AA_AFRG_000003

8/12/2019 AA_AFRG_000003

1/55

HAZARDOUS MATERIALS MANAGEMENT GUIDELINE

AA_AFRG_00000300.doc APPROVED 13 August 2008 Page 1 of 55

This document is intended for Company use only. Reproduction for external use is allowed only under specific authorisation.Anglo American assumes no responsibility for the content and/or the implications of its use by third parties.

AA_AFRG_000003

ISSUE 0

ANGLO FATAL RISK GUIDELINE

HAZARDOUS MATERIALS MANAGEMENT

8/12/2019 AA_AFRG_000003

2/55




AA_AFRG_000003

ISSUE 0

CONTENTS PAGE

1 SCOPE 32 OBJECTIVE 33 APPLICATION 33.1 DEFINITIONS 44 RECOMMENDED APPROACH 75 REQUIREMENTS OF THE STANDARD 85.1 PLANTANDEQUIPMENTREQUIREMENTS 95.2 SYSTEMANDPROCEDURAL REQUIREMENTS 285.3 PEOPLEREQUIREMENTS 50REFERENCES 55RECORD OF AMENDMENTS 55

8/12/2019 AA_AFRG_000003

3/55




AA_AFRG_000003

ISSUE 0

1 SCOPE

This guideline refers to the implementation of the Anglo Fatal Risk Standard: Hazardous

Materials and should be read in conjunction with that Standard.

The guidelines contained in this document are considered as "highly recommended" anddeviations are to be documented and justified. Full adherence to these guidelines will notbe a factor in determining compliance with the Standards, since alternative methods canbe available if justified on a risk basis.

In case of conflict with requirements of any other Anglo document or guideline, thefollowing hierarchy will apply:

1. Anglo Safety Way - ASW

2. Anglo Fatal Risk Standards - AFRS

3. Anglo Fatal Risk Guidelines - AFRG

It is important that when implementing Standards the organisation takes cognizance of,and comply with the relevant legal requirements in the country of application.

2 OBJECTIVE

The purpose of this Guideline is to provide guidance and clarity to assist inimplementing the requirements of the Hazardous Materials Fatal Risk Standard.

This guideline has been developed to provide more detail and clarification for theimplementation of the requirements of the Standard. This should enable sites to be more

aligned with each other on what the boundaries are with regards to meeting therequirements.

This guideline is by no means exhaustive and will be updated periodically and supportedby good practice sharing. It is not intended as a template for achieving compliance.

3 APPLICATION

Pertinent section in the standard: This Standard applies to all Anglo American Groupmanaged businesses and operations, including contractors and visitors when involved incontrolled activities.

Controlled Activities or Controlled Sites are those where the Anglo American GroupCompany has the authority to determine how to manage the operation.

It does not include monitored or uncont rolled activities.

Monitored Activities are those where Anglo American can exercise some influence butcannot set Policies and/or comprehensive Control Standards and/or directly supervise andenforce their application (i.e. contractor and supplier transporting their goods and/orpersonnel to or from controlled sites).

Uncontrolled Activities are those where Anglo American does not set or influencePolicies or Control Standards and does not supervise safety performance. These includeservices provided by public Companies, activities performed at supplier or manufacturer

shops, etc.

8/12/2019 AA_AFRG_000003

4/55




AA_AFRG_000003

ISSUE 0

Where there is uncertainty over whether the activity is controlled, monitored oruncontrolled, the matter should be referred to the Safety function for determination.

3.1 DEFINITIONSHAZOP : A HAZard and OPerability study is a useful tool in evaluating any

inherent hazards or operational problems. The technique enforces astructured, systematic examination of complex process facilities.

HAZID : A (HAZard IDentification) is high level hazard identification thattypically addresses the overall project, not only the process equipment.

MSDS : A Material Safety Data Sheet (MSDS) is a document that containsinformation on the potential health effects of exposure to chemicals, orother potentially dangerous substances, and on safe workingprocedures when handling chemical products. Each MSDS must

contain a minimum of sixteen sections, as prescribed by internationalstandards.

HAZCHEM : This is a code system developed to provide immediate action advicewhen dealing with a chemical incident. Chemicals are assigned a codee.g. 3Y on the basis of the hazard that they represent and the requiredemergency response.

MHI : Major Hazard Installation that holds a quantity of a hazardoussubstance which may pose a risk that could fatally affect the healthand safety of employees and the public.

Hazardous Material

Pertinent Section in the Standard: This Standard applies to hazardous materials in MajorHazard Installations (MHI) that, in one or more of their forms (solid, liquid or gas), havethe potential to lead to harm to people, the environment or community (all stakeholders),either in an incident involving loss of control or in normal, controlled activities (e.g.storage, handling, production, transport, recycling and disposal). Where hazardousmaterials, processes or facilities do not qualify as Major Hazard Installations, somerequirements of this Standard may not be practicable. In these cases, a risk-basedapproach shall be used to determine the level of compliance required. This Standarddoes not cover handling of explosives or radioactive materials, for which specificprocedures shall be in place.

A hazardous material isa substance or mixture of substances having properties capableof producing adverse effects on the health or safety of a human. Included are substancesthat are carcinogens, toxic, irritants, corrosives, sensitizers, asphyxiants and agents whichmay damage the lungs, skin, eyes, mucus membranes or substances which are subject tothe release of large amounts of energy such as explosive gases.

Hazardous materials are present at most Anglo sites in activities such as storage,warehousing, processing, distribution, transportation, cleaning, maintenance and wasterecycling and disposal. The risk associated with hazardous materials is normallyassociated with uncontrolled loss of containment or mishandling and they are typicallycontrolled through a Hazardous Materials Register.

8/12/2019 AA_AFRG_000003

5/55




AA_AFRG_000003

ISSUE 0

Note:for the purpose of Anglos initiative bulk fuels including bulk petrol, diesel and oilsand particularly used engine oils are included along with potentially hazardous wastematerials.

Hazardous materials can present different physical states such as solid, liquid, mists,vapours or gases, pure reagent or mixtures and have the potential to harm human healththrough the following properties:

Nature of Hazard

Flammable/ explosive

Toxic

Corrosive

Irritating/ allergenic

Sensitising

Carcinogenic (cancer inducing)

Mutagenic (likely to induce genetic damage)

Teratogenic (likely to induce foetal damage)

Asphyxiant

Hazardous materials may enter the human body in a number of ways depending on thematerial, its phase (i.e. solid, liquid or gas) and how it is used. The main routes of concernin industry are via inhalation and absorption. Inhalation is the most common route of entryas many toxic materials are present in an airborne form. Entry via the skin and eyes isthrough direct contact with a material. Ingestion is not a common route and predominantly

occurs through poor hygiene practices.

Mode of Assimilation

Inhalation (i.e. breathing in the material)

Ingestion (i.e. swallowing the material either directly or indirectly)

Skin or mucus membrane absorption (i.e. directly or indirectly via contaminatedclothing etc.)

Injection (i.e. into the body by high pressure jet/hose, puncture by sharp object).

Note: it is worth considering the application of these requirements to materials which,

although not hazardous for human health by themselves, may cause damage throughindirect effects (i.e. use of gases that displace oxygen and may cause asphyxiation in aconfined environment).

Exposure Level

The level of exposure depends upon various factors including how the material is handled,how much is used and the existing controls such as ventilation and personal protectiveequipment (PPE). Health effects may be acute,resulting from a short-term (usually high)exposure or chronic, resulting from long-term (often low level) exposure over a period oftime. Chronic effects may not occur for many years, are hard to predict in advance andwhen they do occur it may be hard to identify what caused them.

