Final Report: 

Definition for Inherently Safer Technology in

Production, Transportation, Storage, and Use

Final Report: 

Definition for Inherently Safer Technology in

Production, Transportation, Storage, and Use

Prepared by:

Center for Chemical Process Safety 

The American Institute of Chemical Engineers

For

Chemical Security Analysis Center

Science & Technology Directorate

U.S. Department of Homeland Security

July 2010
Final Report: Definitions for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.
Final Report: 

Definition for Inherently Safer Technology in

Production, Transportation, Storage, and Use 

Prepared by:

Center for Chemical Process Safety 

The American Institute of Chemical Engineers

New York, New York 10016-5991

for

Chemical Security Analysis Center

Science & Technology Directorate

U.S. Department of Homeland Security

Aberdeen Proving Ground, MD 21010-5424

July 2010
Final Report: Definitions for Inherently Safer Technology in Production, Transportation, Storage and Use

Disclaimer

―This report is a work prepared by the Center for Chemical Process Safety of the American Institute of 

Chemical Engineers for the U.S. Department of Homeland Security (DHS) Chemical Security Analysis 

Center (CSAC) for the United States (U.S.) Government. This report does not reflect the opinion of the 

U.S. Government, the DHS, or the CSAC. In no event shall either the U. S. Government, DHS,

or CSAC have any responsibility or liability for any consequences of any use, misuse, inability to use, or 

reliance upon the information contained herein, nor does either warrant or otherwise represent in any way 

the accuracy, adequacy, efficacy, or applicability of the contents hereof.‖

―It is sincerely hoped that the information presented in this document will lead to an even more 

impressive safety record for the entire industry; however, neither the American Institute of Chemical 

Engineers, its consultants, CCPS Technical Steering Committee and Subcommittee members, their 

employers, their employers’ officers and directors, warrant or represent, expressly or by implication, the 

correctness or accuracy of the content of the information presented in this document. As between (1) 

American Institute of Chemical Engineers, its consultants, CCPS Technical Steering Committee and 

Subcommittee members, their employers, and their employers’ officers and directors, and (2) the user of 

this document, the user accepts any legal liability or responsibility whatsoever for the consequence of its

use or misuse.‖
REPORT DOCUMENTATION PAGE

Form Approved

OMB No. 0704-0188

Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for 

reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and 

reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of 

information, including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information

Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of 

Management and Budget, Paperwork Reduction Project (0704-0188), Washington, DC 20503

1. AGENCY USE ONLY (Leave blank) 2. REPORT DATE

07/19/1010

3. REPORT TYPE AND DATES COVERED

Technical 02/11/2010 – 07/19/2010

4. TITLE AND SUBTITLE

Final Report: Definition for Inherently Safer Technology in Productions, 

Transportation, Storage, and Use

5. FUNDING CONTRACT NUMBER

NBCH-D-08-0002

6. AUTHOR(S)

Center for Chemical Process Safety 

The American Institute of Chemical Engineers

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)

Center for Chemical Process Safety 

of the American Institute of Chemical Engineers

3 Park Avenue

New York, New York, 10016-5991

8. PERFORMING ORGANIZATION 

REPORT NUMBER

N/A

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)

Department of Homeland Security, Science & Technology

Chemical Security Analysis Center

5183 Blackhawk Road E3401

Aberdeen Proving Ground, MD 21010-5424

10. SPONSORING/MONITORING 

AGENCY REPORT NUMBER

N/A

11. SUPPLEMENTARY NOTES

None

12A. DISTRIBUTION/AVAILABILITY STATEMENT

Statement C: Distribution authorized to U.S. Government agencies and their contractors; 

administrative or operational use; July 31, 2008. Other requests for this document shall be 

referred to Director, Chemical Security Analysis Center, 5183 Blackhawk Road, Aberdeen 

Proving Ground, MD 21010–5424.

12B. DISTRIBUTION CODE

13. ABSTRACT (Maximum 200 words)

At the request of the United States (U.S.) Department of Homeland Security (DHS) Chemical Security Analysis Center 

(CSAC), the Center for Chemical Process Safety (CCPS), a directorate of the American Institute of Chemical Engineers 

(AIChE), has completed a project to provide a technically based definition of inherently safer technology (IST). CSAC 

requested that an independent technical organization review the literature and common practice related to design of inherently 

safer processes, and lead a process to develop a technically-based definition of IST. CCPS reviewed available literature and 

convened a series of workshops of process safety experts to develop a definition of IST. Along with the definition is included 

brief discussion of the concepts contained in the definition. As the definition is intended to be concise, CCPS believes that it is 

important to read the discussion (Appendix B) in conjunction with the definition because this additional information is critical 

for a full understanding of the IST.

14. KEY WORDS: American Institute of Chemical Engineers (AIChE); Center for 

Chemical Process Safety (CCPS); elimination of hazards; Global Congress on Process 

Safety; Kletz; hazardous materials; inherently safer design (ISD); inherently safer 

technology/inherently safer design (IST/ISD); management of security risks; Occupational 

Safety & Health Administration (OSHA); Occupational Safety & Health Administration 

Process Safety Management (OSHA/PSM); safer design (SD); U.S. Environmental 

Protection Agency (EPA); U.S. Environmental Protection Agency Risk Management 

Program (EPA/RMP). 

15. NUMBER OF PAGES

54

16. PRICE CODE

17. SECURITY 

CLASSIFICATION OF REPORT

NONE

18. SECURITY 

CLASSIFICATION OF THIS 

PAGE

NONE

19. SECURITY 

CLASSIFICATION OF 

ABSTRACT

NONE

20. LIMITATION OF ABSTRACT

NONE

NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89)

 Prescribed by ANSI Std. 239-18

 298-102
Final Report: Definitions for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.
Table of Contents 

 

i

TABLE OF CONTENTS

Page

EXECUTIVE SUMMARY ...................................................................................................................EXEC-1

1.0 INTRODUCTION..............................................................................................................................1

1.1 Purpose............................................................................................................................... 1

1.2 Relevant Past Efforts .......................................................................................................... 1

1.3 Relevance of the Project..................................................................................................... 2

2.0 PROJECT PROCEDURE ................................................................................................................3

2.1 Process ............................................................................................................................... 3

2.2 Project Steps and Timeline ................................................................................................. 3

2.2.1 Initial Definition Workshop – February 3, 2010......................................................3

2.2.2 Second Definition Workshop – IST Draft Definition and Discussion –

February 25, 2010..................................................................................................4

2.2.3 Third Definition Workshop – Final IST Draft and Discussion Presented at the 

Global Congress on Process Safety – March 22, 2010.........................................4

2.3 Project Deliverable ..................................................................................................................... 5

3.0 KEY FINDINGS................................................................................................................................5

3.1 Final Definition .................................................................................................................... 5

3.2 Major Issues........................................................................................................................ 6

3.3 Utility of the Definition ......................................................................................................... 7

3.4 Limitations and Possible Future Work ................................................................................ 7

4.0 REFERENCES.................................................................................................................................7

APPENDIX A: FINAL DEFINITION FOR INHERENTLY SAFER TECHNOLOGY/INHERENTLY 

SAFER DESIGN .......................................................................................................................... A-1

APPENDIX B: FINAL DISCUSSION ON DRAFT DEFINITION OF INHERENTLY SAFER 

TECHNOLOGY............................................................................................................................ B-1

APPENDIX C: CCPS PROJECT PROPOSAL SUBMITTED OCTOBER 13, 2009................................. C-1

C.1 SUMMARY OF NEED..................................................................................................... C-1

C.2 PROPOSED APPROACH .............................................................................................. C-1

C.3 PERSONNEL .................................................................................................................. C-3

C.4 TIMING AND COST........................................................................................................ C-4

C.5 STATEMENT OF WORK................................................................................................ C-4

APPENDIX D: INITIAL DEFINITION WORKSHOP – FEBRUARY 3, 2010 ............................................ D-1

D.1 WORKSHOP AGENDA .................................................................................................. D-1

D.2 PARTICIPANTS.............................................................................................................. D-2

D.3 SUMMARY...................................................................................................................... D-2

APPENDIX E: SECOND DEFINITION WORKSHOP – IST DRAFT AND DISCUSSION –

FEBRUARY 25, 2010................................................................................................................... E-1

E.1 AGENDA......................................................................................................................... E-1
Final Report: Definitions for Inherently Safer Technology in Production, Transportation, Storage and Use

ii

E.2 PARTICIPANTS.............................................................................................................. E-2

E.3 SUMMARY...................................................................................................................... E-3

APPENDIX F: THIRD DEFINITION WORKSHOP – FINAL IST DRAFT DEFINITION AND 

DISCUSSION PRESENTED AT THE GLOBAL CONGRESS ON PROCESS SAFETY –

MARCH 22, 2010 ..........................................................................................................................F-1

F.1 AGENDA..........................................................................................................................F-1

F.2 CONFERENCE SESSIONS ............................................................................................F-2

F.3 PARTICIPANTS...............................................................................................................F-7

F.4 SUMMARY.......................................................................................................................F-7

APPENDIX G: NOMENCLATURE...........................................................................................................G-1

APPENDIX H: ABOUT CCPS.................................................................................................................. H-1

LIST OF TABLES

Page

Table C-1. Proposed Scoping Committee Participants ............................................................................ C-2

Table C-2. Proposed Schedule and Funding............................................................................................ C-4

Table D-1. Agenda .................................................................................................................................... D-1

Table D-2. Workshop Participants ............................................................................................................ D-2

Table E-1. Agenda .....................................................................................................................................E-1

Table E-2. Workshop Participants .............................................................................................................E-2

Table F-1. Agenda for Global Congress on Process Safety: Topical 1 Sessions .....................................F-1

Table F-2. Agenda for Inherently Safer Design/Inherently Safer Technologies: Topical 1, 

Session 21, Part I.....................................................................................................................F-2

Table F-3. Abstracts for Inherently Safer Design/Inherently Safer Technologies: Topical 1, 

Sessions 21a-21c, Part I* ........................................................................................................F-3

Table F-4. Agenda for Inherently Safer Design/Inherently Safer Technologies: Topical 1, 

Session 28, Part II....................................................................................................................F-4

Table F-5. Abstracts for Inherently Safer Design/Inherently Safer Technologies: Topical 1, 

Sessions 28a-28b, Part II ........................................................................................................F-5

Table F-6. Abstracts for Inherently Safer Design/Inherently Safer Technologies: Topical 1, 

Sessions 28c-28d, Part II (cont) ..............................................................................................F-6

Table F-7. DHS/CSAC/CCPS IST Definition Project Participants at the Global Congress .......................F-7

Table G-1. ABBREVIATIONS AND ACRONYMS .................................................................................... G-1
Executive Summary

EXEC-1

Final Report: Definition for Inherently Safer Technology in 

Production, Transportation, Storage and Use

EXECUTIVE SUMMARY

At the request of the Chemical Security Analysis Center (CSAC), Science and Technology Directorate, 

U.S. Department of Homeland Security (DHS), the Center for Chemical Process Safety (CCPS), a 

directorate of the American Institute of Chemical Engineers (AIChE), has completed a project to provide 

a technically based definition of inherently safer technology (IST). CSAC requested that an independent 

technical organization review the literature and common practice related to design of Inherently Safer 

Processes, and lead a process to develop a technically-based definition of IST. CCPS reviewed available 

literature and convened a series of workshops of process safety experts to develop a definition of IST. 

