Background and content Major Accident Prevention Policy (MAPP) and Safety Management System (SMS)

1. This project is funded by the European Union Projekat finansira Evropska Unija Background and content Major Accident Prevention Policy (MAPP) and Safety Management System (SMS) Ike van der Putte PhD Toxicology – EUROTOX registered MSc Environmental Sciences ike.van.der.putte@rps.nl

2. ESSENTIAL ELEMENTS OF A SAFETY REPORT Note: Structure is according to ANNEX II SEVESO II; In practice structure of Safety reports is not followed exactly

3. I. MAPP and SMS Major Accident Prevention Policy (MAPP), is a “self-commitment” by the operator of a Seveso type establishment to meet the requirements of Article 5. (operator obligations) A safety management system (SMS) is instead a set of activities that ensures that hazards are effectively identified, understood and minimised to a tolerable level. In this sense, it may be regarded as the transposition of the general goals identified in the MAPP into specific objectives and procedures.

4. General Management System Principles Management of any sizeable activity is based on the idea of a “management loop”, which involves agreeing an objective, defining a plan to achieve that objective, formulating the detailed work required to implement the plan, carrying out the work, checking the outcome against the plan, and planning and taking appropriate corrective action. Safety management is no exception to this general principle. This means that in addition to the goals of the Safety Management System, and the issues it addresses, the integrity of the management loop and the completeness and accurate functioning of the management system are essential.

5. Plan-Do-Check-Act the Key to Safety Success

6. What is PDCA? PDCA (plan–do–check–act ) • An iterative four-step management method used in business for the control • Continuous improvement of processes and products Plan-Do-Check-Act the Key to Safety Success

7. General Management SystemModel – Plan, Do, Check, Act Policy Planning Management Review Implementation Checking Corrective Action

8. MAPP MAPP and SMS should address the following issues: 1. organisationandpersonnel 2. identification and evaluation of major-accident hazards 3. operational control 4. management of change 5. planning foremergencies 6. monitoring performance 7. audit and review

9. The MAPP is embedded in the overall management system of the company and sets the general goals for the SMS, the latter serving as basis for the risk/hazard analysis (as far as it concerns major accident hazards).

10. MAPP • The operator has to produce MAPP as a written document, which deals • specifically with the overall objectives and general principles of his procedures • for limiting the risk of hazardous incidents. • The document should specifically include the following points: • Formulation of a company policy, which states that the prevention of • hazardous incidents and the limitation of the effects of hazardous incidents • which, despite all efforts do occur is a high priority in the company objectives. • Presentation of the basic approach to implement this objective, for example • in the form of guidelines which are part of company policy.

11. MAPP The MAPP can be a much less detailed document than one which describes the Safety Management System but should clearly indicate the arrangements, structures and management systems required for each of the seven areas. A MAPP is not a mini safety report and should refer to other detailed documentation where necessary. Indeed there will normally be a hierarchy of documentation: at the top of this hierarchy the MAPP sets out the policy and principles of major hazard prevention, and then each subsequent level explains in more detail the application of these principles, finishing with workingdocumentsandinstructions.

12. MAPP MAPP -CORPORATE/COMPANY POLICIES AND GUIDELINES The corporate policy is the basis for the measures to be outlined . In larger companies, it may be appropriate to complement the corporate policy, which is usually formulated in rather general terms, with guidelines that show predominantly the company’s strategy for achieving certain protection goals. The corporate policy should not only make clear what the company is trying to achieve externally, but above all focus on this towards his own staff. Therefore it is recommended that staff, or staff representatives, are involved in the policy formulation process from the beginning, and that the policy's validity is confirmed by signatures of the company management.

