLMANN, A. (1981). Einführung in die Sicherheitswissenschaft, Vieweg und Sohn, Köln. GREEN, A.E.(Hg.) (1982). High Risk Safety Technology, John Wiley. INSTITUT FÜR LANDES- UND STADTENTWICKLUNG NORDRHEIN WESTFALEN (1981). Abstandsregelung in der Bauleitplanung, Düsseldorf. BUNDESMINISTER FÜR UMWELT, Naturschutz und Reaktorsicherheit (Hg), Rhein-Bericht, Umweltbrief Nr. 34, 12 February 1987. UTH, H.-J. (1986). Probleme bei Sicherheitsanalysen, gwf-gas/ erdgas, 127(6), 229. UTH, H.-J. (1987). Sechs Jahre Störfallverordnung—sind Chemieanlagen sicherer geworden? Gewerkschaftliche Umschau, IG Chemie-Papier-Keramik Nr. 2/3, Seite 10.

2 The Italian Situation Concerning the Monitoring of Industrial Activities with Significant Possibility of Risk and the Availability and Application of Associated Exterior Emergency Plans G.CAPRIULO Ministry of Civil Protection, Rome, Italy & L.BINETTI Ministry of Public Health, Rome, Italy 1 INTRODUCTION There are about 100000 chemical substances on the market. Of these, however, about 10000 are of great importance from the point of view of quantity, production and use at the industrial level, and many of these present greater or lesser danger to man and the environment. This really high number gives an idea of the size of the problem presented by the production, employment, use and elimination of chemical substances. It is thus necessary for the risks that they present to be evaluated at different levels, to identify the conditions of acceptability without prejudice to the preservation by the health authorities of man and the environment. Until fairly recently the presence and use of chemical substances were accepted passively, often without knowing either their characteristics and properties, or even their suitability. The awakening of a critical knowledge has sometimes led to reactions which are extreme and not at all rational, with a very strong emotional component. On the other hand, insufficient industrial prevention produces or has encouraged, in some cases, the occurrence of chemical accidents which have sometimes caused irreversible damage. All this required and continues to require the need for man to be able to live with these sources of activity and of progress. In the past, consideration has been given almost entirely to the benefit derived from the use of chemical substances, without also

16 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

taking account of the consequences of damage, which have sometimes been catastrophic. For several years, however, an attempt has been made to redress the balance by evaluating the risk which the production and use of a chemical substance might cause. Chemical substances are therefore of prime importance in the programmes of the CEC and also Italy, and during recent years important and concrete initiatives have been set up including, in the first place, the CEC Directive 82/501 which has recently been modified by Directive 87/216. 2 DIRECTIVES 82/501 AND 87/216 OF THE CEC These represent the standards which the CEC has adopted to prevent and deal with important accidents. The directives have two aims: — to detect, as soon as possible during the initiative’s design phase, the probability of accidents which could occur, by conducting research into possible causes, the identification of critical points, the prediction of combinations of events which could lead to accidents, and the introduction of associated safety measures; — to prevent any accident that occurs from having disastrous consequences, by adopting the safety and control measures which are indicated in the emergency plan. To summarise, the Community standards treat the problem of industrial risk with a single approach and envisage two different phases, i.e. the prediction and prevention phase and the phase of emergency action in the case of an accident. 3 PREDICTION In this respect the community standards mentioned above have fixed a series of objectives to be achieved, and have also indicated some general principles to be followed. The practical application of these principles is, however, left to the initiative of the various member States who will make their own choice depending on the interior structures available. The choices made in Italy have been dealt with in a coordinated programme according to which, following successive stages which

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 17

are linked together, one must arrive, in a reasonable time, at complete monitoring of the entire industrial sector involved in the problem of the risk of serious accidents. The stages of this programme are as follows. 3.1 Identification of the national list of industries concerned The programme was started in February 1985 with two different procedures, one based on a system of self-declaration by the industries which took place under the control of the Ministry of Public Health, the other based on the direct collection of data from industries identified with the banks available at different central and local public offices, which took place under the control of the Ministry of Civil Protection. All the data collected (which are relative to about 10000 industries) have been examined, evaluated and finally divided into three different lists: List A collects together all the industries which perform activities of deposition and/or production in the installations indicated in Appendix I of Directive 82/ 5101 and which use the substances listed in Appendices II and III of the directive but in quantities greater than the levels indicated. List B collects together all the industries which perform activities similar to those of list A but where the quantities of substances are lower than the same levels. List C collects together all the other industries which have provided data. The overall response obtained was considered satisfactory; in fact, by using other sources of information available, it was very close to the real national situation. At present the list is being revised to take account of the modifications made with Directive 87/216. At the end of this last procedure the list may be conclusive and in line with the needs which it must control. In any case one should remember that for all undeclared situations the penal code will be applied. In this respect a programme of inspections is underway which is being organised in coordination with the central and local public State organisations.

18 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

3.2 Risk maps Using data from the list, it has been possible to define the first risk maps which take into account all of the most dangerous industrial activities, i.e. the activities covered by Article 5 of Directive 82/501. 3.3 Safety reports As they form the fundamental knowledge base for the definition of the external emergency plans, this programme has been given the biggest impulse in considering also the technical requirements of industries. As a result, in September 1986 each industry involved was asked to prepare, within a year, safety reports for all the industrial activities to be notified. To facilitate this procedure and make the various reports homogeneous, an appropriate technical guide was made available to all the industries. 3.4 Evaluation of the safety reports and classification of the industries depending on their risk level The safety reports are being examined by the Italian public authorities, according to a programme which has fixed priorities for the most dangerous situations either because of the complexity of the installations or because of their proximity to an inhabited centre. The verification programme must finish as quickly as possible; in any case it is predicted that it will be complete by July 1989. At the conclusion of this examination, as well as having available a complex series of data and technical information, a final judgement will be given which will apply, in general, the following cases: (a) The industrial activity is acceptable from the point of view of interior and exterior safety. (b) The industrial activity is not totally acceptable but may be made to conform to acceptable levels with the introduction of new measures. (c) The industrial activity is not compatible with the place, and consequently must be closed and/or moved.

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 19

3.5 Industrial activities with no obligation of notification (Articles 3 and 4 of Directive 82/ 501) While for activities to be notified the CEC directive has laid down a series of actions which allow the public authorities to have available, according to the case, all the useful information, for those covered by Articles 3 and 4 the situation is less well defined. As the ratio of these activities to notified activities is roughly 10:1, one can easily see the importance of being able to bring them under uniform control. In fact these activities are included in the areas where there are almost always activities to be notified too. Considering that emergency plans must be set up for these activities, it would be a good idea to know about all possible risk sources which could have some effect. The Italian authorities are therefore in the process of deciding on a programme for the monitoring of the safety of all industrial activities covered by Articles 3 and 4 of the directive. In this programme, which should come into force on 31 July 1989, a simplified procedure has been laid down according to which each industry, after having evaluated all the installations concerned, must establish if it is (A) included in the field of application of Articles 3 and 4 of Directive 82/501; if this is the case it must be established if the greatest existing risk — is limited to inside the establishment, — could also affect the outside; (B) not included in the field of application of Articles 3 and 4. A formal communication must be sent to the public authorities. 4 PREVENTION When each safety report has been examined and evaluated, it will then be necessary, first of all, to adopt all the measures, which could differ from case to case. If the activity is considered incompatible at the internal and external safety level, measures for closing it and at the same time for providing economic support must be adopted. The possibilities

20 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

of moving it to a more suitable place must also be evaluated on the technical and policy level. If the activity is compatible with the territory but the safety level is not considered sufficient, then a series of appropriate technical measures must be adopted which the industry must satisfy within an appropriate period. Only after this complex programme has been completed will it be possible to define the external emergency plans with the precision necessary. 5 THE EMERGENCY PLANS The obligation to furnish external emergency plans for the industrial activities, which are covered by Art. 5, CEC 501/82, is the responsibility of the Prefects, as is that of giving the necessary information to the public. Such plans must be based on (a) elements contained in the safety reports on the evaluation of security, on their evaluations and on the measures consequently adopted; (b) the elements deduced from simplified communications laid down for industries which are not at high risk according to Articles 3 and 4 of CEC 501/82. As has already been said, both phases of the survey programme will be completed in July 1989. While it is being carried out, a national sectorial plan called CHEMIC has been prepared to come to the aid of the public and the environment in the case of a disaster due to industrial risk; it provides a framework for provincial and local plans. The CEC directive refers only to certain categories of industry (chemical, petrochemical, release of solid or liquid substances by combustion or chemical decomposition, treatment of energy gases, dry distillation of coal and lignite, production of metals and metalloids, and gas and inflammable liquid depots). The CHEMIC plan also considers power stations, the manufacture and storage of explosives, powders and munitions, installations for the disposal of toxic or dangerous wastes, extraction activities and other mining activities. In the range of industries mentioned above, the CEC directive only considers the activities of transforming and handling toxic substances, and their storage inside and outside the establishment. The transport of these goods is, on the other hand,

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 21

governed by the RID (International Regulation for Railways), by the standards of the European agreement (ARD) stipulated at Geneva in 1966 for road transport, by the International Code of IMCO (Intergovernmental Maritime Consultative Organisation, not ratified by Italy) for sea transport, and by IATA (International Air Transport Association) standards for air transport. FIATA has created FIAT-SDT (shipper’s declaration for the transport of dangerous goods), common to any type of transport which is the direct responsibility of the compiler, who is the most appropriate person to warn the carrier against the dangers which the goods described may pose to people or things. The transport of dangerous substances through oil and gas pipelines, following losses or breaks, may lead to pollution of watercourses, lakes and pools, or explosions. The accidental or deliberate pouring of hydrocarbons into the sea or the leakage or destruction of containers of toxic substances into the sea because of shipwreck may cause pollution of beaches and territorial or international waters. Law 979/82 was passed to defend the sea from pollution. The general criteria to be followed when drawing up and organising plans are well represented by — clarity and conciseness; — flexibility; — involvement of all public organisations; — revision and updating of emergency management; — concrete definition of tools for emergency management. From the operational point of view, it laid down (a) procedures: — definition and location of forces available; — mode of intervention; — criteria of use; — hierarchical organisation; — human resources and materials available; (b) intervention phases: — pre-alarm; — alarm. The following emergency actions are laid down for accidents which occur in various situations:

22 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

(a) At establishments or depots: — evacuation, if necessary; — isolation of the zone (police, etc.); — containment (fire services, etc.); — re-establishment of road and rail networks (ANAS and FFSS); — protection and re-establishment of water supplies and public services (bridges and embankments, municipal enterprises, ENEL, SNAM, etc.); — demand for consultation with experts, specialised actions, analysis of the help of intervention by firemen. (b) In means of transport; oil and gas pipelines: — as in the preceding case; — the technical action of plugging and non-pollution will mainly be the responsibility of the manager. (c) At sea or in ports: The harbourmaster has primary responsibility for actions. He will act with his means and with those of the fire services and other administrations who have the necessary means, and will thus proceed to — isolate the zone; — chemically identify the dispersed substance; — take samples for analysis on the surface and in the pool; — stop the drinking water supply if necessary; —contain, absorb, recover, or dispose of the pollution where possible; — neutralise it chemically where possible; —set up temporary dams, floating barriers or other forms of barrage; —in the case of pollution which is lighter than water and which does not mix with it, suck the surfaces with pumps and drainage pumps; — clean the beaches; — use chemical or other solvents; —put health regulations into practice by advising the public and giving instructions for behaviour; — protect agriculture and livestock.

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 23

In addition to these general standards, initiatives are underway to set up a global approach for certain areas where there are important industrial installations which involve dangerous activities not covered by the CEC directive. This particularly concerns potential areas where the risk factors are aggravated by the movement of dangerous goods by sea and by land and by the existence of a pipeline. 6 DATABANKS To guarantee rational, suitable and efficient action in the case of an emergency, the Civil Protection Department uses a specific service, the CASI (Centre for the Application of Software Studies) which has a data processing centre. It manages the hardware which comprises two computers, graphic equipment and terminals, and the software which includes the departmental data bank and the mathematical models. Many systems are already in operation and others are being developed. Those already in operation and which are of particular interest for industrial risk include (a) The data bank at the local level which collects together, for the 8050 Italian local authorities, some hundreds of items of information, either statistical or related to resources. (b) The risk source data bank which collects together information from surveys performed by the CPD (or for the CPD) on dams or barrages, high risk industries, the disposal of toxic wastes, debris, etc. (c) An automatic map-drawing programme which can create thematic maps using certain programmes. (d) A meteorological model which is used to provide, in real time, a spatial distribution of temperature, humidity etc., by introducing, on a statistical basis, the data detected by the MA (Military Aviation) meteorological stations. (e) An assistance model on the basis of a diagram reproducing the road network schematically and, on the basis of a stored distribution of resources, which is used to evaluate the needs for assistance by locating the nearest available resources and suggesting the best route for the arrival of assistance. Under development are

24 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

(a) The perfection of area data bases already available, and the report of all the data no longer by administrative unit (Local Authority) but by a specific geographical point referred to by its coordinates. (b) An accident and event data bank, which records and processes all the news on accidents and events in Italy and abroad which are of interest to the CPD (Civil Protection Department). (c) An accident data bank when catastrophic events occur, which allows deduction from files on site, thanks to portable processing systems, of the number and type of people injured following a catastrophic event, and management of health and logistics assistance for them. (d) The development and improvement of existing models; seismic models, assistance models, and meteorological models are systematically updated and adapted in the light of experience acquired when real events occur. (e) Liaison with data banks of all the administrations of the State concerned in the emergency, and in particular with the Health Ministry (availability of health structures) and with the Superior Health Institute (dangerous substances data bank), is being planned or set up. 7 CIVIL PROTECTION STRUCTURES The organisation of Civil Protection at the central level is made up of a Department of the Presidency of the Council of Ministers which is responsible for coordination; it has no special personnel or budget and is the only example of a State organisation which acts by function and not by subject. Now a Minister for the Coordination of Civil Protection has been appointed. This department includes (a) The Cabinet Office. (b) The organisations which assist the Minister in his activity: EMERCOM (Operational Committee for Emergencies); the Health Commission; the Committee for voluntary activities; the Coordination Committee for activities concerning safety in the industrial sector. (c) Four services: Coordination; Public Works; Budget and AAAA; Emergencies.

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 25

EMERCOM plays a particular role. It coordinates the administration of all the organisations and the emergency service. The emergency service has the task of ensuring rapid action and assistance to people affected by catastrophes; it puts the Minister’s orders into practice and looks after liaison with the scientific organisations which monitor major risks using the following operational services: (a) The CESI (Situation Centre) formed of a group of operators which receive and evaluate news 24 hours a day, inform Department heads of events which are occurring, respond in the first instance to safety requirements, and maintain contacts with regional and provincial operation rooms; it has a telecommunication centre which has telephone links pointby-point (armed forces, Carabinieri, Minister of the Interior), normal telephone links, links by radio (fire service, ham radio operators, etc.) and telex links (RAI, press agencies). (b) The COAU (Unified Air Operations Centre) which directs assistance by air, particularly by aeroplane, for fighting fires. (c) The COEM (Sea Emergency Operations Centre) which coordinates and plans action at sea in the case of serious pollution or an aeroplane accident. (d) The Sanitary Emergency Service which deals with the sanitary aspects of each event. (e) The CASI, which has already been described. Organisations subordinate to the Department help in the coordination of actions: (a) Ministry of Defence* (b) General Command of Police and Financial Agents (c) Police (d) Fire Service (e) Ministers — of the Interior* (i.e. responsible for the Prefectures, Police, Fire services, etc.) — of Transport* (i.e. responsible for bridges and embankments, railways, State water services, public works, the road network) — of Education (i.e. responsible for the Academies) — of Industry and Commerce (i.e. responsible for Provincial Work Offices and the Regional Work Inspectorate)

26 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

— of the Environment — of the Merchant Marine (i.e. responsible for the harbour masters) — of Post and Telecommunications* (i.e. responsible for the Directorates of Post and Telegraph, national companies for telephone services) — of Agriculture and Forests* — of Health* (i.e. responsible for national health structures) (f) Associations of Volunteers: — International Red Cross (IRC) — Ham Radio Operators’ Centre (CER-ARI) — Italian Alpine Club (CAI) — Caritas — Sovereign Military Order of Malta (SMOM) (g) the large service companies such as — ENEL (electricity); — SIP (telephones); — SNAM (national company for water and gas supply=ENI); — etc. The peripheral Civil Protection organisation is formed of (a) At the Regional level: the person regionally responsible for civil protection and the Regional Operations Centre. (b) At the Provincial level: the Prefect and the Provincial Operations Centre. (c) At the Local level: the Mayor and the Local Operations Centre. From the operational point of view, in the case of an emergency, the peripheral structures of organisations described above go into action each with prescribed tasks.

* Ministers who have their own representatives in EMERCOM.

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 27

8 CIVIL PROTECTION TODAY AND THE SNPC ACCORDING TO THE DRAFT BILL BEING EXAMINED BY PARLIAMENT The standard is applicable to four main groups: 1. The first is represented by the Minister of the Interior (Law 996/70, DPR 66/81) and concerns all the situations which involve serious damage or danger for people and goods. The Minister of the Interior takes charge, through the Prefectures, of emergency and helping services, assistance for people affected by natural catastrophes or accidents, whether they are the responsibility of Regions or other institutional organisations or whether they are the responsibility of the Minister for the Coordination of Civil Protection when he decides to intervene with extraordinary powers. 2. The second group is at the Ministry of Health and the Ministry of Labour (TU LLSS 1934, DPR 303/56, L.833/78 and DM23 December 1985). They deal, in particular, with health and safety in places of work. In particular the TU of 1934, in Articles 216 and 217, classifies industrial installations which produce vapours which are unpleasant and dangerous to general health in two groups: those which belong to the first must be sited in areas away from inhabited centres; those which belong to the second must satisfy special conditions. The authorities may refuse authorisation for the setting up of installations or impose special conditions. In any case the installations must be constructed respecting numerous standards which concern the environment, activities and fire. Art. 24 of Law 833/78 delegated the Government to issue a Unique Text on the subject and laid down the directives to which the exercise of the procural must conform. In this case it covers all the aspects concerning ndustrial risk, such as the unitary character of the safety objectives in the place of work and life. The following have been prepared: updating of standards; training courses; procedures for monitoring the safety of the environment and the state of health of workers; obligations and responsibilities concerning the use of materials; checks and needs of the working environment; productive programming; monitoring procedures; precautions to be adopted to avoid internal pollution which, as well as external, can be caused by chemical, physical and biological poisoning factors; criteria and ways of acting when there is a serious and imminent risk; ways of producing, selling and using dangerous products; special procedures for specific

28 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

risks; ways of determining and updating limiting values for noxious factors, the temporary standards which already exist for industries; reorganisation of public offices and services responsible for safety at work; coordination between State and territorial organisations and the definition of problems of standardisation. However, the procural has twice reached expiry and must be renewed. Article 32 of the same law lays down that the Health Ministry, the President of the Regional Court and the Mayor may issue contingent and urgent orders on hygiene, public health and veterinary policy, with greater efficiency than national, regional and local authorities. Finally there is the DM of 23 December 1985. 3. The third group concerns the decisions taken by the Minister for the Coordination of Civil Protection who, having exceptional powers, coordinates all the public administrations, organisations, institutes and voluntary organisations for preparation in case of emergency, on the site of the emergency, which because of its seriousness and extent cannot be tackled by the administrations in the field of their ordinary competence. In this case the Minister may himself take charge of action against the emergency. The Minister also presides over the committee which coordinates the security activities in the industrial sector created with CPDM, on 18 Dec. 1985, with the task of: analysing the risk situation and of drawing up safety reports, risk cards and internal and external emergency plans; setting up organisations for the prevention, control and monitoring of industrial installations; checking safety reports and emergency plans; encouraging Regions and Prefectures to adopt uniform criteria in the development of administrative action, training of personnel and safety of places of work. The Commission created by the DM of 23 Dec. 1985 of the Health Ministry, which has the same aims, must work as part of this committee. 4. The fourth groups concerns the CEC directives. Those concerning wastes (445/75 and 319/78) have been received (DPR 915/82 and Order of the Interministerial Committee in Art. 5 of the same DPR) and those which concern industrial risk (501/82 and 216/87) have not yet been received. Overall, therefore, Civil Protection is a pyramid-shaped structure with territorial base, divided into successive channels, which come into action by steps, starting from the local step, to satisfy each need of people affected by an event, in relation to the nature and gravity of this event.

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 29

If such an event becomes a disaster or a catastrophe, and if the resources prove insufficient to satisfy demand, a State of Emergency is declared. As has already been said, the Minister for the Coordination of Civil Protection assumes responsibility for action; the power of the orders is put into action for him and he can use the Fund for Civil Protection. The Unified Text of the draft law presented on 5 Feb. 1982 by Deputy G. Zamberletti and Senator G.Spadolini, and approved by the II Permanent Commission, is intended to perfect the organisation of Civil Protection by eliminating the gaps in the present legislation which emerged during the earthquake in Irpinia, 23 Nov. 1980. In this text assistance is not the only component of Civil Protection: prevention is re-evaluated; the structures for the management of smaller emergencies are the basis for interventions in catastrophes; voluntary organisations are given the chance to participate in the Committees laid down by law 996/ 70 in relation to prevention activities. The Regions, Provinces and territoral and institutional public organisations will participate with the State in setting up the SNPC. Even if it remains the responsible organisation, the Region and Province have a permanent function of coordination on their respective territories, and the mayor and local community are of great importance. In the draft there is a substantial revision of the organisation criteria presented in 996/70 and a new orientation towards the creation of a modern conscience on Civil Protection through the psychological and operational preparation of the public, as well as through the promotion of civil voluntary actions.

3 Emergency Planning in the UK: A View from the Inside GEORGE INNES London Fire and Civil Defence Authority, London, UK

HISTORY First, it will be helpful to explain the terminology used. Unlike most other Member States of the European Community, in the UK the term Civil Defence means emergency planning for war. Emergency planning for peace is referred to simply as ‘civil emergency planning’. In 1986 the Government decided that the term ‘Civil Protection’ would be adopted to cover emergency planning for both peace and war. In this connection it is noted with interest that a draft document published by the European Commission in April 1987 covering civil emergencies contained references to ‘Civil Defence’ policies. However, in the final document issued in June under reference 87/C176/01, the generic ‘Civil Protection’ has been substituted for ‘Civil Defence’. In the UK no single organisation is responsible for making contingency plans to deal with major emergencies whether for peace or war. This may seem a bit untidy but could be said to be typically British. It is common knowledge that the UK has no written constitution. Yet, somehow or other, by virtue of political cohesion and the judiciary the bureaucracy has, over the years, generally produced effective programmes to implement the decisions of democratic government. Traditionally, the primary responsibility for caring for the local populace—whatever the contingency—has been devolved from central to local government. It is the responsibility of local governments to feed the hungry, house the homeless and, generally, restore the aftermath of a major emergency to normality as soon as practicable. Local authorities therefore prepare emergency plans for peace (civil emergencies) and war (civil defence) and are empowered by Parliament to spend public money to these ends. Civil defence expenditure by local authorities is

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 31

almost totally refunded by central government under a grant-inaid scheme. Perhaps understandably for an island people, arrangements for the defence of our shores by the populace as a whole have figured prominently in our history since the Middle Ages; hence, in formulating civil defence policy, there has been a natural tendency to look to past examples which then serve as precedents for the future, For instance, in 1914 a government committee, established to consider what should be done in the event of an invasion, came to much the same conclusion as its predecessors had in planning to deal with Napoleon’s threatened invasion of 1803/4. Even then the planners had looked back to the arrangements made to deal with the Spanish Armada of 1588. Civil defence in the United Kingdom has quite a long history. Shortly before the Second World War a number of publicspirited people in politics, the armed services, industry and commerce became determined that the British people should not have to face the prospect of aerial attack as unprotected against its effects as the people of Spain had been during their civil war, so the Air Raid Precautions (ARP) system came into being during the war. This organisation was locally funded with links into the respective local authorities and enjoyed government support. The then Lord Privy Seal, Sir John Anderson—after whom a domestic air raid shelter was named—is on record as saying: ‘I cannot too strongly emphasise that whilst it is the Government’s business to fight the war, as for what people are to do it is the business of the community to prepare itself’ (author’s emphasis). Thus the first links were forged between local government and its now well established responsibility for co-ordinating responses to major emergencies whatever their character. One could easily go on to draw the parallel here between a bomb dropping on a populated district and a 10 tonne road tanker full of flammable material exploding and burning; the causes may be different but, so far as people and property in the vicinity are concerned, the consequences could be remarkably similar. Thus, Sir John Anderson’s historical assertion remains valid. Emergency planning, for peace and war, is local government business. THE DEVELOPMENT OF CONTEMPORARY POLICIES The intellectual development of British contemporary civil defence cannot be easily broken into discrete phases. However, there are

32 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

some identifiable turning points, namely, the Civil Defence Act 1948, the 1968 dismantling, the 1972 care and maintenance policy, and the 1980 ‘enhanced commitment’ subsequently reinforced by statutory Regulations made in 1983 and monitored since then by the Home Department in what is referred to as the Planned Programme for (their) Implementation (PPI). These developments are especially relevant, because it is to match them that a body of professional emergency planners has emerged (specifically in the top tier local authorities) upon whom falls the responsibility for making emergency plans, not only for the war emergency but also for other major emergencies. The post-war years have seen tremendous strides in modern technology leading to the development of new products and materials. Unfortunately a by-product of these developments is the growing dependence of industry and commerce on the use of hazardous materials. Partly as a consequence of this, and partly in response to the major accident which destroyed the caprolactam plant at Flixborough, Lincolnshire, in 1974, the Home Department issued a policy circular to local authorities (since embodied in that department’s Emergency Planning Guidance to Local Authorities, 1985) suggesting that officers employed on civil defence planmaking should be employed on making plans to deal with civil emergencies also. In addition to the promise by the Home Department of grant-aiding the staff costs for a modest amount of this civil emergency activity, the Local Government Act 1972 already empowered local authorities to incur expenditure to ‘avert’, ‘alleviate’ and ‘eradicate’ the effects of any emergency or disaster which could be foreseen as representing a danger to life or property within their jurisdictions. Local authorities were thus inter alia recommended to prepare general local emergency plans to deal with any emergency. These general, or so-called ‘catch all’, plans are still in being in many authorities and have proved their worth. For example, if a school is identified as a reception centre for those who suffer as a result of a local accident, it matters little whether the activation of this part of the plan has been occasioned by an explosion in a nearby site or a chemical spillage from a road tanker passing through the locality. At least the main ingredients of the plan are available for implementation. However, general plans do suffer from some selfevident limitations in that they are not specifically addressed to a specific scenario in a specific locality. Another consequence of the Flixborough accident was that the Government’s Health and Safety Commission appointed the Advisory Committee on Major Hazards who, in 1976,

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 33

recommended in their First Report the introduction of a notification and hazard survey scheme for installations where specified quantities of certain dangerous substances were involved. This culminated in 1978 with the issue of draft regulations for notification and survey of hazardous installations which, in turn, became law in 1983. The Committee also recommended complementary changes to planning legislation to deal with development at, and in the vicinity of, such installations. THE SEVESO DIRECTIVE AND THE UK RESPONSE Following the disasters in Italy at Seveso and Manfredonia, the now well known Seveso Directive was issued in 1982 by the European Council, requiring site-specific plans to be made for certain specified industrial hazards. This directive was translated into UK Statutory Instrument No. 1902, The Control of Industrial Major Accident Hazards Regulations 1984, commonly referred to as the CIMAH Regulations. In pursuance of these regulations some 220 such sites have been identified by the Health and Safety Executive which, among its other functions, enforces the regulations. During 1985 in Greater London, for example, 7 site-specific plans were made by the Emergency Planning Division of the now abolished Greater London Council. These plans included chlorine storage and processing areas, liquid petroleum gas and natural gas sites. More sites are still being identified and it is expected that by the end of 1988 some 10–12 sites in London will be embraced by the CIMAH regime. It is of interest that, when the CIMAH planning cycle started, London had its own government, the Greater London Council (GLC), but with the reorganisation of local government in 1986 the GLC and the six Metropolitan County Councils in England were abolished and their duties were inherited in the main by a lower tier of local government. Two exceptions were fire and civil defence (including CIMAH) which passed to successor Fire and Civil Defence Authorities. Also in 1986, with the enactment of the Civil Protection in Peacetime Act, came the coining of that term. Thus the London Fire and Civil Defence Authority, in which the author is serving, now has two functional responsibilities, namely fire-fighting and civil protection embracing preparedness for peace and war. The costs of the emergency planning staff are met by 100% grant-inaid from central government.

34 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

EMERGENCY PLANS Why do we need emergency plans? What does a professional emergency planner aim to achieve by making a plan in the first instance? What would happen if an emergency of one kind or another did arise and there simply was not a plan to achieve appropriate and coordinated responses to it? These questions can perhaps best be answered by reference to the recent and well publicised Bhopal disaster. On 3 December 1984 a lethal cloud containing some 15 tonnes of methyl isocyanide (MIC) covered some 30 square miles of the Indian town of Bhopal. Some 2500 people died. Much evidence has been gathered about this accident—even if some aspects of it are still shrouded in mystery—and of course the human interest element has been widely covered by the world media. The technical details of the disaster have been extensively ventilated in the scientific press and at seminars, notably the World Conference on Chemical Accidents held in Rome in July 1987, but doubt remains on some aspects. It is not proposed to address such matters now, neither is it appropriate to discuss the medical treatment of the affected population, but one relevant question remains: Why was there no off-site emergency plan to provide for such an eventuality? Had there been one, it should have addressed the various measures outlined below. Because it is generally accepted that the best protection in a toxic environment is to be indoors behind shut windows etc., the public would have been given prior advice to do just that. In Bhopal a public warning siren was actually sounded, albeit late, but nobody knew what the signal meant or what action to take upon hearing it. Moreover, according to one reliable source, the siren was sounded only briefly lest the public became alarmed! The measures that a professional emergency planner would have included in his plan would have been to ensure than the people within the vicinity of the site were — made aware of the existence and nature of the hazard; — told of the significance of the audio warning; — told what to do immediately on hearing the audio warning. These three measures, of which the last is most important, would have constituted the basic preliminary elements of the Bhopal plan.

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 35

It is common knowledge that some parts of Bhopal comprised temporary and frail domestic shelters and that there were even many pavement sleepers, but there were also some buildings which could in the event have been used for protection, and not all the people slept in the open. Indeed, if a relevant hazard analysis of the Union Carbide operation at Bhopal had been undertaken, the emergency scenario would almost certainly have been foreseen and appropriate steps taken, perhaps including the contingency provision of temporary shelter. The existence of a hazard analysis would have had a fundamental effect. Plant procedures and safety measures would have been examined in depth and, hopefully, action taken, thereby reducing the risks to such a level as to make the execution of an off-site emergency plan only a remote possibility. If Bhopal and, before that, Flixborough, Seveso, and others sadly becoming too numerous to mention, had been embraced by the Seveso Directive regime, the disasters now taking these names into the history books might not have occurred; even if they had, effective contingency plan-making would have significantly minimised the damaging consequences for life and property. EFFECTIVE PLAN MAKING How then do the professional emergency planners involved in CIMAH plan-making in the United Kingdom go about making effective and meaningful plans with a view to achieving coordinated and cohesive responses by all the agencies which have contributions to make in given emergency situations? Step 1: Hazard analysis As already indicated, the first step is to obtain from the user of the hazardous substance(s) a hazard analysis that has been endorsed by an independent and competent agency such as the Health and Safety Executive, and record a suitable synopsis in layman’s language early in the planning document. It should not be just a statistical risk appraisal of probabilities, or the determination of mean time between component failures, or the assessment of how many times per million years this or that might happen, but it should clearly and consistently reflect the scenario or scenarios as to what could hypothetically constitute the worst credible event(s). For example, in the case of a toxic substance, the hazard analysis should state that the worst credible event would

36 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

(a) cause a release at x kg/min for a duration of, say, y min; and (b) involve a potential total quantity of toxic gas released of, say, z tonnes. When this information is available it is possible to determine the area which could potentially become affected and to adjust the data in relation to weather, topography, population density etc. and, of course, to devise a method of applying these variables to a real world situation. Step 2: Aim With the hazard analysis in his possession, the emergency planner moves to the second step. Here he determines the ‘aim’ of the plan. The implicit assumption in the plan is that the ‘worst credible accident’ will happen. The aim must therefore be realistic and, above all, attainable. In the case of a massive release of a lethal substance, it would be a mistake to convey the notion that all the lives in the affected area must be saved—if such an idealised objective cannot be fulfilled. The aid must be to minimise the worst potential effects of the emergency. Every one of the planned activities must contribute to the attainment of the aim. The aim of the plan should be clearly and concisely stated before the ‘execution’ section is considered. Step 3: Execution This third step is the very heart of the plan, namely the ‘execution’ or implemention. In this section, the planner should first outline the resources needed to attain the aim, and follow with a description of the resources actually available from contributions by the various agencies. Specifically, it should answer the questions Who?, What? and When? This should be followed by an outline of the operational organisation needed to apply the available resources effectively to the hazard, including the important matter of the arrangements for command and control. The emergency planner should not, however, concern himself with how it is to be done—this is strictly a matter for the professional disciplines concerned. The plan maker will simply provide for the interactive coordination of all the agencies involved.

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 37

What the plan should also usefully provide are convenient checklists for the participants covering those generally relevant matters outside the specialist disciplines. For example, the checklist of the firefighter responding to a given emergency would advise him which route to follow, where to go, what equipment will be needed, or what sort of protective clothing will be necessary in the face of the particular hazard. Such information would also be of value to other contributors, in particular the police. Step 4: Communications and logistics Even the best plans will fail to achieve their aim(s) unless the contributors have adequate communications and appropriate logistics back-up. It is absolutely essential in crisis management— because it is what a major emergency requires—that at least the principal officers concerned should be able freely to communicate with each other and be supported by adequate equipment and material. Step 5: Plan validation/training/exercising/ maintenance Finally, once the plan has been made it must be validated or tested. This is usually done by running an exercise which has the further advantage of serving to train the contributors in their respective roles. Such exercises undoubtedly generate lessons for all to learn—not least the plan maker himself. Emergency plans are not born fully formed like Venus rising from the sea but are subject to a process of continuous evolution, progressing from a broad rudimentary start to greater and greater detail and coverage but in which perfection is never likely to be achieved. All plans need to be maintained and updated on a regular basis. The emergency planner It follows from the obvious importance of the emergency plan that the emergency planner must be a professional trained to analyse the problem and to identify the resources and actions required as well as those available in practice to solve or counter it. He must then devise an organisation to apply the resources and actions to the solution of the problem in the most effective and efficient (in

38 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 1. Age structure.

that order) manner. London has, on the whole, been successful in obtaining people with many, if not all, the required talents. The illustrations show the mixture of talents and qualifications brought together in the London Fire and Civil Defence Authority (LFCDA). Figure 1 shows the breakdown by age and reflects the general high level of experience (incidentally, the Authority’s retiring age is 65). Figure 2 shows the differing backgrounds of formal higher education and, for those exuniformed service, formal staff college training, for it is a sad reflection that it is presently only at such establishments that the skills of planning are thoroughly taught to the necessary extent. Figure 3 shows the differing work experience and the considerable number of officers with experience of more than one of the relevant categories. In terms of quality of work experience, just over 50% of the officers are members of the Institute of their previous professions while all but some 13% of the ex-uniformed members of staff held senior rank. The LFCDA Emergency Planning Division is organised into teams of 4 with as great a mixture of talents and experience as possible, and with team leaders who are either former scientists or people with considerable backgrounds of relevant experience; a very high proportion of the staff is engaged upon second careers. The total number of officers directly employed on emergency planning in a full-time capacity is not readily available. Most officers, however, join either the County Emergency Planning Officers’ Society or the Association of Civil Defence and Emergency Planning Officers. While membership of the Society is restricted to

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 39

FIG. 2. Formal academic qualifications. Twenty-four per cent of the staffhave had the benefit of post-graduate Staff College Training.

FIG. 3. Nature of previous work experience. Thirty-three per cent of the staff have had previous experience in the field of Emergency Planning.

the heads of the emergency planning teams formed in local authorities, membership of the Association is open to all officers employed full-time on emergency planning. Indeed, many members of the Society are members of the Association but not, of course, vice versa. Current membership of the Society is 58 and of the Association it is 392.

40 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

CONCLUSIONS Emergency planning in the United Kingdom is an old activity which has only relatively recently developed into a full profession. The principal thrusts of the function lie in the areas of civil defence and industrial major accident hazards. However, there are smaller but equally important areas of activity such as oil pollution and nuclear radiation. Probably the largest number of professional emergency planning officers is to be found in local government employment, though membership of the Society of Industrial Emergency Services is believed to be on the increase. There is a growing need for a centre of learning to address the subject of emergency planning. A formal course for aspiring emergency planning officers is needed leading to, at least, the award of a diploma. A properly developed career structure would also be beneficial to both the producers and receivers of emergency plans; among other things, it would reduce the considerable dependence on second careerists. On the wider issue of improving the quality of our emergency planner training, the Resolution of the European Council in June to ‘encourage, in cooperation with the Commission, exchanges of persons responsible for civil protection as part of training programmes undertaken by the Member States…’ is a most encouraging contribution to the development of the profession. It is to be hoped that the Commission will not be slow to take the initiative in that regard. In that connection, the article ‘Major catastrophes: our vulnerability’ in the Council’s May 1987 edition of Forum was of particular interest. One sentence in the article reads as follows: ‘If a rescue operation is to be efficient it must be properly organised, in other words, have a structure and chain of command like a military division on the battlefield.’ Clearly, the creation of the organisation referred to is the function of the emergency planning profession. In the same article there was a reference to the new European Disaster Medicine Centre at San Marino ‘…so that at European level there should be a single corpus of theory on the organisation of medical help…’; this initiative by the medical profession is to be applauded. Where, may one inquire, is the single corpus of theory on the organisation of multi-discipline responses to major emergency and disaster situations being formulated and taught at the European level, or even at the national level?

4 Emergency Plans in France R.GROLLIER BARON Institut Français du Pétrole, Vernaison, France

French regulations have long provided for measures to be taken in the case of an accident in industrial establishments, and there are labour laws concerning personnel training and control facilities that such establish-ments must have. The 1976 Law of Classified Installations replaces the former 1919 Law of Classified Installations. For some dangerous activities, and starting with certain amounts of products, manufacturers must obtain an operating authorization including the description of what is to be done in case of an accident. The 1967 petroleum regulation, resulting from the accident at Feyzin, requires a defence plan to be drawn up under the authority of the Prefect to define the course of action to be taken in case of accident, and stipulates the responsibilities of the head of the establishment and those of the Public Authorities. The EEC Seveso Directive makes emergency plans mandatory for member countries, while stipulating a certain number of principles. The 1952 interministerial instruction, called the ORSEC plan, which was improved in 1971, aims at ensuring the command, the mobilization of means, the inventory of these means and their distribution. This plan has been elucidated by the following appendices: ORSECRAD for nuclear activity ORSECTOX for chemicals ORSECHYDROCARBURES for petroleum products In 1985 a new interministerial instruction entitled ‘Technological Risks’ stipulates plans of action for chemical and petroleum installations. It applies to activities covered by the Seveso Directive, but the Prefect can extend its application to other establishments. It has two parts:

42 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

— The in-house operating plan (POI), worked out under the responsibility of the head of the establishment, concerning what is to be done inside the establishment when an accident occurs. — The special action plan (PPI), worked out under the authority of the Prefect, for an establishment or industrial complex when the accident has or-may have consequences going beyond the boundaries of the establishment. In addition, it deals with the POI/PPI interface during the time the accident is increasing in gravity. Mr Boissieras will discuss POIs in Chapter 5. A PPI has two parts: (1) the organization; (2) the means. It is based on scenarios leading to the assessment of the needs, to the identification of the means available, to searching for supplementary means, and it defines the public alarm to be set off. Its aim is to enable the Public Authorities to ensure the protection of persons, property and the environment. POIs and PPIs reinforce one another, thus requiring solid coordination at the level of how they are worked out. Likewise the implementation of public means also requires good coordination of means in keeping with the definition of missions. Exercises must serve to check proper procedures. The scenarios are constructed from reference accidents. We are interested in their consequences and not in preventing them. Among the missions included in the PPI are, in particular: — Alarm — Firefighting — Safety perimeter — Access routes — Instructions to the public — Assistance and relief for the wounded — Pollution control — Relations with the media — etc. A leader and means correspond to each mission. Command is ensured by an operational command post and a logistical command post. The general manager of assistance and relief is the Prefect or his delegate.

SESSION II On-Site and Off-Site Emergency Planning Design Chairman: J.A.S.NICOLAU National Service for Civil Protection, Portugal Rapporteur. R.GROLLIER BARON Institute Français du Pétrole, France

5 Guide for the Establishment of an Emergency Plan J.BOISSIERAS Rhône Poulenc, Safety Directorate, Lyon, France

1 GENERAL COMMENTS 1.1 Definition The Emergency Plan is the guide on the setting up of internal and external equipment at the Establishment, previously inventoried, and of actions to be taken when there is an accident situation. For the Establishments alluded to in the Order ORSEC Plan: Technological Risks, the Emergency Plan corresponds to the requirement for the establishment of an Internal Plan of Operation (IPO), for which the Head of the Establishment is responsible, and it contains all the information to be given to Public Authorities to carry out the Special Intervention Plan (SIP) prepared under the Authority of the Commissaire of the Republic: — Starting from a study of the potential dangers presented by the installation, the IPO defines the organisational measures, the methods of intervention, and the necessary means which the operator must put into practice in the case of an accident, to protect personnel, the public and the environment. — The SIP aims to ensure the safety of the public and to protect the environment when the accident entails or may entail danger outside the Establishment’s boundaries.

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 45

1.2 Why an emergency plan? The Emergency Plan forms part of a policy of prevention and protection of people and goods, of business and its environment, in agreement with the general policy of Public Powers. In the case of an accident it is too late to develop a strategy of actions taking account of all the possible consequences. To avoid improvisations, it is a good idea to predict and to plan. The Emergency Plan also has a legal foundation based on: — the Working Code through the obligation to give safety training (R231–34/35/36/37) and to put into practice fire-fighting equipment, including material for the rescue and evacuation of personnel (R23338/39/40/41); — the Regulations of the Classified Installations; the decree of 2 Sept. 1977 applying law 76.663 of 19 July 1976 in particular envisages the organisation of safety means (Art. 3–5). Decrees of classification may lay down specific protection measures. For installations covered by the Petroleum Regulations and their extensions, a defence plan must be organised (decree of 4 Sept. 1967, Art. 10) and an internal operation plan, plus an overall defence plan (decree of 9 Nov. 1972 on hydrocarbon deposits, Art. 10): — Texts of application proceeding from the CEC directive 82/501 of 24 June 1982 (Seveso) concerning the major risks of some industrial activities, which has been applicable to the Member States since 8 Jan. 1984. — The ORSEC Plan: Technological Risks, an interministry order of 12 July 1985 on intervention plans in the case of accidents which, fulfilling the needs of the Seveso directive, replaced, in France, the ORSEC Hydrocarbons and ORSECTOX plans. 1.3 Field of application The Emergency Plan concerns any situation involving the putting into practice of safety actions or of protection of people, goods and the environment. Although it is intended to allow mastery of serious situations (fires, toxic emission, pollution), it appeared necessary not to exclude from its field of application accidents or incidents of

46 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

medium seriousness as far as they need non-routine actions of help or information. The corresponding procedures will be distinguished as a function of the nature, importance and psychological impact of the accident or incident. Account should be taken of all the situations linked to the presence or absence of personnel in the Establishment (working hours, periods of leave, social conflicts, etc.) and of its accessibility. It must be operational whatever the situation, and be able to deal with the specific risks of each situation; from this, one can see the essential role of permanent monitoring (caretakers, compulsion, remote observation, etc.). 1.4 Manual The Emergency Plan is formalised by the drawing up of documents, which are collected together in an ‘Emergency Plan’ manual, which contains all the information necessary to manage an accident situation. This manual is drawn up by the Establishment Head, in liaison with the Public Powers, and generally under the coordination of the Safety Head, who is responsible for updating it as a function of the evolution of — risks or knowledge; — the organisation, structures; — the environment; — means of intervention. The Establishment staff who are asked to organise or take decisions in the case of an accident must know and have mastered the contents of these manuals, particularly the classes of compulsion. Outside the Establishment the manual will be sent to the people responsible for Civil Safety. To facilitate checking and updating, all the copies will be numbered and named with the function. In the Company there will be a control copy as evidence of updatings. These can be made when intervention exercises are being performed.

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 47

2 STAGES FOR THE REALISATION OF AN EMERGENCY PLAN (1) Examine the accident situations which merit actions to be taken into account in the Establishment Emergency Plan, with — nature and location of the risks; — gravity of the consequences. This evaluation results from the ‘danger study’, which is obligatory for all classified installations subject to authorisation. (2) For each possible and probable scenario, define the internal and/or external means of intervention, human and material, to be put into operation to limit the consequences. (3) Draft the procedures of — intervention; — information; — returning to normal after the accident; as well as the advice for carrying them out. Take the advice of those concerned. (4) Organise the whole in an ‘Emergency Plan’ manual, which must be in the form of single sheets which can be used by anyone involved. 3 EMERGENCY PLAN MANUAL This may act as a specimen scheme for the internal operation plan. 3.1 Alert — Description in the form of an organigram of the progress of the alert from the first sign through to the services concerned — List of the telephone numbers and addresses as an appendix

48 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

3.2 Geographical situation — Plan of the location positioning the factory in relation to its environment on the scale of the major risk and showing the access and assistance routes — General plan of the Establishment with the reception sites — Meteorological data such as the wind rose of the site 3.3 Risk For each unit, zone or workshop, the plans of the inside of the establishment show in particular — the possible ways of access; — the zones to be protected in an emergency; — the zones which might be affected by a toxic cloud or by a shock wave caused by an explosive cloud. 3.4 Means of intervention — List of the Establishment’s fire-fighting equipment with its potential. — List of the external public and private defence equipment, with its potential, where it comes from, and the time needed to make it operational (after the call) — Private or public water services — List of the various materials or products with their potential, where they come from, and the time needed to make them operational (after the call) 3.5 Organigram of the services Organigram of the assistance services, with the names of the people in charge and the staff needed to ensure the following five tasks: — Operation: stopping units and making them safe; fighting against the accident

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 49

— Communication: making and keeping available means of communication — Logistics: supplies of material, fuel, men,… — External relations: administration, public, media, functional services. — Observation: preparation of the log-book, files, etc. … 3.6 Operations For each unit, area or workshop, the strategy will be studied in relation to the potential danger classes, and each intervention sheet will include the following elements: — Risk definition: — Fire/Explosion — Escape of toxic gas or liquid — Escape of inflammable gas or liquid — Aims of the fight against the accident — Location of the PC and the organisation of the assistance — Evacuation and counting of personnel — Staff necessary and their role — Means necessary and where to find them — Information on the administration, the media and the public — Operations to be carried out. Appendices — Inventory of dangerous products and files produced — Plans of the installations Remark This schema may be changed depending on the characteristics of the Establishment itself.

50 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

4 RECOMMENDATIONS 4.1 Emergency plan always operational The modes of work of Establishments vary, but an accident can occur at any time and often in the least favourable situations. It should therefore be possible in any circumstances to summon — Personnel who can take decisions (personnel present, according to regulations, or who can come in quickly when called); — Material and human means of intervention. Safety functions must always be envisaged in the organisation. The list of people who must fulfil these tasks in the case of an accident must be available and the people must be informed. The personnel outside must be easily contactable and be supplied with passes in cases where traffic restrictions are set up. Permanent readiness is ensured by the existence of a ‘fixed point’ where the tasks and means defined in the organisation lead at least to the transmission of the alert. 4.2 Alert It is the duty of any witness of the beginning of an accident or of an anomaly which might lead to an accident to give the alert and to act with the means at his disposal and within the limits of his ability (1 st intervention step). The alert is the information given to ask for assistance, in principle using alarms which are inside or outside the Establishment. Staff should be trained to give a brief and precise warning message indicating the place, type and seriousness of the accident. Generally the message is received by another person at the Fixed Point (assistance centre, guard post, telephone switchboard, or remote sensing centre). The means of intervention corresponding to the type of accident are triggered by alerting — the Establishment’s permanent or auxiliary fire service, or outside firemen (possibly put on pre-alert); — medical service and/or first-aiders;

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 51

— people with a specified task (e.g. reinforcing guards), etc. … There will be differentiated alert levels (internal and/or external) depending on the type of accident and on its potential consequences, depending on whether it concerns — a zone of the Establishment; — the entire Establishment; — outside the Establishment (cf. Section 4.10). The alert level is decided by the most senior person present at the time. 4.3 Means of intervention The means will be adapted to the nature and importance of the risks. The Working Code obliges the Establishment Head to ensure — a minimum of protection against fire (extinguishers, instructions,…), including staff training; — the training of first-aiders in all the continuously established teams. In general the quarter-Heads will be first-aiders. In the Establishments subject to the Classified Installation rules, the means of intervention are defined in relation to risks examined by the study of dangers and by the scenarios considered possible for accidents. The most pessimistic scenarios which are least likely to occur may be taken into account. In all cases, the assistance systems which must be ensured are both internal (those of the Establishment) and external (those of the Public Powers or Mutual Assistance). The coordination of actions implies delays which must be taken into account in evaluating the efficiency of the assistance. Practically, the preparation of procedures and information for the mastery of each risk must allow definition of — who acts (name, address, how he can be informed,…); — with what means (location and performance of the materials); — how to coordinate the performance of the intervention.

52 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

4.4 Triggering of the emergency plan As soon as the alert is received, two tasks must be ensured: — Define the actions for treating the accident (tactical choice=stop the unit, put into a safe state, evacuation,…); this task is the responsibility of the most responsible person on the site — Put into action the means of intervention (strategical choices=controlling the accident, zones to be protected, help for people,…); this task is the responsibility of the intervention head (2nd rank and others) These two tasks can only be accomplished with perfect coordination between the operation hierarchy and the different intervention levels. If the accident cannot be mastered in the framework of the workshop, the following must be set up: — An advanced operational CP, near to the accident, directed by the person responsible for the intervention — Then, if necessary, a Central CP housing the Assistance Directorate, in a room where liaisons with the advanced CP on the one hand and the outside world on the other will be organised In an Establishment which has a Security organisation and means of intervention, the Assistance Directorate comes under (as part of the IPO) the Establishment Chief or his representative. The person responsible for Exterior Assistance receives a task from the Director of Assistance. He deals with its performance and puts the necessary means into effect. The ORSEC Plan: Technological Risks envisages that, in the case of an accident extending outside an Establishment, and without waiting for the starting of the SOP, the Establishment Head must act outside his Establishment under the responsibility of the public authority and in the framework of previous and clear agreements with this authority, stated in the SOP.

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 53

4.5 State of emergency: internal evacuation, counting If the nature of the accident implies the evacuation of a zone, the workshop must set up a state of emergency. To do this, special instructions will be established to make the workshops safe with a small number of manoeuvres and without any risk of making the accident worse, while admitting the possibility of some leaks, in particular of products. If necessary these manoeuvres will be performed with a small number of personnel and/or means of protection such as individual masks. When the order for evacuation of a zone is given, the personnel must go to a prescribed assembly point and be counted. Emotional reactions might lead some people to flee. Part of in-service training is for personnel to acquire the right reflexes. An up-to-date staff list, including home address and telephone number, must always be available. As far as possible the staff will be counted through the hierarchy, without forgetting — part-time staff (maintenance, administration,…); — outside organisations; — visitors. 4.6 Means of communication Inside the Establishment the people in charge will generally have radios for communication, as well as the telephone. It is advised that radio posts should be made available for outside assistance (firemen). The orders to be given to the staff should be given by means of telephone, radio, loudspeaker, megaphone, messenger,… Communication with the outside will be mainly by telephone. Telephone lines must thus be available to organise assistance. Taking account of the risk of breakdowns, there should be two independent systems for communication with the Main Assistance Centre. Lines should be reserved for outgoing messages (be careful of the risk of blockage of lines which go through a guard-post).

54 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

4.7 Reception Following the accident, various categories of people might come to the plant, so a reinforced guard is needed at the Establishment entry. These guards will direct — the assistance towards a pre-established assembly point or, if not, towards the site of the accident (operational CP); — the authorities towards the Directorate’s representative, or the usual person who receives visitors (special room); — the media towards a specially set up room; accompany journalists who are authorised to visit accident sites. Curious onlookers must be kept outside and they will be asked to keep away from dangerous zones while waiting for barriers which might be set up by the public authorities. 4.8 Information procedures These should not be confused with alert procedures or with the orders given as part of the intervention procedures. The aim of the information is to inform people of the nature and the consequences of the accident. It must be quick, objective, and limited to the facts. Do not formulate any assumption on causes or responsibilities. The information must be given by the Establishment Director or a person designated by him and trained for this job. Information for families should be organised quickly, especially if there are injured people or people who are being kept on the site. The information will be the subject of a precise plan incorporated in the emergency plan and structured depending on the seriousness of the accident. A scheme is proposed in the Appendix. 4.9 Analysis Independent of any legal enquiry, it is a good idea to set up quickly a technical analysis which allows the drawing up of an accident report. Spontaneous eye-witness accounts should be collected quickly, if possible on tape. They should then be confirmed in writing.

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 55

To do this, one may use audiovisual apparatus (camera, video camera, film camera,…). There should be at least an instantly developing camera in the first-aid vehicle. 4.10 General information of the public When the consequences of an accident may overflow the limits of the Establishment and affect neighbouring populations (e.g. toxic emission), an alert procedure must be set up in the Special Intervention Plan. The public must be informed of this alert procedure in advance by the distribution of a card giving details of the security measures and the procedures to follow. On 22 July 1986 the UIC published a technical circular recommending the conduct for this subject. APPENDIX: EXAMPLE OF AN INFORMATION PLAN For any incident or accident, even those which a priori appear harmless, and in any case as soon as the alert is given, immediately inform — the Company hierarchy following special instructions. If there is damage which temporarily puts the installation out of action, risks that the accident might extend outside, signs perceptible from outside, and emission or danger of emission of pollutants, the factory Director or his representative will inform, as quickly as possible, — the inspector of classified installations and, in the most serious cases, the Commissaire of the Republic, then, as quickly as possible, — the local authorities, — the police, if they have not been informed as part of the alert. Then one will inform — the factory inspectorate, — the advising engineer of the CRAM, and, as a courtesy,

56 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

— neighbouring factories. If personnel are kept on the site or if there are injuries, one will warn — the family of the personnel concerned. Finally, for serious cases, a communique will be drawn up in agreement with the Public Authorities, to inform the public.

6 Emergency Plan and Alert System at MONTEDIPE L.CORIGLIANO & F.ANTONELLO MONTEDIPE, Milan, Italy

Provision of appropriate information about the actions to carry out and the correct behaviour in case of accident has always been a primary requirement in the chemical industry. Of course, the development of process plants demands a continuous updating of the emergency rules and procedures, checking their feasibility and adaptability to different possible events, considering the latest available studies and technologies. This concern is clearly expressed in the legislation and particularly in the EEC Directive on the major accident hazards of certain industrial activities which also requires linking of on-site preparedness emergency planning with off-site Territorial Civil Protection Plans. The several situations of MONTEDIPE factories (MONTEDIPE is the petrochemical and polymers company of the MONTEDISON group) have made necessary different approaches to achieve this goal, considering the extent of factories, the number and type of plants, the organisation and constitution of personnel, etc. As an example, we report here the case of the larger MONTEDIPE factory (i.e. P.to Marghera), for which three levels of emergency have been defined: 1. The local emergency, referred to a limited event whose possible consequences are confined to the plant where the accident takes place. 2. The zonal emergency, when the area affected by expected consequences can include several plants. 3. The general emergency, when the area that can be affected involves all or most of the factory. The three aforesaid levels are covered by the specific Department Plan and the General Plan, which is linked to the Territorial Civil Protection Plan for chemical Hazard. Obviously the three steps are inter-connected in such a way as to allow the gradual transition

58 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

from one level to the higher one in the case of anomalous evolution of the situation. The Department plan is developed on the basis of a range of reasonable hypotheses of specific events. Assessments of occurrence likelihood are made, and possible consequences are evaluated providing adequate operations and measures both to reduce the likelihood and to mitigate the consequence. As a general rule, the Department plan (first level) includes — the indication of charged employees who must accomplish the emergency operations and the relevant tasks; — a map of the plant on which is plotted the route to follow in order to perform the task; — a list of Departments and Managers to give notice about the event and its possible evolution; — the ultimate meeting point from which to abandon the plant in order to evacuate. This plan provides in particular for quickly warning the in-house fire brigade, other plants involved in the situation, and the emergency planning coordinator. Afterwards, in relation to the development of the situation, and on the basis of a predetermined check, one may extend the emergency to the second level. In this case, an Emergency Committee will meet in a centre equipped with — personal protection equipment; — plan of the factory; — direct phone lines to Company headquarters, public authority, emergency services; — the most important technical files for all the different plants and utilities. The method of notifying employees of the actual situation is the first concern in the case of accident, particularly in the second and third levels of the emergency plan. Panic caused by uncontrolled rumours and feelings or lack of knowledge can also create an emergency. For this reason the factory has a departmental selective communication warning system, from the oper-ations centre to the control rooms of the plants and other specific workshops. Such a procedure allows shutdown and evacuation of the plants or the areas affected by the emergency without spreading alarm and without involving needless general emotional upset of other departments. .

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 59

The warning system, consisting of software for a microcomputer, can represent on the display the map of the factory or the part of it concerned with the event, illustrating the likely affected area according to the chosen type of accident. The operator may find — typical emergency cases; — the appropriate procedure to adopt; — the area that can be typically affected. From the keyboard it is possible to check the availability of the system at any time. These areas have been estimated by computerised mathematical models simulating the consequences of chemical accidents in the typical range of reasonable hypothesis. The warning system is connected to meteorological stations in order to collect data on wind direction and velocity. This affords the possibility to supply information about the accident and to issue the appropriate guidance how to operate. Moreover, the warning system is connected also with the network of alarm points, allowing the spread of preparedness recorded messages that are appropriate to the actual situation. A continuous alarm signal (sirens) will however, be heard in all the departments in the case of a widespread emergency. Periodic simulations of different types of emergency are performed, in order to train the operators, to test the correctness of the procedures, and to improve expertise. It is therefore possible to check the reliability and functionality of the warning system. The trainers may choose from among several typical hypothetical events and test, simulating the alarm, the preparedness of the operators in the receiving stations. The fire-fighting and the first-aid within the works are entrusted to the fire brigade and the medical department, which have specialist teams working on shift. This type of organisation has encouraged the development of a suitable professional attitude to the problem; in addition to the availability of appropriate equipment, it has proved to be of use also for emergency measures taken outside the works itself. In fact, for some years now the emergency teams of some works have proved themselves able to act on the request of the authorities, or of other companies in the event of accidents during transportation or in other sites. A set of emergency protection equipment is available to deal with different situations, e.g. self-contained breathing apparatus, gas

60 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

masks with universal and specific filters, chemical safety goggles, acid-proof and gas-proof clothing, face shields, etc. Moreover, the teams have special equipment at their disposal, e.g. — hydraulic pumps ensuring safe operation even where flammable mixtures are present; — a flare that can be assembled on the site of the accident to burn any flammable gas; — neutralising products which inhibit the evaporation of toxic or harmful substances; — kits for repairing leaks. For some years now it has therefore been possible to respond efficiently to all the requests for help received, working together with the appropriate authorities to prevent harmful consequences and to mitigate the effects of accidents occurring even hundreds of kilometres away from the works itself. Moreover, MONTEDIPE runs, on behalf of Federchimica, a database of more than a thousand substances to comply with any emergency situation. A public authority, such as the fire brigade, can call this database, named SIET, at any time; there will be an expert who will answer questions after a quick scan of the database.

