## Final Report:
Definition for Inherently Safer Technology in Production, Transportation, Storage

, and Use

Final Report:
Definition for Inherently Safer Technology in Production, Transportation, Storage

, and Use

Prepared by:

Center for Chemical Process Safety The American Institute of Chemical Engineers

For

Chemic al Security Analysis Center Science & Technology Directorate U.S. Department of Homeland Security

July 2010Final Report: Definitions for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank

.

# Final Report:

Definition for Inherently Safer Technology in Production, Transportation, Storage

, and Use

Prepared by:

Center for Chemical Process Safety

T he American Institute of Chemica l Engineers New York, New York 10016

- 5991

for

Chemical Security Analysis Center Science & Technology Directorate U.S. Department of Homeland Security Aberdeen Proving Ground, MD 21010

- 5424

Ju ly 20 10Final Report: Definitions for Inherently Safer Technology in Production, Transportation, Storage and Use

Di sclaimer

―This report is a work prepared by the Center for Chemical Process Safety of the American Institute of Chemical Engineers for the U.S. Department of Homeland Security (DHS) Chemical Security Analysis Center (CSAC) for the United States (U.S.) Government. This report does not reflect the opinion of the

U

. S

. Government, the DHS, or the CSAC. In no event shall either the U

. S

. Government , DHS, or CSAC have any responsibility or liability for any consequences of any use, misuse, inability to use, or reliance upon the information contained herein, n or does either warrant or otherwise represent in any way

the accuracy, adequacy, efficacy, or applicability of the contents hereof.‖

― It is sincerely hoped that the information presented in this document will lead to an even more impressive safety record for the entire industry; however, neither the American Institute of Chemical Engineers, its consultants, CCPS Technical Steering Committee and Subcommittee members, their employers, their employers’ officers and directors, warrant or represent, expressly or by implication, the correctness or accuracy of the content of the information presented in this document. As between (1) American Institute of Chemical Engineers, its consultants, CCPS Technical Steering Committee and Subcommittee members, their employe rs, and their employers’ officers and directors, and (2) the user of this document, the user accepts any legal liability or responsibility whatsoever for the consequence of its

use or misuse. ‖

### REPORT DOCUMENTATION PAGE Form Approved
OMB No. 0704

- 0188

Pu blic reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing th e collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202

- 4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704

- 0188), Washington, DC 20503

1. AGENCY USE ONLY (Leave blank) 2. REPORT DATE 07 / 1 9 /1 0 10 3. REPORT T YPE AND DATES COVERED Technical 02/11/2010

– 0 7 / 1 9 / 2010

4. TITLE AND SUBTITLE F inal Report: Definition for Inherently Safer Technology in Productions, Transportation, Storage

, and Use 5. FUNDING CONTRACT NUMBER

NBCH

- D

- 08

- 0002

6. AUT HOR(S) Center for Chemical Process Safety

T he American Institute of Chemical Engineers

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) Center for Chemical Process Safety of the American Institute of Chemical Engineers

3 Park Avenue New York, New Yo rk, 10016

- 5991 8. PERFORMING ORGANIZATION
REPORT NUMBER

N/A

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) Department of Homeland Security, Science & Technology Chemical Security Analysis Center

5183 Blackhawk Road E3401 Aberdeen Proving Groun d, MD 21010

- 5424 10. SPONSORING/MONITORING
AGENCY REPORT NUMBER

N/A

11. SUPPLEMENTARY NOTES None

12A. DISTRIBUTION/AVAILABILITY STATEMENT Statement C: Distribution authorized to U.S. Government agencies and their contractors; administrative or operatio nal use; July 31, 2008. Other requests for this document shall be referred to Director, Chemical Security Analysis Center, 5183 Blackhawk Road, Aberdeen Proving Ground, MD 21010

– 5424. 12B. DISTRIBUTION CODE

13. ABSTRACT (Maximum 200 words)
At the request of the United States (U.S.) Department of Homeland Security (DHS) Chemical Security Analysis Center (CSAC), the Center for Chemical Process Safety (CCPS), a directorate of the American Institute of Chemical Engineers (AIChE), has completed a project to pr ovide a technically based definition of inherently safer technology (IST). CSAC requested that an independent technical organization review the literature and common practice related to design of inherentl y safer processes, and lead a process to develop a technically

- based definition of IST. CCPS reviewed available literature and convened a series of workshops of process safety experts to develop a definition of IST. Along with the definition is include d brief discussion of the concepts contained in the def inition. As the definition is intended to be concise, CCPS believes that it is important to read the discussion (Appendix B) in conjunction with the definition because this additional information is critical for a full understanding of the IST.

14. KEY W ORDS: American Institute of Chemical Engineers (AIChE); Center for Chemical Process Safety (CCPS); elimination of hazards; Global Congress on Process Safety; Kletz; hazardous materials; inherently safer design (ISD); inherently safer technology/inherently safer design (IST/ISD); management of security risks; Occupational Safety & Health Administration (OSHA); Occupational Safety & Health Administration Process Safety Management (OSHA/PSM); safer design (SD); U.S. Environmental Protection Agency (EPA); U.S. Environmental Protection Agency Risk Management Program (EPA/RMP). 15. NUMBER OF PAGES 5 4

16. PRICE CODE

17. SECURITY
CLASSIFICATION OF REPORT NONE 18. SECURITY
CLASSIFICATION OF THIS
PAGE NONE 19. SECURITY
CLASSIFICATION OF
ABSTRACT NONE 20. LIMITATION OF ABSTRACT NONE

NSN 7540

- 01

- 280

- 5500 Standard Form 298 (Rev. 2

- 89) Prescribed by ANSI Std. 239

- 18

298

- 102Final Report: Definitions for Inherently Safer Technology in Production, Transportation, Storage and Use

T his page intentionally left blank.Table of Contents

i TABLE OF CONTENTS

Page

EXECUTIVE SUMMARY

................................ ................................ ................................ ................... EXEC

- 1

1.0 INTRODUCTION

................................ ................................ ................................ .............................. 1

1.1 Purpose

................................ ................................ ................................ ............................... 1

1.2 Relevant Past Efforts

................................ ................................ ................................ .......... 1

1.3 Relevance of the Project

................................ ................................ ................................ ..... 2

2.0 PROJECT PROCEDURE

................................ ................................ ................................ ................ 3

2.1 Process

................................ ................................ ................................ ............................... 3

2.2 Project Steps and Timeline

................................ ................................ ................................ . 3

2.2.1 Initial Definition Workshop

– February 3, 2010

................................ ...................... 3

2.2.2 Second Definition Workshop

– IST Draft Definition and Discussion

– February 25, 2010

................................ ................................ ................................ .. 4

2.2.3 Thir d Definition Workshop

– Final IST Draft and Discussion Presented at the Global Congress on Process Safety

– March 22, 2010

................................ ......... 4
2.3 Project Deliverable

................................ ................................ ................................ ..................... 5

3.0 KEY FINDINGS

................................ ................................ ................................ ................................ 5

3.1 Final Definition

................................ ................................ ................................ .................... 5

3.2 Major Issues

................................ ................................ ................................ ........................ 6

3.3 Utility of the Definition

................................ ................................ ................................ ......... 7

3.4 Limitations and Possible Future Work

................................ ................................ ................ 7

4.0 REFERENCES

................................ ................................ ................................ ................................ . 7

APPENDIX A: FINAL D EFINITION FOR INHERE NTLY SAFER TECHNOLO GY/INHERENTLY

SAFER DESIGN

................................ ................................ ................................ .......................... A

- 1

APPENDIX B: FINAL D ISCUSSION ON DRAFT D EFINITION OF INHERENTLY SAFER

TECHNOLOGY

................................ ................................ ................................ ............................ B

- 1

APPENDIX C: CCPS PR OJECT PROPOSAL SUBMI TTED OCTOBER 13, 200 9

................................ . C

- 1

C.1 SUMMARY OF NEED

................................ ................................ ................................ ..... C

- 1

C.2 PROPOSED APPROACH

................................ ................................ .............................. C

- 1

C.3 PERSONNEL

................................ ................................ ................................ .................. C

- 3

C.4 TIMING AND COS T

................................ ................................ ................................ ........ C

- 4

C.5 STATEMENT OF WORK

................................ ................................ ................................ C

- 4

APPENDIX D: INITIAL DEFINITION WORKSHOP

– FEBRUARY 3, 2010

................................ ............ D

- 1

D.1 WORKSHOP AGENDA

................................ ................................ ................................ .. D

- 1

D.2 PARTICIPANTS

................................ ................................ ................................ .............. D

- 2

D.3 SUMMARY

................................ ................................ ................................ ...................... D

- 2

APPENDIX E: SECOND DEFINITION WORKSHOP

– IST DRAFT AND DISCUS SION

– FEBRUARY 25, 2010

................................ ................................ ................................ ................... E

- 1

E.1 AGENDA

................................ ................................ ................................ ......................... E

- 1Final Report: Definitions for Inherently Safer Technology in Production, Transportatio n, Storage and Use

ii E.2 PARTICIPANTS

................................ ................................ ................................ .............. E

- 2

E.3 SUMMARY

................................ ................................ ................................ ...................... E

- 3

APPENDIX F: THIRD D EFINITION WORKSHOP

– FINAL IST DRAFT DEFI NITION AN D

DISCUSSION PRESENTED AT THE GLOBAL CONGRE SS ON PROCESS SAFETY

– MARCH 22, 2010

................................ ................................ ................................ .......................... F

- 1

F.1 AGENDA

................................ ................................ ................................ .......................... F

- 1

F.2 CONFERENCE SESSIONS

................................ ................................ ............................ F

- 2

F.3 PARTICIPANTS

................................ ................................ ................................ ............... F

- 7

F.4 SUMMARY

................................ ................................ ................................ ....................... F

- 7

APPENDIX G: NOMENC LATURE

................................ ................................ ................................ ........... G

- 1

APPENDIX H: ABOUT C CPS

................................ ................................ ................................ .................. H

- 1

LIST OF TABLES

Page

Table C

- 1. Proposed Scoping C ommittee Participants

................................ ................................ ............ C

- 2

Table C

- 2. Proposed Schedule and Funding

................................ ................................ ............................ C

- 4

Table D

- 1. Agenda

................................ ................................ ................................ ................................ .... D

- 1

Table D

- 2. Workshop Participants

................................ ................................ ................................ ............ D

- 2

Table E

- 1. Agenda

................................ ................................ ................................ ................................ ..... E

- 1

Table E

- 2. Workshop Participants

................................ ................................ ................................ ............. E

- 2

Table F

- 1. Agenda for Global Congress on Process Safety: Topical 1 Sessions

................................ ..... F

- 1

Table F

- 2. Agenda for Inherently Safer Design/Inher ently Safer Technologies: Topical 1,

Session 21, Part I

................................ ................................ ................................ ..................... F

- 2

Table F

- 3. Abstracts for Inherently Safer Design/Inherently Safer Technologies: Topical 1,

Sessions 21a

- 21c, Part I*

................................ ................................ ................................ ........ F

- 3

Table F

- 4. Agenda for Inherently Safer Design/Inherently Safer Technologies: Topical 1,

Session 28, Part II

................................ ................................ ................................ .................... F

- 4

Table F

- 5. Abstracts for Inherently Safer Design/Inherently Safer Technologies: Topical 1,

Sessions 28a

- 28b, Part II

................................ ................................ ................................ ........ F

- 5

Table F

- 6. Abstracts for Inherently Safer Design/Inherently Safer Technologies: Topical 1

,

Sessions 28c

- 28d, Part II (cont)

................................ ................................ .............................. F

- 6

Table F

- 7. DHS/CSAC/CCPS IST Definition Project Participants at the Global Congress

....................... F

- 7

Table G

- 1. ABBREVIATIONS AND ACRONYMS

................................ ................................ .................... G

- 1Executive Summary

EXEC

- 1 

## Final Report: Definitio n for Inherently Safer Technology in Production, Transportation, Storage and Use

EXECUTIVE SUMMARY

At the request of the Chemical Security Analysis Center (CS AC), Science and Technology Directorate, U.S. Department of Homeland Security (DHS), the Center for Chemical Process Safety (CCPS), a directorate of the American Institute of Chemical Engineers (AIChE), has completed a project to provide a technically base d definition of inherently safer technology (IST). CSAC requested that an independent technical organization review the literature and common practice related to design of Inherently Safer Processes, and lead a process to develop a technically

- based defini tion of IST. CCPS reviewed available literature and convened a series of workshops of process safety experts to develop a definition of IST. Along with the definition is included brief discussion of the concepts contained in the definition. The

definition follows, is repeated in Appendix A while Appendix B provides additional discussion. As the definition is intended to be concise, CCPS believes it is important to include the discussion in conjunction

with the definition for clarification and insight to hel p chemical engineers and others to develop a full understanding of the concept of inherently safer technology

.