8/12/2019 AA_AFRG_000003

6/55




AA_AFRG_000003

ISSUE 0

Occupational health and safety laws in most countries require that the risks associatedwith Hazardous Materials are effectively controlled and the exposure to hazardoussubstances is kept below levels at which health effects are known to occur. These laws

usually require workplaces to make sure potentially affected personnel know: What hazardous substances are being used;

What effects they can have on health; and

What has to be done to prevent or minimise exposure to them.

All sites must identify and comply with all relevant local legislation, standards, licenses,permits and other requirements in relation to hazardous materials as well as therequirements of the Hazardous Materials Management Standard.

Major Hazard Installation (MHI) is a term used by South African legislation to classifythose facilities handling hazardous materials that may represent a significant risk to

people in or around the sites. Key considerations for classifying a facility as MHI are:

"the Act" means the Occupational Health and Safety Act, 1993 (Act No. 85 of1993)

"major hazard installation" means an installation where any substance isproduced, processed, used, handled or stored in such a form and quantity that it hasthe potential to cause a major incident;

"major incident" means an occurrence of catastrophic proportions, resulting fromthe use of plant and machinery, or from activities at a workplace;

"on site emergency plan" means the emergency plan to be followed inside thepremises of the installation or part of the installation classified as a major hazard

installation.

"off site emergency plan" means the emergency plan to be followed outside thepremises of the installation or part of the installation classified as a major hazardinstallation.

"risk assessment" means a process of collecting, organising, analysing,interpreting, communicating and implementing information in order to identify theprobable frequency, magnitude and nature of any major incident which could occurat a major hazard installation and the measures needed to be taken to remove,reduce or control potential causes of such incident

8/12/2019 AA_AFRG_000003

7/55




AA_AFRG_000003

ISSUE 0

4 RECOMMENDED APPROACH

A high proportion of the elements in this standard including Major Hazard Installations

are risk based and a standardised approach to risk assessment will be needed to ensureuniformity of application. It is recommended that Anglo Technical Division is consulted foradvice on the current techniques of risk assessment where cognisance is taken of thevalue of both quantitative and qualitative approaches to risk management.

To support the risk management approach referred to above a comprehensive documentand revision control system is a pre-requisite and again AR/ATD may be consulted foradvice in this area.

Notes:

The application of the material in question must be considered in the environment in whichit is to be used. It may therefore require a HAZOP- type RA to evaluate as part of the

Baseline RA (the risks associated with the use of this specific material). Any change inthe use of the material will have to be reassessed using the change managementprocedures.

Non hazardous substances could become hazardous under certain conditions (e.g. waterin contact with molten metals see relevant FRP). Protection systems e.g. gas dumpingsystems could result in control rooms becoming confined spaces.

It is recommended that the users of HAZMAT adhere to the Responsible Care principle,which expects that companies take ownership for the entire life- cycle of hazardousmaterials.

No

Management Appro val in

Safety Document System

New

Material

Supplier Information& MSDS

Possible Hazard?

Refer AFRSImplemetationGuideline forpossible hazard

types

Enter in Hazardous Material

Register

Baseline Risk

Assessment toIdentify high riskmaterials

Can the Materialor Risk be:

Eliminated?Substituted?Process re-

designed?Separated?Reduced by

Training etc?

Low Risk

PPE,BiologicalMonitoring,Buddy

System etc

SHE Document,Standard OperatingProcedure, orSafe Work Practice

Doc

Risk

AssessmentProcedures

Yes

Pending

Assessment

Residual

Risk Acceptable?Yes

Yes

NoRejectfor use

High Risk

8/12/2019 AA_AFRG_000003

8/55




AA_AFRG_000003

ISSUE 0

Responsible Care is the chemical industrys global voluntary initiative under whichcompanies, through their national associations, work together to continuously improvetheir health, safety and environmental performance, and to communicate with

stakeholders about their products and processes.

The Responsible Care ethic helps industry to operate safely, profitably and with duecare for future generations, and was commended by UNEP as making a significantcontribution to sustainable development at the World Summit on SustainableDevelopment in 2002.

5 REQUIREMENTS OF THE STANDARD

This section is structured using exactly the same numbering sequence as the Fatal RiskStandard document. Each requirement is repeated in a box, followed by a statement ofintent. This is followed by discussion and clarification of that particular requirement.

Detail has been added to some, but not all requirements, as some sections were deemedself explanatory.

Definition for some of the terms used in these guidelines:

ALARP : As low as reasonably practicable

CHAZOP : Computer HAZOP

ChemAlert : A Windows based chemical hazard management system to assist in thesafe usage, handling and waste disposal of hazardous materials throughthe provision of Facility: Plant, equipment, buildings and civil

infrastructure

FMEA : Failure Modes and Effects Analysis

FTA : Fault Tree Analysis

HazID : Hazard Identification

HAZOP : Hazard and Operability Study

IBC : Intermediate Bulk Container (a rigid or flexible portable packaging that is

typically of a volume between 500 and 3000 litres)

MSDS : Material Safety Data Sheet

NFPA : National Fire Protection Association

PHA : Process Hazard Analysis

P&ID : Piping and Instrumentation Diagram

PPE : Personal Protective Equipment

PSV : Pressure safety Valve

8/12/2019 AA_AFRG_000003

9/55




AA_AFRG_000003

ISSUE 0

QRA : Quantitative Risk Assessment

SIL : Safety Integrity Level

5.1 PLANTANDEQUIPMENTREQUIREMENTS

1. Process Risk Assessment

The basis of design of a facility or process, whether permanent or temporary,which transports, produces, stores, uses or disposes of hazardous materials shallbe reviewed (preferably with the vendor), amended as necessary anddocumented, utilising a process risk assessment tool such as HAZOP, HAZID,etc. As-built design drawings (e.g. process and instrumentation diagrams,process flow diagrams, layout drawings, isometrics, software upgrades, etc.) shallbe updated as a result of these reviews.

Process risk assessments should be carried out during all phases of a facility life.During the design phase the reviews should start as early as possible and usepreliminary hazard analysis techniques. As the design progresses into executionmore detailed techniques appropriate to the risk profile should be used. During theoperating phase there should be regular reviews at frequencies required by locallegislation or as consistent with the risk profile. During operation, process riskassessments should also be part of the management of change system for anymodifications to plant and equipment.

A variety of process hazard identification and risk assessment tools are available.Some methods are alternatives or are complementary to others. Advice should besought where necessary to select the most appropriate tool.

All methods involving hazard identification should be facilitated by someonecompetent in the technique and involves a review team selected to represent a widerange of disciplines including production, maintenance, technical and safety. Theteam should be provided with the necessary information on hazards of materials,process technology, design drawings, procedures, equipment data sheets,instrumentation control logic, incident experience, previous hazard reviews, etc. Atthe conclusion of the study a report should be issued with a set of recommendedactions and queries concerning the design.

The following is a brief overview of some of the more frequently used tools.

Hazard Identi fication (HazID)HazID is the name sometimes given to the process of identifying credible hazardsfor a Quantitative Risk Assessment (QRA). There are a number of generictechniques that can be used including HAZOP, What-if/Checklist, and FMEA.

Process Hazard Analysis

Process Hazard Analysis is the application of one or more analytical techniques toidentify and evaluate process hazards for the purpose of determining the adequacyof or need for control measures. Regulatory authorities in the US (OSHA and EPA)require a hazard analysis for all subject processes. Acceptable methodologiesinclude What-if, Checklist, What-if/Checklist, HAZOP, FMEA and FTA or other

appropriate equivalent methodology.