7 On-Site Emergency Plans G.L.ESSERY Imperial Chemical Industries, Billingham, UK

1 INTRODUCTION The Seveso Directive, which was enacted in the UK as the Control of Industrial Major Accident Hazard Regulations 1984 [1], requires inter alia that a site on which is stored more than specified quantities of certain hazardous materials shall have an on-site emergency plan. In most cases these plans had been in place for many years, because manufacturers had recognised their value in mitigating the effects of serious incidents. Overall the protection of people both on-site and off-site who might be affected is best achieved by using procedures designed to ensure that the risk of a serious incident is low and that, if it does occur, its consequences are minimised. These procedures will normally be directed towards: 1. Hazard elimination (e.g. use of non-flammable rather than flammable solvents) 2. Hazard reduction (e.g. use of smaller inventories in process and storage) 3. Hazard containment (e.g. pressure vessel design, provision of bunds, etc.) 4. Incident mitigation if all else fails To achieve items 1, 2 and 3, plants processing hazardous materials need to be designed, constructed, operated and maintained to high standards. The use of multi-stage hazard studies, strict adherence to design codes, proper maintenance and regular tests of key plant items and safety devices all contribute to ensuring that plant hardware is reliable. Equally important is the selection and training of operators, the provision of operating

62 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

instructions and safe working procedures, their maintenance with audit and review and good supervision. However, even with high quality plant and adherence to carefully considered procedures, it is still possible that an improbable event, or more likely an unforeseen series of events, could lead to a serious incident. Should this occur, a sound emergency plan is essential. Guidance on emergency planning has been published by the UK Health & Safety Executive [2], and another paper [3] includes a simple quantified approach, which could be used to give a rapid consequence assessment of a toxic gas release. Where the effects of a major accident could extend beyond a site boundary, it is essential that the on-site plan should integrate effectively with those of the external Emergency Services. Such integration can be achieved only by close liaison with the planners and the operating teams from these services. Guidance on off-site planning is available from the UK Chemical Industries Association [4], and more general advice is available on emergency planning for Local Authorities [5] and for industry [6]. It is not possible to provide a detailed description of an on-site plan in this short paper. What follows is therefore an outline of some aspects that need to be considered in preparing an on-site plan. 2 EMERGENCY PLANNING: AIM AND GENERAL PRINCIPLES The prime aim of an emergency plan should be to restore normality as far and as quickly as possible with minimal adverse effect on people and the surroundings. In the case of a minor incident which affects a single plant area only, this aim can generally be met fairly easily. However, this may not be true of a major incident which affects a much wider area. In this case the people trying to contain the incident at source are often unaware that the effects of the incident are causing problems further away and the people trying to ensure that the correct actions are taken elsewhere often have great difficulty in obtaining enough information to enable them to give sound advice and instruction. As rapid, accurate information is essential, the procedures and training must prompt and condition people to act correctly. Unlike a normal plan, which starts from a single clearly defined point, an emergency plan has to be able to start from any one of many abnormal situations. As many of the people who will be

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 63

called upon to perform key roles in the major incident response team will not normally be involved in dealing with emergencies, it is essential that the emergency plan should be simple and flexible. It needs to be simple so that those called upon to implement it can do so readily, despite the wide range of start-points, and it needs to be flexible to allow for easy escalation or de-escalation to match changing situations. Simplicity will also reduce training requirements and increase the likelihood that all those covered by the plan will react in the desired manner in the event of an emergency. Furthermore the simple, flexible approach will ensure an easy dove-tailing of the on-site plan with the off-site plan prepared by the Local Authority in conjunction with the Police, Fire and Ambulance Services, with whom there should be consultation during the planning stage and following regular exercises thereafter. Before starting to draw up the plan, it is necessary to postulate the various types of major incident which could arise and the likelihood and severity of these hypothetical events. Apart from possible fire, explosion and toxic release scenarios, it may sometimes be necessary to consider the normally absent products of a runaway reaction such as dioxin at Seveso or the toxic products of combustion following a major fire. Possible contamination of the environment may also need to be considered. The next stage will be to consider the appropriate countermeasures at the scene and elsewhere. There will have to be a rapid means of calling in both the Emergency Services and the Company personnel required to respond to the incident. It will also be necessary to warn people who might be affected by the incident, but it should be recognised that this ‘warning’ might come after an explosion or a gas cloud has affected the people concerned. Where containment has been lost, it should be reestablished as quickly as possible. Personnel must be accounted for or searched for and where necessary casualty treatment must be initiated. In dealing with a major incident, it is advisable to establish both an Incident Control Point and an Emergency Control Centre. The Incident Controller (who needs to be readily recognised by the Emergency Services) is likely to be the shift supervisor until he is relieved by a more senior manager with knowledge of the area in which the incident is occurring. He will be responsible for ensuring that the actions outlined above are taken and, in the initial stages of an incident, he may also have to act as the Site Main Controller. The Site Main Controller will operate from the

64 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Emergency Control Centre once this is established. He will be primarily concerned with co-ordinating the required actions across the site other than at the incident, advising the Emergency Services about the way the incident is likely to develop, and arranging backup support for the Incident Controller. To perform these tasks he will need information about the current situation, likely weather changes, resource availability, etc. The main objective of his support team will be the seeking out of this data to aid joint decision-making with the Emergency Services. Good communi-cations with the decision-makers in the Emergency Services is therefore essential. The Site Main Controller should also ensure that adequate consider-ation is given to the provision of data for the Public Relations team, data preservation, traffic movements, shift changeovers, etc. 33 IN-PLANT INCIDENTS: SOME ASPECTS TO BE CONSIDERED As has been long appreciated by fire-fighters, a quick response by a well trained person can prevent a minor fire escalating into a major conflagration. Similarly, a plant operator is often able to limit the scale of an incident provided that he has been made aware of the potential non-routine situations and given appropriate training and practice—real or hypothetical. In order for this training to be soundly based, it is necessary for the local management team to assess the various types of incident which could occur in its area. In addition, the team should consider how the superimposed effect of a partial or total loss of essential services would influence their procedures for re-establishing containment. For example: Would remotely operated valves still be operable? Would the shutdown purge systems still be operable? Is the emergency lighting adequate? Do the communication systems have standby power supplies? Having identified the various undesired events and their potential consequences, appropriate counter-measures need to be considered. For example: — Are the plant fire-fighting resources adequate for the initial attack prior to the arrival of the professionals? Is the equipment adequately maintained? Is the plant team adequately trained? Are there some situations where a fire should be allowed to burn or be contained rather than extinguished?

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 65

— Can the drains cope with the fire-fighting water? (Inadequate drains can lead to the spread of hydrocarbon fires.) Should the fire-fighting water be contained to avoid contamination of water courses? — Are instrument and electrical cable ways adequately protected against fire? — Has similar thought been given to structural steel and stock tanks? — Are relief valves and vents sized for fire conditions? — Could sub-zero liquids enter systems not designed for low tempera-tures, thus causing failures which could exacerbate the incident? — Can all the necessary isolations be made easily? — Should more isolation valves be motorised so that they can be operated quickly from a safe location? Should some isolation valves be actuated automatically by gas sensors? — Are the plant alarm, evacuation assembly and roll-call procedures adequate for the events postulated? What about contractors, drivers and visitors? — Is there more than one method of communication? — How is additional help summoned? — How is the decision taken to declare a major site emergency which will require the call-in of the Emergency Contol Centre team? Before moving on to consider some aspects of dealing with a major incident, it is worth commenting on a very natural human reaction which sometimes leads to a less than optimum response. Some people like to believe that they can cope with an incident on their own. This reluctance to ask for help early enough can lead to an incident not being tackled in the best way and to a shortage of the information needed for advising the Emergency Services. It is better to have far too much help at hand than to be just a little short, especially if escalation could occur unexpectedly. 4 MAJOR INCIDENTS. SOME ASPECTS TO BE CONSIDERED All the comments relating to in-plant incidents are still applicable, and in addition there will now be a need to ensure than an Emergency Control Centre is established as quickly as possible. This centre will act as the main communication link with the Emergency Services—particularly the Police. It will act as a data-

66 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

gathering point for information gathered from many sources. To take account of different wind directions, it may be necessary to have two centres allocated, preferably dedicated to and well equipped for the purpose. It may be prudent to locate this centre some distance from the site, providing that it can be manned quickly and that it has excellent communication facilities. Having decided that a major incident is occurring, many actions are required in quick succession: 1. The Emergency Services need to be called. They must be given the location and nature of the incident and, to identify a safe approach route, they should be told the direction from which the wind is blowing. 2. The site needs to be told of the incident, possibly using audible (and zoned?) alarms backed up with a looped tape to emergency telephones. 3. A mobile analytical team for monitoring the environment may be needed together with a readily usable means of estimating the extent of a toxic cloud. 4. A more senior Incident Controller may be needed. 5. A Site Main Controller and his team may be needed. 6. A Public Relations team will be needed. (Media interest even in minor incidents is much more rapid and demanding than it used to be. Good information flow is essential.) 7. Additional telephonists may be required to re-route calls to the Police Casualty Bureau or to the Public Relations team or to the Emergency Control Centre. All these calls need to be made quickly when the Works resources are fully stretched dealing with the emergency. Can the calls be automated or cascaded? Remember that the travellers may need to be told of the direction from which the wind is blowing. Remember also that police road-blocks might restrict the access of those called into work. It is therefore advisable for non-uniformed personnel to carry some form of identification. Bearing in mind the difficulty of establishing what is happening in the first hour or so of a major incident, it is essential that good communication links are established between the Emergency Control Centre, the incident and, where appropriate, the mobile analysts. (On occasion it may be advisable to allocate a radio channel solely for these three users, particularly if problems arise from interference with other users on different channels.) Difficulties arising from interference or ill-disciplined radio procedure can also be overcome by using telephones in preference

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 67

to TELRAD or radio. (The absence of a telephone near the incident is easily overcome with a modern plug-in telephone and a long extension lead carried on a Works emergency vehicle.) A police presence in the Emergency Control Centre is also strongly recommended; the police may have information which will assist the control room staff, and the police representative is able to obtain a better picture of the Works situation. In assessing a situation based on a limited amount of information, some of which may be of poor quality, there is sometimes a temptation to make assumptions. This should be resisted as it could lead to the giving of the wrong advice. It is also important to provide the police with information in a form which will help them. They need to know the effect of a particular gas concentration rather than its actual value. In most cases the advice for the protection of the public from fire, explosion and toxic release will be to go indoors and shut all windows and doors. However, in the event of a toxic release, and as shown in HSE papers [7, 8], it is then important to go outdoors once the gas cloud has passed. In the event of there being many casualties, it may be beneficial to have a company personnel presence in the police casualty bureau. This representative should be able to work directly with his personnel colleagues in dealing with the next of kin without needing to involve anyone in the Emergency Control Centre. While in-plant incidents are clearly owned by plant personnel, difficulties could arise with incidents in interface zones or in pipe trenches if areas of responsibility for dealing with major incidents are not adequately defined. These cases must be recognised and appropriate arrangements made. 5 TRAINING Apart from the in-plant training needs identified earlier, everyone with an active role in the control of a major incident should be aware of the emergency procedures overall. Furthermore each individual should know what to do in the one or more posts which he may be called to occupy in an emergency. The use of checklists can be of great assistance when under pressure in an abnormal situation. Practice in radio procedures may also be necessary. A training package [9] which gives guidance on emergency planning and includes seven in-depth case studies is now available. Another useful training aid is a video prepared for

68 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

CONOCO called ‘April Storm’. It shows a major ‘table top’ exercise with the involvement of several external organisations. The most essential training will be in conjunction with the Emergency Services. It should take the form of a carefully designed and scripted exercise to test the emergency procedures which have previously been prepared following detailed discussions with the Emergency Services. Table-top exercises in which most of the participants are present in one room are useful in that they cause minimal interference with plant operation and they can be conducted at a speed which allows the testing of the team’s reaction to more than a single train of events. A somewhat more realistic testing of a site’s major emergency procedures is provided by a ‘Control post’ exercise, preferably held out of normal office hours. In this case the participants are called out as they would be in a real incident, and they act in accordance with the information received at the place required of them by the emergency procedures. With this arrangement, all necessary communication systems can be tested properly. These joint exercises are of particular value in that they expose any weaknesses in the procedures to which the several teams of participants are working, and in the interaction of these procedures. Equally importantly, the exercises help in building understanding and trust between the participating teams. In the essential joint debriefing sessions after such exercises, there is also scope for a helpful interchange of ideas to overcome some of the problems which have been identified. 6 FINAL COMMENTS For sound business reasons, planning to avoid a major incident has been the normal practice of industry for many years. However, it has also been recognised that the potential for a major incident still exists and that appropriate pre-planning for such an incident should be done in order to minimise its consequences. The process of identifying possible release mechanisms and rates should result in a full appreciation of the possible major incident situations, which in turn will allow the drawing up of procedures to handle such situations. These procedures should be simple, flexible and widely understood. In many cases over the years there has been close co-operation on a voluntary basis between industry and the Emergency Services in the drawing up and testing of the various emergency procedures. The Seveso Directive and the associated UK CIMAH

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 69

Regulations now require that both on-site and off-site emergency plans are completed. As these plans must operate together, this requirement has brought industry’s emergency planners into even closer contact with the local Emergency Services, with benefits to all concerned. REFERENCES 1. 2.

3.

4. 5. 6. 7.

8.

9.

Guide to the Control of Industrial Major Accident Hazard Regulations, Health & Safety Series Booklet, HS(R)21, 1984. Control of Industrial Major Accident Hazard Regulations: Further Guidance on Emergency Planning, Health & Safety Series Booklet, HS (G)25, 1985. LYNSKEY, P., The Development of an Effective Emergency Procedure for a Toxic Hazard Site, European Federation of Chemical Engineering Publication Series No. 42, 1982. Guidelines for Chemical Sites on Offsite Aspects of Emergency Procedures, Chemical Industries Association, 1985. Emergency Planning Guidance to Local Authorities, The Home Office, 1986. Industrial Emergency Planning Manual, Society of Industrial Emergency Services Officers, 1987. PURDY, G. & DAVIES, P.C., Toxic Gas Incidents—Some Important Considerations for Emergency Planning (HSE), European Federation of Chemical Engineering Publication Series No. 47, 1986. DAVIES, P.C. & PURDY, G. Toxic gas risk assessments: The effects of being indoors. Refinement of Estimates of the Consequences of Heavy Toxic Vapour Release, IChemE Symp., 8 January 1986. Preventing Emergencies in the Process Industries, a video training module available from the Institution of Chemical Engineers.

8 Emergency Plans According to the Law for Protection against Catastrophes and On-Site Hazard Protection Plans According to the Major Hazard Regulations W.STEUER Bayer AG, Leverkusen, FRG 1 GENERAL Instruction systems are a vitally essential prerequisite for the management and control of unusual malfunctions and catastrophes. Without such systems the task forces cannot be deployed with maximum efficiency. In the North Rhine-Westphalian Law for Protection against Catastrophes, passed as long ago as 20 December 1977, the legislators specified the following in Article 18: ‘The disaster prevention authorities shall prepare and update plans for protection against catastrophes and Emergency Plans for particularly high-risk objects. These plans shall, above all, specify the alarm procedure, the preparatory measures and all authorities, units and establishments, as well as other organizations, to be called upon for assistance in the event of a catastrophe.’ The local disaster prevention authorities and district disaster prevention authorities shall draw up and update a description of the hazards of all establishments which, by way of their special nature, may be the source of a catastrophe risk. Article 5 of the 12th Directive on the Implementation of the Federal Air Pollution Control Act (Major Hazard Regulations), dated 27 June 1980, defines the requirements for limiting the effects of incidents: ‘In order to fulfil his obligation arising from Art. 3, Para. 3 (safety obligations), the operator of a plant shall, in particular, prepare and update on-site alarm and hazard protection plans which are harmonized with local disaster prevention and hazard protection planning.’

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 71

As a result of these statutory regulations, not only have the terms ‘Emergency Plan’ and ‘on-site Hazard Protection Plan’ been defined, but also their general contents. 2 PLANNING HIERARCHY FROM THE VIEWPOINT OF A LARGE WORKS In large works and with large plant units, it is possible that various buildings of one and the same plant have their own alarm codes which, taken as a whole, form the Hazard Protection Plan of that plant. If there are several Hazard Protection Plans for plants within a works, they are combined to form the Hazard Protection Plan of the works. The Emergency Plan, a cooperative effort of the authorities and the works, adopts the contents of the Hazard Protection Plan of the works which are of importance for the activities of the authorities. Finally, the Disaster Prevention Plan of a community also includes all the existing Emergency Plans. The following paper (Chapter 9) will give a more detailed description of Emergency Plans in accordance with the Law for Protection against Catastrophes and on-site Hazard Protection Plans according to the Major Hazard Regulations. 3 EMERGENCY PLAN ACCORDING TO THE LAW FOR PROTECTION AGAINST CATASTROPHES On the basis of the legal requirement, the Office for Fire Protection, Rescue Services and Civil Defence of the City of Cologne drew up a specimen plan, which has been introduced by the President of the Cologne regional administration as a guideline for drawing up Emergency Plans for this administrative district. This plan will be presented here. The Emergency Plans are always kept by the competent district disaster prevention authority (e.g. Town Clerk, District Clerk) and contain the special information required for implementing measures to protect the public in the event of a catastrophe. Emergency Plans are only intended for use in conjunction with the general disaster protection plan of the authorities and the alarm plan of the operator. The Emergency Plans are updated annually by the district disaster prevention authority. The Emergency Plan is compiled in the form of a checklist. The necessary details are described more precisely in the appendices

72 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

to the Emergency Plan. This checklist gives the Head of disaster prevention a concise management tool allowing him to delegate orders to the members of his disaster prevention management team, while the latter use the appendices to initiate and monitor the individual measures. The Emergency Plan consists of five sections: 1. Description of the object 2. Reporting and alarm-raising paths 3. Immediate actions in event of an emergency 4. Follow-up actions 5. Appendices A little more information will be given on the following subsections of Part 3 ‘Immediate actions in the event of an emergency’: 3.1 Establishing the type of hazard 3.2 Establishing the endangered area 3.3 Measuring the gas concentration 3.4 Warning and informing the public These items cover the essential elements of what is known as the Leverkusen Model. 4 HAZARD PROTECTION PLAN OF THE WORKS The Hazard Protection Plan of the works is the plan ranking above the Hazard Protection Plans of the individual plants. It represents an overview and summary of the essential measures in relation to the entire works and establishes the link to the Emergency Plan. The Hazard Protection Plan of the works regulates tasks and competences relating to deployment of the fire brigade and other unusual malfunctions where decisions coordinated between several managerial areas have to be taken. This includes the notification and/or alarming of management staff, as well as internal and external emergency services. The Plan consists of five sections: 1. General rules 2. Tasks of the management areas 3. Special risks situations 4. Addresses

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 73

5. Appendix Among other things, Section 1 contains the legal principles on which the specifications made are based. The tasks of the Technical Task Force (TEL) and the Works Task Force (WEL)—the central managerial bodies—are shown, together with the general scheme for informing and reporting to agencies outside the works. Section 2 contains the tasks and competences of the individual managerial areas, particularly in relation to the required notification of other or high-ranking areas. As regards the responsibility for informing, a distinction is made between a main line and a secondary line. Section 3 describes the defensive measures in the event of particular risk situations, for which separate regulations or rules exist. Section 4 contains the telephone numbers and addresses of the management staff of the works nominated by the areas to be responsible for the organization and implementation of all the tasks specified in this Hazard Protection Plan. The external agencies and authorities are also listed. Section 5 lists all the plans, including those of the public disaster prevention authorities. 5 ON-SITE HAZARD PROTECTION PLANS ACCORDING TO THE MAJOR HAZARD REGULATIONS It should be pointed out that there are currently some Hazard Protection Plans which have to be drawn up because a plant is subject to the Major Hazard Regulations, while others are set up by the plant in an effort to achieve the greatest possible degree of passive protection. Regardless of whether or not a plant is subject to the Major Hazard Regulations, the contents of the Hazard Protection Plans are identical in both cases. The Hazard Protection Plan is part of the on-site safety organization of a plant. It contains information required for planning and updating defensive actions in the event of danger. In a system of coordinated organizational measures, it ensures the greatest possible degree of protection of life and property in the event of danger. Thus, the Hazard Protéction Plan covers all potential on-site hazards (e.g. fire, explosion, accident) and off-site hazards (e.g. malfunctions in neighbouring plants, tanker collisions), names on-

74 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

site safety facilities, and specifies special behavioural measures for the plant staff in the event of an emergency. The Hazard Protection Plan is directed at the senior staff of a plant, who should put their colleagues in a position to react correctly in the event of an emergency. Thus this plan also serves as a document for plant staff training and drills. In the event of an emergency, it tells the senior staff what they need to know and what actions should be taken, also showing the alarm scheme for deployment of all the necessary on-site technical task forces. Drawing up the Hazard Protection Plan Ideally, the Hazard Protection Plan should be drawn up by the person responsible for the plant in cooperation with the Fire Protection and Occupational Safety departments. It is important that, whenever the plan is updated, e.g. following changes in the materials used, the updated contents are also made known to the competent task forces. The specimen Hazard Protection Plan presented here can be regarded as a recipe for drawing up such a document. The specimen Hazard Protection Plan consists of two parts, an organizational part and an informational part. The organizational part contains all the measures in the form of on-site instructions governing the special behaviour of plant staff in the event of an emergency. Lists of actions describing the behaviour to be adopted in the event of special hazards are enclosed. The informational section contains all the information on the plant which might be of importance in the event of an emergency. It serves, among other things, as a basis for the fire brigade deployment plan, which must be coordinated with the plant management. The informational section is subdivided into three parts: Plant overview. A brief description of the plant is provided here to give the task forces a general idea of the size, type and location of the plant. All information on the plant which might be of importance in the event of an emergency should be listed in plans. These plans should be simple, clearly arranged and easily manageable. The following subdivision is recommended: — Processes (e.g. special requirements of license) — Block plan — Buildings plans

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 75

Hazard sour ce overview. During normal plant operation, hazard sources are prevented from becoming dangerous by means of prophylactic safety measures. However, in the event of unusual malfunctions, they can create a hazardous situation and lead to property damage and personal injury. A knowledge of all on-site hazard sources—and of those in the immediate vicinity—is an essential prerequisite for successful operations in the event of an emergency. Consequently an overview must be compiled. The following subdivision is recommended: — Hazardous substances — Hazard areas — Technical facilities which may be potential hazard sources. Safety equipment and systems overviews. This document should list all equipment and systems which are designed to ensure the safety of the plant staff and the use of which is governed by the safety instructions. The following subdivision is recommended: — Systems — Equipment An overview of these systems is also necessary to allow the responsible person in the plant to check the presence and condition of such systems and equipment more easily, and to facilitate rapid orientation in the event of an emergency. The task forces need this overview in order to coordinate their actions in the plant. Depending on the requirements of individual plants, the subdivision of the sections can be adopted as described, condensed or expanded. However, whatever form of subdivision is used, it must always be ensured that the groups and/or departments requiring to be instructed and/or informed are included as target groups. Thus the list of recipients of these Hazard Protection Plans can be based on target groups. The structure in Table 1 is just one possibility. Heads of department, plant managers, safety officers, plant engineers, fire prevention and occupational safety officers receive the complete Hazard Protection Plan. Drawing up plans takes time and effort, as does any planning. Be prepared to sacrifice this time. You may then already have won half the battle for safety.

76 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Table 1 Recipients of Hazard Protection Plans

9 Co-operation in Emergency Planning T.DICKIE BP Chemicals Ltd, Grangemouth, UK

1 INTRODUCTION The town of Grangemouth, on the River Forth, hosts a number of companies in the oil, petrochemical, chemical and associated businesses. Since 1968 these companies, together with the Emergency Services and statutory bodies, have formed a voluntary Major Incident Control Committee (MICC) with the original, and still valid, purpose of ‘examining the material in each works and its hazard potential, examining the organisation in each works for dealing with it, exploring the integration of the various systems and setting out methods for controlling the emergency should a Major Incident occur’. The following list of the current members may give an indication of the Committee’s scope: Borg Warner limited BP Chemicals Limited BP Oil Limited BP Oil Grangemouth Refinery Limited Central Regional Fire Brigade Calor Gas Limited Central Scotland Police Central Regional Council Enichem Elastomers Limited Falkirk District Council Forth Ports Authority

78 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Health & Safety Executive Macgas Limited Imperial Chemical Industries Limited Rohm & Haas (UK) Limited Ross Chemicals and Storage Company Limited Scottish Ambulance Service 2 DEFINITION OF A MAJOR INCIDENT The definition of a Major Incident has developed over the years as earlier definitions were tested by incidents which appeared to approach the borderline; the current wording is ‘A Major Incident is defined as an industrial incident which (a) is likely to affect, or is affecting, the safety of people outwith the undertaking, and/or (b) requires external aid in fire-fighting, police and ambulance services etc. beyond the normal call-out attendance, after consultation by these Emergency Services and site managements.’ 3 MAIN COMPONENTS OF THE EMERGENCY PLAN The Committee has long recognised the importance of having the individual emergency plans of the Emergency Services and the industrial organisations dovetail into the overall MICC plan, and for this and other reasons the overall tone is that of simplicity. The plan provides for a ‘main control’ centre in Grangemouth Police Station and forward control nearer the scene of the incident. Main Control is housed in a suite of 3 rooms designed, equipped and maintained specifically for the purpose. There is a central room used by the Police with one adjacent for the use of Technical Advisers and another for officers of the Fire and Ambulance Services. Each industrial member’s site is linked to the Police Station by a dedicated Omnibus telephone system which allows communication between the Police Station and either individual sites or groups of sites. This is very simple, and perhaps rather old-fashioned, but it works and can be tested readily and

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 79

regularly. It is, of course, supplemented by the radio communications of the Emergency Services and the industrial members, but it is quite common to encounter difficulties with radio trans-mission/reception in and around plant structures. To eliminate any doubt or hesitancy at the outset of an incident, the first call to the emergency services goes through via the normal telephone system in the standard way. The reference to Technical Advisers above comes from the plan which provides that, in the event of a Major Incident being announced, each industrial member sends one senior member of staff to Main Control to assist with technical advice and information on the availability of mutual aid. The plan provides for an industrial gas detection service by which three of the industrial members provide radio-equipped vans manned by suitably trained staff to monitor the level of gas in the atmosphere in any given area. The plan has specifie sections for the Grangemouth Docks area, for gas releases and for radioactive substances. It also has a section listing the equipment which can be made available from member companies on a mutual aid basis if required in the event of an incident. The plan is co-ordinated with the Central Regional Council offsite contingency plan prepared under the CIMAH Regulations. The Committee is used to obtain the agreement of the companies to the off-site contingency plan and any amendments to it. The Committee was also used as the vehicle for a joint approach by the top-tier sites through Falkirk District Council to implement the requirements of the CIMAH Regulations regarding notifications to the public. 4 EXERCISES The main purposes of exercises are to train staff in the procedures and to test and improve the procedures themselves. There are three levels of ‘exercise’ in use at present. Each week the Police Service tests the Omnibus telephone circuit by calls to each member. This very simple test not only ensures that the equipment is working properly, but provides a regular opportunity for new, replacement or stand-in staff to become familiar with its use. Also, each week, one of the industrial members initiates a small exercise by calling the Police Station on the Omnibus telephone, notifying the Police of an incident and asking for assistance which may be in one of several forms such as setting up road-blocks or

80 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

having another member provide some specified emergency equipment. Again, this is simple but ensures familiarity with the system. Less frequently, currently about twice per year, more ambitious exercises are held. These involve setting up and manning forward control and main control and working through a ‘scenario’ devised by an exercise sub-committee. These exercises have involved the deployment of police to road blocks but, due to restricted availability of manpower, have not involved the deployment of fire and ambulance personnel beyond the attendance of officers at forward and main control. 5 EXPERIENCE OF AN ACTUAL INCIDENT In 1986 the plan was used in earnest when a small leak of bromine gas from one of the factories affected people in neighbouring premises and threatened to affect people in houses nearby. The arrangements worked well and it was clear that the time spent in developing the plan and training people meant that the administrative side fell into place, allowing staff of the emergency services and the technical advisers to concentrate on dealing with the implications of the incident. One lesson learned which had not become apparent from the exercises was that the Department of Environmental Health of Falkirk District Council became a main contact point with the public for the flow of information, and the plan has been modified to reflect this. The Emergency Planning Officer of the Regional Council used the incident as a springboard for further training of Local Authority organisations such as the Housing or Education departments and voluntary organisations such as the WRVS in the roles which they might be called upon to play. This aspect belongs to the Regional Council’s off-site contingency plan, and the Emergency Planning Officer arranged a suitable training course making use of speakers from the MICC. 6 UPDATING THE PLAN The Committee meets quarterly with ad hoc Sub-Committees, e.g. on communications or on updating the manual, meeting separately as required. The plan itself is not static. For example, in the last year the arrangements for information flow within Main

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 81

Control have been improved, and the locations of anemometers held by members have been listed in the manual. (Experience has shown that wind direction and speed can vary considerably within the area.) In conclusion, the Committee members recognise that, while they strive to ensure that the plan is effective and that personnel are trained in its implementation, it represents one part of a wider safety process which has the prime aim of preventing emergencies as well as containing any which may occur.

10 Emergency Response Planning OffSite of Chemical Plants BENNO KIER & GÜNTHER MÜLLER Rheinisch-Westfälischer Technischer ÜberwachungsVerein eV, Essen, FRG

1 INTRODUCTION In the past, emergency response and contingency planning was, on the whole, based on lessons learnt from previous events. The majority of these events were usually natural disasters, such as floods, large fires, avalanches or earthquakes, which to some extent occurred periodically in specific areas. Because of the great danger this caused to the life, health and property of those affected, additional steps were taken to prevent these disasters and plans developed to limit their effects. Generally, these plans encompassed the provision of aid for combating disasters, the rescue and the care of the population, as well as the selection and training of suitable personnel for these tasks. Urgent decisions were taken by those responsible in each case without any forward planning of support services. This procedure was also adopted in principle for those additional dangers which arrive with the increasing mechanisation of traffic installations and industrial plants. The organisation, training and equipment needed for disaster management were geared to the aftermath generally to be expected from serious accidents in these installations— mainly to the fighting of fires, the recovery of and caring for victims, as well as the evacuation and accommodation of parts of the population in special cases. There was no evidence of any major link between the actual causes of accidents and sources of hazard on the one hand, and a preventive protection plan on the other. Specific disaster management planning was first undertaken with the introduction of nuclear power because of all the Radiation hazards associated with it. The type, scope, chronological sequence and range of possible accidents were incorporated into

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 83

this plan, as were the special technological aspects of the individual plant and its respective location. This concept allows detailed prior planning of all necessary defence measures against each particular incident, and also a reality-based testing for such measures. Conventional industrial plants, especially in the chemical industry, in which hazardous substances are produced, treated, stored and handled, also have a high hazard potential Over the past few years this technical development has led to ever larger production units being erected and, at the same time, to the concentration of an increasing number of different installations and works on single sites. In addition, existing installations near residential areas are, increasingly, being renovated, developed, or replaced by new processes. It can be assumed that, thanks to the efforts of manufacturers, operators and authorities, the safety of such installations regarding incidents and the associated effects has been constantly adapted to keep up with the developments in process technology. Even so, basic scientific considerations and actual far-reaching incidents in chemical installations, both in Germany and abroad, show that accidents with adverse effects on the surrounding area cannot be completely eliminated by acceptable technical means. Even though emergency response plans have already been drawn up available for a range of installations in the Federal Republic of Germany, and preventive measures have been organised in certain areas between the operators and the authorities responsible for the prevention of catastrophe under special agreements, there is still a shortage of uniform regulations. For this reason, experiences accumulated to date are being evaluated and supplemented. It is especially necessary to adapt the emergency measures to the situation at the specific plant (e.g. type, size and hazard potential) and at the specific location (e.g. population density, traffic routes, orography), to harmonise them with the plant-based safety precaution plans and to ensure an exchange of information between the public bodies responsible for contingency planning, without any secrecy restrictions. In order to draw up suggestions for a common guideline, the Federal Office for the Environment in Berlin instructed us to conduct a study in 1981. The aim was to throw more light on the use of the existing emergency response plan, both in Germany and abroad, as well as to compile the major requirements for plantspecific emergency response plans.

84 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

2 RESULTS OF THE INVESTIGATION Operators of plants, authorities and competent associations were questioned and the relevant literature was evaluated in order to determine the state of emergency response planning in Germany and abroad. It became clear that the legal stipulations represent a substantial prerequisite for effective emergency response planning and are particularly important for the allocation and demarcation of the tasks and areas of competence of those involved. Converting them into concrete plans, however, depends to a crucial extent on the circumstances of each individual case. Accordingly, within the legal framework, there were found to be considerable differences with regard to the measures to be taken to meet these requirements. This applies to both the organisational requirements and the personnel and technical equipment needed. On the basis of general disaster management planning, the official emergency response plans include specific and specialised measures and preparations with regard to particular hazardous objects. Such measures and preparations relate in each particular case to the specifie features of the particular objects whose storage facilities, production facilities or special properties mean that the possibility of a hazard arising cannot be discounted. Planning must also take account of the residential and traffic structure of the site, the orographie conditions prevailing and the current meteorological conditions. The investigation revealed that the spectrum of planning variants ranges between two basic views. Dynamic emergency response relies on high flexibility in the leadership and services without the detailed prior planning of corresponding individual steps. It concentrates on the decision-making capacity of the leadership of the services, the rapid mobilisation of personnel and the constant availability of technical equipment and aid. In contrast to this, detailed planning provides for highly differentiated instructions, descriptions and prepared specific measures. This is because of the high physical and psychological burden on all those involved in a hazard situation. It provides decision-making aids with regard to immediate measures and provides all the necessary information for further procedure. Specifically, the following aspects were evaluated: — Structure and content of disaster response plans — Characterisation of hazard potential (description of object, hazard and location)

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 85

— Cooperation between operators and authorities — Organisations involved; equipment and aids available — Service strategies (determination of situation, alerting of the general public, traffic control, evacuation, assistance) — Practical instructions and decision-making aids for the alerting of disaster services, initiation of measures and control of the defence operation — Interaction of various types of service teams — Documentation of the incident chronology and the defence measures taken 3 CONVERSION OF THE TEST RESULTS FOR A DRAFT GUIDELINE The legal framework for the preparation of hazard prevention plans in the vicinity of conventional plants with high hazard potential is laid down, on the one hand, by disaster management legislation and, on the other, by anti-pollution legislation. The Disaster Response Act (Katastrophenschutz-Gesetz) obliges govern-ment bodies to go beyond the safety of plants and transport facilities by also ensuring that the effects of any residual risk remain limited. Such a risk may be rated as a very minor factor in the technical rules, but its possibility cannot be excluded entirely. The government bodies are also to ensure that the effects of the residual risk are countered without delay when there is an alarm. This obligation is covered by a series of regulations on a Federal and State level. The existing regulations contain the legal possibilities for emergency response for such planning as well as clear statements regarding their requirements. The Federal Anti-Pollution Act is mandatory for the plant operators. Its purpose is, in conjunction with the ordinances and administrative regulations passed on the basis of the Act, ‘to protect humans, animals, vegetation and other objects from damaging environmental influences and, inasfar as plants are concerned which are subject to licensing, also from hazards, substantial disadvantages and substantial burdens which may be caused in some other way, and to prevent damaging environmental influences from arising’. Already this statement of the Act’s purpose directly imposes an obligation to ensure preventative protection against hazards, entailing not only state-of-the art safety precautions but also emergency response measures. This requirement is put into concrete form in the Incidents Ordinance (12th BImSchV). This

86 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

ordinance lists, among other things, operational alarm and emergency response plans to limit the effects of incidents, plans which are to be drawn up and updated to fit in with the local disaster management and emergency response planning. The Second General Administrative Regulation to the Ordinance Decree (2nd Störfall VwV) expressly mentions related details of organisational protection facilities and operational emergency response plans. From this we obtain starting points for objectrelated or plant-related emergency response. These starting points are reflected in the requirement for special protection plans in the disaster response acts of a number of federal states. Such plans have to be drawn up for special hazardous objects within the framework of general disaster management. Further federal and state regulations can be consulted to back up and fill out specific prevention planning in the surrounding area of hazardous plants, especially chemical plants and refineries. The planning, strategy and logistics of the plant-specific emergency response have to be based on the type and scope of the potential hazards for a particular plant, and on the special conditions and prerequisites in the area around the site. Thus a hazard analysis should be considered as a first step. An object description is drawn up first of all, including a list of all identifiable hazard sources and hazards. In addition, further information is useful to ensure emergency response, such as — Apparatus and vessels for hazardous substances and hazardous processes — Possible but undesirable reactions of substances being handled — Pipelines and pipe bridges for hazardous substances — Loading sites for hazardous substances — Sites with high fire hazards Where there is a hazardous situation, it is crucial to have information on the type and properties of substances with which the emergency services or general public will be confronted. In a works analysis, the substances to be anticipated are allocated to the individual plant parts. For the individual substances, instructive details should be provided of — The properties of the substances — Their possible reactions — The effects of the substances on the human organism, on animals and vegetation, on water and fish, on the soil, on agricultural areas and on food supply operations

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 87

The DIN safety data sheet, which is to be drawn up by the producers of hazardous substances, can serve here in particular as a source of information. In addition to the effects of substances, the following details are also relevant at this stage, with specific reference to individual substances, in order to cope with the consequences resulting from a discharge: — Protective facilities (e.g. filters) — Possibilities for counter-measures — First aid measures for injured persons — Therapy in the case of hospitalisation Finally, the conceivable forms the hazards could take should be listed: — Fire over a very wide area — Gas discharge: possible quantities, discharge rate, duration of discharge, propagation characteristics — Shock wave with distance parameters for the effects of the pressure (e.g. 0·35 bar, 0·03 bar, 0·01 bar) — Devastated areas (e.g. in the case of a tank explosion) — Explosion, deflagration — Contamination of soil and water, with indication of the effect boundaries With a view to the fact that there may be an alarm or evacuation of the population affected by a hazard, details of the chronology of an event are also important. Such details include — Estimation of the time spans between when a hazard situation arises or is detected and conceivable effects in the surrounding area — Establishment of the probable remaining time to alert the emergency services, warn the public, take measures — Details of the probable chronology of hazard effects (e.g. in the case of airborne emissions in various meteorological conditions) To delimit the surrounding area which the plans are to cover, the maximum range of the effects has to be estimated in detail, and in addition the objects requiring special protection in the potential impact area have to be determined. Objects requiring special protection include, for example

88 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

— Installations and facilities which themselves have a hazard potential — Densely populated residential areas — Hospitals — Schools, social welfare facilities, meeting places, lodging facilities — Drinking water source areas, waterways and stretches of water, traffic routes — Plants and stores connected with foodstuffs — Other objects of high value in the meaning of Article 2, Paragraph 2, No. 3 of the Incidents Ordinance The details are listed in a practical form and presented in plans. A valuable aid in hazard analysis, in particular with regard to determining the causes, the chronological sequence and the spatial extent of the effects of accidents, is the evaluation of past events. Events which necessitated major counter-measures are especially useful in indicating how to draw up new plans and updating existing emergency response plans. Specially suitable for this purpose is the documentation of accidents and incidents where the events have been recorded in standardised form, i.e. as has been done in the systematic recording of facts relating to damage events, accidents and incidents, where such facts are important for damage prevention and emergency response. When an alert situation has been established, suitable measures have to be initiated immediately. To enable the competent bodies to take necessary steps in a correct and complete fashion without any delay, alert calendars should be drawn up and made available at the individual points. Alert schedules are a list of the conceivable activities and arrangements for the various bodies, as needed in the specifie situations, bodies such as — Management of the disaster services — Police — Fire brigade — Medical services — Social welfare services Since they can be used as check-lists, they make possible a reliable and complete check of the measures to be taken. The alert procedure should be divided into stages which involve the relevant services according to the increasingly hazardous nature of the situation.

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 89

Evacuation of large areas in the vicinity is an especially difficult task in emergency response. It may be necessary to evacuate neighbouring plants or residential area if — after the onset of an event it is found that no adequate protection is provided by staying in enclosed rooms there, or — it has to be feared that, as the disaster develops (e.g. spreads), this protection can no longer be guaranteed The possibilities for evacuation are thus determined to a crucial extent by the time-related nature of the incident’s level of impact on the surrounding area. The preparation and implementation of any evacuation measures and the decision to set them in motion have to take account of this time dependence. Evacuation after the onset of an incident is only meaningful if persons in enclosed rooms are at direct risk because of a persistent exposure of the area concerned (e.g. through high concentrations of hazardous substances in the ambient air, toxic deposits, severe thermal radiation). On the other hand, it must be noted that the exposure of these persons and the disaster services to the effects of an incident during evacuation may also constitute a considerable hazard. A decision on the relevant procedure to be adopted can be taken with the help of an estimation as to the impact alternatives to be expected. A preventive evacuation of areas in which a hazardous impact may arise, or can be expected as an incident develops (e.g. spread of a fire, subsequent explosion, change in the direction of propagation of toxic substances), assumes the most detailed knowledge possible of the hazard situation and its further development. The earlier such preventive measures can be initiated and concluded, the smaller the effort involved in the evacuation and the risk for the persons and services affected. With sudden, short-lived incidents which have an impact lasting only up to a few minutes, evacuation can be practically discounted because of the practice already described and the preparatory time needed.

11 Industrial Emergency Planning in The Netherlands H.O.VAN DER KOOI & H.K.VUYK Ministry of Social Affairs, Voorburg, The Netherlands

1 INTRODUCTION Although there are nowadays many chemical factories, producing thousands of dangerous chemicals, only in certain big companies are there extended emergency plans and schedules. Generally, small and medium-size chemical industries have not such well developed emergency plans. However, it is the duty of the authorities in the European countries on behalf of the EC Seveso Directive to ensure that there should be emergency plans in companies with major hazard risks. An explanation will be given about the practical situation concerning the Industrial Emergency Plan in Holland. There are two main parties involved in the action to be taken in emergency situations: — Public authorities — Companies With respect to the activities of the public authorities, the obligations are laid down in the Act on Calamities. Since January 1985 this act has been in force. In this act it is stated that in case of calamities, of whatever nature (airplane crashes, the aftermath of large-scale incidents at a chemical plant, railway accidents, etc.), the supreme responsibility in righting the disaster is in the hands of the public authorities, particularly the Mayor. In case the effects of such a disaster extend beyond the municipal borders this act lays the competence at a higher administrative level (e.g. the Provincial Governor or even the Minister of Home Affairs). As a second point, this act gives the obligations to the authorities to draw up emergency plans with respect to disasters which can happen at undefined places. Thirdly, the authorities have to set

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 91

up so-called calamity fighting plans in case the risk of such a calamity is confined to a distinct area and connected with industrial activity. With respect to the activities inside industry, there is a requirement in accordance with the Working Environment Act of November 1980 to have an industrial emergency plan. This requirement can be ordered to major hazard companies. These companies are already obliged to draw up an occupational safety report, in accordance with the so-called notification in the EC Seveso Directive. The designation of the major hazard companies takes place on the basis of having certain minimum amounts of dangerous chemicals. The requirements of an industrial emergency plan are given in a publication ‘Guideline for the setting up of an industrial emergency plan’, which will be officially published by the Directorate General of Labour in the near future. 2 INDUSTRIAL EMERGENCY PLAN In our opinion the following starting points are important in making an Industrial Emergency Plan: — Evaluation of the risks based on safety analysis (a) Insight in the amount of fire-fighting and rescue equipment (b) Nature of the dangers as toxicity, explosion hazard (c) The possible extent of the effects of pressure waves, heat radiation, dispersion of toxic clouds (d) The probability that such a calamity can take place — Preceding research of the company’s own means and services — Relation with the organizational set-up of emergency response systems by the public authorities — Participation in mutual assistance systems Among the basic elements of an Industrial Emergency Plan are (A) Management and coordination. Industrial Head Coordination has the overall management and coordination in the emergency activities inside the establishment. In most cases this function belongs to the managing director of the company. He is located in a head coordination centre which is equipped with all the necessary facilities. (B) Industrial coordinator at place of accident. It is preferable to coordinate the actual activities of assistance and fighting by a

92 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

person closely involved in the industrial activity. He declares the state of emergency on the industrial area and eventually orders shut-down of installations. The production manager is most suitable for doing this job. In any case there must be rules of consignment to be sure that at any time such a functionary can be committed immediately after the event. The Industrial Coordinator at Place of Accident contacts the assistance services and the head coordination centre by means of telephone or orderly. (C) Overall management and coordination in the affected area. In the case of a great catastrophe this is in the hands of the Mayor of the municipality. All people who take part in fighting the calamity are under the command of the Mayor. The Fire-master is in charge of the operational management. 3 FIRE-FIGHTING AND ASSISTANCE IN EMERGENCY CASES Various industrial services have a duty in fighting, assisting at, and controlling an accident. Each service acts according to a prepared action-plan, fitting into the total industrial emergency plan. Such an action-plan varies in accordance with the severity of the emergency situation. (a) Industrial fire brigade. The tasks of fire brigades are of course the firefighting, the prevention of escalation, the protection of apparatus and the rescue of victims. The plan of attack should describe the detailed situation in the plant: storage and amounts of chemicals, properties of the chemicals, provisions of firefighting water, extinguishing foam and special appliances, knowledge of the electrical power system, emergency power provisions and, not least, the relations with the Industrial Coordinator at Place of Accident and the Head Coordination Centre. (b) Security service in emergency cases. Control of the traffic through the gate, blocking the disaster area, keeping the roads free for fire-brigade and other assistance, registration of visitors and announcing the special situations to them, removal of unauthorized persons, being informed about the admission of emergency staff and people and also the authorities etc. These tasks and instructions should be recorded in an action-plan fitted into the Industrial Emergency Plan. (c) Industrial safety service. Assistance in the evaluation of the appearing hazards, giving recommendations concerning safety

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 93

measurements, determining the dispersion of toxic emissions. Reports all necessary information concerning the accident, causes and course of the fighting, to the Industrial Coordinator at Place of Accident and the Industrial Head Coordinator. (d) Industrial health service. For effective medical assistance a medical emergency plan is desired. In such a plan the organization of this service, the coordination during the various stages of the accident, and the relations with the other services should be stated. Besides that, the procedures for alerting the health service, the regional health service and the ambulance service, the medical help, the assistance of other organizations, e.g. Red Cross places for the interception of wounded people, their identification, the transport priority to hospitals and the consultation of the National Toxicity Information Centre should be described. (e) Production departments. The production manager has the coordination about all activities on plant-operational level in case of an emergency. Plant control and emergency shut-down are his responsibility and should be described in emergency procedures. (f) Engineering services. There should be a technical emergency action-plan which describes the emergency power provisions, the disposition of electricians for securing of apparatus for safe extinguishing, etc. (g) Specialists. It can be important to have certain specialists at hand in case specifie hazards are present, e.g. gas specialists, specialists on radioactive materials, and gas surveyors for determination of explosive and toxic gases. (h) Public relations. During a major emergency the Industrial Head Coordinator will report to the media. In case another PR functionary has been designated, provisions must be made for his accommodation. Specific instructions must be available for this functionary. 4 ALARMS, MOBILIZING PROCEDURES AND COMMUNICATIONS Procedures must be available for triggering and sounding the alarm if the latter is initiated from a central communication post. Also procedures should be described for the call-out of key personnel and for mobilizing emergency services, as well as the systems and devices for communicating information to staff and plant personnel. If there is a hierarchy of alarms (minor, fire, gas, major emergency) each particular alarm will have to be described

94 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

as well as alternative means or back-up systems in case the normal system fails. Also the required action of key personnel and emergency services, in accordance with the particular alarm type, should be indicated. 4.1 Declaration of the major emergency situation and evacuation This is a primary task of the Industrial Coordinator at Place of Accident. In case of a calamity/emergency situation it should be obvious for everyone in the company when, and in which area, an emergency situation exists. At the same time the public authorities should be informed about the emergency situation. In most cases the fire brigade is alerted at first. Also the surrounding companies should be informed about the situation. An evacuation action-plan must describe how workers can be evacuated safely. The decision of evacuation is made by the Industrial Head Coordinator in consultation with the Industrial Coordinator at Place of Accident. Procedures should also be included with respect to giving the ‘all clear’ signal. In major emergency situations the decision will be taken by the public authorities. 4.2 Training and exercises Having established the emergency plan, it is essential that all people involved are trained and exercised with adequate frequency in emergency situations to create expertise and confidence in the emergency plan. This is to be developed from simple to fully simulated exercises for various scenarios in which external services participate.

12 Emergency and Intervention Plans: The French Experience M.GENESCO Direction de la Sécurité Civile, Paris, France

Emergency planning for natural or technological disasters is at present based on the ORSEC plans for each of the French geographical departments and the technical annexes to those plans. The emergency plans make it possible to mobilise and commit resources on a large scale, generally throughout an entire department when local emergency arrangements prove inadequate. The operational validity of the concepts on which these plans, which have moreover been adopted by several foreign countries, are based has been successfully put to the test on numerous occasions. However, the experience of recent years has shown that accidents can occur which exceed the risk management capability of a single department. To deal with situations resulting from such major disasters it has been decided to apply the principle of the ORSEC plans to larger areas (zones de défense). However, these new operational arrangements, which establish in general terms how official intervention is to be organised, will not replace planning for specifie accident situations. As regards hazards connected with the storage, transport or processing of chemical and toxic substances, new emergency planning was necessary similar to that already undertaken for radiological hazards, to cover accidents within industrial installations capable of causing damage to the population or the environment. This is the objective of the new departmental plan known as ‘ORSEC risques technologiques’ which will replace the plans known as ‘ORSEC hydrocarbures’ dating from 1967 and ‘ORSECTOX’ dating from 1973. This revision of operational planning to deal with technological hazards was essentially the outcome of the following factors: — The development of modern industry and technology had engendered new hazards which, whatever the degree of

96 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

prevention or of industrial safety and reliability, could never be entirely eliminated — Industrial change had, in particular, led to the creation of petrochemical complexes within which there were a variety of plans with the same objective, e.g. the ORSECTOX plan, the Hydrocarbure plan, the special protection plan — The ever increasing complexity of the chemicals industry has meant an increasing concentration of risks and required better emergency planning to cope with all eventualities, despite the strict preventive measures imposed by French legislation. In this context, the so-called Seveso Community Directive of 24 June 1982, concerning major accident hazards posed by certain types of industry, prescribed various measures relating to both prevention and protection of the population of which account had to be taken. For this purpose, the heads of the emergency services have, in close collaboration with the government departments concerned, drawn up operational emergency plans for technological hazards (chemicals, hydrocarbons) on the lines of those prepared since 1978 in regard to radiological hazards. Henceforth the indispensable collaboration between industry and government in the event of accident, both to provide information and to carry out relief operations, will take the form of a narrow interface between an ‘on-site emergency plan’ (POI) for which the operator will be responsible and a ‘special (off-site) intervention plan’ (PPI) drawn up and implemented by the commissioner of the Republic. This new form of emergency planning will apply to industrial establishments or plants covered by the Seveso Directive, i.e. some 300 in France, including stocks of hydrocarbons with a capacity of over 600 m3. It will be accompanied by an evaluation or revision of the risk assessments for each establishment and correlatively by an exhaustive and detailed analysis of possible accident scenarios. A considerable part of these plans deals with emergency warning arrangements and information for the population, local authorities and the media, notably by the conclusion of information agreements between the commissioner of the Republic and the plant operator. The departmental plan known as ‘ORSEC risques technologiques’ is therefore the outcome of inter-ministerial work over a two-year period involving the Ministries of the Environment, Industry, Defence, Health and the Interior. It was sent out in July 1985 to all local authorities concerned, together

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 97

with a time-table for the preparation of a POI and a PPI for each installation affected. The POI (on-site emergency plan) lays down what the plant operator must do to safeguard his installation and workers. It also stipulates exactly how internal and external emergency resources are to be used. Such resources are initially to be implemented under the authority of the plant manager and subsequently, should the accident spread or threaten to spread outside the plant, under the responsibility of the commissioner of the Republic or his representative. The POI naturally reflects the pre-established risk assessment and lists appropriate resources and facilities at the disposal of the operator to deal with the situation. The PPI (special intervention plan) deals primarily with how outside relief is to be organised and with information to be provided to people living near the site. Like all plans of this type based on the ORSEC approach, it states how emergency warnings are to be given, how the various command posts are to be activated, and what is to be done by local and regional government services. In addition, the plan has three levels of application depending on the scale of the accident. Level 1: Non-toxic accident Level 2: Toxic accident confined to the installation Level 3: Toxic accident with off-site consequences The PPI also covers situations arising as a result of unlawful acts perpetrated against installations. To ensure that the new plan is operationally effective, numerous arrangements have been or are about to be made: — Mobile chemicals emergency (CMIC) have been set up in the departments which are most at risk, owing to the number of installations requiring a PPI, or in terms of the volume of hazardous substances transported, i.e. in 15 departments in 1986 and a similar number in 1987. — Rapid emergency warning and information arrangements have been made for populations which could be affected by the consequences of an accident. — Heads of agreement have been established between the authority responsible for emergency relief operations and local radio stations. — An intervention unit of the emergency services (UISC) has been created, specialising in nuclear and chemical hazards, and will represent a significant additional capability in this area.

98 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

— Lists have been prepared of computer data-banks providing information about hazardous and toxic substances so that relief workers on the spot can be better informed. The following appendix deals with the fire which occurred at Nantes just a short while ago (29 October 1987). APPENDIX: THE NANTES ACCIDENT A. Products involved NPK fertiliser in the form of chloride and nitrate. A nearby silo containing 850 tonnes of ammonium nitrate did not explode. The combustion of these products gave rise to emissions containing, in particular, HNO3, NO and NO2, Cl2, and NH4. B. Protection measures taken 1. Immediate evacuation within the security perimeter 2. Preliminary confinement of the population to their houses 3. Evacuation of the population of 7 parishes (i.e. 45 000 inhabitants including 8000 school-children and several old peoples’ homes) 4. Interruption of traffic on the Loire and the Nantes-St Nazaire railway C. Lessons to be learnt from this event 1. Application threshold of the Seveso Directive 2. Evaluation of the consequences: — difficulty of discovering the origin and composition of the products (industrial secret); — difficulty of quick disposal because of the nature and concentration of the toxic products generated by the combustion; — need to be able to mobilise specialised means quickly, in particular: a) protection of individuals, and b) analysis and identification.

ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 99

3. Measures for protecting the population: — benefit in having radio communications available; — exemplary reactions of the population; — solidarity observed between the evacuating parishes and the welcoming parishes; — effectiveness of the ORSEC plan. Chronology for 29 October 1987 09.36 Beginning of the fire alert 10.08 10.20 11.20 11.40

14.15

16.00 16.10

17.00 18.30 19.00 22.00 07.00

Fertiliser silo (Frensit storage) Installation of the mobile First sampling of toxic PC vapours Setting up of the 500m Evacuation of 3 poisoned safety perimeter people Alert of the national authorities. Setting up of the crisis PC Sending of airborne Preliminary confinement of monitoring systems and the population specialised means of analysis Triggering of the ORSEC 43 000 people involved plan 20 000 evacuated Evacuation of the 25 taken to hospital population Results of the measurements Fire contained The toxic emissions continue. The wind direction changes. Supplementary means of The evacuation continues protection for people and accommodation proposed Fire not extinguished. Sources of supply lacking End of toxic emissions Return of evacuated people The checks continue to their houses throughout the night The ORSEC plan terminated

100

SESSION III Exercises and Auditing of Emergency Planning Chairman: H.SIGEMUND State Ministry of the Interior, FRG Rapporteur: J.HEFFERNAN Department of Labour, Ireland

13 Plan for Off-Site Exercises A.M.PARANHOS TEIXEIRA National Service for Civil Protection, Lisbon, Portugal

1 GENERAL COMMENTS 1.1 Responsibility for the civil protection plans The drawing up of civil protection plans and the carrying out of civil protection operations in Portugal is limited to the effects of major accidents outside manufacturing installations. Within these installations, the company where the accident takes place is responsible. The Portuguese National Civil Protection Service is a very decentralised service and, consequently, responsibility is assumed: — at — at — at — at

the the the the

municipal level (mayor) by the SMPC; regional level (regional government) by the SRPC; district level (prefect) by the SDPC; national level (prime minister) by the SNPC.

When there is a major accident, however, or a catastrophe which has considerable effects on large areas and their populations, and for which one can see, as soon as it begins, that the lowest level will not be able to deal with it, responsibility is assumed by the National Service (SNPC) which draws up plans and carries out civil protection operations. As an example we may cite a serious earthquake at Lisbon, or the massive escape of several tonnes of toxic gas in the Estarreja region. We will now deal with this last example.

EXERCISES AND AUDITING OF EMERGENCY PLANNING 103

1.2 Characteristics of the Estarreja case Estarreja, with local government offices, is situated north of Aveiro in the coastal plain where the height above sea level is less than 50m. The population of the town and its surroundings is about 15 000 inhabitants, who are mainly employed in the agricultural sector, as the region is one of the most fertile in the country. The nearest heights above 50 m are to the east of the town about 2 km away. The town and these heights are separated by the Antua river which is thus an obstacle to rapid evacuation of the town’s population to the higher surrounding ground. The region is crossed by roads and paths in several directions and by the Lisbon-Porto railway in the N-S direction. This railway crosses an industrial area situated NNW of the town; the industrial region is surrounded to the east and west by large tree-covered areas (Pinus pinaster and Eucalyptus globulus). The dominant winds generally blow, with some regularity: — from NW to SE for about 8 months per year; — from SW to NE for about 3 months per year; — from E to W for about 1 month per year but irregularly. The average speed is about 4–5 km/h, except for the SW winds, of which the average is about 20–30 km/h with gusts which may reach 50–60 km/h. Some 3 km to the NW of the town there is a group of four chemical factories which produce several very toxic, and sometimes explosive, gases which are heavier than air: — Quimigal factory: ammonia, NH3 (toxic and explosive vapours) — Uniteca factory: chlorine, Cl2 (toxic) — Isopor factory: phosgene, COC12 (toxic) — Cires factory: vinyl monochloride, CH2CHC1 (explosive and toxic) (Chlorine and phosgene were used as combat gasses in the First World War.) Account must also be taken of how the gases react together. These factories have been constructed according to all the standards imposed by the law and are authorised by the Portuguese administrative authorities. Their activities are in accordance with the legislation in force, and all the safety standards imposed by these authorities are respected.

104 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Furthermore, one may also say that all the industrial equipment is up to date and conforms to the safety standards established by the law. One may thus assume that it is very unlikely in normal conditions that a major accident which goes beyond the limits of the industrial area would occur—but it cannot be ruled out. One must never exclude the unexpected occurrence of violent events which could suddenly lead to a major accident. The situations which follow must be envisaged from the need to have available, in advance, an emergency plan. 2 THE EMERGENCY PLAN The emergency plan for the town of Estarreja and its surroundings was prepared by the SNPC in collaboration with the SDPC and the SMPC. As well as the risk already mentioned, this plan envisages several other risks which, though probably less serious, still worry the Portuguese administrative authorities. These risks, which are considered minor, cover a vast collection of accidents and catastrophes which range from a road accident of a tanker carrying dangerous materials to forest fires and problems of pollution of the environment. Neighbouring villages, such as Murtosa, Avanca, Anjeja and others of considerable economic importance, could also be affected. Thus the plan, based on assumptions which have some probability, anticipates and governs the use of means (human and material) and resources of the region, or of the entire country, to deal with the events. These means are: (1) On the local scale—municipality coordinated by the SMPC):

(immediate

action

— The factories (companies) — The fire service — The Red Cross — The security forces (police) — Health structures (public and private) — Private service organisations (business, transport) — Other voluntary organisations (amateur radio operators, boy scouts, etc.)