Along with the definition is included brief discussion of the concepts contained in the definition. The 

definition follows, is repeated in Appendix A while Appendix B provides additional discussion. As the 

definition is intended to be concise, CCPS believes it is important to include the discussion in conjunction 

with the definition for clarification and insight to help chemical engineers and others to develop a full 

understanding of the concept of inherently safer technology.

INHERENTLY SAFER TECHNOLOGY DEFINITION

Inherently Safer Technology (IST), also known as Inherently Safer Design (ISD), permanently eliminates 

or reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to the 

design and operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an 

iterative process that considers such options, including eliminating a hazard, reducing a hazard, 

substituting a less hazardous material, using less hazardous process conditions, and designing a process to 

reduce the potential for, or consequences of, human error, equipment failure, or intentional harm. Overall 

safe design and operation options cover a spectrum from inherent through passive, active and procedural 

risk management strategies. There is no clear boundary between IST and other strategies. 

ISTs are relative: A technology can only be described as inherently safer when compared to a 

different technology, including a description of the hazard or set of hazards being considered, 

their location, and the potentially affected population. A technology may be inherently safer than 

another with respect to some hazards but inherently less safe with respect to others, and may not 

be safe enough to meet societal expectations.

ISTs are based on an informed decision process: Because an option may be inherently safer 

with regard to some hazards and inherently less safe with regard to others, decisions about the 

optimum strategy for managing risks from all hazards are required. The decision process must 

consider the entire life cycle, the full spectrum of hazards and risks, and the potential for transfer 

of risk from one impacted population to another. Technical and economic feasibility of options 

must also be considered.
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.
1.0 Introduction

1 

Final Report: Definition for Inherently Safer Technology 

in Production, Transportation, Storage and Use

1.0 INTRODUCTION

At the request of the Chemical Security Analysis Center (CSAC), Science and Technology Directorate, 

U.S. Department of Homeland Security (DHS), the Center for Chemical Process Safety (CCPS),a 

directorate of the American Institute of Chemical Engineers (AIChE), has completed a project to provide 

a technically-based definition of inherently safer technology (IST), also known as inherently safer design 

(ISD) but hereafter referred to as IST. CSAC requested that an independent technical organization review 

the literature and common practice related to design Inherently Safer Processes, and lead a process to 

develop a technically-based definition of inherently safer technology (IST). CSAC requested that the 

definition consider the full life cycle of the chemical enterprise, including use and manufacturing, storage, 

and transportation. CSAC requested a definition that is broad enough to encompass the full supply chain 

and recognize the possibility that improvement in safety in one dimension of process or supply chain may 

lead to degradation of safety in another dimension. 

1.1 Purpose

The purpose of this project is to develop a definition of ―inherently safer technology‖ (IST) which meets 

the following criteria:

Integrated – considers the full life cycle and all security considerations of the process

or product;

Applicable to a broad definition of ―technology‖;

Consider the full range of hazards of concern associated with a process or product; and

Be useful in a risk/economic/benefit context.

The IST definition is not:

A specific technical solution;

Offered in the context of any single specific hazard; nor is it

A decision on appropriate technology, however it should facilitate processes for making 

technical decisions.

1.2 Relevant Past Efforts

The concept of IST is not really new, and it is not limited to the process industries. Technologists have 

always recognized the value of eliminating or reducing hazards associated with any activity. Applying 

IST without calling it by that name, they simply considered it to be good design. In reaction to a major 

explosion in Flixborough, England (June 1974), Trevor Kletz questioned the need for such large 

quantities of flammable or toxic materials in a manufacturing plant, as well as the need for processing at 

elevated temperature and pressure. Kletz suggested that the process industries should re-direct efforts 

toward elimination of hazards where feasible by 1) reducing the quantity of hazardous material; 2) using 

less hazardous materials; and 3) developing technology that operates at less severe conditions rather than 

devoting extensive resources for safety systems and procedures to manage risks. Kletz first advanced this 

proposal at the annual Jubilee Lecture of the Society of the Chemical Industry. His proposal was 

subsequently published as a journal article entitled ―What you don’t have, can’t leak.‖ 1
Final Report: Definition of Inherently Safer Technology in Production, Transportation, Storage and Use

2

Since 1974, the concept of IST has been further developed. Some specific references used in this project 

include the following:

CCPS book Inherently Safer Chemical Processes: A Life Cycle Approach (1st Edition, 1996 2, 

and 2nd Edition, 2009 3): IST is a concept, an approach to safety that focuses on eliminating or 

reducing the hazards associated with a set of conditions.

Contra Costa County, California Industrial Safety Ordinance: Inherently safer systems (ISS) 

means Inherently safer design strategies as discussed in the 1996 Center for Chemical Process 

Safety Publication ―Inherently Safer Chemical Processes‖ and means feasible alternative 

equipment, processes, materials, layouts, and procedures meant to eliminate, minimize, or reduce 

the risk of a major chemical accident or release by modifying a process rather than adding 

external layers of protection (discussed in Inherently Safer Chemical Processes: A Life Cycle 

Approach, 2nd Edition, 2009, Section10.2.1, pp. 229-235).

http://cchealth.org/groups/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed July 

15, 2010).

4

Johnson, Robert: ―Inherently safer designs permanently and inseparably reduce or eliminate 

process hazards that must be contained and controlled to avoid accidents.‖ (unpublished 

presentation)5

Kletz, Trevor: Process Plants: A Handbook for Inherently Safer Design. Bristol, PA, Taylor and 

Francis, 1998.5: The essence of the inherently safer approach to plant design is the avoidance of 

hazards rather than their control by adding protective equipment.

6

Kletz, Trevor: ―An [inherently safer] IS design is one that avoids hazards instead of controlling 

them, particularly by reducing the amount of hazardous material or the number of hazardous 

operations.‖ (personal communication in February 2010.)7

1.3 Relevance of the Project

For a number of years, IST has received increasing attention as an important component of process safety 

management systems, and has also been considered a potentially valuable tool in managing security risks 

for hazardous material handling operations of all types. IST has been incorporated into process safety 

management regulations in the state of New Jersey and in Contra Costa County, California. 3 Both the 

Occupational Safety & Health Administration Process Safety Management (OSHA PSM) regulation and 

the U.S. Environmental Protection Agency Risk Management Program (EPA RMP) regulation encourage 

inherently safer processes implicitly by setting a threshold for regulatory applicability in terms of 

chemical inventory.

For a number of years, going back to the early 1990s with an EPA proposal to include technical options 

analysis as a part of the risk management program under the Clean Air Act, there have been proposals in 

the U.S. Congress to incorporate IST concepts, sometimes specifically and sometimes using other names 

or descriptions, into both process safety management and chemical-processing facility security 

regulations. To date these proposals have not been adopted into regulations, but they continue to be 

considered in the current session of U.S. Congress. One obstacle to incorporating IST into regulations, 

either for process safety or for chemical facility security, is the lack of a consensus in defining exactly 

what ―IST‖ means. 

When previously published definitions are compared, they are found to incorporate similar elements. . 

What is lacking is a definition that unifies the concepts of IST with the fact that any multi-dimensional 

process includes many facets that are connected and interrelated. Any single chemical process or product 

may be considered to be a part of a complex ecology with interactions throughout the rest of industry and 

the global economy. A change to a single aspect of this interconnected system to accomplish a single 
2.0 Project Procedure

3 

objective, even one which appears to be highly desirable, may have unanticipated consequences which 

may be undesirable. Implementation of IST will necessarily require a full evaluation of the entire process 

and everything related to it.

A primary area of concern to DHS is the potential for intentional release of toxic chemicals caused by a 

domestic terrorist attack. The very nature of these chemicals poses numerous safety and security issues 

along the entire supply chain. It has been postulated that application of IST principles may provide an 

improvement in the overall security of the U.S. chemical industry and the risk it poses. This is a matter of 

debate and while parties on both sides of the issue believe that IST can play a role, there is no agreement 

on the level of improvement in security that can be accrued. There are specific examples of IST 

applications in the literature but no systematic IST methodology for guiding its evaluation or 

implementation.

2.0 PROJECT PROCEDURE

2.1 Process

While IST was originally conceived as an engineering design philosophy, in recent years the term IST has 

become politically charged. The CCPS project was intended to bring IST back into the technical realm by 

assembling a committee of highly respected experts to evaluate the many IST concepts being discussed in 

the technical and political arenas. The goal is to bring together the many concepts being discussed into a 

consensus definition. 

The CCPS project committee focused on classifying and organizing IST concepts into a draft definition, 

without initially passing value judgments on any of the components. This initial draft definition was 

developed at the first of two workshops where concepts of IST as well as all previously published 

definitions were presented and discussed by the participants. The definition that came out of this initial 

workshop was used as the basis for a second workshop with an even broader participation, where it was 

further modified based upon input from the participants. This third draft definition was presented at the 

Global Congress on Process Safety in San Antonio, Texas (March 22, 2010) for comment by any 

attendees. Feedback from that presentation was incorporated into the final definition reported here (see 

Appendix F).

2.2 Project Steps and Timeline

2.2.1 Initial Definition Workshop – February 3, 2010

The CCPS project team initially met with DHS CSAC personnel at an all-day workshop held in 

Linthicum, Maryland on February 3, 2010. Appendix D lists the agenda, the participants, and a summary 

of the key concepts from the workshop.

Team members reviewed the project proposal and DHS outlined its requirements for the project. The

team then held an open discussion to review key concepts from the resources and publications available to 

team members, and concepts derived from their own personal experience with process safety management 

in general and consideration of IST options in particular. From this discussion, several initial key 

concepts were developed for consideration and further elaboration into the definition.

Some important issues related to the form of the definition arose during this discussion. The group 

determined that the ―definition‖ should be concise while retaining the essential features required for 

understanding the IST concepts. The definition should also avoid the use of examples for purposes of 

defining IST. To better explain the concepts, the definition would be accompanied by a more extensive, 
Final Report: Definition of Inherently Safer Technology in Production, Transportation, Storage and Use

4

discussion section (Appendix B) which could elaborate on the concepts included in the definition, and 

which would incorporate illustrative examples where appropriate.

Based on comments and discussions during the workshop, a draft definition was developed, and later 

circulated through the CCPS project team and DHS representatives. After several iterations, the CCPS 

staff developed a modified draft definition for discussion at a teleconference of the CCPS project team on 

February 18, 2010. Following the teleconference, additional clarifications were made to the draft 

definition and it was modified further by CCPS staff. The draft (Appendix E) was used as the basis for 

discussion at a workshop in Houston, Texas, on February 25, 2010. This workshop provided additional 

opportunities for expert feedback and input from a broader range of process safety experts.

2.2.2 Second Definition Workshop – IST Draft Definition and Discussion –

February 25, 2010 

Attendance at the Houston, Texas workshop was open to individuals who could demonstrate they have 

practiced inherently safer process and system design, regardless of industry or whether practiced as an 

engineer, chemist, operator, manager, or other position. The workshop was announced on the CCPS web 

site, and by an email to the CCPS Technical Steering Committee. Other individuals whom the CCPS 

determined were potentially important contributors to the project were specifically invited by CCPS. The 

draft definition was also sent to Trevor Kletz, who was unable to attend but later submitted comments via 

email.