### INHERENTLY SAFER TECHNOLOGY DEFINITION

Inherently S afer T echnology (IST), also known as I nherently S afer D esign (ISD), permanently eliminates

or reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy

, applied to t he design and operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an iterative process that considers such options , in cluding eliminating a hazard, reducin g a hazard, substituting a less hazardous material, using less hazardous process conditions, and designing a process to reduce the potential for, or consequences of, human error, equipment failure, or intentional harm. Overall safe design and operation options cover a spectrum from inherent through passive, active and pr ocedural

risk management strategies. There is no clear boundary between IST and other strategies.

ISTs are relative : A technology can only be described as inherently safer when compared to a different technology , including a description of the hazard or set of hazards being considered, their location, and the potentially affected population. A technology may be inherently safer than another with respect to some hazards but inherently less safe with respect to others, and may not be safe enough to meet societal expectations.

ISTs are based on an informed decision process : Because an option may be inherently safer with regard to some hazards and inherently less safe with regard to others, decisions about the optimum strategy for managing risks from all hazards are required . The decision proces s must
consider the entire life cycle, the full spectrum of hazards and risks, and the potential for transfer

of risk from one impacted population to another. Technical and economic feasibility of options

must also be considered.Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.1.0 Introduction

1 

## Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

1.0 I NTRODUCTION

At the request of the Chemical Security Analysis Center (CSAC), Science and Technology Directorate, U.S. Department of Homeland Security (DHS), the Center for Chemical Process Safety (CCPS),a

directorate of the American Institute of Chemical En gineers (AIChE), has completed a project to provide a technically

- based definition of inherently safer technology (IST), also known as inherently safer design (ISD) but hereafter referred to as IST. CSAC requested that an independent technical organization review the literature and common practice related to design Inherently Safer Processes, and lead a process to develop a technically

- based definition of inherently safer technology (IST). CSAC requested that the

definition consider the full life cycle of t he chemical enterprise, including use and manufacturing, storage, and transportation. CSAC requested a definition that is broad enough to encompass the full supply chain and recognize the possibility that improvement in safety in one dimension of process o r supply chain may lead to degradation of safety in another dimension.



### 1.1 Purpose

The purpose of th is project is to d evelop a d efinition of ― i nherently s afer t echnolog y ‖ (IST) which meets the following criteria:

Integrated

– considers the full life cycle and all security considerations of the process

or product ; Applicable to a broad definition of ― technology ‖;

Consider the full range of hazards of concern associated with a process or product; and

Be useful in a risk/economic/benefit context

.

The IST d efinit ion is not :

A specific technical solution ; Offered in the context of any single specific hazard ; nor is it

A decision on appropriate technology, however it should facilitate processes for making

technical decision s.



### 1.2 Relevant Past Efforts

The concept of IS T is not really new , and it is not limited to the process industries . Technologists have always recognized the value of eliminating or reducing hazards associated with any activity . Applying

IS T without calling it by that name, they simply considered it to be good design. In reaction to a major explosion in Flixborough, England (June 1974), Trevor Kletz questioned the need for such large quantities of flammable or toxic materials in a manufacturing plant, as well as the need for processing at elevated temper ature and pressure. Kletz suggested that the process industries should re

- direct efforts toward elimination of hazards where feasible by 1) reducing the quantity of hazardous material; 2) using less hazardous materials; and 3) developing technology that op erates at less severe conditions rather than devoting extensive resources for safety systems and procedures to manage risks. Kletz first advanced this proposal at the annual Jubilee Lecture of the Society of the Chemical Industry. His proposal was subseque ntly published as a journal article entitled ―What you don’t have, can’t leak.‖ 1Final Report: Definition of Inherently Safer Technology in Production, Transportation, Storage and Use

2 Since 1974, the concept of IST has been further developed. Some specific references used in this project include the following:

CCPS book Inherently Safer Chemical Processes : A Life Cycle Approach (1 st Edition, 1996 2

, and 2 nd Edition, 2009 3 ): IST is a concept, an approach to safety that focuses on eliminating or reducing the hazards associated with a set of conditions.

C ontra Costa County, California Industrial Safety Ordin ance: Inherently s afer s ystems (ISS) means Inherently s afer d esign s trategies as discussed in the 1996 Center for Chemical Process Safety Publication ―Inherently Safer Chemical Processes‖ and means feasible alternative equipment, processes, materials, layo uts, and procedures meant to eliminate, minimize, or reduce

the risk of a m ajor c hemical a ccident or r elease by modifying a process rather than adding external layers of protection (discussed in Inherently Safer Chemical Processes: A Life Cycle Approach , 2 nd Edition, 2009, Section10.2.1, pp. 229

- 235). http://cchealth.org/groups/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed July 15, 2010)

. 4

Johnson, Rob ert : ―I nherently safer designs permanently and inseparably reduce or eliminate process hazards that must be contained and controlled to avoid accidents .‖ (unpublished presentation) 5

Kletz, Trevor : Process Plants: A Handbook for Inherently Safer Design . Br istol, PA, Taylor and Francis, 1998. 5 : T he essence of the inherently safer approach to plant design is the avoidance of hazards rather than their control by add ing protective equipment

. 6

Kletz, Trevor: ―A n [inherently safer] IS design is one that avoids ha zards instead of controlling them, particularly by reducing the amount of hazardous material or the number of hazardous operations .‖ ( personal communication in February 2010 .) 7



### 1.3 Relevance of the Project

For a number of years, IST has received increasing att ention as an important component of process safety management systems, and has also been considered a potentially valuable tool in managing security risks for hazardous material handling operations of all types. IST has been incorporated into process safet y management regulations in the state of New Jersey and in Contra Costa County, California. 3 Both the Occupational Safety & Health Administration Process Safety Management ( OSHA PSM ) regulation and the U.S. Environmental Protection Agency Risk Management Program (EPA RMP) regulation encourage inherently safer processes implicitly by setting a threshold for regulatory applicability in terms of chemical inventory.

For a number of years, going back to the early 1990s with an EPA proposal to include technical options analysis as a part of the risk management program under the Clean Air Act, there have been proposals in the U.S. Congress to incorporate IST concepts, sometimes specifically and sometimes using other names or descriptions, into both process safety management and chemical

- processing facility security regulations. To date these proposals have not been adopted into regulations, but they continue to be considered in the current session of U.S. Congress. One obstacle to incorporating IST into regulation s, either for process safety or for chemical facility security, is the lack of a consensus in defin ing exactly

what ―IST‖ means.

When previously published definitions are compared

, they are found to incorporate similar elements.

. What is lacking is a def

inition that unifies the concepts of IST with the fact that any multi

- dimensional process includes many facets that are connected and interrelated. Any single chemical process or product may be considered to be a part of a complex ecology with interactions throughout the rest of industry and the global economy. A change to a single aspect of this interconnected system to accomplish a single2.0 Project Procedure

3 objective, even one which appears to be highly desirable, may have unanticipated consequences which may be undesirabl e. Implementation of IST will necessarily require a full evaluation of the entire process and everything related to it.

A primary area of concern to DHS is the potential for intentional release of toxic chemicals caused by a

domestic terrorist attack. The very nature of these chemicals poses numerous safety and security issues along the entire supply chain. It has been postulated that application of IST principles may provide a n improvement in the overall security of the U

. S

. chemical industry and the risk it poses

. This is a matter of

debate and while parties on both sides of the issue believe that IST can play a role , there is no agreement

on the level of improvement in security that can be accrued. There are specific examples of IST applications in the li terature but no systematic IST methodology for guiding its evaluation or implementation

.



### 2.0 PROJECT PROCEDURE

2.1 Process

While IST was originally conceived as an engineering design philosophy, in recent years the term IST has become politically charged. The CCPS project was intended to bring IST back into the technical realm by assembling a committee of highly respected experts to evaluate the many IST concepts being discussed in the technical and political arena s

. The goal is to bring together the many concepts being discussed into a

consensus definition.

The CCPS project committee focus ed on classifying and organizing IST concepts into a draft definition

, without initially passing value judgments on any of the components

. This initial draft definition was

devel oped at the first of two workshops where concepts of IST as well as all previously published definitions were presented and discussed by the participants. The definition that came out of this initial workshop was used as the basis for a second workshop wit h an even broader participation, where it was further modified based upon input from the participants. This third draft definition was presented at the Global Congress on Process Safety in San Antonio, Texas ( March 22, 2010 ) for comment by any

attendees. F eedback from that presentation was incorporated into the final definition reported here (see Appendix F )

.



### 2.2 Project Steps and Timeline

2.2.1 Initial Definition W orkshop

– February 3 , 2010

The CCPS project team initially met with DHS CSAC personnel at an all

- day workshop held in Linthicum, Maryland on February 3 , 2010. Appendix D lists the agenda, the participants, and a summary of the key concepts from the workshop.

Team members reviewed the project proposal and DHS outlined its requirements for the project. The team then held an open discussion to review key concepts from the resources and publications available to team members, and concepts derived from their own personal experience with process safety management in genera l and consideration of IST options in p articular. From this discussion

, several initial key

concepts w ere developed for consideration and further elaboration into the definition.

Some important issues related to the form of the definition arose during this discussion. The group

determined that the ―definition‖ should be concise while retaining the essential features required for understanding the IST concepts. The definition should also avoid the use of examples for purposes of defining IST. To better explain the concepts, the definition would b e accompanied by a more extensive,Final Report: Definition of Inherently Safer Technology in Production, Transportation, Storage and Use

4 discussion section ( Appendix B ) which could elaborate on the concepts included in the definition, and which would incorporate illustrative examples where appropriate.