EXERCISES AND AUDITING OF EMERGENCY PLANNING 105

(2) On the complementary district (prefect) and national (government) level (coordinated by the SDPC or SNPC): — The Armed Forces — Hospitals and health organisations — Public service organisations — Social assistance organisations — The fire service and the Red Cross — etc. The establishment of such a plan must lay down and regulate the actions to be performed before, during and after the emergency: Before:

based on the evaluation of risks and information and the informing of the population by means of conferences, diffusion of individual measures to be taken, in the case of a gas leak, and the performance of exercises and progressive training, especially in schools, factories and other places where there is a large concentration of people During: by the automatic alert, as quickly as possible, that a dangerous event has occurred, and by the immediate triggering of the measures laid down in the plan After: by decontamination and neutralisation of chemical agents deposited on the soil, rehousing of evacuated people, re-establishment of normal living conditions (of health, purification—cleanliness, burning of debris, burial of dead animals, etc.) 3 THE EXTERNAL EXERCISE Although similar exercises have been carried out in Portugal, considering the importance of the industrial area of Estarreja and the fact that its emergency plan has not yet been approved, it has been decided to carry out an exercise in the region, as part of the European Year of the Environment, in February 1988. Observers from Member States may attend. 3.1 Assumptions This exercise, which will be preceded by a vast campaign informing the public, takes one of the situations envisaged in the

106 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

emergency plan— perhaps one of the more severe—based on the following assumptions: — A violent event leads to the uncontrolled release of 50 tonnes of a toxic gas, heavier than air, from a sphere where it was enclosed at a pressure of 10 bar. The factory where the gas leak occurs immediately activates all its warning systems (sirens, telephones) and its own means of assistance, and informs the external authorities (SMPC, fire service, Red Cross, hospitals). — It is impossible to repair or remedy the damage before the total outflow of the gas, which it is estimated will take 1 h. — This release produces a toxic cloud (plume) which has roughly the shape of an irregular and elongated ellipsoid. According to the prevailing meteorological conditions, its approximate dimensions, at the beginning, at soil level, are as follows: — length (in the wind direction) 3500 m — width (transverse) 600 m — height 50 m — This cloud (plume) is formed from a core of pure gas and moves at wind speed (4–5 km/h). It dilutes towards the surface and lasts for about 6 h, until it is completely dispersed (apart from caves and the lowest points, where it can remain for up to 18 h), being able to reach the villages in its path. — its effects will be felt along a ‘corridor’ which the cloud follows, as well as in the houses which are lower than the cloud, in these places and at this precise moment. The gas may infiltrate into the houses, by the doors, windows and drain pipes, by the ‘communicating vessel’ principle. 3.2 Preparation of the exercise This is a ‘planning’ exercise, but there may also be several practical actions on the ground, particularly simulations of the evacuation of children in schools, temporary interruptions of road and rail traffic, evacuation of gassed people by helicopter, actions of decontamination, etc. This exercise is prepared in three phases. 1st phase (preliminary preparations) Educating and making the population of the region aware by: — Conference to be organised in the communities, on the radio and television

EXERCISES AND AUDITING OF EMERGENCY PLANNING 107

— Leaflets to be distributed to people, school children and, indirectly, their parents; the aim is to make people aware of the risks and the measures without dramatising them — Installation of supplementary alerting systems — Perfecting of a system for obtaining meteorological data — Perfection of telecommunication between factories, the civil protection service, the fire service, the Red Cross, health services, etc. — Performance of several sectional sub-exercises to: (a) give various sectors proper training outside the general framework of the exercise (b) avoid dramatisation of the situation by frequent tests; (c) allow more efficient joint action This phase must begin at least 3 months before. 2nd phase (preparation) — Preparation preparation events — Preparation information

of a general framework for the exercise, by the and characterisation of categories of dangerous of a sufficiently detailed ‘guide’, which will include on:

(a) the creation of several accidents: their nature and sequence in time (b) description of each event and its placing in the categories of accidents envisaged (c) indication of the organisations which report the events and those which must receive the information; there will also be information which will not have a prescribed and available receiver — Preparation of messages on the events and of respective envelopes; on the envelope one will write only: (a) the name of the issuing organisation (b) the time of the opening and the consequent transmission of the message — Preparation of a dossier which must contain:

108 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

(a) the ‘category’ of each accident and the ‘situation’ which it may cause and which will be envisaged by the civil protection (b) the theoretical solution which must be adopted according to the principles laid down for each of these situations — Formation of an ‘arbitration team’ and training of its members; it will have representatives at the various levels of performance and decision centres; it will not be involved in decisions but will only observe and remark on the behaviour of the performers, their reactions to messages, and note the correct and incorrect procedures as well as their ‘reaction time’ — Preparation and setting up of places for the performance of the exercise and the different means of communication 3rd phase (performance) — The exercise will begin at hour H of day D — It will begin with the warning, given by the factory chosen, by means of a siren and of telephone calls to the support centres reporting the events — The centres will alert the public — They will proceed simultaneously to activate all the decision organs and the helping and assistance services Adoption of measures envisaged in the emergency plan The evolution of the exercise is ensured by the transmission of messages containing the accidents, according to the graduations established by the ‘guide’; these messages must lead to the immediate reactions of the various participants to whom they are sent. These receivers will have total liberty to take their decision, when they feel it opportune. They are thus under the permanent observation of members of the arbitration team. They are free to involve their subordinates and to ask the upper echelon or others for help, e.g. prohibition of all movement, evacuation of people to nearby higher points, evacuation of gassed people by ambulance or helicopter, etc. The exercise is directed by the National Civil Protection Service. It represents the top level and can in turn either satisfy the requests presented or not, and also create new accidents such as

EXERCISES AND AUDITING OF EMERGENCY PLANNING 109

the temporary interruption of one or several means of communication. It is also envisaged that means for decontaminating and neutralising toxic products can be used, asking the fire services for help or using neutralising products dropped from aeroplanes. Final phase After the exercise there will be a ‘critical review’ organised by the exercise directorate and by the members of the arbitration team who were placed at the various echelons and command posts.

14 Exercise Study for an Emergency of Chemical Origin G.MACCHI, A.MORICI & G.POILLUCCI Directorate of Nuclear Safety and Health Protection, ENEA, Rome, Italy

1 INTRODUCTION The scope of the study is the arrangement of a preventive technical tool for a specific emergency exercise following an accidental event with release of a toxic substance. This tool has to enable the Emergency Coordinator to define quickly and accurately the actual areas at risk, in case real-time information support is not available. The definition of the areas is aimed to optimize the necessary emergency provisions. The site where the exercise will take place is a real one in Italian territory. The selection of the site has been made in order to point out the most important emergency features. The performance of the exercise will be based on the following references: (a) The Piano Provinciale delia Protezione Civile (Provincial Contingency Plan of Civil Protection) established by the competent Prefettura (the Prefecture is the provincial body of Central Government) (b) The Piano di Intervento (Particular Contingency Plan) established by the Prefecture for toxic hazards originating in the specific industrial plant involved in the simulated accident. This particular plan has to be considered as an addendum to the Provincial Contingency Plan.

EXERCISES AND AUDITING OF EMERGENCY PLANNING 111

FIG. 1. Schematic topographical map of the site.

FIG. 2. Scale layout (partial).

112 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

EXERCISES AND AUDITING OF EMERGENCY PLANNING 113

2 SITE DESCRIPTION The selected site is located in essentially flat territory near some small towns, including an industrial area with chemical and manufacturing plants. The movement of raw materials and finished products takes place both by railway and by road. In particular, the railway traffic is based on a FFSS station adjacent to the tank farm of a chemical plant. Normally several rail cars are in transit or parked in the station. Some of these cars contain hazardous materials, such as chlorine, ammonia, flammables. A schematic topographical map of the site is shown in Fig. 1; more details are contained in the plot plan in Fig. 2. 3 PREVENTIVE EVALUATION OF THE AREAS AT RISK ON A PARAMETRIC BASIS ENEA/DISP has performed a study to be used by the Emergency Coordinator as a source term in exercise preparation and as a decision making tool during the exercise itself. The study supplies a parametric evaluation of the areas at risk following the dispersion of chlorine clouds originating in an instantaneous release from pressurized vessels (cf. the accidental sequence described in the following Section 4). For this purpose ENEA/DISP has used the codes ‘Adiabatic Expansion’ and ‘Dense Cloud Dispersion’, parts of the WHAZAN package, developed by Technica Int. Ltd in collaboration with the World Bank [1]. The Dense Cloud Dispersion code, based on the Cox-Carpenter model, is widely used at international level, even if many others are available [2,3]. The code provides also the evaluation of the toxic effects in terms of probability of lethality at given distances by the Probit equation approach. A recent revision of the Probit coefficients [4] has been taken into account in the present study. The calculations have been performed for several values of the released mass and for the most likely meteorological conditions at site (weather category and wind speed). The results are reported in Tables 1–4, expressed as the maximum downwind distances to have probabilities of lethality (LTL) of 50%, 5% and 1%. These probabilities refer to population staying outdoors and in absence of escape reactions. Furthermore, the maximum distance for a concentration of 25 ppm has been reported. Beyond this limit the impact has been regarded as negligible, considering also the short duration of the exposure.

114 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Table 1 Distances to a given hazard level (LTL 50) for instantaneous releases of chlorine from pressurized vessels in relation to released mass and atmospheric conditions

In order to enable a more accurate evaluation of the areas at risk, two more parameters have been defined: — The back-distance (function of the released mass only), representing the maximum impact distance due to the initial expansion of the cloud (Table 5) — The spreading angle (function of the meteorological conditions only), representing the envelope of the transverse impact distances due to the spreading of the cloud during the translation (Table 6); this parameter does not take into account the possible oscillation in the wind direction On these bases the Emergency Coordinator is able to identify the contours of the actual areas at risk on the topographical map, according to the following procedure:

EXERCISES AND AUDITING OF EMERGENCY PLANNING 115

Table 2 Distances to a given hazard level (LTL 5) for instantaneous releases of chlorine from pressurized vessels in relation to released mass and atmospheric conditions

(a) Drawing of the circumference, with centre in the release point and radius equal to the back-distance (Table 5) (b) Drawing of the angle at risk with vertex on the said circumference in the upwind direction and opening given by the spreading angle (Table 6) plus the possible oscillation of the wind direction (c) Drawing of the circular sectors with centre in the release point and radius equal to the impact distances (Tables 1–4) As an example, Fig. 3 shows the case relating to a release of 45 tons of chlorine in meteorological conditions D.3 and a possible oscillation of 40° in the wind direction. The availability in real time of the actual meteorological conditions is a necessary premise to a correct evaluation of the

116 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Table 3 Distances to a given hazard level (LTL 1) for instantaneous releases of chlorine from pressurized vessels in relation to released mass and atmospheric conditions

areas at risk. In case insufficient information is available from some meteorological services, it is anyway necessary to perform an estimation on-site with due caution. In particular with regard to the weather category, whose availability as prompt information from meteorological services is normally poor, the Emergency Coordinator may use some rough estimation developed for this purpose, one of which is shown in Table 7 [5]. A comparison has been carried out between some results of the WHAZAN code (Tables 1–4) and the results of two other codes for the dispersion of dense clouds, namely the DENZ code, developed by UKAEA SRD [6], and the code developed by the Ontario Ministry of the Environment [7]. The results of the DENZ code are reported in Table 8, while those of the Canadian code, limited at the maximum distance to 25 ppm, are reported in Table 9.

EXERCISES AND AUDITING OF EMERGENCY PLANNING 117

Table 4 Distances to a given hazard level (LTL negl., 25 ppm) for instantaneous releases of chlorine from pressurized vessels in relation to released mass and atmospheric conditions

Table 5 Back-distance in relation to released mass

118 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Table 6 Spreading angle in relation to atmospheric conditions

It is clear that some discrepancies that exist in the results of the different codes cannot be overcome at the present state of the art [2, 3]. On the other hand, a sure meaningful overestimation is introduced by any one of these codes, not taking into account the mitigation effect due to the indoors sheltering. In fact a significant part of the population, casually or depending on precise advice,

EXERCISES AND AUDITING OF EMERGENCY PLANNING 119

FIG. 3. Risk contours; release of 45 tons of chlorine in meteorological category D.3. Table 7 Flow chart for selection of weather category

Table 8 Distances to a given hazard level for instantaneous releases of chlorine from pressurized vessels in relation to released mass and atmospheric conditions (as per DENZ)

120 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

EXERCISES AND AUDITING OF EMERGENCY PLANNING 121

Table 9 Distances to 25ppm for instantaneous releases of chlorine from pressurized vessels in relation to released mass and atmospheric conditions (as per Canadian code)

will stay indoors during the cloud passage. The quantification of this mitigation effect has been made the object of recent studies [8–10], as well as the influence of particular characteristics of vulnerability of the population [11]. These aspects should be taken into account by the most used codes, as already done in some particular cases [12]. As the aim of the study is to support the decision-making process in an emergency, and particularly to enable an optimized use of limited resources, the selection of the useful results has been performed accordingly. In this sense an overestimation of the distances may be negative because it will induce the available resources to spread over an area bigger than necessary. On the other hand, an underestimation may also be negative because it will induce neglect of some indispensable provision. Therefore, for the purpose of the present study, the intermediate results of the WHAZAN code have been regarded as a ‘best estimate’. This perspective has to be very well borne in mind by the Emergency Coordinator in using the present tool. Further support for this selection is given by the direct comparison, illustrated in Fig. 4, with the well known recommendations expressed by the US DOT (Department of Transportation) about the isolation and evacuation areas in the case of major chlorine release [13]. This comparison shows not only good general agreement, but also the greater completeness and applicability of the present tool, without significant loss of simplicity and speed of use.

122 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 4. Risk contours for a release of 45 tons of chlorine; a comparison with the US DOT.

4 DESCRIPTION OF THE ACCIDENT SCENARIO The initial event of the accidental sequence is a major fire in the tank farm of the chemical plant adjacent to the railway station. Among others, a rail car containing chlorine is parked in the station (Fig. 2). At this moment, the possibility of getting the fire under control is remote; on the other hand, the heat radiation makes it impossible to approach the rail cars and to move them to a safe place. As thermal collapse of the chlorine rail car must be expected under these conditions, its protection by water sprays is attempted. The probable evolution of the situation makes a major escalation of the accident inside the plant possible, within about 4 hours. For this reason, before that moment all the available firefighting resources, including the water reserves, are directed exclusively to the protection of primary targets inside the plant. Within about 20 min (that means 4½ hours after the sequence initiation) the rail car collapses, releasing to the atmosphere 45

EXERCISES AND AUDITING OF EMERGENCY PLANNING 123

tons of chlorine. It has to be noted that no release of chlorine from the safety valves will take place up to this moment, due to the cooling by water sprays for as long as possible. 5 REALIZATION OF THE EMERGENCY EXERCISE The study of the exercise operating details is not a part of the actual work, being in the charge of the competent Local Authority. On the whole, the exercise is held according to the procedures contained in the Provincial Contingency Plan of Civil Protection of the competent Prefecture and in the on-site emergency plan of the chemical establishment involved. The initiation of the exercise will start with the activation of the on-site emergency plan, followed by the warning given to the personnel of the railway station. This one, after a preliminary evaluation, advises the Fire Brigade about the specifie hazardous situation existing inside the station and undertakes the necessary provisions regarding the railway traffic. At this moment, due to the potential release of a toxic substance, the special procedures contained both in the Provincial Contingency Plan and in the on-site emergency plan are activated. The Fire Brigade converges on the site, while an Emergency Control Centre is set up at the Prefecture, where the Emergency Coordinator is operating. The last named, with the aid of the documentation prepared by ENEA/DISP (see Section 3) and on the basis of the actual meteorological and accidental data, evaluates the areas at risk. Knowledge of these areas enables proper consideration to be given to the following aspects: — Evaluation of the possibility of a safe evacuation and its extent based on the expected accident evolution, the available resources, and the demographic and logistic situation — Identification of the area whose population has to be advised to stay indoors — Identification of particularly vulnerable targets (schools, hospitals, etc.) inside the maximum impact area For illustrative purposes only, and referring to Fig. 5 (valid for an instantaneous release of 45 tons of chlorine in category D.3), a possible line of action may be as follows:

124 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 5. Example of risk contours on a schematic topographical map.

— Immediate evacuation of the back-distance circle and the area A50’ with the exception of personnel provided with adequate protective equipment — Indoors sheltering of the population in areas A5 and Al, with priority warning action in area A5 — Warning to the hospitals and evacuation of the schools in area A0 In the course of the exercise, the possibility of getting assistance in real time from the ARIES Emergency Centre of ENEA/DISP will be checked, in addition to the meteorological services normally available. The ARIES Centre is already operating at national level for nuclear emergencies [14].

EXERCISES AND AUDITING OF EMERGENCY PLANNING 125

To conclude the exercise, the Emergency Coordinator reestablishes normal conditions and, where evacuation has been undertaken, provides for re-entry of the population. 6 CONCLUSIONS The emergency exercise will give indications covering many different aspects. The scope of the exercise will be first of all to test the general adequacy of the procedures included in the Provincial Contingency Plan, and particularly their applicability to this type of emergency. On the other hand, the necessity for specific training of key personnel will be verified, as well as their capability to deal with the technical/scientific aspects of the problem. A second objective of the exercise will be to check the adequacy of the technical aids made available by ENEA/DISP to the competent Prefecture: 1. Preventive parametric evaluation of the areas at risk, referring in particular to the clear and correct interpretation by the Emergency Coordinator 2. Assistance in real time by the ARIES Emergency Centre Prospectively the exercise should give the necessary indications in order to prepare a proper format for the realization of other preventive parametric evaluations. These measures should be used ad interim in dealing with real or simulated emergencies, waiting for an adequate real-time information system to be organized and implemented on the whole national territory, as already done by the Ministry of the Interior with the SIGEM system, for fire and explosion hazards only [15]. REFERENCES 1. 2. 3.

4.

Manual of Industrial Hazard Assessment Techniques, The World Bank, Oct. 1985. Major Industrial Hazards, Technical papers, Warren Centre, University of Sydney, Aug. 1986. McNAUGHTON, D.J., WARLEY, G.G. & BODNER, P.M. (1987). Evaluating emergency response models for the chemical industry. Chem. Eng. Progr., Jan. HARRIS, C. (1987). Mitigation of accidental toxic gases. Int. Symp. on Preventing Major Chemical Accidents, Washington, Feb.

126 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

5. 6.

7. 8.

9.

10. 11.

12. 13. 14.

15.

LYNSKEY, P.G., The development of an effective emergency procedure for a toxic hazard site. IChE Symp. Series, No. 93. FRYER, L.S. & KAISER, G.D. (1979). DENZ—A Computer Program for the Calculation of the Dispersion of Dense Toxic or Explosive Gases in the Atmosphere. UKAEA-SRD, July. Stern, E. (1986). The portable computing system for use in gas emergencies. Risk Analysis, 6 (3). PURDY, G. & DAVIES, P.C., (1985). Toxic gas incidents: some important considerations for emergency planning. IChE Symp. Series, No. 94, March. DAVIES, P.C. & PURDY, G. (1986). Toxic Gas Risk Assessment: The Effects of being Indoors. Refinement of Estimates of the Consequences of Heavy Toxic Vapour Release, IChemE, Symp., 8 January 1986. HAASTRUP, P. (1984). Indoor fatal effects of outdoor toxic gas clouds. J. Occupational Accidents, 5. PETTS, J.I., WITHERS, R.M.J & LEES, F.P. (1987). The assessment of major hazards: the density and other characteristics of the exposed population around a hazard source. J. Hazardous Materials, 14. PAPE, R.P. & NUSSEY, C. (1985). A basic approach for the analysis of risks from major toxic hazards. IChE Symp. Series, No. 93, Apr. Isolation and evacuation distance table. US DOT Guidebook. CARACCIOLO, R. (1987). ARIES: a computer based system for the real time monitoring of atmospheric dispersion in nuclear emergency. ENEA/DISP Int. Conf. on Nuclear Power Performance and Safety, IAEA, Oct. ROMANO, A., MARCHIONNE, E. & PICCININI, N. (1986). Il sistema informativo SIGEM: la gestione delle emergenze. Antincendio, May.

15 Effective Organisation and Incident Control W.D.C.COONEY Cleveland County Fire Brigade, Hartlepool, UK

1 INTRODUCTION The success or failure of any on/off-site emergency plan is wholly dependent upon effective communications between the public emergency services, the local government services in the area, and the industrial/commercial input concerned. Considerable importance must be placed on all branches of the plan, i.e. uniformed emergency services, non-uniformed local government services and, of course, the industrial complex concerned. The best way to ensure that close consultation and coordination take place is by exercising. There is no better way to test the availability of personnel than to undertake the physical exercise. This means moving manpower and equipment to the scene and simulating an actual incident. However, this can be an extremely costly and time-consuming situation. The whole question of the need to exercise, whether it be in respect of an on-site or off-site plan, requires a great deal of thought, discussion and consideration. Emergency plans of any description are worse than useless if they are prepared and then left on a shelf gathering dust. The only way to test a plan is by exercising that plan to ensure that all persons concerned are aware of their duties and responsibilities. However, this has industrial and commercial financial implications. Should we exercise or not? 2 BACKGROUND Cleveland County is situated in North East England, bordering North Yorkshire and Durham. The County Fire Brigade was formed in 1974 as a result of local government re-organisation combining into one authority the former Teesside and Hartlepool

128 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

County Borough Fire Brigades with parts of the North Riding of Yorkshire and Durham Fire Brigades. The present brigade is split into two divisions (Northern and Southern) which are generally divided by the River Tees. In order to discharge its functions, the Brigade has 15 strategically placed fire stations. By national standards Cleveland County is a small area covering 58 550 ha with a population of approximately 650000. However, on closer examination, any visitor cannot help but notice the very highly concentrated industrial areas which dominate the majority of the county area. In fact, 13% of the total county area is classed as ‘A’ risk, with other areas of special risk. This means in effect that Cleveland Fire Brigade responds to the largest concentration of chemical and petro-chemical complexes in Western Europe. The River Tees now rates as the third busiest port in the United Kingdom and, in terms of hazardous products, has more movements than any other port. 3 LEGISLATION The last ten years have produced a significant number of regulations which have had a large impact upon the chemical industry nationally and have, on many occasions, been brought about to assist the Fire Service in its operations and planning. As far as the transportation of hazardous materials is concerned, the springboard for regulatory control was the Dangerous Substances (Conveyance by Road in Road Tankers and Tank Containers) Regulations 1981. This regulation came into being after a voluntary scheme was introduced in Cleveland in the early 1970s and a labelling system was drawn up and known as UKHIS (United Kingdom Hazard Information Warning System). A panel was divised which displayed not only the warning diamond but also three other vital sources of information: (a) A simple code to give first strike information to fire service crews attending an incident involving a road tanker or tank container (b) The United Nations number which allowed further information to be sought on the product via chemical information retrieval system (c) A telephone number that could be contacted to speak direct to a source of specialist advice.

EXERCISES AND AUDITING OF EMERGENCY PLANNING 129

The pilot scheme which was introduced in Cleveland attracted such favourable comment from both emergency services and industry that, in March 1979, the Hazardous Substances (Labelling of Road Tankers) Regulations 1978 came into force. The voluntary scheme had now become mandatory. Later in 1981 this regulation was enveloped into the Dangerous Substances (Conveyance by Road in Road Tankers and Tank Containers) Regulations 1981. These regulations, in conjunction with a list of applicable chemicals, form the basis for legislation in the United Kingdom for the bulk transport of chemicals by road. Whilst the above regulations were a major breakthrough in providing the fire officer with information upon which to base his attack on an incident involving hazardous materials, difficulties were encountered in the form of drums, glass containers, plastic containers, carboys, cardboard cartons, etc. This problem resulted in the introduction of the Classification. Packaging and Labelling of Dangerous Substances Regulations 1984 (CPL) which came into full operation on 1 January 1986. The idea of the CPL regulations was to ensure that a composite label was attached to the package which offered advice and assistance to the Emergency Services when dealing with that particular substance. It is very significant that this set of Regulations came as they did because they mark themselves as the forerunner to the very latest set of Regulations in respect of the Conveyance of Packaged Goods. These Regulations are the Road Traffic (Carriage of Dangerous Substances in Packages, etc.) Regulations 1986 which came into force on the 6 April 1987. Once again this Regulation came about as a result of considerable pressure from the public emergency services to form some type of marking system for vehicles carrying dangerous packaged goods. It is widely appreciated that a simple 3-tonne flatback lorry can carry quite a cocktail of dangerous substances in packages, but imagine the 30-tonne containerised vehicle, carrying a mixed load being involved in a road traffic accident on a motorway. From experience, it has been noted that, should any of these vehicles be involved in such an accident, then it is not normal practice for the total load to be involved, or indeed for all the packages to be ruptured and a cocktail situation evolve. However, there are occasions when a number of packages contained within the vehicle are in fact ruptured and the contents escape causing either a toxic hazard or a fire hazard or a combination of both. It was with this in mind that the pressure put on the Health and Safety Executive resulted in a set of regulations for the marking of

130 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

such vehicles. When the regulations became law, any vehicle carrying in excess of 500kg of one or more dangerous substance is required to be marked with a rectangular orange plate, outlined in black, the minimum number of plates required is two, Qne on the front of the vehicle and one on the rear. The reason for this simple marking system is so that the public emergency services will identify the vehicle as having dangerous packaged goods and then use the label on the package as defined under the CPL regulations for subsequent action in dealing with that particular problem. Having dealt with regulations designed to assist the emergency services in the handling of incidents involving hazardous materials in transit, there are other equally important systems which assist the emergency services in bringing any incident to a satisfactory conclusion: Chemsafe and Chemdata. 4 SELF-HELP SCHEMES 4.1 Chemsafe The Chemical Industry Scheme for Freight Emergencies (Chemsafe) is a voluntary scheme undertaken by the chemical industries in conjunction with the Chemical Industries Association. The scheme does not give to the fire service an ‘all singing, all dancing’ means of solving a problem. What it does, in fact, do is offer a standard procedure that says to fire authorities, for example, ‘Contact the Specialist telephone number if available and make direct request from the manufacturer, trader or supplier of the product to offer advice and/or assistance’, The Chemsafe Scheme goes from there to allow the manufacturer under the standard procedure to make contact with another company who is also a member of Chemsafe to assist on his behalf, should the other manufacturer be closer to the scene of the incident. However, in all cases it is not possible to have direct access to the manufacturer or his nominee, as a specialist telephone number may not be available and, as a result of that, the Chemsafe Scheme as devised by the Chemical Industries Association, have introduced a procedure called ‘Longstop’. Longstop is a procedure that involves the National Chemical Emergency Centre at Harwell, which has a massive computer with databanks storing most of the known chemical products available, and qualified staff with practical experience over a very wide range

EXERCISES AND AUDITING OF EMERGENCY PLANNING 131

of chemical substances, to be available to offer advice and, in some instances, available to be called to the incident to offer on the spot advice. It is important, therefore, that the Fire Service are fully aware of the Chemsafe procedures that are available, whether it be the Chemsafe standard procedure or the Chemsafe Longstop procedure, should the fire service require additional advice in helping them to deal with an incident. 4.2 Chemdata Is a computer based databank, primarily devised for the British fire service. The idea behind Chemdata was to produce an easy to understand, simple to operate, and simple to access computer databank on chemicals. It was also devised that the print out from the databank would be simple, clear and easy to understand. After five years of use, the Chemdata system is being used by 45 fire authorities within the United Kingdom and the current database holds approximately 50000 known chemical substances. The databank is updated on a regular basis from the National Chemical Emergency Centre at UKAEA Harwell UK. 5 INCIDENT PROCEDURES There are a number of areas that require to be considered when dealing with this particular subject. Evacuation is a simple and straightforward word but can cause chaos and disaster if not handled correctly. There is a need in dealing with this type of incident to have a clearly defined role of command, incident control and communications. Evacuation must be given considerable thought with regard to the welfare needs of the people being evacuated, transportation, documentation and, by no means least, the protection of property left behind following the evacuation. The prime movers in an evacuation situation would normally be the police force. However, before this takes place, there should be a great deal of consultation between the officer in charge of the incident, the officer in charge of the local police service, and all the other senior persons on the ground, to consider the evacuation procedure that should take place. Nevertheless, should we evacuate? Is it necessary? Are we placing the people at risk by exposing them to unnecessary risks out of doors? This subject requires a great deal of discussion in some considerable detail to ensure that all parties involved in the control and

132 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

implementation of an incident are fully aware of what evacuation means. 6 EXERCISES FOR ON/OFF-SITE EMERGENCIES The Control of Major Industrial Hazards Regulations 1984 (CIMAH) within the United Kingdom place a duty on industrialists and local authorities to prepare emergency plans in respect of major emergencies that may occur and primarily in respect of off-site emergency plans. The majority of authorities have completed, or nearly completed, their off-site planning and it is important for the success or failure of any off-site emergency plan that effective communications between the public emergency services and industrial complexes operate. It is equally important for the needs of other areas of local authority services, both from the uniformed point of view and from the non uniformed viewpoint, to have very close liaison with each other and this means only one thing— exercises. There is no better way to test the availability of personnel than to run some form of exercise. In order to ensure that the plans have been drawn up to allow sufficient flexibility, exercises need to be undertaken to ensure that site personnel, the public emergency services, local authorities, health authorities, etc. are fully in the picture with regard to the possible problems that could arise following a major incident. The methods of undertaking exercises are many fold and the size and format can vary enormously. However, when all exercises undertaken are analysed in detail, they fit into two main categories: 6.1 Table-top exercises Exercises of this type are used to test the emergency planning procedures by using table-top plans and imaginary situations and a carefully detailed, written scenario. The personnel normally involved are primarily: (i) The principal management from the industry concerned (ii) Principal officers of the public emergency services, the local authority, health authority, etc. The method normally undertaken involves a group of officers using the plans of the premises and simulated situations in a

EXERCISES AND AUDITING OF EMERGENCY PLANNING 133

written scenario to alert and actuate policies already laid down in the emergency plans. Telephone contacts and the answering of specific questions and requests by management would be normally all that is required. A table-top exercise is a useful medium to test out management reaction to receiving telephone calls and being asked specific questions in respect of, for example, capacities of plants, inventories, type of product, type of release expected, water supplies, and a whole host of various other activities that can take place on site. This type of exercise also has the desired effect that it does not interrupt normal industrial activities on the site that are taking place and that combined on-site and off-site planning can take place at the same time. A simple, straightforward, table-top exercise can have considerable advantages in checking for example the plans in respect of advice to public, availability of people in the right places to undertake certain tasks, etc., amending and alteration of the plans as required, without massive disruptions to output. This type of exercise is required to take place with site personnel and emergency services, in conjunction with the local authority etc. to test the validity of the plan. You will note that I have used the word ‘required’ above. You will recall, no doubt, that the regulations do not specifically state that exercises are required. However, the only useful method of testing a plan’s efficiency is to carry out such exercises. A table-top exercise of the type described above requires firm and close control in order to maintain an element of realism. 6.2 Physical exercises These are by far the most common type of exercise, since it is necessary on occasions actually to move manpower and equipment to test their availability and capabilities of handling an emergency situation. It is therefore important that major physical exercises be undertaken on a regular basis. These exercises must be well planned in advance, with a carefully written scenario, and they should be guided towards certain objectives. It is no good having a haphazard physical exercise, as no benefit would be gained from haphazard results. Clear supervision and assessment, plus a vital debriefing session, should take place after an exercise, and soon enough for the exercise still to be fresh in the minds of the people who undertook it. By this means, maximum benefit will be gained

134 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

from the problems encountered and any mistakes that were seen. It is important that this liaison, and this type of exercise, takes place at a very early stage after the emergency plans have been drawn up. 6.2.3 Problems associated with the physical type exercise (1) Wholesale evacuation of members of the public cannot be undertaken during a physical exercise as there is a considerable difficulty in evacuating the public in a real life situation. It would be even more difficult to move people in an exercise situation. Also, disruption caused to the normal way of life within that particular community would not justify involvement at that level. (2) The actual use of large amounts of personnel has a fairly large cost implication. Also, it could denude available resources away from normal activities. (3) Physical exercises undertaken by the public emergency services can only allow limited resources of manpower and equipment so as not to take away the sharp end service to the public, for example fire appliances off normal activities, simply to test a plan with a physical exercise. Exercises, no matter in which form they are undertaken, require considerable preparation beforehand so that the plans are clearly understood by all parties before the exercise commences. Difficulties arise in using personnel who are not normally acquainted with a fast response time. Most local government chief officers tend to deal with emergency situations on a very small scale. For example, the Director of Education, Director of Social Services, County Surveyor and Engineer would normally only deal with small scale emergency situations. Exercises are a way to bring these officers out of their normal environment and place them in an abnormal situation to allow them to expand their horizons and expand the role to be played in an actual situation. The whole question of the need to exercise, whether it be on-site or off-site plans of any description, is worse than useless if left on a shelf gathering dust. The only way to ensure that a plan is tested is by exercising that plan. This allows all those people concerned with the plan to be aware of their duties and responsibilities.

EXERCISES AND AUDITING OF EMERGENCY PLANNING 135

Also, it ensures that consultation continues, that cross-flow of information and experience continues, and that officers and personnel do not meet each other for the first time in a live situation, but they have the opportunity in an exercise situation to see their other contemporaries at work. Also, this type of exercise gets the dialogue running between all the parties and as the dialogue is in being, then the plans will not gather dust. EXERCISES IN WHATEVER FORM ARE REQUIRED TO TEST EMERGENCY PLANS

7 INCIDENT CONTROL The Oxford English Dictionary definitions in respect of Incident, Control, Communications and Evacuation are as follows: INCIDENT Public event causing trouble, etc. CONTROL Dominate—command—exert control over COMMUNICATIONS Practice of transmitting information There is no way that I am attempting to teach the readership English. However, it is important that the definitions of the words noted above are clearly understood. For example, let us look at the situation with regard to Incident Control. The dictionary definition states quite clearly that Incident Control is to dominate or command a public event causing trouble. This, in fact, is the subject that is being explored during this particular conference. Whilst that seems simple to state, it is in fact difficult to implement. Let us imagine a release of a toxic substance from a particular source. That release, due to weather conditions, is moving towards an area of population. Incident control therefore means a number of things: Hazard definition and identification Hazard effect Effective control of the overall situation Communications Evacuation—yes or no? Let me now look at each of these areas in detail. Firstly, one area that is not identified is the role of command. You will see from the dictionary definition that to control means to dominate or command. A major incident situation within the United Kingdom

136 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

brings into play all the major emergency services—fire, police and ambulance. The command role of such an incident is extremely important. In the case of an incident not involving fire, then the Senior Police Officer present would have overall command of the situation under United Kingdom legislation. If, however, fire was involved in no matter what form, then the senior fire officer present would have overall command. This would appear to be a very haphazard method of operation and, in practice, the command role does not assume these defined areas. Because of pre-planning and exercises, the command function under normal circumstances, be it whatever type of incident, is a combined effort involving all the senior officers of the public emergency services in decision making. This, however, does not mean that we operate a democracy in command. There is a final decision taken and an autocratic decision must be made. 7.1 Hazard definition and identification It is extremely important that the senior officer in charge at the ‘sharp end’, i.e. the officer in charge of the operations on the incident ground, must have a clear indication of the hazard, the definition of the hazard, and the identification of the problems that that hazard could cause to the population, and of course to the workers on the site. You will see from earlier parts of my paper that within the United Kingdom we have a number of areas for gaining hazard information. It is very important to ensure that the hazard definition and identification is understood as well as possible to ensure that the local health authorities are provided with sufficient information to provide effective treatment to those persons who may be suffering from the effects of the incident. 7.2 Hazard effect Whilst it is important to find out the characteristics of the product that is being dealt with, it is of paramount importance in any evacuation procedures to find out the effect that would take place on the general population. We must, of course, consider weather conditions, that is whether it is wet, windy, cold, dry, etc. We must understand the parts per million definitions as to whether people ought to be evacuated, left in premises, etc. The hazard effect has a very important part to play in the overall command role.

EXERCISES AND AUDITING OF EMERGENCY PLANNING 137

7.3 Effective control of the situation Let me now look at the problems that face a major emergency service, i.e. a county fire brigade, in the effect of the release of a toxic substance. Let us assume that we have received all the information outlined above which clearly indicates that there could be a serious effect on the population. This, however, is by no means all the information required by the senior officer present. There are a number of other factors that come into play: Do we tell the public? If so, by what method? Public address from Police vehicles, public announcement on radio and television stations, or by physically sending in Emergency personnel to knock on individual doors? Whilst the methods outlined above are fairly simple, can we be sure that everybody in the possibly affected area has heard the messages or have we created a panic situation in areas outside that designated for possible evacuation? Or, as mentioned above, is the best method of removing people from their homes, albeit slow and time consuming, simply to knock on the door and ask them to leave? This, however, leads to further questions as to Why? What for? Have you spoken to…? etc. All of this is extremely time consuming and has to be taken into serious consideration. One of the disadvantages of personal contact is the fact that if you require to evacuate, e.g. due to a toxic release, is it safe to do so or, in fact, is it unsafe to send officers into a possible affected area to carry out such an evacuation? Could we be placing emergency service personnel in a dangerous situation? Allow me to go back to the question of evacuation later. 7.4 Communications The dictionary definition of communications is ‘Practice of transmitting information’ which simply states that we should effectively communicate with each other. However, as we are all aware, communications play an extremely vital role in dealing with any incident and are of paramount importance when dealing with a major incident involving members of the public. There is a need to ensure that all messages and orders issued are clearly understood by all persons concerned and acted upon as quickly as possible. But it is equally important that there is a continual feed back through the various incident controls, and therefore to the incident commander, to ensure that he is aware that his

138 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

communications, messages, orders, instructions, etc. have been carried out. One of the pitfalls with regard to communications is that a number of the emergency services operate on different radio channels and so incidentally, do a number of the major industrial sites within the United Kingdom. To set up communications in post can, to some extent, be detrimental in that radio interference can occur and cause a number of problems in the transmitting of information. 7.5 Evacuation Let me once again quote you the Oxford English Dictionary definition of this simple word: EVACUATION Withdraw from—remove occupants from—place to be considered dangerous to a safer place. This is a very simple and straightforward definition which, on the face of it, appears to be simple and easy to undertake but, if it is not controlled correctly, what appears to be simple can very rapidly turn into chaos and disaster. The question really is ‘Do we evacuate or do we not?’ We are very close to quoting Shakespeare in the act where Hamlet states To be or not to be? that is the question.’ May I continue to say to evacuate or not is also the question? Let us look at the situation that we have been considering before —the release of a toxic substance. If that release is as a result of an explosion, then it may well be safer to leave the members of the public in their own homes, offices, shops, etc. and to allow the normal weather conditions to dissipate the release as quickly as possible and to consider the fact that the public are safer where they are than to move them into the open air. On the other hand, if the release is of a prolonged nature, then of course consideration must be taken for the movement of the population. Let me go back to the problem. If we have an area that has been affected by a toxic release for a considerable period of time, then the moving into that area of emergency personnel to ask the population to move places a number of persons in jeopardy. On the other hand, if a release and/or explosion is imminent, do we take the decision before it happens to move the population within the area and away to a place of safety? If the explosion or release is imminent, would we not, therefore, be placing the population at risk by taking them into the open air and, should the inevitable

EXERCISES AND AUDITING OF EMERGENCY PLANNING 139

happen, expose them to even greater dangers? Even before you reach any of the decisions outlined above, there are a number of other factors that come into play, involved in mass evacuation and, by the word ‘mass’, I do not envisage tens of thousands—it could be two or three hundred—but nevertheless, it is a mass evacuation. We need to consider, as officers controlling the incident, are the following factors available: (a) Local authorities. Have they manned rest centres? Can they provide sufficient food and shelter? Can they, in fact, ensure that the people moved from their normal residence can be adequately looked after? (b) Public transport companies. Can we provide large numbers of public vehicles to transport people to rest centres, food centres, shelter, etc.? (c) Police. Are there sufficient members of the Police Force available to control traffic, to undertake documentation, to control looters, etc.? (d) Hospitals. Are they fully equipped to take care of the injuries occurring as a direct result of the incident, i.e. injuries to firefighters, police personnel etc., and are they also prepared to undertake normal medical requirements for the general public who will suffer as a result of evacuation—old persons, heart attacks, strain, shock, etc.? (e) Media. Are we prepared for the media? All forms of the media will descend on the incident seeking news, clogging main roads, attempting to gain information from whatever source is available. We must be sure that relations with the press are adequate to fulfil the situation. I have outlined only a few of the problems that have to be faced when considering evacuation. If the decision is made to evacuate, there are numerous other examples. Water supplies, feeding personnel engaged at the incident, relief personnel, additional stocks of equipment and fuel, informing relatives of those persons evacuated, etc. You will see, therefore, that serious consideration must be undertaken as to whether to evacuate or not. IN MY OPINION, EVACUATION SHOULD BE CONSIDERED TO BE THE LAST RESORT WHEN ALL OTHER METHODS OF CONTROLLING A HAZARD TO THE PUBLIC HAVE FAILED.

16 Assessing the Response Capability and Vulnerability of an Emergency Plan: Some Important Issues R.MAX-LINO, P.HARRISON & C.G.RAMSAY Technica Ltd, London, UK

1 INTRODUCTION In Technica’s experience, addressing the response capability of emergency plans involves examining both the quality and the quantity of the response resources, and their suitability for the emergency environment. The notion of quality in this context refers both to the quality of the individual component resources and to the dynamic relationships and functions within the emergency plan as a whole. It is often the case that while emergency plans focus mainly on the capacity of response resources (i.e. quantities of fire hydrants, numbers of first-aiders available, control room hardware, etc.) these are not necessarily all utilised effectively in an emergency situation. By focusing first on the quality factor during the auditing of an emergency plan, an assessment of the efficiency and of the quantity of the resources required can be determined. One approach to auditing the response capability of an emergency plan is that of high-fidelity simulation. By high-fidelity it is meant that the emergency can be simulated to match the real situation as closely as possible. Its major advantage is that it allows the evaluation of the effectiveness of all the functional components (i.e. emergency organisations) of an emergency plan. Each organisation may well be proficient in its own function, having had some training and experience of the relevant requirements. However, this experience may have been obtained in isolation. The high-fidelity characteristic is important because factors such as time pressure, physical obstruction or danger will significantly influence performance. Another approach is that of functional analysis. This is an analytical technique for assessing the relationships between the components of any system. The relationships may include those

EXERCISES AND AUDITING OF EMERGENCY PLANNING 141

between equipment, communications, and physical interactions between personnel in the sharing and coordinating of resources. The main advantage of functional analysis is that it can be used to assess on paper the logical flow of events, workload distribution, the coordination of events in time, and man-machine interactions. This paper aims to illustrate how a simulation of the emergency plan, coupled with a functional analysis of the data obtained, allows an evaluation of a variety of issues. These include: — Assignment of responsibility — Notification methods and procedures — Communication — Public information These issues are not mutually exclusive. They will be discussed in this paper in the light of Technica’s experience in the assessment of emergency plans. 2 ASSIGNMENT OF RESPONSIBILITY This includes the roles and dynamics of the organisations which must be coordinated. For the purposes of this paper, it will be assumed that the emergency has originated at an industrial site which has its own operational management but can call on regional emergency services for support. The plan should define clearly the role of the site management with respect to the emergency response professionals. Attempts by the management to take active control could lead to conflicts between themselves and the emergency response teams, both on-site and off-site. Equally important is the knowledge of how these two distinct groups must be able to coordinate effectively to conduct their responsibilities successfully. It may also be the case that in-house emergency response officials need a clearer definition of their individual roles and responsibilities, and how these should be effectively coordinated. To illustrate from one case study, it was not clear to the on-site officials which of two emergency control rooms they should be communicating with. As a result, some tasks were duplicated by each control room, and some omissions of functions were made. Auditing the roles can be conducted on paper by documenting the tasks/activities required of the key personnel. The assessment team can determine:

142 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

— the tasks that can be performed simultaneously without conflict; — the tasks that must be done sequentially. In this way those tasks and resources/roles which need to be further developed/altered for the benefit of the emergency plan can be determined. A high-fidelity simulation can then be conducted to ensure operational viability. It is true, however, that some conflicting activities may not be filtered out of the plan during a functional analysis because there is no access to realtime data. This is where a high-fidelity simulation can be most effectively utilised. To illustrate the type of operational problems that may be inherent in an emergency plan, the following example may be quoted. An emergency response control room operator became overloaded with communications duties within a few minutes of the commencement of an exercise. It was found that this operator was using two telephones (one at each ear)—trying to brief the Chief Fire Officer and trying to handle several simultaneous communications on the radio. This operator was also required to brief several incoming personnel of the situation, yet there was no assistance or relief provided for the first 36 minutes of the simulated emergency. This example illustrates the necessity for the emergency response plan to avoid workload excesses on emergency response officials. The functional analysis will then determine the appropriate resources to reduce the possibility of such workload excesses. 3 NOTIFICATION METHODS AND PROCEDURES It is important for the on-site emergency response officials to be aware of requirements procedures for the notification of government officials. Significant in this issue is the determination of when an emergency situation requires such notification. That is, in the event of an incident which is likely to escalate beyond the site, early detection of this likelihood and early notification of the appropriate officials are important for a variety of reasons. These include the reduction in time for determining what resources are needed and, logically, the potential need to coordinate extra resources beyond the back-up teams already considered. Another issue to address is that the methods by which early warning and clear instructions are given to the population at risk

EXERCISES AND AUDITING OF EMERGENCY PLANNING 143

should be determined. How, for instance, do officials ensure that the population is given early warning such that any necessary evacuations have the required time for safe and effective conduct? The warning system should be able, as far as possible, to take advantage of the available time from the onset of the incident. In Technical experience, for instance, there appears to be some reluctance on the part of notification officials to warn the population at risk, for fear that this will cause panic. Another example is that some on-site personnel during a simulation were unaware than an emergency situation did exist. In other words, the warning system—auditory alarm—did not notify some of those in potential danger. On the other hand, it inhibited the performance of emergency personnel, by making conversation difficult. This latter point is discussed further in the section on communication. Within the approach to auditing the emergency plan, a functional analysis of the potential for early warning and of the instructions to the population at risk can be conducted. This may be done by considering credible scenarios, determining the shortest time from the onset of a threat to reaching a given population at risk. A simulation would then provide data to help determine whether the available time allows you to to: — assess, during the emergency, the risk to the population; — notify the relevant emergency officials accordingly; — notify the population at risk. The time taken to complete the above three tasks should ideally be much less than the time taken for the release to reach the population, especially where the release may render sheltering ineffective. Where sheltering is not the appropriate response to a release, the time taken to evacuate the population must be included in the analysis, in order to determine the potential hazard to the population. No high-fidelity simulation has been conducted by Technica which has involved the issuing of orders to the general population for evacuation or sheltering. It is possible, however, to simulate release scenarios by computer modelling techniques, and estimates of the times to reach the population at risk can then be evaluated. Previous work on the evacuation of the public has also identified some of the significant factors in the notification process which will affect population evacuation. These include the warning

144 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

content and the source of the warnings. Some discussion of these will be conducted in the section on public information. 4 COMMUNICATION Inherent in previous examples have been some of the effects of communication system and information transfer failures. In the first example, where the emergency response operator is described, the issue of information transfer and the overload that occurred is well illustrated. However, another issue is that of the failure to identify/ appreciate what constitutes time-critical information. By this we mean information that must be known as early as possible, and which must be transferred to the relevant personnel for action. This information is rather difficult to determine using a functional analysis alone, simply because it is not easy to predict the dynamics of a given incident and its effects on the emergency response personnel. Some assumptions about the emergency scenarios can be made, and these scenarios may be simulated to provide data on the types of critical information required for the resolution of these emergencies. The identification of critical information can then be conducted within the framework of a functional analysis and, once specified, the appropriate factors can be incorporated into the training of the officials responsible for information transfer. This information is particularly important for systems in which a queueing system is employed for simultaneous communications to the control room. This may result in trivial information delaying critical information, and techniques for avoiding this include specific training for those transmitting information and/or separate channels for critical data. One other problem within the communication issue is that of the masking effects of background noise on the performance of the operators who are transferring information. Specifically, we refer to situations in which numerous auditory alarms are going off in an emergency control room. These may detrimentally affect the identification of critical information and its subsequent communication beyond the control room. In the case of major industrial accidents, the event itself may be associated with extreme noise levels, such as from escaping high-pressure gases, fires or mechanical impacts. Outside of the control room, but still on-site, the effects of external sirens in the vicinity of emergency officials (such as

EXERCISES AND AUDITING OF EMERGENCY PLANNING 145

firemen) may also produce masking effects on communication between them. In the above situations, it is inadvisable to allow alarms to be switched off by the incident control room operators because, as experience shows, this can become a regular reflex and so undermines the effectiveness of the alarm. The resolution of this problem will depend very much on the context in which the auditory alarm is sounded. Whilst the operators in the indicent control room may wish to silence an alarm to which they have already responded, this possibility should not be applied in blanket terms to other locations. One suggestion from a case study was that, where auditory alarms were being sounded, the emergency officials could be allowed to make announcements over the tannoy system. To ensure that these announcements were audible, the sirens were attenuated for the duration of the announcement by the official transmitting the message. Additionally, redundancy and diversity should be incorporated into the alarm systems such that, where one mode fails, the other may still be available and functioning. One solution would be to use visual alarms as well. 5 PUBLIC INFORMATION It is possible that, whilst an effective emergency plan has been developed for an on-site emergency, it fails to cope with the many variables that are evident in the off-site situation. Of most relevance to this paper is the capability of the emergency plan to utilise effective methods by which information to the public can be disseminated. In Technica’s experience, the requirement of the public for information is straightforward: unambiguity about what the threat characteristics are, instructions on how to mitigate these, and the ability to confirm the threat. It is simply inadequate to expect sirens to provide the public with such specific information on the nature of an emergency. Responsibility for the officials/authority giving such information must be clearly defined. Research conducted by Technica suggests that careful consideration needs to be given to those responsible for information dissemination and to the type of information that will be given. In other words, a good authority figure, clear instructions, and preferably two-way communication are necessary. This would enhance the public’s perception of the origin and reliability of the information. It is common for the

146 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

public to jam communication lines as they try to confirm the threat. This should be avoided if possible. For obvious reasons it is unlikely that a simulation exercise involving large numbers of the public can be economically conducted. However, data from a simulation exercise (e.g. threat characteristics and their relation to the proposed warning methods and content) could be used to assess the capability of the warning system to effect the appropriate response in the population at risk. Data on the efficiency of the warning process in evoking the appropriate response have been obtained by Technica, and these can be used in a predictive analysis of the emergency plan. 6 SUMMARY This paper has not attempted to discuss all the issues important to emergency plan assessment. It has, however, documented the issues that Technica has found, in previous work, to be important. Additionally, no attempt has been made in this paper to produce a complete methodology for assessing emergency plans. The paper does, however, document the use of two approaches. The first is a high-fidelity simulation, of which we have experience in implementation for auditing purposes. The second, functional analysis, is a complement to the first approach, but can be most useful when a full-scale high-fidelity simulation is not viable. Such an analysis is more economical than a high-fidelity simulation. However, the functional analysis, on paper at least, may not have access to real-time data. We would therefore suggest that the two approaches be used together. In this way, the benefits of each can be reaped to the advantage of the emergency plan.

17 Exercises and Auditing: Experience Gained in the FRG STEPHAN NEUHOFF Berufsfeuerwehr Köln/Cologne Fire Brigade, Cologne, FRG

1 DISASTER RISKS AND PREVENTION In North-Rhine-Westphalia every city must carry out a disaster prevention exercise at least twice a year. These exercises must be directed at specifie local risk factors. Cologne is a city with an important chemical industry as well as being an important traffic junction. 25% of the total German production of chemical materials is produced in Cologne and the surrounding areas. The city is surrounded by a belt of large chemical factories as well as many small businesses which process chemicals or are involved in chemical trade and transport. Large amounts of dangerous chemicals are transported by road, rail, ship or pipeline. Cologne is a major road, rail and air transport junction not only for freight but also for passengers. The exercises must therefore be aimed at handling these two risk factors. In Cologne the city fire brigade is responsible not only for firefighting and emergency services but also for disaster prevention. As long as a fire or accident can be controlled by the professional fire brigade, by the volunteer fire brigade and by organizations involved in emergency services, such as the German Red Cross, the operation is directed by the chief of the professional fire brigade. If the situation cannot be brought under control by these organizations, then units of the Disaster Prevention Service must be brought in, and a Disaster Alarm is given. The operation is then directed by the town clerk. An operations staff group, the Disaster Prevention Management (Katastrophenschutzleitung, KSL), is available in a specially equipped control centre. This operations staff group consists of officers of the professional fire brigade together with the directors of various city offices such as the Health Office or the Press Office. It also includes members of state

148 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

agencies such as the police and military services, and (if necessary) members of private companies. Depending on the situation at the site of the emergency, one or several Technical Operations Management Groups (Technische Einsatzleitung, TEL) are established. They consist of an officer of the professional fire brigade together with a small operations staff. The TELs direct the units which have been put under their command. 2 THE AIM AND THE EXECUTION OF EXERCISES The exercises should enable a realistic simulation of a disaster and also the testing of disaster prevention measures. They should include the following procedures: 1. Notification of the management and units of the Disaster Prevention Service and other agencies 2. Communications between the KSLs, the subordinate TELs, the supervisory authority and other state agencies and (if necessary) private companies 3. Situation assessment and decision making by the operations staff 4. The execution of measures such as warning, evacuating and assisting large numbers of injured people Three types of exercise can be performed depending on the specific aim: alarm exercise, staff exercise, or a complete exercise. Any combination of these exercise types is also possible. The alarm exercise is only performed in order to check the time between the alarm and the ‘ready for action’ state. A staff exercise is only performed by the operations staff; the units at the disaster locality are simulated. During a complete exercise the KSLs, TELs and all units perform the exercise in a simulated emergency situation. The most frequent exercises are the staff exercises. Alarm exercises for the 4500 assistants of the Disaster Prevention Service in Cologne only take place every 3 years. Complete exercises are only performed approximately every 5 years due to the extensive preparations which are necessary.

EXERCISES AND AUDITING OF EMERGENCY PLANNING 149

3 ALARM EXERCISES The most recent unexpected alarm exercise in Cologne showed some rather sobering results. The exercise was performed on a weekday at 18.00 hours (6 pm). The members of the Disaster Prevention Management (KSL) were notified by telephone or, if available, by radio receivers. In cases where a simultaneous notification of all radio receivers could take place using a collect call (i.e. just by pressing a single button) the staff members arrived at their positions after approximately 30 minutes. Giving the alarm by telephone required much more time: an average of 3 minutes for each call. In addition, the telephone lines at the fire brigade control centre were blocked, and staff members whose presence would have been essential, especially during the early stages of a disaster, were not available. This problem will be tackled by the installation of a computer which automatically dials the stored telephone numbers and plays a prerecorded tape, after which the staff members who have been notified are registered and a list is printed. The fact remains, though, that at least 1 hour is required before the management staff members can commence their work. This means that in the meantime the situation must be managed by leading staff members of the professional fire brigade, the emergency services and the police who are on duty at the time of the incident. The units of the Disaster Prevention Service were alerted by sirens and by telephone calls. In the units which were notified by sirens, 20% of the members were available after the first halfhour, 40% after 1 hour, and 60% after 2–5 hours. In the units which were notified by telephone calls, approximately 10% arrived during each half-hour, resulting in a total of 46% after 2–5 hours. The conclusions are that notification of leading staff members and units of the Disaster Prevention Service must be done by sirens or by using a collect call for radio receivers. Plans must also be made for employing units with only 50% of their personnel. 4 COMMUNICATION PROBLEMS All technical means must be employed together to ensure efficient communications between the Technical Operations Management (TEL) at the site of the emergency and the Disaster Prevention Management (KSL).

150 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The radio communications network is often overloaded or even jammed during the early stages of an emergency. It is also frequently used by reporters. Therefore communications using mobile telephones in vehicles should be established as soon as possible. This can then be replaced by connecting the Technical Operations Management (TEL) with existing private telephone lines. A prerequisite for the use of telephone communications is the availability of secret telephone numbers for the Disaster Prevention Management (KSL) which cannot be blocked by calls from the public, from town councillors or from the press. Longer written reports can be transmitted by radio telex, and plans and maps can be forwarded by using telefax machines. Not only during exercises but also during real emergencies does it take a long time for the Technical Operations Management (TEL) at the emergency location to forward a first detailed report of the situation to the Disaster Prevention Management (KSL). As the Technical Operations Management (TEL) is nearly always overloaded, especially during the early stages of an emergency, it can take 45 minutes or more. The Disaster Prevention Management (KSL) must therefore have their own scouts, who can use motorcycles or 4WD vehicles to reach the emergency area and to report from there. The use of video cameras has turned out to be a successful measure in Cologne. The city of Bonn even has facilities which allow the direct transmission of video recordings from a helicopter into the control centre of the Disaster Prevention Management (KSL). The long time needed by the Technical Operations Management to investigate and report the situation has an additional consequence: it must not affect protection measures for civilians, for example if an accident occurs in a chemical factory! In Cologne, chemical factories must therefore report each incident using the code numbers D1-D4 depending on the suspected amount of danger to the public. If the fire brigade is notified of a chemical accident with the code number D3, the endangered area is immediately warned by sirens, radio stations and vehicles with loudspeakers, and closed off by the police. 5 ASSESSING THE SITUATION AND MAKING DECISIONS We have noticed, during all staff exercises, that the management groups can only work efficiently if they are kept as small as possible. The positions and tasks within the group must be

EXERCISES AND AUDITING OF EMERGENCY PLANNING 151

defined beforehand, so that the group members can prepare themselves and practise properly. Every position must be occupied by two people in order to enable shift work during longer emergencies. The performance of a management group depends very much on whether the individual group members are capable of working together. The most common problem is the incorrect behaviour of superiors at the highest level. These problems increase in significance if the exercise is being prepared, supervised and evaluated by staff members of this superior. Therefore exercises in Cologne are regularly planned and supervised by groups from other cities or by disaster prevention schools. This has resulted in a less restricted viewpoint and a more critical approach. It also reduces the probability that information about an exercise is released too early. So far, in Cologne, 4 staff exercises have been undertaken together with chemical factories. Cooperation was good as staff members were exchanged with members of the factory management as liaison officers. The emergency situation during the exercise consisted of a transport accident inside or in the direct vicinity of the factory area. The factories were not prepared to simulate an accident in a production area or at a storage area. Possibly they did not want to discuss the number of fatalities or injured persons which could result from an accident in these areas. Two of these factories are directly on the boundary between Cologne and neighbouring city areas. Exercises and real accidents have indicated the problems which can occur during the required cooperation. Planning and protection for the entire factory area must be the responsibility of the city which has the larger potential and facilities for protection. Tasks, information exchange and responsibilities must be defined precisely in advance. 6 EXECUTION OF PROTECTION MEASURES The protection measures which are required during a chemical accident, such as — warning, — closing off areas, — investigation, — care of injured persons, — evacuation, or

152 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

— decontamination, can be planned during an exercise by the management group without being executed, or they can be planned and then actually executed by units, or complete preplanned measures can be tested by the units. In Cologne the endangered area is defined by superimposing a template or pattern on a map of the city, the position of which depends on the prevailing wind direction but not on the type and amount of toxic material released or on other prevailing weather conditions. Other cities use several templates or simple empirical formulae for a calculation. National or EC recommendations are necessary. In order to do this, past accidents should be evaluated and future hypothetical accidents should be simulated. Use of loudspeaker-equipped vehicles for alarms has been extensively tested in the Cologne area and the results have been used as a base for planning purposes. Eighty-four fire brigade vehicles which are either permanently occupied, or which can be employed immediately, were equipped with loudspeakers, cassette tape decks and prerecorded cassette tapes. The success of a combined alarm using sirens, radio broadcasts and loudspeaker vehicles is not known, however, as it has not yet been tested. This exercise would require a large amount of participation from the general public. The handling of large numbers of injured persons was practised in Cologne by assuming the case of a crash-landing of a JumboJet At the simulated crash site the main problem was the management of large numbers of doctors and ambulance personnel in order to ensure rapid examination and treatment depending on the gravity of the sustained injuries. The second problem area was the hospitals. At night and on weekends they are understaffed and, depending on their size, even had problems when confronted with two badly injured patients at the same time. It is therefore necessary to install systems which can rapidly give the alarm to additional operating teams. The storage of antidotes depends less on the number of possibly poisoned persons than on the time available for the administration of the antidotes and the number of available doctors. Unfortunately it has not yet been possible to test the treatment of a large number of poison cases in an exercise in order to gain some knowledge of the requirements for an antidote storage system. A staff exercise is to be undertaken in Cologne in 1988. The test case is a railway accident, in which a fire threatens a filled LPG

EXERCISES AND AUDITING OF EMERGENCY PLANNING 153

tank car. According to a state recommendation, the area within a 1 km radius of the accident site is to be evacuated. In the Cologne city area this would require the evacuation of between 10000 and 100000 inhabitants. The planning of an evacuation on this scale, which is extremely complex and requires a large number of individual measures, can be practised by the operations staff. As the incident in Mississauga is difficult to compare with the situation in a large European city, it would only be possible to indicate the problems involved in evacuating 10000 or more people by a practical exercise, but this would reach the limits of this kind of exercise. The participation of hundreds of people can be organized, but the involvement of thousands exceeds our present organizing capacities.