Attendees were given a copy of the draft definition to review the day before the workshop. During the 

workshop, extensive interactive discussion occurred. Attendees were invited to submit comments, suggest 

concepts that might be missing, or those that might be consolidated or eliminated to keep the definition 

short, and also to identify the strengths and weaknesses of the candidate definition. Paper feedback forms 

were collected for review by CCPS. Attendees were not asked to agree on the definition, but rather to 

provide their perspective on what was missing, superfluous, or at variance with their own concept of IST. 

All comments were collected and compiled in a spreadsheet after the workshop, and used as a basis for 

revising the definition.

Participants provided over 150 written comments as summarized in Appendix E, ranging from very 

detailed and specific editorial comments on wording parts of the definition, to significant suggestions to 

revise the organization and content of the definition. In some cases, specific wording was suggested for 

parts of the definition. CCPS Staff carefully considered this feedback in revising the definition. It was not 

possible to incorporate all feedback for many reasons—some suggestions were in conflict with each 

other, while others were deemed inappropriate because they were too detailed for a high level, short 

definition. However, all comments were evaluated and considered. As a result of the workshop, CCPS 

was able to significantly shorten the definition and combine a number of concepts from the initial draft to 

make the definition simpler, while retaining the essential components of a good IST definition.

The CCPS project team reviewed the modified definition at a teleconference on March 15, resulting in 

additional simplification and clarification. The result was a final draft definition presented to the process 

safety community at the Global Congress on Process Safety, in San Antonio, Texas on March 22, 2010 

(Appendix F).

2.2.3 Third Definition Workshop – Final IST Draft and Discussion Presented at the

Global Congress on Process Safety – March 22, 2010 

CCPS presented the final draft definition on the first day of the Global Congress, held in San Antonio,

Texas, at two IST technical sessions that were open to all meeting registrants (Appendix F). Written 

copies of this final draft definition were made available to attendees along with comment and feedback 
3.0 Key Findings

5 

forms. These sessions concluded with an IST panel discussion lead by session speakers and other people 

involved in the IST definition project. CCPS received limited feedback from this comment opportunity 

(primarily minor wording and punctuation changes), which indicates that attendees at these Global 

Congress IST sessions consider the draft definition fundamentally sound and accurate.

The final draft definition was sent to Dr. Trevor Kletz, who endorsed the draft definition in the following 

response:

―The final version of the definition is far better than I expected. I feared it would end up like 

many (most?) company mission statements and safety policies, which are written in semi-legal 

language. As a result, few people read them and they have little or no effect. I think those 

members of the Senate that have been pressing for compulsory adoption of [inherently safer] IS 

designs may now have a better understanding of the strengths and limitations of the technique. If 

so, [then it] is a great achievement... .‖ (personal communication March 16 2010)

2.3 Project Deliverable

The product deliverables are the definition of IST, a discussion of the definition (Appendix B), and this 

final report. 

3.0 KEY FINDINGS

3.1 Final Definition

The project produced a short, scientific definition of IST, as follows:

INHERENTLY SAFER TECHNOLOGY DEFINITION

Inherently Safer Technology (IST), also known as Inherently Safer Design (ISD), permanently eliminates 

or reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to the 

design and operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an 

iterative process that considers such options, including eliminating a hazard, reducing a hazard, 

substituting a less hazardous material, using less hazardous process conditions, and designing a process to 

reduce the potential for, or consequences of, human error, equipment failure, or intentional harm. Overall 

safe design and operation options cover a spectrum from inherent through passive, active and procedural 

risk management strategies. There is no clear boundary between IST and other strategies. 

ISTs are relative: A technology can only be described as inherently safer when compared to a 

different technology, including a description of the hazard or set of hazards being considered, 

their location, and the potentially affected population. A technology may be inherently safer than 

another with respect to some hazards but inherently less safe with respect to others, and may not 

be safe enough to meet societal expectations.

ISTs are based on an informed decision process: Because an option may be inherently safer 

with regard to some hazards and inherently less safe with regard to others, decisions about the 

optimum strategy for managing risks from all hazards are required. The decision process must 

consider the entire life cycle, the full spectrum of hazards and risks, and the potential for transfer 

of risk from one impacted population to another. Technical and economic feasibility of options 

must also be considered.
Final Report: Definition of Inherently Safer Technology in Production, Transportation, Storage and Use

6

3.2 Major Issues

Because the IST definition is intended to be short, it necessarily leaves out many clarifications and 

discussions which are important to a full understanding of IST. The CCPS project team, and participants 

in the various workshops, believed that additional clarification and discussion of the definition was 

appropriate. This discussion is found in Appendix B. It is essential to read this discussion to fully 

understand and appreciate the role IST might play as a tool for improved security and safety across the 

entire hazardous material supply chain. The discussion incorporates most of the key points discussed in 

the IST definition workshops. Principally:

IST is a philosophy focusing on eliminating or reducing hazards.

IST is applicable through the entire life cycle and footprint of any system that manufactures, 

transports, stores, or uses hazardous materials or hazardous processing conditions. 

While IST applies throughout the life cycle, the greatest opportunities to implement IST 

significantly arise early in the cycle.

A material, process, or technology can only be described as ―inherently safer‖ when compared to 

a different material, process, or technology; and, the hazard or set of hazards which were 

considered must be specified.

IST options can be dependent on location and release scenarios.

There is currently no consensus on either a quantification method for IST or a scientific 

assessment method for evaluation of IST options.

IST is a part of an iterative decision-making process for risk reduction and choice, ongoing 

through the technology life cycle of a technology.

It is unlikely that any technology will be ―inherently safer‖ with respect to all hazards, and other 

approaches will always be required to manage the full range of hazards and risks.

IST can be categorized as: 

o First Order – Completely eliminates a particular hazard. Note that this does not say 

anything about the impact on other hazards, which may be increased, decreased, or 

remain unaffected by the change.

o Second Order – Reduces the magnitude of a hazard, or makes a potential accident 

associated with a hazard less likely to occur, or less severe, by means of equipment and 

process design but not through add-on safety devices.

o Layers of Protection – When all of the multiple hazards associated with any 

technology are considered, layers of protection will always be required as a part of the 

total risk management program. These layers may be made more reliable and robust 

through the application of principles of inherent safety.

Decisions on overall risk management strategy need to consider potential conflicts and 

tradeoffs among: 

o Hazards;

o Likelihood of failure;

o Consequences to all potentially exposed populations and

o Other important risk considerations such as

 environmental impact;

 impact on risk in other locations or sectors of the overall economy;

process and product supply chain and life cycle;

 technical feasibility;

 economic viability; and 

 regulatory requirements.
4.0 References

7 

3.3 Utility of the Definition

This definition focuses on understanding the nature of IST, and what needs to be considered in evaluating 

whether or not IST is appropriate for management of security risks associated with hazardous material 

facilities of all types. It also provides some high level guidance to assist in identifying opportunities for 

IST. However, the more extensive and detailed information and checklists available in published 

literature are more appropriate for use by technical staff (engineers and chemists) and management for 

identification of IST opportunities for a specific facility. The definition summarizes a very complex 

technical philosophy in a short and concise statement to make IST understandable to a broad, nontechnical audience. However, actual identification of potential IST options, and evaluation of whether or 

not they make sense to implement at a specific facility requires a more extensive understanding of the 

technology involved than this definition provides.

3.4 Limitations and Possible Future Work

This project and definition does not address a number of important issues in IST, including:

Specific methodologies for engineers and managers to identify IST alternatives. This is a 

field which continues to be developed, and the current status of techniques and procedures is 

best summarized in Chapter 8 of the 2nd (2009) Edition of the CCPS book Inherently Safer 

Chemical Processes: A Life Cycle Approach.

3

Methods for measuring the IST characteristics of alternative technologies. Inherently 

Safer Chemical Processes: A Life Cycle Approach, 2

nd Edition3

(Section 9.7, pp. 223-225) 

summarizes some research on this topic but there continues to be no consensus on how to 

measure IST. A primary issue is that any ―single number‖ quantification of IST will 

necessarily incorporate some kind of weighting factors to combine the potential consequences 

of different types of hazards (for example, fires, explosions, acute toxicity, chronic toxicity, 

environmental hazards, etc.). An alternative might be to separately rank the IST 

characteristics of different options and then use decision analysis techniques to evaluate 

options in a specific situation.

4.0 REFERENCES

1.0 Kletz, T.A. ―What you don’t have, can’t leak.‖ Chemistry and Industry, 6 May 1978, pp 287-292.

2.0 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes: A Life Cycle 

Approach, ed. D. A. Crowl. New York, American Institute of Chemical Engineers, 1996.

3.0 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes: A Life Cycle 

Approach, 2nd Edition. American Institute of Chemical Engineers, New York and John Wiley & 

Sons, Hoboken, NJ. 2009

4.0 Contra Costa County, California Industrial Safety Ordinance: Inherently safer systems (ISS) 

http://cchealth.org/groups/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed July 

15, 2010).

5.0 Johnson, Robert: ―Inherently safer designs permanently and inseparably reduce or eliminate 

process hazards that must be contained and controlled to avoid accidents.‖ (unpublished 

presentation)

6.0 Kletz, T. A. Process Plants: A Handbook for Inherently Safer Design. Bristol, PA, Taylor and 

Francis, 1998.

7.0 Kletz, Trevor: ―An [inherently safer] IS design is one that avoids hazards instead of controlling 

them, particularly by reducing the amount of hazardous material or the number of hazardous 

operations.‖ (Personal communication in February 2010.)
Final Report: Definition of Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.
 

APPENDICES

APPENDIX A: FINAL DEFINITION OF INHERENTLY SAFER TECHNOLOGY

APPENDIX B: FINAL DISCUSSION ON INHERENTLY SAFER TECHNOLOGY

APPENDIX C: CCPS PROJECT PROPOSAL SUBMITTED OCTOBER 13, 2009

APPENDIX D: INITIAL DEFINITION WORKSHOP – FEBRUARY 3, 2010

APPENDIX E: SECOND DEFINITION WORKSHOP – IST DRAFT DEFINITION AND 

DISCUSSION – FEBRUARY 25, 2010

APPENDIX F: THIRD DEFINITION WORKSHOP – FINAL IST DRAFT AND 

DISCUSSION PRESENTED AT THE GLOBAL CONGRESS ON 

PROCESS SAFETY – MARCH 22, 2010

APPENDIX G: NOMENCLATURE

APPENDIX H: ABOUT CCPS 
Final Report: Definitions for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.
Appendix A

A-1

APPENDIX A: FINAL DEFINITION FOR INHERENTLY SAFER 

TECHNOLOGY/INHERENTLY SAFER DESIGN

Below is the final technically based definition of inherently safer technology/inherently safer design 

(IST/ISD). Appendix B provides additional discussion to enable the reader a full understanding of IST.