Based on comments and discussions during the workshop, a draft definition was developed, and later circulated through the CCPS project team and DHS representatives. After several iterations, the CCPS staff developed a modified draft definition for discussion at a teleconference of the CCPS project team on

Feb ruary 18, 2010. Following the teleconference, additional clarifications were made to the draft definition and it was modified further by CCPS staff. The draft ( Appendix E ) was used as the basis for discussion at a workshop in Houston, Texas, on February 25 , 2010. This workshop provided additional opportunities for expert feedback and input from a broader range of process safety experts.

2.2.2 Second Definition Workshop

– IST Draft Definition and Discussion

– February 25, 2010

Attendance at the Houston , Texa s workshop was open to individuals who could demonstrate they have practiced inherently safer process and system design, regardless of industry or whether practiced as an engineer, chemist, operator, manager, or other position. The workshop was announced o n the CCPS web site, and by an email to the CCPS Technical Steering Committee. Other individuals who m the CCPS determined were potentially important contributors to the project were specifically invited by CCPS. The

draft definition was also sent to Trevor Kletz, who was unable to attend but later submitted comments via

email

.

Attendees were given a copy of the draft definition to review the day before the workshop. During the workshop, extensive interactive discussion occurred. Attendees were invited to su bmit comments, suggest

concepts that might be missing, or those that might be consolidated or eliminated to keep the definition short, and also to identify the strengths and weaknesses of the candidate definition. Paper feedback forms

were collected for re view by CCPS. Attendees were not asked to agree on the definition, but rather to provide their perspective on what was missing, superfluous, or at variance with their own concept of IST.

All comments were collected and compiled in a spreadsheet after the w orkshop, and used as a basis for revising the definition.

Participants provided over 150 written comments as summarized in Appendix E , ranging from very detailed and specific editorial comments on wording parts of the definition, to significant suggestions to revise the organization and content of the definition. In some cases, specific wording was suggested for parts of the definition. CCPS Staff carefully considered t his feedback in revising the definition. It was not possible to incorporate all feedback for many reasons

— some suggestions were in conflict with each other, while others were deemed inappropriate because they were too detailed for a high level, short definition. However, all comments were evaluated and considered. As a result of the workshop, CCPS was able to significantly shorten the definition and combine a number of concepts from the initial draft to make the definition simpler, while retaining the essential components of a good IST definition.

The CCPS project team reviewed the modified def inition at a teleconference on March 15, resulting in additional simplification and clarification. The result was a final draft definition presented to the process safety community at the Global Congress on Process Safety, in San Antonio, Texas on March 22 , 2010 ( Appendix F ).

2.2.3 Third Definition Workshop

– Final IST Draft and Discussion Pr esented at the Global Congress on Process Safety

– March 22, 2010

CCPS presented the final draft definition on the first day of the Global Congress, held in San Antonio, Texas, at two IST technical sessions that were open to all meeting registrants ( Appendix F ). Written copies of this final draft definition were made available to attendees along with comment and feedback3.0 Key Findings

5 forms. These sessions concluded with an IST panel discussion lead b y session speakers and other people involved in the IST definition project. CCPS received limited feedback from this comment opportunity (primarily minor wording and punctuation changes), which indicates that attendees at these Global Cong ress IST sessions consider the draft definition fundamentally sound and accurate.

The final draft definition was sent to Dr. Trevor Kletz, who endorsed the draft definition in the following

response:

― The final version of the definition is far better than I expected. I feared it would end up like

many (most?) company mission statements and safety policies, which are written in semi

- legal language. As a result

, few people read them and they have little or no e ffect. I think those

members of the Senate that h ave been pressing for compulsory adoption of [inherently safer] IS designs may now have a better understanding of the strengths and limitations of the technique. If

so, [then it] is a great achievement

... . ‖ ( personal communication March 16 2010 )



### 2.3 Project De liverable

The product deliverable s are the definition of IST , a discussion of the definition (Appendix B), and this final report.



### 3.0 KEY FINDINGS

3.1 Final Definition

The project produced a short, scientific definition of IST, as follows:



### INHERENTLY SAFER TECHNO LOGY DEFINITION

Inherently Safer Technology (IST), also known as Inherently Safer D esign (ISD), permanently eliminates or reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to t he design and operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an iterative process that considers such options, including eliminating a hazard, reducin g a hazard, substituting a less hazardous material, using less hazardous process conditions, and designing a process to reduce the potential for, or consequences of, human error, equipment failure, or intentional harm. Overall safe design and operation options cover a spectrum from inherent through passive, active and pr ocedural

risk management strate gies. There is no clear boundary between IST and other strategies.

ISTs are relative : A technology can only be described as inherently safer when compared to a different technology , including a description of the hazard or s e t of hazards being considered

, their location, and the potentially affected population. A technology may be inherently safer than another with respect to some hazards but inherently less safe with respect to others, and may not be safe enough to meet societal expectations.

ISTs are ba sed on an informed decision process : Because an option may be inherently safer with regard to some hazards and inherently less safe with regard to others, decisions about the optimum strategy for managing risks from all hazards are required . The decision p roces s must
consider the entire life cycle, the full spectrum of hazards and risks, and the potential for transfer of risk from one impacted population to another. Technical and economic feasibility of options

must also be considered.Final Report: Definition of Inherently Safer Technology in Production, Transportation, Storage and Use

6 

### 3.2 Major Issues

Because the IST definition is intended to be short, it necessarily leaves out many clarifications and discussions which are important to a full understanding of IST. The CCPS project team, and participants in the various workshops, believed that additional clarifi cation and discussion of the definition was appropriate. This discussion is found in Appendix B . It is essential to read this discussion to fully understand and appreciate the role IST might play as a tool for improved security and safety across the

entire hazardous material supply chain. The discussion incorporates most of the key points discussed in the IST definition workshops. Principally:

IST is a philosophy focusing on eliminating or reducing hazards.
IST is applicable through the entire life cycle an d footprint of any system that manufactures, transports, stores, or uses hazardous materials or hazardous processing conditions.
While IST applies throughout the life cycle, the greatest opportunities to implement IST significantly arise early in the cycl e. A material, process, or technology can only be described as ―inherently safer‖ when compared to a different material, process, or technology; and, the hazard or set of hazards which were considered must be specified.
IST options can be dependent on loca tion and release scenarios.
There is currently no consensus on either a quantification method for IST or a scientific assessment method for evaluation of IST options.
IST is a part of an iterative decision

- making process for risk reduction and choice, ongo ing through the technology life cycle of a technology.
It is unlikely that any technology will be ―inherently safer‖ with respect to all hazards, and other approaches will always be required to manage the full range of hazards and risks.
IST can be categor ized as:

o First Order

– Completely eliminates a particular hazard. Note that this does not say anything about the impact on other hazards, which may be increased, decreased, or remain unaffected by the change.

o Second Order

– Reduces the magnitude of a haza rd, or makes a potential accident associated with a hazard less likely to occur, or less severe, by means of equipment and process design but not through add

- on safety devices.

o Layers of Protection

– When all of the multiple hazards associated with any

tec hnology are considered, layers of protection will always be required as a part of the total risk management program. These layers may be made more reliable and robust through the application of principles of inherent safety.
Decisions on overall risk manag ement strategy need to consider potential conflicts and

tradeoffs among:

o Hazards;

o Likelihood of failure;

o Consequences to all potentially exposed populations and

o Other important risk considerat i ons such as

 e nvironmental impact;

 i mpact on risk in other loca tions or sectors of the overall economy;
process and product supply chain and life cycle;

 technical feasibility;

 economic viability; and

 regulatory r equirements.4.0 References

7 

### 3.3 Utility of the Definition

This definition focuses on understanding the nature of IST, and wha t needs to be considered in evaluating whether or not IST is appropriate for management of security risks associated with hazardous material facilities of all types. It also provides some high level guidance to assist in identifying opportunities for

IST. However, the more extensive and detailed information and checklists available in published literature are more appropriate for use by technical staff (engineers and chemists) and management for identification of IST opportunities for a specific facility. T he definition summarizes a very complex technical philosophy in a short and concise statement to make IST understandable to a broad, non

technical audience. However, actual identification of potential IST options, and evaluation of whether or not they make sense to implement at a specific facility requires a more extensive understanding of the technology involved than this definition provides.



### 3.4 Limitations and Possible Future Work

This project and definition does not address a number of important issues in I ST, including:

Specific methodologies for engineers and managers to identify IST alternatives. This is a field which continues to be developed, and the current status of techniques and procedures is best summarized in Chapter 8 of the 2 nd (2009) Edition of the CCPS book Inherently Safer Chemical Processes: A Life Cycle Approach

. 3

Methods for measuring the IST characteristics of alternative technologies. Inherently Safer Chemical Processes: A Life Cycle Approach, 2 nd Edition 3 (Section 9.7, pp. 223

- 225)

summ arizes some research on this topic but there continues to be no consensus on how to measure IST. A primary issue is that any ―single number‖ quantification of IST will necessarily incorporate some kind of weighting factors to combine the potential conseque nces of different types of hazards (for example, fires, explosions, acute toxicity, chronic toxicity, environmental hazards, etc.). An alternative might be to separately rank the IST characteristics of different options and then use decision analysis techn iques to evaluate options in a specific situation.



### 4.0 REFERENCES

1.0 Kletz, T.A. ―What y ou d on’t h ave, c an’t l eak.‖ Chemistry and Industry , 6 May 1978, pp 287

- 292.

2.0 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes: A Life Cycle Appro ach , ed. D. A. Crowl. New York, American Institute of Chemical Engineers, 1996.

3.0 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes: A Life Cycle Approach , 2nd Edition. American Institute of Chemical Engineers, New York and John Wiley & Sons, Hoboken, NJ. 2009

4.0 C ontra Costa County, California Industrial Safety Ordinance: Inherently s afer s ystems (ISS) http://cchealth.org/groups/hazmat/pdf/is o/2006_iso_official_code_complete.pdf (accessed July 15, 2010).

5.0 Johnson, Robert : ―I nherently safer designs permanently and inseparably reduce or eliminate process hazards that must be contained and controlled to avoid accidents .‖ (unpublished presentation )

6.0 Kletz, T. A. Process Plants: A Handbook for Inherently Safer Design . Bristol, PA, Taylor and Francis, 1998.

7.0 Kletz, Trevor: ―A n [inherently safer] IS design is one that avoids hazards instead of controlling them, particularly by reducing the amount of ha zardous material or the number of hazardous operations .‖ ( P ersonal communication in February 2010 .)Final Report: Definition of Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.

## APPENDI CES

APPENDIX A: FINAL DEFINITION OF INHERENTLY SAFER TECHNOLOGY

APPENDIX B: FINAL DISCUSSION ON INHERENTLY SA FER TECHNOLOGY

APPENDIX C: CCPS PROJECT PROPOSAL SUBMITTED OCTOBER 13, 2009

APPENDIX D: INITIAL DEFINITION WORKSHOP

– FEBRUARY 3 , 2010

APPENDIX E: SECOND DEFINITION WORKSHOP

– IST DRAFT DEFINITION AND

DISCUSSION

– FEBRUARY 25, 2010

APPENDIX F : THIRD DE FINITION WORKSHOP

– FINAL IST DRAFT AND

DISCUSSION PRESENTED AT THE GLOBAL CONGRESS ON
PROCESS SAFETY

– MARCH 22, 2010

APPENDIX G: NOMENCLATURE

APPENDIX H : ABOUT CCPSFinal Report: Definitions for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.Appendix A

A

- 1 

### APPENDIX A: FINAL DEFINITION FOR INHERENTLY SAF ER
TECHNOLOGY

/INHERENTLY SAFER DESIGN

Below is the final technically based definition of i nherently s afer t echnology /inherently s afer design (IST/ISD). Appendix B provides additional discussion to enable the reader a full understanding of IST.