18 Auditing and Exercising of Emergency Plans for the Danish Oil and Natural Gas Transmission System, Including Fixed Installations HANS HAGEN & PETER JOHANSEN Danish National Fire Service, Copenhagen, Denmark 1 INTRODUCTION After the discovery of oil and natural gas fields in the Danish part of the North Sea, the concession for import, sale, transmission and storage of natural gas was given to Dansk Olie & Naturgas A/ S (DONG) in 1979. This concession was later extended to include crude oil. Based on this concession, oil and gas transmission and storage systems including fixed installations have been built. The systems, of which the first part was put into service in 1983, today include 3 fixed installations covered by Article 5 of the EEC Major Hazard Directive 82/501/EEC. The facilities are a gas treatment plant, an oil storage facility, and a natural gas cavern storage facility. 2 NATIONAL REGULATIONS COVERING OIL AND NATURAL GAS TRANSMISSION SYSTEMS The above-mentioned systems were established in accordance with the Acts giving DONG the concession. The safety regulations for the systems were established jointly with the Natural Gas Coordinating Committee headed by the Energy Agency comprising all planning and safety authorities. As safety code, the US ASME Code for Natural Gas Transmission and Distribution systems was used, supplemented with specific Danish requirements. The specific requirements for the internal emergency plan are part of the safety requirements laid down by the Ministry of Labour in Order 406/1979 regarding the safety of natural gas facilities. This order also requires that the operator must obtain construction as well as operation

EXERCISES AND AUDITING OF EMERGENCY PLANNING 155

authorization. A condition for such authorization is that the internal emergency plan has been prepared and implemented. As regards the external emergency plan, the responsibility rests with the Ministry of Justice. This Ministry lays down the general requirements whereas the implementation rests with the police, the fire authorities, the Civil Defence Corps and the hospitals. 3 INTERNAL EMERGENCY PLAN PREPARED BY DONG In accordance with the requirements of the order by the Ministry of Labour, DONG has prepared an emergency plan covering the organizational structure, the emergency control centres, the communication systems, the technical procedures, and the equipment to minimize the consequences of accidents, alarm plans, and liaison with the external emergency authorities. The emergency plan consists of a plan covering all DONG oil and gas systems together with specific plans for individual facilities. The emergency plan also includes the necessary staff training and exercises. The exercises specified in the emergency plans include local exercises and exercises involving the whole system and the external emergency services. 4 EXTERNAL EMERGENCY PLAN (EEP) The main principle in making the EEP in Denmark is that the fire brigades available in the area in which the plant is situated must be adequate. This means that the authorities in approving the project have to take this into consideration and if necessary set up requirements for the company’s own fire brigade and/or fixed installations for fire-fighting. The EEP is prepared by the local fire authorities in coordination with the police and sent to the Danish National Fire Inspectorate (DNFI) for approval. As an example of the EEP, the treatment plant for natural gas in Nybro will be considered. The plant is located in the community of Varde, which has approximately 20000 inhabitants and a fire brigade consisting of 2 first attendances. Within a short range of the plant there are two small communities, each with 1 first attendance. The nearest big town is Esbjerg with approximately 80 000 inhabitants and a fire brigade consisting of 3 first attendances. Besides the fire brigades mentioned, the Civil Defence Corps send the following appliances to the plant in a case

156 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

of ‘great alarm’: within 15–20 minutes there will be 31 firemen and 9 vehicles, and within 50 minutes a further 36 firemen and 8 vehicles. 5 PLANNING OF EXERCISES The exercises are planned by DONG in collaboration with the external emergency services, with the following objectives: (a) Testing the alarm procedures (b) Testing the collaboration between DONG and the external emergency services and the availability of special equipment (c) Making on-site and off-site personnel familiar with their equipment, the facilities, and possible accidents 6 AUDITING OF THE EMERGENCY PLAN After each exercise a short report is made by the participating DONG units and the external emergency services. These reports normally cover the following items: (a) Tasks carried out during the exercise (b) Communications with other participants and the press (c) Lessons learnt

SESSION IV Techniques for Emergency Plans Chairman: M.F.VERSTEEG Ministry of Housing, Physical Planning and The Environment, The Netherlands Rapporteur: H.SCHNADT TÜV Rhineland. FRG

19 The Computer Program TIGRE and its Application to the Planning of Chemical Emergencies A.SENYÉ,a B.SIGAÉLSb aDepartamento de Ingeniria Nuclear, b Departamento de Termotecnia, Universitat Politécnica de Catalunya, Barcelona, Spain & A.TRUJILLO BRAIN Ingenieros SA, Barcelona, Spain

The computer code TIGRE [1] is an expert system, specially designed to fill the needs of off-site Emergency Plans prepared under the requirements of the 82/501/CEE directive. It has been applied to the plans of the chemical complexes of the provinces of Tarragona and Huelva (Spain), known respectively as PEE/ PLASEQTA and PEQHU. These two provinces contain approximately 70% of the Spanish chemical industry. In order to accomplish its objectives, TIGRE contains two data bases. The first deals with major accidents. It contains a complete catalogue of the accidents taken into account in the Response Guide [2]. The second data base contains the information needed to estimate physical and chemical properties of hazardous substances. In addition, TIGRE uses mathematical models to calculate the values of some variables representative of the physical phenomena due to major accidents. The models used are derived from those proposed by the Netherlands Organization for Applied Scientific Research (TNO) and described in the so-called Yellow Book [3]. In this way it is possible to alter the meteorological conditions and also the source term adopted in the Response Guide. So the program TIGRE allows the operator to determine the real consequences of the accident and also the best counter-measures to be taken.

TECHNIQUES FOR EMERGENCY PLANS 159

It is worth noting that the models used have to be simple enough to be capable of offering responses during the emergency. They also have to be complete enough to provide reliable results. The option chosen is a compromise between the two needs. Due to that lack of precision they have to be supported by the Chemical Security Group [4]. The emergency starts when a chemical factory notifies the CECOP [5] of an incident. At this moment the Emergency Plan becomes active, as also does the code TIGRE. When the Chemical Security Group has assessed the accident, one can use TIGRE in two different ways: (1) If the accident is similar to one of those contained in the Response Guide, it is possible to obtain a forecast of the consequences of the accident in a few seconds. The only additional information needed is meteorological data. (2) If the accident is not similar to one of those contained in the Response Guide, it is also possible to use TIGRE to predict its consequences. The sole difference is that the operator has to provide some more information about the characteristics of the accident and the place where it has taken place. If the substance involved in the accident is not one on the data base [6] it is also necessary to supply properties data. The use of TIGRE has been simplified as much as possible in order to make it suitable for use during emergencies by unqualified personnel. In addition, it contains a great number of safeguards to minimize erroneous operation. The simplicity of TIGRE is improved by a very detailed user’s manual and by short courses given to the personnel responsible for its use. Finally, emergency simulacra are prepared periodically so as to maintain the operability of the whole system. NOTES 1.

2.

3.

TIGRE stands for Tratamiento de la Information y Guía de Respuesta en la Emergencia (information treatment and response guide during the emergency). The Response Guide contains a great number of hypothetical major accidents covering a wider range of severity. It has been deduced from a meticulous analysis of the installations. TNO. Methods for the Calculation of the Physical Effects of the Escape of Dangerous Material (Liquids and Gases). Report of the Committee for the Prevention of Disasters, Directorate General of

160 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

4.

5.

6.

Labour, Ministry of Social Affairs, Voorburg, The Netherlands, 1979. The Chemical Security Group is one of the four task groups that are included in the Emergency Plan. It has to assess the accident and provide all the information needed to the Direction of the Plan. CECOP stands for CEntro de Coordinación OPerativa. It is an operations centre from where the emergency procedures are directed. The substances data base contains more than 60 substances. Among them are the most commonly used of the classified substances under the 82/501/CEE directive.

20 Expert System Technology to Support Emergency Response: Its Prospects and Limitations SALVATORE BELARDO State University of New York, Albany, New York, USA & WILLIAM A.WALLACE Rensselaer Polytechnic Institute, Troy, New York, USA 1 INTRODUCTION The capabilities for computer technologies to provide decision support in emergency response are now well recognized [1]. The information flow prior to, during, and after potentially catastrophic events must be managed in order to have effective response. We feel strongly that computer technology can be a crucial component in this management process. We will first review a relatively new facet of computer technology — expert systems. We will then provide a conceptual framework for decision making under crisis, a situation typified by emergency response. We follow with a discussion of a prototype expert system for response to an accident at a nuclear power generation facility. Our final section discusses the potential advantages and limitations of expert system technology in emergency response. 2 EXPERT SYSTEMS [2] The origins of artificial intelligence (AI) date back several decades. AI has its roots in the mathematical logic systems of Frege, Whitehead, Russell and Tarski, and in the theories of computation developed by Church and Turing, among others. These theorists addressed thinking by formalizing some aspects of reasoning into a relatively simple framework. The formal systems of logic and newborn computers were then linked by these systems of logic. The crucial advance was the recognition that computers were not limited to numeric calculations but could process symbols.

162 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The introduction of symbolic processing opened the door for attempts to mimic the human mind. Studying the ways humans solve problems, AI researchers have developed techniques that attempt to represent human decision making. Knowledge representation, the searching for possibilities and alternatives, and learning processes are all ingredients in AI research. Expert systems have recently emerged as the leading practical application of AI. The user of an expert system interacts with the computer in a ‘consultation dialogue’, much as he or she would approach a human expert on the same problem. The user explains his or her problem, perhaps performing some tests, and then asks questions about the computer’s proposed solution. 2.1 Representing expertise Representing the various types of knowledge that characterize expertise constitutes one of the main themes of expert systems research. Expert systems are often designed with knowledge concerning: (1) facts about the domain; (2) hard rules or procedures; (3) problem situations and potential solutions; (4) general strategies; and (5) conceptual models of the domain. Much of this information must be stored in the program of the expert system using special techniques for knowledge representation. Many systems use production rules of the form ‘IF A THEN B’ to store information types (2), (3) and (4). Domain information is often stored in tables or matrices, while the designers’ conceptual model of the problem is usually built into the program logic. The clearest distinction between expert systems and conventional computer programs is the flexibility of the artificial intelligence design. Much of the knowledge that is used by human experts does not constitute definite decision sequences, rather it is ‘hunch-like’.

TECHNIQUES FOR EMERGENCY PLANS 163

2.2 Transfer of expertise The primary bottleneck in the development of expert systems is the acquisition of the knowledge of the expert. Typically the system designers consult with one or several ‘experts’ for long periods of time during the development stages. Since intuition and opinion are part of this knowledge, this process is often arduous and inexact and can lead to long delays in producing a working expert system [3]. 2.3 System processing Expert systems attack problems by feeding all the available information concerning the problem into the knowledge base that makes up the heart of the system. Often this consists of production rules that generate possible hypotheses or solutions to the problems. Once initial possibilities have been determined, the process of confirming or narrowing the solution begins. In systems involving diagnostic problems, the program uses its conceptual model to suggest tests to be performed or questions to be answered. These narrow the solution range in order to enable the system to reach a valid conclusion. 2.4 Explanation of knowledge A key feature of many expert systems is their capability to explain their reasoning in understandable terms. This ability is one of the distinguishing features of consulting with human experts and is implemented on computer systems to improve the user’s confidence in the system’s judgment. With the availability of the exact reasoning process followed by the system, it is easier to convince users that the solutions are valid and reliable. However, differing philosophies are used to explain whether the system can actually mimic the reasoning processes of the expert. Several systems use an elaborate solution technique but then attempt to explain their solutions in conventional ways. The issue of knowledge presentation is also an open research question [4].

164 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

3 DECISION SUPPORT FOR EMERGENCY RESPONSE [5] In an emergency, managers face a unique decision making process. Dynes and Quarantelli [6] state that decision making during crises is marked by a rapid increase in the number of decisions made and the volume of information that must be processed. As a result, crisis managers cannot analyze options available to them. Feeling intense time pressure and operating under the stress created by dealing with life-threatening events, they ignore critical information (which they are unable to process or relate to the events facing them) and resort to rule-based behavior. The success or failure of the response operation is dependent upon the validity of the rules selected. Successful emergency managers are people who have a valid mental set of rules or can instantly determine upon which ‘experts’ they can rely. The probability that information-free, trust-based decision making will succeed is diminished by the fact that emergency management involves rapidly changing ad hoc organizations. Communications and control are difficult at best, and these organizations are likely to include many members with inadequate expertise. The sequence of events and decisions at Chernobyl, Bhopal, and in Switzerland are evidence that the heuristics of the first-line responders and crisis managers may not be appropriate to the scale of the crisis that they face. Information technology, appropriately used, can support the judgment of crisis managers and can also aid in the actual management of a crisis response. Knowledge-based support and control systems may be used to evaluate and determine correct courses of action, to perform functions automatically (thereby diminishing the volume of decision making that must be done), or by calling attention to exceptional conditions. The need to provide decision support to emergency managers is readily apparent from theories of decision making. One theory suggests that a decision maker has an optimal band of information processing capability that, when breached, will result in a reduced quality of performance. Another theory suggests that, when information handling capabilities of an individual are overwhelmed, individuals try to compensate for their deficiencies by constructing a simplified representation of the problem and by behaving rationally within this representation [7]. The latter concept is related to the psychological phenomenon known as

FIG. 1. Flow of action in emergency management operations.

TECHNIQUES FOR EMERGENCY PLANS 165

166 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

‘cognitive strain’, caused by the inability of the decision maker to match his or her information processing capabilities to the information demands. Stress occurs and resultant dysfunctions are apparent in the decision maker’s performance. Decision making performance is not only a function of the psychological attributes of the individual, but also a product of the individual’s role in an organizational system and of the availability of appropriate resources to support the decision making process, i.e. information technology decision aids. Decision making can be improved, therefore, by selecting people with the proper psychological prerequisites, or by engineering the environment so that better decisions result. Our interest is in this latter category and, in particular, in the selection and design of expert systems to support emergency response decision making. Figures 1 and 2 illustrate the flow of decisions in a crisis event. The flow of actions in emergency management operations follows the dynamics of the event. The decisions made in one stage of the disaster are constrained by the time available and they, in turn, constrain the decisions made in later stages. Figure 2 is based upon Smart and Vertinsky’s [8] conceptualization of the decision process during crisis. The quality of the decision made by an individual in a crisis setting (box I) is a function of the quality of the information received (box H), his or her cognitive capabilities (box A), and an assessment and evaluation of the tradeoffs associated with the various alternatives (box G). The quality of the information used in the decision process depends on the ability of the information system to monitor and, when necessary, to reduce data flows to prevent information overload (box C), as well as the ability of the system to insure that the data are in a form meaningful to the user and of value in the decision process. The major difference between emergency response situations and routine decision situations is highlighted by the ‘loop’ in Fig. 2 (from box A to box E). The closed-system nature of the conceptual model indicates the large degree of dependence among the factors, specifically with regard to surprise (box D), stress (box E), and information processing abilities (box B). A decision aid (box F) can dampen feedback in the loop (and thus lessen the impact of stress and surprise on the decision maker) by reducing the decision maker’s information overload, real or perceived. Reducing the information overload results in an increase in available response time, a reduction in stress, and improved information processing, which results in a more efficient use of the decision maker’s cognitive processes.

TECHNIQUES FOR EMERGENCY PLANS 167

FIG. 2. A conceptual model of the role of a decision aid in an individual crisis decision process.

4 EXPERT SYSTEMS AS A DECISION AID FOR EMERGENCY RESPONSE We have identified the components of a decision support system for emergency management in Fig. 3. The five subsystems are (1) a data bank, (2) a data analysis capability, (3) normative models, (4) expert systems, and (5) an interactive technology for display and use of the data and models. This system would interact with the decision maker and collect data from the environment, either directly to the data bank or from the user. The data bank stores information obtained from the operating environment. This information is typically obtained prior to the decision situation, but data on current conditions can also be stored and processed as needed. The data are then presented to the decision maker in their original configuration or after transformation according to one or more models. In many circumstances the data are processed statistically to provide specific types of information that may be useful in obtaining appropriate decisions. For example, projections of human resource requirements and staffing constraints can be combined to yield a forecast of future recruitment and selection goals. Normative models can assist the decision maker by providing solutions that are not obvious, evaluating tradeoffs

168 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 3. Components of a decision support system.

between alternative solutions, and providing recommendations on a specifie course of action to be taken. The expert system technology, as we indicated in the previous section, takes the data from the data bank and assesses their applicability to the decision process in question. It then provides a recommendation to the decision maker using the system rules. Although not explicitly shown in Fig. 3, a model management system could act as an interface between the decision maker and the various models. Conceptually the system could manage the interaction between the models and provide advice to the decision maker on the appropriate model(s) for a decision situation. The last subsystem, the technology required for display and interactive use, may be the most important part of the system. Even the most ‘optimally’ designed system may go unused if the information is not presented in a form that supports the decision maker. The decision aid must take into account the differences in how individuals approach the problem solving process. Thus the interface technology must be flexible and provide several display and retrieval alternatives.

TECHNIQUES FOR EMERGENCY PLANS 169

5 AN EXAMPLE IN NUCLEAR PLANT EMERGENCY RESPONSE [9] Since the TMI-2 and Chernobyl accidents, the nuclear industry has undertaken a major initiative to improve nuclear plant emergency response capabilities. Progress has been made in developing computerized data systems to support the emergency response facilities. However, response management must include federal, state and the private sectors as well as the coordination among them. It includes activities such as direction and control, communication, public notification, accident assessment, protective response action, public information, evacuation, etc. Typical response proceedings during a radiological emergency are depicted in Fig. 4.

FIG. 4. Typical response proceedings during a radiological emergency.

A prototype expert system was built to provide decision support for emergency response. The knowledge base was taken from the emergency level classification for the Indian Point Nuclear Power Plant and the procedures from the State of New York Radiological Emergency Preparedness Group in the USA. The system was built using the GEN-X expert system shell product of General Electric. It consists of 64 modules, of which 57 are AND/OR trees and 7 are IF/THEN tables. The system can run in two modes: interactive or semi-automated. In the first one, questions are asked of the user at each step of the inference process, whereas in the second a data base or file is interrogated and the user is only required to confirm or supply ‘judgmental’ answers. The objective of this prototype system is to aid in the decision making process. The system queries the user for identification and then prints a list of procedures that have to be followed—matched to the responsibilities of the user.

170 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 5. Logical structure of the expert system.

TECHNIQUES FOR EMERGENCY PLANS 171

172 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The system has several levels of nesting, i.e. a CAN’T ANSWER response at one stage will produce a call to an inner module that asks for more specific parameters. This process goes on for several levels until an answer is obtained. A schematic of this process is shown in Fig. 5. The plant conditions can be one of the following: normal operation, unusual event, alert state, site area emergency, general emergency. The events that determine the above conditions are classified as: thermohydraulic, radiological, power loss, safety systems actuation, natural hazards or other type. The user can be any individual involved at the federal, state, local or private sector. This can be accomplished by taking advantage of its modular design as well as its ability to perform forward and/or backward chaining. It is designed using a hierarchical top-down approach, i.e. going from general to specifie questions until an answer is obtained or can be inferred. It has two running modes: interactive, asking questions at every step, and semiautomated, interrogating a fact/data base and asking the user only a few questions. This prototype system is being validated by implementing various plant scenarios from past drills, and comparing the answers with those obtained in the field. 6 DISCUSSION We have attempted to demonstrate the role of expert system technology in providing support to emergency managers. The example we used was the case where these managers are faced with an incident at a nuclear power generator facility that has the potential for catastrophic consequences. Artificial Intelligence as a discipline is just in its infancy. We have only discussed one area in this rapidly expanding (and often confusing) field. The area of expert systems seems to hold promise for implementation in a meaningful way, i.e. it is used operationally. The difficulty with its use in emergency response is the lack of routine in the activities required to manage the emergency. We can, and have, simulated the events surrounding a nuclear accident, but have not tested this technology even in that environment [10]. We might also consider other new advanced information technologies as possible candidates for supporting emergency response. Of particular note is the use of mobile cellular telephone systems with expert system technology [11]. The availability of

TECHNIQUES FOR EMERGENCY PLANS 173

rapid, accurate digital information will complement the judgment capturing and processing capabilities of expert systems. The result would be recommendations for emergency response, displayed graphically in ‘real time’, i.e. in time to support the decisions that have to be made to protect life and property. NOTES AND REFERENCES 1.

2.

3.

4.

5.

6.

See BELARDO, S., KARWAN, C.R. & WALLACE, W.A. (1984). Managing the response to disasters using microcomputers. Interfaces, 14(2), 30–9, for examples, while a US government report by the Congressional Research Service of the Library of Congress, Information Technology for Emergency Management, US Government Printing Office, Washington, DC, 1984, surveys the topic. This section draws heavily upon HURLEY, M.W. & WALLACE, W.A. (1986). Expert systems as decision aids for public managers: an assessment of the technology and prototyping as a design strategy. Public Administration Review, Special Issue, 563–71, and MICK, S. & WALLACE, W.A. (1985). Expert systems as decision aids for disaster management. Disasters, 9, 98–101. Other references used are BARR, A. & FEIGENBAVIN, E.A. (Eds) (1979). Handbook of Artificial Intelligence, Vol. 1, Stanford University Press, Stanford, CA, and WATERMAN, D.A. (1985). A Guide to Expert Systems, AddisonWesley, Reading, MA. The problem of transfer of expertise or knowledge acquisition has yet to be resolved; one example of ongoing research is GRABOWSKI, M. & WALLACE, W.A. (1987). Knowledge Acquisition Using Prototyping: An Empirical Investigation. Technical Report No. 37–87– 120, Decision Sciences and Engineering Systems Department, Rensselaer Polytechnic Institute, Troy, NY. The impact of advanced technology will be most evident in the way the user interacts with computing and communication technology. Very realistic and useful graphics and voice interactive capabilities will be available within the next few years. The issue of knowledge presentation, how we instil confidence in the user of expert systems, becomes the key to user acceptance and understanding; see LAMBERTI, D. & WALLACE, W.A. Presenting uncertainty in expert systems: an issue in information portrayal. Information and Management (in press). A more detailed discussion may be found in BELARDO et al. (see Note 1), and BELARDO, S., HARRALD, J. & WALLACE, W.A. Knowledge based decision support systems for responding to chemical accidents. Proc. 1987 World Conf. on Chemical Emergencies, Rome, Italy (in press). DYNES, R. & QUARANTELLI, E. (1976). Organizational Communication and Decision Making in Crises. DOD/ARPAN00014–

174 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

7.

8.

9.

10.

11.

75–C–0458, Department of Defense, Advanced Research Projects Agency, Washington, DC. TAYLOR, R.H. (1975). Psychological determinants of branded rationality: implications for decision-making strategies. Decision Sciences, 6(3), 409–29. This diagram is based upon SMART, C. & VERTINSKY, I. (1980). Designs for crisis decision units. Administrative Science Quarterly, 22 (4), 640–57. SALAME, A.A., GOLDBOGEN, G., RYAN, R.M., WALLACE, W.A. & YEATER, M.L. (1987). An expert system for improving nuclear emergency response. Artificial Intelligence and Other Innovation Computer Applications in the Nuclear Industry: Present and Future, Snowbird, Utah, USA, 31 August-2 September. We have assessed (fortuitously) simulation as a basis for training in BELARDO, S., PAZER, H.L., WALLACE, W.A. & DANKO, W.D. (1983). Simulation of a crisis management information network: A serendipitous evaluation. Decision Sciences, 14(4), 588–606, and have used gaming to test decision aids; see BELARDO, S., KARWAN, K.R. & WALLACE, W.A. (1984). An investigation of system design considerations for emergency management decision support. IEEE Trans. Systems Man and Cybernetics, 14(6), 795–804. WALLACE, W.A. (1987). On Managing Disasters: The Use of Decision Aid Technologies. Technical Report No. 37–87–118, Rensselaer Polytechnic Institute, Troy, NY, and to be published in Proc. NSF Workshop on Natural and Technological Hazards. University of Colorado, Boulder, CO. (in press).

21 Improved Emergency Response after Release of Toxic Substances: Application of the System SMART* D.HESEL TÜV Rheinland, Cologne, FRG & H.DE WITT, H.D.BRENK & A.G.KNAUP Brenk Systems Planning, Aachen, FRG An accidental atmospheric release of toxic substances can take place in chemical factories, it can be caused by a fire or it can follow a transport accident with hazardous materials. Emergency response forces have to be able to act properly in all these cases. Whatever the reason for the contingency may be, a quick and accurate estimate of the toxic air concentrations in consequence of the accident must be made and a decision on protective measures must be deduced from this estimate. This important decision in off-site emergency management as to which protection measure must be taken for the general public is generally left to the first on the scene, the fire brigades. Once they have an idea of which material has been released, they require information on emission rates and meteorological data to estimate the consequences of the release to people in the vicinity of the accident site. To date the instrumentation and the tools to achieve this are very simple and unreliable. Identification of the material released is achieved by UN number, or by questioning the manufacturer. Measuring is carried out with absorption tubes, if it is carried out at all. Prediction of the propagation of the released material is effected with the aid of some precalculated plume models (Fig. 1). If this is compared with the actual course of a released cloud (Fig. 2) we can see that the prediction made using Fig. 1 can lead to a severe misjudgement of the real conditions.

* SMART: System for Measurement-based Assessments of Released Toxicants.

176 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 1. Example of a precalculated plume model (variables: wind direction, wind speed).

FIG. 2. Actual shape of a propagating cloud under realistic weather conditions.

To improve this situation, the German Ministry for Research and Technology has sponsored us to develop a mobile unit for use by the fire brigades. The developed unit consists of a command vehicle, a personal computer with relevant software, input and output devices, a meteorological mast and three very simple measuring units equipped with absorption tubes. Figure 3 presents a rough sketch of the unit and its equipment. Concerning the air concentration measurements, we found out that all other devices, such as infrared spectrometers, dosimeters for individual substances, portable GC/MS devices and so on, are not (or not yet) suitable for use by fire brigades. The main reasons for this are the expertise required to operate and to maintain the systems, the lack of versatility of the devices and the costs. This disappointing result of our study forced us to stay with the absorption tubes and to incorporate them into the system. The key to the developed system is the computer software, which was designed to help the fire-fighter perform his tasks of identifying the released substance, assessing the released quantities, following the released and dispersing cloud, measuring air concentrations and of course making a decision on which protective measure to take. The software provides masks on the screen of the PC, which guide the operating fire-fighter through

TECHNIQUES FOR EMERGENCY PLANS 177

FIG. 3. The mobile unit and its basic equipment.

the programme. Figure 4 summarizes the modules which make up the programme. All these modules are controlled and initiated from a main programme, which also takes care of the input and output. In short, the modules perform the following tasks: — Identification of the released material — Estimation of the released quantity using plant-specific data — Recording and processing of meteorological data — Processing of air concentration data — Estimation of source parameters — Dispersion calculation with adjustment to the measured air concentration data — Output of prediction and recommendations While most of these modules can be found in similar approaches, the module which carries out the dispersion calculation and adjusts it to the actually measured air concentration data is unique. This module SMART permits best possible elimination of uncertainties connected with each of the two factors dispersion calculation and measurement, by means of two key elements; see

178 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 4. Modules of the computer code applied in the emergency response system.

Fig. 5. The first element is the feed-back of current air concentration measurements into diagnostic calculations in order to adapt the calculations to the measurements. This results in a more realistic set of model parameters, including the source term. Subsequently these parameters are used as input data for the second key element of SMART which is real-time projection of the dispersion situation. The feed-back of current air concentration measurements into diagnostic calculations is realized by the following adaptation sequence. After the release of a toxic substance a first approximation of the dispersion situation is made as usual, without knowledge of measured air concentrations. In the second step, the computer module SMART incorporates the current concentration values measured at different locations and compares them with the modelled concentration values. The fundamental calculation procedure, which is then initiated, can be described as quasi-continuous adjustment of the calculated to the measured concentrations. This is repeated for each time interval, e.g. 10 minutes, for which measurements are provided. Depending on the specific question to be answered, the adjustment may be accomplished by evaluating 5 model parameters such that the procedure results in a best fit within the scope of the prediction accuracy of the dispersion model used. In mathematical terms this is realized with the aid of the following equation which is a modified least-squares fit formula:

TECHNIQUES FOR EMERGENCY PLANS 179

FIG. 5. Logical scheme of the corrective/predictive procedure of the System for Measurement-based Assessments of Released Toxicants (SMART).

where CC and CM are the calculated and measured off-site air concentrations of each measurement location i at the end of the time interval n; N is the total number of absorption tubes and k is the number of trials to find the best fit. The model parameters are: — Wind direction — Wind velocity — Standard deviation of horizontal and vertical wind direction fluctuations — Source term These parameters are evaluated according to a particular ‘trial and error’ strategy, based on Monte Carlo techniques and guided by their sensitivity with respect to the dispersion calculations.

180 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The adjustment procedure provides a most realistic and accurate set of effective model parameters to describe the current dispersion situation. This set is then used to project pollutant concentrations for subsequent time periods. The projection is based on the assumption that the meteorological conditions and the release rates are constant during the prediction time. This is a restriction which is not necessarily true, particularly for long time periods. It can be opened, however, by repeating the measurements and the adaptation procedure within sufficiently short time interval such as 10 minutes. This allows a proper adaptation to both changing weather conditions and varying releases of toxicants. Test applications with experimental dispersion data and first implementation in the emergency response system have revealed good operational performance of SMART. Therefore it can be stated that it provides very realistic and accurate information on the dispersion situation after an accidental release of toxicants to the atmosphere. It thus enables the first on the scene to make a quick decision about necessary protection measures. The complete system which is installed in the mobile unit performs a number of tasks. It helps the emergency forces to identify the released substance; it recommends measuring points and measuring equipment; it measures and records meteorological data; it registers every step of the accident; above all, it acts as a decision aid. The equipment used is still relatively simple, easy to maintain and reasonably priced. At the moment, the system is in its test phase in a joint effort with the Cologne fire department.

22 Emergency Management of a Gas Escape C.M.PIETERSEN Division of Technology for Society TNO, Apeldoorn, The Netherlands

1 INTRODUCTION Large industrial disasters that happened recently, like the LPG escape in Mexico and the methyl isocyanate escape in Bhopal (both at the end of 1984), again show the need for good preparation for such situations. It is the responsibility of the industry as well as the authorities to reduce risks to a minimum, but that does not mean that industrial disasters will cease to take place. One of the means to reduce the risk that people on-site as well as off-site will suffer from the consequences is to draw up an emergency management plan. Such an emergency response plan should be drawn up after a thorough analysis of the particular situation. Several elements can be distinguished: (a) Risk analysis of the hazardous activity; what types of accident will happen: — magnitude of the escape — possible consequences (area, number of people involved) — development of the disaster in time (b) Analysis of the type of action which will be the most effective during an emergency (and what type of organization should be set up) (c) Development of the tools to be used in an actual emergency An analysis of accidents that actually occurred will be of great benefit for all three steps mentioned. In this paper the TNO analysis of the Mexico and the Bhopal disasters will be used to illustrate the necessity for all three elements. These accidents represent

182 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

completely different situations, for which completely different emergency responses will be necessary. It also leads to large differences in requirements with respect to the type of organization (number of people, delay in being present at the site etc.). The diversity of possible disaster situations by type, magnitude, location and time requires an automated decision support system, to be used in actual emergencies. TNO is currently developing such a system on behalf of the Dutch Ministry of Internal Affairs (Fire Inspectorate). This paper gives a short description of the possibilities of that system. The importance of preparing an on-site emergency schedule (for the workers) is based on risk assessment techniques and is illustrated with TNO wind tunnel modelling of NH3 escapes at a Dutch chemical plant. 2 RISK ANALYSIS OF HAZARDOUS ACTIVITIES FOR EMERGENCY RESPONSE PLANNING In order to be able to set up an emergency response plan for a particular industrial activity (installation, transport or handling), a risk analysis of the activity should be drawn up: (1) Identification of representative accident scenarios: What can go wrong? A certain indication of probability of the scenarios will be useful, in order to set priorities. Quite often the ‘maximum credible accident’ approach is followed. The judgement of what is and what is not credible is of course a subjective one. (2) A calculation of what will happen to the surroundings of the activity in the case of an escape: (a) Effect calculations: — concentrations in vapour cloud as a function of distance — passage time of a vapour cloud — heat radiation as a function of distance — overpressures upon explosion etc. These effects can easily be calculated via existing models [1], also available in software packages for personal computers. (b) Consequence calculations:

TECHNIQUES FOR EMERGENCY PLANS 183

— number of injured and killed people as a function of toxic dose, heat radiation dose etc. — damage to different types of building These calculations need introduction of a specific environment. TNO has currently developed software for personal computers that will make these calculations possible [4]. An analysis of comparable accidents that actually occurred will be useful in order to verify the models that are used to estimate the development in time and to learn from already taken emergency response actions. Accident data are available for instance in the TNO databank FACTS. However, it is worthwhile to analyse some accidents in more detail. The Mexico and Bhopal accidents are examples of such an analysis, also with regard to the emergency response aspect. 3 THE GREAT DIFFERENCE IN EMERGENCY RESPONSE REQUIREMENTS OF THE MEXICO AND BHOPAL ACCIDENTS 3.1 Mexico LPG disaster, 19 November 1984 In November 1984 a disaster involving an LPG installation in Mexico City resulted in the death of over 500 people and 7000 people were injured. A TNO team visited Mexico shortly afterwards to carry out an investigation [2]. This investigation was mainly directed to a check of the existing damage and effect models and to the emergency relief that had taken place. Some figures in relation to the emergency relief are given below. The area in question is given in Fig. 1. During the disaster 985 medics, 1780 para-medics and 1332 volunteers were giving medical assistance. They handled 7231 wounded, of which 5262 were treated in provisional emergency centres. Of the 1969 wounded taken to 33 hospitals, approximately 900 had to stay there for further treatment. By 25 February 1985, 710 patients had recovered, 32 were still in the hospitals and 144 people had died there.

184 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

For transportation purposes, the emergency services used 363 ambulances and 5 helicopters. Eleven provisional shelters were established for 39 000 homeless and evacuated people. Each day 35 000 hot meals were provided, with a total of approximately 125000 hot meals. The Mexico disaster developed very rapidly. A vapour cloud formed and was ignited shortly after the first leak (±10 minutes). The escalation to a complete disaster took place in the next few minutes. Generally it can be stated that in this type of accident the warning time is very short; however, some time may be available to take certain actions: — Removal of ignition sources (traffic etc.) — Evacuation of people — Stoppage of leak — Some time can be gained by effectively cooling (water spray) the tanks; due to the rapid sequence of events this should be an automatic system — The emergency relief organization for this type of disaster should be able to act very fast and to be present within a very short time

FIG. 1. Reproduction of the area in which the damage occurred.

TECHNIQUES FOR EMERGENCY PLANS 185

3.2 Bhopal disaster, 4 December 1984 Shortly after the Mexico disaster, a massive escape of methyl isocyanate caused the death of at least 2500 people and over 100000 people were injured in Bhopal, India. A toxic cloud developed during the night. In a TNO report [3] the accident and its emergency management are extensively described. At the request of the official Indian scientific investigation team, the Union Carbide plant itself was also visited. Compared with the Mexico accident this type of accident shows important differences with respect to emergency relief. Important points are: — A warning time (even before any gas escape) may be available; in Bhopal it might have been obvious 1 hour prior to the escape that a very dangerous situation was rapidly developing. — The development of the disaster allows time for important mitigating actions: evacuation etc. In Bhopal hardly any action was taken with respect to emergency response in the sense described above [3]. In Fig. 2 is illustrated how people started to run into the direction of the hospitals without any guidance. In fact this running worsened the situation; they were running in the wind direction and therefore stayed within the cloud.

FIG. 2. Movement of people to the hospitals during the Bhopal disaster.

186 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The scope of an emergency response organization to take effective actions is quite large for this type of accident. It is also mainly for these accidents that TNO developed an automated information and calculation system, to be used in actual disaster situations.

4 ON-SITE EMERGENCY MANAGEMENT It is important to base on-site emergency management schemes on realistic accident scenarios. This can be achieved by studying accidents from the past and/or via risk assessment techniques. However, the calculation of concentrations of toxic or inflammable/ explosive gas clouds, for the relatively small distances involved, may be rather difficult, depending on the circumstances. The influence of obstacles (buildings etc.) may be such that at present only wind tunnel modelling can predict the shape and concentrations of the cloud. For emergency management it is important that, in built-up areas like chemical plants, not only the down-wind area is covered but also the area up-wind and in the lateral direction. This should be realized in the case of an accidental release of a heavy gas. Running in the up-wind direction is not necessarily valid. From descriptions of several accidents involving NH3 there is clear evidence that staying inside a building in the event of a release has an advantage. For instance, it has been reported [6] that 10 men survived in a control room 80 m from the release; they put wet cloths over their faces. Five men left the control room; two of them were killed. More people outside or on their way outside were killed (see Fig. 3). The dispersion of the gas in all directions and the protection by (relatively) gas-tight rooms has set clear requirements for on-site emergency management in the case of toxic heavy gas releases. Gas-tight rooms are to be created and clearly indicated; people should run to these rooms. Adequate protective means and communication equipment should be present at the spot.

TECHNIQUES FOR EMERGENCY PLANS 187

FIG. 3. General layout of Potchefstroom plat.

188 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

5 INFORMATION AND CALCULATION SYSTEM FOR EMERGENCY RESPONSE Commissioned by the Dutch Ministry of Internal Affairs (Fire Inspectorate) and the Ministry of Housing, Physical Planning and Environment (Directorate General for Nuclear Accidents), TNO developed an Information and Calculation System to support decision making in

FIG. 4. Information and calculation system for emergency response.

disaster situations with toxic and nuclear material. The user can interact with the system, in order to get informed: — The system calculates and shows the size of the threatened area and the number of people involved. It also calculates the number of people that will survive and the number of people with several degrees of injury. The system also gives an insight into the development of the situation as a function of time. — The system is capable of analysing the effect of possible measures relating to a reduction of numbers of victims. The structure of the program is given in Fig. 4. The system is still in a demonstration phase and will shortly be implemented in fire brigade regions in the Netherlands.

TECHNIQUES FOR EMERGENCY PLANS 189

REFERENCES 1.

2. 3. 4. 5.

6.

Calculation of the physical effects of the escape of hazardous material (gases and liquids)—‘The Yellow Book’. Directorate General of Labour, Voorburg, the Netherlands, 1979. Also available as a software package (EFFECTS), TNO. PIETERSEN, C.M. (1985). Analysis of the LPG Incident in San Juan Ixhuatepec, Mexico City, 19 November 1984. TNO report. PIETERSEN, C.M. (1987). Bhopal: Risk Assessment and Emergency Management. TNO report. Software Package RISKCURVE for Personal Computers. TNO, 1987. GULDEMOND, C.P. The behavior of denser than air ammonia in the presence of obstacles: wind tunnel experiments. Plant/Operations Progress, 5(2). LONSDALE, H. (1975). Ammonia tank failure: South Africa. Ammonia Plant Safety, 17, 126–31.

23 Effective Emergency Planning Design by Means of Risk Analysis Models A.DONATI, L.LAMBARDI, V.SICILIANO & E.SILVESTRI Ansaldo SpA, Genoa, Italy

1 INTRODUCTION This paper discusses the analysis and design of emergency planning in an integrated framework of risk analysis. Two aspects are taken into consideration: — Risk analysis of the installation (industrial or civil), for deciding upon the reference accident scenarios, both in terms of their consequences and their probability — Detailed representation and modelling of emergency plans, to quantify their effectiveness in risk reduction This approach, in effect, considers emergency plans as virtual ‘safety systems’ and quantifies their effectiveness and reliability as such. 2 THE OVERALL MODEL The initial phase of the analysis consists of the risk analysis of the installation. This phase implements system models, like fault trees, event trees, models of accident analysis (fire, toxic release, or whatever is relevant for the installation being considered). This phase identifies the accident scenarios presenting the most significant risks for which an emergency procedure is required. Then each emergency procedure combining to form the emergency plan is evaluated with a systems analysis approach, and introduced into the overall plant model, like any other system or physical process already modelled, to identify the sequence of events/failures leading to an undesired outcome.

TECHNIQUES FOR EMERGENCY PLANS 191

This approach requires the emergency procedures to be evaluated in terms of their physical effectiveness and of their probabilities to be effective (a standard probabilistic risk assessment approach). 3 SYSTEM MODELS FOR AN EMERGENCY PLAN In order to evaluate the efficiency of a designed emergency plan, it is necessary to develop a model of the egress flow of people which points out the main parameters that may affect the success of the emergency procedure. The construction of the model passes through many phases; the main ones are: — Modelling the structure of the plant (e.g. a room, a floor, a building) and routes (doors, passages, stairs, open spaces, obstacles, bottlenecks) — Modelling the dynamics of people involved (e.g. reaction time to the alarm, speed, behaviour in stress conditions) — Introducing the use of possible means of conveyance (e.g. lifts, vehicles, ambulances) and their availability — Analysing the phenomenology of the accident (fire, smoke, toxic release propagation) A complete model will take into account all the parameters and should evaluate the possible interaction between them. To evaluate the adequacy of an emergency plan for a building it is necessary to be able to estimate the egress times of individuals (or homogeneous groups of people), and the probability that this time is less than a predetermined value. Egress time is here considered to be that elapsing between the alarm signal and the moment the group reaches a pre-assigned zone. During this time the plant or site situation may change (e.g. because of the accident or the environmental situation), and the pre-established safety course may then be unfit for use. Ansaldo has carried out a study of the first two steps and has developed, in an initial stage, two computerized models, one for the dynamics of people’s movements and another for people’s egress probabilities. Interactions with the phenomenology of the accident will be developed in a successive stage.

192 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The code EPDES (Emergency Planning DESign) is able to model the emergency traffic with the goal of evaluating the single person or group position, depending on the varying plant conditions. The code takes into account the topological situation, the variation of the environmental conditions (e.g. amount of smoke), the presence of obstacles on the escape routes. At each time, the code provides extension of the accident-related zones, positions of people, forbidden routes, and non-evacuable zones. It is also capable of searching routes alternative to the standard ones, ‘to reach safe zones; consequently the traffic model permits march inversions and route changes, depending on the situation as known by single persons. Basic entities of the model are the ‘group’, the ‘zone’ and the ‘route’: Group: homogeneous composition of people who, in emergency situations, run along a preset route to reach a safe zone. It is characterized by a mean speed and by various factors that may change it. Zone: each area into which the plant is subdivided. It is characterized by a length and a surface. With each zone is associated a typical speed which corresponds to that of a person crossing it, alone and in optimum conditions; this speed changes depending on the number of people present, on the environmental conditions and on the shape of the exits. Route: ordered succession of zones that each group crosses. It is characterized by a direction. A route may be interrupted at a certain time, and this may force the group to go back to look for a junction with a free route; if no alternative route is found, the group is to be considered lost. Three different egress modes are envisaged: — Independent groups, with no exchange of information among people about route practicability — Groups exchanging information about route practicability — ‘Panicking’ groups The group speed, V is evaluated through the equation: where Fg is the product of group factors, Fz is the product of zone factors, Vz is the typical speed in the zone. Factors and speeds are

TECHNIQUES FOR EMERGENCY PLANS 193

obtained from experimental correlations (see, for example, Refs 1 and 2). The EPDES code is part of a code family for the design of emergency plans relating to a reference scenario; it is thus linked both with codes of accident analysis and, in the future, with codes of probabilistic evaluation (presented by Ansaldo on the general organization of the methods and codes). The code provides a 3D graphic representation that shows the state of the system at different time steps. This graphic representation allows identification, in an interactive way, of the consequences of events forced by the code operator; also, subcases of different egress paths can be studied by means of the restart option. To predict the probabilistic outcome of this traffic model, a stochastic simulation is performed on it. This can be accomplished in various ways, such as a direct Monte Carlo type simulation of the dynamic model by assigning appropriate probability distributions to input variables (in this approach response-surface methodologies may represent an aid) or by using an appropriate logical model, for example (see Refs 3 and 4) a state transition (Markov) model (the latter is applicable if nonlinear effects, i.e. the dependence of state transition probabilities on the visited states is shown not to be important), where the values of state transition probabilities are based on the physical model just discussed. Implementation of these models with the appropriate input data will produce the various degrees of success of the emergency procedure at various times with associated probabilities. The results of this analysis can be coupled with the risk analysis of the installation, thus determining the accident situations that are most relevant, with account taken of the emergency plan. This resulting risk can be then, for design purposes, verified according to pre-defined acceptability criteria. The EGRESS program models the transient states of occupancy of a building by means of a Markov model. The transition matrix can be automatically constructed and reduced by checking the consistency of its states and its topological characteristics. At the present stage of development, the modelled emergency plans can only consist of a ‘rigid’ procedure, which means that each group of people has an a priori fixed and known route to exit. So no arbitrary choice of route is allowed; even the alternative route in case of obstacles is fixed. In this way it is possible to compare different egress paths, and therefore different emergency plans, checking the people’s time to

194 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

egress at a given level of probability (or vice versa). At present no search for optimal routing is performed. The basic entities of the model in this case are groups, states, egress rates, and routes. Groups and routes have the same physical interpretation as in the EPDES code, whereas states and egress rates are physically correlated with the concepts of zone and of group speed, and are defined as: State: possible configuration (occupation by people) of the rooms or spaces Rate: the mean flow of people from one zone to another; the rate depends on various factors: speed of people, type of exit, door, etc. A sensitivity analysis can easily be performed to check the relative influence of the parameters; this can be used to find the areas of the problem that need more details on data or on the model. In this way the probability of success/failure of an emergency plan may enter into the plant system event trees as a nodal probability like that of a protection system. 4 DESIGN OF AN EMERGENCY PLAN The overall model just described can be used for design purposes with the aim of reducing the risk generated by the process that takes places in the installation, by modifying the process intrinsic or active safety or, in particular, if the installation is already in the operational state, by improving the emergency procedures to be foreseen for its safe operation. This can in general be obtained by introducing or modifying engineered or procedural features with the general effects of: — increasing the effectiveness of the emergency plan through improved performance (e.g. a reduction of expected times of execution of the procedure, or reduction of dependence of its success on the success of single items or factors); — increasing the probability of reaching a successful terminal state under various conditions by reducing the effects of such factors of variability that may cause a large dispersion of the probability distribution of the parameters of merit like the time for people to leave the site), even if their expected or mean value is adequate.

TECHNIQUES FOR EMERGENCY PLANS 195

The choice between various alternatives at all levels, if it exists, must then take cost-effectiveness and cost-benefit considerations into account. REFERENCES 1. 2.

3. 4.

CASCARINO, A. and other authors (1982–1987). Various articles. Antincendio (in Italian). La Sicurezza contro Vlncendio degli Edifici a Struttura di Acciaio. Monografia 6 della Ricerca: II comportamento delle strutture portanti de acciaio alle azioni sismiche Parte II, 1979. SCHULTZ, N. (1985). Fire and Flammability Handbook. Van Nostrand. SAATY, T.L. (1961). Elements of Queueing Theory with Applications. Dover.

24 Major Industrial Risks: Examples of a Technical and Predictive Basis for Onand Off-Site Emergency Planning in the Context of UK Legislation K.CASSIDY Technology Division, Health and Safety Executive, Bootle, UK 1 INTRODUCTION There is nothing new about major hazards; it is only their character that has changed over the years. Intially, of course, large-scale threats to man and his environment had a natural origin, mainly storm, flood and fire, although the archaeological record amply demonstrates the potential for disaster that arose from mankind’s early attempts to harness the potential of fire. In the Middle Ages the manufacture, storage and accidental ignition of black powder may well provide the first examples of large-scale damage from manufactured substances and artefacts. In the last couple of centuries, large-scale water dam failure and boiler explosions accompanied the onset of the Industrial Revolution. The entry of chemistry, and particularly of chemical engineering, on to this stage has been relatively recent; it is even more recently that the threats posed by large-scale chemical engineering and energy processes have attracted the attention, first of risk analysts, and then of legislators, as a response to growing public concern. The justification for such concern has been demonstrated at regular intervals, by a succession of incidents causing widespread damage and death. Many lists of such incidents could be produced; most would include catastrophes such as those at Oppau, Texas City, Flixborough, Seveso and Manfredonia, Bantry Bay, San Carlos, San Juan Ixhautepec, and Bhopal, all of which have been seminal in terms of public and regulatory response. Nor is the catalogue confined to damage to humans. Many major hazard risks have an element (which may indeed predominate) of environmental damage where effects may persist long-term. It may well be that the recent

TECHNIQUES FOR EMERGENCY PLANS 197

pollution incident at Basle will prove to be a watershed of equal significance to the incidents listed above. 2 THE UK APPROACH The UK has been a leading architect in the framing of legislative control for major industrial hazards. We have a system, based mainly on the advice of the Advisory Committee on Major Hazards [1] and confirming European standards [2], which is centred in the following concepts [3]: — Identification: via the Notification of Installations Handling Hazardous Substances (NIHHS) Regulations [4] — Assessment and control: via the Control of Major Industrial Accident Hazard (CIMAH) Regulations [5]* — Mitigation: via the CIMAH Regulations (involving emergency planning and information to the public and land-use planning control [6, 7] This approach is very much an interdependent package of controls and responses, appropriately tailored to the relevant risks. 3 IDENTIFICATION There are in the UK some 1750 installations subject to NIHHS, and several hundred more now notified under CIMAH, many of the latter in particular presenting environmental as well as humandamage risks. The requirement for statutory notification has a number of effects: it gives priority to HSE attention; it permits identification of such sites to land-use and emergency planners, and to emergency services; and, hopefully, it stimulates greater onsite awareness of the hazards and risks. 4 ASSESSMENT AND CONTROL The general requirements of the CIMAH Regulations apply to sites which store or use hazardous substances which satisfy criteria

* Extensive guidance on and interpretation of the CIMAH Regulations can be found in a guide to the Regulations, published by HSE [17].

198 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

related to toxicity, flammability, reactivity or explosiveness. Several thousand such substances have been identified as being in regular use in UK industry. In such cases, the operator of the site must: — notify the HSE of any major accident which has occurred on his site, with details of steps taken to prevent its recurrence (to be a ‘major’ accident it need have no more than the potential for harm); — be prepared to demonstrate to an inspector, on request (and produce documentary evidence as appropriate), that he has considered the potential for major accidents from his operations, and has taken all appropriate steps both to prevent their occurrence and to mitigate the consequences of any which may occur. Further, more specific duties under the Regulations apply to sites on which are stored or used certain substances in excess of specified thresholds. These sites are known as large inventory top tier sites (LITTS), which store large quantities of flammable toxic or explosive materials, and small inventory top tier sites (SITTS), which store or use materials that are considered particularly toxic, and for which much lower thresholds (1 tonne or less) are prescribed. In the UK there are over 200 LITTS and several hundred SITTS notified to HSE. The additional duties which fall to the occupiers of such sites are: — Preparation of on- and off-site emergency plans — Provision of appropriate information to the public — Submission to HSE of a ‘safety case’ 4.1 The safety case Emergency planning and information to the public are measures primarily designed to mitigate the consequences of any major incident, should it occur (the probability of a major accident should, however, be remote), or, in the case of some aspects of emergency planning, to intervene in the escalation process. This latter approach apart, such questions should be concerned with the residual risk after all appropriate, reasonably practicable precautions have been taken. This is a general requirement of UK law [8]. In the case of hazardous installations, however, it is

TECHNIQUES FOR EMERGENCY PLANS 199

reinforced by a specific requirement to present to HSE a written report (the safety case) which: — describes the installation, and places it in its geographical and social context; — identifies any relevant major accident hazards; — analyses the effectiveness of the safeguards (both hardware and software) that have been applied; — reaches conclusions about the risks presented by the installation; and — on the basis of the above analyses, effectively justifies the continuation of the operation, whilst identifying any remedial action. This is not a process of approval, or one of licensing. Neither is it a once and for all exercise, as there are revision and updating requirements. The analysis is, however, a written demonstration of the application of good management techniques to major hazard control. It identifies the critical areas, which can then be addressed on a concentrated and continuing basis, and the hazard analysis carried out at an early stage of the assessment process highlights inter alia the relevant areas for potential mitigation, including that provided by adequate emergency planning. 3 MITIGATION The main elements of mitigation are planning, and information to the public.

location,

emergency

5.1 Location Adequate mitigation of major hazard risks is best achieved by planning control of incompatible land uses. Such controls have been applied in the UK, on a formal basis, since 1972. We are, however, the inhabitants of a small island (where intensive landuse is at a premium), and the hazard ranges of some of our industrial processes may be very great. Additionally, there is an existing legacy of previously permitted and continuing incompatible development. Many of our hazardous installations are not ideally located with respect to adjacent developments. This most powerful tool of control is therefore only partially applicable

200 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

to the existing situation, despite continuing developments in UK planning law [9] which will shortly introduce a ‘consent’ procedure for hazardous installations. Additional, operational measures are therefore required. 5.2 Emergency planning CIMAH requires effective arrangements for on- and off-site emergency plans, involving close cooperation between the site operator, the local authority, the county authority and the emergency services. General advice on emergency planning has been published in the UK by both the HSE [10] and industry [11, 12]. The recent SIESO booklet is an important addition to this corpus of advice [13]. Similar guidance is being produced in other countries, e.g. the USA [14]. The following principles are relevant in the production of emergency plans. 5.2.1 Assessment of the hazards and risks Manufacturers need to assess their activities to ensure that all that is reasonably practicable is being done to avoid or reduce danger. They should then assess what dangers could arise to people on- and off-site as a result of foreseeable emergencies and what the effects of an incident could be on the environment. This should be followed by consideration of how these could be mitigated by preplanned remedial and rescue measures using, when necessary, the combined resources of the organisation concerned and the public emergency services. The objectives of emergency plans are to contain and control incidents, to safeguard employees (and anyone nearby who might be affected), and to minimise damage to property or the environment. The spectrum of possible incidents may be very wide. The smallest, if promptly detected and dealt with, may have virtually no ill effects. If allowed to escalate, however, any incident may have serious consequences both on and off the site. Any relevant analysis will therefore involve an investigation of hazard, vulnerability, and risk. As a minimum, the following criteria will apply.

TECHNIQUES FOR EMERGENCY PLANS 201

(a) Hazard identification. — Types and quantities of hazardous materials located in (or transported through) a community — Location of hazardous materials facilities (and routes) — Nature of the hazard most likely to accompany hazardous materials spills or releases. (b) Vulnerability analysis. — Extent of the vulnerable zone (the significantly affected area) and the conditions that can influence the impact (e.g. size of release, wind direction, topography) — Population, in terms of size and types (residents, employees, sensitive populations—hospitals, schools, old folk’s homes etc.), expected to be at risk within the vulnerable zone — Essential support systems which may be affected by any incident — Any particular risks to the environment (c) Risk analysis. This will assess the probability of damage (or injury) to individuals or to the community due to a hazardous materials release, and the actual damage which might occur, in the light of the vulnerability analysis. It will include information on: — Event probability — Relevant environmental phenomena — ‘Domino’ effects — Types of harm to people (including high risk groups); whether acute, delayed or chronic — Types of damage to property (temporary, repairable, permanent) — Types of damage to the environment (repairable, permanent) — Indirect hazards/risks There are many uncertainties in the predictive modelling of all the above issues; similar uncertainties occur in real situations. For these reasons, a relative simple broad-brush approach is the preferred option. Assessments purporting to give closely defined accuracy are suspect, and may be misleading; in any event, such precision is more relevant (if achievable) to a developing incident than to a preplanning protocol, where a degree of realistic

202 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

conservatism and pragmatism is desirable. Flexibility of response is a paramount requirement. Examples of hazard ranges from substances presenting explosive, flammable and toxic hazards will be presented at the seminar, with some indication of the likelihood of each type of event and its relevance for emergency planning. A selection of these examples is given in the Appendices. Emergency plans must be capable of dealing with the largest incidents that can reasonably be foreseen, but detailed planning should concentrate on those events that are more probable. Plans must also have sufficient flexibility so that the response is tailored to the severity of the incident. Flexibility will also allow the response to be extended and increased if extremely remote combinations of adverse events and circumstances lead to consequences larger or more severe than those that formed the basis for the emergency plans. For example, the risks of aircraft crashing on to an installation that is not within a few miles of an airfield are remote and the consequences need not be considered in detail. If such a disaster occurred, there is no doubt that, in practice, the existing peace-time emergency plans would form the basis of the response by the emergency services. Seismic effects are unlikely to result in major vessel failure in the UK, but more minor events may need to be considered. 5.2.2 Content of the emergency plans (a) On-site plan. Key personnel will be identified. These will include the Incident Controller, whose primary task is to take charge at the scene, and the Site Main Controller, with overall responsibility for directing operations from the Emergency Control Centre. Nominated key personnel having immediate tasks to perform will always be available, as well as the Incident Controller or deputy and an emergency team. Provision will need to be made for the call-out of the other key personnel when they are absent from the site. Where the level of manning does not give cover round the clock, arrangements will be made to ensure adequate emergency response. The plan will also set out the arrangements for initiation of the plan, raising the alarm, the emergency control centre or centres, safeguarding those on-site, and the action by the emergency team. (b) Off-site plan. The off-site emergency plan will be based on events identified by the manufacturer that could affect people and the environment outside his premises. The manufacturer has to

TECHNIQUES FOR EMERGENCY PLANS 203

provide the emergency planners with information on the nature, extent and likely effects of such incidents. The plan will need to cater in detail for those events identified as being most likely, but it must be sufficiently flexible to allow for the remedial measures to be extended and increased to deal with extremely adverse combinations of circumstances and consequences or with an escalating situation. Several different responses may be necessary at a single site, depending on the size and characteristics of potential incidents. This is particularly so in the case of ‘mixed’ hazard sites, or where there is significant risk of escalation. The Chief Executive of each Emergency Planning Authority will normally designate an Emergency Planning Officer to oversee the plan. The emergency services, fire authorities, police, ambulance, etc. have duties to deal with emergencies and accidents of all sorts. In the UK, the police will have overall control of an incident, with control on the ‘fire ground’ by the fire authority. The plans will ensure coordination of existing services targetted to hazards specific to the industrial installation. The plans should set out a command structure and identify the respective roles and responsibilities of the senior personnel involved, so that a command and response structure is in place before the event. An Emergency Coordinating Officer may be designated; he will take overall command of the off-site activities. It is essential that any arrangements include a suitable off-site Emergency Control Centre. The plan will identify and detail immediate action to be taken to protect those in danger and arrangements for caring for those affected by an incident. In many cases the advice on immediate action may be to stay or go indoors, shut doors and windows, tune in to the local radio and await further instructions (normally from the police). Evacuation may present special problems. Indeed, being indoors may provide initial protection, but on the longer term it could increase the risk [15, 16]. Where environmental risks are present (and especially where they predominate), special arrangements will be necessary. Potential hazard ranges may be very great, and potable water and food supplies may be at risk. Such risks may, however, be delayed rather than immediate. The recovery phase should also be preplanned; again, special problems may be associated with environmental risks.

