Finding the Weak Links

• Mar 01, 2003

In response to pressing issues facing the new U.S. Department of Homeland Security, over 15,000 chemical and industrial plants may have to evaluate their vulnerability to terrorist attack and improve countermeasures at their facilities. Federal lawmakers are considering two bills requiring facilities to submit site security plans: the Chemical Security Act (Senate Bill S. 157, reintroduced in January 2003) and the Comprehensive Homeland Security Act of 2003 (S. 6).

Regardless of specific regulatory requirements, the U.S. Department of Homeland Security is expected to emphasize voluntary partnerships with industry to get security assessments and countermeasures underway as soon as possible. A number of U.S. Senate Republicans and industry representatives favor self-initiated security measures, such as the American Chemistry Council (ACC)'s Responsible Care® program, to achieve Homeland Security goals.

Although ACC and other chemical industry group members already subscribe to the Responsible Care® program, these members comprise less than 10 percent of the facilities potentially affected by the proposed legislation. The legislation addresses not only chemical, pharmaceutical and petrochemical manufacturers and refineries, but also a wide spectrum of manufacturing industries. The latter include such industries as food processing, paper, automotive and electronics manufacturing. Highest priority facilities include those with large quantities of hazardous chemicals or flammable products, particularly those close to population centers or critical infrastructure.

To ensure adequate countermeasures, both the legislation and voluntary programs advocate that facilities first review and evaluate their vulnerabilities and then, based on assessment findings, show that necessary steps (i.e., site, process and procedural changes) have been taken to enhance their site security programs. To assess vulnerabilities to potential toxic and flammable hazards, facilities will need to consider a range of terrorist-instigated events and their possible impacts. The proposed legislation may follow the recently adopted American Chemistry Council (ACC) Responsible Care® Security code by including a three-tiered approach, so that facilities that pose a greater concern must address the requirements of the regulation sooner.

Under Responsible Care® every ACC member company was supposed to prioritize their sites by June 20, 2002. Tier 1 ACC companies should have assessed their vulnerabilities by the end of 2002. By December 2003, every Tier 1 ACC facility should have implemented concrete steps to improve security preparedness. The deadline for Tier 2 ACC facilities follows Tier 1 deadlines by 6-8 months, with a similar implementation deadline one year later.

A key provision of the both the proposed legislation and the Responsible Care® program is the designation of high priority facility categories according to

• Severity of the harm that could be caused by an unauthorized release
• Proximity to population centers
• Threats to national security
• Threats to critical infrastructure
• Quantities of substances of concern
• Requirements for high priority facilities (within 1 year)
• Assess vulnerability to terror attack
• Identify on- and off-site hazards
• Adequacy of the facility's existing prevention, preparedness and response plan

Although it is uncertain what the final specific site vulnerability assessment requirements will be, recently available guidance from the chemical industry and the U.S. Department of Justice (DOJ) clearly identify factors that facilities should consider in addressing vulnerability to terrorist attack.

The Chemical Facility Vulnerability Assessment Methodology published by DOJ (July 2002) provides a holistic Process Hazards Analysis-type approach to assess terrorist threats and develop a multi-faceted and balanced response. The Site Security Guideline for the U.S. Chemical Industry published by the ACC, Chlorine Institute and Synthetic Organic Chemical Manufacturers Association (SOCMA) (October 2001) is a practical guide to identify vulnerable processes and to develop suitable measures to reduce risk. It has been widely distributed and is currently being used by ACC member companies to meet Responsible Care® requirements. Further, the AIChE's "Guidelines for Analyzing and Managing the Security Vulnerabilities of Fixed Chemical Sites" published by the Center for Chemical Process Safety in August 2002, provides a systematic process for identifying, analyzing and managing a company's security vulnerabilities. SOCMA has developed a screening method founded on engineering methods in the DOJ/AIChE guidance. This SOCMA method is likely to find frequent use for initial screening studies.