13. MAPP Policy. It is recommended that management signsthe relevant documents. In addition to the company policies and any accompanying guidelines, MAPP must also state: a) what risks of hazardous incidents are present in the establishment; b) what provisions have been made for preventing these, or limiting their effects; c) in which way it is ensured that these measures are implemented properly. a) and b) are supplied in other sections of the safety report, particularly in the installation-specific safety analysis. c) Refers to the presentation of the safety management system which is dealt with seperately

14. MAPP HAZARD POTENTIAL IN THE ESTABLISHMENT - what risks of hazardous incidents are present in the establishment- The basis of all considerations is the identification of possible hazards. The regulations emphasize on major accidents (hazardous incidents). Basic details for the identification and evaluation of hazards are supplied in the notification procedure, which should be included as a copy. A reference on this document is possible. In this section it should be clarified which hazards can originate in the establishment. To do this, the possible hazards should be specified and evaluated with regard to their relevance to safety. The following factors in particular should be taken into consideration: Geographical location (sensitive/susceptable areas) Substances (complete list) Type of process or activity (selected for MAHs)

15. MAPP • b) TECHNICAL AND ORGANISATIONAL MEASURES TO PREVENT OR • LIMITTHE CONSEQUENCES OF MAJOR ACCIDENTS (1) • what provisions have been made for preventing these, or limiting their • effects • In this section, the operator should explain the basic measures proposed • to reduce and control the hazard potential described in the previous section, and • to limit the consequences of a hazardous incident. These measures can be of • technical and/or organisational nature. • Reference should also be made, if applicable, to other relevant documents, • such as licences,permits. It is, however, strongly recommended that the operator • makes clear in this section, which priorities are set in applying the safety policy • to meet the general obligations of the regulations

16. MAPP b. TECHNICAL AND ORGANISATIONAL MEASURES TO PREVENT OR LIMIT THE CONSEQUENCES OF MAJOR ACCIDENTS (2) The following factors may be important when determining and presenting technical safety relatedmeasures: - Safety-related construction and design characteristics of installation components, such as the material used (e.g. steel, glass or graphite), as well as location and overall design of these components. - Safety-related maintenance at the establishment/installation. - State-of-the-art of safety technology, regulations, standards, guidelines, etc. which must beobserved.

17. MAPP b. TECHNICAL AND ORGANISATIONAL MEASURES TO PREVENT OR LIMIT THE CONSEQUENCES OF MAJOR ACCIDENTS (3) Measures to prevent, and limit the effects of events which could cause major accidents, may include: - process control systems to prevent excessive pressure or temperatures; - safe containment of hazardous substances; - safetyvalves; - measures to avoid explosive atmospheres (e.g. inertisation); - measures to avoid sources of ignition (for example, using electrical installations according to qualified, i.e. standardised, categories of explosion protection,grounding); - fire prevention measures; - defensive and constructional fire protection measures; - equipment of constructional explosion protection, such as rupture disks, explosion flaps and explosion suppression systems; - rapidclosuredevices; - spillage-collectionfacilities; - sprinkler systems; - gas detectors; and - water/steamcurtains.

18. MAPP c) in which way it is ensured that these measures are implemented properly. The structure of the organisational measures is based on the principles for a Safety Management System (SMS) (only structure; not detailed; reference to be made to SMS procedures). In general, the technical and organisational measures of the operator have to provide the premises of meeting all legal requirements (laws, ordinances, accident prevention regulations, permits and legal conditions). This particularly includes measures, which guarantee that the operator’s documentation is in line with the current situation.

19. MAPP MAPP QUESTIONS - CHECK Q 1 Does the MAPP exist as a written document? Q 2 Does the senior management show commitment to the MAPP, e.g. through signature? Q 3 Has the MAPP been communicated to the workforce? Q 4 Is the MAPP communicated to contractors and third parties undertaking activities on site? Q 5 How does senior management review the MAPP

20. SMS MAPP and SMS should address the following issues: 1. organisationandpersonnel 2. identification and evaluation of major-accident hazards 3. operational control 4. management of change 5. planning foremergencies 6. monitoring performance 7. audit and review

21. Elements of Safety Management System (SMS) A safety management system (SMS) is a set of activities that ensures that hazards are effectively identified, understood and minimised to a tolerable level. In this sense, it may be regarded as the transposition of the general goals identified in the Major Accident Prevention Policy (MAPP) into specific objectives and procedures.