204 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

5.2.3 Rehearsals and training Both on-site and off-site emergency plans need to be tested when first devised, and thereafter to be rehearsed at suitable intervals, for a number of reasons: (a) They familiarise on-site personnel with their roles, their equipment and the details of the plans (b) They allow the professional emergency services to test their parts of the plan and the coordination of all the different organisations; they also familiarise them with the special hazards (c) They prove the current accuracy of the details of the plan (d) They give experience and build confidence in the team members; in the initial shock and confusion of a real incident, preplanned procedures are essential, as was clearly shown at San Juan Ixuatepec and Bhopal After each rehearsal or practice, plans should be reviewed to take account of any shortcomings highlighted by the exercises. In addition, its effectiveness should be reviewed every time it is used to deal with a real emergency. 5.3 Information to the public Any emergency planning depends for its success on an appropriate response from those covered by the plan, and this necessitates adequate briefing of those liable to be affected. Onsite personnel should receive this briefing (and training, as appropriate) as part of the preparation and realisation of an emergency plan. Off-site, however, such detailed briefing and preparation will rarely be possible. For this reason the UK CIMAH Regulations impose an additional duty to inform persons who are within an area that it is for the HSE to define (usually the land-use planning consultation distance). The minimum information to be given is: — that the hazardous installation is notifiable, and has been notified to HSE; — a description of the operations on site, and of the hazards and risks that might affect the recipient of the information; and

TECHNIQUES FOR EMERGENCY PLANS 205

— any emergency measures (including appropriate personal behaviour) to be taken in the event of an incident Methods of giving information will vary, as will frequency. Advance and regular information can be given to those resident or working in the area; those in control of public amenities can be similarly informed. However, transients may well receive the information only in an emergency situation. Adequate and relevant information is therefore a prerequisite for control and response in an emergency situation. 6 CONCLUSION The UK has set in place a system of major hazard controls which should help to prevent major accidents and minimise the effects of any that may occur. The controls are a combination of discrete but interdependent elements. On- and off-site emergency planning are essential parts of the overall system of control. REFERENCES 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14.

Advisory Committee on Major Hazards. Three Reports: 1976, 1979, 1984. HMSO. OJEC Directive No. 82/501/EEC CASSIDY, K.Hazardous installations and the law. Eurochem’ 86. I.Chem.E. Notification of Installations Handling Hazardous Substances Regulations 1982. HMSO. Control of Industrial Major Accident Hazard Regulations 1984. HMSO. Department of Environment Circular 9/84. HMSO. Town and Country Planning (General Development) and (Use Classes) (Amendment) Orders, 1984. Health and Safety at Work etc. Act 1974. HMSO. Housing and Planning Act 1986. HMSO. CIMAH Regulations 1984. Further guidance on emergency plans HS (G)25. HMSO. Recommended procedures for handling major emergencies (and supplement), 1977. CIA. General guidance on emergency planning within the CIMAH Regulations for chlorine installations 1986. CIA. Guide to Emergency Planning. SIESO, 1986. Hazardous Materials Emergency Planning Guide. National Response Team Report NRT, 1 March 1987.

206 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

15. 16. 17.

DAVIES, P.C. & PURDY, G.I. (1986). Toxic gas risk assessments: the effects of being indoors. Chem. Eng., January. PURDY, G. & DAVIES, P.C.Toxic gas incidents: some important considerations for emergency planning. I.Chem.E., 1986. A guide to the CIMAH Regulations 1984 HS(R)21. HMSO.

APPENDIX 1 Criteria Heat Blast Toxic

300 kJ/m2 (e.g. 30 kW/m2 for 10s): severe burns 200 kJ/m2: burns 2 psi (14 kN/m2): some severe injuries 1 psi (7 kN/m2): injuries; buildings repairable e.g. chlorine: 100ppm/10min: severe effects C1·667 /(min)=104 (Dicken ‘fatal’ level) C2·75 t=3·2×106 (HSE criterion)

Consultation distances For example:

TECHNIQUES FOR EMERGENCY PLANS 207

APPENDIX 2: FLAMMABLES (a) Criterion: effects of thermal radiation

For a few seconds exposure, 300 kJ/m2 is dangerous (e.g. 20 kW/ m2 for 15s) (b) Application: Basic assessment (LPG)

(c) Other variables Ignition may be immediate, delayed local, delayed remote, or none Immediate ignition Small leak Medium leak Vessel burst

Local fire: escalation hazard Jet, torch: immediate and escalation Fireball: immediate hazard (and domino effect)

208 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

(d) Examples (i) Fireball effects (propane)

(ii) Large cloud Ranges to LFL (m):

(iii) Vapour Cloud Explosion (VCE) Violent, large release; short delay to ignition; partial confinement: explosion

TECHNIQUES FOR EMERGENCY PLANS 209

(vi) VCE (Propane) For hydrocarbons: M(TNT)=M(half contents)×0·42 M(H/C)=2×flash fraction—vessels

(v) Other explosions Solids (ammonium nitrate, sodium chlorate, etc.): like TNT M(TNT)=(Expl) × Efficiency e.g. Sodium chlorate: Efficiency=(l/4)Ammonium nitrate=(1/8) TNT Blast: related to scaled range, i.e. distance/(m) 1/3) e.g. 50 te sodium chlorate gives 14kPa (severe damage) at 400 m 4000 te ammonium nitrate gives 80 kPa (devastation) at 300 m, 14 kPa at 850m (e) Mitigation? Escape Shelter

APPENDIX 3: TOXICS (a) Criterion: Chlorine toxicity Immediately fatal, 500 ppm Very quickly fatal, 300 ppm Fatal cnt=A (or probit)

210 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

(b) Application: Basic assessment (chlorine)

(c) Mitigation? Shelter Escape Wind direction

(d) Other substances

25 Decision Support Systems for Emergency Management V.ANDERSEN & J.RASMUSSEN Risø National Laboratory, 4000 Roskilde, Denmark

1 INTRODUCTION The current trend in the industrial development is towards large, centralized production units, and consequently there is an increasing potential for severe accidents. This in turn creates an increasing demand on methods for systematic risk analysis and, in the case of release of the accident potential, means for effective emergency management. At the same time, there is a dramatic development within electronic information technology and, quite naturally, widespread efforts to exploit this technology in the design of systems for support of systematic risk analysis, decision support systems for operating crews during plant disturbances and accident control, and for support of the general emergency management organization. 2 REVIEW OF THE STATE OF THE ART OF DECISION SUPPORT SYSTEMS As a basis for discussing the use of information technology in support of emergency management, we will briefly view the general development of decision support systems. 2.1 Management information and decision support systems Development of managerial decision support systems has been pursued separately in two schools, one based on a management science perspective, focusing on the formulation of rational, normative decision making strategies based on objective economic

212 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

analysis of the problem domain, another based on a social science perspective and focusing on the social system and considering the roles and needs of the people in the system. The two approaches, considering what are generally labelled ‘management information systems’ and ‘decision support systems’, respectively, have been considered alternative paths to a solution, an attitude which has caused considerable controversy. However, due to increasing understanding of the cognitive aspects of decision making, a more integrated view of the system has recently been evolving. These lines of development will be briefly reviewed. Management science approach. A major class of proposals for decision support systems has been based on decision making research rooted in economic theories, in particular the expected utility theory developed by economists and mathematicians. The approach focuses on decision making from a prescriptive point of view only. It is a logical structure for decisions and makes no claim that it represents or describes the information processing of human decision makers. The emphasis is not on what they do, but on what they should do. A general criticism of this approach has been that the formal models based on economic or decision theories fail to appreciate the complexity of the challenges under which real-world decision makers must operate. Critics of decision theory also argue that it is not useful as a guide because human beings do not behave in accordance with the fundamental assumptions of the theory. Social science approach. Whereas the management science approach is focused on the problem characteristics, the perspective of the social science is primarily concerned with the characteristics of the decision makers and their social roles. This means that there will be no formal basis for evaluating the performance of such a system; the only basis for judgement will be user-acceptance, and there will be no structured way to plan a functional system design, which therefore will be based on bottomup integration of the requirements of the individual activities. System science approach. Recently, a more integrated, top-down approach to the design of management decision support systems has been taken by system scientists. An illustrative example is the discussion presented by Sutherland [1]. He compares the approaches taken by the two schools based upon management science and social science, respectively. His conclusion is that both approaches are too schematic and drawn to unacceptable extremes, and that a more balanced view should be taken. His discussions relate to business decision making, but the conclusions are well related in the present context. In doing so it

TECHNIQUES FOR EMERGENCY PLANS 213

is necessary to take into consideration that decision making in the different levels of organization cannot be covered by one theoretical model, and will require different tools for effective support Four levels of decision types are identified and correlated with decision processes and support models: (1) Goal programming and long range planning at the highest level are related to the sequential state model for heuristic problem solving procedures or structured decision making procedures. Support in this function is essential for executives who are responsible for development of the policy over the long run. (2) Strategic analysis at the next lower level includes contingency planning related to stochastic-state techniques to provide for deductive techniques for problems the ‘state’ outcomes of which are variable, such as game-theoretic models or logical analysis programs. This technique underlies most classic military contingency planning. (3) The tactical programming, one level further down, includes ‘equilibrium maintenance’ mainly based on statistics-based decision and control instruments for dealing with probabilistic problems, such as econometric methods, parametric decision theory, etc. (4) The lowest levels concerned with the operations management, based on discrete-state instruments which are primarily algorithmic and analytical methods that allow optimal solutions of deterministic problems. This is the domain of methods of industrial engineering and operations research. The basic idea of this system theoretic approach is that any properly conceived management support system should include tools for all of these levels. This is so, whether or not it is requested by the existing management authorities. Sutherland emphasizes the need for a structured design methodology: 1. The first step is to identify ‘a population of decision requirements that is derived by examining organizations in aggregate in terms of universalistic (e.g. ideal-type or categorical) as well as context specific properties’. 2. The next step is an attempt to reduce a population of functionally abstracted decision requirements to their most fundamental constituents, i.e. to decompose into elementary operations or primitives. 3. Then the set of all primitives is reduced into a prime set, in order to remove redundancies. 4. Given this prime set, attention shifts to the instrumental capabilities they imply in terms of a collection of decision aids. All

214 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

integral decision aids or model base components are now decomposed into their lowest order transformational components— the microfunctions which are the basic elements of ‘any structured model-base’. 5. Now a prime set of system facilities is generated, to have a mutually exclusive set which in aggregate should be able to perform all the functions associated with the set of decision aids from which they were derived. 6. Any of the higher-order decision requirements should thus be able to be met by synthesizing in effective real-time the functions pertinent to the integral decision aid. The prerequisite for this concept will be that the analytical procedures or techniques underlying a support system are congruent with the nature of the problem at hand. Therefore the tools for the different levels in an organization will be different. This congruence is discussed with reference to a generic problem/ instrument domain. Four levels of problems are considered: deterministic, probabilistic, equifinal, and indeterminate problems. Also four instrument categories are used: discrete state (operations research, industrial engineering, or AI algorithms), finite state (statistical decision theory, correlation, regression), stochastic state (contingency planning), and sequential state. Optimal tools are then to be found in the diagonal of the representation, while choice outside the diagonal will be either ineffective (insufficient) or inefficient (too sophisticated) for the purpose. The rationale for this solution will be to ensure that organizational decision problems get all the precision and discipline they deserve, but no more. 2.2 Expert systems: artificial intelligence approaches While the approaches to decision support systems mentioned above are predominantly problem driven, the solutions based on artificial intelligence approaches are by nature tool driven. Expert systems. In the present context the term ‘expert system’ is used in the ‘classical’ sense to characterize a decision support system based on heuristic rules derived from experts and intended to support a well defined decision maker having a uniform set of decision tasks within a bounded information context.

TECHNIQUES FOR EMERGENCY PLANS 215

Recent reviews of the historical development of expert systems [2] focus on expert systems for application in domains of very uniform characteristics, such as: — Dendral: for analysing mass spectroscopic, nuclear magnetic resonance, and other such data to infer molecular structures — Mycin: for medical diagnosis of infectious blood disease — Expert, Caduceus: for other domains of medical diagnosis — Prospector: for geologic survey support, etc. The present expert systems are laboratory ‘demonstration’ systems, of which only few are in actual, serious use. In order to be accepted by a user, advice from an expert system in a risky decision context will require a more elaborate explanation capability than is presently available (see, for instance, Rasmussen and Goodstein [3]. Likewise, Hayes-Roth et al. [2] have formulated that today’s expert systems typically show up badly when measuring along a number of dimensions: — They are unable to recognize or deal with problems for which their own knowledge is inapplicable or insufficient. — They have no independent means of checking whether their conclusions are reasonable. — Explanation of their reasoning process is frequently silent on fundamental issues. From this review, use of ‘expert systems’ for support of the decision making process ‘on-line’ seems to be premature. However, AI tools for organization of the distributed data base available to emergency management may be feasible. Other artificial intelligence approaches. More differentiated approaches have been taken to the design of decision support systems, when AI techniques have been considered tools in a design effort based on analysis of the problem requirements. A system oriented approach to design of a system for support of distributed decision making, based on the tools made available by artificial intelligence research, has been proposed by Thorndyke [4]. This proposal will be reviewed in some detail because distributed problem solving appears to be an important feature of emergency management. Thorndyke describes a system for model-based situation assessment and planning based on expert system architecture. Applications are described for military strategic planning, air traffic control, as well as location and identification of hazardous

216 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

chemical spills. To model the organization of time stressed situation analysis and planning, the ‘cooperating experts paradigm’ is used. For the organization of these activities the Hearsay-II paradigm is used [5]. A number of experts are organized around a common data base, the ‘world model’: a sensor, a plan generator, an evaluator, a communicator, and a controller. The conclusion of this review is that the structure offered by the Hearsay system concept for communication and coordination in a distributed group of decision makers appears to match the needs for data base support in emergency management, and should be considered in more detail for future developments. 2.3 Decision support in emergency management The present problem of information systems for emergency management appears to be characteristic in the following respects: — The problem domain is poorly denned. The system should support decision making related to a large variety of emergencies, caused by very different physical processes. The resources to consider in emergency control may belong to different technical service fields. — The decision maker(s) are difficult to identify in advance, being dependent on the size and nature of the actual case. — Several organizations and technical services may be involved, and decision making will have the nature of a cooperative effort in a distributed system. — Support from the system may be relevant during dynamic emergency situations, as well as for planning purposes. — The information needed for decisions may stem from a large variety of sources, such as engineering textbooks, laws and regulations, risk analysis, analysis of prior accidents, procedures, and instructions. Key problems for system development will therefore be to consider: — Organization of large, inhomogeneous data bases, information retrieval, requirements for analysis supplying data in order to have proper data attributes and formats compatible with user needs

TECHNIQUES FOR EMERGENCY PLANS 217

— Analysis of the organization of the cooperative decision making, and the structure of the communication network involved — The nature, in general terms (covering typical situation scenarios), of the control and decision task, and the related information needs At present it appears very plausible that a coordinated data base and a consistent specification of the information needs of the various decision makers, as well as of the requirement for the information formats used by the information sources, will be an important area of development for advanced information technology. 3 A FRAMEWORK FOR ANALYSIS AND DESIGN OF DECISION SUPPORT SYSTEMS In consequence of the discussion in the previous section, the approach to the design of a decision support system based on new technology should be taken from a cognitive point of view, and should include an analysis of the decision task and the information processing requirements in terms referring to human cognitive functions. In general, when designing systems for support of decision making, the problem is to design systems which are also effective during situations which have not been foreseen during design, and which are not familiar to the user. For design it is necessary to structure the great variety of real life work conditions into domains which correspond to design decisions. By use of a multi-facet description system it is possible to represent a great variety of conditions by a rather low number of categories in each domain, related to general features. From this point of view, the following dimensions of a conceptual framework for description of a cognitive task have proved useful for the analysis of cognitive tasks, and hence for design of decision support systems. The problem domain. The first domain of an analysis which will serve to bridge the gap between the purely technical description of the work content and the psychological analysis of user resources should represent the functional properties of the system in a way which makes it possible to identify the control requirements of the system underlying the supervisory task. This is an analysis in technical systems terms and will result in a systematic and consistent representation of the problem space.

218 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Since decision making in emergency management, as in many other contexts, is a resource management problem, an appropriate representation of the problem space should reflect the varying span of attention in the part/whole dimension, and the varying level of abstraction in the means/and dimension. Change in representation along both dimensions is normally used by decision makers in order to cope with the complexity of a decision task [6, 7]. The decision sequence. The next domain of analysis to consider is related to the decision process which has to be applied for operation upon the problem space. It is generally accepted that the decision process can be structured into a fairly small number of typical decision processes representing the various phases of problem analysis and diagnosis, evaluation and choice of goal priority, planning of resources and, finally, execution and monitoring. Mental strategies and heuristics. An analysis in this problem domain can serve to identify the information processing strategies which are effective for the different phases of the decision sequence in order to identify the required data, control structures, and processing capacities. It is generally found that a given cognitive task can be solved by several different strategies varying widely in their requirements as to the kind of mental model and the type or amount of observations required. Cognitive control domain. While the information content should be included in the messages from a decision support system from an analysis of problem space and mental strategies, the form of the displays should be selected from consideration of human cognitive control mechanisms. 4 IMPLEMENTATION FOR EMERGENCY MANAGEMENT SUPPORT It follows from the preceding section that the most important domain of analysis for emergency management will be the problem domain and the decision task, including the role and cooperation of several decision makers.

TECHNIQUES FOR EMERGENCY PLANS 219

4.1 Problem domain The first aspect to consider will be the problem domain, i.e. the representation of the relationships controlling the state of affairs in the emergency management context. Emergency management can be considered a resource management problem in a means-end hierarchy representing the functional properties of the environment. In this hierarchy, these properties are represented by concepts which belong to several levels of abstraction. The lowest level of abstraction represents only the physical form of the system, its material configuration. The next higher level represents the physical processes or functions of the various components and systems in a language related to their specific electrical, chemical, or mechanical properties. Above this, the functional properties are represented in more general concepts without reference to the physical process or equipment by which the functions are implemented, and so forth. At the lower levels, elements in the process description match the component configuration of the physical implementation. When moving from one level of abstraction to the next higher level, the change in system properties represented is not merely removal of details of information on the physical or material properties. More fundamentally, information is added on higher level principles governing the cofunction of the various functions or elements at the lower level. In man-made systems these higher level principles are naturally derived from the purpose of the system, i.e. from the reasons for the configurations at the level considered. Change of level of abstraction involves a shift in concepts and structure for representation, as well as a change in the information suitable to characterize the state of the function or operation at the various levels of abstraction. Thus an observer asks different questions to the environment depending on the nature of the currently active internal representation. In other words, models at low levels of abstraction are related to a specific physical world which can serve several purposes or violate different goals. Models at higher levels of abstraction are closely related to a specific purpose which can be met by several physical arrangements. Therefore shifts in the level of abstraction can be used to change the direction of paths, suitable for transfer

FIG. 1. Domain of potential risk.

220 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 2. Domain of emergency management resources.

TECHNIQUES FOR EMERGENCY PLANS 221

222 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

of knowledge from previous cases and problems. For the emergency management systems, the information related to the decision space will be discussed for two separate categories, the domain of the potential risk, and the domain of mitigation resources. 4.2 Domain of potential risk This part of the representation includes information identifying the potential risk sources, their functional physical properties making it possible to predict the accidental propagation of effects of accident releasing mechanisms, and the possible higher level consequences in relation to social norms and legal rules. This part of the data base will supply the basis for the analytical part of the representation, and the information will be available from risk analysis, technical manuals, and analysis of the technical features of prior cases. Examples of the information at the various levels may be seen in Fig. 1. 4.3 Mitigation resource domain This domain includes the information about functions, processes, and equipment/personnel which is available to form the counteracting and mitigating force. It represents the problem space for the planning part of the representation. The information included at the various levels can, for instance, be as shown in Fig. 2. 4.4 Use of problem representation This representation of the problem space will be a multi-level representation in terms of available/required equipment-processfunction-purpose elements, and decision making in a specific situation will be a resource management task aiming at a proper relationship in the potential many-to-many mapping between the levels. A property of the total emergency management system considered at an individual level can be characterized in three different ways: (1) ‘what’ it is, i.e. its causal properties in interactions at that particular level; (2) ‘why’ it may be chosen, i.e. its role at the next higher level; and (3) ‘how’ it may be implemented by resources at the next lower level. This means that

TECHNIQUES FOR EMERGENCY PLANS 223

the data element in a data base should be characterized from at least three different points of view. Decision making in a particular situation will be an iterative consideration of the resources at the various levels until a satisfactory relationship through the levels has been identified, connecting the various, possibly conflicting, goals and constraints with the available physical resources. This will involve the task of keeping track of a many-to-many mapping in a complex net, and the use of information technology should be considered not only for advice giving to the expert system, but also for support of the decision process itself (for instance by alerting the user to consider other relevant means-end mappings than the one behind an actual information request). The nature and the related sources of information to be included in a data base should be specified for each of the cells in the domain abstraction/decomposition matrix (Figs 3 and 4). The form in which the information should be stored in the data base depends entirely upon the users’ formulation of their problems and needs (cf. Pejtersen’s work on information retrieval in libraries [8]). This, in turn, depends on the identity of the actual decision maker, and the boundaries of his information needs in terms of location in the problem space chart (see Fig. 5), as well as upon the hierarchical structure of the operating organization. The data base representing the problem domain in terms of risk potential and emergency management resources will include structural information about functional properties and causal relationships which must be transformed into procedural information in order to be operational in the actual accident situation. This transformation can be based on heuristics derived from prior experience or deductions based on state information from the case actually present. If procedural transformations are incorporated in the data base, it will have to be rather general rules, unless very specifie information can be supplied. If the procedural information has to be generated on-site, it will either have to be done by the decision maker himself, or information on the actual state of affairs will have to be transmitted to the advisor in possession of the necessary general background knowledge or the intermediary working on the available data bases (see Fig. 6). This advisor can be a human domain expert or an ‘expert system inference machine’ attached to the data base.

FIG. 3. Information sources; domain of potential risk.

224 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Fig. 4. Information sources; domain of emergency management resources.

TECHNIQUES FOR EMERGENCY PLANS 225

FIG. 5. Information users; domain of emergency management resources.

226 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

TECHNIQUES FOR EMERGENCY PLANS 227

FIG. 6. Problem domain in emergency management.

The conclusion of this preliminary analysis is that the meansend hierarchy is well suited to structure the information content of the data base which is underlying emergency management decisions, during preplanning as well as during the actual situations. Thus structured, it will be possible in a consistent way to identify the proper search terms to use for retrieval design, and to specify the format in which information should be supplied by

228 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

the numerous data sources, such as risk analysis, incident analysis, plant design, operations planning, and inspections. 5 EMERGENCY MANAGEMENT IN NUCLEAR AND NON-NUCLEAR INDUSTRIES The problems involved in industrial emergency management appear to fall into two rather distinct groups. One group includes the rather frequent, smaller scale accidents related to fires, toxic spills, etc. The emergency management organization is established ad hoc, and must be able to cope with a wide variety of accidents. The other group includes emergency management related to accidents in hazardous industrial installations for which emergency organizations have been carefully planned and for which risk analysis typically has been made. Nuclear power installations are typical for this category. Figure 7 shows a schematic representation of different types of emergency situations, where the focus of optimal support for a given situation is found in the diagonal of the representation. Outside the diagonal the task will be either insufficient or ineffective. Most non-nuclear emergency situations will be located in the upper left of the diagram, while most nuclear power-plant emergency situations will be located in the lower right of the diagram. A decision support system for the latter is being developed as a joint Nordic programme NKA/INF, where a top-down approach has been taken by analysing the requirements needed to satisfy the specified goals for an emergency management system. A short description of the content and status of this programme will now be given. 5.1 NKA/INF project content The basis for the study of the potential use of advanced information technology for accident and emergency management was established in a pilot project undertaken in 1985. The subjects addressed in this project led to a preliminary description of accident and emergency scenarios [9], a state-of-the-art review of models and methods available for construction of a conceptual system [10], and a review of available tools from artificial intelligence, e.g. expert systems [11]. The programme, at present, has two lines of development. One is to analyse the present emergency management organizations

TECHNIQUES FOR EMERGENCY PLANS 229

FIG. 7. Different types of emergency situation.

and procedures, to evaluate the problems perceived and the possibility of remedy by means of modern information technology. Another, concurrent line of approach has been to establish models of the distributed decision making involved in operations like emergency management, in order to evaluate whether advanced information technology will influence the effective way of organizing. The approach taken to such a model may be to consider decision making a control task involving a number of decision makers each controlling only part of a loosely coupled problem space. For concerted activity communication between the decision makers is necessary. The programme consists of five main activities: (1) The study and detailed analysis of accident and emergency scenarios based on records from incidents and drills in nuclear installations (2) Development of a conceptual understanding of accident and emergency management with emphasis on distributed decision making, information flow, and control structures that are involved (3) Development of a general experimental methodology for evaluating the effects of different kinds of decision aids and forms of organization for emergency management systems with distributed decision making

230 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

(4) Development and test of a prototype system for a limited part of an accident and emergency organization to demonstrate the potential use of computer and communication systems, data base and knowledge base technology, and applications of expert systems and methods from artificial intelligence (5) Production of guidelines for the introduction of advanced information technology in the organizations based on evaluation and validation of the prototype system. In an early stage of the project a limited target area must be defined. Based on the scenario descriptions, a ‘vertical slice’ is identified dependent primarily on two criteria: it must be able to display the major features of the conceptual system, and it must be limited to the extent where the prototype development is possible using the available resources. In the later phases of the project the scenario descriptions will gradually change to data and knowledge acquisition, and the conceptual work will be followed by development of a general experimental methodology and by experimental work using the prototype as test bed. The prototype system will experience a dynamic development throughout the major part of the project. The keyword for the project is system studies with emphasis on system integration. This will be reflected in the recommendations and guidelines developed in the final phase of the project. 5.2 Status of the NKA/INF programme The programme has developed conceptually, in data acquisition and specification of data and knowledge base, and in prototype implementation, but in the present context only the status of the conceptual work will be described. Conceptual work. The general point of departure for the conceptual work has been to design a framework for analysing different kinds of emergencies. In the first stage, we have been concerned with the problems of hierarchical organizations in emergency management. Such organizations were found to present problems under certain conditions because [12]: — all kinds of emergencies cannot be foreseen, and this may create a need for a more flexible structure with the capacity to reconfigure itself;

TECHNIQUES FOR EMERGENCY PLANS 231

— information delays would make it hard to exercise control by means of a hierarchical system that would be too slow; — some aspects of emergency management cannot be modelled hierarchically but require a different control structure; and — hierarchical command and control systems are not needed for all kinds of emergencies. In the second stage, we have tried to create a general framework for analysing emergency management based on the view of emergency management as a control system, which [13]: — provides a clear specification of the goals of an emergency management system; — provides a specification of what the components of such a system should be; — specifies the information needs; and — specifies what can, and what cannot, be controlled in emergency management. Further work is now directed towards solving two problems: 1. To develop a conceptual framework for those aspects of emergency management that cannot be controlled hierarchically. The problems here are those of coordination in a system characterized by distributed decision making. 2. Using the time-area diagrams developed as part of the analysis of emergency management as a control system to analyse a variety of emergencies. This is done in an attempt to test the general usefulness of these diagrams as an analytical tool for analysing information needs in emergency management. In addition, some first thoughts on how the decision support system should be evaluated have been looked into. Here a distinction between two forms of evaluation has been discussed: analytical evaluation and empirical evaluation. It is recommended that an analytical evaluation be performed first. This comprises two steps: — Mapping the decision support system onto a set of general decision tasks — Assessing the extent to which these tasks are supported by analysing (a) the nature of the situation, (b) the kind of displays that are provided, and (c) the knowledge required for understanding these displays

232 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

It is also recommended that the empirical evaluation be directed towards limited and well defined functions of the decision support system. DESSY-D, a general interactive program for simulating dynamic systems, is being developed for this purpose in Uppsala. The methodological problems in using this system for the evaluation of a decision support system are now being analysed. 6 CONCLUSIONS AND RECOMMENDATIONS The conclusion of the present feasibility study will be that the recent development of advanced information technology, together with the trend towards more cognitively oriented approaches to studies of decision making, offer promising lines of development of improved tools for emergency management. Such improvements will be necessary in order to cope with the increasing potential for unacceptable consequences of accidents which is the result of industrial centralization together with the widespread use of hazardous substances. In addition, a reconsideration of the information basis of emergency management will be relevant now because much information of great importance for emergency management will be generated or collected from activities such as systematic risk analysis, safety inspections, quality assurance programmes, etc. REFERENCES 1.

2. 3.

4. 5.

6.

SUTHERLAND, J.W. (1983). Normative predicates of next generation management support systems. IEEE Trans. Syst. Man. Cybern., 13 (3), 279–97. HAYES-ROTH, F., WATERMAN, D. & LENAT, D. (1983). Building Expert Systems, Addison-Wesley, Reading, MA. Rasmussen, J. & GOODSTEIN, L.P. (1985). Decision support in supervisory control. 2ndIFAC/IFIP/IFORS/IEA Conf, on Analysis, Design, and Evaluation of M an-Machine Systems, Varese, Italy, 10– 12 September. THORNDYKE, P.W. (1982). A Rule-based Approach to Cognitive Modelling of Real-Time Decision Making, ORNL/TM-8614. Erman, L.F., HAYES-ROTH, V., LESSER, V. & REDDY, D. (1980). The Hearsay-II speech understanding system: integrating knowledge to reduce uncertainty. Computing Surveys, June, 213–52. RASMUSSEN, J. (1985). The role of hierarchical knowledge representation in decision making and system management. IEEE Trans. Syst. Man. Cybern., 15(2), 234–43.

TECHNIQUES FOR EMERGENCY PLANS 233

7.

8.

9.

10. 11.

12. 13.

RASMUSSEN, J. (1985). A Framework for Cognitive Task Analysis, Risø-M-2519. Also in: Hollnagel, E., Mancini, G. & Woods, D. (Eds), Intelligent Decision Support Systems in Process Environment, Springer Verlag, Berlin, in press. PEJTERSEN, A.M. (1980). Design of a classification scheme for fiction based on an analysis of actual user-libarian communications, and use of the scheme for control of librarians’ search strategies. In Theory and Application of Information Research, O.Harboe & L.Kajberg (Eds), Mansell, London, pp. 146–59. JOHANSSON, R., ANDERSSON, H. & HOLMSTROM, C. (1986). A Descriptive Analysis of the Management of Nuclear Power Plant Emergencies, Studsvik Technical Note NI-86/7. RASMUSSEN, J. (1986). A Cognitive Engineering Approach to the Modelling of Decision Making and Its Organization, Risø-M-2589. BERG, Ø. & YOKOBAYASHI, M. (1985). Review of Expert System Techniques Relevance to Computerised Support Systems in Emergency Management, Institutt for Energiteknikk, INF-630(85)1. BREHMER, B. (1986). Organization for decision making in complex systems. Unpublished note. BREHMER, B. (1987). Emergency management as a control system. Unpublished note.

SESSION V Lessons Learnt from Emergency Management of Major Incidents Chairmen: M.VASSILOPOULOS Ministry of the Environment, Greece U.POLI Istituto Superiore per la Prevenzione e la Sicurezza del lavoro, Italy Rapporteur: E.L.QUARANTELLI Disaster Research Center. USA

26 Experience Gained from Recent Major Accidents in the Federal Republic of Germany STEPHAN NEUHOFF Berufsfeuerwehr Köln/Cologne Fire Brigade, Cologne, FRG 1 FIRE IN THE CHEMICAL FACTORY KALK IN COLOGNE On 8 September 1982 at 11.02 a.m. the factory fire brigade of the Chemical Factory Kalk (CFK) notified the professional fire brigade in Cologne by radio of a fire in the factory. The CFK is a chemical factory which produces and stores nitrogencontaining fertilizers. Several smaller plants also produce organic and inorganic bromine compounds. The factory is located in the central city area in the direct vicinity of residential areas. The bromine plant No. II is a steel-framed skeleton structure with thin asbestos-cement walls. It covers an area of 450 m2 and is 15 m high. It contains apparatus for producing brominecontaining flame-protecting substances for plastics. Methanol and other alcohols are used as cleaning fluids. During the refilling of a 2000 litre plastic container, about 150 litres of methanol leaked from a faulty pipeline. The methanol, which is electrically conductive, caused the generation of sparks on an electricity cable which led to an ignition process. The fire rapidly spread through the entire production plant and threatened a neighbouring storage area with barrels of solvents and other chemicals as well as an additional production plant. The professional fire brigade and the CFK factory fire brigade, comprising a total of 109 firemen, used 6 water cannon and 5 lines to restrict the fire to the bromine plant and to extinguish it after 2 hours. Dense smoke moved over the neighbouring residential areas. The area was closed off by the police. Radio broadcasts were used to request that civilians remain inside and close all windows and

236 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

doors. As bromine in the smoke was suspected, an evacuation seemed to be necessary. A meeting of the Disaster Prevention Management, directed by the town clerk, was held in order to prepare first measures. Measurements then indicated however, that no halogens were present in the smoke. The bromine plant was completely destroyed. The damage was estimated at approximately 20 million DM. The plant was not rebuilt. The following conclusions were arrived at: 1. The plant had been approved 6 months before the incident. The plastic container, however, was not approved. 2. Cooperation between the professional fire brigade and the CFK was excellent. A definite advantage was the fact that a joint exercise had been held in the factory area 5 months before the incident, in which a similar scenario had been assumed. 3. The police as well as the fire brigade had set up separate onsite Technical Operation Management Groups. As liaison officers were not exchanged immediately, an optimum coordination of the protection measures was not possible. In future a joint command centre should be established. 4. Measurements and analyses were made by the fire brigade, the industrial inspection board and by the factory. There was no centralized control and evaluation of the measurements. 2 LEAKAGE FROM AN LPG TANK IN WILHELMSHAVEN On 23 January 1985 a gas tank in the Mobil Oil AG refinery in Wilhelmshaven was being filled with pressurized liquified butane. During the filling procedure it was noticed that liquified gas was being emitted at the top of a support brace and a visible cloud drifted past several other storage tanks towards a nearby river. The spherical tank had been constructed in 1975. Its diameter was 19m and its volume was 3500 m3. The authorized operating pressure was 6·6 bar. The wall of the container was 18 mm thick in the support brace area. The construction of the tank was officially supervised. It was then subjected to construction and pressure tests as well as a final acceptance test. External inspections were made every 2 years. The

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 237

inside of the tank was inspected every 3 months by refinery personnel. No faults were detected. The refinery area was closed off immediately. Shipping movements on the river were also stopped. The liquified gas was pumped into a nearby tank. Fortunately ignition of the gas did not occur. The incident was caused by a crack in the tank. During the construction of the tank, the tops of the hollow support braces were at first covered by welding on a cover sheet, in order to prevent rainwater from entering the support brace. This cover sheet was also welded directly onto the spherical tank. This however, led to strong tensions so that the welded joint was separated again. Instead of being welded, the cover was bolted on with clamps, and a rubber gasket was inserted between the cover sheet and the support braces. This gasket obviously did not seal properly and rainwater entered the support braces. Due to a separating sheet inside the support braces, 1 m3 of water was sufficient to fill the tops of the support braces. This water then froze during a frost period. The pressure of the ice pushed in the tank wall at the tops of the support braces. At one of the tops an 860 mm long and up to 15 mm wide crack was formed. The crack was not noticed earlier due to the intense cold in January. The pressure in the tank was only slightly higher than atmospheric pressure. Gas was only emitted when the tank was filled with liquified gas. The incident could have been avoided by drilling holes in the separating sheets and in the lower ends of the support braces, in order to let trapped rainwater flow out. 3 EXPLOSION IN THE RHEINISCHE OLEFINWERKE IN COLOGNE On 18 January 1985 at 15.47 hours (3.47p.m.) the control centre of the professional fire brigade was notified that an explosion had occurred in the southern area of the city. At first it was assumed that a tanker had exploded and caught fire in the harbour. The control centre sent several fire-fighting vehicles to the harbour. Telephone calls to a refinery and investigations from a helicopter led to the conclusion that a fire was burning at the Rheinische Olefinwerde (ROW). At 16.07 hours (4.07 p.m.), 26 minutes after the explosion, the ROW finally called to report the explosion.

238 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The ROW is a large chemical factory, which uses the products of a nearby refinery to produce ethylene and plastics such as polyethylene and polypropylene. The accident occurred in the distillation section of an ethylene plant; 4t of propylene leaked from a cracked pipe. The gas emission was registered by the gas warning system, but the immediate emergency shut-down of the entire plant could not prevent the ignition of the gas cloud by a heater. The pressure wave caused extensive damage and several fires started in the plant. In the area surrounding the factory, windows were destroyed up to 9km away, 43 employees were injured by splinters, but in a nearby residential area only one person was slightly injured. The ROW factory fire brigade and the professional fire brigade, with a total of 104 firemen, used 24 water cannon and up to 60000 litres of water per minute to cool the plant. The fire could not be extinguished completely. Remaining gas was allowed to burn itself out. The fire brigade operation was only completed 9 days later. The plant has since been rebuilt. The damage amounted to 100 million DM. The gas had escaped through a crack in a 100mm diameter pipe. During the investigations an identical pipe was filled with water and cooled. The ice which formed did not lead to any cracks in the pipe. Only after a second test with the same pipe did it crack due to being over-stressed in the first test. Before the accident it had been generally accepted that the propylene did not contain any water. The investigations, however, revealed a water content of 1 ppm. At a production rate of 130 000t per year, 70 litres of water accumulated in the pipe. Two periods of severe frost during the winter of 1984/1985 then caused the damage. The following conclusions were drawn: 1. The ROW took much too long to report the accident. After this incident the city of Cologne reached an agreement with 7 chemical factories, with the aim of much quicker reporting of fires and accidents. 2. The extensive water supply network with 257 installed water cannon permitted rapid cooling of the plant. 3. A world-wide investigation of comparable plants was undertaken to check for possible water accumulation in lowlying pipeline sections. 4. The suspended ceiling in the plant control station collapsed. However, it was still possible to shut down the plant. Special

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 239

explosion protection measures were included in the new control station. 5. A safety analysis was undertaken during the reconstruction of the plant. The factory concluded that the worst possible damage was the failure of a support brace which would result in a 2 m long flame. 4 LEAKAGE FROM A LIQUIFIED GAS TANKER IN DIELHEIM The village of Balzfeld with a population of approximately 1000 is part of the municipality of Dielheim. On 23 December 1986, at 13. 52 hours (1.52 p.m.) a slight east wind was blowing, it was snowing, and the temperature was approximately 0°C. At the edge of the village, but still surrounded by houses, the driver of a liquified gas tanker truck was filling a fixed liquified gas tank. The vehicle contained 4–81 of propane. When the truckmounted pump was switched on, the drive shaft to the secondary drive came loose and damaged the connecting pipe between the tank and the pump. The propane which was pressurized at 9–5 bar immediately started escaping through the leak. The gas cloud spread out and was visible as a 1 m thick fog which covered an area of 500m2. The truck driver, with great presence of mind, immediately switched off the engine and called the fire brigade. The operations chief of the fire brigade immediately evacuated the nearby houses and had the central heating systems switched off. Dut to the dense fog and ice formation, it was at first difficult to determine the exact position of the leak, and it could not be sealed. An attempt to seal the leak by spraying water on it failed due to the high pressure. The danger of igniting the gas stopped any attempt to tow the truck out of the village. Finally a water curtain from 4 lines was used to push the gas cloud into a low-lying field. The sewage system was flushed with large amounts of water. In the meantime the entire electricity supply to the village had been cut off by the electric supply company. This also resulted in a shut-down of the water supply system, so that water had to be transported by fire brigade tank trucks. After 1 hour the gas concentration in the centre of the village dropped to values below the detection limit. In the field into which the gas had been moved, the lower explosion limit could only be measured at a distance of 60m from the tank truck.

240 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

As soon as the over-pressure in the tank truck had disappeared, the tank was flushed with nitrogen until gas could no longer be detected at the leak. Measurements were then made in all nearby houses. The highest value reached only 10% of the lower explosion limit. Flushing the air in the houses was therefore felt to be unnecessary and the inhabitants could return to their homes. A total of 4·8 t of propane, approximately 2400 m3, had escaped without being ignited. A different pipe location, a stronger pipe, or some type of protection for the pipe between the tank and the pump could have prevented the incident. 5 LIQUIFIED GAS EXPLOSION IN A HOTEL IN GARMISCH-PARTENKIRCHEN The Hotel Riessersee with 350 beds had been opened in May 1985. For environmental protection reasons it was heated with liquified gas which was stored in a covered underground pressure tank. The tank contained 64·1 m3 and was constructed for a permitted filling of 85% at an operating pressure of 15·6 bar. The lower part of the tank could be heated by a warm water pipe system. Two over-pressure safety valves were installed on the tank. Three pipes, the gas pipe and the inlet and outlet pipe for the warm water heating system, connected the gas tank with the heating apparatus in the heater room in the cellar of the hotel. The tank heating system was constructed as a closed secondary system. The tank heater was regulated by a pressure controller which switched off the pump for the warm water cycle as soon as the tank reached an over-pressure value of 4 bar. At 15.45 hours (3.45 p.m.) on 27 December 1986 the safety valve on the gas tank, which was 54% full, opened and large amounts of liquified gas escaped. A strong smell of gas was reported to the hotel reception and the hotel personnel tried to evacuate the hotel. At 16.00 hours (4.00 p.m.) ignition occurred. The police and the fire brigade had not yet arrived at this time. Gas had invaded both underground floors through windows and ventilation openings. Most of the damage occurred in the fitness centre (sauna, squash courts, swimming pool), in the heating room and in the underground garage. The pressure shock wave caused extensive damage to the exterior of the three-storey hotel and to nearby buildings.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 241

Seven people were killed instantly in the fitness centre, and 4 died during the following days. Eight people were injured. The explosion had ignited the gas escaping from the safety valve. The public prosecutor prohibited any alterations to the system. The dome shaft was therefore flooded in order to cool the fittings. The gas was left to burn for 4 days. The remaining liquefied gas was then pumped out by a tank truck. The investigation of the heating system for the tank showed that the pump for the warm water cycle could be controlled either automatically or manually. When the system was operating automatically the pressure controller on the tank was switched on and controlled the pump. During manual operation, however, the pressure controller was switched off. The warm water could continue heating up the gas tank until the safety valve opened and gas escaped. After this accident a special investigation was undertaken in Bavaria. Only 56 out of a total of 40 000 liquefied gas tanks were heated with warm water. Six tanks had exactly the same configuration as the one in Garmish-Partenkirchen. An additional 26 tanks were found to have either no pressure limiter or no temperature limiter. A total of 23 heating systems were shut down immediately. There is no technical need for a heating system for liquefied gas tanks, as increased amounts of gas can be removed through an evaporator. A total ban of heating systems on liquefied gas tanks is therefore being considered.

27 Community and Organizational Preparations for and Responses to Acute Chemical Emergencies and Disasters in the United States: Research Findings and Their Wider Applicability E.L.QUARANTELLI Disaster Research Center; University of Delaware, Newark, Delaware, USA 1 INTRODUCTION There appears to be general agreement that the number of accidents, disasters and catastrophes involving dangerous chemicals has been increasing in the last decade or so. The Bhopal, India, incident was a public manifestation of what many observers have known has been a growing increase of problematical risky events in the chemical area. Considerable technical research has been undertaken on the handling of hazardous chemical occasions. However, little attention has been given to the behavioral features of the problem, i.e. the human and group aspects. To begin to close this gap in knowledge, the Disaster Research Centre (DRC) in 1977 began a 4year study of socio-behavioral preparations for and managing of chemical disasters. This study was the first systematic and largescale effort of its kind undertaken by social scientists. In 45 field studies, DRC examined organizational and community preparedness planning for, as well as the management of, response to sudden dangers resulting from hazardous chemicals. In the first phase of the study, systematic and comparative data on preparedness were obtained from 19 communities in the United States that had varying degrees of risk due to dangerous chemicals. In the second phase of the research, DRC studied 26 managements of responses to major emergencies or disasters that resulted from toxic releases, explosions, spills, fires, or other acute chemical threats.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 243

The on-site data in both phases of the study, obtained primarily through intensive interviewing of key personnel and collection of documents, were subjected to a variety of quantitative and qualitative analyses, the specifics of which have been reported in publications elsewhere [1–7]. In this paper a general overview is presented of these findings. We will first briefly summarize what we learned about preparedness planning for chemical threats. However, the bulk of the paper reports what DRC found in its studies of response management, with special attention being given to emergencies and disasters resulting from transportation accidents. More specific information about the methodology and theory, as well as different substantive foci of the study, is contained in the publications previously cited. A general report on the full study has been given [8]. Since that initial research, which was concluded in 1981, DRC has done additional work on chemical disasters. Two explosions were separately studied in field studies: (a) a chemical tank explosion in 1982 in Taft, Louisiana [9], and (b) a major catastrophe outside of the United States: the liquified petroleum explosion in November 1984 in the Mexico City metropolitan area. In addition, for other purposes, a series of official reports on chemical incidents was recently systematically examined (e.g. the report on an incident in Somerville, Massachusetts, where in 1980 a cloud resulted from a spill of phosphorus trichloride as a consequence of a train accident; 418 people were injured and there was a forced evacuation of a 1·5 square mile area which contained 23 000 inhabitants). We also recently undertook a comparative analysis of transportation accidents that involve phosgene gas versus those that involve dangerous nuclear wastes [10]. Currently, as part of a series of field studies on organizational functioning in crisis occasions, DRC has also looked at seven more chemical incidents, including the phosphorous spill from a train derailment in Dayton, Ohio, in 1986 and another similar spill in the Pittsburgh metropolitan area. There later field studies and analyses have been used to test and to extend some of the observations and conclusions that were drawn from the initial large-scale research. Thus, while this paper is primarily a summary presentation of the first systematic research, it does take later work into account.

244 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

2 RESEARCH FINDINGS ABOUT DISASTER PREPAREDNESS PLANNING 2.1 Threat perceptions There is a degree of perception that chemical agents, compared with other agents, have more potential as disaster agents. However, different communities, sectors, and organizations selectively vary in their perceptions of chemical threats [11]. In particular, there are noticeable differences between threat perceptions of public and private groups, with the latter seeing chemically based disasters as less likely than the former. This variability in perception may partially be the result of role expectations as they apply to these different sectors of the community. That is, many public sector groups (such as fire departments) have official responsibility for emergency preparedness and are expected by the community to carry out these responsibilities. This type of role expectation can sensitize these groups to the various demands of their domains. On the other hand, fewer private sector groups (with the exception of chemical companies) have formal responsibility for preparedness planning and, therefore, are less likely to be aware of disaster threats in general. 2.2 Availability and mobilization of resources In principle, but not in fact, there are many potential resources available to prepare for chemical emergencies and disasters. Many tangible resources either are unknown, are unrecognized as such, or are the property of private groups, and, even when available tend to be segregated inefficiently from other kinds of community disaster resources. More intangible resources are also undependably and unevenly available, and a lack of leadership and responsibility for their availability prevails, particularly in the public sector. There is little collective mobilization of resources except in a minority of communities with local comprehensive mutual aid systems (i.e. networks of relevant organizations from both the public and private sectors that form for the express purpose of sharing resources in disaster preparedness and response). Such systems are particularly strong with respect to resource sharing

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 245

and communication, although they are usually weak in risk assessment, in providing a role for the medical area, and in addressing the problem of evacuation [12]. Extra-community resources are seldom part of any individual or collective preparedness planning for the mobilization of resources for chemical disasters. 2.3 Patterns of community social organization A variety of social linkages were found (i.e. formal or informal contacts between and among organizations and groups) for chemical preparedness planning in most of the communities we studied. In particular, there tend to be links between local fire departments and the chemical companies in their areas. The general pattern, however, is one of weak vertical rather than horizontal linkages within communities. That is, the structure tends to be hierarchical in nature, with authority vested in the uppermost levels and with few provisions for effective crosscommunication among the various disaster relevant groups. There is also an almost total absence of local extra-community linkages, even though the collective resources of the latter sources are extensive in nature. More integrated linkages are slowly evolving, but overall evidence shows a pattern of weak community social organization for chemical emergencies and disasters. 2.4 Social climate As a whole, the social climate in most local communities in the United States is not favorable to preparedness planning. While some of the existing norms, values, and beliefs provide incentives for planning, most do not. There is a tendency to believe that communities could respond to emergencies and disasters better than they probably do. This reinforces a disinclination to disturb local economic benefits from chemical plants or to argue against what is seen as a public unwillingness to spend governmental funds for almost anything, including disaster preparedness planning.

246 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

2.5 The planning process and preparedness Only a low degree of preparedness planning for chemical emergencies and disasters exists in most communities in the United States. In fact, such planning is frequently non-existent among public emergency organizations, with the exception of some fire departments. Preparations for chemical disasters are especially handicapped by the public-private sector split in the United States. An additional impediment to local planning efforts is the fact that the most relevant resources rest in the hands of extra-community groups (i.e. state and federal level organizations) rather than with the local community organizations that invariably are confronted with problems associated with the immediate post-incident response. Preparedness is often incorrectly equated with formal disaster plans, an end product of the planning process, or viewed as an extension of everyday operations. However, good preparedness is actually a knowledge-based, realistic process stressing general principles aimed at reducing the unknowns in a problematical situation. As such, it comprises all the activities, practices, documents, formal and informal agreements, and associated social arrangements that, over the long or short term, are intended to reduce the probability of disaster and/or the severity of the community disruption occasioned by its occurrence. Community disaster preparedness for chemical problems is generally poor, if not nonexistent, in most localities. However, the private sector is relatively well prepared, especially for in-plant accidents. Extra-community groups that do have resources for chemical crises are seldom incorporated into local planning. Nonetheless, to the extent that preparedness planning of any kind exists, it tends to make for a better response to chemical emergencies and disasters. We should observe that, while the above observations reflect our field studies in the last decade, much is happening with respect to chemical disaster preparedness planning in the United States in the last few years. Partly triggered by the Bhopal catastrophe, both the chemical industry and United States governmental agencies have initiated a variety of programs aimed at improving local community preparedness for chemical accidents and disasters. The effectiveness of this planning and its contribution to the better management of hazardous chemical incidents has not yet been documented. Almost certainly this preparedness planning will make the situation better than it was; however, we would

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 247

suspect that what we report from the past will generally be what will be found in future studies. In the disaster area, as most other areas in life, improvements tend to occur incrementally and slowly, not massively and quickly. 3 RESEARCH FINDINGS ABOUT MANAGING RESPONSES TO CHEMICAL DISASTERS 3.1 Fixed and in-transit sites. There were some major differences in the patterns of response to hazardous chemical incidents that occurred at fixed sites compared with those that resulted from an accident that occurred while a vehicle was in transit. Fixed-site situations generally are those that occur in chemical plants or on their property. In-transit incidents are the result of transportation accidents, such as those that involve trucks, trains, barges, or aircraft carrying hazardous chemicals, and that occur on publicly accessible lands. Which organizations participate in the response to the crisis and what they do, as well as the difficulties that emerge, differ somewhat in the two types of situations. Although there are many common elements between the two types of crises in the United States, there are enough differences in the responses to make them worthwhile noting. For example, emergencies that occur at a fixed site, such as a plant, are likely to involve only company-related groups, such as the plant fire squad, rather than the fire department of the local community. In contrast, in-transit accidents will, usually quickly, evoke the appearance of community emergency agencies, such as the local police and fire units. Fixed-site incidents, such as those that occur at a plant, usually generate responses that are specific to the particular chemical hazard involved. In-transit accidents, on the other hand, often initially trigger general accident response measures rather than specific chemical disaster responses. Also, in-plant chemical emergencies tend to lead to actions to contain, if not to prevent, the threat from developing. In contrast, many of the initial activities in in-transit accidents are devoted to measures to protect the community. The differences in the managing of the two types of crises are the result of a variety of factors. Chemical plant incidents in the United States almost always occur on private property. In

248 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

contrast, in-transit accidents, even though they may involve a private carrier, usually occur in what normally is viewed as a public setting. This is related to the low social visibility of incidents that occur at plants. Unless the accident is of major magnitude, only the workers and officials immediately present in the plant may know that there has been a chemical mishap. Although incidents beyond a certain level of impact are supposed to be reported to the public authorities, this does not always occur. In contrast, most (although not all) in-transit accidents are more socially visible; usually it is difficult to prevent the community from finding out about the accident. In our study we discovered some attempts to maintain secrecy about hazardous incidents in railroad yards, but most efforts of this kind were unsuccessful. The major differences, however, between responses to fixed-site accidents and responses to in-transit accidents probably are the result of other factors. Chemical companies generally have good emergency preparedness programs, and the extent of preparedness is usually related to the size of the company. Larger companies are more likely to have detailed and extensive preparedness planning for chemical mishaps, especially if the plant is part of a nationwide or international corporation. There is a tendency to equate accident preparedness with disaster preparedness; however, even if an incident is an accident that is not a disaster, the mobilization of resources to alleviate the accident will probably help alleviate the potential for a disaster occurring. Moreover, not only is there likely to be less preparedness planning for intransit accidents, but there are more problems that must be coped with in transportation related events. There are often complicated jurisdictional questions and multi-level organizational issues when trains, tank trucks, ships, or planes carrying dangerous chemicals are involved in a transportation accident. For example, any incident in the United States that may lead to the pollution of any body of water could lead to the activation of the national contingency plan for such events and the active participation of the US Coast Guard, regardless of local and state plans and the activities of community and state agencies. In summary, responses to chemically threatening incidents are better when the accident occurs in a fixed facility than when the accident occurs in transit. Often minor mishaps in chemical plants are so well handled that they never develop a potential for becoming a disaster. Also, when level of risk for an accident to

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 249

occur is considered for different modes of transportation, our study found that motor vehicle incidents are generally handled less efficiently and effectively than those occurring on railroads. In part this results from the relatively little systematic chemical disaster preparedness planning for accidents that occur on roads or highways; railroads have undertaken far more elaborate planning for chemical threats. On the other hand, according to our study it appears that the potential for the occurrence of catastrophic chemical disasters compared with the potential for occurrence of non-catastrophic incidents is greatest in fixed installations. The next most vulnerable type of accident is that involving railroads. Motor vehicle incidents are least likely to result in catastrophic accidents. Our study did not obtain enough information to form a conclusion about the potential for the occurrence of chemical catastrophes as a result of barge-ship and airplane accidents. There are many factors that can affect the magnitude of the possible danger in an incident. In general, it appears that the locations that have the greatest risk of occurrence of a chemical catastrophe or major disaster are those where better preparedness and response measures are likely to be found. That is, better preparedness for accidents generally exists in plants that produce the most dangerous and greatest volume of hazardous chemicals. Thus, it is in such locations that the quickest and most efficient initial responses to a chemical mishap are likely to occur in the United States. 3.2 First responders The importance of the initial response in a chemical emergency is widely recognized. One major American chemical manufacturer has produced a safety training film entitled Those Vital First Minutes’ to emphasize the necessity of proper and quick actions during the period immediately following a chemical mishap or an accident that involves chemical substances. It is often the actions taken in the first few minutes, just before a release or just following a spill, that determine whether there will be a minor nonchemical mishap or the threat of, or actual occurrence of, a chemical disaster. In incidents that occur inside chemical plants there usually is no lack of understanding that a hazardous chemical is involved. However, a far more problematical situation usually exists in the early stages of an in-transit mishap. We observed in the study

250 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

that in transportation accidents first responders seldom initially perceive a dangerous chemical threat unless there are obvious sensory cues, such as a strong pungent odor or eye and skin irritations. This is true even when first responders are from emergency organizations such as fire or police departments. Motor vehicle or train accidents are initially seen only as transportation accidents or wrecks. The general tendency of first responders is to define the situation as it appears to be on the surface, namely a transportation incident. In doing this, responders are acting in a way that has long been observed in the disaster literature; that is, there is a tendency to consider all cues in terms of normal or expected events. If an occurrence appears to be a transportation accident, it will be perceived and defined as a transportation accident. The problem with misperception of the initial situation is compounded in that organizational and community disaster plans rarely discuss the combination of a transportation accident and a hazardous chemical incident. A DRC content analysis of plans determined that separate consideration of the two types of events was almost universal. One consequence is a tendency for responding groups in transportation accidents to initially use their routine accident standard operating procedures; they seldom initially activate the disaster plans of their organizations, and even more rarely do they activate the plans specifically for chemical disasters. In principle, first responders should be aware of the various placards and symbols that are mandated by law in the United States to be carried on tanks and other containers of hazardous materials. Unfortunately, various studies have determined that the legal requirements are not always followed. One systematic study of trucks in Virginia found that 41 % of the trucks stopped for inspection were violating placard requirements for hazardous materials [13]. It is stated, in another unpublished report from a railroad, that its own study showed that required placards were in place on only 77% of the railcars. The view that placarding requirements are often widely ignored is supported by the observations of our study. However, even when placards and symbols are in place and readable after an accident, they are not automatically recognized. Our study revealed that first responders do not always note the signs that identify hazardous materials; even if aware of them, they do not always fully understand their meaning. (This excludes situations in which placards and symbols had either been destroyed or were made illegible as a result of the transportation

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 251

accident.) Also, first responders seldom have easily accessible manuals or booklets that would define the symbols or indicate how they should respond to the incident according to the type of dangerous chemical substance, identified by the placard, that is involved. Sometimes first responders to transportation incidents do initiate searches for invoices or other relevant papers. However, even if a search is initiated, it is sometimes difficult to find the invoices or shipping bills for the material that is being transported. Moreover, the relevant papers are not always carried on the vehicle; one survey found that 23% of trucks carrying hazardous materials failed to carry required shipping papers [13]. If the papers are found, they are not always understandable to people without an appropriate technical background. Personnel from law enforcement agencies, usually the first responders to transportation accidents, seldom have the knowledge to read technical papers correctly. Personnel from the transporting carrier are sometimes killed, injured, or disappear from the accident scene, thus precluding questioning by first responders. Of course, such personnel do not always know exactly what type of goods the vehicle had been carrying. There have been cases in which first responders have been unintentionally misinformed by truck or train personnel about the dangerous cargoes that were being carried. Also, it was observed in the study that personnel from the carriers were sometimes reluctant (if not actually uncooperative) to provide relevant information to first responders. Thus, for all these reasons, first responders are frequently uncertain about the specific nature of the chemical threat even after they suspect that the incident is more than a routine accident. It was rare in the chemical emergencies that resulted from a transportation accident for first responders to learn quickly what they had to face. Also, in some instances, and frequently in accidents that involved multiple dangerous chemicals, responders learned about the hazards long after the incident was over. Some of the DRC observations on these matters have also been reported by others, especially operational personnel. In a US National Transport-ation Safety Board hearing, witnesses from the fire service area indicated that reliance on technical manuals, placards, computer printouts, and waybills did not fulfill their informational needs. They stated that all too often placards located on hazardous materials tank cars were destroyed, the knowledge of the train crew was limited as to the exact placement of tank cars and the materials carried, and in immediate

252 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

emergency conditions there was not adequate time to search for waybills and cross-reference materials with an emergency manual to determine general emergency actions [14]. In accidents that occur in chemical plants in the United States, in contrast to in-transit accidents, there seldom is a problem of identifying the chemical threat, although in one case it took company officials hours after an explosion to realize they had a poisonous gas episode potentially present in the situation. However, there are other kinds of problems that result from the typical behavior of first responders to fixed-site accidents that occur in plants. We observed more than once that company personnel often failed to report promptly to outside authorities fixed-site accidents that involved chemicals. This failure to communicate existed even when the threat expanded or continued to develop outside of the plant grounds. We noticed in our study that community emergency officials often learned by chance about the possible danger to their localities. Not infrequently, the outside community agencies did not find out about a chemical threat until there were obvious sensory cues, such as a toxic cloud. Given such circumstances, it is understandable that the responders from outside of plants often remain unclear for some time about the specific nature of the chemical threat. They may recognize that the community is possibly endangered and that some chemicals may be involved, but they have no specific knowledge beyond these impressions. A few situations were observed in which an evacuation was initiated even though the community did not officially know the nature of the danger from which people were being evacuated. In the face of a very unclear and uncertain threat there is likely to be a delay in doing anything; this is the general principle stated in the disaster literature [15]: faced with responding or not responding to an uncertain threat, the latter course of action is most likely to be followed. All efforts by first responders to identify the exact nature of the chemical threat in transportation accidents are beset by a number of difficulties. As previously noted, correct identification of the chemical involved by the first or early responders sometimes does not occur. Incorrect identification may be diffused to many others through rumor among local officials outside of a plant or near the site of a transportation accident. As students of rumor phenomena have stated, the function of rumor behavior is to provide some definition of a situation when none is otherwise readily or officially available [16]. Because it is known that a danger exists does not necessarily mean that the exact nature of the danger is understood.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 253

Hazardous chemicals may have varied and multiple effects on human beings and on the ecology of the environment. Thus, it was observed in some chemical incidents that, even when the identification of the chemical substance was correct, an equivalent recognition of the specific dangerous nature of the threat was not always known. To identify something as a threat does not automatically mean that there is knowledge about the specific nature of the threat or how to handle it. Our study also found that first responders to transportation accidents tend to overlook two important and dangerous possibilities. In almost all cases there is an initial overlooking of possible synergistic effects, e.g. the volatile reaction that will occur if water is combined with calcium carbide. First responders tend to be oriented to the existence of a single chemical agent rather than a multiple chemical agent. In addition, responders to on-site accidents generally do not recognize the different and various kinds of multiple hazards that might be present because of a variety of dangerous chemicals on the same train or truckload. Thus, if a fire is perceived or if one chemical is identified as capable of burning, this is focused on, but explosive, asphyxiating, or corrosive threats that might result from other chemicals involved in the transportation accident are overlooked. The lack of widespread knowledge about correct stabilization and neutralization procedures is especially significant at the local community level. First responders to chemical incidents often literally do not know what to do, even if they correctly identify the dangerous chemical and know its effects. Thus, even when a chemical threat is correctly identified, fire department personnel (most likely the first responders to the danger) may not act appropriately. Their traditional routine of quickly putting water on a blaze tends to be done automatically; unfortunately; in some instances this can be one of the worst things to do. Trained personnel also may act inappropriately. In the DRC field work, direct observations were made of trained company emergency response teams who acted incorrectly and endangered themselves and others. Trained teams normally do what should be done; however, it is possible for mistakes in judgment to be made, given the complex nature of dangerous chemicals and the various contingencies involved. In general, fire departments are not well prepared to respond to most sudden chemical incidents, with the exception of some in large communities and other special cases. They usually lack the appropriate equipment, materials, and protective gear. Moreover, perhaps surprisingly, they often do not know where to turn for

254 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

information. For example, DRC discovered more than one fire department that had personnel who had never heard of CHEMTREC, the nationwide chemical emergency reporting center. Although the situation has been changing rapidly in recent years, relatively few local personnel have had training in dealing with hazardous chemicals. Many of these weaknesses in coping with chemical incidents result from the primarily volunteer nature of the staffs of the nearly 30 000 fire departments in the United States. Yet it is these volunteer groups that are often among the first responders and that usually are the lead organizations in fighting hazardous chemical threats in transportation accidents. A major observation of the DRC study was that the initial responding activities of emergency organizations usually follow standard operating procedures. This generally facilitates action being taken by the organizations, but they are not necessarily doing something relevant to the problem at hand. As the nature of the chemical threat becomes clearer, there usually is a tendency to try to adjust to the newly recognized situation. A vast majority of first responders do not have experience from a similar situation that they can rely on. Therefore, experience in responding to any unusual emergency in the past is likely to influence the response to the current situation. We observed in field work during our study that some emergency organizations have relevant technical manuals available; however, they are often inaccessible to the first responders. Moreover, there is considerable variation in the use of such manuals, and frequently, as mentioned earlier in this paper, the manuals are not consulted at the height of the emergency. There is an ad lib quality to the pattern of the first response, especially in transportation accidents. Trying to clarify the situation is often a prime activity. Defining what is happening and what can and should be done is a large part of the early response, but such definitions are not always correct. There is often a delay in defining a transportation accident as one that has the potential to be a chemical disaster. This is in part because there can be many contingencies present in a potential disaster situation. A discussion of the possible contingencies is presented in the next section. 3.3 Impact and situational contingencies Different types of contingencies can influence the way in which a community will respond to a particular chemical threat, as well as the degree to which they respond. These contingencies can be

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 255

divided into two categories: impact variables (or chemical agent variables) and situational variables. However, even though the managing of a chemical incident and its effectiveness will be affected by differences in the chemical agent’s impact characteristics as well as by variations in the social aspects of the particular situation, we do not argue for the importance of idiosyncratic factors. In fact, the opposite is stressed in this paper; aspects which appear to be idiosyncratic when observations are made of only one or a few cases turn out to be more general features or happenings when enough incidents are observed. To a considerable extent, what we shall be discussing as the tactical problems posed by contingencies are what often appear to an unsophisticated disaster planner or operational emergency worker as idiosyncratic or unique in a specific hazardous chemical threat incident. 3.3.1 Impact contingencies Impact contingencies include those characteristics of the chemical agent that can affect the organized response. Different chemical agents generate different risks and threats. While risk assessment essentially involves a perceptual component, there are dimensions of risk that are inherent to the chemical agent. For example, some chemicals are toxic, but most are not; a few chemicals can explode, others cannot; certain chemicals only become dangerous when they combine with other chemical substances, other chemicals remain inert. Thus, the specific characteristics of the chemical agent or agents involved in a major accident will influence the risk and threat to a particular environment. Given the variety of characteristics that might be involved, myriad possibilities of risk could be present. However, many of these variations can be reduced to one of two types of possible consequences: the damaging or destructive potential of the chemical or chemicals, and the ability to control the chemical or chemicals. Both of these characteristics will have implications for the manner in which responders to an incident can and will attempt to neutralize the threat. The situation is complicated, of course, in that responders to the crisis may not correctly perceive either the damaging and destructive potential or the controllability of the chemical threat. Nevertheless, the potential consequences of the risk still remain, even if they are incorrectly perceived.