INHERENTLY SAFER TECHNOLOGY DEFINITION

Inherently Safer Technology (IST), also known as Inherently Safer Design (ISD), permanently eliminates 

or reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to the 

design and operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an 

iterative process that considers such options, including eliminating a hazard, reducing a hazard, 

substituting a less hazardous material, using less hazardous process conditions, and designing a process to 

reduce the potential for, or consequences of, human error, equipment failure, or intentional harm. Overall,

safe design and operation options cover a spectrum from inherent through passive, active and procedural 

risk management strategies. There is no clear boundary between IST and other strategies. 

ISTs are relative: A technology can only be described as inherently safer when compared to a 

different technology, including a description of the hazard or set of hazards being considered, 

their location, and the potentially affected population. A technology may be inherently safer than 

another with respect to some hazards but inherently less safe with respect to others, and may not 

be safe enough to meet societal expectations.

ISTs are based on an informed decision process: Because an option may be inherently safer 

with regard to some hazards and inherently less safe with regard to others, decisions about the 

optimum strategy for managing risks from all hazards are required. The decision process must 

consider the entire life cycle, the full spectrum of hazards and risks, and the potential for transfer 

of risk from one impacted population to another. Technical and economic feasibility of options 

must also be considered.
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.
Appendix B

B-1

APPENDIX B: FINAL DISCUSSION ON DRAFT DEFINITION OF INHERENTLY 

SAFER TECHNOLOGY

Inherently safer technology/inherently safer design (IST/ISD) is a philosophy—an approach to safety that 

focuses on eliminating or reducing the hazards associated with a set of conditions. It is applicable through 

the entire life cycle and footprint of any system that manufactures, transports, stores, or uses hazardous 

materials or hazardous processing conditions. IST permanently and inseparably reduces or eliminates 

process hazards that must be contained and controlled to avoid incidents, rather than controlling those 

hazards by added-on protective equipment. While IST applies throughout the life cycle of a process, 

plant, or material, the greatest opportunities for significant IST benefits are early in the life cycle, before 

the technology becomes deeply integrated into the infrastructure of an industry from raw material 

suppliers through final product users, and before major investments in plant and equipment are made.

A material, process, or technology can only be described as ―inherently safer‖ when compared to a 

different material, process, or technology. This description must include the definition of the particular 

hazard or set of hazards that were considered in making the comparison. Thus, it is not appropriate to 

describe a technology as inherently safer than an alternate technology, with no further description. An 

appropriate description would be, for example, that the first technology is inherently safer than the 

alternate technology with respect to the hazards of acute toxicity and flammability of the vapor. Note that 

this statement makes no judgment about the relative inherent safety characteristics of other possible 

hazards – the first technology may be inherently less safe than the alternate technology with respect to 

other hazards such as chemical reactivity, chronic toxicity, or potential for hazardous decomposition.

IST options can be location and release scenario dependent, and different potentially exposed populations 

may not agree on the relative inherent safety characteristics of the same set of options. For example, two 

options for handling a toxic gas might be receiving the material in ten, 1-ton cylinders or one, 10-ton 

truckloads. To a population several miles from the site, the 1-ton cylinders would be inherently safer 

because the maximum potential release size is smaller and less likely to expose them to a hazardous 

concentration of the gas. However, operators, who would now have to connect and disconnect 10 

cylinders for every 10 tons of material used, instead of a single truck, would consider the truck shipments 

to be inherently safer. Thus, evaluation of IST options can be quite complex, and dependent on the local 

environment. There is currently no consensus on either a quantification method for IST or a scientific 

assessment method for evaluation of IST options. 

Inherently safer design is a part of an iterative decision-making process for risk reduction. It is ongoing 

and continuous throughout the life cycle of a technology, from initial conception through 

commercialization, operation, and, when obsolete, shutdown and demolition. It should consider the entire 

footprint of the process—raw material sources and supply, impact on supply technologies, transportation, 

and impact on downstream users and their technologies, and ultimate material disposition. Evaluation of 

IST options for a particular plant, product, or other system must consider the overall effects of all other 

impacted systems—it is essential to understand the impact that a change in one technology will have on 

hazards and risks elsewhere in society. In particular, it is important to identify all such impacts and to 

make informed decisions on the best overall way to manage risk throughout society.

Risk reduction criteria will be determined by the nature of the hazards or threats, and will require 

consideration of conflicts among multiple hazards and threats. Tools for understanding societal 

expectations for risk management include national and local government regulations and other legal 

requirements, consensus codes and standards developed by technical and trade associations, and internal 

corporate standards and requirements. The potential hazard of a major release resulting from an accident, 

as well as security or vulnerability concerns such as theft of materials, contamination of products, and 

degradation of infrastructure, must be considered. Hazard identification, risk assessment, and security 
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

B-2

vulnerability analysis tools are used to identify and characterize risk. Risk can be reduced by many 

methods, including inherently safer design, but those methods must include the full spectrum of risk 

reduction approaches (passive, active, and procedural risk management systems). This is particularly true 

when considering the need to manage multiple hazards and risks—it is unlikely that any technology will 

be ―inherently safer‖ with respect to all hazards, and other approaches will always be required to manage 

the full range of hazards and risks. Ultimately, society must decide which hazards and risks it wants to 

manage primarily with inherently safer design approaches, and which hazards and risks will be managed 

with other approaches (active, passive, and procedural).

The inseparability of IST from the overall objective of the safe design and operation of hazardous 

material manufacturing, transportation, storage, and use is apparent when considering chemical security. 

An IST with respect to catastrophic release hazard from a fixed manufacturing plant may conflict with

methods to minimize other hazards, such as theft or diversion of materials, contamination of product, or 

degradation of infrastructure. It may not address other hazards at all, or, it may create new hazards.

The CCPS book Inherently Safer Chemical Processes: A Life Cycle Approach describes several levels of 

inherently safer design. 1

―First Order inherently safer design refers to the identification of alternatives that completely 

eliminate a particular hazard. Note that, as discussed above, this does not say anything about the 

impact on other hazards, which may be increased, decreased, or remain unaffected by the change. 

An example would be using a water based paint to paint a room in your house instead of 

flammable solvent based paint, eliminating the hazard of exposure to low levels of potentially 

toxic solvents, and fire hazards associated with flammable solvent.

Second Order inherently safer design reduces the magnitude of a hazard, or makes an accident 

associated with a hazard less likely to occur, by the design of the equipment, and not through addon safety devices. Again, this does not say anything about the impact of the change on other 

hazards, which may be increased, decreased, or remains unaffected. As an example of reducing 

the magnitude of a hazard, explosives such as TNT can be made in small continuous reactors 

containing a few gallons of material rather than large batch reactors containing thousands of 

gallons of material. As an example of inherently making a hazard less likely to result in an 

accident, if adding too much raw material to a vessel can cause a runaway reaction, this can be 

made inherently less likely by installing a feed tank that holds the exact amount of raw material 

required, and no more.

Layers of Protection include risk management equipment and management systems often 

categorized as Passive, Active, and Procedural. These layers include risk management features 

such as containment dikes to manage spills and leaks (passive), safety alarms and shutdown 

systems (active), and safety procedures and operator actions (procedural). When you consider all

of the multiple hazards associated with any technology, it is unlikely that it will ever be possible 

to manage all of them inherently, and layers of protection will always be required as a part of the 

total risk management program. Inherently safer design concepts can be used to make these layers 

of protection inherently more reliable and robust.‖

 

1 Center for Chemical Process Safety (CCPS). Inherently Safer Processes: A Life Cycle Approach. 2

nd Edition, 

American Institute of Chemical Engineers/John Wiley & Sons, Inc., Hoboken, NJ, 2009, pp. 15-16.
Appendix B

B-3

Decisions on the appropriate overall risk management strategy will be a function of, and will consider 

potential conflicts and tradeoffs with:

Hazards;

Likelihood of failure;

Consequences to all potentially exposed populations;

Other important risk considerations such as environmental impact;

Impact on risk in other locations or sectors of the overall economy;

Process and product supply chain and life cycle, including distribution 

considerations and final user considerations such as consumer expectations 

or government regulations regarding product quality;

Technical feasibility – may be location specific;

Economic viability – may be location specific; and

Regulatory requirements – may be location specific.
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.
Appendix C

C-1

APPENDIX C: CCPS PROJECT PROPOSAL SUBMITTED OCTOBER 13, 2009

C.1 SUMMARY OF NEED

The Center for Chemical Process Safety (CCPS), a directorate of the American Institute of Chemical 

Engineers (AIChE), a 501 (c) (3) not for profit educational organization, is pleased to submit this proposal 

to the U.S. Department of Homeland Security (DHS) Chemical Security Analysis Center (CSAC).

The CSAC statement of work is attached to this proposal for reference. CSAC is requesting an 

independent technical organization to review the literature and common practices related to design of 

Inherently Safer Processes, and lead a process to develop a technically-based definition of Inherently 

Safer Technology (IST).

CSAC desires that the definition span the full life cycle of the chemical enterprise, including use and 

manufacturing, storage, and transportation. It is CSAC’s view that the various current definitions 

available in the literature, including those of CCPS, Trevor Kletz, and others have inconsistencies. CSAC 

further believes that existing definitions are not broad enough to address the full supply chain and do not 

go far enough to help resolve the classic challenge posed by IST, such as tradeoffs where improvement in 

safety in one dimension of process or supply chain may lead to degradation of safety in another 

dimension.

C.2 PROPOSED APPROACH

CCPS proposes a 5-step process to address this challenge.

Step 1: Scoping

While IST was originally conceived as an engineering design philosophy, in recent years the term IST has 

become politically charged. CCPS will seek to bring IST back into the technical realm by assembling a 

committee of highly respected experts to evaluate the many IST concepts being discussed in the technical 

and political arena. The goal of this scoping meeting is to pull together the many concepts being discussed 

into 3-6 alternative definitions, which would be the deliverable of this step. The committee would strive 

to focus solely on classifying and organizing the definitions, without initially passing value judgments on 

any of the alternatives. An idea synthesis process will be used, similar to that used by the CCPS Planning 

Committee to survey current needs and trends in process safety to generate project proposals for selection 

by CCPS members. Additionally, the subcommittee will propose criteria by which the alternatives will be 

evaluated.

CCPS proposes that the scoping committee be led by Mr. Peter N. Lodal of Eastman Chemical. Mr. Lodal 

is a Fellow of AIChE and of CCPS and is the current chair of the CCPS Engineering Design 

subcommittee. Mr. Lodal’s time will be donated by Eastman Chemical to this project, but reimbursement 

of his travel, food, and lodging has been requested. The committee membership will also include the 

following technical leaders from the CCPS community, or others with similar attributes, to represent 

chemical, refining, and pharmaceutical manufacturing, large and small companies, and experts serving 

these industries as listed in Table C-1:
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

C-2

Table C-1. Proposed Scoping Committee Participants

PARTICIPANT ORGANIZATION

Kathy Anderson Vertellus

Scott Berger CCPS

Paul Butler CCPS

Eric Freiburger NOVA Chemicals

Cheryl Grounds BP

Dennis Hendershot CCPS

Greg Housell Pfizer

Shakeel Kadri Air Products

Neil Maxson Neil Maxson

Jack McCavit CCPS

Steve Meszaros Wyeth

Cathy Pincus ExxonMobil

Jatin Shah Baker Risk

Kenan Stevick Dow Chemical

Karen Tancredi DuPont

Scott Wallace Olin

NOTE: This is a proposed participant list—substitutions may have been made to actual participants.