8/12/2019 AA_AFRG_000003

10/55




AA_AFRG_000003

ISSUE 0

Hazard and Operabili ty Study (HAZOP)

HAZOP is a qualitative structured brainstorming technique that identifies thepotential hazards and operating issues with the design of processes, plant and

equipment and concentrates on how the design will cope with deviations fromdesign conditions.

HAZOP studies primarily use P&IDs and systematically question every part of thesystem being studied on a section by section basis. Deviations from the intent of thedesign, their causes and consequences are investigated. Deviations are identifiedusing a checklist of standard guide words (pressure, temperature, flow, level,composition, maintainability etc), which also suggest deviations from normaloperating conditions (high, low, reverse, etc).

When hazard and operability issues are identified, risk assessment is required todetermine if the hazards are credible and to recommend actions including design

changes to address them. Those actions may be a result of the following resolutionmethods:

Brainstorming: the options to eliminate or control (Terminate, Treat, Transferof the risk in this order of preference) are to be considered. The effectiveness,cost and residual risk following the implementation of the proposed controlmeasure is then weighed.

Experience: individual or collective experience in the review team can identifythe control because this situation and solution has been seen before;

Codes of Practice: the control is dealt with through some applicable codes ofpractice, design standards or other industry standards or guidelines; or

Hazard Analysis: either the level of risk is uncertain or the control(s) for therisk are not obvious and so further analysis is required (e.g. QRA).

Cost effective resolution by any of the first three methods is preferable to avoid theneed for more time consuming qualitative or quantitative risk assessment (seelater).

The advantages of HAZOP are that it encourages creativity and new ideas andbecause it is a systematic method it tends to be more thorough and accurate.Limitations are that it assumes that the design has been carried out in accordancewith appropriate engineering design codes. It can also be time consuming andsuccess is significantly dependent upon the knowledge and experience of the team

members and the capability of the leader. The process requires a trained facilitator,preferably with experience in the process evaluated.

What-if/Checklist

What-if/Checklist is a qualitative technique that is a combination of the creativebrainstorming What If technique and the prescriptive Checklist technique. Thepurpose of the technique is to identify hazards, consider the types of incidents thatcan occur in a process or activity, evaluate in a qualitative manner theconsequences and determine whether the existing controls are adequate.

The study team leader and a sub team first formulate the initial what if questions tobe used and also assemble the process specific checklists. The brainstorming

technique is then used on subsections of the process guided by the set questions toidentify possible deviations and weaknesses in design.

8/12/2019 AA_AFRG_000003

11/55




AA_AFRG_000003

ISSUE 0

Questions such as: What if the pump stops? and What if the level sensor fails?are used to stimulate discussion. As the study progresses, any new what ifquestions that become apparent are examined. This is followed by one or more

checklists which are used to trigger thoughts about situations that may have beenoverlooked. Checklists which are specific to the type of industry or process and arebased on prior experience are available (references for checklists are provided inLees: Loss Prevention in the Process Industries). If hazards are identified thenrecommendations are made as to additional controls to minimise or eliminate therisk (similar to HAZOP).

The technique is relatively easy to use, quicker than HAZOP, and is a good mix ofcreativity and previous experience captured in checklists. Limitations are that itdepends upon the knowledge and expertise of the team performing the analysis andon the right questions being asked. It is not particularly effective in identifying new orpreviously unrecognized hazards and focus can also be lost due to repetition of the

checklists.

Failure Modes and Effects Analysis (FMEA)

FMEA is a qualitative analytical technique which identifies each failure mode, thesequence of events associated with failure and the consequences of failures ormalfunctions of individual components (pressure relief devices, valves, switches,pressure vessels, pumps etc) in a system. The technique is oriented towardsequipment rather than process parameters. Guidance on FMEA is given in BS 5760Reliability of Systems, Equipment and Components, Part 5:1991 Guide to FailureModes, Effects and Criticality Analysis (FMEA and FMECA).

For the system that is to be studied questions are asked for each component such

as:

How can each component fail?

What might cause these modes of failure?

What would the effects be if the failure occurs?

How serious are these failure modes?

How is each failure mode detected?

The risk of each is assessed using a risk matrix. A report details the failure modesof components, including recommended risk reduction actions either to reduce thefrequency of failure or mitigate the consequences of failure.

The limitations of FMEA are that it focuses on single failures of equipment and itmay not recognise multiple failures or multiple causes. It also does not focus onhazards caused by human error and can be a laborious and inefficient processunless judiciously applied. Consequently this is best done in combination withHAZOP.

8/12/2019 AA_AFRG_000003

12/55




AA_AFRG_000003

ISSUE 0

Fault Tree Analysis (FTA)

FTA is a predominately quantitative graphical technique that provides a systematicdescription of the combinations of possible hardware and human failures in a

system which can result in an undesirable outcome. The outcomes with the highestrisk such as fire, explosion and release of toxic materials are selected as the topevent in the fault tree. Such events may have been identified as a result of previoushazard identification studies such as HAZOP, What-if/Checklist, or FMEA. A faulttree is then constructed top down by relating the sequence of events whichindividually or in combination could lead to the top event. The fault tree isconstructed by deducing in turn the preconditions for the top event and thensuccessively for the next levels of event, until the basic causes are identified.

The fault tree is graphically developed using AND and OR gates. By ascribingprobabilities to each event, the probability of the top event can be calculated.

FTA is an effective technique for identifying failures that have the greatest influenceon bringing about the top event. If the risk is unacceptable then in order to reducethe risk corrective action should be taken with emphasis on those branches of thetree that have the most effect on the top event. Actions may include adding safetydevices, testing safety devices more frequently or improving the design andreliability of devices. FTA focuses on developing the logical links of failures that leadto the top event and is not that effective in identifying the hazards themselves.

Preliminary Hazard Analysis

Preliminary Hazard Analysis is a qualitative method used to identify hazards with adesign in concept and/or pre-feasibility stages. Controls implemented at this earlydesign stage are less costly and easier to implement than in later design stages.Usually this method is driven by a checklist and one method of application is to usehazard guidewords characterised by energy type (electrical, mechanical, chemical,kinetic, potential, pressure, thermal, fire/flammability, explosive, acoustic, biological,radiation, etc). Each process unit or area is then reviewed with these guidewords.Various aspects are reviewed including the effect of these hazards on people,equipment, product, environment, community etc. Hazards identified are treated in asimilar way as with other HazID techniques.

Preliminary Hazard Analysis is reliant upon the skills and experience of the peopleinvolved. Hazards are only assessed singly and the method does not evaluate thecombined effect, nor is it a substitute for conforming to applicable design codes,standards and regulations and subsequent use of other techniques such as HAZOP.

Variants of this methodology are Concept Hazard Analysis and Screening LevelRisk Analysis (SLRA).

Procedural HAZOP

The procedural HAZOP is similar to HAZOP but is intended to identify specificHAZARDS around the procedures associated with the operation of the systems. Itnormally follows in the implementation stage once procedures are being developed.Examples of questions are:

Not done/ step omitted

Done too early/too late Too many repetitive tasks

8/12/2019 AA_AFRG_000003

13/55




AA_AFRG_000003

ISSUE 0

Computer HAZOP (CHAZOP)

This technique is similar to HAZOP but is intended to identify specific hazardsassociated with computer control systems of processes. CHAZOP is typically only

done during the project design phase and if it is done it normally follows on after theproject HAZOP. Like HAZOP this technique uses a systematic methodology withguidewords. As well as looking at the hardware design aspects of the system it alsoreviews the control logic with a question set to investigate control failures. Examplesof questions are:

Does the failure matter?

Will the operator be aware of the failure?

What should the operator do?

The input and output signals are each reviewed with guidewords such as: low, high,

invariant, drifting and bad.