256 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The damaging destructive potential of any chemical agent is the amount of damage and destruction it can do to people and to the ecological environment. Certain agents have a greater potential for damaging results than others. In general, the high-risk chemicals are those that are extremely volatile or that exhibit an unstable molecular structure. Chemicals that have a high-risk potential are exemplified by the inherent dangers of compressed gases or the hazards posed by gases such as butadiene and vinyl chloride, which are both highly reactive and have a tendency to polymerize. The typical first responder (whether police or fireman) to a chemical accident, unless it occurs within the confines of a chemical plant, usually has little idea of the destructive potential of such substances. Those managing a chemical threat can be faced with widely differing dangers depending on which chemical or chemicals happen to be involved. Thus, in one emergency the responders might be faced with a relatively low-risk situation. In another emergency the risk may be extremely high. One result is that multiple exposures to chemical risks may not provide a good learning experience that can be used in other emergency situation. Unlike in many natural disasters, experience in one chemical disaster does not necessarily transfer well to the next incident. This great variation in possible damaging destructive potential is an inherent agent contingency in a threatening chemical situation. There can, however, be more than a threat of impact—there can be actual impact; again there is often substantial variation in the damaging or destructive consequences. DRC studied some actual chemical incidents in which populations that were dozens of miles away from the actual disaster site were endangered. Yet other chemical disasters were examined in which the actual destructive impact was confined to the part of the truck or railroad tank car involved in the accident. Those managing a localized disaster are presented with operational and response problems different from those faced by the responders to a diffused disaster. Thus, there can be a tremendous difference in threat or impact of a chemical accident, depending partly on inherent qualities of different substances. In both of the situations previously noted, responders may be presented with different contingencies that are primarily dependent on the inherent properties of the type of chemicals that are involved in the accident. Chemical properties of an agent include flash point, toxicity, vapor density, and synergistic possibilities, all of which can be further affected by meteorological

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 257

conditions such as precipitation, wind velocity, and other similar factors. This is in addition to the possibility that responders may have incorrectly perceived the chemical danger or even not perceived any threat at all. Perceptual differences aside, however, different dangerous chemicals provide different threat of actual impact contingencies to which those managing the disaster must react The magnitude of a disaster can also complicate the response pattern. In a large-scale disaster, the magnitude of which partly depends on inherent properties of the chemical or chemicals, a number of representatives of agencies from different jurisdictional levels will respond to the event. We usually have more involvement of state and federal organizations. This often complicates jurisdictional problems because there are often discrepancies in responsibilities among different governmental sectors. If a disaster is large enough to necessitate a response from state, regional, or federal level of government, or some combination of levels, these representatives will often attempt to exercise authority and control in the situation, sometimes over the opposition of local officials. Thus, the contingency of the damaging destructive potential of any chemical agent may influence the coordination of inter-organizational response. In addition to potential or actual destructiveness, there is also the factor of the uncontrollability of chemical agents. Here too there may be considerable variation between the inherent uncontrollability of a chemical agent and the responder’s perception of this uncontrollability. Our study determined that most community officials are likely to assume there is a high degree of uncontrollability in most chemical agents. While the same perception exists for most natural disaster agents, the belief is sometimes expressed that this should not be the case for chemical substances. In actuality, a chemical’s controllability is only partly dependent on the properties of the chemical agents. Controllability also depends on the amount or volume of the chemicals, as well as on the capability of the community to respond appropriately in the critical period of time immediately following the onset of an accident that has a potential to be a disaster. Usually, the greater the volume, the greater the uncontrollability, everything else being equal. Finally, controllability is partly dependent on the community’s ability to perform certain initial response tasks. While both destructiveness potential and uncontrollability of the agent are inherent to the properties of the chemical, they are not, insofar as response is concerned, independent of the perceptual factors. The results of our study suggest that there is

258 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

misunderstanding with respect to both destructiveness potential and uncontrollability. In general, community officials and the public tend to overestimate the damaging and destructive potential of dangerous chemicals. As in projections of risks at nuclear plants, the threat presumed to exist due to a chemical emergency often exceeds the inherent possibilities of most chemical substances. Chemicals can present major risks and result in major consequences, but they are seldom major threats acrossthe-board. Most chemicals are not inherently dangerous, but our study showed that the reverse is often the common view; the perception that chemicals are involved in an accident often leads to a perception of danger. Probably one reason for a general misunderstanding of the potential effects of chemical agents is that, except within the chemical industry, few people have any experience in viewing chemicals and certain risks associated with technological accidents. Although chemical agents are widespread throughout American society, they are relatively random in their manifestations of hazard. That is, the risks posed by dangerous chemicals are not restricted to certain localities or regions of the country. They are non-specific in this respect. In contrast, most natural disaster agents such as earthquakes, hurricanes, or tornadoes are specific to certain localities. Therefore, it is unlikely that any given population group will have had much, if any, direct experience with dangerous chemicals. Consequently, the image of the risk presented by chemical agents is vague and tends to be exaggerated. Impact contingencies add to the possible variation and complexity of the response in chemical incidents. In some actual chemical disasters, the situation is further compounded for those managing the event by the multiplicity and variety of hazardous aspects that may be involved. In some acute chemical cases there are often multiple elements of a disaster occurring either concurrently or sequentially. For example, in the derailment of a train carrying dangerous chemicals, the derailment is a problem that must be solved, and there may be resultant fires and explosions due to the derailment. In turn, these may create a chemical spill or toxic cloud that might not otherwise have occurred from the derailment alone.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 259

3.3.2 Situational contingencies Situational contingencies include those specific characteristics of the particular social context in which a chemical mishap first occurs. A chemical incident does not just happen; it happens in a particular locality, in a place with distinctive features. A chemical problem also occurs at a specific point in time—more accurately, at some social time in the community life. Likewise, there are particular circumstances associated with each chemical emergency; for example, the overturned truck carrying a dangerous chemical cargo may or may not have displayed the required warning placards or signs. In the following subsections, situational contingencies will be discussed that can be classified as variations in location, time or circumstances affecting the response to, or the managing of, a chemical incident. (a) Variations in location. The location at which a chemical threat or disaster occurs significantly affects the response. A chemical incident, for instance, can occur on private property, a mixed public-private setting, or a public location. These possibilities have implications for a variety of factors, ranging from the degree of knowledge the public will have about the event to the possible courses of action that responding organizations can take. For example, we observed during our research that, when chemical accidents occurred inside plants or chemical company property, the larger community seldom found out quickly about such events unless there were immediate casualties. In nearly every case there was a delay between the time that the accident on private property was turning into a potential disaster and when this happening became public knowledge. There were also situations in which local fire departments were denied entry onto private property on which a chemical emergency was occurring. Situations were studied in which, because the chemical emergency was in a public setting, the response was delayed and confused because no local agency believed it had exclusive responsibility for, and jurisdiction over, the incident. Such a lack of clarity over response initiative would not occur in a private setting. Thus, the location (actually property responsibility) and whether that property is a private, public, or private-public responsibility (which is a contingency) have an effect on the patterns of managing chemical emergencies. Another locational contingency involves the geographic and demographic setting of incidents. An obvious possibility that may

260 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

affect the pattern of response is whether the incident occurs in a rural or urban setting. An accident that might have only minor consequences in a rural area could have potentially catastrophic consequences in an urban area with high population density and heavy concentrations of buildings. The inherent destructiveness of the chemical agent might not differ, but it could vary depending on the geographic setting in which the destructive agent manifests itself. Each of these events creates different demands, and thus a single situation may involve multiple disaster potentials that generate different demands to which the affected community must respond. Moreover, the incident may generate different emergencyrelated tasks that are incompatible with each other. For example, the water needed to douse the fire might actually trigger a dangerous chemical reaction that otherwise would not occur. This example represents an extreme, but not uncommon, manifestation of the complexities that can be generated for responding organizations by impact contingencies. Furthermore, we frequently noted in our research that interjurisdictional and interagency problems may arise, depending on the location in which the chemical incident occurs, because many jurisdictional boundaries and domains are often vague. Therefore, if an emergency occurs near the uncertain boundaries of two or more separate jurisdictions, ambiguities can surface about who has the major responsibility for managing the disaster. In particular, chemical disasters that occur in port areas or that involve bodies of water appear to generate jurisdictional problems in the response, although the same difficulties also frequently surface outside of city boundaries. Many rural or quasi-rural areas in the United States are locales where organizational responsibility, authority, and domain are unclear and often overlapping. A chemical incident in such a location is certain to elicit interagency confusion, if not competition or conflict. Thus, the contingency of the location in which a chemical emergency occurs can have a major impact on the managing of the response. (b) Variations in time. The time when a chemical threat or disaster occurs also has an important effect on the response. However, it is not chronological time but social time that creates an effect. These two types of time are not equivalent. In every community, there is a rhythm to social life, with certain activities ebbing and increasing in particular patterns and cycles. These patterned activities vary (and not always directly) in relation to the time of day, the day of the week, and the season. Thus, there are community social phenomena such as the rush hour, major

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 261

sports events, and holiday weekends [17, 18]. Such social times affect where people will be concentrated and what they will be doing, as well as the state of readiness of emergency organizations and how quickly resources can be mobilized. We noted in our study that there was a significant variation in response, depending on the time at which the incident occurred. For example, evacuation is easier to carry out when it is light than when it is dark. At the Mississauga (Ontario, Canada) chemical incident, massive evacuation was partly delayed, according to police reports, because of a reluctance to try to move a large number of people at night [19]. Even organizations that operate on a shift basis, and most emergency groups are on a 24-hour basis, do not have either the same quantity or quality of personnel available at all times. Some chemical incidents were studied in which the response developed slowly because higher level emergency officials were not immediately available because the incident occurred outside of regular weekday working hours. In a few cases, certain material resources could not be easily located and used because the organizations owning them were closed and it was difficult to find any personnel with relevant information on how the resources could be obtained or the authority to do so. Thus, similar to variations in the location of an accident, variations in time can create different contingencies. With respect to time, the rhythms of community life (or social time) can create significantly different situations with which responders must cope. The chemical risks might be identical in two chemical emergencies, but because of the time at which the accidents occur there could be somewhat different situations for the responders and managers to face in the two cases. (c) Variations in circumstances. In addition to contingencies due to location and time, there are still other possible variations. There may be other circumstances affecting the situation; two of these factors will be illustrated here: the duration of the threat and the speed of onset. In our research, chemical incidents were observed in which the response activities ranged from a few hours to nearly a week. As indicated earlier in this paper, some events that eventually become chemical emergencies may initially be no more than a transportation accident or a plant mishap. Thus, a railroad derailment may produce no chemical toxic release for several hours, days, or perhaps not at all. However, responding organizations must maintain site security and mobilize certain resources for the duration of the episode.

262 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The residual polluting effects of a dangerous chemical neutralized can likewise extend the duration of an incident. In other cases, the circumstances are such that the threat is over quickly, and hours after the initial indication of an emergency there is little sign that anything happened. This can create greatly differing consequences, depending on the kind of community in which it occurs. For example, we noted that smaller communities were more adversely affected by a prolonged emergency. Among the negative consequences noted in the study were lost wages for volunteers in emergency organizations, substantial losses to the local economy because of closed businesses, and rapid depletion of certain kinds of resources. A chemical emergency of the same duration would not have the same consequences in a metropolitan area. Although an urban area might suffer more in absolute terms, our observations were that smaller communities tended to incur relatively higher losses for chemical incidents of the same duration. Speed of onset is another situational variable that may affect response patterns. Depending on many factors, including properties of the chemical agents as well as how the potentially dangerous substances are initially treated, there may be little or no advance warning of an impact. In such cases, preventive efforts cannot be taken and the response management generally focuses on recovery efforts. However, in many transportation accidents the initial accident does not always produce an immediate chemical emergency. In many such cases, the response can be directed primarily at preventing a chemical emergency from developing. As illustrated in the examples, circumstances can create different types of situation, and in that way circumstances partially structure the managing of the response which should occur. It is easy to think of impact contingencies in individualistic or idiosyncratic terms. However, we have indicated that there are some general aspects even of contingencies, including impactrelated contingencies, in almost any chemical incident. This realization should encourage general tactical planning that takes contingencies into account. Much of what happens after the arrival of the first responders and their initial definition of the situation can generally be visualized as convergence and outflow patterns. There is a movement of organizations, things, and information outward from the disaster site, and a similar flow toward it. Both the outflow and the convergence patterns are marked by much uncertainty and un-evenness of knowledge of the situation by selectively involved organizations. What flows out is even more erratic than

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 263

what converges, and some behaviors tend to compound the difficulties in the situation and almost ensure lack of coordination. There are also special problems in chemical emergencies with respect to exactly how to handle the often overwhelming numbers of mass media representatives, how to obtain accurate information relevant to the diagnosis and treatment of victims (often the chemical agent is unknown or, if it is known, medical personnel are uncertain on measures to take, especially in relation to very unfamiliar chemicals, and no centralized sources are available for quick references), and how to identify appropriate procedures for neutralization of the chemical threat. 3.4 A few implications What are the implications of our study? From a general perspective, our work suggests that locally based preparedness planning using existing resources can lead to an improvement in integrated community responses. From a more specific perspective, preparedness planning ought to consider three aspects. There is a major public-private sector split, with weak linkages between the two sectors. The split hinders chemical disaster preparedness and is not helpful in chemical disaster management. Also, chemical disasters are more problematical than disasters resulting from most other kinds of agents. A chemical disaster can be occasioned by rather different things, can physically have rather different outcomes, and frequently requires rather different coping mechanisms. Put another way, chemical disaster agents tend to be relatively more heterogeneous than other kinds of disaster agents. This also makes for problems in preparedness and response. Finally, a strong technological bias exists in the planning activities and operational measures undertaken with respect to hazardous chemicals. There is the strong belief that technical solutions can be found both to prevent and to soften chemical disasters. While in one sense this is undoubtedly true, there are social as well as technical aspects of preparing and responding to acute chemical emergencies and disasters. Even if all the technical problems were solved, problems would still be inherent in the group and human aspects of the situation. These require the application of a sociological perspective, which we have partly tried to illustrate in this paper.

264 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

3.5 Cross-societal applications The great majority of social science studies of hazardous chemical incidents has been done in the United States. There has been only limited research in other highly industrialized and urbanized societies in Western Europe and in Japan [20–22]. Also, until Bhopal there had been almost no study of acute chemical disasters in developing countries. Additionally, outside of the research in the United States and Canada there has been little systematic research on hazardous chemical incidents resulting from transportation accidents. Thus, there is the question of the applicability of what we have reported to all other types of societies. Our view is that the work done so far, including all the recent studies of Bhopal, suggests that, while there may be cross-societal differences along some lines with respect to preparedness planning and response managing of chemical incidents, there are more similarities than differences [23, 24]. To the extent that societies vary from one to another, there may be variations in social organizational structures (e.g. the degree of centralization of the governmental structure) as well as cultural values [25] which could affect both preparedness and response. But these kinds of differences will also manifest themselves in non-chemical types of disasters, e.g. as found in a comparative national level study of natural disaster response in the United States, Italy and Japan [26]. Even the often drawn distinction between developed and developing societies does not appear very useful for disaster research and policy purposes [27]. Overall our position is that what has been learned so far about planning for and managing of chemical disasters should be taken as generally applicable unless future research shows the necessity of taking some distinctions into account. ACKNOWLEDGEMENTS Part of this research was supported by National Science Foundation (NSF) Grant PFR-7714445 but all views expressed are those of the author and not necessarily those of NSF. Some of the observations in the middle sections of this paper have been reported previously [28].

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 265

REFERENCES 1.

2.

3.

4.

5.

6.

7. 8.

9.

10.

11. 12. 13.

QUARANTELLI, E.L. & TIERNEY, K. (1979). Social climate and preparations for sudden chemical disasters. In Sociological Research Symposium IX (Ed. E.P. Lewis, L.D.Nelson, D.H.Sculley & J.S.Williams), Department of Sociology, Virginia Commonwealth University, Richmond, VA, pp. 457–60. TIERNEY, K. (1980). A Primer for Preparedness for Acute Chemical Emergencies, Disaster Research Center, University of Delaware, Newark, DE. GRAY, J. (1981). Three Case Studies of Organized Responses to Chemical Disasters, Disaster Research Center, University of Delaware, Newark, DE. GRAY, J. & QUARANTELLI, E.L. (Eds) (1981). Social aspects of acute chemical emergencies. J.Hazardous Materials, 4 (Special Issue), 309–94. TIERNEY, K. (1982). Developing a community preparedness capability for sudden emergencies involving hazardous materials. In Safety and Accident Prevention (Eds H. Fawcett & W. Woods), Wiley, New York, NY. GRAY, J. & QUARANTELLI, E.L. (1983). Sociobehavioral aspects of chemical hazards: summary findings on preparations for and responses to acute chemical emergencies at the local community level. In Sociological Research Symposium XIII (Eds M. Larkin, J. Honnold & J.S. Williams), Department of Sociology, Virginia Commonwealth University, Richmond, VA, pp. 115–18. QUARANTELLI, E. L (1984). Chemical disaster preparedness at the local community level. J.Hazardous Materials, 8, 239–49. QUARANTELLI, E.L. (1984). Sociobehavioral Responses to Chemical Hazards: Preparations for and Responses to Acute Chemical Emergencies at the Local Community Level, Disaster Research Center, University of Delaware, Newark, DE. QUARANTELLI, E.L., PHILLIPS, B. & HUTCHINSON, D. (1983). Evacuation Behavior: Case Study of the Taft, Louisiana, Chemical Tank Explosion Incident, Disaster Research Center, University of Delaware, Newark, DE. QUARANTELLI, E.L. (1982). Transportation Accidents Involving Hazardous Chemicals versus Those Involving Dangerous Nuclear Material, Disaster Research Center, University of Delaware, Newark, DE. HELMS, J. (1981). Threat perceptions in acute chemical disasters. J.Hazardous Materials, 4, 321–30. GABOR, T. (1981). Mutual aid systems in the United States for chemical emergencies. J.Hazardous Materials, 4, 343–56. SCHMIDT, J. & PRICE, D. (1977). Virginia Highway Hazardous Materials Flow, Virginia Polytechnic Institute and State University, Blackburg, VA.

266 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

14.

15. 16. 17. 18. 19.

20. 21. 22. 23. 24. 25. 26.

27.

28.

Analysis of Proceedings of the National Transportation Safety Board into Derailments and Hazardous Materials, National Transportation Safety Board, Washington, DC, 1978. QUARANTELLI, E.L. (1984). Perceptions and reactions to emergency warnings of sudden hazards. Ekistics, 309, 511–15. SHIBUTANI, T. (1966). Improvised News: A Sociological Study of Rumor, Bobbs Merrill, Indianapolis, IN. LAUER, R. (1981). Temporal Man: The Meaning and Uses of Social Time, Praeger, New York. ZERUBAVEL, E. (1981). Hidden Rhythms: Schedules and Calendars in Social Life, University of Chicago Press, Chicago, IL. SCANLON, T.J. & PADGHAM, M. (1980). The Peel Regional Police Force and the Mississippi Evacuation, Canadian Police College, Ottawa, Canada. WESTGATE, K. (1975). Flixborough—The Human Response, Disaster Research Unit, University of Bradford, Bradford, England. LAGADEC, P. (1982). Major Technological Risk, Pergamon Press, Oxford, England. IKED A, K. (1982). Warning of disaster and evacuation behavior in a Japanese chemical fire. J.Hazardous Materials, 7, 51–62. SHRIVASTAVA, P. (1985). Bibliography of Publications on Bhopal, Industrial Crisis Institute, New York. SHRIVASTAVA, P. (1987). Bhopal: Anatomy of a Crisis, Ballinger, Cambridge, MA. DOUGLAS, M. & WILDAVSKY, A. (1982). Risk and Culture, University of California, Berkeley, CA. McLucKiE, B. (1977). Italy, Japan and the United States. Effects of Centralization on Disaster Responses 1964–1969, Historical and Comparative Series No. 1, Disaster Research Center, University of Delaware, Newark, DE. QUARANTELLI, E.L. (1986). Research findings on organizational behavior in disasters and their applicability in developing countries. Preliminary Paper No. 107, Disaster Research Center, University of Delaware, Newark, DE. GRAY, J. & QUARANTELLI, E.L. 1986. First responders and their initial behavior in hazardous chemical transportation accidents. In Recent Advances in Hazardous Materials Transportation Research: An International Exchange, Transportation Research Board, National Research Council, Washington, DC, pp. 97–104.

28 Experience Gained from the Pollution Control Operation at Læsø 1985 FLEMMING LIND ARPE Danish Civil Defence and Emergency Planning Agency, Copenhagen, Denmark

1 INTRODUCTION With its situation between the North Sea and the Baltic Sea, Denmark, her peninsula of Jutland and c. 400 bigger and smaller islands, is a typical coastal nation. The total coastline is c. 7000km, of a highly varying nature (sandy and stony beaches, marsh, salt meadows and a few rocks). The Danish sounds and belts are among the most crowded in the world. Apart from the traffic to and from Denmark, a large number of tankers, freighters and bulk-carriers pass to and from the Baltic states (FRG, GDR, Poland, USSR, Finland and Sweden). The high sea traffic has been assigned a special international passage called Route Tango. Many special conditions add to the risk of pollution hazards in Danish waters. Heavy sea traffic, the narrow sounds and belts, difficult navigational conditions, frequently bad weather and a considerable cross-traffic all present a constant risk of collision and grounding. The relatively short distance between the individual coasts means that in a very short time (a few hours) a spill will wash ashore, even with favourable winds and currents. The National Agency of Environmental Protection (NAEP) is responsible for directing and coordinating control operations in cases of oil and chemical spills at sea. NAEP has its own pollution combatting vessels and units stationed at the Copenhagen and Korsør naval bases (the Sound and the Great Belt). The national ‘maritime preparedness’ also comprises the Civil Defence Corps whose task it is to combat sea pollution in nearshore areas and if possible stop it from washing ashore. The forces of the CD Corps (professionals and conscripts) are stationed

268 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

at 6 regional barracks and equipped with oil booms, skimmers, tools etc. These forces are trained in pollution control operations. The local authorities are responsible for shoreline clean-up. In cases of comprehensive and complicated shoreline pollution, local government may apply for practical assistance (know-how and strike teams) from the national authorities (NAEP and CD Corps). 2 THE OIL POLLUTION CONTROL OPERATION AT LÆSØ IN AUGUST 1985 One of the biggest oil spills ever in Danish waters was caused by the West German tanker ‘Jan’ of Bremen. The result was a major, complicated pollution of Læsø, a small Danish island in northern Kattegat. 2.1 The island of Læsø The island of Læsø (112 km2) is a municipality with 2600 inhabitants and a very attractive recreational tourist area due to the beautiful and varied nature (fine sandy beaches, dunes, plantations, marsh and salt meadows). Læsø also an important nature reserve with sea birds and seals, thus very sensitive to any pollution. This small community, of course, does not have sufficient resources to combat a large-scale, complicated oil pollution. 2.2 The situation On 2 August 1985, at 02.40a.m. (local time), ‘Jan’ of Bremen rammed into the Hals Barre lighthouse near the eastern entrance to the Limfjord, in the northern part of Kattegat (position: 56°54′ 05″N 10°30′07″E). The total cargo was 3000 tonnes of heavy fuel oil. In the collision ‘Jan’ received a 20 m long gash in the forepeak tank and the cargo tanks Nos 1 and 2. The first effect of the collision was the immediate spill of c. 200 tonnes of oil. (During the rescue operation later, another spill of more than 100 tonnes occurred; however, this oil was recovered on the spot by one of the combatting vessels.) NAEP at once dispatched their vessels to the area and early in the morning started air reconnaissance. In the afternoon a large oil slick was observed drifting in north-easterly direction c. 6·5

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 269

nautical miles (NM) from the collision site. (Denmark has not yet any remote sensing equipment.) The weather in the area had deteriorated considerably. Owing to high seas, the strong current (speed 0–8 knots, course 050°) and a large spread of the oil, the sea clean-up operation was very difficult. It soon became clear that the south-west coastline of Læsø (c. 24 NM from the collision site) was threatened. The next day (3 August) oil was observed drifting only 1–2NM from the coast. NAEP ordered a combatting strike team (20 men) dispatched from the North Jutland CD column at Thisted. Their primary task was to evaluate the situation and the extent of the pollution, and try to prevent the oil from drifting ashore. The team arrived at Læsø on 4 August at 02.00 a.m. with their own vehicles, materials, staff, and communications equipment and outfit for a longer stay on the island under primitive conditions. 2.3 The combatting operation In the course of the first 2 days it became clear that it was not possible to prevent the oil from washing ashore. The use of oil booms could not be considered because of extremely difficult weather conditions (strong current and wind, high sea and tidal water). The oil was washed over the booms (the current sucked the ‘skirt’ towards the sea bottom) and it was impossible to keep them stationary in the high waves. An oil belt 60–100 m wide polluted 8 km of salt meadow. The tidal water had also pressed the oil into the small inlets and draining canals in the area where it had settled in a layer up to 30cm thick. Since the oil was now actually on the coast it had become a local task to organize the shoreline clean-up. The local government asked for central government assistance, and the CD Corps over the next 10 days carried out the practical work in cooperation with the local authorities. A vast, difficult and dirty job had begun. The force Was increased to c. 100 men from the CD columns at Thisted and Herning (Jutland). The practical work was organized and controlled by the mobile staff and communications unit. All decisions were made in daily meetings with the local authorities. Owing to the special nature of the area (salt meadows) and its considerable sensitivity to mechanical impact, the clean-up had to be done manually. Only very light vehicles could be used for

270 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

transport of the large quantities of waste (oil and polluted vegetation, sand, stones etc.). The waste was temporarily stored in pits dug out in the area and lined with oilproof plastic. Very simple equipment, such as shovels, forks, buckets and special ‘vegetation cutters’ was mostly used for the clean-up operation. The men worked every day from early morning to sunset. The dirty nature of the work made it necessary to equip the men with protective clothing (waders and gloves). Cleaning of materials, equipment and personnel had to be improvised in the open. Special cleaning sites were established in the area where the men daily underwent a systematic and efficient cleaning procedure whereby they were completely cleaned of oil. This proved essential for their working morale. With c. 100 men working continuously for almost 2 weeks, it was necessary to have a well functioning logistic service to keep operations going efficiently (feeding, supply, materials, equipment and workshop services). The means to maintain these services were brought from the barracks in Jutland. The operation was carried out with efficiency and capability by the staff, the strike team and the logistic service. The CD Corps won national and international praise for its efforts. The oil spill had hit a large number of sea birds in the Læesø area. About 1000 birds, mostly terns, became victims of the pollution. The cleaning of Læsø was so efficient that no damage was done to nature (fauna and flora). Nor were any negative effects on tourism registered. The total costs involved in the oil spill from ‘Jan’ of Bremen were c. 11 million DKK (1·6 million US$). The CD Corps share of this amount was c.4·5 million DKK (about 0·6 million US$). 3 LESSONS LEARNED FROM THE OPERATION The CD Corps gained some general and specific experience on Læsø. (a) We learned the importance of: — having an overall, coordinated preparedness plan to ensure: — speedy and certain judgement of the situation; — speedy communications with/alerting of all responsible authorities;

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 271

— a standing combatting force at a sufficiently high state of preparedness; — a distinct delegation of tasks and responsibilities among authorities; — ample and efficient resources; — current updating; — being able to muster a well trained, well functioning staff, capable of turning theoretical knowledge and previous experience (also at international level) to practical purpose, and able to improvise; — having staff who can master planning, coordination and control under difficult circumstances; — having well trained leaders and strike teams with great stamina and good working morale; — having an independent and well functioning communications system (internal and external communications on own radio and telephone networks); — establishing close cooperation and coordination among all local authorities involved to be able to: — profit from local and special knowledge; — discuss ideas, methods, proposals, resource needs, working plans, operations, etc.; — ensure back-up from the local authorities; — establishing cooperation or contact with other interested parties to be able to inform about the situation or to seek professional assistance or back-up, such as environmental organizations and hunts (to kill polluted birds), insurance companies etc.; — using valuable international contacts who are able to offer concrete advice due to their own research or practical experience; — ensuring that the formally responsible local authority is not deprived of its competence but is submitted all important operational suggestions from the staff for the final decision (of great psychological importance); — resources being earmarked for current information of the press through briefings and excursions on the spot (the press must always have real and updated information on the situation);

272 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

— resources also being earmarked for information of the many national and international experts and observers who wish to gain practical experience during the operation; — the press and observers being handled without disturbing the combatting operation. (b) We also learned: — that, due to the absence of remote sensing equipment, it was not possible to verify, sufficiently early the captain’s statement of the volume of the spill (just a few tonnes); — that the time factor is essential; the existing mechanical recovery equipment is not sufficiently efficacious in rough seas if thin oil slicks are spread over a large area; — that modern machinery, large beach cleaners and sludge sucking equipment cannot be used in such a situation (the sensitive salt meadows could not endure being exposed to heavy mechanical traffic); use of military temporary roads to ensure the absolutely necessary traffic had the result that after 2 weeks’ operation in the area the salt meadows were almost intact; — that use of sludge sucking equipment in the ‘wet areas’ (draining canals) had to be given up as it sucked up an unacceptable amount of water, which added drastically to transport costs (use of oil separators was impossible owing to the weight of the vehicles); — that the nature of the area and of the pollution made beach cleaners worthless for the purpose; — that the existing coastal oil booms and skimmers are of limited use and are completely useless in high seas and with strong currents along the coast; — to make daily plans for the work and carry them out according to detailed schedules for each working team; — to put down and mark all relevant facts (resources used, supply needs, pollution situation etc.) to be able to maintain control of the operation; — to put down all improvised procedures and all practical experience gained in order to be able to prepare manuals at a later date for future operations; it is essential in order to achieve a good result of the operation that differentiated decision tools are available (use of modern technology will possibly make the decision process easier); — that good working morale is of vital importance to achieve a favourable result of the operation (this is why many

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 273

resources were used to ensure efficient cleaning of the men every day after work in the extremely dirty environment); a great effort was also made to ensure that the men had sufficient rest and food, as this is also important for morale; — that working in a tight protective suit in the summer heat creates a need to consume liquids; symptoms of lack of liquid and salt (headache and nausea) were remedied by giving ample quantities of refreshing drinks with salt added. (c) We finally learned: — that it would be a good idea to undertake research into the sensitivity of our national coast stretches; this would make it possible to launch an immediate operation in the areas most sensitive to pollution, thus achieving the best possible results.

29 The Accident at DSM: Learning from a Major Accident in The Netherlands MENNO J.VAN DUIN Leiden University, Department of Public Administration, The Netherlands

1 INTRODUCTION This paper deals mainly with the accident at DSM (the Dutch Mining Company) on 7 November 1975 in the Western Mining District (of the province of Limburg in the south of The Netherlands), in which 14 employees lost their lives. This accident will be looked at from three different points of view. First, the situation in Limburg and the Western Mining District before the accident will be described. Second, the accident itself will be examined, with special attention given to the role of the authorities and questions of coordination. Finally, the major consequences of the accident with regard to the policy-making process will be discussed. 2 THE SITUATION BEFORE THE ACCIDENT One of the most important events that influenced both public and governmental attitude towards DSM was the disaster on 1 June 1974 at Flixborough, England. In the explosion, caused by ignition of a cloud of escaped vapour (due to a broken pipeline), 28 people were killed on the premises of Nypro, a daughter company of DSM, Holland. Members of parliament as well as members of local and provincial councils raised questions as to what would happen if a comparable accident should occur at DSM in The Netherlands. The regional department of Civil Defence in Limburg made an analysis of the consequences of such an accident in the Western Mining District. In its conclusions, the lack of professional personnel by the local fire squads and other rescue organizations,

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 275

including those for medical care, was emphasized as a major problem in coping with a major accident at DSM. In the meantime, at the beginning of 1975, a committee was formed with respesentatives from different municipalities, the province and the management of DSM. Its main concern was issues of town and factory planning and the environmental problems of DSM. Also, a working group on disaster management, serving to analyse the potential dangers of DSM, was organized. Half-way through 1975, several local authorities of municipalities around DSM developed some preliminary operational plans for specific accidents like those involving faulty gas lines and chlorine leaks. Although there were some initial preparatory activities, incidental plans here and there, the predominant feeling was still that a disaster like the one in England was unlikely to happen in Limburg. 3 7 NOVEMBER 1975: THE BIG BOOM IN BEEK On that morning, 7 November 1975, at about 9.48 a.m., a leakage in one of the pipelines occurred. This formed a gaseous cloud which, within 2 minutes, exploded. The explosion caused tremendous fires to break out through the piping system and nearby storage tanks. At about 10.10 a.m., while members of DSM’s own fire squad attempted to extinguish the fire, the first attempts were made to find and rescue possible victims. About 1 hour later, public fire squads of different municipalities arrived at the scene. The first body was not retrieved until 1.45 p.m. Meanwhile, a great number of wounded people were found and 45 of them were brought to different hospitals in the area. Altogether, by 4 p.m., 9 persons had been found dead. Attempts to put out a tank fire continued. Due to the difficulty of the task and the bad cooperation between the local and DSM fire squads all efforts were in vain. Suddenly, around 6 p.m., the entire situation changed dramatically. One of the tanks in the tank park cracked open, spreading burning petrol all over the place and forcing the firemen away from the immediate area. The entire tank park flew up in flames. This was a setback in itself, but the main danger was the threat of a huge explosion of the two nearby gas balls. Attempts to cool them were frustrated by the wind sending the flames and heat towards them.

276 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

In 1966, in a similar situation, an explosion had occurred in Feyzin, France. This explosion led to a great disaster. If the same were to happen here in the Western Mining District the consequences would be tremendous. At that stage the danger of such an explosion was apparent. The situation remained critical for about 1½ hours. At 8 p.m. the municipal firemen returned to the scene. Eventually, on 12 November, the last fire in the tank park died out. 3.1 Some specific problems on 7 November 1975 Although it is not possible to discuss in detail all the problems encountered, a concise picture of the problems concerning operational activities and management of the operations of the responsible authorities is discussed below. 3.1.1 Problems of traffic congestion and disaster tourism The accident occurred less than 100m from a busy highway quite near to the major intersection in the southern part of Limburg. The necessary blockage of this intersection (Kerensheide) led to traffic chaos on the surrounding secondary roadways. As if that was not enough, traffic was already hindered at another intersection due to road repairs. During the day, hundreds of curious people came to see the big fire; as a result, several car crashes occurred. By 3 p.m. the traffic started moving again after the opening of the Kerensheide intersection. At 6 p.m., when the accident radically escalated, the police had to close the main routes again. At this time a lot of people, mostly disaster tourists, were very close to the burning tank park and the gas balls. 3.1.2 Some operational problems The public fire departments from the surrounding municipalities functioned far from optimally, partly due to operational problems. Firstly, there were technical difficulties such as mismatching connections for water pumps and hoses, and the lack of adequate means of communication. In addition, the coordination between the local fire squads and that of DSM left much to be desired. Notably, DSM never officially requested assistance from the 8 local fire squads; they entered the grounds of DSM on their own

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 277

initiative. Three years earlier in Amsterdam (Marbon explosion) five local firemen died on the premises of a private firm when helping the firemen of the firm. Later the question was posed as to who would have been responsible if one of the public firemen had been killed at DSM. 3.1.3 Information and communication problems Directly after the enormous explosion at DSM all the telephone lines were blocked in almost the whole Western Mining District. Everyone had heard the boom and wondered what had happened. Women tried to telephone their husbands working at DSM. This total blockage in Beek and Geleen lasted for hours. For example, the police and the mayor of Geleen did not make direct contact with representatives of DSM until only a few minutes before noon, more than 2 hours after the explosion. Not until 12.16 p.m. did the mayors of Beek and Geleen, the cities most involved, manage to contact each other. In one of the early reports, at about 10 a.m., operational services spoke of a fire at DSM’s northern location. Although this report was quickly corrected to the southern location, several firemen went to the north. At 1.30 p.m. the regional radio station was still reporting an evacuation of schools at Borne (in the north) instead of at Beek, once again proving how persistent mistakes can be. 3.1 Lack of coordination The most important problem experienced on 7 November was the rather chaotic and uncoordinated management of the local and provincial authorities involved. DSM was situated in no less than 6 different municipalities. The situation of the accident itself best illustrates the complexity and the strangeness of this situation. The border between the towns of Beek and Geleen cuts right through the tank park. The explosion took place on the territory of Beek. The fire burned in two cities. The gas balls are situated in Beek but, in the case of an explosion, the residents of Geleen, and to a lesser degree Stein, would be threatened initially. For some hours the mayors of Beek and Geleen were not sure if the accident was in their city. There were six local crisis centres set up and one provincial centre in Maastricht, but during the day, partly due to the

278 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

communication jams, there was hardly any contact between them. Of the various local authorities, each handled their own problems. The public received very little or sometimes no information from these centres. Thousands of people had heard the big bang from the explosion that morning; hundreds of windows were shattered; alarming reports were sent out over the radio. Yet the local citizens heard nothing from the authorities about what had happened and whether there was any further danger. So the police warning around 6.30 p.m., issued by just a few policemen, to open the windows because of the new threat of a big explosion, came as a complete surprise for most of the people of Geleen. They had heard that everything was under control, that the roads were opened again, and now it appeared that the danger was still acute. Of course a lot of people missed this message, as well as the message at around 9.25 p.m. to close the windows again. When members of the Provincial Council asked their Governor (Commissaris der Koningin) why he did not intervene to coordinate activities during that day, he answered (incorrectly) that only one municipality (Beek) was directly involved because everything had happened in the municipality of Beek. However, it appears that lack of experience played a far greater role in his decision not to act than this ‘legal’ reason (which was mistaken in itself). The lack of coordination was the most important issue in the aftermath. Of course, the inadequate means of communication influenced this element. 3.2 After 7 November 1975 The accident at DSM had particular influence on several matters at the local, provincial and national levels of government. It is evident that measures taken on the local level are more often directly related to the accident than measures at the central level. In the following we will begin the analysis at the central level, followed by the provincial and local levels. 3.2.1 The central level At the national level, several areas can be distinguished in connection with the accident at Beek/Geleen. Disaster management, and internal/labour safety will be discussed successively.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 279

(a) Disaster management. At the beginning of 1975, the Minister of Internal Affairs presented a bill on Assistance in the Event of Disasters and Accidents (Nota hulpverlening bij ongevallen en rampen). The bill was discussed in a committee of the parliament but broader debate had not yet been planned. The accident at DSM caused the bill to be discussed before the Christmas recess. The accident fell into the parliament like a bomb. The weak management, the lack of disaster preparation plans and the administrative chaos did not go unseen by the parliament. All political parties, speaking of the accident, agreed to new legislation. This new law should oblige all the municipalities in The Netherlands to make local disaster preparation plans. A more far-reaching law dealing with disasters not only in times of peace but also war, as announced in the 1975 bill, would have to wait. The interim law (local disaster preparation plans) became the top priority. Within l½ years a concept law was ready. Although only marginal changes were made, it took another 3 years before the law came into force. Several years later this law, the Law on Local Preparation Plans (Wet gemeentelijke rampenplannen), was replaced by a more extensive version, the Disaster Law (Rampenwet). In the meantime the existing Civil Defence organization was abolished and regional fire departments had been formed. (b) Internal/labour safety. Flixborough, Marbon (Amsterdam, 1972), DSM and later Seveso (1976) all influenced policy regarding labour protection and labour safety in firms. For many years the most important law on this subject was the Safety Law (Veiligheidswet). Recently this law has been replaced by the Labour Circumstances Law (ARBO-wet, 1981). In 1977, due to the above-mentioned accidents, the Safety Law has been changed. Since then, the bigger and more complex industrial and chemical firms have been obliged to make internal safety reports about their organizations. The main reason for these reports was the fact that the labour inspectorate was no longer able to check most of these complicated and high-tech organizations by their traditional methods. This new regulation gives more responsibility to the management of the firm; they have to make an analysis of both the industrial process and the organizational structure. These safety reports should help the labour inspectorate to do their job adequately. Eventually more than 2000 of these reports will have to be made; up to now about 400 have been finished and approved.

280 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

3.2.2 Provincial level Following the accident, during the first meeting of the Provincial Council (Provinciale Staten), the Governor reacted as if the entire event had been only a matter of local involvement—the role of the province was and should be only marginal, and only when more municipalities would be directly involved and coordination is badly needed would the Governor step in. Three months later the Governor and the Deputies (Gedeputeerde Staten) reacted in quite a different way. In order to deal with the powerful DSM, the municipalities of Geleen, Beek, Stein, Urmond and Elsloo should be combined into one big municipality. By purposely by-passing several regular advisory procedures, the provincial government was able to develop this proposal quickly. This drastic proposal, which went further than mere cooperation between the different municipalities, was made in an atmosphere of urgency and a feeling that it was ‘now or never’. Criticisms against this proposal naturally came from the municipalities affected. The Municipal Council of Beek reacted by pointing out that this newly developed municipality model completely differed from earlier proposals about the restructuring of the municipalities from 1968 and 1975; they described it as an ‘explosion model’ initiated by a panic reaction to the explosion at DSM, and said that the possibility for future explosions would not be reduced by this reorganization. That it did not come to anything was to be expected. Support for the proposal was lacking. The result of the proposal would have been a municipality with a very big firm in the centre surrounded by a number of townships. Eventually, in 1982, a total restructuring of all the municipalities in the middle part of the province (not only the Western Mining District) came into being. Years of lobbying, and protest meetings ended with the formation of 17 new municipalities from the original 56 municipalities. It was for a long time uncertain if Beek would be one of them. The mayor of Beek, however, had managed to convince his party member Wiegel, the Minister of Internal Affairs. Beek survived. All industrial grounds belonging to DSM came under the jurisdiction of the municipality of Geleen.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 281

3.2.3 Local level After the accident, the events around the DSM disaster were discussed in different Municipal Councils. In these settings the whole atmosphere was defensive: Don’t talk too much about our own mistakes and be nice to DSM (the biggest employer in the whole district). A good example of this can be seen in the speech of the mayor of Beek a couple of days after the accident: ‘All those questions asked by MPs and in the Provincial Council can only lead to panic. We should not talk about the few mistakes made, but talk about the positive role of the DSM fire squads and the fine job these men have done. Why so anxious? It is better to trust the authorities.’ This seems to be the reaction of a man who does not understand how the citizens felt during and after the accident of 7 November. In the long run hardly any changes were made in the different municipalities. The authorities have waited for initiatives by the provincial and central government on restructuring of the municipalities, restructuring of the fire departments and the changes with regard to disaster management. 4 CONCLUSIONS Although the analysis of all eight cases is not finished yet, some preliminary remarks can be made about the learning possibilities and the learning capacity of the different governmental agencies and authorities involved. (1) Accidents, especially when death and injury are involved, are a matter of political interest Members of Parliament, local and provincial Deputies will ask questions about what has happened and what can be done to prevent a future occurrence. Attention to the issue is one thing; enduring attention and necessary adjustments after the accident are another. The saying 4We want to learn from the accident’ is more often than not a cliché. Accidents are not only occasions from which we can learn, occasions for policy innovation. Accidents are also situations which we, or the authorities, sometimes like to forget. The mayor of Beek was angry about all

282 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

the attention to the things that went wrong. The only thing that counted, he said a few days after the accident, was the adequate and brave behaviour of the DSM fire squads. (2) Appropriate critical mass If an organization wants to learn from an accident, as well as from normal circumstances, the organization must have a built-in capacity to cope with information. The organization needs to have a policy memory. This presupposes a certain degree of size and intelligence, but also a state of stability of an organization. In the case of DSM both the local and the regional level lacked this critical mass. In the entire area only a handful of professional firemen were available. Local authorities were not able to counterbalance the power of DSM. The different municipalities lacked the knowledge to be equal partners with the DSM management. Local governments were not able to learn from the accident. Only some marginal adjustments were made on the local level. Authorities waited for national help and national guidance in the form of new legislation. As a result of the over-reaction by the province, it was 1982 before one municipality got control over the whole DSM area. The provincial proposals from 1976 were perhaps useful in terms of learning, but they were a total denial of the vested interests and the power structure in the area. (3) Policy making is time-consuming People often believe that adjustments, regulations and laws are made only after the calf has been drowned. Something went wrong, an accident occurred and everyone agrees that something must be done, if not today, then tomorrow. After an accident one expects firm but, even more important, quick response. Investigations and, if necessary, changes and adaptations should closely follow the accident. Accidents break into the established order and become a top priority. Unfortunately the real situation is often not so impressive. Policy making is a time-consuming enterprise, even after accidents and disasters. After an accident, investigations begin but the importance of the accident decreases with time. New things come to the fore.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 283

In the case of DSM this pattern of diminishing interest and decreasing priority can be seen clearly. Dutch members of parliament and the Minister of Internal Affairs both agreed on the need for a rapid regulation of local preparation plans. In the beginning everything went well, but it took more than 5 years for the law to be enacted. Political problems were not the cause of this delay. Rather, it was ‘ordinary’ administrative factors, such as ministerial changes and a gradual decrease of policy priority, which account for this dramatic delay. (4) Learning by informing One of the conditions for learning from accidents is to communicate to others what has happened and what has been done with regard to evaluation etc. To evaluate is one thing, to inform others about the evaluation is another. Unfortunately this second step seems to be far less developed. The knowledge acquired is often hardly disseminated at all. Technical reports often remain secret. For instance, the present author had difficulty in obtaining the different reports made after the accident. Fortunately some articles have been written about the technical aspects of this accident. With regard to evaluating and learning from the non-technical aspects (social consequences, the role of the authorities, the way to inform the public, etc.) this situation is far worse. For example, for some years the alerting and informing of people has been a non-issue. Only recently have people in the Western Mining District received information on how to act in the case of an accident. (5) Learning and blaming There may exist a conflict between the will to learn from an acident or disaster and the tendency to cover up the mistakes that have been made by the authorities and organizations involved. Often the goal of an evaluation is not only to learn but also to blame or to punish. Organizations and authorities often do their utmost to make the evaluation reports seem as favourable as possible for them. They can profit from positive reports (more prestige, more money) but negative reports can lead to less prestige or even dismissal.

284 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

In the case of DSM (and not only in this case) only technical reports have been made. At least four different organizations have made more or less technical reports (about the cause and about the operation of the fire squads). The weaknesses of the local and provincial authorities have hardly been evaluated (see the example about the mayor of Beek). After the accident, authorities stressed the fact that the accident was a technical event in a private company. They almost completely neglected the fact that this accident had, at the time of the explosion, far-reaching social consequences. The explosion not only struck DSM, it also scared and affected the people in the neighbourhood.

30 Lessons Learnt from Major Fire Accidents in Greece M.VASSILOPOULOS Ministry of the Environment, Athens, Greece

1 INTRODUCTION It is good accident prevention practice to ensure that all possible lessons are learnt from an accident. In this paper an attempt is made to apply this principle to the Jet Oil terminal plant at Kalochori in February 1986 and to present action taken by the state and the company itself to further the increase of safety in Greek industry. The widely accepted principle that a majority of accidents are a result of human error is confirmed by this first major technological accident in Greece. The lesson learnt from this is the need to change the method of working, training, instruction, inspection etc.—in other words to improve risk management. 2 THE FIRE At about 12.00 on 24 February 1986 a fire occurred at the Jet Oil terminal near Kalochori in West Salonika, where some 65000 tons of crude oil and 55 000 tons of fuel oil were stored plus 100 tons of naphtha (total capacity 180000 tons). Kalochori is an industrial area located about 7 km from the centre of Salonika (1 million inhabitants), the capital of Northern Greece. West of the terminal, at a distance of 1 km, there is a village with 1000 inhabitants. Close to the Jet Oil facilities there is a terminal of Greek refineries (total store capacity 500 000 tons) and close to them a liquefied ammonia storage tank of 15 000 tons capacity. In the vicinity of the terminal there are also LPG storage facilities of AGIP and BP, a Mobil Oil terminal and a pesticide warehouse of Bayer.

286 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

There is evidence that the original fire started in waste oil dispersed on the soil, during welding work on a pipe. The main cause, according to the only scientific publication on the event, presented by a group of chemical engineers, was the absence of any observation of the safety regulations during welding work on the plants. Also, the absence of skilled personnel to implement the emergency plan at an early stage, together with improper safety maintenance, attributed to the enormous spread of the fire. As expected in such cases, an interministerial council was established under the auspices of the Vice Minister of Defence and the Minister for Northern Greece, who took control of the situation during the fire. Apart from the local fire brigade, units of the Greek army, personnel from the forestry service and the neighbouring industries (Greek refineries and EKO) were involved. A number of firemen were wounded, mostly by heat radiation, but fortunately no other victims were recorded. The total cost of the site damage was estimated to be about 22 million US dollars. Nine of the twelve tanks were demolished together with the buildings and electromechanical equipment. A truck of the fire brigade was also destroyed. Hundreds of tons of vegetables were destroyed because of the dispersion of toxic pollutants such as benzo(a) pyrene over a wide area, fortunately not in the direction of Salonika. As was previously stated, the fire started in the area of tank No. 1 and, through the drainage system, was transferred to the bunker of tank No. 7 where 4500 tons of fuel oil were stored. It increased rapidly because of leakage at a sluice valve. At about 14.00 an explosion of tank 7 took place and the fire spread to tank 8 where 15 000 tons of crude oil were stored. Due to the unsuccessful attempts to put out the fire at this early stage, the fire brigade decided to cool tanks 1–4 and 10. It is noted that, after a heavy rain shower just before the event, it was not possible to approach the bunkers of tanks 7 and 8 from the outside of the terminal. To reduce the danger of fire spreading to the whole industrial area, the army constructed a dam around the terminal. On Wednesday 26 February a new explosion took place in tank 7 and the fire expanded to tanks 1–4, and to a lesser extent to tank 10. The fire brigade managed to extinguish the fire in this area. At midnight on 17 February, an enormous boilover in tank 8 took place and the fire spread to all the bunkers of the terminal. This was followed by an explosion of tank 2.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 287

On Sunday 2 March the fire had gained access to all areas of the terminal through an explosion of tanks 5 and 6. Action was concentrated on tank 5 with success, and on Monday morning at 03.30 the fire was finally extinguished. It is to be noted that, during the fire, major effort was put into avoiding its spreading to the Greek refineries terminal by cooling the two tanks nearest to the fire. To prevent possible damage to the ammonia tank, the contents were pumped into the storage process tanks of the fertilizer and refinery plants, and the major part into a ship. Also, to avoid possible dispersion of pesticides in the area, the Bayer storage facility was transferred using military trucks, because of a strike, to a safe distance. 3 LESSONS LEARNT For the reconstruction of the terminal, three major safety aspects were taken into account: (1) Every part of the terminal can be approached easily from inside or outside. Safe distances between the new tanks have to follow the new regulations, including appropriate storage and drainage systems. (2) Continuous control using skilled personnel and electronic equipment. (3) Automatic fire alarm systems. The major accident in Salonika either accelerated or induced measures to increase risk management in Greece. Two new laws were ratified in 1985 and 1986 covering safety aspects for the workers and the environment respectively. Also, ministerial decrees about new technical regulations, especially for flammable liquids and gases, were promulgated. The lack of scientific and technical personnel in the fire brigade was recognized, and such personnel are now being recruited. The fire brigade created, promptly after the event, a special unit for use in cases of major technological accidents. Inspections were performed on almost all industrial units where a major accident could occur, and contingency plans were reviewed. An expanded training programme for inspectors and industry engineers is in hand, and risk assessment for dangerous facilities

288 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

has to be prepared by the year 1989, as forecast by the Seveso directive. Risk management in Greece has been started. To hope to avoid accidents in the future is unrealistic; to reduce their impact through continuous effort is possible.

