Regardless of specific regulatory requirements, the Department of Homeland Security is expected to emphasize voluntary partnerships with industry to get security assessments and countermeasures underway as soon as possible. A number of Senate Republicans and industry representatives favor self-initiated security measures, such as the American Chemistry Council (ACC)'s Responsible Care® program, to achieve Homeland Security goals.
Although ACC and other chemical industry group members already subscribe to the Responsible Care® program, these members comprise less than 10% of the facilities potentially affected by the proposed legislation. The legislation addresses not only chemical, pharmaceutical, and petrochemical manufacturers and refineries, but also a wide spectrum of manufacturing industries. The latter include such industries as food processing, paper, automotive, and electronics manufacturing. Highest priority facilities include those with large quantities of hazardous chemicals or flammable products, particularly those close to population centers or critical infrastructure.
To ensure adequate countermeasures, both the legislation and voluntary programs advocate that facilities first review and evaluate their vulnerabilities and then, based on assessment findings, show that necessary steps (i.e., site, process, and procedural changes) have been taken to enhance their site security programs. To assess vulnerabilities to potential toxic and flammable hazards, facilities will need to consider a range of terrorist-instigated events and their possible impacts.
The proposed legislation may follow the recently adopted American Chemistry Council (ACC) Responsible Care® Security code by including a three-tiered approach, so that facilities that pose a greater concern must address the requirements of the regulation sooner.
Under Responsible Care® every ACC member company was supposed to prioritize their sites by June 20, 2002. Tier 1 ACC companies should have assessed their vulnerabilities by the end of 2002. By December 2003, every Tier 1 ACC facility should have implemented concrete steps to improve security preparedness. The deadline for Tier 2 ACC facilities follows Tier 1 deadlines by 6-8 months, with a similar implementation deadline one year later.
A key provision of the both the proposed legislation and the Responsible Care® program is the designation of high priority facility categories according to:
Severity of the harm that could be caused by an unauthorized release
Proximity to population centers
Threats to national security
Threats to critical infrastructure
Quantities of substances of concern
Requirements for high priority facilities (within 1 year)
Assess vulnerability to terror attack
Identify on- and off-site hazards
Adequacy of the facility's existing prevention, preparedness and response plan
Although it is uncertain what the final specific site vulnerability assessment requirements will be, recently available guidance from the chemical industry and the U.S. Department of Justice (DOJ) clearly identify factors that facilities should consider in addressing vulnerability to terrorist attack.
The Chemical Facility Vulnerability Assessment Methodology published by the U.S. DOJ (July 2002) provides a holistic Process Hazards Analysis-type approach to assess terrorist threats and develop a multi-faceted and balanced response. The Site Security Guideline for the U.S. Chemical Industry published by the ACC Chlorine Institute and Synthetic Organic Chemical Manufacturers Association (SOCMA) in October 2001 is a practical guide to identify vulnerable processes and to develop suitable measures to reduce risk. It has been widely distributed and is currently being used by ACC member companies to meet Responsible Care® requirements. Further, the AIChE's 'Guidelines for Analyzing and Managing the Security Vulnerabilities of Fixed Chemical Sites' published by the Center for Chemical Process Safety in August 2002, provides a systematic process for identifying, analyzing, and managing a company's security vulnerabilities. SOCMA has developed a screening method founded on engineering methods in the DOJ/AICHE guidance. This SOCMA method is likely to find frequent use for initial screening studies.
Step-wise Approach to a Facility Vulnerability Assessment
Prior to taking steps to reduce terrorist threats, a vulnerability assessment will help owners determine whether their facility is likely to be a target by virtue of 1) chemicals present, 2) susceptibility to malicious intent causing a release, and 3) proximity to population centers or strategic receptors. Although the impending legislation address only fixed facilities, many of the same concerns will ultimately need to be addressed for transportation of chemicals to and from these sites. It is likely that the site vulnerability assessment legislation will incorporate the basic elements contained in the Site Security Guidelines for the U.S. Chemical Industry. ENSR uses a seven-step process (See Figure 1) including these elements to help facilities prepare the vulnerability assessments and implement needed improvements. Each of these steps is addressed below. An example of a completed ENSR project is included at the end of the article to illustrate how we helped clients with vulnerability assessment related projects.
Step 1 Chemical Hazards Evaluation: How likely is a chemical release and how harmful would it be?
Facilities that handle acutely toxic substances have had to answer these questions for over 15 years in response to regulatory programs [Emergency Planning and Community Right-to-Know Act (EPCRA), state accidental release programs first in Delaware, then later in New Jersey and California and, more recently, EPA's Risk Management Program (RMP)]. This evaluation is also implied by the General Duty Clause [Section 112(r)] of the Clean Air Act which requires owners and operators to understand the hazards associated with chemicals used at their facilities. However, facilities will now also be required to review their hazard evaluation with a new perspective on intentional modes of release that could increase the likelihood of a release and/or the severity of the consequences.