22. The MAPP is embedded in the overall management system of a company or site. The MAPP sets the general goals for the SMS, the latter serving as basis for the risk/hazard analysis (as far as it concerns major accident hazards). reference: http://www.uba.de/uba-info-medien-e/4510.html .

23. In practice a SMS consists of a compilation of written principles, plans, formal organisation charts, responsibility descriptions, procedural recommendations, instructions, data sets etc (character of “underlyingdocuments”) For the purpose of a safety report, the description of the SMS is of a summarising character and should address the following subsets. It shall at least consist of: • The major accident prevention policy (MAPP); • An explanation of the relationship of the MAPP to the site-specific aims and safety-related objectives; • Explanations in generic terms concerning how these objectives are met, especially with respect to consistency between the approaches followed and the measures taken.

24. It is useful to link the SMS to other existing or planned management systems in the company. If a holistic management system is already in place, the SMS should be integrated into it. This allows the operator to take company specific factors into account, for example, the SMS can be integrated into existing managements systems which comply with e.g. ASCA-based systems, ISO 9000 ff, ISO 14001, EMAS

25. 1. ORGANISATION AND STAFF Establishing the principal responsibility of the operator The operator, i.e. the management, is responsible for devising the SMS and for ensuring it is adheredto. Structuralorganisation The structural organisation of the SMS must be detailed, providing a clear assignation of tasks, functions and competences at the different levels of the company. Organisationcharts and job descriptions are particularly suitable for this task. Establishment organisation Details must be given of the principle used in the SMS to deal with establishment Processes in order to comply with the regulations (particularly establishment processes which cover more than one function or department). This covers establishment processes throughout the SMS, so detailed descriptions are not necessary in this section. Committees Qualificationsandtraining Involvement of staff and where appropriate of third parties and subcontractors

26. 2. IDENTIFYING AND ASSESSING THE RISK OF HAZARDOUS INCIDENTS The SMS must ensure that the potential for hazardous incidents is identified and that the probability and severity of these incidents is assessed. Suitable systematic methods should be used to achieve this. All sections of the establishment, and where appropriate external sources of potential hazards, are to be taken into account. Appropriate measures should be taken on the basis of the risk assessment. The SMS providesthe more detailed definitions on which the identification and assessment of risks of major accidents are based Ref. Hazid (with Hazop. DOW, What if etc) Ref. Hazard & Scenario Analysis (Fault tree, Event tree, Bowtie etc.) Descriptions of how the outcomes of hazard identification and risk assessment have been used to determine the physical control measures and management risk control systems needed for the prevention and mitigation of major accidents.

27. 3. OPERATIONAL CONTROL (1) General The SMS must ensure that for all safety-related procedures: - there are written work and operating instructions; - staff are informed in writing or orally in an appropriate way; - the work and operating instructions are exercised in practice where necessary; & - are monitored, to see whether they are reasonable and viable, and whether they are obeyed The inclusion of temporarily employed staff, outside companies and subcontractors should be taken into consideration when drawing up work and operating instructions. When drawing up this section of the SMS, it is important to remember that work and operating instructions are required under a number of other national regulations.

28. 3. OPERATIONAL CONTROL (2) Workand operating instructions Work and operating instructions can be related to the workplace, the activity, or the substances handled. According to context and validity, they should resolve the following issues in particular: - competenceandresponsibility; - start of the installation or facility; - normal operation of installations, facilities and work materials; - handling of hazardous substances and preparations; - recognising disruptions, procedure for establishing the cause and both methods and responsibility for resolving the disruptions (return to normal operation); - fixed-term or special operating circumstances; - operation during maintenance and cleaning; - close down of the installations and facilities under normal conditions; - procedures for installation stoppages; and - procedure in the event of operational disruptions and in emergencies, including emergency stoppages, first aid procedures and appropriate disposal of wastes. Where there are extensive procedures and protection measures, it has always been worthwhile to expand work and operating instructions with checklists or step-by-step lists (see system UK)