31 Organizational Learning from Disasters BARRY A.TURNER & BRIAN TOFT Department of Sociology, University of Exeter, UK

1 INTRODUCTION We can learn from the past only if we are able to recognize similarities between our past experience and our present situation. All forms of learning based upon feedback require that we link patterns from the past with those cues which might alert us to related patterns in the foreseeable future. In many fields of industrial engineering we have become skilled at making such links, with the result that thousands of routine industrial operations can now be carried out much more safely than they were 50, 20 or even 10 years ago. Where we are less skilled is in learning fully the lessons offered to us by major failures in largescale complex systems. To extend such learning it is necessary to start with the assumption that major failures in large-scale systems are not wholly unique, so they can be analysed to provide information which will reduce the chances of similar events recurring. It is gradually becoming clear that many disasters and large-scale accidents display similar features and characteristics, so the possibility of gaining a greater understanding of these disturbing events is presented to us [1]. Although major large-scale failures are high-intensity events, they also occur with low frequency within any one industrial sector, so to learn from them we must make use of a wide range of comparisons from different industrial sectors. To facilitate such comparisons a framework must be developed which aids recognition of similar types of causal patterns, disregarding the differing contexts in which they may occur. Much recent research has been moving towards the development of such a framework, suggesting that the majority of large-scale accidents arise from combinations of individual, group, social and

290 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

organizational factors, and that these combinations display recurring configurations when detached from their specific technical contexts [1–5]. Public accident inquiries have an important role to play in these learning processes, but they are normally under pressure to give all of their attention to the matter in hand, and they have little opportunity to develop more wide-ranging analyses or to contribute directly to the emerging debate about system patterns which might aid learning. Public inquiries after major accidents already have to serve a number of purposes: they respond to public concern by trying to ascertain exactly how the events in question came about; they provide an authoritative investigatory basis for any subsequent legal action related to liability; and they attempt to provide information which will ensure that accidents will not arise from similar causes in the future. To make any progress at all towards this latter goal an inquiry must, of course, be efficiently carried out, any resulting conclusions must be disseminated effectively and their implications must be translated by individuals and by organizations into appropriate preventive action. These cycles of events are, however, rarely considered in a unified fashion, and in this paper we wish to correct this omission and to address some issues which bear upon the problems of the effective generation, dissemination and use of information relevant to large-scale accident prevention. After a major accident, some kind of corrective action is likely to be initiated spontaneously by operators of similar plant, or operators in related industries, merely upon the basis of reports of an accident occurring, or upon the basis of reports of an inquiry in the national or the technical press. A widely publicised component failure, for example, might prompt checks upon similar components elsewhere. But the primary focus for action based upon the lessons of the inquiry lies in the recommendations of that inquiry, and if we are concerned to minimize and contain the adverse outcomes associated with major hazards it is important to look at the nature of inquiry recommendations and at the response to them. In a current study we have been examining the recommendations made in reports from 19 public inquiries into major accidents, and in order to determine in detail the nature of the response to the inquiries we have followed this up by interviewing representatives of the array of organizations involved with five of these incidents. We chose to look at public inquiries into major accidents which took place in Britain between 1965

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 291

and 1975, these inquiries having already had their findings subjected to some detailed analysis [1]. The incidents studied more intensively were all accidents which triggered fires or explosions. The study is not yet complete and the analysis reported here is an interim one. When we examined recommendations from these major accident inquiries, we found that it was possible to discern recurrent types of recommendations [6]. An accident is always a physical event, and all inquiries made recommendations demanding technical improvements and requiring that certain physical changes be made to plant and equipment. But these large-scale inquiries also normally recognized that the accidents were not solely technical events. They clearly acknowledged them to be socio-technical in nature, and over 80% of their recommendations were accordingly concerned with organizational and procedural matters. Recommendations were thus concerned to clarify administrative procedures and arrangements, to draw attention to personnel issues such as the need for staff training, or to call retrospectively for improved safety-precautions to be installed by, for example, the revision or work procedures or by the modification of existing rules or regulations. Organizational recommendations also typically exhibited concern about information flows, calling for improved communication about hazards within and outside organizations, demanding the formulation and dissemination of new rules or procedures, and recommending increased supervision, monitoring or inspection of organizational activities by in-house staff, by external agencies or both. Finally, most of these major public inquiries attempted to develop foresight by making recommendations which offered the possibility of forestalling future problems, doing this by calling for the initiation of programmes of experimental investigations, for example, or by directing calls for action to organizations not immediately implicated in the particular incident under scrutiny. Such an analysis of recommendations displays to us both the areas which were of concern to those conducting these inquiries and the model of diagnosis and prevention which the inquiry body tacitly adopted. These particular public inquiries sought to control hazards and to prevent the recurrence of major incidents by advocating action at a physical, an administrative and at a communications level, as well as sometimes proposing actions which ranged more widely where future plans to deal with a particular hazard were concerned. The model behind these arrays of practical recommendations stresses the importance of: selecting appropriate physical safety precautions; identifying and

292 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

eliminating ambiguous situations; keeping working practices, rules and procedures up-to-date; training staff appropriately; improving communication about hazardous matters; and attending to the supervision and monitoring of processes and individuals within the organizations concerned. This kind of approach is broadly in keeping with the direction of the recent research referred to above, but it is presented in specific rather than general terms in each case. Organizations in any sector could doubtless learn much about emergency planning for industrial hazards merely by considering their own operations alongside this very general checklist. But we should ask here whether there are also other ways of making maximum use of the considerable volume of investigation which goes into such accident inquiries, in order to ensure that any wider applicability of their findings is brought to notice and that the response to their recommendations is effective. One of the problems which such inquiries face in attempting to learn from their investigations is that of marshalling the evidence so that appropriate relationships can be observed and the appropriate deductions made. Since the evidence taken by an inquiry will run to many hundreds of thousands of words, it is, on occasion, difficult for the interrelationships between events to be fully appreciated. It may then, in turn, prove difficult to extract all the lessons to be learnt from an incident; if members of the investigating team are not able to comprehend fully all the implications of the evidence which they have at their disposal, they may unwittingly end up with a limited set of recommendations. The complexity of events associated with large-scale incidents may thus generate ‘blind spots’ in the lessons drawn from them, and it would be a contribution to organizational learning if such blind spots could be reduced or eliminated. A technique known as Schematic Report Analysis has been developed in the course of examining public inquiry reports, in order to explore the combinations of unnoticed events which develop in the ‘incubation period’ prior to a major disaster. This technique has been used not only to summarize a number of public inquiry reports but also to analyse other types of incidents, for example, the build-up to the Yom Kippur War [7] and the causation of instances of structural failure [8]. In recent developments of this technique, Schematic Report Analysis has been used first to translate the written synthesis of evidence gathered about a particular incident into a graphic form, and then to locate recommendations within this format in a way

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 293

which links them to the relevant aspects of the accident investigation. Thus, by summarizing large amounts of information into a readily comprehensible form, such diagrams could assist those investigating accidents to clarify their own diagnoses and to identify more clearly the connections being proposed between diagnosis and recommendation. A fuller account of this technique is available elsewhere [9], but the accompanying figures give some indication of the approach which has been used. Figure 1 illustrates how the events of the incubation period of one particular unwanted incident, in this case a methane explosion at Cambrian Colliery, Wales, can be displayed in a single schematic presentation. In Fig. 2, the various branches of the causal analysis have been isolated and each recommendation of the inquiry has been related to the train of events which it is intended to prevent recurring. It can readily be seen that the schematic diagram subdivides into six separate yet interrelated clusters of events, but the recommendations made as a result of the inquiry seek only to intervene in three of those clusters. Whether this omission was due to an oversight on the part of the investigators, or whether, as seems more likely, they were unable to formulate appropriate corrective courses of action, the diagram set out in Fig. 2 points up the relationship between the inquiry and the recommendations more clearly and more immediately than does the original report. The development and wider use of this and related techniques clearly have a part to play in improving organizational learning after major accidents. As well as assisting the analysis of the evidence, they can help to spread the findings of the inquiry in a more readily accessible form. Very full versions of Schematic Report Diagrams can be stored as nested sets using proprietary programs such as Macintosh Filevision, and diagrams generated from such stores can readily be used as training aids. As indicated above, work currently in hand at Exeter (with the support of the Economic and Social Research Council) is investigating the long-term feedback cycle instituted by accident inquiries. Following the examination of inquiry recommendations, this project is making a detailed exploratory investigation of the response to recommendations made by five major inquiries concerned with large fires and explosions 10 years or more ago. The recommendations of the five inquiries called for action by a total of 23 organizations. Of these, only one refused to cooperate with the research, although four other organizations declined indirectly, on the grounds that no one with knowledge of the incident and its aftermath was now available, staff having died,

294 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 1. Outlining of individual event SRAD Cambrian Colliery accident. Source: Ref. 1.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 295

retired or moved on. A further four organizations had gone out of business since the incident, but interviews were conducted satisfactorily with representatives of the remaining 14 organizations involved. Although the analysis of these interviews is still in an early stage, some preliminary observations arising from them seem to be of sufficient interest to set out here. A point which is immediately striking is the emotional impact which involvement in a major accident has upon those concerned. Even after an interval of 10 years or more, these effects appear to be massive and enduring. One senior manager still did not wish to talk about the incident which his organization was involved with, because it still upset him to think about it, even though his organization bore no responsibility for the accident. As a result of the effects of the accident, some of those interviewed reported that their connection with the accident had triggered a major shift in preoccupations and activities. One architectural practice, for example, had shifted emphasis of its work so that the bulk of its work was concerned with safety matters, whilst an individual in another practice responded to the shock of discovering the fire potential of furniture used in his building by spending several years designing safer alternative fittings. A second observation relates to the clarity of recall about the incidents in question by individuals, even after an interval of 10 years or more. We have no independent means of confirming the accuracy of recall, and all studies of memory and recollection would lead us to expect systematic distortion in such retrospective accounts, but informants’ discussions of what had taken place had a very vivid and immediate quality. They had no difficulty in presenting their clear account of what had taken place, of the lessons which had been learned, and of how the implementation process had been carried out. They had all clearly carried away and retained, in a very accessible form, their own personal lessons from the incident. If such an incident recurred, of course, these personal learning experiences would not be the only issue which it would be important to ask about. It would be equally relevant to ask whether the lessons absorbed by these individuals with direct responsibility for response to the earlier accident had been satisfactorily transferred to the ‘memory’ of the organization; for this to occur, they would need not just to have made an impact upon this particular band of individuals, but to have been translated into a form where they had become a pervasive and accepted part of the organization’s mode of operation [10]. Our

296 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 2. SARD showing main cluster of events for Chambrian Colliery accident.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 297

298 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

inquiries are centrally concerned with the extent to which this institutionalization occurred, but as yet we have no conclusions to offer on this point. As far as organizational responses are concerned, the accounts collected did suggest that action was taken to implement relevant recommendations from the inquiry, and that it was taken very quickly, delays in implementation occuring only when large outlays of capital expenditure were needed. In such cases, the shortfall in safety during the interim period was typically made up by the devising of new rules and regulations, and by safety campaigns to make staff particularly aware of the problem. A clear preference was expressed within these organizations for forms of safety training which actively involved employees in safety practices and procedures, rather than merely making them the passive recipients of additional sets of regulations or directives. As one would expect following incidents which had excited considerable public concern, the recommendations for action were considered at the highest level in all 14 organizations, followed subsequently by a meeting or a series of meetings with lower levels of management, and supplemented in some organizations by information programmes aimed at the general workforce. Such a pattern of endorsement of action from the top of the organization clearly contributed to the speed and scope of the reaction to the recommendations within the organizations. Whilst the diffusion of information about the response to hazard within organizations could readily follow the normal hierarchical pattern used for other types of in-house communications, clear differences could be discerned when issues of broader diffusion were discussed. In very large national organizations which constituted industries in their own right, difficulties of communication arising from sheer size were compensated for by the possibility of using standard communication channels to ensure widespread and rapid dissemination of a particular warning or instruction to all parts of the industry with a reasonable degree of certainty about its delivery. By contrast, in a fragmented or decentralized sphere of operations, the differential response of small organizations to information about hazard seemed to be associated with a lack of cross-communication between small competitors about such matters, few enquiries being made of others about their level of hazard awareness.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 299

A SYSTEMS MODEL FOR THE REDUCTION OF SOCIO-TECHNICAL FAILURES These preliminary observations from our study may serve to raise some questions about the manner in which recommendations contribute to feedback and learning, about the assumptions which underlie them, and about mechanisms for ensuring that they are more widely known after an investigation. They raise the question also of whether it would be desirable and feasible to establish some kind of unitary hazard reporting system which would overcome the problems of hazard communication within fragmented and decentralized sectors of activity to which we have just referred. To help to clarify discussion about organizational learning and adequate feedback after major incidents, it might be helpful to try to formulate such a system in model form. The elements of such a hypothetical model are set out in Fig. 3, which is based upon earlier work in which one of the authors was concerned to apply systems thinking to the problem of reducing the incidence of socio-technical failures [6, 11]. It is sketched out here not as an immediate policy proposal, but in order to illuminate the issues which proposals that moved any way towards such a system would need to confront. The schematic model in Fig. 3 is best understood by considering a proposal to initiate a project which would bring about some change in the environment, a proposal to build a bridge, say, or to construct a power station. The left-hand side of the diagram sets out in a schematic form the kinds of events which might then be expected to follow, as the design is specified and transmuted into more detailed proposals which can be reviewed for their acceptability The implementation of the accepted design and the development of operational instructions for the project enable the accepted cycle to be completed by the generation of the changes initially envisaged—the bridge is built and carries traffic, or the power station is finished and generates electricity. What this cycle does not include are the activities suggested on the right-hand side of the diagram, activities concerned with learning about design. Typically we do have some kinds of activities which provide us with opportunities for design learning but these are rarely seen either as complete elements in themselves or as key contributors to an overall learning system, particularly when the information from failures is being considered. Here we are pointing to the need for a set of procedures which could help to ensure that the lessons which can

FIG. 3. A socio-technical failure reducing system.

300 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 4. Expanded socio-technical failure reducing systems model.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 301

302 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

be drawn from socio-technical failures are incorporated into training and working practices in the future. This could be achieved by making wider provision for the collection, collation and analysis of data from known socio-technical failures, as well as from other sources, and by making arrangements to incorporate this information into design and implementation, and into the management of these processes. We have expanded the model further in Fig. 4 to move a little way away from the wholly schematic, by trying to specify some of the sub-systems which a unitary arrangement for reducing sociotechnical systems failure might contain. We hope that this model, initially formulated earlier this year [6] by the application of a ‘Systems Approach’ [12, 13], might provide an organizing framework within which discussions of the improvement of the management of industrial hazards might take place. In the expanded model, operations have also been separated out into three levels of functioning. At the first level the Design Implementation and the Operational Socio-technical Systems are to be found. The second level contains the first level plus the Design and the Design Specification Systems, whilst the third level of the model adds the Design Learning System to the first two levels. Within each system, the sub-systems shown are intended to be illustrative of the activities likely to be taking place, rather than being an exhaustive specification. The core sequence assumed in the model is the same as that already discussed for Fig. 3: a desire for change in the environment prompts the specification of a possible project design, which will, we hope, be devised with the benefit of opinions sought from concerned actors in the system. The completed specifications will then be translated into firm proposals, through the activities of sub-systems concerned, among other things, with problem-solving and the collation of designs from separate sections of the project in order to avoid difficulties of mismatching. A Simulated Systems sub-unit is included in the model to emphasize the importance of the possibility of non-destructive testing of proposals in as many failure modes as possible before the design to be implemented is finalized. Here, as in other parts of the system, good communications and a two-way dialogue are important in reducing the possibility of failure. As in the simplified model, the Design Implementation System translates the proposals of the Design System into operational instructions which would include information about cost, the

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 303

provision of labour, the ordering of materials and so on. A token sample of sub-units is included here for illustrative purposes. The Operational System can then be brought into action to start to engineer the proposed project, setting up the required sociotechnical system in order to do so. This should generate both the changes initially specified for the project, and also ‘condition data’ which may be used to monitor the project, and to initiate corrective control action where this is possible. As with the earlier diagram, the principal focus of interest for present purposes is to be found at the highest level of the model, in the interaction of the processes already outlined with the Design Learning System, which is here sketched out in a little more detail. Should the project fail catastrophically, or should it malfunction to a level which produces a ‘nearmiss’ catastrophe, the procedures indicated here would be brought into play. The three processes specifically identified here set out some of the important general modes of reaction which are involved. As discussed earlier, this part of the system is expected to receive information from a variety of sources about socio-technical failures, together with relevant academic research findings. As these are accumulated, the system would be expected to: (a) transmit information directly to the Designer Education Systems, so that information about failures and the responses to them could be made available to designers, engineers, managers and others in training, making them much more aware of the problems and mechanisms of failure; (b) pass information on to sub-systems concerned with the production of Codes of Practice and Safety Legislation in order to influence procedures and work practices; and (c) communicate the knowledge gained directly to industry via trade journals and other publications, special notices (as at present in civil aviation), and training courses, to ensure that current experience influences practice as soon as possible. To many there will be little that is novel in this model, except perhaps in its clear diagrammatic formulation; it merely proposes that in designing and operating large-scale socio-technical systems we should make maximum use of available information by setting up and maintaining negative feedback loops to improve our control of such systems. But when we look at practice, the logic of the model looks less self-evident. Engineering institutions are resistant to suggestions that they might install procedures for

304 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

reporting on and learning from failures. Research into such matters can only be carried out with extreme circumspection if at all, and specialists in the insurance industry who possess information which is vital to the operation of a Design Learning System are reluctant in the extreme to consider making use of this information in the way outlined by the model, either because they fail to see any connection between such discussions as the present one and their own commercial concerns, or because of the contraints and anxieties imposed upon them by the need for confidentiality and by associated legal limitations upon the dissemination of failure-related information. We suggested above that this model might provide a framework for the discussion of some of the issues connected with learning from disasters. The difficulties in moving current practitioners a very small step along the way towards the constructive use of failure-derived information indicates clearly that a sociological analysis of current practices in any industry operating large-scale hazardous systems would reveal a pattern much different from the model outlined, with the partial exception, perhaps, of the nuclear industry [14, 15]. We should note too that the model itself has its drawbacks. An all-embracing information-gathering and reporting system would be difficult to devise and to operate, and it might generate undesirable side-effects by accelerating current trends towards the over-centralization of information in our society. It could also be accused of placing an undue faith in a purely cognitive approach to issues of hazard management and failure prevention, neglecting many of the social, emotional and aesthetic aspects of the processes discussed, and making no overt provision for assessing the way in which issues of commercial, political and military power might impinge upon our understanding of, and our response to, large-scale systems failures. With all of these provisos, however, serious discussion of the issues raised by the model is needed if we are successfully to confront the potential for catastrophic losses which results from the continued development in our societies of large-scale systems with high energy concentrations. CONCLUSIONS At every large-scale accident inquiry the hope is expressed that the investigations will ensure that ‘this shall not happen again’. But, in practice, adequate learning is often constrained. Several factors contribute to this: frequently there is an assumption that

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 305

the particular large-scale incident is unique and unlikely to recur —even, perhaps, that it is pointless to look for regularities in such ‘Acts of God’. Often there is also no readily available perspective making it easy to interpret findings at an appropriately general level, and no set of techniques for discerning all relevant patterns in the events surrounding the accident. Learning about such failures is further inhibited if too limited a range of possible comparisons is scanned. Large-scale failures do not recur with great frequency in any single field of activity, and we need to look outside our own industrial sector, examining incidents in other industries and in non-industrial settings if we are to maximize our chances of spotting repeated patterns and of learning from them. The final stage in developing adequate organizational learning after a disaster requires the lessons identified to be passed on effectively to those who need to know about them, and that they be passed on in such a way that appropriate action indicated by them is encouraged. In general, then, as the model discussed in this paper indicates, learning from disasters requires: first, a wide-ranging investigation; second, an outlook and techniques which enable appropriate lessons to be drawn from events which are often similar only at some general systemic level; and finally, an efficient capability to transmit information from these lessons to those most in need of it. Much remains to be done in identifying patterns of contemporary institutional reactions to failure, and in devising ways of minimizing such failures in the future. REFERENCES 1. 2. 3. 4.

5.

TURNER, B.A. (1978). Man-made Disasters, Wykeham Press, London. BIGNELL, B. & FORTUNE, J. (1984). Understanding Systems Failures, Manchester University Press, Manchester. PERROW, C. (1984). Normal Accidents: Living with High-Risk Technologies, Basic Books, New York. PIDGEON, N.F. & TURNER, B.A. (1986). ‘Human error’ and sociotechnical systems failure in structural engineering. In Modelling Human Error in Structural Design and Construction, (Ed. A.Nowak), ASCE, New York. PIDGEON, N.F., TURNER, B.A. & BLOCKLEY, D.I. The sociological management of safety. Paper presented to the British Sociological Association Conference on Science, Technology and Society, Leeds, 6–9 April.

306 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

6.

7. 8.

9.

10. 11.

12. 13. 14.

15.

TOFT, B. (1987). Schematic Report Analysis Diagramming: an aid to organisational learning. Unpublished research paper, Department of Sociology, University of Exeter, UK. STECH, F.J. (1979). Political and Military Intention Estimation, Mathtech, Bethesda, Maryland. PIDGEON, N.F., BLOCKLEY, D.I & TURNER, B.A. (1986). Design practice and snow loading: lessons from a roof collapse. The Structural Engineer, 64A(3), 67–71. TOFT, B. & TURNER, B.A. (1987). The Schematic Report Analysis Diagram: a simple aid to learning from large-scale failures. International CIS Journal, 1(2), May, 12–23. KLETZ, T.A. (1980). Organisations have no memory. Loss Prevention Manual, 13. TOFT, B. (1984). Human Factor Failure in Complex Systems, unpublished undergraduate dissertation, Department of Independent Studies, University of Lancaster, UK. LOCKETT, M. & SPEAR, R. (1980). Organisations as Systems, Open University Press, Milton Keynes, UK. CHECKLAND, P. (1981). Systems Thinking, Systems Practice, Wiley, New York. KALFSBEEK, H.W. (1987). The Organisation and Use of Abnormal Occurrence Data, Technical Note No. 1.87.72, PER 1320/87, Ispra Joint Research Centre, Varese. AMESZ, J., FRANCOCCI, G., PRIMAVERA, R. & VEN DER PAS, A. (1982). The European Abnormal Occurrences Reporting System, PER 672/82, Ispra Joint Research Centre , Varese.

SESSION VI Information to the Public Prior to and During an Emergency Chairman: A.SAMAIN Ministry of Health and the Environment, Belgium Rapporteur: B.WYNNE University of Lancaster, UK

32 Communicating Industrial Risk in The Netherlands: Principles and Practice PIETER JAN M.STALLEN Institute for Environment and Systems Analysis, Amsterdam, The Netherlands 1 INTRODUCTION Risk communication to the general public is becoming a central feature of policy in the area of public health and safety as it relates to technological hazards [1, 2]. In response to the Bhopal tragedy, the US Chemical Manufacturers’ Association unveiled its Community Awareness and Emergency Response program in 1985. This program has been widely adopted and has generally received local support. Initial legal developments in the US have been scattered, mostly at State level. However, in 1986 Congress enacted the Emergency Planning and Community Right to Know Act as Title 3 of the Superfund Amendments and Reauthorization Act. Title 3 applies to facilities dealing with one or more of some 400 ‘extremely hazardous substances’. It calls for the establishment of local emergency response committees which, among other things, shall make provisions for public meetings to discuss emergency plans. In 1982, the European Commission passed Directive 82/501/ EEC on Major Accident Hazards of Certain Industrial Activities. The European Council of Chemical Manufacturers’ Federations has generally supported this so called Seveso Directive. Its Article 8.1 states: ‘Member states shall ensure that persons liable to be affected by a major accident originating in a notified industrial activity…are informed in an appropriate manner of the safety measures and of the correct behaviour to adopt in the event of an accident.’ Although with great variety in phasing and quality, most member states are now envisaging procedures to respond to the EEC requirements for public information practices. Communicating about industrial risk may appear to be a simple and direct issue. However, it will often turn out to be an issue of

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 309

great scientific, economic, social and political complexity. Limitations in the science of risk assessment, in media coverage, in risk management institutions, in public perception and understanding or in other resources may pose serious obstacles to risk communication. For example, risk communicators may place undue emphasis on information central to their own regulatory policy, on information regarding the best understood issues, or on information regarding risks to the detriment of information about benefits or the trustworthiness of the risk management institution [3]. Perhaps even more important, though less visible, is the political culture which may shape the subject of the risk communication process. For example, it has been suggested [4] that, in open and individualized cultures like the US and, to a lesser extent, The Netherlands, the public administration in order to show its accountability will favour explicitness and sciencebased decision rules. Thus, the argument goes, there will be a strong preference for quantitative risk analyses to determine the standard setting process. In view of the value of social and cultural divergences, on the one hand, and of the desirability to provide an equal level of public protection throughout different countries, on the other hand, it would be worthwhile to identify a number of principles (if not practical rules) to guide the development and evaluation of risk communication activities. These principles might be derived from a variety of sources of applied scientific knowledge since, to some extent, risk communication can be seen as a commodity that has to be marketed, as a clinical treatment that has to be monitored carefully, as a warning signal that has to be responded to, as an attempt to mediate between community conflicts, and as a way to educate the public about the difficult trade-offs in regulatory decision-making. Also of importance is the focused effort of more than a decade of risk perception research. 2 PRINCIPLES Many of the following principles may seem obvious but nonetheless they are often violated [5]. Such violations not only make effective communication on health and environmental matters unnecessarily difficult; they may also create an adversarial atmosphere which will be counterproductive in future attempts to communicate.

310 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

(1) Know your risk problem Risk problems emerge in a variety of policy contexts. These may be: (a) Identification of hazardous substances and installations (b) Siting of facilities and the zoning of neighbouring activities (c) Management of hazardous processes, its control and enforcement (d) Establishment of emergency plans Each of these has its own characteristic uncertainties, social environment and potential for conflicts which must be realized when initiating communication. (2) Know your risk communication objective(s) Viewed from the position of the source of communication, risk communication can be undertaken for one or more of the following three major purposes: (A) To convince the public of the trustworthiness of the risk management activities. Other relevant terms under this heading are: to assure that safety arrangement are adequate, to create an open and responsive atmosphere. (B) To stimulate behavioural change and encourage the taking of protective action. This purpose is important in so far as one is anticipating emergency situations and, most clearly so, when such situations in fact exist. (C) To inform the audience. Providing factual information about the risk and its context (e.g. standards set to acceptable risk) is the typical thing to do when operating under this mode. In some circumstances a secondary purpose will be to solve problems jointly and to mediate risk disputes. Too often one admits priority to the information purpose (C) whereas the real motive for risk communication (which one fears to communicate publicly) is to achieve credibility for one’s efforts to manage the risks.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 311

(3) Know your limitations in achieving your objectives Knowing your limitations is just another way of saying ‘know your resources’. Often resources are insufficient and sometimes they may even be lacking. Limited resources can be: absence of the proper legal mandate to cover the risk issues; lacking financial support; inadequate training of manpower; insufficient knowledge of communication target. When identifying such limitations the particular situation should be anticipated where the initial message may lead to a public response that will require a second communication effort. (4) Benefit from existing practices In most countries one will find, at scattered places, companies and local authorities who are already experimenting with risk communication in some form. Such practices are important not only because typically they have been developed by trial and error, and have thus become very sensitive to practical constraints to risk communication, but also because one would like them to be part of the larger, nationwide programs rather than replacing the existing practices by new legal and institutional requirements. (5) Establish the necessary institutional liaisons Risk is a complex institutional phenomenon as well. The management and regulation of industrial hazards concerns three stages of risk: accident prevention, exposure reduction, and consequence mitigation. Risk communication concerns not only the behavioural and technical measures taken at each stage, but also the decision processes involved (e.g. standard setting, licensing, enforcement procedures). In most member states the preventive aspects of hazard control are the mandate of a different institution (ministry, inspectorate, and agencies at the municipality level) from that for the reactive aspects. Also, there are often several intermediary groups, carrying out related activities, that will see risk communication as of interest to them too (e.g. the media, fire departments, health services). Experience with emergency situations shows that it is effective to establish personal links between the relevant sources [6]. Evidently, such

312 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

commitment is all the more when one has to rely on the resources of others as well. (6) Determine the audience’s needs One of the most difficult tasks facing risk communicators is to develop messages that, both in form and substance, show sensitivity to the different contexts (personal, local, historical) in which the message may be embedded. Many public information campaigns fail because they expose the public to information and values without linking these to the information and concerns that it already shares. Without such linkages, not only may the individual be simply unable to process the message presented appropriately, but he may also make the inference that the risk communicator is not really interested in his problems, and thus judge this source as untrustworthy. (7) Empower the audience with opportunities to control As a general rule it is necessary to use simple and non-technical language, both written and visual, to make the public understand and control the hazards to which it is exposed. The presentation of quantitative information on exposure levels (e.g. of the 10−6 type) and the like is only one aspect of providing cognitive control. Risk communicators should also, and probably more importantly so, provide qualitative information on accident prevention, opportunities for protection and remedies for harm. Preferably, this information should be structured so as to enable the interested citizen to use easily accessible secondary opportunities to gain additional information. Such a form of behavioural control will help prevent anxiety and frustration. It is for much the same reason that the establishment of local emergency committees with public representation is effective, as it too offers an indirect opportunity for such behavioural control. (8) Place the risk in perspective Risk is not only an objectively verifiable element of a situation; it is also a culturally determined phenomenon reflecting political constellations, societal values and conflicts. Thus, provision of risk information needs to be accompanied by efforts to assist

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 313

individuals in understanding the legitimacy of the often implicit risk context. Types of contextual information include [7]: (a) Comparisons with other risks of a similar nature (which needs to be done with intelligence and sensitivity) (b) Comparisons with regulatory standards or natural background levels (c) Comparisons with the extent to which the risk can be and/or has been reduced and what that requires in resources Invariably, individuals will need help in understanding the differences between the societal or management perspective with its typical focus on statistical lives, and the personal perspective which concerns a particular individual at risk (often oneself). (9) Communicate in good time The probabilistic nature of risk makes it difficult to decide when to initiate risk communication. It is tempting to start communication late in the process, when information and evidence are more complete and control strategies and supporting rationales more fully developed. However, experience seems to show that modest but early activity will be appreciated and will not cause undue anxiety. In a sense, the mere act of communicating may convey the most important information. Moreover, risk communication in its various forms should be a repetitive event. (10) Monitor and evaluate communication performance and effectiveness Even if the state of risk communication were not so meagre, failures in practice should be anticipated. Given our limited understanding, false steps and insensitive approaches are nearly certain. A well designed risk communication programme should therefore incorporate an evaluation plan both of communicators’ performance (conducted in-house) and of its effectiveness (probably at best conducted by outside evaluators). Such evaluation will provide the central means to assure that accurate information gets through, sensitivity is developed, interaction between institutions is promoted, and credibility grows in the face of adversity and the unexpected.

314 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

All the above principles have to be taken into account when designing a particular strategy for public risk communication. As guidelines they facilitate the making of a great number of concrete and seemingly insignificant decisions about procedure and content. For example, risk communication will often necessitate new institutional relationships; consequently, problems of overlapping responsibility and legal mandates have to be resolved. If there are limited resources available (as is most often the case at the municipality level), one will have to decide whether to spend them on the most accessible audience or on those most at risk. Decisions must be made about whether to communicate directly, e.g. by mail, or indirectly, e.g. by mass media. Also important is how to structure the information, i.e. what information to present first and what to provide at later stages. 3 PRACTICE IN THE NETHERLANDS In The Netherlands a number of cases of industrial risk communication exist. Since about 1980 the Dutch Association of Chemical Industries has organized national ‘open days’ with some hundred organizations participating (including relevant university departments and government laboratories). The Royal Dutch Chemical Association, which is the major professional organization, is publishing a series of popular leaflets on properties and risks of a number of chemical substances. At present there is no legal requirement that forces companies to communicate actively and directly with the public. However, there are a number of companies that for various reasons have initiated a public information campaign. In some cases this has been triggered by an environmental event like an accident or a spill (e.g. Duphar BV); in other cases it has been because of what one might call the management culture with respect to safety (e.g. Dow Chemical, The Netherlands). In general, information campaigns by industry seem to focus more on the preventive aspects of risk management. The objective is to gain trust or to restore credibility more than to educate the public by improving factual knowledge; see principle (2) above. Another source of information on industrial risk is through local governmental bodies. Most important in this respect is the Nuisance Act which requires industrial facilities that can cause danger, damage or nuisance to apply for a license. Additional legal provisions are currently discussed to meet with the demand for a more explicit treatment of the risk aspect of the industrial activity.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 315

In most cases to which the directive applies, the licensing body is the regional authority or Provincie. The application for a license must be published in the (local) newspaper, at the city hall, and via (non-personal) letters to neighbouring residents. During a 30day period the public has access to most of the information presented by the company to the local authority, and it can express its view and/or ask for additional information. Related to this practice of passive communication is the increasing number of municipalities that are planning actively to provide information to the public about what to do in case of a disaster of an industrial origin. No doubt the Chernobyl accident has strongly contributed to this interest. The (further)* implementation of Article 8.1 of the Seveso Directive in the Netherlands will be based upon four provisions: 1. Risk communication as required by Article 8.1 must apply both to the preventive and to the repressive aspect of risk management by industry and (local) government 2. It should be active instead of passive communication 3. Plans for risk communication should be developed with close cooperation between industry and government 4. Article 8.1 should be implemented as much as possible within existing legal and institutional arrangements On the basis of these preconditions, and with particular emphasis on the fourth one, it was decided to adopt the following framework for the implementation of the Directive in The Netherlands: — The Provincie activates (if necessary) the relevant parties, i.e. the company and the local authority. — The company prepares the information material and aligns it with information provided by the local authority. — The Provincie is formally in charge of inspecting the appropriateness of the information presented. Having opted for this framework, the running theme for risk communication is more likely to be ‘the company and the safety of

* The European Commission has raised an argument about whether the Dutch government was lagging behind in implementing the Directive. The debate centred around the question of whether the Directive demands an active approach or also permits passive means of informing the public.

316 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

Table 1 Proposed items of information to be presented to the public (as a specification of Article 8.1 of the Seveso Directive).

its environment’ than e.g. ‘industrial risk and regulations’ or ‘industrial hazards and emergency behaviour’. Of course, this general framework still leaves open a number of substantive and procedural questions. For example, in the context of the chosen framework, what should be considered ‘appropriate’ information? We propose to consider risk communication as appropriate when it contains information on a number of specific items; these are listed in Table 1. Even with this list, risk communication can range from anywhere between a one- or twopage letter and a full-blown brochure. Also, and thus perhaps better, one can make a structured approach, giving relatively modest information to all persons liable to be affected by a major accident and offering secondary opportunities for information to those who show a wider interest (see item 7 of Table 1). The choice of the above global framework and of the running theme suggests that items 1.2, 4.2, 5, 6.1 and 6.2 may be given more emphasis than the others, as the latter are more general in nature and less geared to the specific relationship of the company to its environment.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 317

To deal with the various issues of content and form, and to gain practical experience with risk communication along the above global lines, it was decided to conduct a pilot study first. This study started in January 1986 under the supervision of representatives from various government agencies and industry. The first phase was aimed at investigating communication practices in Europe, and in The Netherlands in particular. It also surveyed areas of relevant research. During the second phase, started in January 1987, a concrete campaign for risk communication around a real facility was designed and tested. ACKNOWLEDGEMENTS Research for this paper was supported by a grant from the Office of Nuisance Act and Risk Assessment of the Ministry for Housing, Physical Planning and Environment. The help of Jose van Eijndhoven is gratefully acknowledged in The Netherlands. However, opinions expressed in this paper are the responsibility of the author and do not necessarily reflect those of the granting agency. REFERENCES 1.

2. 3.

4. 5.

6.

7.

BARAM, M. (1986). Risk communication: moving from theory to law to practice. Paper presented at Annual Conference of the Society for Risk Analysis, Boston, MA. STALLEN, P.J.M. & COPPOCK, R. (1987). About risk communication and risky communication. Risk Analysis, (in press). FISCHOFF, B. (1987). Treating the public with risk communications: a public health perspective. Science Technology and Human Values, (in press). JASANOFF, S. (1986). Risk Management and Political Culture, Russell Sage Foundation, New York. COVELLO, V.T., VON WINTERFELDT, D. & SLOVIC, P. (1986). Communicating scientific information about health and environmental risks: problems and opportunities from a social and behavioral perspective. In Uncertainties in Risk Assessment and Risk Management (Ed. V.T.Covello et al.), Plenum Press. SORENSEN, J., MILETI, D.S. & COPENHAVER, E. (1985). Inter- and intra-organizational cohesion in emergencies. Int. J.Mass Emergency and Disaster, 3, 3 . KASPERSON, R.E. & PALMLUND, I. (1986). Paper presented at the Annual Meeting of the Society for Risk Analysis, Washington, DC.

33 Hazard Protection Measures in the Case of the Release of Toxic Gases: Principles and Description of the Concepts W.HALPAAP Bayer AG, Leverkusen, FRG 1 INTRODUCTION Fire services are faced by a particularly difficult problem in cases where toxic gases are released and threaten the environment. Rapid notification of the incident, as well as fast decisions on suitable measures and who is to take them, decide the effectiveness of their actions. In Bhopal there was obviously no concept for hazard defence in the vicinity, with the result that the population was directly exposed to the full effects of the chemical cloud. A large area was evacuated following the Mississauga incident. The area was apparently not exposed to the escaping chlorine cloud, since this would have caused injury to any persons out of doors during the evacuation. In contrast to ignitable gas clouds, the concentration of which must be greater by at least 4 orders of magnitude (ratio=ppm: %) for them to ignite, toxic gases have a considerably greater range. Ignitable gas clouds thus usually only occur in the direct vicinity of a leak, and generally leave no time for the fire service to take action. Consequently this paper will discuss actions to be taken following the escape of toxic gases, giving consideration to their effect on the environment. When such events occur, there are two fundamentally different tasks to be performed at almost the same time: — Action at the operation site to prevent further escape — Action to prevent effects on the environment In this paper, special attention will be paid to actions relating to the effects on the environment, which have attracted growing attention in public debate. An agreement reached as long ago as

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 319

1979 in Leverkusen between Bayer AG and the City of Leverkusen, on cooperation in the event of such occurrences, has since become a model, and it can be expected to be applied on a supra-regional basis, initially in the Cologne area. 2 PRINCIPLES Let us start with a fundamental statement: If a toxic gas cioud escapes, there is no alternative to seeking protection in closed buildings! Assuming normal impermeability of the windows (w=0·2), a gas cloud inside the building reaches a concentration of only 10% of the outside cloud after 30 minutes. This realization is supported by the fact that, although the threat to human life is a function of concentration and time, the concentration has an overproportional effect. A concentration halved by appropriate measures can subsequently be tolerated for about 4 times as long. There is no fixed value which can be regarded as ‘hazardous’ or ‘safe’; the transition is a smooth one. A hazard is almost always preceded by a clear perceptibility or nuisance. On the other hand, not every annoying smell is associated with a hazard. This applies in particular for decomposition gases occurring during major fires. On the other hand, only very few gases are odourless, such as CO. However, these are almost insignificant in relation to their long-range effect. Nevertheless, no matter what the situation, suitable actions can reduce an otherwise unavoidable effect and reach better values. As regards the fundamental effect, it is irrelevant whether harmful concentrations are to be avoided or simply nuisances. — People should be influenced to react properly as soon as possible. — People should be prevented from going or driving into the affected area, or they should seek protection in closed buildings, as shown here. In the event of evacuation being ordered, people would be sent out onto the streets precisely during the rising concentration phase. The fact that people have not suffered injury when evacuations have been ordered and performed in the past must be due to the concentrations having been so low that such injuries could not occur for this reason despite incorrect behaviour.

320 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

This is why the following point should always be kept in mind: The more hazardous a cloud is, the more important it is to comply with the procedures discussed here. Evacuation should only be considered if it can be performed after carefully studying the facts and taking special precautions. 3 ELEMENTS OF THE AGREEMENT One essential prerequisite for rapid initiation of action is fast information as well as specification of the information routes, contents and subsequent actions. In Leverkusen, this information is passed from the works fire service to the municipal fire brigade. The information content determines the actions to be initiated by the municipal fire brigade in the city district concerned. The works security department gives the police the corresponding information at the same time. If there is no works fire service, or if the technical and organizational prerequisites are not fulfilled, the municipal fire service must, as in the case of a transport accident, for example, obtain this information itself and make its own enquiries. Realizing how difficult it is to take decisions on far-reaching actions with the required speed in the first phase of an operation, and that making enquiries in advance would take too much time, the following agreements were reached: (1) Precautionary information is also given on occurrences which are expected to remain well below the hazard limits, but where a more extensive risk cannot be excluded. This also includes occurrences where ‘third parties’ have the impression of being in danger, i.e. in cases where the danger is only detected subjectively. (2) The conceivable effects are initially estimated. This concept is based on the principle that speed is more important than accuracy, i.e. that measurements are usually not awaited first. (3) Even the control room staff of the works fire service has the authority to send appropriate information to the municipal fire brigade on the basis of messages received without making its own enquiries. (4) The information received (be it from employees, the population or the plant involved) is used to assess the situation, i.e. whether a small nuisance or a health hazard must be expected, must not be expected or cannot be excluded. The result of this assessment is a precautionary notice Dl or an advance notice D2, D3 or D4.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 321

— D1 means that probably no effects outside the neighbourhood need be expected, and that consequently no action will probably be necessary. — D2 means that the possibility of effects on the neighbourhood cannot be excluded, but that action will probably not be necessary, an agreement on such action being reached, if necessary. — D3 means that effects on the neighbourhood must be expected and that the agreed action must therefore be initiated without delay. — D4 would additionally mean that a catastrophe warning will probably also have to be given. The terms ‘precautionary notice’, ‘advance notice’ or ‘probably’ mean that the assessment of the situation may still change, but estimation of the situation at the earliest possible time is required. The resultant actions are therefore of a particular precautionary nature and take priority over the assessment whether or not the corresponding hazard actually exists. The action taken in accordance with this system is therefore not a definitive indicator of the actual hazard existing. Experience has shown that numerous notices have been submitted in accordance with this system on events which, contrary to the initial assessment, had no effects beyond the company limits. In such cases, these notices are treated only internally by the authorities. The willingness to provide such comprehensive information is thus rewarded by this information being treated with a certain degree of confidentiality. 4 EXPOSURE AREA/WARNING AREA We have seen just how important it is to initiate any necessary action as rapidly as possible. In addition to providing information on an occurrence as rapidly as possible, it is also important to agree upon the extent of its effects. In this context, it is important to relate the estimated effect to a certain area, since the hazard changes considerably as a function of various factors, including the distance from the point of origin. The effects at distances of 1000 m, 2000 m or 10 000 m will be completely different. On the other hand, it is difficult to define such an area when such an event actually occurs. With the same quantity escaping in each case, the difference in the areas results exclusively from a slight change in the wind speed or weather situation.

322 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

If the tolerance limit (perceptibility, irritation, hazard) and the quantity escaping were also to be changed, the result would be a large number of different exposure areas. It is consequently senseless to expect that an appropriate exposure area could be selected in a concrete case. Above all, the major parameter, the quantity escaping, is unknown and cannot be determined rapidly enough. It is for this reason that the decision was taken at the very start not to prepare or determine any such exposure areas related to concrete occurrences. Instead, an exposure area was selected, which has been defined as the ‘warning area’ and is intended to fulfil the following requirements: — The cigar-shaped area resulting from the progagation model used is applied in its basic form because it is more likely to allow rational deployment of the task forces than a sector warning. — The area selected is so large, or only so large, that the available task forces, police vehicles and fire brigade loudspeaker vans can service this area within an acceptable period, e.g. in about 20–30 minutes. The police and fire service control centres direct their vehicles to the area defined by the wind direction and the templates. The police take up positions at road junctions outside these areas and cordon them off. The fire service enters the district with its loudspeaker vans and begins to warn the population. At the same time, they also ascertain whether they are inside the cloud (as assumed) or still outside. They locate the ‘cloud edge’ and report back on the actual location and intensity of the cloud. These reports then show whether the area thus defined is larger or smaller than the specified area, and whether appropriate conclusions must be drawn. There were also debates as to whether a larger area should be assumed, in the expectation that a larger area would mean greater safety. However, this proposal was rejected, since a larger area cannot be covered as effectively as a small one. Furthermore, the control centres cannot direct any desired number of vehicles during the initial phase. In other words, a greater area does not mean ‘greater safety’ in this phase.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 323

5 INFORMING THE PUBLIC The current concept is rounded off by an information brochure containing general rules of conduct which is distributed: — to the company employees by the company management; — to the general public by the town clerk. It contains the general recommendation that refuge should be taken in closed buildings and windows closed if unusual gases are noticed, i.e. even before a warning is issued. At the same time, the concept foresees the use of existing public warning sirens and appropriate signals telling the public to switch on their radios to hear more detailed information on the warning. 6 ADDITIONAL COMMENTS The major elements of this concept are as follows: — The checklist as a basis for the company informing the municipal authorities as rapidly as possible — The agreed exposure area as the basis for the action to be initiated in the first phase, if necessary — The principles for establishing rules of conduct giving particular consideration to toxic gases — The translation of these principles into rules of conduct for the population In conclusion, there are a number of details to be kept in mind when implementing or further developing this concept: (a) The entire city has been divided into numbered warning districts with specified routes for issuing warnings by loudspeaker vans. The texts have been kept as brief as possible and the vehicle speeds selected accordingly. The district numbering system is based on a neutral point—the Leverkusen motorway junction—not on the company grounds. (b) The information system has also proved of interest for the exchange of information between public agencies. This again shows that the importance of the fundamental idea of interlinking information with the resultant actions has been recognized. It is, for example, conceivable that a warning area assigned to advance notice D3 is allocated a further area where the fire brigade and

324 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

police control rooms are merely to be informed—in the sense of Dl or D2. (c) It cannot be emphasized often enough that the actions described for toxic substances are largely correct, irrespective of the specific properties of any particular substance. In addition, the substance escaping can often not be identified immediately. This is why reports on effects (nuisance, coughing, etc.) take priority over measurements. (Details of the additional difficulties in making such measurements or of how difficult it is to obtain useful measurements suitable for analysis will not be mentioned here.) (d) Filter masks will still suffice in the case of large-area warnings, i.e. protection through simple breathing equipment. The only exception to this rule should be in the direct vicinity of the point of origin. A general order specifying complex or selfcontained breathing apparatus would make large-area actions virtually impossible. Road blocks should always be located beyond the cloud so that the use of filter masks is not necessary. The fact that it has been possible openly to discuss and agree on this concept in Leverkusen is a reason for satisfaction. Such a concept naturally also gives rise to the question of the occurrence and effects of possible accidents. Since the Bayer works in Leverkusen have never experienced an event resulting in such effects on the neighbourhood, we had to make it clear why such actions were nevertheless being prepared and rules of conduct issued—because possibly something could happen. People accepted that such an incident was regarded as ‘not impossible’ by way of precaution, but without developing a feeling of fear. On the contrary, in view of events occurring elsewhere, it is my opinion that the existence of a clear concept has even created an additional feeling of safety.

34 Industrial Risk and Information to the Public R.GROLLIER BARON Institut Français du Pétrole, Vernaison, France

1 INTRODUCTION When confronted with the development of techniques, the general public is divided between admiration and the old spectre of the sorcerer’s apprentice. Demystification is more difficult when technologies make use of knowledge which is no longer at the level of the man in the street. On the other hand, the media (and particularly television) have a considerable effect on public opinion —the fourth power. While in recent decades the public has become more and more aware of problems of the environment, the industries which manufacture basic materials for the other economic sectors have made little progress in their communication with the general public. Most often they have faced nonspecialist journalists when accidents occur, without preparation and in circumstances when it is difficult to achieve credibility. The major accidents which have occurred in recent years, and a certain number of events the amplitude of which has been considerably exaggerated by the media, have led to reconsideration and a change in attitude. The present ideas regarding information to the public as far as industrial risk is concerned may be summarised as follows: — To convince the public of the social value of the activity of the establishment, to counteract the nuisances and risks which it presents; to acquire credibility in a situation of calm — To prepare for a possible crisis situation and manage information during the crisis

326 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

The first phase, which gives a positive image, is an indispensable preliminary if one wishes to control efficiently the second, which gives a negative picture. 2 CREDIBILITY: SOCIAL VALUE There are two sorts of public for an industrial establishment: those who live around the establishment and who are exposed to its nuisances, and those whom one can call the general public. The first needs reassurance while the second expects more general information. 2.1 Facts The enquiry carried out by Adicra in 1980 among populations living near chemical factories to the south of Lyon showed that the inhibitants were divided into three segments; at the extremes, 15– 20% of people fiercely for or against the industry, and at the centre 60–70% of undecided people whose opinion can be summarised as follows: — They are satisfied with the presence of the factories which bring employment and thanks to which the areas benefit financially thus enabling the building of facilities for the public (swimming pools, sports complexes, etc.). — They are not worried about pollution by the neighbouring factory but are worried about pollution created by factories further away. — With regard to industrial risks, they admit that there is no zero risk, which is very important, but wish to know whether all reasonable precautions to reduce the risk of accident have been taken. On this subject, they lack credible reference; of the sources of information, the mayor inspires most confidence (he defends the interests of his electors). It should be noted that, even though the credibility of the media is quite small, that of television is greater than that of the press. Among other things, when an audio film on pollution was filmed, it was tested on ecologists; the test showed that the ecologists were first of all aggressive but then posed questions when they found that they were dealing with people who were competent to

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 327

give them explanations for problems which they had only encountered through the media. 2.2 What information should one provide? Following these reports, Adicra on the one hand tried to make the chemical industry of Rhone-Alpes known through the media and, thanks to Rhone-Loire scholarships, performed a study on the actions undertaken in this field in Switzerland, Germany and The Netherlands. From this study and from experience of dealing with the media, the following rules governing the way of informing the public have been drawn up: — Give information in simple language, accessible to everyone, avoiding technical or learned terms as far as possible. — Explain what the products are used for if they are not directly commercialised (which is the case most often in chemistry). In the case of direct information, show samples of products used or known by the general public which use substances produced by the factory (drugs, plastic objects, car parts, medicines, etc.). On this occasion one can detail the advantages (price, weight, comfort, efficiency, etc.). — Show the establishment’s contribution to the local economy: direct employment, sub-contracting and work created, revenue for the community and amenities which it has been able to finance. — Mention the regional prestige of the establishment by e.g. mentioning its renown in such and such a field, its position at the national and international level, the originality of its products, etc. — Indicate its contribution to the national economy: volume of business, value added tax, exports. To acquire credibility, one must also discuss the negative counterpart of these positive aspects: — Pollution and nuisances — Risk of accidents On these two themes, one must show that the factory has the permanent aim of reducing nuisances, of avoiding accidents which are always possible although improbable, and of limiting

328 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

consequences. To do this, one should highlight the professional competence of the factory staff, their training, the regular performance of safety exercises, the money spent on these activities, etc. One may also mention the means available for safety and the performance obtained. It is very important to be objective on these two themes to acquire credibility. As an example, one must not deny the dangerous character of certain products when they are dangerous, but explain how one can mitigate these dangers. A triumphant attitude does not favour credibility. One may also help the public to draw up a balance between advantages and inconveniences, by comparing the activity of the factory with familiar activities whose risks are balanced by a certain value (use of town gas, electricity, cars, etc.). These risks should also be given a relative value by comparing them to risks encountered in everyday life (lightning, drowning, illness, etc.). In this type of communication it is important to refer to subjects which are known by the man in the street and to his references in matters of probability. 2.3 How should the information be given? There are various means which must be adapted to local situations and to the people whom one wishes to convince. One may cite: — Open days which can be oriented towards certain sections of the public (teachers, pupils, general public, professionals in the health service, neighbours, etc.). It should be noted that, although it is a good idea to convince elected officials, these follow the opinion of their electors whatever their personal convictions — Use of staff who are particularly credible vis-à-vis their frends and relations; they must be encouraged to defend their establishment — Newspapers and business brochures — Local press: — reception of journalists; — insertion in newspapers of articles on factory life (new installations, important visits, commercial successes, sports equipment, etc.);

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 329

— articles in free newspapers — Local radio and regional television, — Video films shown in schools, for associations or organised meetings. 3 PRELIMINARY INFORMATION FOR A CRISIS SITUATION The CEC Seveso directive of 24 June 1982 concerning the risk of major accidents in certain industrial activities (82/501/CEC) states in Article 8: The member states will ensure that people who may be affected by a major accident caused by a notified industrial activity in the sense of Article 5 are informed in a suitable manner of safety measures and procedures to be followed in the case of accidents.’ In France on 12 July 1985 the Minister of the Interior and Decentralisation issued circular No. 85/170 to the Commissaires of the Republic on new safety planning for technological risks. The interministerial communication of 12 July 1985, together with the circular on the Orsec plan Technological Risks, section Special Intervention Plan, dealt with the problem of informing populations: ‘…In most cases the systematic application of these measures will be suitably prepared by information of the population, e.g. by the distribution of information cards giving safety advice. …The mayors of parishes at risk must receive privileged information from the Directorate of the Establishment and the Commissaire of the Republic Appendix II of the Orsec plan Technological Risks deals with population information cards: ‘…It is obvious that the nature and magnitude of risks for the population varies considerably depending on accident dynamics. The preparation of safety advice in the form of a card will thus be considered as imperative in all the cases where risk analysis shows the possibility of rapid dynamic accidents, implying immediate countermeasures, such as confinement in the house or evacuation. This will be the case e.g. when there is danger of explosion or of rapid propagation of a toxic, corrosive or asphyxiating gas ‘If one has an industrial complex which includes several neighbouring installations of different types, it is better to

330 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

prepare a single card, including all the useful information and advice, rather than several documents Industries thus have an obligation to keep the population informed of the risks involved in their activity and of the procedures to follow. They must prepare an information card in liaison with the authorities concerned, taking account of the following considerations: — The card will be drawn up on one page with the company or companies on the heading and the Directorate of Civil Safety or the municipality of the factory or factories involved. Joint cards are recommended, — People responsible for public places must receive special information to enable them to complete the safety advice for their establishment. Open air amenities (swimming pools, stadiums, etc.) may pose problems. — A radio warning on a fixed frequency (local radio) is more efficient than the telephone for obtaining instructions or information. It is recommended that the telephone system should not be saturated in crisis periods. The population should be advised to test the radio warning at normal times (no danger situation). Preferably stations should be chosen which broadcast continuously and which have a certain permanence. Obviously the information card must be adapted to particular cases. One can note that it would be a good idea to have a standardised European alert code. It is a good idea to prepare for the distribution of this card by preliminary information in order to avoid the creation of unjustified fears, specifying that it is just a complement to the efforts already made on safety. 4 INFORMATION IN A CRISIS SITUATION There is no lack of examples where bad management of information at the time of an accident or incident increased its gravity in public opinion well beyond the reasonable (Seveso, Montlouis, Chernobyl, the Rheims transformer, the Sandoz accident, etc.). One should thus keep in mind some characteristics of information for the media if one wishes to understand how a process of disinformation can be started:

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 331

— The media must sell their services, i.e. fulfil public demand; now the information media sell ‘news’ or events. — One often says that for journalists ‘a dog which bites a man is not news; a man who bites a dig is’. The media news event is characterised by its rare, unusual, unexpected, etc. nature; this is the case in most chemical accidents. — Information very quickly loses its value; it is a perishable commodity; it has more value when it is fresh; some journalists even say that it is better to publish unreliable information quickly rather than wait for confirmation. — When journalists have information they try to verify it by comparing the points of view to the extent that they have the time. — Information has more value if its source is credible. — Journalists who deal with different facts (including accidents) are not specialists and do not have any particular competence. — The journalist who covers an event finds his information where he can from the most accessible people who are not necessarily those who are most competent or most objective. — If he wishes to ‘sell’ his article it must draw the reader’s attention with eye-catching headlines. One can deduce the best way of managing information in a crisis situation from these characteristics. One must be able to answer the press very quickly, anticipating them by taking the initiative of announcing the event as soon as possible. This supposes that this function is envisaged in the organisation of emergency plans and attributed in the same way as other intervention functions. This implies that the designated people, who must be of a good level, remain available and have received some training to enable them to inform the public correctly. Good training consists in receiving the press occasionally, cold; this also has the advantage of establishing personal relationships with the journalists and of obtaining a certain credibility. It is very important to take the initiative in information to avoid the propagation of rumours which could cause panic movements in the population, by anticipating the media. Answering the press quickly supposes that one does not wait for the drawing up of a communique by the authorities; such a communique will very probably be too late and will not answer the needs of local journalists. The information must be objective and limited to describing the facts without making any assumptions, saying what one does and

332 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

does not know. One should also say that the press will be kept informed of the first results of the enquiry. Initial information and declarations must only concern indisputable facts: — Type, place and time of the accident — Installation name — Product involved — Control measures put into practice As long as no precise figures are available, no statement should be made about the gravity and cost of the accident. Communiques transmitted to journalists by telephone or telex could with advantage be confirmed by special courrier. If the accident is large and will last for some time, once the operations are terminated, the media should be informed of the outcome. Do not try to believe that one can give a smattering of technical information to journalists concerned with various matters; they are what they are and they must be dealt with as such. For major accidents, which involve the PPI, there should be just one spokesman for industry and the administration. He should be designated a priori when the PPI is being prepared. In US emergency plans, the information for the public is carefully prepared; it includes a detailed list of journalists with no omission with their details, the procedures to be followed to facilitate their task according to the importance of the accident (making available a room with means of communication: telephones, telex, facilities for photographs, audio-visual material, cards, documentation, identification badges, record of entries/exits, reproduction apparatus, provision of food and lodging, etc.). For very large accidents which may require e.g. evacuation of the population, there is another problem of information of the public which has been mentioned above; it involves informing the people involved in the accident. Local radio and television may play a very important and positive role in the giving of orders; the organisation of a press centre thus helps in accident management. This was shown in particular in Mexico where the television gave indications on the organisation of transport of wounded by the underground to the various hospitals. In the United States, a radio frequency is reserved for the transmission of these messages.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 333

5 CONCLUSION For a long time industrialists have believed that, according to the old proverb, one should let sleeping dogs lie. As A.Giraud said recently, one must be ‘media-oriented’ because disinformation is a considerable risk for our societies and can lead to aberrations, as can be seen in certain fields. Industrialists have understood this situation very well; they have organised training sessions for communication with the media. In the Grenoble region the head of an establishment where a risky investment is underway informed the public during the administrative enquiry with a remarkable card. It is better to spend a little more on public relations and a little less on superfluous investments to increase the illusion of safety.

35 Requirements for the Planning of Industrial Hazard Alarm Systems with a view to the Application of Modern Communication Systems WOLFGANG ULRICI Ecomanagement Consultant, Bonn, FRG & G.GUTMANN Battelle Institut, Frankfurt, FRG 1 INTRODUCTION Hazard alarm systems are a special case of communication systems. Their communication qualities decide their value. The analysis in terms of communication systems has to cover three essential aspects: — The semantic aspect: what is the information to be transmitted and to whom? — The sociological aspect regarding the receivers of alarm messages: how may the public be informed without producing unwanted reactions; how may the public be prepared for potential industrial hazards? — The technical aspect, the proper solution depending on the specification of the semantic and sociological demands. We shall not discuss here the balance between increasing efforts on measures to avoid hazards and increasing efforts on better alarm system. We start from the notion that incidents can happen despite every effort to avoid them; however, if they happen they should be handled in such a manner as to minimize harmful consequences.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 335

FIG. 1. Hazard communications system characteristics.