For example, while the RMP analysis identified the release of a single vessel as the worst-case scenario, a re-evaluation may indicate a simultaneous release from several adjacent vessels as potential worst case. ENSR uses process engineers, risk management specialists and air dispersion modelers to help facilities shore-up their chemical hazards evaluation by:
- Identifying highly toxic and flammable substances that could lead to off-site consequences
- Reviewing the types of accidental releases that have been previously considered
- Identifying previously unforeseen types of episodic releases
- Performing modeling to rank off-site hazards
- Identifying if and where risk evaluation and reduction should be focused.
Chemical hazards evaluation is the first step in identifying if off-site toxic or flammability hazards due to unplanned releases should be of concern. ENSR clients have previously undertaken such studies for other related purposes such as: (1) concerns over insurance liability, (2) regulatory compliance with the EPCRA under SARA Title III, and (3) response to EPA's RMP Section 112(r) of the Clean Air Act.
For example ENSR helped a nationwide company with multiple facilities that handles hazardous waste comply with EPA's RMP. This evaluation included identifying potential chemical spill scenarios and developing a system, based on relative volatility and toxicity, to rank various mixtures in their potential to create off-site hazards. This streamlined the company's development of risk management plans.
Step 2 Process Hazard Analysis (PHA): Where is the process vulnerable?
Process hazards analyses, considered good practice in the chemical industry, are required for processes regulated under U.S. EPA's RMP and OSHA's PSM Rules. In a PHA, a panel of experts 1) identifies the weak links in a system that by themselves or in combination with other factors could lead to a consequential release, 2) qualitatively ranks the hazards in terms of likelihood and consequence, and 3) makes recommendations on prevention or mitigation.
For these new requirements the PHA will need to also highlight areas of potential vulnerability to external factors involving malicious intent. The use of an outside consultant to support performance of a 'supplemental' PHA offers the opportunity to employ questioning techniques different from those originally used. This review activity can greatly improve the ability of the PHA team to address hazards that may have been previously ignored. ENSR's process engineers and risk management specialists help facilities meet these challenges by:
- Providing third-party review of previously-conducted PHAs and, if necessary, recommending procedures to extend the PHA to address security concerns.
- Leading extended PHAs for specific processes and providing input as to the magnitude of off-site consequence of potential events
- Leading facility-wide PHAs, including an expert in security-related issues
PHAs have been successfully performed for clients with petrochemical facilities, pharmaceutical and specialty chemical manufacturing, hazardous waste incinerators, ammonia systems used at coal-fired power plants, cryogenic liquid hydrogen and oxygen fuel storage tanks and launch facilities at military bases, as well as municipal and military drinking water and wastewater facilities.
ENSR performed a comprehensive process safety and hazards review for a major chlorine user who manufactures consumer cleaning products. ENSR reviewed site safety and chemical management practices by inspecting the facility and interviewing plant personnel to confirm status of written practices compared to state-of-the-art operations and design practices. We performed a HAZOP Analysis (a form of PHA) with plant personnel, to determine the release amounts of chlorine, aircraft crash risks, and recommended risk reduction strategies. As a follow-on, we obtained approval of the submitted Summary Risk Management Program Statement documentation required by the state, and evaluated the site's emergency response and agency notification plans and subsequently recommended instrumentation for enhanced meteorological monitoring.
Step 3 Consequence Assessment: What are the off-site impacts of security threats?
The prescriptive RMP definition of worst-case and alternative scenarios may not be practical for assessing and prioritizing potential threats and consequences or in developing effective terrorist countermeasures. To this end a facility should expand the off-site consequence assessment to evaluate additional release events that the expanded PHA has identified. ENSR's process engineers, modeling specialists and toxicologists can work with facility staff to evaluate off-site impacts using established state-of-the-science modeling approaches. The result is a more comprehensive consequence assessment used to develop risk reduction strategies. This re-assessment may need to include:
- Extended PHA-driven worst-case scenarios for each regulated substance and process (rather than the single administrative worst-case scenario for the entire facility as required under RMP).
- More detailed assessment of off-site hazards, such as including the population potentially exposed to additional toxic-effects levels
- Simultaneous evaluation of toxic hazards, flammability hazards and combustion products.
- In the case of very large-scale releases, assessment of impacts beyond the arbitrary 25-mile upper limit established by RMP.
- Toxicological assessment of simultaneous releases of multiple substances.
- Evaluation of the effectiveness of mitigation strategies recommended in the extended PHA.
Consequence assessments, which are required for risk management and emergency response plans, relate release scenarios to impacts to people and the environment. It incorporates technical disciplines including process engineering to realistically define the scenarios, chemistry and physics to simulate how the chemical is released to the atmosphere, atmospheric science to model how the plume mixes with the atmosphere, and toxicology to evaluate health effects.
Since 1985, ENSR has performed onsite and offsite air quality impact assessments involving accidental releases of toxic chemicals at multiple sites. ENSR conducted hazard and impact assessment studies for a major electronics manufacturer at their nationwide facilities. These involved site reviews to establish the location and initial dispersion characteristics of potential releases from valve failures of toxic gas cylinders. ENSR modeled the potential offsite impacts based on varying meteorological conditions. Sources include outdoor loading docks, onsite transportation routes, chemical storage facilities, laboratories, and wastewater treatment facilities. We recommended mitigation measures to minimize the impact should a release occur.