Hazard Indices

There are several hazard indices such as the Dow Index and Mond Index. Theseindices are not hazard identification tools but rather tools for risk ranking of hazardsin a particular facility and comparative risk ranking to other similar facilities. Furtherinformation is available in Lees: Loss Prevention in the Process Industries.

Qualitative and Quantitative Risk Assessment

Depending on the site-specific requirements of the process hazard analysis and thehazards identified, the analysis of the risks associated with the hazard can vary fromsimple intuitive qualitative risk assessments conducted during the HazID, to formal

qualitative risk assessments and ultimately to Quantitative Risk Assessment (QRA).

QRA is a quantitative method of estimating the magnitude of risk. It provides adegree of objectivity and a facility for ranking risks. It does however involve somedegree of subjectivity as it relies to a certain extent on past events and/orexperience. QRA uses numerical values for consequences and likelihood using datafrom a variety of sources. Consequences are evaluated by various modellingtechniques. Usually consequence modelling is done using specialist modellingsoftware for evaluating the effects of:

Flammable and toxic gas releases

Fires (including jet, pool and building / warehouse fires)

Explosions

Products of combustion / fires including smoke and toxic gases.

Risks that cannot be eliminated should be documented in the sites risk register.

Current drawings should be available for all process risk assessment reviews.Drawings which may be required are listed in requirement 18. Affected drawingsshould be updated at the conclusion of any design changes as a result ofimplementing engineering controls.

8/12/2019 AA_AFRG_000003

14/55




AA_AFRG_000003

ISSUE 0

2. Risk Assessment of Design Specifications

All specifications for the location, design and/or modification of hazardousmaterials facilities shall be subjected to risk assessment that includes materials

selection, site conditions, transport, production, storage, handling, use anddisposal. Previous incidents shall be reviewed.

The design of an entire facility as well as subsystems and individual items of plantand equipment is critical to effective elimination or minimisation of risks. An integralpart of the design process for new or modified plant and equipment is the selectionof appropriate design codes and standards. In some cases the application of thesealone is sufficient; however, where necessary, designers should conduct hazardidentification, risk assessment and identification of controls to achieve a designwhere the risk is ALARP. When conducting risk assessments, previous incidents insimilar or related facilities should be reviewed to ensure that the learnings areincorporated.

Process risk assessment methods as outlined in requirement 1 generally assumethat the design has been carried out in accordance with appropriate engineeringdesign codes and standards. Depending upon the types of hazardous materialsinvolved and the complexity of the process, plant and equipment which handles thehazardous materials and the following aspects of design may also require riskassessment:

Process selection (inherently safer design)

Plant siting and plot plan layout

Storage tanks design (segregation, containment etc)

Separation distances Hazardous area classification

Ignition sources

Fire and explosion analysis

Fire protection (passive and active equipment)

Vapour cloud dispersion modelling

Control building design and survivability to fire and explosion and toxic gasclouds

Emergency response equipment

Escape route and refuge area survivability

Materials of construction selection

Pressure equipment

Materials handling systems (spillage, stoppage etc)

Valves (leakage routes through glands and flanges)

Rotating equipment (catastrophic failure, leak routes though glands and seals)

Equipment reliability (FMEA)

Control system reliability (Safety Integrity Level)

Effluent and drain systems

Flare and Blowdown systems

Waste disposal

8/12/2019 AA_AFRG_000003

15/55




AA_AFRG_000003

ISSUE 0

Manual handling of raw materials and products

Maintainability (provision for access, decontamination, isolation, vessel entry)

Positive isolation requirements (e.g. spool pieces required to all equipment

that needs to be isolated. Provision for calibration without exposure to hazardous materials/conditions

Provision for sampling of process streams without exposure to hazardouscircumstances)

Safeguarding and personal protection

Human factors analysis (alarm management, mal-operation etc.)

Commissioning, start-up and shutdown studies

Transport systems including loading and unloading and offsite risks

Risks that cannot be eliminated should be documented in the sites riskregister.

3. Emergency Response Facilit ies

All facilities which have a significant risk from hazardous substances shall providea risk-based emergency response plan which includes:

- emergency response procedures appropriate to the hazardous materials andthe risk

- emergency equipment/facilities (e.g. oxygen, antidotes, showers, etc.) onlocation where hazardous materials are stored or used

- means of escape in an emergency situation

- clearly marked emergency isolation valves

- emergency response teams appropriate to the risk

- appropriate use of safe refuge and assembly areas for people

- emergency response equipment for spillage containment, fires, explosions,burns, etc.

- appropriate response arrangements with external emergency services(e.g. ambulance, hospitals, fire brigade, medical personnel, etc.)

- impact minimisation including spill clean-up and dust suppression

- recovery procedures and disposal of the hazardous material.

This requirement covers the plant and equipment required for emergency response(the systems for emergency response are covered in requirement 24 and training in

requirement 34). The plant and equipment may be fixed equipment such as firepumps or portable equipment such as fire extinguishers. In many countries,emergency response equipment is specified by legislation, design standards andcodes of practice for hazardous industries. The plant and equipment should also beidentified as a result of design studies and/or risk assessment in order to be able torespond to credible emergency scenarios and can include:

Designated emergency assembly areas and safe refuges

Emergency escape and evacuation routes/role of access control

Emergency sirens and warning systems

Emergency alert equipment such as break glass alarms

8/12/2019 AA_AFRG_000003

16/55




AA_AFRG_000003

ISSUE 0

Communication systems including both fixed such as public address andtelephones and portable such as hand held radios

Detection systems such as thermal, fire, smoke, flammable and toxic gas

detectors Passive fire protection equipment such as blast walls and thermal insulation

Fixed fire fighting equipment including fire water tanks, foam tanks, fire waterpumps, fire water and foam monitors, fire hydrants, hoses, deluges and CO2flooding systems

Fire trucks and trailers equipped for both fires and hazardous materialincidents

Portable equipment including fire extinguishers, breathing apparatus, specificPPE for fires and hazardous materials

Portable equipment for responding to spills such as absorbent material, oilcontainment and absorbent booms, neutralising chemicals and appropriatePPE

Medical and first aid response equipment including medical response centres,first aid rooms, first aid kits and fire blankets

Safety showers and eye washes

Emergency response command centre including all the required contents ofcommunication equipment, maps, manuals etc.

All fixed and portable equipment should be covered by a documented maintenance,inspection and test regime (see requirement 13) to ensure that its technical integrityis maintained. Such programs should also include the routine inspection and testingof emergency alarms, pumps, safety showers and eye washes and fireextinguishers.

These systems are to be tested and trained as per section 34.

4. Vents and Drains

Provisions shall be made for the safe venting, drainage and containment requiredduring normal operations and in emergency situations, based on a process riskassessment tool such as HAZOP and HAZID.

The location and design of vents and drains is normally specified during the design.It is not the intent of this requirement to supplant design standards and codes andgood design practice however some points to note for the design and operation ofsystems which have caused incidents in the past are:

Correct Location and configuration

Vents and drains for maintenance and operating activities should be located atappropriate high points for vents and low points for drains. Where equipment itemsor sections of plant and equipment are anticipated to be taken out of service formaintenance (e.g. pumps, compressors, heat exchangers, tanks and vessels) thenvents and drains should be appropriately located so that personnel do not have tocrack flanges to achieve inventory removal especially of flammable and toxicmaterials.

8/12/2019 AA_AFRG_000003

17/55




AA_AFRG_000003

ISSUE 0

The vents and drains should preferably be connected to closed systems (e.g. flareheader or closed drain system) where the materials should not be released forhealth, safety or environmental reasons. Where this is not practical or required then

they should be directed to a safe location where the discharge of material will notcause a health, safety or environmental hazard.