CCPS also wishes to incorporate the thinking of Trevor Kletz, considered by many to be the father of the 

Inherently Safer Process design philosophy. If it were not possible for Dr. Kletz to travel to the committee 

meetings, his input would be included by tele- or web-conferencing, or offline discussions.

Step 2: Workshop on the definition of inherently safer technologies

Once 3-6 candidate definitions and criteria to evaluate them have been drafted, they will be presented at a 

workshop so that attendees can review these definitions and criteria. We will not ask the workshop 

attendees to decide between the definitions, but rather to identify the strengths and weaknesses of each 

candidate. Likewise, we will not ask the attendees to agree on the criteria, but rather to identify criteria 

that are missing or superfluous.

Attendance at the workshop will be open to any individual who can demonstrate that they have practiced 

inherently safer process and system design, regardless of industry or whether practiced as an engineer, 

chemist, operator, manager, or other position. Labor and activist participants will be welcome, but only to 

the extent they have actually practiced inherently safer processes. Because some attendees may need 

financial assistance in order to attend, a process will be developed by which invitations are extended and, 

if appropriate, travel stipends awarded from grant.
Appendix C

C-3

Step 3: Finalizing Definitions

Following the workshop, the CCPS committee will review the input received and proceed to evaluate the 

candidate definitions, ultimately narrowing them down to a single recommended definition.

Step 4: Presenting Recommendations for Comment

CCPS plans to formally present its recommendations at the Global Congress on Process Safety, and 

simultaneously publish the recommendations on its website for public comment. Since many key 

stakeholders attend this conference, it will be a convenient opportunity to gather them together. In order 

to ensure that key viewpoints are represented during the presentation at the Global Congress on Process 

Safety, CCPS will invite individuals who represent diverse viewpoints but do not normally attend the 

Global Congress to attend. A process will developed by which invitations are extended and, if 

appropriate, registration fees and travel stipends awarded from grant funds to enable such individuals to 

attend.

Step 5: Finalizing the Recommendation

The CCPS committee will review comments provided at the Global Congress and via other formats and 

thereafter finalize the definition. If comments were provided by a person who wishes a formal response 

explaining how their comment was addressed, such a response will be given. This final meeting (or set of 

meetings) will be held by tele- and web-conference. The single definition, along with the rationale 

supporting the choice of this definition, will be reported to CSAC in a final report. 

C.3 PERSONNEL

CCPS proposes that the project be supported by the following permanent and part-time staff.

Project Manager: Scott Berger, CCPS Executive Director

Scott Berger joined the staff of AIChE in 2001 and has served as the CCPS Director and Executive 

Director since then. In this capacity, he has facilitated more than 40 projects leading to the publication of 

CCPS Guideline or Concept Series books, other publications, or training materials related to process 

safety. Over this period, industrial participation in CCPS activities grew from 65 to over 120 member 

companies. Prior to joining AIChE, he worked at Owens Corning for 5 years in various leadership roles 

promoting safer and greener manufacturing processes, management systems, and products. He started is 

career at Rohm and Haas, where for 18 years he worked in process development and engineering, with a 

focus on pollution prevention and inherently safer processes. Scott holds a BS and MS from 

Massachusetts Institute of Technology.

Expert Advisor: Dennis Hendershot, CCPS Staff Consultant

Dennis Hendershot joined the CCPS staff as a part-time staff consultant upon his retirement from Rohm 

and Haas in 2005. Dennis led two important CCPS projects, the revision of ―Inherently Safer Processes,‖

the CCPS authoritative text on the subject, and ―Guidelines for Safety Risk Criteria.‖ During this same 

period, Dennis served on the Baker Panel investigating process safety culture within the BP organization 

following the major vapor cloud explosion in March 2005. Prior to 2005, Dennis worked at Rohm and 

Haas for 35 years, more than half of which as Rohm and Haas’ leading expert on process safety, hazard 

and risk analysis, and inherently safer processes. Dennis holds a BS from Lehigh University and an MBA 

from University of Pennsylvania.
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

C-4

Project Facilitator: Paul Butler, CCPS Technical Manager

Paul Butler joined the AIChE staff as CCPS Technical Manager in 2008. Prior to joining CCPS, Paul 

worked at Buckman Laboratories for 35 years, more than half of which serving as the Director of Process 

Safety. In this role, Paul deployed process safety principles and management systems throughout 

Buckman’s worldwide sites. Paul holds a BS from Virginia Tech.

C.4 TIMING AND COST

Table C-2 lists the proposed schedule, dates, and funding for this project. It is assumed the final 

workshop will be held at the Global Congress on Process Safety on March 22-24, 2010. If a more 

compressed time schedule is required, the schedule may be changed.

Table C-2. Proposed Schedule and Funding

SCHEDULE DATE

Awarding of grant November 1, 2009

Organize scoping meeting November 1 – November 15, 2009

Hold scoping meeting November 15 – December 15, 2009

Summarize scoping meeting December 16, 2009 – January 15, 2010

Organize Workshop December 1, 2009 – January 15, 2010

Hold Workshop January 15 – January 31, 2010

Report Recommendation March 22-24, 2010

Final comments accepted April 15, 2010

Final report May 1, 2010

Requested funding: $59,695

C.5 STATEMENT OF WORK

Prepare a final definition of Inherently Safer Technology in Production, Transportation, Storage and Use

The Chemical Security Analysis Center (CSAC), part of the U.S. Department of Homeland Security 

(DHS) Directorate of Science and Technology (S&T) is seeking sources to provide a definition of 

inherently safer technology (IST).

A primary area of concern to the U.S. Department of Homeland Security (DHS) is the potential for 

intentional release of toxic chemicals caused by a domestic terrorist attack. The very nature of these 

chemicals poses numerous safety and security issues along the entire supply chain. It is believed that 

application of principles of inherently safer technology (IST) will provide a significant improvement in 

the overall safety of the U.S. chemical industry. Even though this view is widely held, there is no 

consensus on a definition of IST beyond its basic philosophical tenets. There are specific examples of IST 

applications in the literature but no systematic IST methodology, which can guide its implementation.
Appendix C

C-5

In order to provide such guidance, CSAC is seeking a contractor to provide a definition of IST. This 

definition should address in some manner the basic tenets of IST as applied to production such as:

1. Minimization of toxic material usage;

2. Substitution or use less hazardous materials for toxic materials;

3. Attenuate reaction conditions; and 

4. Simplification of process design to minimize human error or equipment failure.

However, because of the concerns of risk shift/transfer to other sectors, this definition should also capture 

IST issues related to the other components of the chemical supply chain: 

1. Transportation,

2. Storage, and

3. Use. 

This definition should provide a basis on which the safety of alternate manufacturing, use, transportation,

or storage modes of a particular compound can be compared and quantified. This comparison should 

allow for the selection of the safest process.
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.
Appendix D

D-1

APPENDIX D: INITIAL DEFINITION WORKSHOP – FEBRUARY 3, 2010

D.1 WORKSHOP AGENDA

The Initial Inherently Safer Technology Definition Workshop was held in Baltimore, Maryland on 

February 3, 2010. The agenda is listed in Table D-1. 

Table D-1. Agenda

TIME TOPIC LEADER

7:30 Breakfast All

8:00 Summary of agenda – how the day will work Shawn Bowen

8:15 Introductions All

8:30

Introductory comments

Objectives and deliverables

Overall process

George Famini

Scott Berger

9:00 Ground rules Shawn Bowen

9:05 Explanation of definition Dennis Hendershot

9:20 Pause to write comments All

9:30 Feedback on ―Comparative‖ Dennis Hendershot

10:00 Break All

10:15 Feedback on ―specific‖ Dennis Hendershot

10:45 Feedback on ―value judgment‖ Dennis Hendershot

11:15 Feedback on ―not absolute‖ Dennis Hendershot

11:45 Lunch All

1:00 Feedback on title and introductory paragraph Dennis Hendershot

1:30 General feedback Dennis Hendershot

2:30 Review, summarize, and next steps Scott Berger

3:00 Close
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

D-2

D.2 PARTICIPANTS

The Initial Inherently Safer Technology Definition Workshop (February 3, 2010) participants are listed in 

Table D-2. 

Table D-2. Workshop Participants

PARTICIPANTS ORGANIZATION

Scott Berger CCPS

Shawn Bowen DHS-CSAC

Dan Crowl Michigan Tech University

George Emmett DHS-CSAC

George Famini DHS-CSAC

Eric Freiburger Praxair

Cheryl Grounds BP

Dennis Hendershot CCPS

Iclal Atay New Jersey DEP

Peter Lodal Eastman

Jack McCavit CCPS Emeritus

Adolpho Negron US DHS CSAC

Pat Scenefeldt ExxonMobil

Kenan Stevick Dow

Karne Tancredi DuPont

Scott Wallace Olin

D.3 SUMMARY

Below are the key concepts summary of the Initial Inherently Safer Technology Definition Workshop 

(February 2, 2010):

Overview of project and clarifications

Criteria – how do we know definition fits purpose

Review ―gold book‖ definition

Brainstorming

o How do we extend IST to life cycle steps?

o Definitions for each life cycle step

o Also, what IST is not

o Reconciling the life cycle definitions with each other

o How does IST apply to vulnerability?

o Definition for IST related to vulnerability

o Reconciliation the security definition with the prior 

Preparation for February 25 workshop – how to make sure we get input that clarifies rather 

than blurs?

Preparation for March 22 workshop – how to structure.
Appendix E

E-1

APPENDIX E: SECOND DEFINITION WORKSHOP – IST DRAFT AND DISCUSSION 

– FEBRUARY 25, 2010

E.1 AGENDA

The Initial Draft Inherently Safer Technology Definition and Discussion Workshop was held in Houston, 

Texas on February 25, 2010. The agenda is listed in Table E-1.

Table E-1. Agenda

TIME TOPIC LEADER

7:30 Breakfast All

8:00 Summary of agenda – how the day will work Shawn Bowen

8:15 Introductions All

8:30

Introductory comments

Objectives and deliverables

Overall process

George Famini

Scott Berger

9:00 Ground rules Shawn Bowen

9:05 Explanation of definition Dennis Hendershot

9:20 Pause to write comments All

9:30 Feedback on ―Comparative‖ Dennis Hendershot

10:00 Break All

10:15 Feedback on ―specific‖ Dennis Hendershot

10:45 Feedback on ―value judgment‖ Dennis Hendershot

11:15 Feedback on ―not absolute‖ Dennis Hendershot

11:45 Lunch All

1:00 Feedback on title and introductory paragraph Dennis Hendershot

1:30 General feedback Dennis Hendershot

2:30 Review, summarize, and next steps Scott Berger

3:00 Close
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

E-2

E.2 PARTICIPANTS

Participants at the Initial Draft Inherently Safer Technology Definition and Discussion Workshop 

(February 25, 2010) are listed in Table E-2. 