### INHERENTLY SAFER TECHNOLOGY DEFINITION

Inherently Safer Technology (IST), also known as Inherently Safer D esign (ISD), permanently eliminates or reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to t he design and operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an iterative process that considers such options, including eliminating a hazard, reducin g a hazard, substituting a less hazardous material, using less hazardous process cond itions, and designing a process to reduce the potential for, or consequences of, human error, equipment failure, or intentional harm. Overall

, safe design and operation options cover a spectrum from inherent through passive, active and pr ocedural

risk mana gement strategies. There is no clear boundary between IST and other strategies.

ISTs are relative : A technology can only be described as inherently safer when compared to a different technology , including a description of the hazard or set of hazards bei ng considered, their location, and the potentially affected population. A technology may be inherently safer than another with respect to some hazards but inherently less safe with respect to others, and may not be safe enough to meet societal expectations

. ISTs are based on an informed decision process : Because an option may be inherently safer with regard to some hazards and inherently less safe with regard to others, decisions about the optimum strategy for managing risks from all hazards are required . T he decision proces s must
consider the entire life cycle, the full spectrum of hazards and risks, and the potential for transfer of risk from one impacted population to another. Technical and economic feasibility of options

must also be considered.Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This pa ge intentionally left blank.Appendix B

B

- 1 

### APPENDIX B: FINAL DISCUSSION ON DRAFT DEFINITION OF INHERENTLY
SAFER TECHNOLOGY

Inherently safer technology/inherently safer design (IST/ISD) is a philosophy

— an approach to safety that focuses on eliminating or reducing the ha zards associated with a set of conditions. It is applicable through the entire life cycle and footprint of any system that manufactures, transports, stores, or uses hazardous materials or hazardous processing conditions. IST permanently and inseparably red uces or eliminates process hazards that must be contained and controlled to avoid incidents, rather than controlling those hazards by added

- on protective equipment. While IST applies throughout the life cycle of a process, plant, or material, the greatest opportunities for significant IST benefits are early in the life cycle, before the technology becomes deeply integrated into the infrastructure of an industry from raw material suppliers through final product users, and before major investments in plant an d equipment are made.

A material, process, or technology can only be described as ―inherently safer‖ when compared to a different material, process, or technology. This description must include the definition of the particular

hazard or set of hazards that were considered in making the comparison. Thus, it is not appropriate to describe a technology as inherently safer than an alternate technology, with no further description. An appropriate description would be, for example, that the first technology is in herently safer than the alternate technology with respect to the hazards of acute toxicity and flammability of the vapor. Note that this statement makes no judgment about the relative inherent safety characteristics of other possible

hazards

– the first te chnology may be inherently less safe than the alternate technology with respect to other hazards such as chemical reactivity, chronic toxicity, or potential for hazardous decomposition.

IST options can be location and release scenario dependent, and differ ent potentially exposed populations may not agree on the relative inherent safety characteristics of the same set of options. For example, two options for handling a toxic gas might be receiving the material in ten, 1

- ton cylinders or one, 10

- ton
truckload s . To a population several miles from the site, the 1

- ton cylinders would be inherently safer because the maximum potential release size is smaller and less likely to expose them to a hazardous concentration of the gas. However, operators, who would now ha ve to connect and disconnect 10 cylinders for every 10 tons of material used, instead of a single truck, would consider the truck shipments to be inherently safer. Thus, evaluation of IST options can be quite complex, and dependent on the local

environment . There is currently no consensus on either a quantification method for IST or a scientific assessment method for evaluation of IST options.

Inherently safer design is a part of an iterative decision

- making process for risk reduction. It is ongoing

and co ntinuous throughout the life cycle of a technology, from initial conception through commercialization, operation, and, when obsolete, shutdown and demolition. It should consider the entire footprint of the process

— raw material sources and supply, impact on supply technologies, transportation, and impact on downstream users and their technologies, and ultimate material disposition. Evaluation of IST options for a particular plant, product, or other system must consider the overall effects of all other impact ed systems

— it is essential to understand the impact that a change in one technology will have on hazards and risks elsewhere in society. In particular, it is important to identify all such impacts and to make informed decisions on the best overall way to m anage risk throughout society.

Risk reduction criteria will be determined by the nature of the hazards or threats, and will require consideration of conflicts among multiple hazards and threats. Tools for understanding societal expectations for risk manage ment include national and local government regulations and other legal requirements, consensus codes and standards developed by technical and trade associations, and internal corporate standards and requirements. The potential hazard of a major release res ulting from an accident

, as well as security or vulnerability concerns such as theft of materials, contamination of products, and degradation of infrastructure, must be considered. Hazard identification, risk assessment, and securityFinal Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

B

- 2 vulnerability analys is tools are used to identify and characterize risk. Risk can be reduced by many methods, including inherently safer design, but those methods must include the full spectrum of risk reduction approaches (passive, active, and procedural risk management syst ems). This is particularly true when considering the need to manage multiple hazards and risks

— it is unlikely that any technology will be ―inherently safer‖ with respect to all hazards, and other approaches will always be required to manage the full range of hazards and risks. Ultimately, society must decide which hazards and risks it wants to manage primarily with inherently safer design approaches, and which hazards and risks will be managed with other approaches (active, passive, and procedural).

The ins eparability of IST from the overall objective of the safe design and operation of hazardous material manufacturing, transportation, storage, and use is apparent when considering chemical security. An IST with respect to catastrophic release hazard from a f ixed manufacturing plant may conflict with

methods to minimize other hazards, such as theft or diversion of materials, contamination of product, or degradation of infrastructure

. It may not address other hazards at all, or
, it may create new hazards.

The C CPS book Inherently Safer Chemical Processes: A Life Cycle Approach describes several levels of inherently safer design. 1

― First Order inherently safer design refers to the identification of alternatives that completely eliminate a particular hazard. Note that, as discussed above, this does not say anything about the impact on other hazards, which may be increased, decreased, or remain unaffected by the change. An example would be using a water based paint to paint a room in your house instead of

flammable solvent based paint, eliminating the hazard of exposure to low levels of potentially toxic solvents, and fire hazards associated with flammable solvent.

Second Order inherently safer design reduces the magnitude of a hazard, or makes an accident

associate d with a hazard less likely to occur, by the design of the equipment, and not through add

on safety devices. Again, this does not say anything about the impact of the change on other hazards, which may be increased, decreased, or remain s unaffected. As an example of reducing the magnitude of a hazard, explosives such as TNT can be made in small continuous reactors containing a few gallons of material rather than large batch reactors containing thousands of gallons of material. As an example of inherently ma king a hazard less likely to result in an accident, if adding too much raw material to a vessel can cause a runaway reaction, this can be made inherently less likely by installing a feed tank that holds the exact amount of raw material required, and no mor e.

Layers of Protection include risk management equipment and management systems often categorized as Passive, Active, and Procedural. These layers include risk management features such as containment dikes to manage spills and leaks (passive), safety alar ms and shutdown systems (active), and safety procedures and operator actions (procedural). When you consider all of the multiple hazards associated with any technology, it is unlikely that it will ever be possible to manage all of them inherently, and laye rs of protection will always be required as a part of the total risk management program. Inherently safer design concepts can be used to make these layers of protection inherently more reliable and robust.‖

1 Center for Chemical Process Safety (CCPS). Inherent ly Safer Processes: A Life Cycle Approach. 2 nd Edition, American Institute of Chemical Engineers/John Wiley & Sons, Inc., Hoboken, NJ, 2009, pp. 15

- 16.Appendix B

B

- 3 Decisions on the appropriate overall risk managem ent strategy will be a function of, and will consider potential conflicts and tradeoffs with:

Hazards ;

Likelihood of failure ; Consequences to all potentially exposed populations ; Other important risk considerations such as environmental impact ;
Impact on r isk in other locations or sectors of the overall economy ; Process and product supply chain and life cycle, including distribution considerations and final user considerations such as consumer expectations or government regulations regarding product quali ty ; Technical feasibility

– may be location specific ; Economic viability

– may be location specific ; and

Regulatory requirements

– may be location specific.Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.Appendix C

C

- 1 

### APPENDIX C : CCPS PROJECT PROPOSAL SUBMITTED OCTOBER 13, 20 09

C.1 SUMMARY OF NEED

The Center for Chemical Process Safety (CCPS), a directorate of the American Institute of Chemical Engineers (AIChE), a 501 (c) (3) not for profit educational organization, is pleased to submit this proposal to the U.S. Department o f Homeland Security (DHS) Chemical Security Analysis Center (CSAC).

The CSAC statement of work is attached to this proposal for reference. CSAC is requesting an independent technical organization to review the literature and common practice s related to des ign of Inherently Safer Processes, and lead a process to develop a technically

- based definition of Inherently Safer Technology (IST).

CSAC desires that the definition span the full life cycle of the chemical enterprise, including use and manufacturing, sto rage, and transportation. It is CSAC’s view that the various current definitions available in the literature, including those of CCPS, Trevor Kletz, and others have inconsistencies. CSAC further believes that existing definitions are not broad enough to ad dress the full supply chain and do not go far enough to help resolve the classic challenge posed by IST, such as tradeoffs where improvement in safety in one dimension of process or supply chain may lead to degradation of safety in another

dimension.



### C. 2 PROPOSED APPROACH

CCPS proposes a 5

- step process to address this challenge.

Step 1: Scoping

While IST was originally conceived as an engineering design philosophy, in recent years the term IST has become politically charged. CCPS will seek to bring IST bac k into the technical realm by assembling a committee of highly respected experts to evaluate the many IST concepts being discussed in the technical and political arena. The goal of this scoping meeting is to pull together the many concepts being discussed

into 3

- 6 alternative definitions, which would be the deliverable of this step. The committee would strive to focus solely on classifying and organizing the definitions, without initially passing value judgments on any of the alternatives. An idea synthesis process will be used, similar to that used by the CCPS Planning Committee to survey current needs and trends in process safety to generate project proposals for selection by CCPS members. Additionally, the subcommittee will propose criteria by which the a lternatives will be

evaluated.

CCPS proposes that the scoping committee be led by Mr. Peter N. Lodal of Eastman Chemical. Mr. Lodal is a Fellow of AIChE and of CCPS and is the current chair of the CCPS Engineering Design

subcommittee. Mr. Lodal’s time will be donated by Eastman Chemical to this project, but reimbursement of his travel, food, and lodging has been requested. The committee membership will also include the following technical leaders from the CCPS community, or others with similar attributes, t o represent chemical, refining, and pharmaceutical manufacturing, large and small companies, and experts serving

these industries as listed in Table C

- 1 :Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

C

- 2 Table C

- 1. Proposed Scoping Committee Participants

PARTICIPANT ORGANIZATION

Kathy Anderson Vertellus

Scott Berger CCPS

Paul Butler CCPS

Eric Freiburger NOVA Chemicals

Cheryl Grounds BP

Dennis Hendershot CCPS

Greg Housell Pfizer

Shakeel Kadri Air Products

Neil Maxson Neil Maxson

Jack McCavit CCPS

Steve Meszaros Wyeth

Cathy Pincus ExxonMobil

Ja tin Shah Baker Risk

Kenan Stevick Dow Chemical

Karen Tancredi DuPont

Scott Wallace Olin

NOTE: This is a proposed participant list

— s ubstitutions may have been made to actual participants.