Atmospheric vents should be discharged to a safe location to avoid sources ofignition for flammable vapours or to safely disperse toxic vapours. Drains should bedirected to a safe location where the material can be contained such as inside abund or into an effluent treatment system rather than uncontrolled discharge to theenvironment. Liquid hydrocarbons should not be discharged into an open sewersystem or large standing pools of water because the hydrocarbon will float on top ofany water and can travel significant distances and create a fire/explosion hazard ata distant location.

Consideration should be given to segregation of waste streams of totally differentcomposition at their source (e.g. acidic aqueous material from liquid hydrocarbons)so as to minimise the complexity of downstream waste disposal facilities.

When not in use, vents and drains should be securely isolated to prevent fugitiveleaks and unintended loss of containment. Leaks have occurred when valves havebeen left open, vibrated open or been accidentally knocked open. Two barriers ofisolation should be used where vents and drains discharge into the openenvironment. The normal method is to have a blank (spade, slip plate, blind) fitteddownstream of the vent/drain valve.

Inherently Safe

Valves used for inventory reduction as part of normal operation (e.g. periodicdraining of water from the bottom of a hydrocarbon vessel or purging inert gasesfrom an accumulator drum) should be designed for the frequent use and takeaccount of the potential for human error. Many leaks have occurred when personnelhave left open vents, drains and sample valves to purge the stream and then goaway and do another task and subsequently return to find hazardous materialflowing out. Consideration should be given to spring-loaded ball valves that have tobe held open and will close automatically if left unattended.

It is preferable for vents and drains, particularly in flammable and toxic materialservice, to have a primary valve closest to the process which is opened first and asecondary isolation valve that is used for controlling the flow of venting/draining.

Thus if the secondary valve starts to leak the primary valve can be closed.

Sample points for fluid streams are similar to these vents and drains in respect tothe hazard of loss of containment and their design should follow recommendedindustry practice and use should be covered by standard operating procedures.

Automatic valves and devices such as pressure relief valves, automaticallycontrolled overpressure valves and automatic dump valves should all be carefullydesigned according to applicable design codes and standards and their designreviewed during process hazard analysis. Hazards can occur with these devices inoperation when they become partially restricted or blocked with contaminants orinadvertently isolated by spades or valves. Modifications to process conditions, and

associated plant and equipment that are protected by these devices should not be

8/12/2019 AA_AFRG_000003

18/55




AA_AFRG_000003

ISSUE 0

undertaken without review using a management of change system (see requirement15) to avoid creating hazards.

Containment

Containment refers to secondary containment as a back up to the primarycontainment of a storage tank, vessel, container or package. The purpose of allsecondary containment systems is to limit the extent and spread of hazardousmaterials when there is a loss of containment from the primary containment.

In most countries, the requirement for secondary containment is covered bylegislation, standards and codes of practice which govern storage and handling ofhazardous materials of various classes. Such legislation and codes of practice covernot only the design of the primary tanks, but also other aspects such as layout andseparation from other storage and facilities, venting and relief, fire protection, safetyequipment, signage, and also dictate when and how secondary containment is

required.In the absence of any specific requirements Lees (Loss Prevention in the ProcessIndustries, figures 22.20 22.22)provides some guidance in the form of decisiontrees for flammable, toxic and corrosive materials.

Bunds (dike, berm) are one of the more common types of secondary containment.Bunds are normally designed to contain the entire volume (usually at least 110%) ofa tank or of the largest tank in a combined storage area. The bund is usually madeof concrete or earth lined with impervious material to prevent leakage. Theseparation distance and height of the bund walls must be designed taking accountof crest locus limits.

Bulk containers (e.g. IBCs, bulki bins); drums and small volume packages may alsobe subject to containment. Containment can be provided by fixed facilities ormoveable bunds made out of an impermeable membrane. Care should be taken inwarehouse and mixed storage areas to ensure that correct segregation ismaintained (see requirement 23).

Bunds are normally provided with drains to allow discharge of storm water. Thedrain valves should normally be closed.

5. Vessel and Tank Labelling

Labelling shall be in place on all storage vessels, containers and tanks, as perappropriate national or international standards. This labelling shall clearly identifythe carried or stored material. Supporting information (e.g. material safety datasheets [MSDS]) shall also be readily available at the point of use and storage toidentify appropriate first aid/spill response procedures.

The purpose of labelling of storage tanks, containers and packages is to ensure thatthe contents can be readily identified by product name and provide relevantinformation including hazards and precautions about the contents for normaloperational use and for emergency response. In some countries there is also arequirement where some types of Hazardous Materials (e.g. Dangerous Goods)are stored in sufficient quantities that placarding is required. Placarding ensures thatin event of fire, spillage or other incident involving such material that emergency

response personnel have sufficient information to respond immediately and

8/12/2019 AA_AFRG_000003

19/55




AA_AFRG_000003

ISSUE 0

effectively. Placards usually provide information on the class of material (see later)and guidance on how to manage emergency responses.

Most countries have specific legislation which identifies types of hazardous

materials (dangerous goods, hazardous substances, toxic substances etc) and isspecific about the types of labelling and placarding, the size of labels and wherethey should be affixed at the entrances to facilities and to tanks, containers,packages, warehouses and transport by road and rail. Each site should identify allapplicable legislation including any site specific permits and licences and complywith them (refer to Anglo Management Standard).

Labels (or placards) mayinclude:

The product name

UN number (which identifies the material according to a numbering systemdeveloped by the UN Committee of Experts on the Transport of Dangerous

Goods)

HAZCHEM Action Code (see later)

Class of material (see later)

Relevant health and safety information

The word hazardous

Telephone number to contact for specialist advice.

Labels should be firmly attached to the storage tank, container, package and belegible and durable. Labelling should be in a language that the workforceunderstands. Labels should be regularly checked and damaged or illegible labelsshould be replaced. Labels should also be revised when any of the details change.

Materials which arrive at a site insufficiently labelled should be quarantined until thecorrect labels are affixed or should be returned to the supplier.

Labelling also applies to hazardous materials that are decanted or transferred toother containers. A container into which a hazardous material has been decantedshould also include as a minimum the product name on the container and preferablymore detailed relevant information such as class labels. Under no circumstancesshould food or drink containers be used for decanting either for ongoing use ordisposal. If a container is found with an unknown material that is suspected of beinghazardous then a label such as Caution Do Not Use: Unknown Substance shouldbe affixed and the container removed from the workplace until the contents areidentified or disposed of.

Some of the more common types of labels that are used in various countries are:

Class labels

Class labels are based on the international system detailed in the ModelRegulations for the Transport of Dangerous Goods prepared by the United NationsEconomic and Social Councils Committee of Experts on the Transport ofDangerous Goods .

8/12/2019 AA_AFRG_000003

20/55




AA_AFRG_000003

ISSUE 0

The classes (excluding explosives) are:

Class 2 - Gases

Class 3 - Flammable Liquids

Class 4 - Flammable Solids

Class 5 - Oxidising Substances and Organic Peroxides

Class 6 - Poisonous (toxic) and Infectious Substances

Class 7 Radioactive Substances

Class 8 - Corrosives

Class 9 - Miscellaneous Dangerous Goods

HAZCHEM Emergency Action Code for Fire and Spillage

The HAZCHEM code (also known as the Emergency Action Code) was developed

by the United Kingdom Fire Service to provide emergency services personnelinformation on how to respond to fire and spill emergencies involving vehicles

8/12/2019 AA_AFRG_000003

21/55




AA_AFRG_000003

ISSUE 0

transporting dangerous substances. The HAZCHEM Code system has beenadopted in other countries not only for transport but also workplaces where suchmaterials are kept.