Table E-2. Workshop Participants

PARTICIPANT ORGANIZATION

Kathy Anderson Vertellus

Steve Arendt ABSG Consulting

Iclal Atay NJDEP

Scott Berger CCPS

Shawn Bowen DHS-CSAC

Carl Brown KBR / Univ. Houston

Alber Candello University of Houston

Kenneth Carlson Occidental

Jack Chosnek Independent

Jim Cooper NPRA

Vic Edwards Aker Solutions

George Emmett DHS-CSAC

George Famini DHS-CSAC

Brad Fuller AcuTech

Cheryl Grounds BP

Dennis Hendershot CCPS

Charles Jones Solvay-Solexis

Michael Kennedy SOCMA

Greg Kiihne BASF

George King Huntsman

Allen Lasater Koch

Peter Lodal Eastman

Sa, Mannan Texas A&M

John Miles Occidental

Shawn Moshiri Chevron

Tim Overton BP

Cathy Pincus ExxonMobil

Robin Pitblado DNV

Mike Sawyer Apex Safety

Randall Sawyer Contra Costa County

Roxy Schneider CCPS

Steve Selk DHS

Terry Smith PPG

Karne Tancredi DuPont

Kevin Walker Chevron

Scott Wallace Olin

Nohemi Zerbi DHS
Appendix E

E-3

E.3 SUMMARY

Participants provided over 150 written comments as summarized below, ranging from very detailed and 

specific editorial comments on wording of parts of the definition, to significant suggestions to revise the 

organization and content of the definition. In some cases, specific wording was suggested for parts of the 

definition. This feedback was carefully considered by CCPS Staff in revising the definition. It was not 

possible to incorporate all feedback for many reasons because some suggestions were in conflict with 

each other, while others were deemed inappropriate because they were too detailed for a high level, short 

definition. However, all comments were evaluated and considered. As a result of the workshop, CCPS 

was able to significantly shorten the definition and combine a number of concepts from the initial draft to 

make the definition simpler, while retaining the essential components of a good IST definition.

Inherently safer technology (IST), also known as inherently safer design (ISD), is a design philosophy or 

strategy integral to the broader objective of safer design (SD). Inherently safer technology permanently 

and inseparably reduces or eliminates process hazards to avoid accidents, rather than controlling those 

hazards by added-on protective equipment.

Inherently safer technology reduces risk through a hierarchy of approaches, starting with eliminating 

hazards, then reducing hazards, substituting less hazardous materials, using less hazardous process 

conditions, and designing processes to reduce the possibility or consequences of human error or 

mechanical failure. As we progress through this hierarchy, we gradually transition from IST to SD, and 

that is why IST cannot be separated from SD. Some important characteristics of IST include:

Relative: A technology, material, or process can only be described as ―inherently safer‖ 

when compared to a different technology, material, or process.

Specific: It is not possible to describe Technology A as ―inherently safer‖ than Technology

B without describing the hazard or set of hazards being considered. It is possible for a 

technology, material, or process to be inherently safer than another technology, material, or 

process with respect to some hazards and inherently less safe with respect to others. 

Value judgment: The potential of an option to be inherently safer with regard to some 

hazards and inherently less safe with regard to others may require value judgments about the 

optimum strategy for managing risks arising from all hazards. Some hazards may be managed 

inherently, while others may require other safety management approaches. 

Not absolute: It is fundamentally possible for one technology to be inherently safer than 

another, while still not safe enough to meet societal expectations.

Inherently Safer Technology – Discussion

Inherently safer design is a concept and philosophy - an approach to safety that focuses on eliminating or 

reducing the hazards associated with a set of conditions. An inherently safer design permanently and 

inseparably reduces or eliminates process hazards that must be contained and controlled to avoid 

accidents, rather than controlling those hazards by added-on protective equipment. A material, process, or 

technology can only be described as ―inherently safer‖ when compared to a different material, process, or 

technology, and this description must include the definition of the particular hazard or set of hazards 

which were considered in making the comparison. Thus, it is not appropriate to describe Material A as 

―inherently safer‖ than Material B with no further description. An appropriate description would be 

―Material A is inherently safer than Material B with respect to the hazard of acute toxicity of the vapor, 

and the hazard of flammability of the vapor.‖ Note that this statement makes no judgment about the 

relative inherent safety characteristics of other possible hazards – Material A may be inherently less safe 
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

E-4

than Material B with respect to other hazards such as chemical reactivity, chronic toxicity, or potential for 

hazardous decomposition.

Inherently safer technology (IST), also known as inherently safer design (ISD), permanently eliminates or 

reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to the 

design and operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an 

iterative process that considers options, including eliminating a hazard, reducing a hazard, substituting a 

less hazardous material, using less hazardous process conditions, and designing a process to reduce the 

potential for, or consequences of, human error, equipment failure, or intentional harm. Overall safe design 

and operation options cover a spectrum from inherent through passive, active and procedural risk 

management strategies. There is no clear boundary between IST and other strategies. 

Inherently safer design is a part of an iterative decision-making process for risk reduction. It is ongoing 

and continuous throughout the life cycle of a material or process, from initial conception through 

commercialization, operation, and, when obsolete, shutdown and demolition. It should consider the entire 

footprint of the process – raw material sources and supply, impact on supply technologies, transportation, 

the impact on downstream users and their technologies, and ultimate material disposition. Risk reduction 

criteria will be determined by the nature of the hazards or threats, and will likely require some 

consideration of conflicts among multiple hazards and threats. Important considerations in prioritizing 

efforts include the threshold of a major accident hazard (public health impact – PHI), as well as security 

or vulnerability (including definition of the threat, which must include factors such as theft/diversion, and 

intentional release). Hazard and risk assessment tools are used to identify and characterize risk. Risk can 

be reduced by many methods, including inherently safer design, but methods must include the full 

spectrum of risk reduction approaches (passive, active, and procedural risk management systems). This is 

particularly true when considering the need to manage multiple hazards and risks – it is unlikely that any 

technology will be ―inherently safer‖ with respect to all hazards, and other approaches will always be 

required to manage the full range of hazards and risks. Ultimately we must decide which hazards and 

risks we want to manage primarily with inherently safer design approaches, and which hazards and risks 

will be managed with other approaches (active, passive, procedural). The inseparability of IST from SD is 

apparent when considering chemical security. An Inherently Safer Technology with respect to 

catastrophic release hazard may conflict with, or may not address other hazards, such as theft/diversion of 

materials, contamination of product, or degradation of infrastructure, or may create new security hazards.

The CCPS book Inherently Safer Chemical Processes: A Life Cycle Approach describes several levels of 

inherently safer design.2

―First Order inherently safer design refers to the identification of alternatives that 

completely eliminate a particular hazard. Note that, as discussed above, this does not say 

anything about the impact on other hazards, which may be increased, decreased, or 

remain unaffected by the change. An example would be using a water based paint to paint 

a room in your house instead of flammable solvent based paint, eliminating the hazard of 

exposure to low levels of potentially toxic solvents, and fire hazards associated with

flammable solvent.

Second Order inherently safer design reduces the magnitude of a hazard, or makes an 

accident associated with a hazard less likely to occur, by the design of the equipment, and 

not through add-on safety devices. Again, this does not say anything about the impact of 

the change on other hazards, which may be increased, decreased, or remains unaffected. 

 

2 Center for Chemical Process Safety (CCPS). Inherently Safer Processes: A Life Cycle Approach. 2

nd Edition, 

American Institute of Chemical Engineers/John Wiley & Sons, Inc., Hoboken, NJ, 2009, pp. 15-16.
Appendix E

E-5

As an example of reducing the magnitude of a hazard, explosives such as TNT can be 

made in small continuous reactors containing a few gallons of material rather than large 

batch reactors containing thousands of gallons of material. As an example of inherently 

making a hazard less likely to result in an accident, if adding too much raw material to a 

vessel can cause a runaway reaction, this can be made inherently less likely by installing 

a feed tank that holds the exact amount of raw material required, and no more.

Layers of Protection include risk management equipment and management systems 

often categorized as Passive, Active, and Procedural. These layers include risk 

management features such as containment dikes to manage spills and leaks (passive), 

safety alarms and shutdown systems (active), and safety procedures and operator actions 

(procedural). When you consider all of the multiple hazards associated with any 

technology, it is unlikely that it will ever be possible to manage all of them inherently, 

and layers of protection will always be required as a part of the total risk management 

program. Inherently safer design concepts can be used to make these layers of protection 

inherently more reliable and robust.‖

Decisions on the appropriate overall risk management strategy will be a function of, and will consider 

potential conflicts and tradeoffs with:

hazards;

material selection;

process and product supply chain and life cycle, including distribution considerations and 

final user considerations;

technical feasibility – may be location specific;

economic viability – may be location specific; and

environmental impact.
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.
Appendix F

F-1

APPENDIX F: THIRD DEFINITION WORKSHOP – FINAL IST DRAFT DEFINITION 

AND DISCUSSION PRESENTED AT THE GLOBAL CONGRESS ON PROCESS 

SAFETY – MARCH 22, 2010

F.1 AGENDA

The Final Draft Definition and Discussion of Inherently Safer Technology were presented at the Global 

Congress on Process Safety, which was held in San Antonio, Texas on March 22, 2010. The agenda for 

the Global Congress is listed in Table F-1. 

Table F-1. Agenda for Global Congress on Process Safety: Topical 1 Sessions

Topical 1: Global Congress on Process Safety*

12th Process Plant Safety Symposium (PPSS) 

25th Center for Chemical Process Safety International Conference (CCPS) 

44th Annual Loss Prevention Symposium (LPS) 

Monday, March 22, 2010

8:00 AM-9:20 AM

Topical 1: Global Congress on Process Safety 

(#6) - T1C07 Opening Plenary Session - Sherman Glass, President of Exxon-Mobil 

Worldwide Refining and Supply Co.

10:00 AM-11:30 AM

Topical 1: Global Congress on Process Safety 

(#20) - T1C00 Fires, Explosions and Reactive Chemicals (Part I)

Topical 1: Global Congress on Process Safety 

(#21) - T1B04 Inherently Safer Design/Inherently Safer Technologies (Part I)

Topical 1: Global Congress on Process Safety 

(#22) - T1B00 LOPA Bloopers and Outtakes

Topical 1: Global Congress on Process Safety 

(#23) - T1A02 Management of Change - the Most Difficult PSM Challenge

1:30 PM-5:00 PM

Topical 1: Global Congress on Process Safety 

(#26) - T1B02 Case Histories of Risk Assessment and Problem Solving

Topical 1: Global Congress on Process Safety 

(#27) - T1C05 Fires, Explosions and Reactive Chemicals (Part II)

Topical 1: Global Congress on Process Safety 

(#28) - T1B07 Inherently Safer Design/Inherently Safer Technologies (Part II)

Topical 1: Global Congress on Process Safety 

(#29) - T1A01 Layer of Protection Analysis (LOPA) - Case Studies and Experiences

* Adapted from the AIChE Website: http://aiche.confex.com/aiche/s10/webprogram/T1.html (accessed July 6, 2010).
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

F-2

F.2 CONFERENCE SESSIONS

The Initial Inherently Safer Technology Definition and Discussion agenda and abstracts of the sessions 

held at the Global Congress on Process Safety have been modified and are located in Table F-2 though 

Table F-6.