CCPS also wishes to incorporate the thinking of Trevor Kletz, con sidered by many to be the father of the Inherently Safer Process design philosophy. If it were not possible for Dr. Kletz to travel to the committee meetings, his input would be included by tele

- or web

- conferencing, or offline discussions.

Step 2: Worksho p on the definition of inherently safer technologies

Once 3

- 6 candidate definitions and criteria to evaluate them have been drafted, they will be presented at a workshop so that attendees can review these definitions and criteria. We will not ask the works hop attendees to decide between the definitions, but rather to identify the strengths and weaknesses of each candidate. Likewise, we will not ask the attendees to agree on the criteria, but rather to identify criteria that are missing or superfluous.

Atten dance at the workshop will be open to any individual who can demonstrate that they have practiced inherently safer process and system design, regardless of industry or whether practiced as an engineer, chemist, operator, manager, or other position. Labor a nd activist participants will be welcome, but only to the extent they have actually practiced inherently safer processes. Because some attendees may need financial assistance in order to attend, a process will be developed by which invitations are extended and, if appropriate, travel stipends awarded from grant.Appendix C

C

- 3 Step 3: Finalizing Definitions

Following the workshop, the CCPS committee will review the input received and proceed to evaluate the candidate definitions, ultimately narrowing them down to a singl e recommended definition.

Step 4: Presenting Recommendations for Comment

CCPS plans to formally present its recommendations at the Global Congress on Process Safety, and simultaneously publish the recommendations on its website for public comment. Since m any key stakeholders attend this conference, it will be a convenient opportunity to gather them together. In order to ensure that key viewpoints are represented during the presentation at the Global Congress on Process Safety, CCPS will invite individuals who represent diverse viewpoints but do not normally attend the Global Congress to attend. A process will developed by which invitations are extended and, if appropriate, registration fees and travel stipends awarded from grant funds to enable such individ uals to

attend.

Step 5: Finalizing the Recommendation

The CCPS committee will review comments provided at the Global Congress and via other formats and thereafter finalize the definition. If comments were provided by a person who wishes a formal response

e xplaining how their comment was addressed, such a response will be given. This final meeting (or set of meetings) will be held by tele

- and web

- conference. The single definition, along with the rationale supporting the choice of this definition, will be re ported to CSAC in a final report.



### C. 3 PERSONNEL

CCPS proposes that the project be supported by the following permanent and part

- time staff.

Project Manager: Scott Berger, CCPS Ex ecutive Director

Scott Berger joined the staff of AIChE in 2001 and has serv ed as the CCPS Director and Executive

Direct or since then. In this capac ity, he has facilitated more than 40 projects leading to the publication of CCPS Guideline or Concept Series books, other publications, or training materials related to process safety. Over this period, industrial participation in CCPS activities grew from 65 to over 120 member companies. Prior to joining AIChE, he worked at Owens Corning for 5 years in various leadership roles promoting safer and greener manufacturing processes, manage ment systems, and products. He started is career at Rohm and Haas, where for 18 years he worked in process development and engineering, with a focus on pollution prevention and inherently safer processes. Scott holds a BS and MS from

Massachusetts Institut e of Technology.

Expert Advisor: Dennis Hendershot, CCPS Staff Consultant

Dennis Hendershot joined the CCPS staff as a part

- time staff consultant upon his retirement from Rohm

and Haas in 2005. Dennis led two important CCPS projects

, the revision of ―Inher ently Safer Processes ,‖

the CCPS authoritative text on the subject , and ― Guidelines for Safety Risk Criteria. ‖ During this same period, Dennis served on the Baker Panel investigating process safety culture within the BP organization following the major vap or cloud explosion in March 2005. Prior to 2005, Dennis worked at Rohm and Haas for 35 years, more th an half of which as Ro hm and Haas’ leading expert on process safety, hazard and risk analysis, and inherently safer processes. Dennis holds a BS from Lehig h University and an MBA from University of Pennsylvania.Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

C

- 4 Project Facilitator: Paul Butler, CCPS Technical Manager

Paul Butler joined the AIChE staff as CCPS Technical Manager in 2008. Prior to joining CCPS, Paul

worked at Buckman Laboratories for 3 5 year s, more than half of which serving as the D irector of Process Safety. In this role, Paul deployed process safety principles and management systems throughout Buckman’s worldwide sites. Paul holds a BS from Virginia Tech.



### C. 4 TIMING AND COST

Table C

- 2 list s the proposed schedule, dates, and funding for this project. It is assumed the final workshop will be held at the Global Congress on Process Safety on March 22

- 24, 2010. If a more compressed time schedule is required, the schedule may be changed.

Table C

- 2

. Proposed Schedule and Funding

SCHEDULE DATE

Awarding of grant November 1, 2009

Organize scoping meeting November 1

– November 15, 2009

Hold scoping meeting November 15

– December 15, 2009

Summarize scoping meeting December 16, 2009

– January 15, 201 0

Organize Workshop December 1, 2009

– January 15, 2010

Hold Workshop January 15

– January 31, 2010

Report Recommendation March 22

- 24, 2010

Final comments accepted April 15, 2010

Final report May 1, 2010

Requested funding: $59,695



### C. 5 S TATEM ENT OF WORK

Prepare a final definition of Inherently Safer Technology in Production, Transportation, Storage and Use

The Chemical Security Analysis Center (CSAC), part of the U.S. Department of Homeland Security (DHS) Directorate of Science and Technology (S&T) is seeking sources to provide a definition of

i nherently s afer t echnology (IST)

.

A primary area of concern to the U.S. Department of Homeland Security (DHS) is the potential for intentional release of toxic chemicals caused by a domestic terrorist at tack. The very nature of these chemicals poses numerous safety and security issues along the entire supply chain. It is believed that application of principles of i nherently s afer t echnology (IST) will provide a significant improvement in

the overall safet y of the U

. S

. chemical industry. Even though this view is widely held, there is no consensus on a definition of IST beyond its basic philosophical ten e ts. There are specific examples of IST applications in the literature but no systematic IST methodology, which can guide its implementation.Appendix C

C

- 5 In order to provide such guidance, CSAC is seeking a contractor to provide a definition of IST. This definition should address in some manner the basic tenets of IST as applied to production such as:

1. Minimization of tox ic material usage ;

2. Substitution or use less hazardous materials for toxic materials ;

3. Attenuate reaction conditions ; and

4. Simplification of process design to minimize human error or equipment failure

. However, because of the concerns of risk shift/transfer to other sectors, this definition should also capture IST issues related to the other components of the chemical supply chain:

1. Transportation,

2. S torage, and

3. Use.

This definition should provide a basis on which the safety of alternate manufacturing, use, transportation, or storage modes of a particular compound can be compared and quantified. This comparison should allow for the selection of the safest process.Final Report: Definition for Inherently Safer Technology in Production, Transportati on, Storage and Use

This page intentionally left blank.Appendix D

D

- 1 

### APPENDIX D : INITIAL DEFINITION WORKSHOP

– FEBRUARY 3 , 20 10

D .1 WORKSHOP AGENDA

The Initial Inherently Safer Technology Definition Workshop was held in Baltimore, Maryland on February 3 , 2010. The agenda is listed in Table D

- 1

.

Table D

- 1. Agenda

TIME TOPIC LEADER

7:30 Breakfast All

8:00 Summary of agenda

– h ow the day will work Shawn Bowen

8:15 Introductions All

8:30 Introductory comments

Objectives and deliverables Overall process George Famini Scott Berger

9:00 Ground rules Shawn Bowen

9:05 Explanation of definition Dennis Hendershot

9:20 Pause to wri te comments All

9:30 Feedback on ―Comparative ‖ Dennis Hendershot

10:00 Break All

10:15 Feedback on ―specific‖ Dennis Hendershot

10:45 Feedback on ―value judgment‖ Dennis Hendershot

11:15 Feedback on ―not absolute‖ Dennis Hendershot

11:45 Lunch All

1 :00 Feedback on title and introductory paragraph Dennis Hendershot

1:30 General feedback Dennis Hendershot

2:30 Review, summarize, and next steps Scott Berger

3:00 CloseFinal Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

D

- 2 

### D

. 2 PARTICIPANTS

The Initial Inherently Safer Technology Definition Workshop ( February 3 , 2010) participants are listed in

Table D

- 2

.

Table D

- 2. Workshop Participants

PARTICIPANTS ORGANIZATION
Scott Berger CCPS

Shawn Bowen DHS

- CSAC

Dan Crowl Michigan Tech University George Emmett DHS

- CSAC George Famini DHS

- CSAC
Eric Freiburg er Praxair Cheryl Grounds BP

Dennis Hendershot CCPS
Iclal Atay New Jersey DEP

Peter Lodal Eastman

Jack McCavit CCPS Emeritus
Adolpho Negron US DHS CSAC

Pat Scenefeldt ExxonMobil

Kenan Stevick Dow

Karne Tancredi DuPont

Scott Wallace Olin



### D

. 3 SUMMARY

Below are the key concepts summary of the Initial Inherently Safer Technology Definition Workshop (February 2, 2010) :

Overview of project and clarifications

Criteria

– how do we know definition fits purpose

Review ―gold book‖ definition

Brainstor ming

o How do we extend IST to life cycle steps?

o Definitions for each life cycle step

o Also, what IST is not

o Reconciling the life cycle definitions with each other

o How does IST apply to vulnerability?

o Definition for IST related to vulnerability

o Reconciliation the security definition with the prior

Preparation for February 25 workshop

– how to make sure we get input that clarifies rather

than blurs?

Preparation for March 22 workshop

– how to structure.Appendix E

E

- 1 

### APPENDIX E : SECOND DEFINITION WORKSHOP

– IST DRAFT AND DISCUSSION

– FEBRUARY 25, 2010

E.1 AGENDA

The Initial Draft Inherently Safer Technology Definition and Discussion Workshop was held in Houston,

Texas on February 2 5 , 2010 . The agenda is listed in Table E

- 1

.

Table E

- 1. Agenda

TIME TOPIC LEADER

7:30 Breakf ast All

8:00 Summary of agenda

– how the day will work Shawn Bowen

8:15 Introductions All

8:30 Introductory comments

Objectives and deliverables Overall process George Famini Scott Berger

9:00 Ground rules Shawn Bowen

9:05 Explanation of definition D ennis Hendershot

9:20 Pause to write comments All

9:30 Feedback on ―Comparative‖ Dennis Hendershot

10:00 Break All

10:15 Feedback on ―specific‖ Dennis Hendershot

10:45 Feedback on ―value judgment‖ Dennis Hendershot

11:15 Feedback on ―not absolute‖ De nnis Hendershot

11:45 Lunch All

1:00 Feedback on title and introductory paragraph Dennis Hendershot

1:30 General feedback Dennis Hendershot

2:30 Review, summarize, and next steps Scott Berger

3:00 CloseFinal Report: Definition for Inherently Safer Technology in Production, Tr ansportation, Storage and Use

E

- 2 

### E

. 2 PARTICIPANTS

Participants at t he Initi al Draft Inherently Safer Technology Definition and Discussion Workshop (February 2 5 , 2010) are listed in Table E

- 2

.