The HAZCHEM Code provides advice on:

The type of medium to be used in combating an incident involving a materialwhere there has been a loss of containment or fire

The type of PPE to be worn by persons combating the incident

Whether a violent reaction or explosion could occur

Whether a spill should be contained or diluted, and

If there is a hazard is to the local population.

The code consists of a number followed by one or more letters as shown in the

table:

Notes for guidance:

V : Can be violently or even explosively reactive.

BA : Use breathing apparatus plus protective gloves.

FULL : Use full body protective clothing with breathing apparatus.DILUTE : Wash to drain with large quantities of water.

CONTAIN : Prevent spillage from entering drains or watercourses.

WATER FOG : In the absence of fog equipment, a fine spray may be used.

DRY AGENT : Water must not be allowed to come in contact with the substanceat risk.

An example is Liquefied Petroleum Gas (LPG) which has a HAZCHEM Code of2 W E. This means that in the event of a fire a water fog or fine spray should beused, full protective clothing with breathing apparatus should be used andevacuation of the surrounding area should be considered.

8/12/2019 AA_AFRG_000003

22/55




AA_AFRG_000003

ISSUE 0

NFPA Hazardous Materials Identification System

The system is primarily used in the USA and is based on a diamond shapedmarking that is divided into 4 regions. Each region is assigned a colour and a

numerical rating in each region. The regions depict health hazard, fire hazard,reactivity hazard and a region to indicate reactivity with water, or other specifichazards if water reactivity is not an issue.

The format of the marking is as follows:

The degrees of hazard are ranked according to the potential severity of theexposure in a fire situation. Like the HAZCHEM Action Code the disadvantage ofthis system is that it does not address the hazard of day-to-day workplace exposure.

An example is Liquefied Petroleum Gas (LPG) which has a NFPA Hazard Class ofHealth (blue) = 2; Flammability (red) = 4; and Reactivity (yellow) = 0.

8/12/2019 AA_AFRG_000003

23/55




AA_AFRG_000003

ISSUE 0

Transport Placards

Legislation in many countries requires road tankers carrying chemical products tocarry a placard. The placard includes the HAZCHEM Code, the correct technical

name of the substance being transported, hazard class label, UN number of thesubstance and telephone number for emergency advice.

A generic example is shown below:

Standard Safety and PPE Signs

Although not usually required by legislation, the use of PPE and other Safety signsthat are in addition to the minimum PPE required on a site (i.e. safety helmet, safetyglasses, safety shoes, etc) can be posted close to the location where hazardousmaterials are handled. Standard safety signs are used as an aid to:

Communicate the need for PPE and the type to be used

Communicate information on hazards

Communicate the location of safety equipment/emergency facilities

Provide guidance and instruction in an emergency.

There are two main types of safety signs referenced in Australian Standard 1319 1994: Safety Signs for the Occupational Environment. These are:

Picture signs, which utilise text and symbols to represent the hazard,equipment or process as well as the standard colours and shapes used toconvey a message (e.g. PPE signs)

Signs with text only messages which are supplemented by the use of standardcolours and shapes (e.g. Stop, Caution, Fire Exit, emergency contact phonenumber, etc. signs).

Picture signs which are standard in the country of location should preferablybe used.

8/12/2019 AA_AFRG_000003

24/55




AA_AFRG_000003

ISSUE 0

6. Pipe Labelling

Piping containing hazardous substances shall be clearly marked so that thecontents and direction of flow can be identified.

Pipelines are an integral part of conveying hazardous materials in process plants;however it is almost impossible to determine the contents from the externalappearance of the pipe.

The purpose of providing a system for easy identification of contents and flowdirection of piping systems which transport hazardous materials is:

So that personnel who work in the vicinity are alerted as to the contents

So that operating personnel can easily identify the relevant valves and otherequipment

So that isolations can be placed on correct pipe line systems for maintenancework

So that information is provided to assist in response in the event of an incidentinvolving the loss of containment

To assist in the training of personnel who need to be able to identify specificsystems required for operating or maintenance activities.

Marking may be achieved by a system of colour coding or by labels which can bepainted on or affixed and which specify the contents and arrows to indicate thenormal direction of flow. Marking should occur in such locations as adjacent tovalves, tees, important line fittings, wall penetrations, road crossings, entries andexit nozzles to tanks, vessels, heat exchangers, pumps, compressors and otherimportant plant and equipment items. On piping runs the marking should be typicallyat uniform separation distances specified in relevant standards.

In addition to pipeline marking additional definition can also be provided by theinclusion of line designation numbers and valve numbers as shown on P&IDs.

Refer to BS 1710 Identification of Pipelines and Services or AS1345: Identificationof the Contents of Piping, Conduits and Ducts. Whichever system is used, affectedpersonnel should be able to understand the meaning of the colour coding and/orlabels and they must be maintained in a relatively clean state in order to be legible.

7. Security and Access Control

Security and access control systems and hardware shall be in place, appropriateto the risk, to manage access to areas where hazardous materials are stored andused.

Each site should review the hazardous materials on site and, depending upon therisks, install appropriate security hardware and/or security systems. Aspects thatshould be considered when determining what appropriate is include:

The hazards and risks associated with the hazardous materials

The likelihood of deliberate and unwanted access by unauthorised personsand vehicles to storage areas (e.g. for sabotage or theft)

The likelihood of unintentional and unwanted access by unauthorised personsand vehicles to storage areas

8/12/2019 AA_AFRG_000003

25/55




AA_AFRG_000003

ISSUE 0

The integrity of storage and handling systems to inadvertent operation causingloss of containment (e.g. even if someone was able to get to the storage andhandling equipment could they cause a loss of containment by opening avalve)

The integrity and reliability of security systems and hardware.

Examples of security hardware that should be considered are:

Security fence and site access control to perimeter of the site

Security fence or enclosure to the area where individual or collectivehazardous materials are stored and/or used

Locks on doors and other access routes to enclosed buildings and compounds

Remotely monitored security cameras

Bollards or other vehicle access control devices

Signs prominently posted warning of the storage of hazardous materials andthe need for appropriate authorisation before entry into an area.

See requirement 25 for security and access control systems.

8. Process Control

Process control systems shall ensure that the potential for personnel to be exposedto hazardous materials is eliminated wherever possible, or reduced.

Process control systems are a risk control designed to eliminate those activitieswhere personnel are close to the contained materials and can be exposed to

hazardous materials in the event of loss of containment. Process control achievesseparation from the risk and should be applied both during new plant design andduring ongoing risk reduction activities. Examples of activities which occur duringthe operating phases of start-up, normal operation, equipment changeover, plannedshutdown, emergency shutdown and abnormal operating scenarios that should bereviewed include:

Process flow, temperature, pressure, level and composition adjustmentthrough the manipulation of a valve or other device

Charging feed to and discharging products from processes

Sampling and analysis

Routine venting and draining, purging and flushing.

9. Automatic Control

Automatic plant control systems should be in place in hazardous material facilitiesto eliminate the need for operator intervention and to maintain operation within therequired parameters. Such systems shall incorporate fail-to-safe systems in theevent of emergencies. Where automatic control is not practicable, risk assessmentshall be used to identify and implement operational options that reduce the risk.

Automatic control is a generic term used in this protocol and refers to what isotherwise referred to as a trip system (also referred to as emergency shutdownsystem or ESD) and interlock system (also referred to as override system).

8/12/2019 AA_AFRG_000003

26/55




AA_AFRG_000003

ISSUE 0

These systems are discrete control actions whereas process control inrequirement 8 is continuous control action.