Prior to taking steps to reduce terrorist threats, a vulnerability assessment will help owners determine whether their facility is likely to be a target by virtue of 1) chemicals present, 2) susceptibility to malicious intent causing a release and 3) proximity to population centers or strategic receptors. Although the impending legislation address only fixed facilities, many of the same concerns will ultimately need to be addressed for transportation of chemicals to and from these sites. It is likely that the site vulnerability assessment legislation will incorporate the basic elements contained in the Site Security Guidelines for the U.S. Chemical Industry. ENSR uses a seven-step process, including these elements, to help facilities prepare the vulnerability assessments and implement needed improvements. Each of these steps is addressed below. Examples of a completed ENSR vulnerability assessment project are included throughout this article.

Facilities that handle acutely toxic substances have had to answer these questions for over 15 years in response to regulatory programs Emergency Planning and Community Right-to-Know Act (EPCRA), state accidental release programs first in Delaware, then later in New Jersey and California and, more recently, U.S. Environmental Protection Agency's (EPA) Risk Management Program (RMP) under the Clean Air Act. This evaluation is also implied by the General Duty Clause Section 112(r) of the Clean Air Act which requires owners and operators to understand the hazards associated with chemicals used at their facilities. However, facilities will now also be required to review their hazard evaluation with a new perspective on intentional modes of release that could increase the likelihood of a release and/or the severity of the consequences.

For example, while the RMP analysis identified the release of a single vessel as the worst-case scenario, a re-evaluation may indicate a simultaneous release from several adjacent vessels as potential worst case. ENSR uses process engineers, risk management specialists and air dispersion modelers to help facilities shore-up their chemical hazards evaluation by

• Identifying highly toxic and flammable substances that could lead to off-site consequences
• Reviewing the types of accidental releases that have been previously considered
• Identifying previously unforeseen types of episodic releases
• Performing modeling to rank off-site hazards
• Identifying if and where risk evaluation and reduction should be focused.

Chemical hazards evaluation is the first step in identifying if off-site toxic or flammability hazards due to unplanned releases should be of concern. ENSR clients have previously undertaken such studies for other related purposes such as: (1) concerns over insurance liability, (2) regulatory compliance with the EPCRA under the Superfund Amendments and Reauthorization Act (SARA) Title III and (3) response to EPA's RMP Section 112(r) of the Clean Air Act.

For a specialty chemicals manufacturer, ENSR successfully obtained a required occupancy permit for their chemical storage warehouse in the Northeast. To demonstrate the adequacy of the facility's emergency response plan, ENSR's Chemical Hazards Evaluation calculated the magnitude and extent of airborne chemical concentrations, which could result from a warehouse fire. The project a) reviewed the planned inventory of chemicals and their combustion characteristics; b) developed realistic fire scenarios; c) calculated chemical combustion product release rates; d) simulated plume dispersion from a large buoyant source; e) identified the toxicologically important concentrations for various combustion products: and f) evaluated the areas at potential risk.

ENSR also helped a nationwide company with hazardous wastes comply with EPA's RMP rules. This evaluation also included identifying potential chemical spill scenarios and developing a system, based on relative volatility and toxicity to rank various mixtures in their potential to create off-site hazards. This risk ranking procedure streamlined the company's development of risk management plans.

Process hazards analyses (PHA), considered good practice in the chemical industry, are required for processes regulated under EPA's RMP and OSHA's PSM Rules. In a PHA, a panel of experts 1) identifies the weak links in a system that by themselves or in combination with other factors could lead to a consequential release; 2) qualitatively ranks the hazards in terms of likelihood and consequence; and 3) makes recommendations on prevention or mitigation.

For these new requirements the PHA will need to also highlight areas of potential vulnerability to external factors involving malicious intent. The use of an outside consultant to support performance of a "supplemental" PHA offers the opportunity to employ questioning techniques different from those originally used. This review activity can greatly improve the ability of the PHA team to address hazards that may have been previously ignored. ENSR's process engineers and risk management specialists help facilities meet these challenges by

• Providing third-party review of previously-conducted PHAs and, if necessary, recommending procedures to extend the PHA to address security concerns;
• Leading extended PHAs for specific processes and providing input as to the magnitude of off-site consequences of potential events; and
• Leading facility-wide PHAs, including an expert in security-related issues.

PHAs have been successfully performed for clients with petrochemical facilities, pharmaceutical and specialty chemical manufacturing, hazardous waste incinerators, ammonia systems used at coal-fired power plants, cryogenic liquid hydrogen and oxygen fuel storage tanks and launch facilities at military bases, as well as municipal and military drinking water and wastewater facilities.