Table F-2. Agenda for Inherently Safer Design/Inherently Safer Technologies: 

Topical 1, Session 21, Part I

Inherently Safer Design/Inherently Safer Technologies (Part I )*

Monday, March 22, 2010: 10:00 AM

Room 101 A/B (Convention Center)

Dennis C. Hendershot, Process Safety, Bethlehem, PA

Inherent safety (IS) is the modern term for eliminating hazards rather than accepting and managing 

them. Engineering is the traditional realization of this concept, as its core function is the application of 

science, technology, and mathematics to develop and implement practical solutions that are safe and 

efficient. Currently there is much interest across industry, academia, advocacy groups and governments 

in mandating IS to achieve process safety and security goals. There is much debate as to what 

comprises IS, how and when it is best applied, who/how to judge this creative process, how and whether 

it differs from traditional engineering, and what role it should have in the chemical industry to achieve 

process safety and security goals. This session will present three papers of realistic scenarios and case 

histories that demonstrate various perspectives and views of IS and its application. A facilitated panel 

discussion exploring the proper role of IS and audience questions session will follow the presentations.

Sponsor: 25th Center for Chemical Process Safety International Conference (CCPS)

Chair: Eric Freiburger

Email: Eric_Freiburger@Praxair.com

Co-Chair: Cheryl Grounds

10:00 AM

(21a) Overview of IST

Dennis C. Hendershot

10:30 AM

(21b) The DHS Chemical Facility Anti-Terrorism Standards – A Risk-Based Approach to Chemical 

Facility Security

Larry Stanton

11:30 AM

(21c) IST Trade-Offs

Jatin Shah

* Adapted from the AIChE Website: http://aiche.confex.com/aiche/s10/webprogram/Session13520.html (accessed July 6, 2010).
Appendix F

F-3

Table F-3. Abstracts for Inherently Safer Design/Inherently Safer Technologies: 

Topical 1, Sessions 21a-21c, Part I*

Overview of IST

Topical 1, Session 21a

Monday, March 22, 2010: 10:00 AM

Room 101 A/B (Convention Center)

Dennis C. Hendershot, Process Safety, Bethlehem, PA

Inherently Safer Design (ISD) is a holistic approach to making the development, manufacturing, and use 

of chemicals safer. Over time, there have been many developments on the concept of inherent safety;

however, currently there is a growing fixation on only one element of ISD: substitution. This paper will 

present an overview of ISD and its elements of minimize, substitute, moderate, and simplify. In addition, 

the life cycle of a process will be explained in context of ISD to further explain the most effective use of 

ISD as well as other risk mitigation methods and strategies.

The DHS Chemical Facility Anti-Terrorism Standards –

A Risk-Based Approach to Chemical Facility Security

Topical 1, Session 21b

Monday, March 22, 2010: 10:30 AM

Room 101 A/B (Convention Center)

Larry Stanton, Infrastructure Security Compliance Division, Department of Homeland Security, 

Washington, DC

In October 2006, Congress granted DHS authority to regulate security at high-risk chemical facilities. 

The resulting program, CFATS, (1) prioritizes facilities that possess chemicals of interest to terrorists 

due to the release, sabotage or diversion hazards they present; (2) identifies the types of security 

performance measures that address these risks; and (3) adapts to different types of facilities, ranging 

from manufacturing plants to universities, hospitals and warehouses across various industries. The riskbased approach drives facilities to consider adoption of a range of risk-reduction measures, including 

inherently safer technologies, to achieve compliance with the standards.

IST Trade-Offs

Topical 1, Session 21c

Monday, March 22, 2010: 11:00 AM

Room 101 A/B (Convention Center)

Jatin Shah, Baker Engineering and Risk Consultants, Inc., Chicago, IL

Inherently Safer Technologies should be a key consideration in any companies risk management effort. 

Often we are faced with making a choice between an inherently safer option and one that is more 

hazardous but provides better benefits. With proper safeguards and controls it is possible to manage the 

risk of the more hazardous option to levels that are comparable or even lower than the inherently safer 

option. It may cost more and involve a greater amount of oversight but the benefits may still outweigh 

the costs.

This paper presents three examples to illustrate the trade-offs that one should evaluate in deciding 

which option is the best for a given situation:

1. Comparison between travel by Automobile and Airplane

2. Comparison of HF vs. MHF (HF with additive)Transport 

3. Comparison of HF Alkylation risk reduction options with Sulfuric Alkylation

While inherently safer technological options should be considered they may not always be the 

appropriate option to select, since it may require sacrificing desired benefits that an alternative option 

can provide at comparable or lower risk.

* Adapted from the AIChE Website: http://aiche.confex.com/aiche/s10/webprogram/T1.html (accessed July 6, 2010).
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

F-4

Table F-4. Agenda for Inherently Safer Design/Inherently Safer Technologies: 

Topical 1, Session 28, Part II

Inherently Safer Design/Inherently Safer Technologies (Part II )*

Monday, March 22, 2010: 1:30 PM

Room 101 A/B (Convention Center)

Inherent safety (IS) is the modern term for eliminating hazards rather than accepting and managing 

them. Engineering is the traditional realization of this concept, as its core function is the application of 

science, technology, and mathematics to develop and implement practical solutions that are safe and 

efficient. Currently there is much interest across industry, academia, advocacy groups and governments 

in mandating IS to achieve process safety and security goals. There is much debate as to what 

comprises IS, how and when it is best applied, who/how to judge this creative process, how and whether 

it differs from traditional engineering, and what role it should have in the chemical industry to achieve 

process safety and security goals. This session will present three papers of realistic scenarios and case 

histories that demonstrate various perspectives and views of IS and its application. A facilitated panel 

discussion exploring the proper role of IS and audience questions session will follow the presentations.

Sponsor: 25th Center for Chemical Process Safety International Conference (CCPS)

Chair: Eric Freiburger

Email: Eric_Freiburger@Praxair.com

Co-Chair: Cheryl Grounds

1:30 PM

(28a) Federal View of IST From the CSB Perspective

John Bresland

2:00 PM

(28b) ACC Philosophy On the Appropriate Application of Inherently Safer Principles

Peter N. Lodal and Laurie A. Miller

2:3 PM

(28c) Applying Inherently Safer Systems – Contra Costa County's Experience

Randall Sawyer

3:00 PM

Break

3:30 PM

Panel Discussion

* Adapted from the AIChE Website: http://aiche.confex.com/aiche/s10/webprogram/Session 13520.html (accessed July 6, 2010).
Appendix F

F-5

Table F-5. Abstracts for Inherently Safer Design/Inherently Safer Technologies: 

Topical 1, Sessions 28a-28b, Part II

Federal View of IST From the CSB Perspective

Topical 1, Session 28a

Monday, March 22, 2010: 1:30 PM

Room 101 A/B (Convention Center)

John Bresland, United States Chemical Safety Board, Washington, DC

The CSB is an independent federal agency charged with investigating industrial chemical accidents. 

Headquartered in Washington, DC, the agency's board members are appointed by the President and 

confirmed by the Senate.

The CSB conducts root because investigations of chemical accidents at fixed industrial facilities. Root 

causes are usually deficiencies in safety management systems, but can be any factor that would have 

prevented the accident if that factor had not occurred. Other accident causes often involve equipment 

failures, human errors, unforeseen chemical reactions or other hazards. The agency does not issue 

fines or citations, but does make recommendations to plants, regulatory agencies such as the 

Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency 

(EPA), industry organizations, and labor groups. Congress designed the CSB to be non-regulatory and 

independent of other agencies so that its investigations might, where appropriate, review the 

effectiveness of regulations and regulatory enforcement.

The CSB's investigations and mission gives it a unique perspective of IST that crosses legislation, 

regulations, industry, trade groups, unions, and public boundaries. The CSB Chair will present this 

perspective.

ACC Philosophy On the Appropriate Application of Inherently Safer Principles

Topical 1, Session 28b

Monday, March 22, 2010: 2:00 PM

Room 101 A/B (Convention Center)

Peter N. Lodal, Plant Protection Technical Services, Eastman Chemical Company, Kingsport, TN

Laurie A. Miller, American Chemistry Council, Arlington, VA

As part of its Responsible Care® Process Safety Code, the American Chemistry Council (ACC) has long 

supported the concepts of Inherently Safer Chemical Processes. In this paper, the authors will describe 

the ACC philosophy around the appropriate application of Inherently Safer Principles, including a 

discussion on the avoidance of risk-shifting, and the proper use of economic criteria in the risk decision 

making process. A number of examples from actual case histories will be included to illustrate the ACC 

approach.

* Adapted from the AIChE Website: http://aiche.confex.com/aiche/s10/webprogram/Session 14748.html (accessed July 6, 2010).
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

F-6

Table F-6. Abstracts for Inherently Safer Design/Inherently Safer Technologies: 

Topical 1, Sessions 28c-28d, Part II (cont)

Applying Inherently Safer Systems – Contra Costa County's Experience

Topical 1, Session 28c

Monday, March 22, 2010: 2:30 PM

Room 101 A/B (Convention Center)

Randall Sawyer, Contra Costa Health Services, Martinez, CA

During the 1990's, many process safety accidents occurred in Contra Costa County. Some of the impact 

of these accidents included the following:

• Six people died and two others were seriously injured in three separate accidents • Over 20,000 

people sought medical attention after one release and over 1,200 went to a medical clinic that was 

established after another accident • Millions of dollars in equipment damage and lost production.

The community and the County's Board of Supervisors were greatly concerned about the accidents and 

the trend of the accidents. In January 1999, the County's Board of Supervisors passed the Industrial 

Safety Ordinance. The ordinance expands on the California Accidental Release Prevention Program 

and the U. S. EPA's Risk Management Program and includes a requirement that covered facilities 

consider inherently safer systems.

This paper and presentation will discuss the experience of implementing inherently safer systems in 

Contra Costa County. This discussion will include the history on why the County's Industrial Safety 

Ordinance, which includes the requirement for implementing inherently safer systems, was passed; a 

definition of inherently safer systems and when inherently safer systems are to be applied; the initial 

problems with implementing inherently safer systems by the covered facilities; clarification of what is 

meant by inherently safer systems and when to consider inherently safer systems; auditing for inherently 

safer system implementation and results; examples of when inherently safer systems have been 

successfully applied; and the impact of the implementation of inherently safer systems.

Panel Discussion

Topical 1, Session 28d

Monday, March 22, 2010: 3:30 PM

Room 101 A/B (Convention Center)

Abstract: File Not Uploaded

* Adapted from the AIChE Website: http://aiche.confex.com/aiche/s10/webprogram/Session 14748.html (accessed July 6, 2010).
Appendix F

F-7

F.3 PARTICIPANTS

The DHS/CSAC/CCPS project participants listed in Table F.2 were present when the final draft 

definition of and discussion on inherently safer technology (IST) was presented at the Global Congress 

(March 22, 2010).

Table F-7. DHS/CSAC/CCPS IST Definition Project Participants at the Global Congress 

PARTICIPANTS ORGANIZATION

Kathy Anderson Vertellus

Steve Arendt ABSG Consulting

Iclal Atay NJDEP

Scott Berger CCPS

Dan Crowl Michigan Tech University

Vic Edwards Aker Solutions

George Emmett DHS-CSAC

George Famini DHS-CSAC

Brad Fuller AcuTech

Cheryl Grounds BP

Dennis Hendershot CCPS

George King Huntsman

Peter Lodal Eastman

Jack McCavit CCPS Emeritus

Sam Mannan Texas A&M

Shawn Moshiri Chevron

Tim Overton BP

Cathy Pincus ExxonMobil

Robin Pitblado DNV

Randall Sawyer Contra Costa County, CA

Roxy Schneider CCPS

Steve Selk DHS

Jatin Shah Baker Engineering and Risk Conslutants, Inc. 