Control systems (automated or manual) and associated critical equipment must be

given sufficient design attention, appropriately risk assessed and supported by arigorous maintenance regime and planned inspections.

Trip and interlock systems are automatic protection systems designed to preventsituations where a hazardous condition could occur in a process. Trip systems shutdown an entire process or part of a process or one function if a hazardous conditionis detected. An interlock system is slightly different in that it prevents an operator oran automatic control sequence from following a hazardous sequence of controlaction. Trip and interlock systems and their components are normally classified ascritical equipment and should be covered by appropriate maintenance inspectionand test plans (see requirement 13).

The identification of the hazardous situation may occur during the normal designprocess or could be revealed during HAZOP. The decision to install a trip orinterlock can be a function of the project/facility design philosophy but also shouldbe risk assessed during development of design specifications (see requirement 2).The hierarchy of controls should be used to determine whether it is better to use theredesign control and implement a trip/interlock or use the administrate controland depend upon personnel to follow procedures when hazardous situations occur.

Trip systems can either be single loop (sensor to trip switch to trip valve) or multiloop (sensor to trip processor to switches to trip valves). The logic can be as simpleas a single switch, a relay system, PLC or a complex computerised trip system.

Examples of trip systems are:

Single Loop:A benzene storage tank that receives benzene supply pumped from arail tank car requires an automatic system to prevent overfilling of the tank. A highlevel switch can be installed on the tank that shuts an actuated valve in the benzenesupply line.

Multi Loop:A hydrocarbon gas processing plant has a lot of flanges and valves thatcan leak gas with the risk of fire and explosion and requires a system to shut downthe plant and prevent ignition if this occurs. Strategically located gas detectors areinstalled that trigger when a certain level of gas is detected and automatically shutdown the supply of gas into the plant and open blowdown valves to depressure the

inventory safely to a flare system.

Examples of interlock systems are:

Instrumented: A road tanker which is filled with flammable fuel pumped from astorage tank via a loading hose system must have a secure electrical continuitysystem to prevent static electricity discharge (an ignition source) between the fixedloading equipment and the road tanker. An interlock system is built into the loadinghose control system which requires connection of the earthing strap before the mainisolation valve in the loading line can be opened to start loading.

8/12/2019 AA_AFRG_000003

27/55




AA_AFRG_000003

ISSUE 0

Non-instrumented: A pressure vessel containing a hazardous gas is protectedfrom overpressure by two pressure relief valves. The two valves are installed inparallel with one being a standby and manual isolation valves are provided to allow

isolation of either valve to allow one of the pressure relief valves to be taken out ofservice. A manual interlock system is required to prevent isolation of both valves atthe same time. A special sequential key system is provided which only allows themanual valves on one of the pressure relief valves to be isolated at any one time.

Both trip and interlock systems (or parts of them) require bypassing (disarming,defeating) at various times such as for start-up, calibration and testing. A systemshould be in place to assess the risk of bypassing of these safety systems. Usuallythis is covered under an extension of a permit to work system.

Both trip and interlock systems require periodic proof testing to ensure theirreliability and capability. This is often referred to as Critical Function Testing (CFT)

and should be part of a maintenance inspection and test program on a facility (seerequirement 13). Frequency of proof testing should be determined by SafetyIntegrity Level studies.

Standards for instrumented and electrical/programmable safety systems can befound in:

IEC 61508-1; Functional safety of electrical/electronic/programmableelectronic safety-related systems, and

IEC 61511-1; Functional safety safety instrumented systems for the processindustry sector.

10. Detect ion Devices

Fixed detectors and personal detection devices shall be considered as options inthe selection of potential risk reduction measures.

Fixed devices are usually installed to detect the presence of flammable or toxicgases but can also include smoke, thermal, flame and other detection methodsincluding visual. Their purpose should be clearly defined during design. Systemsmay either be primarily designed to detect fugitive leaks that can lead to adverse butnon fatal health effects or detect major loss of containment which can lead tofatalities either directly (e.g. carbon monoxide gas cloud) or indirectly via fire andexplosion of flammables.

The justification for fixed devices should be the subject of careful analysis whichevaluates the likely leak locations (e.g. flanges), the potential quantity of leaks anddispersion modelling of gas clouds all in relation to where personnel may be located.This may require risk assessment methods such as QRA (see requirement 1).

Provision should be made for dealing with large loss of containment scenariosincluding emergency shut down and blow down of inventory, containment systems,shut down of heating and ventilation systems in habited confined work areas suchas control rooms and provision of gas absorption facilities (e.g. activated carbonfiltration). Emergency response plans should specifically have procedures forresponding to such scenarios and not only include process actions to respond to theloss of containment but procedures for evacuation.

8/12/2019 AA_AFRG_000003

28/55




AA_AFRG_000003

ISSUE 0

Fixed detection devices are normally classified as critical equipment and requiremaintenance, inspection and testing to ensure availability and calibration (seerequirement 13).

Personal detection devices are normally used for the fugitive leak scenarios and forother activities such as confined space entry and atmosphere testing formaintenance. The selection of the correct type for each relevant hazardous materialshould be done by qualified personnel such as occupational hygienists. Whenpersonal devices are used there should also be an atmospheric and/or healthsurveillance program depending upon the nature of the hazardous materials (seerequirement 27).

The provision of fixed or personal detection devices is not an alternative to prudentdesign and operation of a facility including but not limited to the correct design ofpressure relief systems, vents and drains, suitable workplace ventilation, tightness

testing of pressurised systems, correct gasket selection and flange tighteningprocedures.

5.2 SYSTEMANDPROCEDURAL REQUIREMENTS

11. Hierarchy of Controls

Management of risk associated with hazardous materials shall be supported by adocumented process that incorporates risk reduction using the Hierarchy ofControls, applied in the following order (a number of these options may beconsidered and applied individually, or in combination):

- ELIMINATE the complete elimination of the hazard;

-

SUBSTITUTE replace the material or process with a less hazardous one;- RE-DESIGN re-design the equipment or work processes;

- SEPARATE isolating the hazard by guarding or enclosing it;

- ADMINISTRATE provide controls such as training, procedures, etc. ;

- PERSONAL PROTECTIVE EQUIPMENT (PPE) use appropriate andproperly fitted PPE where other controls are not practicable.

The hierarchy of controls should be embedded in risk based systems relevant to thisprotocol including:

Risk assessment methodologies (requirements 1 and 2)

Selection of detection devices (requirement 10)

Risk assessment of hazardous materials on site (requirement 12)

Introduction of new hazardous materials (requirement 14)

Management of change (requirement 15)

Permit to work system (requirement 22)

Control of simultaneous operations (requirement 23)

Emergency response procedures (requirement 24)

Security and access control systems (requirement 25)

8/12/2019 AA_AFRG_000003

29/55




AA_AFRG_000003

ISSUE 0

Examples of application of the hierarchy of controls to hazardous materials are:

Eliminate: Where a process or task involves the use of a material that is notessential, the material or the process should be eliminated or the risk associatedwith the material or process eliminated if practicable. Examples include:

Eliminate on site feedstock storage tank by a pipeline supply direct to theprocess

Eliminate potential leak points at flanges by fully welded systems

Eliminate the need for sampling by use of non invasive instruments.

Substitute: Using a safer material or process which includes exchanging thematerial for one that is less harmful, using the same material in a less hazardousform or using the same material in a less hazardous process. Examples include:

Substitute a water-based solvent instead of a solvent based material

Substitute acetic acid for acid cleaning instead of using hydrofluoric acid

Substitute pellets instead of using dusty powders.