Table E

- 2. Workshop Participants

PARTICIPANT ORGANIZATION

Kathy Anderson Vertellus

Steve Arendt ABSG Consulting
Iclal Atay NJDEP

Scott Berger CCPS

Shawn Bowen DHS

- CSAC

Carl Brown KBR / Univ. Houston

Alber Candello University of Houston

Kenneth Carlson Occidental

Jack Chosnek Independent

Jim Cooper NPRA

Vic Edwards Aker Solutions George Emmett DHS

- CSAC George Famini DHS

- CSAC

Bra d Fuller AcuTech Cheryl Grounds BP

Dennis Hendershot CCPS

Charles Jones Solvay

- Solexis

Michael Kennedy SOCMA Greg Kiihne BASF George King Huntsman

Allen Lasater Koch

Peter Lodal Eastman
Sa, Mannan Texas A&M

John Miles Occidental

Shawn Moshiri Ch evron

Tim Overton BP Cathy Pincus ExxonMobil

Robin Pitblado DNV

Mike Sawyer Apex Safety

Randall Sawyer Contra Costa County
Roxy Schneider CCPS

Steve Selk DHS
Terry Smith PPG

Karne Tancredi DuPont

Kevin Walker Chevron

Scott Wallace Olin

Nohemi Z erbi DHSAppendix E

E

- 3 

### E .3 SUMMARY

Participants provided over 150 written comments as summarized below, ranging from very detailed and specific editorial comments on wording of parts of the definition, to significant suggestions to revise the organization and content of the definition. In some cases, specific wording was suggested for parts of the definition. This feedback was carefully considered by CCPS Staff in revising the definition. It was not possible to incorporate all feedback for many reasons because some su ggestions were in conflict with each other, while others were deemed inappropriate because they were too detailed for a high level, short definition. However, all comments were evaluated and considered. As a result of the workshop, CCPS was able to signifi cantly shorten the definition and combine a number of concepts from the initial draft to make the definition simpler, while retaining the essential components of a good IST definition.

Inherently s afer t echnology (IST) , also known as i nherently s afer d esig n (ISD) , is a design philosophy or strategy integral to the broader objective of s afer d esign (SD). Inherently s afer t echnology permanently and inseparably reduces or eliminates process hazards to avoid accidents, rather than controlling those hazards by a dded

- on protective equipment

.

Inherently s afer t echnology reduces risk through a hierarchy of approaches, starting with eliminating hazards, then reducing hazards, substituting less hazardous materials, using less hazardous process conditions, and designin g processes to reduce the possibility or consequences of human error or

mechanical failure. As we progress through this hierarchy, we gradually transition from IST to SD, and that is why IST cannot be separated from SD. Some important characteristics of IS T include:

Relative : A technology, material, or process can only be described as ― i nherently s afer‖ when compared to a different technology, material, or process.

Specific : It is not possible to describe Technology A as ―inherently safer‖ than Technology B without describing the hazard or set of hazards being considered. It is possible for a technology, material, or process to be inherently safer than another technology, material, or process with respect to some hazards and inherently less safe with respe ct to others.

Value judgment : The potential of an option to be i nherently s afer with regard to some hazards and inherently less safe with regard to others may require value judgments about the optimum strategy for managing risks arising from all hazards. Some hazards may be managed inherently, while others may require other safety management approaches.

Not absolute : It is fundamentally possible for one technology to be inherently safer than another, while still not safe enough to meet societal expectat ions.

Inherently Safer Technology

– Discussion

Inherently safer design is a concept and philosophy

- an approach to safety that focuses on eliminating or reducing the hazards associated with a set of conditions. An inherently safer design permanently and

i nseparably reduces or eliminates process hazards that must be contained and controlled to avoid accidents, rather than controlling those hazards by added

- on protective equipment. A material, process, or technology can only be described as ―inherently safer ‖ when compared to a different material, process, or technology, and this description must include the definition of the particular hazard or set of hazards which were considered in making the comparison. Thus, it is not appropriate to describe Material A as ―inherently safer‖ than Material B with no further description. An appropriate description would be ―Material A is inherently safer than Material B with respect to the hazard of acute toxicity of the vapor, and the hazard of flammability of the vapor.‖ Note that this statement makes no judgment about the relative inherent safety characteristics of other possible hazards

– Material A may be inherently less safeFinal Report: Definition for Inherently Safer Technology in Production, Tr ansportation, Storage and Use

E

- 4 than Material B with respect to other hazards such as chemical reactivity, chronic toxicity, or potential for hazardous decomposition.

Inherently s afer t echnology (IST), also known as i nherently s afer d esign (ISD), permanently eliminates or

reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to the design a nd operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an iterative process that considers options, including eliminating a hazard, reducing a hazard, substituting a less hazardous material, using less hazardous proce ss conditions, and designing a process to reduce the potential for, or consequences of, human error, equipment failure, or intentional harm. Overall safe design and operation options cover a spectrum from inherent through passive, active and procedural ris k management strategies. There is no clear boundary between IST and other strategies.

Inherently safer design is a part of an iterative decision

- making process for risk reduction. It is ongoing and continuous throughout the life cycle of a material or pro cess, from initial conception through commercialization, operation, and, when obsolete, shutdown and demolition. It should consider the entire footprint of the process

– raw material sources and supply, impact on supply technologies, transportation,

the im pact on downstream users and their technologies, and ultimate material disposition. Risk reduction criteria will be determined by the nature of the hazards or threats, and will likely require some consideration of conflicts among multiple hazards and threa ts. Important considerations in prioritizing efforts include the threshold of a major accident hazard (public health impact

– PHI), as well as security or vulnerability (including definition of the threat, which must include factors such as theft/diversion , and intentional release). Hazard and risk assessment tools are used to identify and characterize risk. Risk can be reduced by many methods, including inherently safer design, but methods must include the full spectrum of risk reduction approaches (passiv e, active, and procedural risk management systems). This is particularly true when considering the need to manage multiple hazards and risks

– it is unlikely that any technology will be ―inherently safer‖ with respect to all hazards, and other approaches w ill always be required to manage the full range of hazards and risks. Ultimately we must decide which hazards and risks we want to manage primarily with inherently safer design approaches, and which hazards and risks will be managed with other approaches ( active, passive, procedural). The inseparability of IST from SD is apparent when considering chemical security. An Inherently Safer Technology with respect to catastrophic release hazard may conflict with, or may not address other hazards, such as theft/di version of materials, contamination of product, or degradation of infrastructure, or may create new security hazards.

The CCPS book Inherently Safer Chemical Processes: A Life Cycle Approach describes several levels of inherently safer design. 2

― First Orde r inherently safer design refers to the identification of alternatives that completely eliminate a particular hazard. Note that, as discussed above, this does not say anything about the impact on other hazards, which may be increased, decreased, or

remain unaffected by the change. An example would be using a water based paint to paint a room in your house instead of flammable solvent based paint, eliminating the hazard of exposure to low levels of potentially toxic solvents, and fire hazards associated with

flammable solvent.

Second Order inherently safer design reduces the magnitude of a hazard, or makes an accident associated with a hazard less likely to occur, by the design of the equipment, and not through add

- on safety devices. Again, this does not say anything about the impact of the change on other hazards, which may be increased, decreased, or remain s unaffected.

2 Center for Chemical Process Safety (CCPS). Inherently Safer Processes: A Life Cycle Approach. 2 nd E dition, American Institute of Chemical Engineers/John Wiley & Sons, Inc., Hoboken, NJ, 2009, pp. 15

- 16.Appendix E

E

- 5 As an example of reducing the magnitude of a hazard, explosives such as TNT can be made in small continuous reactors containing a few gallon s of material rather than large batch reactors containing thousands of gallons of material. As an example of inherently making a hazard less likely to result in an accident, if adding too much raw material to a vessel can cause a runaway reaction, this can be made inherently less likely by installing a feed tank that holds the exact amount of raw material required, and no more.

Layers of Protection include risk management equipment and management systems often categorized as Passive, Active, and Procedural. These layers include risk management features such as containment dikes to manage spills and leaks (passive), safety alarms and shutdown systems (active), and safety procedures and operator actions (procedural). When you consider all of the multiple hazar ds associated with any technology, it is unlikely that it will ever be possible to manage all of them inherently, and layers of protection will always be required as a part of the total risk management program. Inherently safer design concepts can be used to make these layers of protection inherently more reliable and robust.‖

Decisions on the appropriate overall risk management strategy will be a function of, and will consider potential conflicts and tradeoffs with:

h azards ;

m aterial selection ;

p rocess and product supply chain and life cycle, including distribution considerations and

final user considerations ;

t echnical feasibility

– may be location specific ;

e conomic viability

– may be location specific ; and

e nvironmental impact

.Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionall y left blank.Appendix F

F

- 1 

### APPENDIX F : THIRD DEFINITION WORKSHOP

– FINAL IST DRAFT DEFINITION
AND DISCUSSION PRESENTED AT THE GLOBAL CONGRESS ON PROCESS
SAFETY

– MARCH 22, 2010

F .1 AGENDA

The Final Draft Definition and Discussion of Inherently Safer Technology were p resented at the Global Congress on Process Safety, which was held in San Antonio, Texas on March 22, 2010. The agenda for the Global Congress is listed in Table F

- 1

.

Table F

- 1. Agenda for Global Congress on Process Safety : Topical 1 Sessions

Topical 1: Gl obal Congress on Process Safety*
12th Process Plant Safety Symposium (PPSS)

25th Center for Chem ical Process Safety International Conference (CCPS)

44th Annual Loss Prevention Symposium (LPS)

Monday, March 22, 2010

8:00 AM

- 9:20 AM

Topical 1: Global Congress on Proc ess Safety

(#6)

- T1C07 Opening Plenary Session

- Sherman Glass, President of Exxon

- Mobil Worldwide Refining and Supply Co.

10:00 AM

- 11:30 AM

Topical 1: Global Congress on P rocess Safety

(#20)

- T1C00 Fires, Explosions and Reactive Chemicals (Part I)
Topical 1: Global Congress on Process Safety

(#21)

- T1B04 Inherently Safer Design/Inherently Safer Technologies (Part I)
Topical 1: Global Congress on Process Safety

(#22)

- T1B00 LOPA Bloopers and Outtakes
Topical 1: Global Congress on Process Safety

(#23)

- T1A02 Management of Change

- the Most Difficult PSM Challenge

1:30 PM

- 5:00 PM

Topical 1: Global Congress o n Process Safety

(#26)

- T1B02 Case Histories of Risk Assessment and Problem Solving
Topical 1: Global Congress on Process Safety

(#27)

- T1C05 Fires, Explosions and Reactive Chemicals (Part II)
Topical 1: Global Congress on Process Safety

(#28)

- T1B07 Inherently Safer De sign/Inherently Safer Technologies (Part II)
Topical 1: Global Congress on Process Safety

(#29)

- T1A01 Layer of Protection Analysis (LOPA)

- Case Studies and Experiences

* A dapted from the AIChE Website: http://aiche.confex.com/aiche/s10/webprogram/T1.html ( accessed July 6, 2010).Final Report: Definition for Inherently Safer Technology in P roduction, Transportation, Storage and Use

F

- 2 

### F. 2 CONFERENCE SESSIONS

The Initial Inherently Safer Technology Definition and Discussion agenda and abstracts of the sessions held at the Global Congress on Process Safety have been modified and are located in Table F

- 2 though

Table F

- 6

.