Chicago, IL

Larry Stanton Infrastructure Security Compliance Division, 

DHS, Washington, DC

Kenan Stevick Dow

Karen Tancredit DuPont

F.4 SUMMARY

Inherently Safer Technology – Final Draft Discussion

Inherently safer technology (IST) is a philosophy - an approach to safety that focuses on eliminating or 

reducing the hazards associated with a set of conditions. IST is applicable through the entire life cycle and 

footprint of any system which manufactures, transports, stores, or uses hazardous materials or hazardous 

processing conditions. IST permanently and inseparably reduces or eliminates process hazards that must 

be contained and controlled to avoid incidents, rather than controlling those hazards by added-on 

protective equipment. While IST applies throughout the life cycle of a process, plant, or material, the 
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

F-8

greatest opportunities for significant IST benefits are early in the life cycle, before the technology 

becomes deeply integrated into the technology infrastructure of an industry from raw material suppliers 

through final product users, and before major investments in plant and equipment are made.

A material, process, or technology can only be described as ―inherently safer‖ when compared to a 

different material, process, or technology. This description must include the definition of the particular 

hazard or set of hazards which were considered in making the comparison. Thus, it is not appropriate to 

describe a technology as inherently safer than an alternate technology, with no further description. An 

appropriate description would be, for example, that the first technology is inherently safer than the 

alternate technology with respect to the hazard of acute toxicity of the vapor, and the hazard of 

flammability of the vapor. Note that this statement makes no judgment about the relative inherent safety 

characteristics of other possible hazards – the first technology may be inherently less safe than the 

alternate technology with respect to other hazards such as chemical reactivity, chronic toxicity, or 

potential for hazardous decomposition.

IST options can be location and release scenario dependent, and different potentially exposed populations 

may not agree on the relative inherently safety characteristics of the same set of options. For example, 

two options for handling a toxic gas might be receiving the material in 1-ton cylinders or 10-ton truck 

loads. To a population several miles from the site, the 1 ton cylinders would be inherently safer because 

the maximum potential release size is smaller and less likely to expose them to a hazardous concentration 

of the gas. But, operators who would now have to connect and disconnect 10 cylinders for every 10 tons 

of material used, instead of a single truck, would consider the truck shipments to be inherently safer. 

Thus, evaluation of IST options can be quite complex, and dependent on the local environment. There is 

currently no consensus on a quantification method for IST, and there is no scientific assessment for 

evaluation of IST options. 

Inherently safer design is a part of an iterative decision-making process for risk reduction. It is ongoing 

and continuous throughout the life cycle of a technology, from initial conception through 

commercialization, operation, and, when obsolete, shutdown and demolition. It should consider the entire 

footprint of the process – raw material sources and supply, impact on supply technologies, transportation, 

and impact on downstream users and their technologies, and ultimate material disposition. Evaluation of 

IST options for a particular plant, product, or other system must consider the overall effects of all other 

impacted systems – it is essential to understand the impact that a change in one technology will have on 

hazards and risks elsewhere in society. In particular, it is important to identify all such impacts and to 

make informed decisions on the best overall way to manage risk throughout society.

Risk reduction criteria will be determined by the nature of the hazards or threats, and will require 

consideration of conflicts among multiple hazards and threats. Tools for understanding societal 

expectations for risk management include national and local government regulations and other legal 

requirements, consensus codes and standards developed by various technical and trade associations, and 

internal corporate standards and requirements. The threshold of a major accident hazard of a major 

release, as well as security or vulnerability concerns such as theft of materials, contamination of products, 

and degradation of infrastructure must be considered. Hazard identification, risk assessment, and security 

vulnerability analysis tools are used to identify and characterize risk. Risk can be reduced by many 

methods, including inherently safer design, but methods must include the full spectrum of risk reduction 

approaches (passive, active, and procedural risk management systems). This is particularly true when 

considering the need to manage multiple hazards and risks – it is unlikely that any technology will be 

―inherently safer‖ with respect to all hazards, and other approaches will always be required to manage the 

full range of hazards and risks. Ultimately we must decide which hazards and risks we want to manage 

primarily with inherently safer design approaches, and which hazards and risks will be managed with 

other approaches (active, passive, procedural).
Appendix F

F-9

The inseparability of IST from the overall objective of the safe design and operation of hazardous 

material manufacturing, transportation, storage, and use is apparent when considering chemical security. 

An IST with respect to catastrophic release hazard from a fixed manufacturing plant may conflict with, or 

may not address other hazards, such as theft or diversion of materials, contamination of product, or 

degradation of infrastructure, or may create new security hazards.

The CCPS book Inherently Safer Chemical Processes: A Life Cycle Approach describes several levels of 

inherently safer design.3

―First Order inherently safer design refers to the identification of alternatives that 

completely eliminate a particular hazard. Note that, as discussed above, this does not say 

anything about the impact on other hazards, which may be increased, decreased, or 

remain unaffected by the change. An example would be using a water based paint to 

paint a room in your house instead of flammable solvent based paint, eliminating the 

hazard of exposure to low levels of potentially toxic solvents, and fire hazards associated 

with flammable solvent.

Second Order inherently safer design reduces the magnitude of a hazard, or makes an 

accident associated with a hazard less likely to occur, by the design of the equipment, 

and not through add-on safety devices. Again, this does not say anything about the 

impact of the change on other hazards, which may be increased, decreased, or remain 

unaffected. As an example of reducing the magnitude of a hazard, explosives such as 

TNT can be made in small continuous reactors containing a few gallons of material 

rather than large batch reactors containing thousands of gallons of material. As an 

example of inherently making a hazard less likely to result in an accident, if adding too 

much raw material to a vessel can cause a runaway reaction, this can be made inherently 

less likely by installing a feed tank that holds the exact amount of raw material required, 

and no more.

Layers of Protection include risk management equipment and management systems 

often categorized as Passive, Active, and Procedural. These layers include risk 

management features such as containment dikes to manage spills and leaks (passive), 

safety alarms and shutdown systems (active), and safety procedures and operator actions 

(procedural). When you consider all of the multiple hazards associated with any 

technology, it is unlikely that it will ever be possible to manage all of them inherently, 

and layers of protection will always be required as a part of the total risk management 

program. Inherently safer design concepts can be used to make these layers of protection 

inherently more reliable and robust.‖

Decisions on the appropriate overall risk management strategy will be a function of, and will consider 

potential conflicts and tradeoffs with:

Hazards

Likelihood of failure

Consequences to all potentially exposed populations

Other important risk considerations such as environmental impact

Impact on risk in other locations or sectors of the overall economy

 

3 Center for Chemical Process Safety (CCPS). Inherently Safer Processes: A Life Cycle Approach. 2

nd Edition, 

American Institute of Chemical Engineers/John Wiley & Sons, Inc., Hoboken, NJ, 2009, pp. 15-16.
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

F-10

Process and product supply chain and life cycle, including distribution considerations and 

final user considerations

Technical feasibility – may be location specific

Economic viability – may be location specific

Regulatory requirements – may be location specific.

FINAL DRAFT DEFINTION FOR INHERENTLY SAFER TECHNOLOGY

Inherently Safer Technology (IST), also known as Inherently Safer Design (ISD), permanently eliminates 

or reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to the 

design and operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an 

iterative process that considers such options, including eliminating a hazard, reducing a hazard, 

substituting a less hazardous material, using less hazardous process conditions, and designing a process to 

reduce the potential for, or consequences of, human error, equipment failure, or intentional harm. Overall 

safe design and operation options cover a spectrum from inherent through passive, active and procedural 

risk management strategies. There is no clear boundary between IST and other strategies. 

ISTs are relative: A technology can only be described as inherently safer when compared to a 

different technology, including a description of the hazard or set of hazards being considered, 

their location, and the potentially affected population. A technology may be inherently safer than

another with respect to some hazards but inherently less safe with respect to others, and may not 

be safe enough to meet societal expectations.

ISTs are based on an informed decision process: Because an option may be inherently safer 

with regard to some hazards and inherently less safe with regard to others, decisions about the 

optimum strategy for managing risks from all hazards are required. The decision process must 

consider the entire life cycle, the full spectrum of hazards and risks, and the potential for transfer 

of risk from one impacted population to another. Technical and economic feasibility of options 

must also be considered.
Appendix G

G-1

APPENDIX G: NOMENCLATURE

Table G-1. ABBREVIATIONS AND ACRONYMS

ABBREVIATION / 

ACRONYM DEFINITION

AIChE American Institute of Chemical Engineers

CCPS Center for Chemical Process Safety, formed by AIChE in March 25, 1985 

to develop process safety information, including guidelines and resources.

CSAC Chemical Security Analysis Center

DHS U.S. Department of Homeland Security

DHS/CSAC/CCPS U.S. Department of Homeland Security/ Chemical Security Analysis 

Center/ Center for Chemical Process Safety

EPA U.S. Environmental Protection Agency

EPA RMP U.S. Environmental Protection Agency Risk Management Program 

ISD Inherently safer design 

IST Inherently safer technology

IST/ISD Inherently safer technology/inherently safer design 

ISS Inherently safer systems or inherently safer design strategies 

OSHA PSM Occupational Safety & Health Administration Process Safety Management

SD safer design

U.S. United States
Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage and Use

This page intentionally left blank.
Appendix H

H-1

APPENDIX H: ABOUT CCPS

Just after midnight on December 3, 1984, water contamination of a tank of methyl isocyanate in Bhopal, 

India initiated a series of events that led to a catastrophic toxic release, killing more than 3000 residents 

and injuring over 100,000. 

In February 1985, leaders from 17 of the leading chemical and petroleum companies asked the American 

Institute of Chemical Engineers (AIChE) to lead a collaborative global effort to eliminate catastrophic 

process incidents by:

ADVANCING state-of-the-art process safety technology and management practices,

SERVING as a premier resource for information on process safety,

FOSTERING process safety in engineering and science education, and

PROMOTING process safety as a key industry value.

On March 25, 1985, AIChE formed the Center for Chemical Process Safety (CCPS) with charter member 

companies. In the years that followed, CCPS has been the world leader in every area of process safety 

information, with over 60 guideline and resource books in print, and an ever-growing web knowledge 

base. CCPS membership now exceeds 100 companies, headquartered in more than 15 companies in four 

continents and operating in every part of the world.

To contact or to learn more about the CCPS the following information has been provided:

View the CCPS book catalog: www.wiley.com/go/ccps

Learn about CCPS membership: www.aiche.org/CCPS/Corporate/index.aspx

Browse the CCPS Web Knowledge Base: 

www.aiche.org/CCPS/Resources/KnowledgeBase/overview.aspx

Attend CCPS events: www.aiche.org/CCPS/Conferences/index.aspx

Contact CCPS: ccps@aiche.org or +1.646.495.1372.