Redesign: Using machinery, equipment or processes which minimise workplacecontamination by eliminating or reducing the generation of materials, suppressing orcontrolling the materials or limiting the area of contamination in the event of spills.Examples include:

Install local exhaust ventilation to remove hazardous fumes

Install containment and bunding systems to limit spread of spills

Install automatic fire/smoke detectors and fire suppression systems.

Separate:Separating hazardous materials from the people through using them bydistance or barriers. Examples include:

Separate operators from hazardous fumes in an air-conditioned control room

Use remote controls to operate a process

Safe separation distance of hazardous material storage tanks from controlrooms.

Administ rate: Minimising the exposure through changing the work method andwork practices. Examples include:

Provision of standard operating procures for safe handling of hazardousmaterials

Reducing the duration of exposure through job rotation

Good housekeeping to remove workplace contamination.

Personal Protective Equipment: Wearing PPE should only be used to provideextra protection, or where other control measures are not practicable. PPE shouldnot be depended upon to control risk because it relies upon personnel using itcorrectly.

8/12/2019 AA_AFRG_000003

30/55




AA_AFRG_000003

ISSUE 0

12. Risk Assessment

A risk assessment process shall be in place for all hazardous materials to identify:

-

the selection criteria and life cycle analysis for all hazardous materials- the level of risk associated with the hazardous materials

- controls required to manage the risk

- the performance requirements (reliabilities and capacities) of specificequipment and systems included in these controls.

Risk assessment may be undertaken for hazardous materials either as a standalone activity or part of a process wide risk assessment (see requirement 1). If thelatter is the case then relevant hazardous material data in steps 2 4 below shouldbe used. For risk assessments on new hazardous materials (see requirement 14),steps 4 -7 below can be used.

A suggested step-wise risk assessment process is:

Step 1: Assemble a team to carry out the risk assessment

Risk assessment should preferably be undertaken by HSEC professionals andpersonnel who may be affected including supervisors, operators and maintainersand if necessary risk consultants or other personnel with subject knowledge (seerequirement 30). Such involvement ensures that the risk assessment is based upona thorough and practical understanding of what currently happens or will likely occurin new facilities.

Step 2: Identify all hazardous materials stored, used, transported and

disposedThis should involve a site wide inspection to locate, identify and list all materials andthe type of storage (i.e. tank, vessel, container and packages). Locations shouldinclude not only the normal storage and use areas but also workshops, laboratories,warehouses, laundry facilities, waste treatment facilities etc. Labels on containers,inventories, log sheets, purchasing records and existing registers of MSDSs canassist in data gathering.

Step 3: Obtain Material Safety Data Sheets

Contact the manufacturer or supplier of the materials to obtain the MSDS.Alternatively data bases such as ChemAlert may have the MSDS already registered

on them.

Step 4: Review Material Safety Data Sheets

The four key aspects to be reviewed are:

a) Inherent hazards and routes of exposure:

Consider for flammable materials the potential for fire and explosion and fortoxic materials which of the routes of inhalation, ingestion, absorption and/orinjection may be relevant in the activities associated with the hazardousmaterial.

8/12/2019 AA_AFRG_000003

31/55




AA_AFRG_000003

ISSUE 0

b) Form of the hazardous material

Review the process conditions to determine the phase of the material (solid,liquid or gas) and what is its concentration and any impurities or mixturecomponents. Consideration should be given also as to whether the material isa mist, fume or dust.

c) Physical and chemical properties

Determine properties such as the pH of liquids (corrosive to the skin andeyes), boiling point and vapour pressures (which can cause high airborneconcentrations due to evaporation), the flammability limits and flash point offlammable materials (fire and explosion potential), and the nature andconcentration of combustion products and odour.

d) Health effects

For each route of exposure consider the adverse health effects (i.e. toxic,harmful corrosive, irritating, sensitising, carcinogenic, mutagenic andteratogenic).

Step 5: Evaluate the nature of work involving Hazardous Materials

Determine what tasks are carried out where there is a potential for exposureinvolving hazardous materials (see requirement 19 for critical activities). For eachtask this should include identifying who is or might be exposed, how they might beexposed and the nature of that exposure (i.e. quantity, frequency and duration), howthe material is used, whether health effects are currently present and theeffectiveness of control measures currently in place. Reviewing existing standardoperating procedures may provide information and involvement of personnel whocarry out the tasks is essential.

Step 6: Assess the risk

Determine the credible consequences and estimate the duration and frequency ofexposure and the exposure level. Use incident reports and the results ofatmospheric monitoring and health surveillance programs to help quantifyconsequences and frequency. It is also important to remember that risks mayextend to personnel who have no direct involvement in the work activity by incidentsinvolving fires and explosions and widely dispersed toxic releases.

For some hazardous materials on a site the risk profile may be similar for some orall activities and so a generic risk assessment can be carried out rather thanduplicating for each activity.

Step 7: Identify Risk Contro ls

Controls should be identified and implemented to manage the risk so that it iseliminated or reduced to levels so that after implementation they are ALARP. Thehierarchy of controls should be used to determine appropriate controls (refer torequirement 11). The controls should be communicated to those personnel likely tobe exposed via documentation such as standard operating procedures, job safetyanalyses, permit to work documentation, safety alerts and related training programs.

8/12/2019 AA_AFRG_000003

32/55




AA_AFRG_000003

ISSUE 0

Step 8: Develop performance standards for cri tical controls

Where critical controls (either critical equipment as identified in requirement 13 orcritical activities as identified in requirement 19) are identified then performance

standards (e.g. availability, reliability and capacity, survivability, functionality) shouldbe identified. Performance should be routinely monitored and reported to measurethe effectiveness of critical controls.

At the conclusion of this step-wise process, the risk assessment should bedocumented. As a minimum the documentation should include:

Date of the risk assessment and attendees

Which hazardous materials were assessed and in what tasks or facilitylocations they were used (attach or refer to any JSAs or standard operatingprocedures)

The controls already in place

Relevant data such as previous incidents or results of workplace monitoring

The result of the risk assessment (can graphically show on the HSEC RiskMatrix)

Recommended additional controls and responsibility for implementation

Attach copies of MSDS as a record of what revision was available at the time.

The risk assessment should also be regularly reviewed during the life cycleand revised at a suggested interval of every five years or if significant changeshave occurred, including:

- A new hazardous material is introduced to the site (see requirement 14)- The process, plant or equipment is significantly modified (see

requirement 15)

- New information on the hazardous nature of the material becomesavailable

- Health surveillance or atmospheric monitoring shows that controls areinadequate

- Incidents (actual or near miss) occur which indicate that controls areineffective

- New or improved practicable control measures become available.

Another approach to risk assessment (steps 3 7) is through Control Banding.Control Banding is a qualitative or semi-quantitative approach to risk assessmentthat groups occupational risk control strategies into bands based on their level ofrigor. The most fully developed Control Banding model comes from the UK Healthand Safety Executive, and is known as COSHH Essentials (from Control ofSubstances Hazardous to Health regulations). The concept is that while there aremany chemicals, there are only a few levels of risk management (control bands)available to control exposures to these chemicals. For guidance on this approach goto the web site: COSHH ESSENTIALS

Risks that cannot be eliminated should be documented in the sites risk register.

8/12/2019 AA_AFRG_000003

33/55




AA_AFRG_000003

ISSUE 0

13. Critical Equipment Maintenance

A system shall be in place to identify and document maintenance, inspection andtesting schedules and procedures for critical equipment associated with hazardous

materials.

The identification of critical equipment is necessary to ensure that maintenance,inspection and testing is conducted on that equipment to maintain its technicalintegrity. A system should describe how critical equipment is identified and thatequipment should then be

Documents

AA_AFRG_000003