Table F

- 2

. Agenda for Inherently Safer Design/Inherently Safer Technologies: Topical 1, Ses sion 21, Part I

Inherently Safer Design/Inherently Safer Technologies (Part I ) *

Monday, March 22, 2010: 10:00 AM Room 101 A/B (Convention Center)

Dennis C. Hendershot , Process Safety, Bethlehem, PA

Inherent safety (IS) is the modern term for eliminating hazards rather than accepting and managing them. Engineering is the traditional realization of this concept, as its core function is the application of science, technology, and mathematics to develop and implement practical solutions that are safe and
eff icient. Currently there is much interest across industry, academia, advocacy groups and governments in mandating IS to achieve process safety and security goals. There is much debate as to what comprises IS, how and when it is best applied, who/how to judg e this creative process, how and whether it differs from traditional engineering, and what role it should have in the chemical industry to achieve process safety and security goals. This session will present three papers of realistic scenarios and case

his tories that demonstrate various perspectives and views of IS and its application. A facilitated panel discussion exploring the proper role of IS and audience questions session will follow the presentations.

Sponsor: 25th Center for Chemical Process Safet y International Conference (CCPS)

Chair: Eric Freiburger

Email: Eric_Freiburger@Praxair.com

Co

- Chair: Cheryl Grounds

10:00 AM
(21a) Overview of IST
Dennis C. Hendershot

10:30 AM
(21b) The DHS Chemical Facility Anti

- Terrorism Standards

– A Risk

- Based Approach to Chemical Facility Security Larry Stanton

11:30 AM
(21c) IST Trade

- Offs
Jatin Sha h

* Adapted from the AIChE Website : http://aiche.confex.com/aiche/s10/we bprogram/Session13520.html (accessed July 6, 2010).Appendix F

F

- 3 Table F

- 3

. Abstracts for Inherently Safer Design/Inherently Safer Technologies:

Topical 1, Session s 21 a

- 21c , Part I*

Overview of IST Topical 1, Session 21a Monday, March 22, 2010: 10:00 AM

Room 101 A/B (Convention Center)

Dennis C. Hendershot , Process Safety, Bethlehem, PA

Inherently Safer Design (ISD) is a holistic approach to making the development, manufacturing, and use of chemicals safer. Over time, there have been many developments on the concep t of inherent safety ; however, currently there is a growing fixation on only one element of ISD: substitution. This paper will present an overview of ISD and its elements of minimize, substitute, moderate, and simplify. In addition, the life cycle of a pro cess will be explained in context of ISD to further explain the most effective use of ISD as well as other risk mitigation methods and strategies.

The DHS Chemical Facility Anti

- Terrorism Standards

– A Risk

- Based Approach to Chemical Facility Security

To pical 1, Session 21b Monday, March 22, 2010: 10:30 AM Room 101 A/B (Convention Center)

Larry Stanton

, Infrastructure Security Compliance Division, Department of Homeland Security, Washington, DC

In October 2006, Congress granted DHS authority to regulate security at high

- risk chemical facilities. The resulting program, CFATS, (1) prioritizes facilities that possess chemicals of interest to terrorists due to the release, sabotage or diversion hazards they present; (2) identifies the types of security perfo rmance measures that address these risks; and (3) adapts to different types of facilities, ranging from manufacturing plants to universities, hospitals and warehouses across various industries. The risk

based approach drives facilities to consider adoption of a range of risk

- reduction measures, including inherently safer technologies, to achieve compliance with the standards.

IST Trade

- Offs Topical 1, Session 21c Monday, March 22, 2010: 11:00 AM Room 101 A/B (Convention Center)

Jatin Shah

, Baker Engineeri ng and Risk Consultants, Inc., Chicago, IL

Inherently Safer Technologies should be a key consideration in any companies risk management effort. Often we are faced with making a choice between an inherently safer option and one that is more hazardous but p rovides better benefits. With proper safeguards and controls it is possible to manage the risk of the more hazardous option to levels that are comparable or even lower than the inherently safer option. It may cost more and involve a greater amount of overs ight but the benefits may still outweigh

the costs.

This paper presents three examples to illustrate the trade

- offs that one should evaluate in deciding which option is the best for a given situation:

1. Comparison between travel by Automobile and Airplane

2. Co mparison of HF vs. MHF (HF with additive)Transport

3. Comparison of HF Alkylation risk reduction options with Sulfuric Alkylation
While inherently safer technological options should be considered they may not always be the appropriate option to select, since it may require sacrificing desired benefits that an alternative option can provide at comparable or lower risk.

* Adapted from the AIChE Website: http://aiche.confex.com/aiche/s10/webpr ogram/T1.html (accessed July 6, 2010).Final Report: Definition for Inherently Safer Technology in P roduction, Transportation, Storage and Use

F

- 4 Table F

- 4

. Agenda for Inherently Safer Design/Inherently Safer Technologies: Topical 1, Session 28, Part II

Inherently Safer Design/Inherently Safer Technologies (Part II )*

Monday, March 22, 2010: 1:30 PM

Room 101 A/B (Convention Center)

Inherent safety (IS) is the modern term for eliminating hazards rather than accepting and managing them. Engineering is the traditional realization of this concept, as its core function is the application of science, technology, an d mathematics to develop and implement practical solutions that are safe and efficient. Currently there is much interest across industry, academia, advocacy groups and governments in mandating IS to achieve process safety and security goals. There is much debate as to what comprises IS, how and when it is best applied, who/how to judge this creative process, how and whether it differs from traditional engineering, and what role it should have in the chemical industry to achieve process safety and security g oals. This session will present three papers of realistic scenarios and case histories that demonstrate various perspectives and views of IS and its application. A facilitated panel discussion exploring the proper role of IS and audience questions session will follow the presentations.

Sponsor: 25th Center for Chemical Process Safety International Conference (CCPS)

Chair: Eric Freiburger

Email: Eric_Freiburger@Praxair.com

Co

- Chair: Cheryl Grounds

1:30 PM
(28a) Federal View of IST From the CSB Perspective

John Bresland

2:00 PM
(28b) ACC Philosophy On the Appropriate Application of Inherently Safer Principles

Peter N. Lodal and Laurie A. Miller

2:3 PM
(28c) Applying Inherently Safer Systems

– Contra Costa County's Experience Randall Sawyer

3:00 PM

Break

3:30 PM

Panel Discussion

* Adapted from the AIChE Website: http://aiche.confex.com/aiche/s10/webprogram/Session 13520.html (accessed July 6, 2010).Appendix F

F

- 5 Table F

- 5 . Abstracts for Inherently Safer Design/Inherently Safer Technologies:

Topical 1, Session s 28 a

- 28b , Part II

Federal View of IST From the CSB Perspective

Topical 1, Session 28a
Monday, March 22, 2010: 1:30 PM Room 101 A/B (Convention Center)

John Bresland

, United States Chemical Safety Board, Washington, DC

The CSB is an independent federal agency charged with investigating industrial chemical accidents. Headquartered in Washington, DC, the agency's board members are appointed by the President and

confirm ed by the Senate.

The CSB conducts root be cause investigations of chemical accidents at fixed industrial facilities. Root causes are usually deficiencies in safety management systems, but can be any factor that would have prevented the accident if that fac tor had not occurred. Other accident causes often involve equipment failures, human errors, unforeseen chemical reactions or other hazards. The agency does not issue fines or citations, but does make recommendations to plants, regulatory agencies such as t he Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA), industry organizations, and labor groups. Congress designed the CSB to be non

- regulatory and independent of other agencies so that its investigations mig ht, where appropriate, review the effectiveness of regulations and regulatory enforcement.

The CSB's investigations and mission gives it a unique perspective of IST that crosses legislation, regulations, industry, trade groups, unions, and public boundarie s. The CSB Chair will present this perspective.

ACC Philosophy On the Appropriate Application of Inherently Safer Principles
Topical 1, Session 28b
Monday, March 22, 2010: 2:00 PM
Room 101 A/B (Convention Center)

Peter N. Lodal

, Plant Protection Technica l Services, Eastman Chemical Company, Kingsport, TN

Laurie A. Miller

, American Chemistry Council, Arlington, VA

As part of its Responsible Care® Process Safety Code, the American Chemistry Council (ACC) has long supported the concepts of Inherently Safer Chemical Processes. In this paper, the authors will describe the ACC philosophy around the appropriate application of Inherently Safer Principles, including a

discussion on the avoidance of risk

- shifting, and the proper use of economic criteria in the risk decision making process. A number of examples from actual case histories will be included to illustrate the ACC approach.

* Adapted from the AIChE Website: http://aiche.confe x.com/aiche/s10/webprogram/Session 14748.html (accessed July 6, 2010).Final Report: Definition for Inherently Safer Technology in P roduction, Transportation, Storage and Use

F

- 6 Table F

- 6 . Abstracts for Inherently Safer Design/Inherently Safer Technologies: Topical 1, Session s 28 c

- 28d , Part II (cont)

Applying Inherently Safer Systems

– Contra Costa County's Experience Topical 1, Session 28c
Monday, March 22, 2010: 2:30 PM Room 101 A/B (Convention Center)

Randall Sawyer

, Contra Costa Health Services, Martinez, CA

During the 1990's, many process safety accidents occurred in Contra Costa County. Some of the i mpact of these accidents included the following:

• Six people died and two others were seriously injured in three separate accidents • Over 20,000 people sought medical attention after one release and over 1,200 went to a medical clinic that was

establishe d after another accident • Millions of dollars in equipment damage and lost production.

The community and the County's Board of Supervisors were greatly concerned about the accidents and the trend of the accidents. In January 1999, the County's Board of Su pervisors passed the Industrial Safety Ordinance. The ordinance expands on the California Accidental Release Prevention Program and the U. S. EPA's Risk Management Program and includes a requirement that covered facilities consider inherently safer systems

. This paper and presentation will discuss the experience of implementing inherently safer systems in Contra Costa County. This discussion will include the history on why the County's Industrial Safety Ordinance, which includes the requirement for implemen ting inherently safer systems, was passed; a definition of inherently safer systems and when inherently safer systems are to be applied; the initial problems with implementing inherently safer systems by the covered facilities; clarification of what is

mea nt by inherently safer systems and when to consider inherently safer systems; auditing for inherently safer system implementation and results; examples of when inherently safer systems have been successfully applied; and the impact of the implementation of inherently safer systems.

Panel Discussion Topical 1, Session 28 d
Monday, March 22, 2010: 3:30 PM Room 101 A/B (Convention Center)

Abstract: File Not Uploaded

* Adapted from the AIChE Website: http://aiche.confex.com/aiche/s10/webprogram/Session 14748.html (accessed July 6, 2010).Appendix F

F

- 7 

### F

. 3 PARTICIPANTS

The DHS/CSAC/CCPS project participants listed in Table F.2 were present when t he final draft

definition of and discussion on i nherently safer technology (IST) was presented at the Global Congress ( March 22 , 2010)

.