336 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

2 BASIC GOALS AND MODELS OF HAZARD ALARM SYSTEMS First, and basically, hazard alarm systems are simply to indicate that there is danger imminent. This will advise people to protect themselves. The second task of a hazard alarm system is to inform on the character of the hazard. This is particularly important for industrial hazards when fast and well founded reactions are needed in order to protect the plant from technical as well as from secondary damage. Third, hazard alarm systems may tell people what they are expected to do next. The advice may be very simple, such as ‘seek shelter immediately’; in other cases it may be more elaborate, indicating e.g. why the orders given are necessary. Fourth, in a later phase, hazard alarm systems will provide for the means of communication among those concerned in an incident. We may distinguish two major kinds of alarm systems for different stages of the reaction on to hazard. The essential differences are found in the purpose of triggering passive or active reactions of those concerned. In this context, ‘passive’ means requiring people to take immediate action in order to protect themselves and leave the hazard to itself for the moment; ‘active’ means counteracting the hazard and turning to knowing more about it, in a later phase. These differences show up in the rates and amounts of information that are to be transferred. These characteristics are tentatively drawn up in Fig. 1, with a view to industrial hazards. Passive reaction systems are characterized by high information transmission rates, but only medium to low amounts of information to be transmitted. Active reaction systems, on the other hand, are characterized by elevated amounts of information to be transmitted; high-rate channels are required only between hazard observers/analysts, hazard management, and hazardcombating services, the other links needing only medium-rate channels. In addition to this, the number of communication partners and the direction of the channels (one-way, two-way) will have to be considered.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 337

3 SEMANTIC ASPECTS Semantic aspects are of particular importance in all those cases where information must be transmitted at a high rate, i.e. in the first, passive reaction phase, and during the active reaction phase among hazard management, hazard observers/analysts and hazard-combating services. In the first phase of industrial hazard alarm, requirements are strongest for the links between the site of the incident and the hazard management and further to the authorities, as hazard management and authorities need sufficient information in order to be able to decide on triggering the internal and public alert systems or not. For this, the alarm system must be able to yield information on the character and the severity of the hazard; any simple alarm signal must be completed by concise (for time reasons), specifie information from technical sensors and human observers/analysts that is sufficient for a well founded decision. Typical data to be transmitted are: affected plant, process involved, emissions, potential consequences, time scale of evolution. The channel width of a telephone link should be sufficient for this purpose, as the number of decision-makers will be small. In the active reaction phase, the requirements for the link between the hazard observers and hazard management will even grow, as now the information must suffice to make quick and optimal decisions for combating the hazard. The transmission of images will be necessarry. Telephone links will no longer satisfy the needs, as their channel width is insufficient; messengers may not be sufficiently fast. The other channels with particular requirements are those from hazard management and authorities towards the public during the first, passivereaction phase. The essential requirement is that alarm messages, being short for reaction time reasons, must be shaped so as to be unambiguously decoded by those concerned, particularly as communication both ways may not be feasible because of the number of communication partners, the bottleneck being the alarm centres with hazard management and the authorities. This imposes restrictions on the amount and the complexity of the information to be conveyed by the public alarm system. Even if people have been trained in general, it is never known for sure if all those concerned in an incident are indeed properly trained and if they have memorized their parts well. So it is of crucial importance to shape the passive alarm system so as to convey

338 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

easily understood, if possible self-explaining, messages leading to standard reactions. In a later stage, needs are for continuously widening public channels, but their transmission rate may slow down. However, with the public, the problem of serving a large number of people with a continuously growing amount of information remains. Some particular considerations will be necessary for this problem. 4 SOCIOLOGICAL ASPECTS A sector that is often treated with little care in the planning of hazard alarm systems is the communication of the hazard management with the public. This part of the system is seemingly unimportant for active reaction purposes. The amount of information that must reach the public is in many cases considered as minor and restrictable to the needs of the passive reaction system. In our opinion this view is inadequate. Even if the potential consequences of the hazard may be technical at the moment, the intangible consequences of neglecting the information dimension of hazards may be serious, particularly in an emancipated and critical society. Confidence in the technical and political decision structures may be essential for the survival of an industrial plant From the sociologist’s point of view, an incident is not a disaster by itself; it may, however, develop into one by affecting people and by wrong reactions. A disaster is formed by the interaction of an incident and the people concerned. Thus, knowledge of the characteristic reactions of people and of their social environment will determine, to a large extent, the design of the technical realization of the hazard alarm system. The alarm system is to guide the actions of those concerned; this will be possible only if the messages are transmitted to all those concerned, and if they are decoded by them as intended. The problem is best illustrated with people who are driving in their cars at the time of alarm. How will they be reached? How should they behave— turn to flight or seek shelter? If the latter, how are you sure to convince them that an official order to leave their cars will be to their advantage? After all, our societies are largely emancipated—some call them ‘ego’ societies—and people are not used to obeying orders if they think they know better; there is no guarantee that people will behave the way they are expected to, even if they have been trained for it.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 339

So, in order to improve the efficiency of the alarm system, sociological reasoning leads to additional requirements (which translate into technical design requirements) such as: (1) It will be generally helpful to keep the public alert signals as simple as possible, e.g. one ‘on’ and one ‘off’ sign, and to train people to just one standard reaction that will be viable in the majority of cases: ‘seek shelter and turn the radio/TV on’. This implies that people must be kept informed as long as the alarm is effective; this again implies that triggering an alarm should always include interrupting the radio programmes in favour of alarm messages. Training local people to more elaborate reactions to alert signals is a good idea in principle. However, this is a delicate point for industrial hazards, even if it can be done financially, people potentially wanting to participate in the hazard planning and to get internal details. Therefore, special training appears to be necessary only if the alert system and the standard reaction should be totally inadequate. This is not an argument against training in general but only against special training. (2) As often as possible, hazard management and authorities should provide reasoning together with orders. Arguments may (and should) be short; e.g. the order ‘seek shelter and close your windows’ may be accompanied by the reasoning: ‘fire in chemical plant at site xyz, emitting noxious gases; turn off air conditioners’. Without this, people might be inclined to turn their air conditioners to full power. It is useful to include the shaping of messages and their reasoning as early as in the hazard alarm planning phase; hazard managers should be trained for their use. A good example of this is the French alarm system Grands Barrages in which the essential messages are precisely formulated and standardized in advance. (3) The alarm message should not only contain the reasoning for the orders but also a positive message such as: ‘You can avoid harm if you act like this…; this will leave you secure for the moment; further messages will follow soon on radio and TV’. This will be clear from the consideration of the state of people at the moment of receiving the alarm; they are alarmed, they are stressed, and they will be inclined to panic. So they will be eager for precise directives as to what to do for the best and to know that their needs are cared for. (4) In an emancipated society, whoever needs more information should obtain it. This is a rather delicate point with industrial hazards, as the population and the public media tend easily to

340 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

lose confidence in official statements if there remains only the slightest suspicion that something essential and important for their well-being is hidden from them; as somehow the bad truth will come out anyway, it is important for the management to keep the initiative. On the other hand, there may be some confidential information involved that should not enter the public scene. The simplest technical solution, namely the installation, of a couple of telephone lines to a specially trained PR officer, will not work because they would tend to be quickly blocked. In addition to the amount of information needed, there is the problem of time dependence of information needs. In the first moments after an incident, the needs of the public concerned may be fulfilled by just knowing how to protect themselves, whereas afterwards more precise information will be necessary to suppress unwanted reactions such as panic or troublesome curiosity. A solution that may largely satisfy the needs of the public as a whole may consist in a quasi-intercommunicative system: telephone lines to the centres of administration and of hazard management, a link to the next radio station, and the broadcasting of information that is of common interest. This is not a solution for private problems, but it may help to manage the first problems of general interest. Moreover, the appearance of the hazard managers or their PR officers and of the authorities on the radio/TV would have the effect of demonstrating that the public is not excluded from first-rate information but rather included in the discussion of hazard management and of the consequences of the incident; this may raise public confidence in the hazard management and help to calm down public stress. Still, this does not rule out keeping certain information confidential. (5) The rules for interaction between hazard management and the public should be followed for communication among the hazard-combating services as well. This means that: — Orders to the hazard-combating services should be followed by the reasoning behind them, and suggestions on when and where to get more detailed information. — Hazard-combating services should be able to communicate with the hazard management both ways. — Messages must be unambiguous. This includes even such simple items as the naming of intervention means. Harmonizing these terms is felt to be urgent, particularly if helpers from other countries are involved, which may be the case for incidents near the borders of a country.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 341

(6) Up to now, the special role of the authorities in industrial hazard alarm systems has not been specifically considered; it was assumed that the authorities, being partly hazard management, partly public, will be informed as comprehensively and as quickly as possible. It is our opinion that this is in industry’s own interest and will not need further discussion, 5 TECHNICAL DESIGN OF HAZARD ALARM SYSTEMS 5.1 Basic principles For any technical solution to the alarm system, there are certain basic principles to be followed: — The alarm system must be reliable. — The alarm system must reach all people concerned with certainty. — The alarm system must reach those concerned in time. The first of these requirements is meant to include a guarantee against missing alarm as well as against false alarm. These two demands are to some degree contradictory, as the easier and more reliably the alarm system is triggered the more it is prone to false action because of spurious commands. There has to be some compromise. To provide proper functioning in case of hazard is probably conisdered by most planners to be more important, and most technical systems give priority to hazard warning instead of suppression of false alert, even if this should tend to blunt the instrument to a certain degree. The requirement of sure firing in the case of hazard is taken into account by providing the system with proper redundant elements. It is good technical practice to do this by establishing different systems in parallel, such as providing cars with two brake systems that work on different principles. Another guiding principle adding to reliability is the passive design of those parts of the alarm system that have to be most reliable and timecritical, e.g. the alert should be triggered by passive rather than active elements, active elements being involved only to keep the system from firing. An example of this is the railway security system that causes the engine to stop if the driver does not react

342 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

in time to a certain periodic signal. Yet another principle that produces reliability is to provide sufficiently wide and redundant information channels. In some cases it may be useful to provide the alarm system with a monitoring system indicating the orderly status of the alarm system. However, as this adds to the complexity of the system and thus provides another potential source of errors, such a monitoring system should be checked very carefully for usefulness. The second requirement means that the alarm system keeps open the lines to those concerned or provides for reliably opening them in case of hazard. Being weak elements of transmission, these channels must be properly secured. Apart from technically securing, i.e. protecting, the lines, there is a problem caused by the mobility of people. If only a few persons are immediately concerned, a portable warning system that is permanently worn may be helpful, but for large numbers of persons, such as the public, this system is not feasible. So the solution of providing different alarm systems for different phases of a disaster and for different degrees of concernedness must be adapted to the mobility and number problem. The next requirement rules out certain information media such as newspapers for high-rate information as they will not add to the efficiency of combating the hazard. So only the fastest information transmitters may be allowed at the hazard site. Finally, the alarm system should be flexible enough to make the management of unexpected situations possible. It should always be kept in mind that, even if a hazard system is planned with much care, hazards usually do not behave according to planning. The technical alarm system must be planned as flexibly as possible, without fixing too many details. 5.2 Technical options Considering the semantic and sociological requirements restricts the choice of communication means to rather few typical options: — High-rate, high-amount transmission that addresses only a few partners is provided by TV and special data transmission links. The future public ISDN (Integrated Services Digital Network) system applies digital transmission to existing telephone links and will provide data transfer rates of 64kBaud in the first stage; the technology should serve well for the purpose of future hazard alarm systems. These transmission means will be useful

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 343

for hazard observers and analysts to reports to hazard management during the active reaction phase. — High-rate, medium-amount communication among a few partners will be possible by radio or telephone links. They should be used by the hazard management to communicate with hazard observers/analysts, with the hazard-combating services in the active reaction phase, and with the authorities in the passive reaction phase. — Medium-rate, high-amount communication among few partners may be done by couriers or, better, future ISDN systems. They are to be used for communication between hazard management and authorities in the active reaction phase. — Medium-rate, medium-amount communication between hazard management and authorities, with a large number of partners, poses the greatest problem, not in the technical sense proper but rather in the sense of organizing it. A possible solution for a quasicommunicational system, including telephone links leading to the hazard management centre and to the authorities, and from there to the next radio station, the information of general interest to be broadcast from there, has been mentioned above. Still, newspapers appear to be too slow a way for mutual communication. — High-rate, low-amount communication addressing a large number of people appears to be provided best by sound signals of low information content, i.e. sirens, whistles, bells (the use of the latter is, however, not recommended, as they are reserved for religious purposes and not all people are used to paying heightened attention to them). They will be used for basic alert signals. The question may be raised of whether one should combine the hazard alarm systems for the passive and the active reaction stage into a maximal hazard communication system (cf Fig. 2). The answer is ‘no’ because, for most of the links, there is a strong time dependence of needs that are best served by different systems, with the exception of the link between hazard management and the authorities which may be served now by radio intercom, in the future with preference for ISDN

344 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

5.3 Passive reaction alarm systems 5.3.1 Links from hazard management or authorities to the public For reasons of reliable decoding, as feedback will not be feasible for most of the people concerned, alert signals should be coded as simply as possible. A single-information alert system, i.e. one that conveys just the information ‘danger’, may be appropriate for warning the public in a first step, as this will, if necessary in combination with the appropriate training of local people, suggest the proper immediate action to protect themselves.

FIG. 2. Maximal hazard communications system characteristics.

The requirement for a warning system that reaches more or less all people concerned in time with unambiguous messages leads to recommending the simple siren whose range of signals may be restricted to: — permanent continuous or oscillating sound as long as the cause for danger is in effect; — some kind of short ‘all clear’, e.g. three long pulses.

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 345

For testing purposes, the ‘all clear’ signal may be fired every now and then, even without announcement. It is a very important principle to make sure that the alert signal proper should never be fired just for test purposes. In some countries, the rather frequent firing of the whole alarm sequence for the sake of technical testing bears the risk of blunting the instrument; people tend to ignore the alarm signals. If one wants not only to convey the ‘danger’ information but also to provide more, this will raise the task of more elaborate coding (and decoding). An example of a code of proven efficiency is the Morse code. It contains four elements (the two significant ones being short pulse and long pulse, and the short and long pauses used for separation of the elements and signs) that are easily transferred with few errors. The problem then is the training needed to decode the information; this is high for radio amateurs, but there are probably not many who still remember the Morse code they learnt with the boy scouts, except for the SOS code: short, short, short, long pause, long, long, long, long pause, short, short, short. In addition, there is the problem of repeating the message on short terms in order to reach even those who did not get it the first time and to permit them to log in and get the whole message. So what appears to be possible is to code the information in short sequences of, say, up to three elements per sign. In order to decode unambiguously short pause and long pause, singleelement signs shall not be allowed, each sign denoting precisely one message. The successive elements may be given mnemotechnically easy meanings, e.g. the first element indicates the time for reaction (short/long), the second element indicates the distance to the hazard (short/long), one extra sign (e.g. three long pulses) means ‘all clear’. This means that, in order to be decoded fast and reliably, the decoding help information that must be present in memory should be as simple as possible. The siren does not appear appropriate here because of its limited potential to transfer more than the most simple signals in the short time required. Thus, for this case, another instrument such as a sonore whistle will be better suited. Incidentally, this kind of instrument is used by vehicles such as railway engines and ships, e.g. in foggy weather when short message transmission and reaction time is important. These whistles have proved to be very reliable. Even if a whistle for the transfer of complicated signals is applied, it is useful anyway to provide for siren signals as the basic alarm. This yields a unified alarm system for general use

346 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

and a superposed special system for special use. What adds to it is the notion that the whistle may be tested apart from the general alarm system, just by cutting the sirens, without the danger of misunderstandings. A slight problem exists with the reliability of this more complicated alarm system. On the other hand, this system will drastically reduce the probability of false alarm. An important aspect should be observed. As most people are equipped with radio and TV, it should be obligatory to cut any radio/TV programme in the alarmed area in favour of the transmission of information relating to the alarm and the incident causing it. Blocking radio/TV transmissions in favour of alarm messages is recommended in order to inform people comprehensively, to relieve the telephone system, and to create general confidence in the efficiency of the alarm system. 5.3.2 Links from hazard observers to hazard management and authorities In principle, the hazard management and the authorities will need high-rate, but only medium-amount, information channels in order to decide upon the alarm message to the public. The number problem will not play the same rule as with the informing of the public; however, there may still be the problem of simultaneously processing information from several sources. A couple of telephone lines leading to the hazard management centre as well as leading to the authorities will probably be sufficient for the purpose of passive reaction. The links from sensors may lead decentrally not farther than to the local control centres on site, where the signals should be interpreted first by human observers/analysts. 5.4 Active alarm reaction systems 5.4.1 Links between hazard observers/analysts and hazard management The rate and amount of information necessary in order to decide upon the most appropriate action may be enormous, particularly with industrial hazards, because of the sometimes rapid evolution of incidents. The widest high-speed information channels required

LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 347

for hazard management are TV channels, the next best solution being radio or mobile telephone. So it may be a good idea to equip the observers/analysts with light video cameras to transmit images from the hazard site to the hazard management centre. How can this information be reliably transmitted to the hazard management centre (and, for reasons of confidentiality, to nobody else)? One idea is to install a firm-based monitoring, alarming and guiding system within the firm, using microphones, cameras and loudspeakers. This will probably raise suspicions that the system might be used for other watching purposes as well; it appears that this will argue against such a system. Besides, it has the drawback of being a rather rigid, additional system that requires intensive care. Another conception might consist in using the electric power lines for transmission; they will provide the power necessary to drive the high-rate, high-information communication system, and they are available on virtually any spot of the plant. The configuration of such a system might then look like this: a portable video camera with a microphone will transmit with weak power to a local transponder/digitizer that is plugged into the next socket, from where transmission goes via the lines of the electric power system to the hazard management centre which is equipped with a corresponding receiver/decoder. The link back may be provided just by conventional radio to a receiver with the observing personnel on site. It is felt that such a system would provide for optimal flexibility, combined with guarding the confidentiality of industrial information. 5.4.2 Links from hazard management to hazard-combating services The hazard-combating services, i.e. in most cases the fire services, need portable means of intercommunication. Short-wave intercoms or mobile telephones should be best, since fixed telephone and video lack the portability required for the operating (and not just observing and analysing) personnel. 5.4.3 Links between hazard management and authorities The authorities may want elevated amounts of information, but will not need it immediately. A special telephone line, maybe in combination with a future ISDN, should be sufficient for most purposes. More than that, a future ISDN system is expected to be

348 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

particularly suited just to the needs of medium-rate, high-amount data transmission such as for the communication between hazard management and the outside, making other communication links more or less obsolete. It will be the favourite future link between them. Remote radio/TV links, possibly via satellite, may be considered if the hazard management is located far from the site of the incident; in the case of industrial hazard, the management will usually be near the site and thus not need remote links. 5.4.4 Links between hazard management or authorities and the public An idea for a quasi-commutational system has been described above. It is assumed that the industrial hazard management should have access to the authorities’ public alarm system in order to fire the alert signal if need be. The probability of misuse appears to be minimal. 6 CONCLUSIONS In this paper, it is suggested that sociological aspects be increasingly considered when planning industrial hazard alarm systems. It is important that this should include the close cooperation of industrial systems and of the authorities as well as the information policy towards the public, and that the technical systems are designed according to the needs of those. Regarding new communication technologies, the coming appearance of wide-channel telephone (ISDN) technology will offer a good opportunity to reshape the communication systems among the hazard management, hazard-combating services, and the public authorities towards better efficiency. However, for the purpose of triggering the alarm and of setting the passive reaction system into action, the existing means of sirens, whistles and radio/TV appear to be sufficient if properly organized.

CONCLUDING SESSION Panel Discussion and Conclusions Chairman: R.W.KAY Formerly Health and Safety Executive, UK Panel members: P.BOISSEAU, France H.B.F.Gow, CEC J.HEFFERNAN, Ireland E.L.QUARANTELLI, USA H.SCHNADT, FRG B.WYNNE. UK

36 Summary of the Concluding Session

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING In the first session, papers were given on the organisational aspects of emergency planning for chemical accidents in Germany, Italy, UK and France. Within these countries there were significant differences in the way responsibilities had been allocated between various authorities. Three countries had already implemented laws which dealt specifically with the Seveso Directive but Italy as yet did not have such a law and was dealing with the matter through a number of administrative measures in which a network of ministries and organisations was involved. Within most countries, a framework had already existed for the tackling of emergencies, and the introduction of the Seveso Directive had drawn further attention to the industrial sites which presented major accident hazards. In such situations, the first step was the identification of the hazard, followed by an assessment of the consequences of possible accidents and then the drawing up of emergency plans which could mitigate these consequences, both on- and off-site. In Germany, problems had been identified in some instances in producing site-specific emergency plans, particularly in rural areas, and this had led to proposals for amendments to the regulations and for the preparation of further guidance. In France, there was a considerable history of emergency planning for industrial establishments, and the organisation and means necessary had to be specified. This led to proposals for on-site plans (POI) which were the responsibility of the manufacturer, and off-site plans (PPI) which were drawn up under the authority of the Prefect. In the UK, the responsibility for off-site planning had been given to the local authority at county or equivalent level.

CONCLUDING SESSION 351

Although there were different legal backgrounds and organisational structures in these countries, emergency planning had been organised to produce the same positive effects. Implementation of the requirements of the Seveso Directive was easier in cases where there was already a suitable framework in existence. ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN In the discussions of the design of emergency plans, there was a general convergence of points of view. Some differences did emerge in the approach of different countries, although these were more of a practical than a fundamental nature. The first stage was the preparation of an accident scenario which determined the type of warning system, the level of resources required and the amount of coordination that was necessary. There were many difficulties in predicting the consequences of accidents, and this was an area in which further work was in progress. It was stressed that plans must be flexible and well defined. When a major emergency occurred, the first need was for a rapid response, and plans should therefore be as simple as possible. In the design of emergency plans, an essential feature was the definition of the people who had to carry out various functions, and the thorough training of those people in their roles. It was also necessary to define the type of cooperation that was required, in particular between industry and the authorities. Two particularly important roles were identified: the operational controller who is responsible for the direct response to the incident, and the coordinator who ensures liaison with outside bodies. Particular stress was laid on the need for effective communications to factory personnel, between authorities, to the outside public and, also very important, to the media. Finally, there was the need for realistic exercises to check the design of the plan and to ensure that it was kept up-to-date. In this way, the roles of the participants and the overall experience could be evaluated. EXERCISES AND AUDITING OF EMERGENCY PLANNING Throughout the conference, it was emphasised that an emergency plan that is placed on a shelf to gather dust is worthless and that

352 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

there must be effective exercising and review of these plans. During the discussion of these particular aspects, both theoretical and practical considerations were addressed. Examples were given of theoretical models that could be used to evaluate the effectiveness of existing plans, and to simulate the results of an exercise. Modelling could also be a useful tool in designing practical exercises. It was an essential part of emergency exercises that they should be drawn up with clear objectives in mind. Table-top exercises provided a useful way to test procedures, but practical exercises, which involved moving men and equipment, should also be carried out. As a result of exercises, faults had been revealed; these included the non-availability of key personnel, alterations in telephone numbers, defective equipment, and a lack of understanding of the roles of others. During the initial stages, the sequential telephoning of key personnel took time; in some cases it had taken up to an hour to get management staff members to their posts. There was also the danger of overloading communication systems. One consequence of the need for immediate response, and the lack of immediate availability of some personnel, meant that units would initially operate with only 50% of their manpower. Once the exercise had been completed, it was most important to evaluate the experience that had been gained and to assess the performance of the participants, particularly those in key positions. In the course of this session, two issues with general implications were also discussed. There was the need to provide the emergency services with information so that they could instantly identify the dangerous substances involved and their possible effects. The other question related to evacuation. When and how to evacuate would always prove a difficult problem. Often, the safest procedure for the public was to remain indoors with doors and windows shut, and the point was made that evacuation should only be considered as a last resort. TECHNIQUES FOR EMERGENCY PLANS The great interest in the application of techniques for emergency plans was reflected in the range of discussions in this section. There was considerable interest in the use of computers as tools for planning and protection activities. An overview was also given of the possibilities and limitations of expert systems and other artifical intelligence methods. Finally, technical data were provided from which the hazards presented by industrial installations could

CONCLUDING SESSION 353

be assessed; from this information, the need and extent of emergency planning could be determined. Computers and modern information techniques provided a wide range of applications, and examples were given of off-line programmes that had been developed for risk analysis, storage and retrieval of information, and also for developing the background for accident scenarios as a basis for planning for emergencies. A more direct application lay in on-line systems for computerised alerting systems, assessing the actual extent of an incident using data from atmospheric sampling/meteorological measurements, and assessing the possible consequences of emergency measures. Because of the rapid nature of the development of major emergencies, questions were raised as to the availability of computers and measuring devices in the early stages. With fixed installations, one solution might be to collect data by means of permanent monitoring systems. There was rapid development in the field of information technology as systems achieved greater and more rapid response and more flexibility. With respect to the application of expert systems, it appeared that their use for support of the decisionmaking process in emergencies is premature. However, promising lines of research were being pursued. There would also be further opportunities to develop the use of modern information technology and computerised tools in evaluating problems and assisting in their solution. LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS The lessons learnt from major incidents were of two kinds: those related to a specific emergency and those where the lessons could have a much wider application. Indeed, it was pointed out that the study of incidents in fields other than industrial hazards would often establish repeat patterns. In order that a correct interpretation of these events could be made, it was necessary to establish a suitable framework for comparison. There was also a need to ensure that information from the lessons would reach the people who were most in need of it. A study of major incidents in America had emphasised the importance of considering emergency planning as a process. This led to a deeper understanding of the phenomena arising in disaster situations and would enable emergency managers to cope with unforeseen configurations. Unexpected events often occurred

354 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

in the crisis phase of disasters; a robust overall plan was needed which could be applied to these situations. Examples were given of the way in which post-mortems on specific incidents had led not only to proposals for technical improvements but also to the consideration of wider issues, such as the organisation of the emergency services. In some cases, because of a poor and confused response to an emergency, changes had been made to local authority organisations. In extreme cases, the severity of a major incident could be such that action was decided on a national level and could lead to changes in the law dealing with industrial installations. INFORMATION TO THE PUBLIC PRIOR TO AND DURING AN EMERGENCY In the Seveso Directive, Article 8.1 requires that persons liable to be affected by a major accident be informed in the appropriate manner of the safety measures and the correct behaviour to adopt in the event of an accident. There was considerable concern from industry initially that the provision of this information could cause unnecessary public alarm. However, experience has shown that this was not the case and that the public was more realistic about the appreciation of risks than had generally been believed. There were a number of areas in which information was necessary: the need to alert people that they lived near an industrial activity with the potential to cause a major accident, the nature of the hazard that could be presented, and the type of action that should be taken in the event of an emergency. One result of this process was that industry had found that it paid to be as open as possible, and it was suggested that, while no attempt should be made to conceal the hazard, attention should also be drawn to the efforts that had been made to ensure that the plant operated safely and, indeed, to stress the economic benefits provided by the installation. Relationships with the media were also very important, particularly to prevent misinformation during an actual incident. There were different ways in which information could be supplied but they all should be aimed at clarity and simplicity. It had been found that there was a much greater impact if personal contacts were made. A review was also given of the requirements for alarm systems. During an actual emergency, it was accepted that radio provided the best means of communication but there was some difference of opinion about the effectiveness of loudspeaker vans.

CONCLUDING SESSION 355

Finally, if an evacuation was required, it would be necessary to explain to the public the necessity for this step and the facilities that were available. SUMMARY AND CONCLUSIONS The conference has shown that there is worldwide interest in emergency planning. This was reflected in the number of papers from different countries and in the information that was presented and discussed. There is basic agreement on the approach to emergency planning but some practical differences are inevitable owing to different national structures. The presentations showed that some common problems exist. For example, there are difficulties in predicting the consequences of an accident and hence the area likely to be affected in an emergency. Also, the very nature of an emergency plan can require quite complex relationships between manufacturers, emergency services and local authorities. The involvement of the public can also present difficulties. One of the common themes of the conference was the need to continue working on the improvement of emergency planning systems. This leads to some general conclusions: (1) The problem of communication with the public deserves further debate. The content of the communication and the means of its transfer to the media should be further investigated. It might be food for thought to consider the organisation of a special ‘workshop’ to cover these points. (2) There is a need to continue to exchange information and experience on emergency planning. The conference provides a good example, and the Commission (DG-XI) should consider how to build on the work in progress. (3) The establishment of general guidelines would be beneficial. This work could draw on the experience of countries with advanced emergency planning systems and lead to a consistency of approach. Such a device could prove particularly useful in situations where sophisticated resources are not always available, for example in small factories, in some types of storage and in rural areas. The framework so created could also provide useful information for installations that fall outside statutory requirements. However, there are some issues that need to be further investigated before formalising guidelines, in particular the relation between the content of a safety report and emergency planning, especially those linked with the development of probable or worst case scenarios and consequently preparedness, when and

356 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

how to evacuate, integration of plans from other plant in the vicinity, safety distances and allowable doses, available monitoring and alerting systems, existing expert and data base resources, etc. (4) The progress occurring in the field of advanced informatic tools should be carefully followed and encouraged. It is to be hoped that, in the near future, user-friendly informatics for use in emergency management will reach maturity and hence play an important role in this and other related fields.

LIST OF PARTICIPANTS

Amendola, A. CEC—JRC Ispra JRC Ispra Establishment Ispra Varese Italy Ancarani, A. CEC—DG XVII 200 rue de la Loi Bruxelles Belgium Ancillotti, P. Via Luigi Settembrini 52 Milano Italy

São Paulo Brazil Avouris, N. CEC—JRC Ispra JRC Ispra Establishment Ispra Varese Italy Bardolet Casellas, J. Direccio General de Provencio Via Layetana 69 08003 Barna Spain

Andersen, V. RISO National Laboratory 4000 Roskilde Denmark

Barone, D. ENICHEM Anic Piazza Boldrini 1 20097 S.Donato Milanese Milano Italy

Arioli, G. SNAM Progetti S.Donate Malanese Milano Italy

Baun, A. Danish Police Ridderstraede 1 2100 Copenhagen Denmark

Arpe, F.L. Danish Civil Defence and Emergency Planning Agency 18 Vordingborggade 2100 Copenhagen Denmark

Bellamy, L. TECHNICA Ltd. Lynton House 7–12, Tavistock Square London WC1H 9LT UK

Aventurato, H. CETESB—Environment Ag. Av. Prof. Frederico Hermman Jr., 345

Bellamy, S. St.Giles College 16 Northumberland Avenue London WC2 5AP UK

358 LIST OF PARTICIPANTS

Bernard, P. BEFA GMBH Postfach 8901 5030 Huerth FRG Binetti, L. Ministero Sanità Via Liszt 34 Roma Italy

Civil Defence Corps 18 Vordingborggade 2100 Copenhagen Denmark Bressan, L.GRENFIL Via Emillia Ponente Imola Italy

Birden, J. Inspection du Travail 26 rue Zithe Luxembourg

Brynjulusen, J. Norwegian Petroleum Directorate PO Box 600 4001 Stavanger Norway

Blok, M. Province of South-Holland Konigskade 1 2596 AA The Hague The Netherlands

Caputo, G. ROHM and HAAS Italia SpA Via V.Pisani 26 Milano Italy

Bo, E. Ass. Europeenne Gas Liquefile Paris France

Caroselli, R. Ministero Sanità Via Listz 34 Roma Italy

Boato, P. Centre Italiano CTL Corso Venezia 37 Milano Italy Boisseau, P. Ministry of Environnement/ DRIR 84 rue de Faretra Toulouse France Boissieras, J. RHONE POULENS TcL 129 rue Servient 69398 Lyon France Bork Kristoffersen, K.

Carrasco Arias, V. Gobierno Civil Protec. Civil Avda Marques de la Argentera S/N Barcelona Spain Casarino, S. AGIP Raffinazione ENI Piazza Della Vittoria 15 16121 Genova Italy Cassidy, K. HSE Room 405—Magdalen House HSE Stanley Precinct

LIST OF PARTICIPANTS 359

Bootle Merseyside UK Chiesa, G. AGIP Raffinazione SpA S.S. 33 del Sempione 20017 Rho Milano Italy Cipolla, F. Ministero Protezione Civile Via Ulpiano 11 Roma Italy Clausen, B.O.A. Topsikring A/S 4 Borupvang 2750 Ballerup Denmark Consolini, L. SAGERI 2 rue Ancelle 95521 Neuilly-sur-Seine France Cooney, W. Cleveland County Fire Brigade Endeavour House Stockton Road Hartlepool Cleveland TS25 5TB UK Corigliano, L. MONTEDIPE SpA Via Rosellini 15–17 20124 Milano Italy Corti, F. Gruppo LEPETIT Via G.Murat 23 20159 Milano

Italy de Marchi, B. Inst. of Int. Sociology Via Malta 2 3417; Gorizia Italy de Palma, G. Vigili del Fuoco Via Valleggio 15 Como Italy de Witt, H. BRENK SYSTEMPLANUNG Heinrichsallee 38 5100 Aachen FRG del Bino, G. CEC—DG XI 200 rue de la Loi Bruxelles Belgium Dickie, T. CEFIC—BP Chemicals Limited Boness Rd Grangemouth Stirlingshire Scotland Egidi, D. Regione Emilia Romagna Via dei Mille 21 Bologna Italy Essery, G. ICI Safety & Environm. Department ICI PO Box 8 Billingham Cleveland UK Fary, R.

360 LIST OF PARTICIPANTS

Energiesystem Nord GMBH Walkerdamm 17 2300 Kiel FRG

Av. Prof. Frederico Hermman Jr., 345 São Paulo Brazil

Feliu, M. Generalitat de Catalunya C/Via Layetana 69 Barcelona Spain

Genesco, M. Ministry of the Interior 1 Place Boauvau Paris France

Filippelli, G. ENEL CEN ‘E.Fermi’ Saluggia Italy

Gilby, E.V. Electrowatt Engineering Services Stanford House Garrett Field Science Park South Birchwood Warrington Cheshire WA3 7BH UK

Folino, M. DATAMAT SpA Via Simone Martini 126 Roma Italy Fox, R. FIAT Engineering-Torino c/o Ministero Protezione Civile Via Ulpiano 11 00193 Roma Italy Galvan, D. CRE Casaccia SP Auguillarese 301 00060 S.M.di Galeria Roma Italy Garay Unibaso, L.A. Altos Hornos de Vizcaya C/Carmen 2 Baracaldo Vizcaya Barcelona Spain Garcia, F. CETESB

Gilby, P.M. GILBY Associates Nethertoun Glebelands Road Knutsford Cheshire WA 16 9DZ UK Ginex, G. Comando Prov.le VV.F. Via Gregorio XVI 3 32100 Belluno Italy Ginnity, B. Bruel & Kjaer A/S 2850 Naerum Denmark Giocoli, R. AGIP Petroli SpA Via Launentina 449 00142 Roma Italy Gomes da Silva, M.E.

LIST OF PARTICIPANTS 361

Direccae Geral da Industria Av. Cons. Fernando Sousa 11 Lisboa Portugal Gow, H. CEC—JRC Ispra JRC Ispra Establishment 21020 Ispra Varese Italy Graziano, A. Ind. Chim. FRANCIS SpA Via Origgio Caronno P.lla Varese Italy Greenhill, J. North East Thames Regional Health Authority UK National Health Service Addison House 32–43 Chart Street London NI 6GP UK Gremmen, J. Dow Chemical Europe Sa. Aert Van Nesstraat 45 The Hague The Netherlands Grollier Baron, R. Inst. Français du Pétrole BP3 69390 Vernaison France Guerrini, V. NIER Via Stefano Bologna Italy

Gullo, F. Industria Italiana Petroli S.S.Jonica 74100 Taranto Italy Haddad, E. CETESB Environment Ag. Av. Prof. Frederico Hermman Jr., 345 São Paulo Brazil Heffernan, J. Department of Labour Mespil Road Dublin, 4 Ireland Heffernan, M. ASAHI Synthetic Fibres Killala Co. Mayo Ireland Hesel, D. TUEV Rheinland Postfach 101750 5000 Koeln 1 FRG Holt, E. Norsk Hydro AS PO Box 646 5001 Bergen Norway Holtbecker, H. CEC—JRC Ispra JRC Ispra Establishment Ispra Varese Italy Honan, M. ASAHI Synthetic Fibres Killala

362 LIST OF PARTICIPANTS

Co. Mayo Ireland Johansen, P. Statens Brnadinspektion Kongevejen 207 Copenhagen 2830 Denmark Kahl, H. Linde ag Industrial Gas Div. Seitnerstrasse 70 8023 Hoellriegelskreuth FRG Kal, E. Province of South-Holland Konigskade 1 2596 AA The Hague The Netherlands Kay, R. (formerly Health and Safety Executive, London) Cotswold St. Johns Close Penn Bucks HP10 8HX UK

Lepore, L. ISPESL Via Urbana 167 00184 Roma Italy Loprieno, N. Università di Pisa Via Damiano Chiesa 5 56100 Pisa Italy Lucchini, L. FAI Via Cardano 8 Milano Italy Macchi, G. USSL 68 Rho (MI) Via Galdino da Varese 27 Varese Italy Madsen, F. BRUEL & KJAER A/S Naerum Hovedgade 18 Copenhagen 2850 Denmark

Lambardi, L. ANSALDO SpA Via D’Annunzio 113 Geneva Italy

Mancini, G.M. Dipt. Protezione Civile Ufficio Procivil. Ind. Via Ulpiano 11 Roma Italy

Lanzino, M. ICARO Srl Via Sonnino 9 Pisa Italy

Mangialavori, G. ENEA—DISP Via V.Brancati 48 Roma Italy

Leonardini, L. ETS Via Cisanello 32 56100 Pisa Italy

Mammone, I. Vigili del Fuoco Via Gnocchi 22 Como Italy

LIST OF PARTICIPANTS 363

Marangoni, G. DNS SpA Via Nazionale 59 Merano Italy

TECHNICA Limited Lynton House 7–12 Tavistock Square London WC1H 9LT UK

Marchant, T. Emergency Planning Advisory Committee 590 Jarvis Street Toronto Ontario Canada

Melis, M. EDRA Srl Via Gradisca 8 20151 Milano Italy

Marchionne, E. Ministero degli Interni Via De Pietro Roma Italy Mariano, J.A.M. ISOPOR—Ca. Portuguesa de Isoc. Apartado 30 3861 Estarreja Codex Portugal Marlier, G. ELF France 2 Place de la Coupole B. 24D03 Cédex 45 92078 Paris La Defense France Marshall, V. 5 Ivy Road Shipley West Yorks, UK Mattia, G.M. BRUEL & KAER Viale U.Tupini, 116/2 001444 Roma Italy Max-Lino, R.

Mellin, B. BPCI 80 New Forest Drive Neath UK Michell, P.D. UKAEA Srd Wigshaw Lane Culcheth Warrington Cheshire UK Milone, I. AGIP Petroli SpA Via Laurentina 449 00142 Roma Italy Mocke, F. ESCOM PO Box 1091 Johannesburg South Africa Montini-Trotti, M. ENEA (Dir. Studi) V.Regina Margherita 125 00198 Roma Italy Mostarda, M. FLEXA SpA Via Custodi 25 Italy

364 LIST OF PARTICIPANTS

Mueller, G. Rheinisch Westfaelischer Technischer Ueberwachungs-Verein Steubenstrasse 53 4300 Essen 1 FRG Neuhoff, S. Cologne Fire Brigade 5000 Koeln 60 Scheibenstr. 13 FRG Nicolau, J. Servigo Nacional de Proteccao Civil Rua de Bela Vista à Lapa 57 Lisboa Portugal Nivolianitou, Z. Ministry of Housing & Environment Athens Greece Odou, M. Min. Van De Vlaamse Gemeensch. Belliardstraat 18 1040 Bruxelles Belgium Olivier, P. VINCOTTE Avenue du Roi 157 1060 Bruxelles Belgium Olivieri, M. DATAMAT SpA Via S.Martini 126 00143 Roma Italy O’Reilly, C.

London Fire and Civil defence Authority 20 Albert Embankment London SE1 7SS UK Paesler-Sauer, J. Kernforsch. Zentrum Karlsruhe 7500 Karlsruhe FRG Paranhos Teixeira, A. Civil Protection Nat. Service Rua da Bela Vista à Lapa 57 Lisboa Portugal Pares, X.Cap. del Servei d’Ordenacio i Seguretat Vial Ajuntament de Barcelona Av. Portal de l’Angel 8 08002 Barcelona Spain Pesarini, M. GALSTAFF Ind. Ch. SpA Via Stazione 90 Mornago Varese Italy Picciolo, G. ENICHEM S.Donate Milanese Milano Italy Pietersen, C.M. Society TNO Aeldoorn The Netherlands Poli, U. ISPESL Via Urbana 167 00184 Roma

LIST OF PARTICIPANTS 365

Italy Pozzi, D. Ass. Ind. Varese Piazza Monte Grappa Varese Italy Pruess, M. Dow Chemical GMBH PO Box 1120 2160 Stade FRG Pucciarelli, L. ENEA—DISP—ARA—SCA Via C.Brancati 48 00144 Roma EUR Italy Quarantelli, E. Disaster Research Center University of Delaware Newark Delaware 19716 USA Raadsen, W. SHELL Int. Petr. My. PO Box 162 2501 AN The Hague The Netherlands Ribeiro de Almeida, A. National Fire Service Rua Julio De Andrade 7 Lisboa Portugal Ricchiuto, A. ENEA—DISP Via V.Brancati 48 Roma Italy Rossi,F. F.lli Lamberti SpA Via Piave 18 Albizzate

Varese Italy Rubino, F. SNAM Progetti S.Donato Milanese Milano Italy Rueda, S. Cap. Unitat Operativa de Gestio Ambiental Ajuntament de Barcelona Pg. Circumval.lació 1 08003 Barcelona Spain Sacchetti, R. Comandante Vigili del Fuoco Via Legnani Varese Italy Saltroe, P. Norwegian Petroleum Director PO Box 600 4001 Stavanger Norway Samain, A. Min. Santé Publ. & Envir. Bruxelles Belgium Schlanbusch, F. Norsk Hydro SA PO Box 646 5000 Bergen Norway Schnadt, H. TUEV Rheinland Postfach 101750 5 Koeln 1 FRG Schouteten, L.M.E. DSM—CVMD

366 LIST OF PARTICIPANTS

PO Box 603 6160 MH Geleen The Netherlands Selig, R. Cons. Engineers & Planners A/ S Houedgaden 2 PO Box 51 Birkeroed Denmark Semprini, F. SNAM Progetti V.A.De Gasperi 16 S.Donate Milanese Malano Italy Serafini, A. Via Bordoni 4 Milano Italy Serafini, S. Comando Prov.le Vigili del Fuoco Via Gregorio XVI 3 32100 Belluno Italy Sesenna, F. ENICHEM Agricoltura VIA Medici del Vascello 26 Milano Italy Siegmund, H. Ministerium des Innerns Schillerplatz 3–5 6500 Mainz FRG Sigales, B. Univ. Politecnico Catalunya Av. Diagonal 647 08028 Barcelona

Spain Singleton, B. Dow Chemical Company King’s Lynn Norfolk PE30 2JD UK Smyrniotis, T. CEC—DG XI 200 rue de la Loi Bruxelles Belgium Stallen, P.J. TNO PO Box 541 Appeldoorn The Netherlands Steininger, S. Dornier System GMBH PO Box 1360 7990 Friedrichschafen FRG Steur, W. Bayer AG Fackbereich Brandschutz D—5090 LeverkusenBayerwerk FRG Tasias, A. Tema-Terr.y Medio Ambiente S.Juan De La Salle 6 08022 Barcelona Spain Testori Coggi, P. CEC—DG XI 200 rue de la Loi Bruxelles Belgium Toft, B. University of Exeter Department of Sociology

LIST OF PARTICIPANTS 367

Amory Building Exeter UK

Via Desenzano 17 20146 Milano Italy

Tognoli, M. ORSA Via Colombo 60 Gorla Minorc Italy

Vallmes Rodoreda, M. INKE SA Po. Ind. Can. Pelegri Barcelona Spain

Tominez, M. SNAM Progetti S.Donate Milanese Italy

Van den Brand, D. Province of South-Holland Konigskade 1 2596 AA The Hague The Netherlands

Tuite, R. Calor Teo. (LP Gas) Longmile Road Dublin, 12 Ireland Tuohy, B. Department of Environment Custom House Dublin, 1 Ireland Turner, B. University of Exeter Department of Sociology Amory Building Exeter UK Ulrici, W. ECO Consult Bluecherstr. 13 5300 Bonn 1 FRG Uth, H.J. Umweltbundesamt Bismarkplatz 1 1000 Berlin 33 FRG Valerio, E. USSL 68 Rho (MI)

Van der Hooft, M. AKZO NV PO Box 186 6800 LS Arnhem The Netherlands Van der KOOI, H.O. Ministry of Social Affairs and Employment DG of Labour Balen van Andelplein 2 NL—2273 KH Voorburg The Netherlands Van Duin, M. Research University Leiden Rapenburg 59/2311 GY Leiden The Netherlands Van Leidekerke, M.H. CEC—JRC Ispra JRC Ispra Establishment Ispra Varese Italy Vassilopoulos, M. Ministry of Envir. 147 Patission Str. Athens

368 LIST OF PARTICIPANTS

Greece Versino, B. CEC—JRC Ispra JRC Ispra Establishment Ispra Varese Italy Versteeg, M.G. Ministry Vrom Drvd Stamstraat 2 Leidschendam The Netherlands Villanueva Munoz, J.L. Jefe Servicio Prot. Civil C/Caballeros, 9–2c Valencia Spain Volpe, F. TOP Srl Via San Lorenzo 12–9 16123 Geneva Italy Volta, G. CEC—JRC Ispra JRC Ispra Establishment Ispra Varese Italy Wallace, W. Rensslaer Polytechnic Inst. 110 Eighth Street Troy NJ USA Wendler, E. CEC—JRC Ispra JRC Ispra Establishment Ispra Varese Italy Wynne, B.

University of Lancaster Lancaster LA1 4YN UK Zanarelli, G.C. Stone-Webster V.le Regina Margherita 11 Monza Milano Italy Zanelli, S. Università di Pisa Via Diotisalvi 2 56100 Pisa Italy Zani, F. Syreco Srl Via Roma 1 Besozzo Varese Italy Zanuzzi, G. ENEL Via F.Ferrara 36 Roma Italy Zappellini, G. NIER Bologna Via S.Stefano 16 Bologna Italy Zaro, G. CEDA Srl Via Cagnola 29 Gazzada Varese Italy

Index

Accident inquiries, 298, 299–301 Accidents, emergency action for, 23–4 Act on Calamities, 93 Adiabatic Expansion, 118 Advisory Committee on Major Hazards, 33, 206 Alarms, 151, 152, 155–7, 160, 332, 343–56 active reaction, 354–6 basic goals and models, 345 basic principles, 349–51 links between hazard management and authorities, 355 links between hazard management or authorities and the public, 356 links between hazard observers/ analysts and hazard management, 354–5 links from hazard management or authorities to the public, 352– 4 links from hazard management to hazard-combating services, 355 links from hazard observers to hazard management and authorities, 354 passive reaction, 352–4 procedures, 96–7 semantic aspects, 343, 345–56 sociological aspects, 343, 346–9 technical design, 349–56 technical options, 351–2

Alert schedules, 91 Ammonia, 108, 118, 197 Appropriate information, 325 April Storm, 69 ARIES Emergency Centre, 129–30 Artificial intelligence, 171–2 Association of Civil Defence and Emergency Planning Officers, 40 Auditing, 155–63, 360–1 Back-distance, 119, 122 Bantry Bay, 205 Basle, 3, 206 Bayer AG, 328 Bhopal, 3, 35, 36, 191, 194, 205, 251, 255, 317, 327 Bromine, 243 Cambrian Colliery, 301 CECOP, 168 CFK, 243 Chemdata, 137 CHEMIC, 22 Chemical agents, 252 Chemical emergencies, 115–31, 167–9 251–73 cross-societal applications, 271– 2 impact contingencies, 263– 6 Chemical emergencies—contd. implications of research study, 270–1 initial response, 257–62 managing responses to, 255–72 protection measures, 159–60

369

370 INDEX

situational contingencies, 266– 70 Chemical engineering, 205 Chemical Industries Association, 64, 136 Chemical industry, 7, 108, 155, 243–4, 336 Chemical installations, 85–97 Chemical Security Group, 168 Chemical substances, 17, 43, 81, 137 Chemistry, 205 Chemsafe, 136 Chernobyl, 178, 323 Chlorine, 108, 118–22, 124–7, 217, 218 CIMAH, 34, 36, 63, 70, 83, 137, 206, 208, 212–13 Civil defence, 31–2 Civil Defence Act 1948, 32 Civil Defence Corps, 275–6 Civil protection, 26–8, 28–30, 31 Civil Protection in Peacetime Act 1986, 34 Classification Packaging and Labelling of Dangerous Substances Regulations 1984 (CPL), 135 Cleveland County Fire Brigade, 133–15 Cologne, 74, 155–60, 243–6, 328 Communication(s), 37–8, 96–7, 143, 151–2, 299–300, 343–56 problems of, 157–8, 286 Community Awareness and Emergency Response program, 317 Community disaster preparedness, 254–5 Community social organization patterns, 253–4 CONOCO, 69 Control of Major Industrial Hazards Regulations 1984. See CIMAH Co-operation, 81–4 Coordination problems, 286–7 County Emergency Planning Officers’ Society, 40

Credibility, 336–8 Crisis situation, information for, 338–2 Dangerous Substances (Conveyance by Road in Road Tankers and Tank Containers) Regulations 1981, 134, 135 Danish National Fire Inspectorate (DNFI), 162 Dansk Olie & Naturgas A/S (DONG), 161–3 Data banks, 24–6 Dayton, 252 Decision making, 158–9 Decision support systems, 219–40 artificial intelligence approaches, 222–4 cognitive control domain, 226 decision sequence, 225 emergency response, for, 173–7 framework for analysis and design of, 225–6 implementation of, 226–35 management information, and, 219–24 management science approach, 220 mental strategies and heuristics, 226 mitigation resource domain, 227 nuclear power installations, 235 potential risk domain, 227 problem domain, 225, 226–7, 234 social science approach, 220 state of the art, 219–24 system science approach, 220–2 use of problem representation, 230–5 Denmark oil and natural gas transmission, 161–3 oil pollution control, 175–81 Dense Cloud Dispersion, 118 DENZ code, 123 Dielheim, 247

INDEX 371

Disaster Law, 288 management, 287–8 preparedness planning, 252–5 Prevention Management, 155, 157–8, 244 Prevention Plan, 74 Prevention Service, 155–7 Research Centre (DRC), 251 Response Act, 88 tourism, 285 DSM, 283–92 Dutch Association of Chemical Industries, 322 EMERCOM, 26 Emergency Control Centre, 65–9, 211 Emergency Coordinator, 115, 120, 121, 126 Emergency planning, 208–12 accidents, for, 23–4 organisations implementing, 359 Emergency Planning and Community Right to Know Act, 317 Emergency Planning Authority, 211 Emergency Planning Officer, 38– 40, 211 Emergency plans definition, 47 design of, 203 establishing, 47–57 example, 56–7 external, 21–4 field of application, 48–9 manual, 49, 50–1 recommendations, 52–6 stages for realisation of, 49–50 technique, 36–40 techniques for, 361–2 Emergency response decision support for, 173–7 to release of toxic substances, 185–90 Emergency Services, 65–70, 81, 82

ENEA/DISP, 118, 128–9 EPDES (Emergency Planning DESign) code, 201–3 Estarreja, 107–13 European Commission, 317 European Disaster Medicine Centre, 41 Evacuation, 91–2, 97, 143–4, 160 Exercises, 38, 83–4, 97, 115–31, 155–60, 212, 360–1 aim and execution of, 156 Danish oil and natural gas transmission, 161–3 off-site, 107–13 on/off site emergencies, 137–40 physical-type, 139–40 table-top, 138 Expert systems, 167–9, 171–83, 222–4 Explosions, 217, 245–6, 248–9, 283–5, 301 Explosive materials, 207, 210 Exposure area, 330–1 Falkirk District Council, 83, 84 Federal Anti-Pollution Act, 88 Federal Republic of Germany chemical plants, 85–92 exercises and auditing, 155–60 major accidents, 243–9 protection in vicinity of hazardous plants, 3–15 safety concept, 9–12 Feyzin, 285 FIAT-SDT, 22 Fire accidents, 293–5 Fire-fighting, 95 Fire services, 327 Fireball effects, 216 Fixed-site situation, 255–7 Flammable materials, 6, 118, 207, 210, 215 Flixborough, 33, 36, 205, 283, 288 France, emergency and intervention plans, 43–4, 99–113 Garmisch-Partenkirchen, 248–9

372 INDEX

Gas escape, 191–8 GC/MS devices, 186 GEN-X expert system, 179 Grangemouth, 81 Greece, 293–5 Hazard analysis, 3–9, 36 areas, 78 assessment, 209 containment, 63 definition, 141–2 effect, 142 elimination, 63 identification, 141–2, 209 level, 119, 120, 121, 122, 125 protection measures, 327–33 Protection Plan, 74, 75–9 reduction, 63 sources, 78, 89 Hazardous activities, risk analysis of, 192–3 Hazardous installations, 208 identification of, 4 notification and survey of, 34 Hazardous materials, 63, 118 transportation of, 134 Hazardous substances, 78, 89, 206 categories of, 6–9 Hazardous Substances (Labelling of Road Tankers) Regulations 1978, 135 Hazards, forms of, 90 Health and Safety Executive, 135, 206, 207, 213 Hospitals, 144 Hydrocarbons, 217 Incident control, 140–5 Control Point, 65 Controller, 68, 211 mitigation, 63 procedures, 137 Incompatible land uses, 208 Indian Point Nuclear Power Plant, 179

Industrial Emergency Plan, 93–7 basic elements of, 94 Industrial Head Coordination, 94 Industrial health service, 96 Industrial risk, 335–42 Industrial safety service, 95 Information and Calculation System, 197–8 Information brochure, 331 Information problems, 286 Information requirements, 55, 152– 3, 212–13, 331–2, 335–42, 363 Information sources emergency management resources domain, 230 potential risk domain, 230 Information systems for emergency management, 224 Information technologies, 182 In-house operating plan. See Onsite In-plant incidents, 66–7 In-plant training, 69–70 Internal Plan of Operation (IPO), 47 In-transit incidents, 255–7 Italy, monitoring of industrial activities, 17–30 Jet Oil terminal fire, 293–5 Kalochori, 293–5 Labour Circumstances Law, 288 Labour protection, 288 Labour safety, 288 Læsø, 275–81 Large inventory top tier sites (LITTS), 207 Law for Protection against Catastrophes, 73–9 Law of Classified Installations, 43 Law on Local Preparation Plans, 288 Learning from disasters, 297–313 Legislation, 205–18 Leverkusen, 328, 329 Leverkusen Model, 75

INDEX 373

Limburg, 284, 285 Liquefied gas explosion, 248–9 Liquefiee gas tanker, 247 Liquefied petroleum explosion, 252 Local Authorities, 64, 65, 128, 144 Local Government Act 1972, 33 Logistics, 37–8 London Fire and Civil Defence Authority (LFCDA), 34, 39 LPG, 191–8, 215, 244–5 Macintosh Filevision, 301 Maintenance, 38 Major Accident Hazards of Certain Industrial Activities, 317 Major Hazard Regulations, 73, 76–9 Major hazards, 205 Major Incident Control Committee (MICC), 81–4 Major incidents, 67–9 definition, 82 experience gained, 243–9 lessons learnt from, 362–3 Major industrial risks, 205–18 Manfredonia, 205 Marbon, 288 Markov model, 202 Mathematical models, 167 Media coverage, 144, 318 Methane, 301 Methyl isocyanate, 191, 194 Methyl isocyanide, 35 Mexico, 342 Mexico City, 3, 191, 193, 252 Mitigation, 208–13 Mobilization of resources, 253 Mobilization procedures, 96–7 Monte Carlo techniques, 190, 202 MONTEDIPE, 59–62 Nantes accident, 102–3 National Agency of Environmental Protection (NAEP), 275 National Chemical Emergency Centre, 137 National Toxicity Information Centre, 96

Natural Gas Coordinating Committee, 161 Natural gas transmission, 161–3 Netherlands, The accident at DSM, 283–92 communicating industrial risk, 317–26 industrial emergency planning, 93–7 NKA/INF project, 235–9 North Rhine-Westphalian Law for Protection against Catastrophes, 73 North-Rhine-Westphalia, 155–60 Notification methods and procedures, 149–50 Notification of Installations Handling Hazardous Substances (NIHHS) Regulations, 206 NPK fertiliser, 102 Nuclear activity, 43 Nuclear industries, 235–9 Nuclear plant emergency response, 178–82 Nuclear power generation facility, 171 Nuclear power installations, 86, 235 Nuclear wastes, 252 Nuisance Act, 323 Nypro, 283 Off-site emergency planning (PPI), 11–12, 44, 100–1, 205–18, 341 Oil industry, 81 pollution control, 275–81 transmission, 161–3 On-site emergency planning (POI), 10–11, 44, 63–7, 73–9, 100–1, 195–7, 205–18, 359–60 aim and general principles, 64–6 Operational problems, 285 Oppau, 205 ORSEC, 43, 47, 48, 54, 99, 100, 103, 339 ORSECHYDROCARBURES, 43

374 INDEX

ORSECRAD, 43 ORSECTOX, 43, 48, 99, 100 Particular Contingency Plan, 115 PEE/PLASEQTA, 167–9 PEQHU, 167–9 Pesticides, 295 Petrochemicals, 81 Petroleum products, 43 Petroleum refining industry, 7 Petroleum Regulations, 48 Phosgene, 108 Phosphorus trichloride, 252 Plume models, 185–6 Police Force, 144 Pollution hazards, 275 Portuguese National Civil Protection Service, 107–13 Potchefstroom plant, 196 Probabilities of lethality (LTL), 118 Propane, 216, 217, 247 Provincial Contingency Plan of Civil Protection, 115, 128 Provincial Council, 288, 289 Public inquiries, 298 Public Relations, 66, 68, 96 Public transport, 144 Radio, 68, 342 Radiological emergency, 178–82 Recommendations, 299 Regulation on major industrial accidents, 3, 9–10, 12–14 Response capability assessment, 147–53 Responsibility assignment, 148–9 Rheinische Olefinwerke (ROW), 245–6 Risk, probabilistic nature of, 321 Risk analysis, 210 hazardous activities, 192–3 models of, 199–204 Risk assessment, 209, 295, 318 Risk communication, 317–26, 318 appropriate, 325 limitations in achieving objectives, 319

objective(s), 319 performance and effectiveness, 322 Risk contours, 124, 127, 129 Risk— contd. evaluation, 94 information, 321 management, 295, 318 maps, 19 problem, 319 sources, 20 Road Traffic (Carriage of Dangerous Substances in Packages, etc.) Regulations 1986, 135 Royal Dutch Chemical Association, 322 Safety equipment, 78 Safety Law, 288 Safety reports, 20 San Carlos, 205 San Juna Ixhautepec, 205 Schematic Report Analysis, 300 Schematic Report Diagrams, 301 SDPC, 107, 109 Security service, 95 Self-help schemes, 136–7 Seveso Directive, 3, 18, 34, 36, 43, 63, 93, 100, 317, 323, 324, 338, 360, 363 Seveso disaster, 36, 205, 288 SIGEM system, 130 Site Main Controller, 65, 66, 68 Small inventory top tier sites (SITTS), 207 SMART system, 185–90 SMPC, 107, 109 SNPC, 107, 109 Social climate, 254 Social value, 336–8 Socio-technical failures, 306–12 Somerville, Massachusetts, 252 Spain, 167–9 Special Intervention Plan (SIP), 47

INDEX 375

Special (off-site intervention) plan (PPI). See Off-site Special protection, 90 Spreading angle, 119, 122 SRPC, 107 Störfallverordnung, 3 Structural failure, 300 Systems Approach, 307 Systems models, 200–3, 306–12 Systems overviews, 78 Technical Operations Management (TEL), 157–8 Technical Task Force (TEL), 76 Technological Risks, 43, 47, 48, 54, 339 Telephones, 68 Television, 342 TELRAD, 68 Texas City, 205 Thermal radiation effects, 215 TIGRE computer code, 167–9 TMI-2, 178 Tolerance limit, 330 Toxic environment, 35 Toxic gases, 327–33 Toxic materials, 207, 210, 217 Toxic substances, 22–3, 185–90 Traffic congestion, 285 Training, 38, 69–70, 83–4, 97, 212, 295, 341 Transport of dangerous substances, 22–3 Trial and error strategy, 190 UKHIS (United Kingdom Hazard Information Warning System), 134 Union Carbide, 35, 194 United Kingdom, emergency planning, 31–41, 205–18 United States, chemical emergencies, 251–73 US Coast Guard, 257 Validation, 38 Vapour cloud explosion (VCE), 216

Vinyl monochloride, 108 Vulnerability analysis, 209 Vulnerability assessment, 147–53 Warning area, 330–1 WHAZAN code, 118, 123, 126 Wilhelmshaven, 244–5 Working Environment Act, 94 Works Task Force (WEL), 76 Yom Kippur War, 300