Step 4 Physical Factors Assessment: How do process design, site layout and location affect vulnerability?
If an assessment of hazards indicates that there is a significant potential for off-site consequences associated with an attack, the next step would be to investigate the physical factors that could affect the vulnerability of a potential target. These factors include the size and type of containment; visibility and accessibility of storage locations; the manner in which chemicals are stored (e.g., containers side-by-side, stacked, isolated); and facility environs, including geographic features. Evaluation of physical factors is intrinsic to evaluating the potential for unplanned releases, and as such is often included in all of the previous steps. Although physical factors are often highlighted in facility or process siting studies, physical factors relating to a terrorist threat would also involve security specialists.
ENSR process engineers and risk management specialists can solicit and review this information and, in conjunction with security specialists, evaluate the effect on vulnerability. Suggested changes can then be factored into the mitigation assessment step, which follows.
ENSR assisted a chlorine bleach manufacturer evaluate the relative off-site risk a ssociated with moving its production operation from one site to another. The evaluation accounted for differences in process design, chlorine storage facilities, location, site environment, population and transportation routes.
In another study, ENSR examined the likelihood that the site's control room might become uninhabitable during a major chemical release. A series of sensitivity analyses indicated that an enhanced automatic warning system was needed. The real-time hazardous gas sensing system could be augmented with additional sensors and automated modeling systems that used onsite wind measurement data to automatically warn occupants of dual management centers. ENSR supplied many of the additional sensing systems and coordinated the development of a satellite decision management system to provide more reliable early warning information to both operators and managers.
Step 5 Mitigation Assessment: To what extent will mitigation measures reduce off-site impacts?
Effective mitigation measures incorporated into a facility's risk management and emergency response plans may have the added benefit of reducing the likelihood of the facility being a potential terrorist target. In this regard, passive mitigation systems, which are less vulnerable to tampering, have an advantage over active mitigation systems. The cost and effectiveness of mitigation systems should be evaluated for the highest priority releases identified in the extended PHA. ENSR uses process engineers and dispersion modeling specialists to assist a facility to:
- Develop conceptual mitigation system design
- Evaluate effectiveness of mitigation systems for various releases scenarios
- Model the associated reduction in atmospheric release rate and off-site impacts
- Use this information to refine the recommendations of the extended PHA.
Sometimes a chemical hazards evaluation or consequence assessment will identify a situation for which a reduction in off-site risk is sought. Mitigation can take many forms, including passive systems such as dikes and enclosures to active systems such as water sprays. Before a system can be recommended, an evaluation of its effectiveness is often warranted.
For several pharmaceutical manufacturing facilities located in relatively populated areas, ENSR performed a series of alternative consequence analyses to determine which chemical hazards could be best managed by careful control or reduction of quantities maintained in single locations. In one case process requirements were found compatible with substitution of a less volatile form of the primary chemical of concern, and the changeover was economically managed in a short period because the extra storage capacity needed was already constructed and underutilized.
Step 6 Security Assessment/Gap Analysis: Do security measures at the site meet the potential threat?
After identifying potential vulnerabilities, threats, and countermeasures, the next step is for a facility manager to conduct a security assessment to help determine whether protective measures are adequate. The ACC recommends that this aspect of the vulnerability assessment should be addressed by security professionals. ENSR staff can interface with facility or a consulting security staff to help interpret the other technical aspects of the vulnerability assessment and to address how changes in security could affect off-site risk. The security assessment should address:
- Risk Communication Management
- Physical security
- Employee and contractor security
- Information, computer and network security
Step 7 Planning and Implementation of Needed Improvements: Considering costs and risk reduction benefits, what are the priorities?
Setting priorities for follow-up actions and implementation of identified improvements always depends upon site-specific relationships between the relative costs and perceived benefits of the candidate measures. Plant location and siting of potentially hazardous materials or operations within a plant site are key to determining the scale of the potential risks, and the effectiveness of proposed changes. Costs for relocation of storage areas or sensitive processes vary greatly with the scale of the operation. An effective emergency notification system and response plan may be more effective in some situations. Smaller facilities can often consider secondary containment as an option. Large or remote sites inherently have more options for establishing safety buffer zones around high hazard areas. These options need to be systematically reviewed to develop an implementation plan that is both effective and fiscally possible. In many cases engineering risk benefit reviews can help clarify the optimal balance.
Various industries are required to develop their implementation plans by providing the engineering risk analyses that are important to the planning process. For several pharmaceutical and agricultural chemical companies, alternative siting layouts for hazardous chemical processes were evaluated. Similar analyses performed for a number of paper manufacturing companies assisted in determining the value of chemical substitution for risk reduction. These examples highlight a few of the many ways in which risk engineering and management support have helped client companies to be more confident that their solutions would be both practical and effective.