Table F

- 7

. DHS/CSAC/CCPS IST Definition Project Participants at the Global Congress

PARTICIPANTS ORGANIZATION

Kathy Anderson Vertellus

Steve Arendt ABSG Consulting

Iclal Atay NJDEP
Scott Berger CCPS

Dan Crowl Michigan Tech University

Vic Edwards Aker Solutions

George Emmett DHS

- CSAC
George Famini DHS

- CSAC

Brad Fuller AcuTech
Cheryl Grounds BP

Dennis Hendershot CCPS
George King Huntsman

Peter Lodal Eastman

Jack McCavit CCPS Emeritus

Sam Mannan Texas A&M

Shawn Moshiri Chevron

Tim Overton BP
Cathy Pincus ExxonMobil

Robin Pitblado DNV

Randall Sawyer Contra Costa County , CA

Roxy Schneider C CPS

Steve Selk DHS

Jatin Shah Baker Engineering and Risk Consl utants, Inc. Chicago, IL

Larry Stanton Infrastructure Security Compliance Division, DHS, Washington, DC

Kenan Stevick Dow

Karen Tancredit DuPont



### F

. 4 SUMMARY

Inherently Safer Technology

– Final Draft Discussion

Inherently safer technology (IST) is a ph ilosophy

- an approach to safety that focuses on eliminating or reducing the hazards associated with a set of conditions. IST is applicable through the entire life cycle and footprint of any system which manufactures, transports, stores, or uses hazardous materials or hazardous processing conditions. IST permanently and inseparably reduces or eliminates process hazards that must be contained and controlled to avoid incidents, rather than controlling those hazards by added

- on protective equipment. While IST applies throughout the life cycle of a process, plant, or material, theFinal Report: Definition for Inherently Safer Technology in P roduction, Transportation, Storage and Use

F

- 8 greatest opportunities for significant IST benefits are early in the life cycle, before the technology becomes deeply integrated into the technology infrastructure of an industry from raw material suppliers through final product users, and before major investments in plant and equipment are made.

A material, process, or technology can only be described as ―inherently safer‖ when compared to a different material, process, or technology. This description must include the definition of the particular hazard or set of hazards which were considered in making the comparison. Thus, it is not appropriate to describe a technology as inherently safer than an alternate technology, with no further d escription. An appropriate description would be, for example, that the first technology is inherently safer than the alternate technology with respect to the hazard of acute toxicity of the vapor, and the hazard of flammability of the vapor. Note that this statement makes no judgment about the relative inherent safety characteristics of other possible hazards

– the first technology may be inherently less safe than the alternate technology with respect to other hazards such as chemical reactivity, chronic to xicity, or potential for hazardous decomposition.

IST options can be location and release scenario dependent, and different potentially exposed populations may not agree on the relative inherently safety characteristics of the same set of options. For exam ple, two options for handling a toxic gas might be receiving the material in 1

- ton cylinders or 10

- ton truck loads. To a population several miles from the site, the 1 ton cylinders would be inherently safer because the maximum potential release size is sma ller and less likely to expose them to a hazardous concentration of the gas. But, operators who would now have to connect and disconnect 10 cylinders for every 10 tons of material used, instead of a single truck, would consider the truck shipments to be in herently safer. Thus, evaluation of IST options can be quite complex, and dependent on the local environment. There is currently no consensus on a quantification method for IST, and there is no scientific assessment for evaluation of IST options.

Inherent ly safer design is a part of an iterative decision

- making process for risk reduction. It is ongoing and continuous throughout the life cycle of a technology, from initial conception through commercialization, operation, and, when obsolete, shutdown and dem olition. It should consider the entire footprint of the process

– raw material sources and supply, impact on supply technologies, transportation, and impact on downstream users and their technologies, and ultimate material disposition. Evaluation of IST op tions for a particular plant, product, or other system must consider the overall effects of all other impacted systems

– it is essential to understand the impact that a change in one technology will have on hazards and risks elsewhere in society. In partic ular, it is important to identify all such impacts and to make informed decisions on the best overall way to manage risk throughout society.

Risk reduction criteria will be determined by the nature of the hazards or threats, and will require

consideration of conflicts among multiple hazards and threats. Tools for understanding societal expectations for risk management include national and local government regulations and other legal requirements, consensus codes and standards developed by various technical and trade associations, and internal corporate standards and requirements. The threshold of a major accident hazard of a major release, as well as security or vulnerability concerns such as theft of materials, contamination of products, and degradation of infrastructure must be considered. Hazard identification, risk assessment, and security vulnerability analysis tools are used to identify and characterize risk. Risk can be reduced by many methods, including inherently safer design, but methods must includ e the full spectrum of risk reduction approaches (passive, active, and procedural risk management systems). This is particularly true when considering the need to manage multiple hazards and risks

– it is unlikely that any technology will be ―inherently sa fer‖ with respect to all hazards, and other approaches will always be required to manage the full range of hazards and risks. Ultimately we must decide which hazards and risks we want to manage primarily with inherently safer design approaches, and which h azards and risks will be managed with other approaches (active, passive, procedural).Appendix F

F

- 9 The inseparability of IST from the overall objective of the safe design and operation of hazardous material manufacturing, transportation, storage, and use is apparent wh en considering chemical security. An IST with respect to catastrophic release hazard from a fixed manufacturing plant may conflict with, or may not address other hazards, such as theft or diversion of materials, contamination of product, or degradation of infrastructure, or may create new security hazards.

The CCPS book Inherently Safer Chemical Processes: A Life Cycle Approach describes several levels of inherently safer design. 3

― First Order inherently safer design refers to the identification of alternat ives that completely eliminate a particular hazard. Note that, as discussed above, this does not say anything about the impact on other hazards, which may be increased, decreased, or remain unaffected by the change. An example would be using a water based paint to paint a room in your house instead of flammable solvent based paint, eliminating the hazard of exposure to low levels of potentially toxic solvents, and fire hazards associated

with flammable solvent.

Second Order inherently safer design reduces t he magnitude of a hazard, or makes an accident associated with a hazard less likely to occur, by the design of the equipment, and not through add

- on safety devices. Again, this does not say anything about the impact of the change on other hazards, which ma y be increased, decreased, or remain unaffected. As an example of reducing the magnitude of a hazard, explosives such as TNT can be made in small continuous reactors containing a few gallons of material rather than large batch reactors containing thousands of gallons of material. As an example of inherently making a hazard less likely to result in an accident, if adding too much raw material to a vessel can cause a runaway reaction, this can be made inherently less likely by installing a feed tank that hold s the exact amount of raw material required,

and no more.

Layers of Protection include risk management equipment and management systems often categorized as Passive, Active, and Procedural. These layers include risk management features such as containment dikes to manage spills and leaks (passive), safety alarms and shutdown systems (active), and safety procedures and operator actions (procedural). When you consider all of the multiple hazards associated with any technology, it is unlikely that it will ever be possible to manage all of them inherently, and layers of protection will always be required as a part of the total risk management program. Inherently safer design concepts can be used to make these layers of protection inherently more reliable and rob ust.‖

Decisions on the appropriate overall risk management strategy will be a function of, and will consider potential conflicts and tradeoffs with:

Hazards

Likelihood of failure

Consequences to all potentially exposed populations

Other important risk cons iderations such as environmental impact

Impact on risk in other locations or sectors of the overall economy

3 Center for Chemical Process Safety (CCPS). Inherently Safer Processes: A Life Cycle Approach. 2 nd Edition, American Institute of Chemical Engineers/ John Wiley & Sons, Inc., Hoboken, NJ, 2009, pp. 15

- 16.Final Report: Definition for Inherently Safer Technology in P roduction, Transportation, Storage and Use

F

- 10 Process and product supply chain and life cycle, including distribution considerations and

final user considerations

Technical feasibility

– may be location specific

Economic viability

– may be location specific

Regulatory requirements

– may be location specific

.



### FINAL DRAFT DEFINTION FOR INHERENTLY SAFER TEC HNOLOGY

Inherently Safer Technology (IST), also known as Inherently Safer D esign (ISD), perm anently eliminates or reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to t he design and operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an iterative process that cons iders such options, including eliminating a hazard, reducin g a hazard, substituting a less hazardous material, using less hazardous process conditions, and designing a process to reduce the potential for, or consequences of, human error, equipment failure, or intentional harm. Overall safe design and operation options cover a spectrum from inherent through passive, active and pr ocedural

risk management strategies. There is no clear boundary between IST and other strategies.

ISTs are relative : A technology can only be described as inherently safer when compared to a different technology , including a description of the hazard or set of hazards being considered, their location, and the potentially affected population. A technology may be inherently safer than another with respect to some hazards but inherently less safe with respect to others, and may not be safe enough to meet societal expectations.

ISTs are based on an informed decision process : Because an option may be inherently safer with regard to some h azards and inherently less safe with regard to others, decisions about the optimum strategy for managing risks from all hazards are required . The decision proces s must
consider the entire life cycle, the full spectrum of hazards and risks, and the potentia l for transfer of risk from one impacted population to another. Technical and economic feasibility of options

must also be considered.Appendix G

G

- 1 

### APPENDIX G: NOMENCLATURE

Table G

- 1

. ABBREVIATIONS AND ACRONYMS

ABBREVIATION /
ACRONYM DEFINITION

AIChE American Instit ute of Chemical Engineers

CCPS Center for Chemical Process Safety, formed by AIChE in March 25, 1985 to develop process safety information, including guidelines and resources.

CSAC Chemical Security Analysis Center

DHS U.S. Department of Homeland Secur ity

DHS/CSAC/CCPS U.S. Department of Homeland Security/ Chemical Security Analysis Center/ Center for Chemical Process Safety

EPA U.S. Environmental Protection Agency

EPA RMP U.S. Environmental Protection Agency Risk Management Program

ISD Inherent ly safer design

IST Inherently safer technology

IST/ISD Inherently safer technology/inherently safer design

ISS Inherently safer systems or inherently safer design strategies

OSHA PSM Occupational Safety & Health Administration Process Safety Manag ement

SD safer design

U.S. United StatesFinal Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.Appendix H

H

- 1 

### APPENDIX H : ABOUT CCPS

Just after midnight on December 3, 1984, water contamination of a tank of methyl isocyanate in Bhopal,

India initiated a series of events that led to a catastrophic toxic release, killing more than 3000 residents and injuring over 100,000.

In February 1985, leaders from 17 of the leading chemical and petroleum companies asked the American Institute of Chemical Engineers (AIChE) to lead a collaborati ve global effort to eliminate catastrophic

process incidents by:

ADVANCING state

- of

- the

- art process safety technology and management practices

, SERVING as a premier resource for information on process safety

, FOSTERING process safety in engineering and sci ence education , and

PROMOTING process safety as a key industry value

.

On March 25, 1985, AIChE formed the Center for Chemical Process Safety (CCPS) with charter member companies. In the years that followed, CCPS has been the world leader in every area of p rocess safety information, with over 60 guideline and resource books in print, and an ever

- growing web knowledge base. CCPS membership now exceeds 100 companies, headquartered in more than 15 companies in four continents and operating in every part of the world.

To contact or to learn more about the CCPS the following information has been provided:

View the CCPS book catalog : www.wiley.com/go/ccps

Learn about CCPS membership : www.aiche.org/CCPS/Corporate/index.aspx

Browse the CCPS Web Knowledge Base : www.aiche.org/CCPS/Resources/KnowledgeBase/overview.aspx

Attend CCPS even ts : www.aiche.org/CCPS/Conferences/index.aspx

Contact CCPS : ccps@aiche.org or +1.646.495.1372

.