ENSR has performed PHA for facility process safety management plans, as well as for direct use in RMPs, for several food manufacturers with plants in multiple states. The covered processes include those using ammonia refrigeration and chlorine for sterilization. For many of these facilities, propane (an early concern for RMP programs presently eliminated by a rule change) may be an additional issue for future hazards analysis reviews. For these sites, ENSR developed, conducted and completed the process hazard analyses. For several sites, we also assisted with the preparation of standard operating procedures, RMP evaluations, and emergency response plan development.

ENSR also performed a comprehensive process safety and hazards review for a major chlorine user who manufactures consumer cleaning products. Existing site safety and chemical management practices were reviewed by inspecting the facility and interviewing plant personnel to confirm status of written practices. At company request, results were compared to state-of-the-art-operations and design practices. ENSR subsequently led a HAZOP analysis with plant personnel to determine potential release events for chlorine, including aircraft crash risks, and recommended risk reduction strategies. ENSR helped the facility attain approval of the state-required Summary Risk Management Program Statement. This included evaluating the site's emergency response and agency notification plans and developing recommended specifications for instrumentation for enhanced meteorological monitoring.

The prescriptive RMP definition of worst-case and alternative scenarios may not be practical for assessing and prioritizing potential threats and consequences or in developing effective terrorist countermeasures. To this end a facility should expand the off-site consequence assessment to evaluate additional release events that the expanded PHA has identified. ENSR's process engineers, modeling specialists and toxicologists can work with facility staff to evaluate off-site impacts using established state-of-the-science modeling approaches. The result is a more comprehensive consequence assessment used to develop risk reduction strategies. This re-assessment may need to include

• Extended PHA-driven worst-case scenarios for each regulated substance and process (rather than the single administrative worst-case scenario for the entire facility as required under RMP).
• More detailed assessment of off-site hazards, such as including the population potentially exposed to additional toxic-effects levels
• Simultaneous evaluation of toxic hazards, flammability hazards and combustion products.
• In the case of very large-scale releases, assessment of impacts beyond the arbitrary 25-mile upper limit established by RMP.
• Toxicological assessment of simultaneous releases of multiple substances
• Evaluation of the effectiveness of mitigation strategies recommended in the extended PHA.

Consequence assessments, which are required for risk management and emergency response plans, relate release scenarios to impacts on people and the environment. It incorporates technical disciplines including process engineering to realistically define the scenarios, chemistry and physics to simulate how the chemical is released to the atmosphere, atmospheric science to model how the plume mixes with the atmosphere and toxicology to evaluate health effects.

ENSR conducted hazard and impact assessment studies for a major electronics manufacturer at their nationwide facilities. Since 1985, ENSR has performed onsite and offsite air quality impact assessments involving accidental releases of toxic chemicals at multiple sites. These involved site reviews to establish the location and initial dispersion characteristics of potential releases from valve failures of toxic gas cylinders. ENSR modeled the potential offsite impacts based on varying meteorological conditions. Sources include outdoor loading docks, onsite transportation routes, chemical storage facilities, laboratories and wastewater treatment facilities. The project concluded with a listing of recommended mitigation measures demonstrated by the modeling results to minimize the impact of any potential release event.

ENSR has been conducting hazard and consequence assessment studies on a continuous basis since 1985 for a major electronics manufacturer using many chemicals at more than 25 of their nationwide facilities. These analyses required initial site reviews to establish the location and initial dispersion characteristics of potential releases from valve failures of toxic gas cylinders and storage tanks. Sources include outdoor loading docks, onsite transportation routes, chemical storage facilities, laboratories and wastewater treatment facilities. Potential offsite impacts were modeled based on varying meteorological conditions. The project concluded with a listing of recommended mitigation measures demonstrated by modeling results to minimize the impact of any potential release or event.

A major chemical producer, working to avoid situations like Bhopal, required the development of a distributed dispersion modeling system (DDMS), a network of scientific workstations that could calculate the magnitude and extent of toxic and flammable releases. This system addressed several complex release phenomena, including pool evaporation, pressurized jets, heavy-gas dispersion and plume rise. DDMS was utilized for both emergency response management and design planning at the technical coordinating center and eight plants.