29. 3. OPERATIONAL CONTROL (3) Training The SMS should ensure that not only there is regular training on the content of the operating and working instructions, but special instructions are provided: - before new or modified installations, facilities or work materials begin to operate; - before new or transferred staff take up related functions; - before processes, establishments or working arrangements are modified; - before different substances or operating media are used; - before major disconnections, closures or other activities which are particularly hazardous; - after incidents involving accidents, damage or emissions; - when legal requirements have an effect on establishment processes; and - in the event of any other changes which have to be made to the operating and work instructions, forwhateverreason.

30. 4. MANAGEMENT OF CHANGE (1) The following issues shall be addressed by the safety management system: Management of change - adoption and implementation of procedures for planning modifications to, or the design of new installations, processes or storage facilities.

31. 4. MANAGEMENT OF CHANGE (2) The operator should adopt and implement management procedures for planning and controlling all changes in people, plant, processes and process variables, materials, equipment, procedures, software, design or external circumstances which are capable of affecting the control of major accident hazards. This approach should cover permanent, temporary and urgent operational changes, and should address: • definition of what constitutes a change • assignment of responsibilities and authorities for initiating change • identification and documentation of the change proposed and of its implementation; • identification and analysis where appropriate of any safety implications of the change proposed; • definition, explanation where appropriate, documentation, and implementation of the safety measures deemed appropriate, including information and training requirements, as well as the necessary changes to operational procedures; • definition and implementation of appropriate post-change review procedures and corrective mechanisms, and subsequent monitoring.

32. 5. PLANNING FOR EMERGENCIES Implementingthe emergencyplans This section of the SMS contains a description of the procedure for identifying foreseeable emergencies, and for drawing up, testing and reviewing the internal emergency plans (alert and disaster control plans), and for the identification and passing on of information required from the operator for drawing up external emergency plans. The SMS should determine the following, in particular: - The procedure for identifying foreseeable emergencies, based on a systematic analysis (scenarios). This must ensure that all installations and storage facilities are systematically examined for potential technical, organisational or human failures which could cause an emergency situation. - The group of people who will carry out this analysis. Teamwork is recommended. In the event of insufficient internal expertise, outside resources have to be brought in. - The different competences for carrying out the analysis, and for devising, testing and reviewing the resultant emergency plans. - The procedure for devising internal emergency plans.

33. 6. MONITORING PERFORMANCE Relevant text from the Directive: The following issues shall be addressed by the safety management system: Monitoring performance - adoption and implementation of procedures for the ongoing assessment of compliance with the objectives set by the operator’s major accident prevention policy and safety management system, and the mechanisms for investigation and taking corrective action in case of non-compliance. The procedures should cover the operator’s system for reporting major accidents or near misses, particularly those involving failure of protective measures, and their investigation and follow-up on the basis of lessons learnt.

34. 6. MONITORING PERFORMANCE (2) The operator should maintain procedures to ensure that safety performance can be monitored and compared with the safety objectives defined. This should include determining whether plans and objectives are being achieved, and whether arrangements to control risks are being implemented before an incident or accident occurs (active monitoring), as well as the reporting and investigation of failures which have resulted in incidents or accidents (reactive monitoring).

35. 6. MONITORING PERFORMANCE (3) Active monitoring should include inspections of safety critical plant, equipment and instrumentation as well as assessment of compliance with training, instructions and safe working practices. Reactive monitoring requires an effective system for reporting incidents and accidents and an investigation system which identifies not only the immediate causes but also any underlying failures which led to the event. It should pay particular attention to cases of failure of protective measures (including operational and management failures), and should include investigation, analysis, and follow-up (including transfer of information to personnel involved) to ensure that the lessons learnt are applied to future operation. The information from performance monitoring should also be a significant input to the processes of audit and review (see next slides)

36. 7. AUDIT AND REVIEW (1) Relevant text from the Directive: The following issues shall be addressed by the safety management system: Audit and review - adoption and implementation of procedures for periodic systematic assessment of the major accident prevention policy and the effectiveness and suitability of the safety management system; the documented review of performance of the policy and safety management system and its up-dating by senior management.

37. 7. AUDIT AND REVIEW (2) The terms “audit” and “review” are used here for two different activities. An audit is intended to ensure that the organisation,processes, and procedures as defined and as actually carried out are consistent with the Safety Management System; It should be carried out by people who are sufficiently independent from the operational management of the unit being audited to ensure that their assessment is objective. A review is a more fundamental study of whether the Safety Management System Is appropriate to fulfil the operator’s policy and objectives, and may extend to considering whether the policy and objectives shouldthemselvesbemodified.

38. 7. AUDIT AND REVIEW (3) Audit (1) In addition to the routine monitoring of performance, the operator should carry out periodic audits of its SMS as a normal part of its business activities. An audit should determine whether the overall performance of the Safety Management System conforms to requirements, both external and those of the operator. The results of these audits should be used to decide whatimprovements should be made to the elements of the SMS and their implementation. For this purpose the operator should adopt and implement an audit plan covering items 1-6.

39. 7. AUDIT AND REVIEW (4) Audit Plan(2) The audit plan, which should be reviewed at appropriate intervals, should define: • the areas and activities to be audited; • the frequency of audits for each area concerned; • the responsibility for each audit; • the resources and personnel required for each audit, bearing in mind the need for expertise, operational independence, and technicalsupport; • the audit protocols to be used (which can include questionnaires, checklists, interviews both open and structured,measurementsandobservations); • the procedures for reporting audit findings; • the follow-up procedures.

40. 7. AUDIT AND REVIEW (5) Review Senior management should, at appropriate intervals, review the operator's overall safety policy and strategy for the control of major-accident hazards, and all aspects of the SMS to ensure its consistency with these. The findings of the monitoring and of the audit are to be specifically included. This review should provide information to determine whether the policy or the objectives themselves need to be modified. This review should also address the allocation of resources for SMS implementation, and should consider changes in the organisation as well as those in technology, standards, andlegislation.

41. SMS - QUESTIONS - CHECK Q .1 Is the organisation of the facility documented, the process safety related units roles and responsibilities clearly identified? Q .2 Have processes for identifying and monitoring the process safety requirements on personnel and their roles and responsibilities been developed? Q .3 Have processes for the identification of hazards and assessment of their risks been defined? Q .4 Have processed been defined for the communication of the results from hazard identification and risk assessment? Q .5 Do processes exist for addressing changes in documents as a result of changes? Q .6 Do processes exist for developing internal emergency plans? Q .7 Do processes / procedures exist for training / drills related to the internal emergency plan? Q .8 Are there complete processes and procedures in place for monitoring compliance with defined requirements? Q .9 Does an accident reporting mechanism exist? Q .10 Is a process defined for regular audits? Q .11 How does senior management review the MAPP and the SMS?

42. REFERENCES Sectoral Checklist for preparation and inspection of a Safety Report. UNECE Convention on the transboundary effects of industrial accidents & the EU Directive 96/82/EC (SEVESO II) by a consistent Checklist System This publication is only available online. It can be downloaded as ANNEX 3 from http://www.uba.de/uba-info-medien-e/4510.html . Guidelines on a Major Accident Prevention Policy and Safety Management System,as required by Council Directive 96/82/EC (SEVESO II). Neil Mitchison & Sam Porter (Eds.) ISBN92-828-4664-4 Guidance on the preparation of a Safety Report to meet the requirements of Directive 96/82/EC as amended by Directive 2003/105/EC (SEVESO II). Luciano Fabbri, Michael Struckl and Maureen Wood (Eds.), 2005. ISBN 92-79-01301-7