ENSR helped a Fortune 100 petroleum company in Alaska meet design requirements for permitting an LNG storage and transport facility for a coastal location. To estimate the potential consequences of LNG spills on land and water maximum flammable plume distances were determined for many possible meteorological conditions (wind speed, atmospheric stability, temperature and relative humidity). The radiant heat flux from an ignited pool of LNG was calculated and compared to threshold values for burn injury. Pool fires and vapor cloud explosion impacts were estimated. Also considered was the potential impact of a rupture and ignition of the natural gas feed line to the LNG facility.

If an assessment of hazards indicates that there is a significant potential for off-site consequences associated with an attack, the next step would be to investigate the physical factors that could affect the vulnerability of a potential target. These factors include the size and type of containment; visibility and accessibility of storage locations; the manner in which chemicals are stored (e.g., containers side-by-side, stacked, isolated); and facility environs, including geographic features. Evaluation of physical factors is intrinsic to evaluating the potential for unplanned releases and as such is often included in all of the previous steps. Although physical factors are often highlighted in facility or process siting studies, physical factors relating to a terrorist threat would also involve security specialists. ENSR process engineers and risk management specialists can solicit and review this information and, in conjunction with security specialists, evaluate the effect on vulnerability. Suggested changes can then be factored into the mitigation assessment step, which follows.

ENSR assisted a chlorine bleach manufacturer with a Physical Factors Assessment to evaluate the relative off-site risk associated with moving its production operation from one site to another. The evaluation accounted for differences in process design, chlorine storage facilities, location, site environment, population and transportation routes.

In another study, ENSR examined the likelihood that the site's control room might become uninhabitable during a major chemical release. A series of sensitivity analyses indicated that an enhanced automatic warning system was needed. The real-time hazardous gas sensing system could be augmented with additional sensors and automated modeling systems that use onsite wind measurement data to automatically warn occupants of dual management centers. ENSR supplied many of the additional sensing systems and coordinated the development of a satellite decision management system to provide more reliable early warning information to both operators and managers.

Effective mitigation assessment measures incorporated into a facility's risk management and emergency response plans may have the added benefit of reducing the likelihood of the facility being a potential terrorist target. In this regard, passive mitigation systems, which are less vulnerable to tampering, have an advantage over active mitigation systems. The cost and effectiveness of mitigation systems should be evaluated for the highest priority releases identified in the extended PHA. ENSR uses process engineers and dispersion modeling specialists to assist a facility to

• Develop conceptual mitigation system design
• Evaluate effectiveness of mitigation systems for various releases scenarios
• Model the associated reduction in atmospheric release rate and off-site impacts
• Use this information to refine the recommendations of the extended PHA.

Sometimes a chemical hazards evaluation or consequence assessment will identify a situation for which a reduction in off-site risk is sought. Mitigation can take many forms, including passive systems such as dikes and enclosures to active systems such as water sprays. Before a system can be recommended, an evaluation of its effectiveness is often warranted.

For several pharmaceutical manufacturing facilities located in relatively populated areas, ENSR performed a series of mitigation assessment, alternative consequence analyses to determine which chemical hazards could be best managed by careful control or reduction of quantities maintained in single locations. In one case process requirements were found compatible with substitution of a less volatile form of the primary chemical of concern, and the changeover was economically managed in a short period because the extra storage capacity needed was already constructed and underutilized.

As part of a major chemical manufacturer emergency response planning process, ENSR calculated offsite concentrations resulting from accidental spills of ammonia (NH3), phosphorus trichloride (PCl3) and hydrogen cyanide (HCN). The distances to hazardous concentration threshold levels were calculated for each release for a range of possible meteorological conditions. A number of special technical issues were addressed during this study. The first was the mitigating effects of a water spray system for an ammonia release. ENSR's analyses showed that the direct application of water on a liquid ammonia spill pool was not advisable due to the short term increase in ammonia vapor evolution and the possibility for increased risk of exposure for individuals on elevated terrain adjacent to the facility. A second issue was the calculation of the evolution of hydrogen chloride vapor due to a spill of PCl3 into water.

ENSR has assisted facilities in several different industries develop their implementation plans by providing the engineering risk analyses that are important to the planning process. For several pharmaceutical and agricultural chemical companies, ENSR has also evaluated alternative siting layouts for hazardous chemical processes. Similar analyses performed for a number of paper manufacturing companies assisted them in determining the value of chemical substitution for risk reduction. These are a few examples of the many ways in which ENSR?s risk engineering and management support have helped client companies to be more confident that their solutions would be both practical and effective.

After identifying potential vulnerabilities, threats, and countermeasures, the next step is for a facility manager to conduct a security assessment to help determine whether protective measures are adequate. The ACC recommends that security professionals should address this aspect of the vulnerability assessment. ENSR staff can interface with facility or a consulting security staff to help interpret the other technical aspects of the vulnerability assessment and to address how changes in security could affect off-site risk. The security assessment should address

• Risk Communication Management
• Physical security
• Employee and contractor security
• Information, computer and network security

Many of the risk emergency preparedness and risk management planning projects that ENSR conducts include security assessment evaluations as an integral part of the program. This is especially true for those projects which involving emergency response planning support. In these cases site access and protection of personnel from hazards of either inappropriate or hostile handling of toxic chemicals or flammables and explosives is naturally a concern--one that is addressed either explicitly or implicitly in the project analysis and recommendations. Several ENSR program managers have technical backgrounds in safety and emergency planning for either nuclear or other high profile chemical-handling facilities. Their risk analysis and planning projects have carefully considered the full range of protective measures necessary to protect both assets and safety of plant personnel and the public in high-hazard situations. In a number of projects conducted for some of the largest chemical and electronics manufacturing firms ENSR staff have worked closely with either the corporate director of security, or the plant's security management team to ensure that issues overlapping technical analysis and security control are appropriately addressed.

Setting priorities for follow-up actions and implementation of identified improvements always depends upon site-specific relationships between the relative costs and perceived benefits of the candidate measures. Plant location and siting of potentially hazardous materials or operations within a plant site are key to determining the scale of the potential risks, and the effectiveness of proposed changes.

Costs for relocation of storage areas or sensitive processes vary greatly with the scale of the operation. An effective emergency notification system and response plan may be more effective in some situations. Smaller facilities can often consider secondary containment as an option. Large or remote sites inherently have more options for establishing safety buffer zones around high hazard areas. These options need to be systematically reviewed to develop an implementation plan that is both effective and fiscally possible. In many cases engineering risk benefit reviews can help clarify the optimal balance.

ENSR has extensive experience in helping industrial clients not only in recognizing issues and diagnosing potential consequences, but in effectively planning continuous improvements that represent the best permanent solutions. For several pharmaceutical and agricultural chemical companies, alternative siting layouts for hazardous chemical processes have been evaluated. Similar analyses performed for paper manufacturing companies helped them determine the value of chemical substitution for risk reduction. These examples highlight a few of the many ways in which risk engineering and process safety management support have helped companies to be more confident that their solutions would be both practical and effective in minimizing their risks.

Security for Public Water Systems

The Public Health, Security, and Bioterrorism Preparedness, and Response Act (a.k.a. Bioterrorism Act), signed by President Bush in June 2002, requires public water systems to develop vulnerability assessments and emergency response plans. Vulnerability assessments will identify potential intentionally harmful acts, assess the likelihood and consequences of these acts, and present a prioritized system upgrade plan. Emergency response plans are action steps that a water system will take if the primary drinking water source is contaminated or the flow of water is interrupted. Wastewater treatment plants will also be required to perform similar assessments under additional legislation that was introduced to the U.S. House of Representatives in June 2002 (HR 5169).

Pipelines Institute Heightened Security

Immediately following the attacks on September 11, 2001, natural gas pipelines and liquid pipelines across America instituted heightened security measures. These measures were adequate at the time, but they were stopgap and very short-term in protection and duration. A longer-term strategy that assesses the vulnerability and degree of security necessary for these facilities must be developed. ENSR recommended using a multi-disciplinary team for vulnerability assessment and safety integrity management for pipelines or other linear assets. ENSR's recent experience includes helping pipelines develop steps to take in a potential terrorist attack emergency and procedures for how the company should respond to comply with all applicable laws, rules and regulations.

This article originally appeared in the 03/01/2003 issue of Environmental Protection.