The One Plan – “A Winning Strategy”

A New and Improved Era of Emergency Management Using the One Plan and Automated System Controls to "Prevent Emergencies or Stop them SMALL”

December 11, 2009 by Gary Smith, President of the Ammonia Safety and Training Institute

Introduction: Consider this key question, the emergency is discovered and the operators and first responders will act...are they equipped and trained to act appropriately? The secret to operator and first responder success is going to be revealed in this paper using the "golden rules to emergency response". They are the critical drivers for engaging the One Plan. Engage these golden rules to response and rest assured that the trained operator and first responder will control ALL emergency events before ANY further life threat or serious damage occurs.

Background: The real and perceived threats associated with an emergency event tend to cause chaos and lack of strategic engagement by under-prepared operators and first responders. In most cases an emergency event will start as a small and controllable incident, sometimes occurring while doing service or maintenance on the system. A lack of proper operator and first responder readiness will reduce the effectiveness of engagement , a small incident that grows without emergency management mitigation will quickly evolve into a major emergency event within the first five minutes. The quick spread of a fire or hazmat release will cause stress, anxiety, and chaotic thinking by poorly prepared operators and first responders. If the emergency event proceeds with no implementation of a defensive strategy, the emergency can easily domino into a catastrophic event within the first 30 minutes. This phenomena is very likely to occur when the operator or first responder is victimized by the sudden release of a hazardous material or flash fire. They cannot see or breathe to engage action and survival becomes the priority. The emergency response effort focuses on rescue and treatment of the injured rather than control the emergency event.

The Problem: We have created a simple yet comprehensive overview the risks and threats with a three column table, two columns with "cause and effect" followed by one column dedicated to "preventative action".

The “cause and effect” table is laid out below as a visual explanation about why the One Plan readiness is valuable. The "Cause",  "Effects" and "Preventative Action" listed below are cumulative and build in intensity as you proceed down the table, each row (scenario) builds upon the previous, e.g. if Scenario 4 occurs the Cause, Effects, and Preventative Action listed in the other three scenarios all apply to Scenario 4 concerns.

Cause	Effect	Preventative Action
Scenario 1: Slow leak or odor of hazmat in the air	A need to recognize, report, and engage operator and first responder investigation	1. Pre-Emergency readiness in place 2. Availability of first responder mitigation - system control and fire extinguisher readiness
Scenario 2: Sudden release or fire resulting during service, maintenance or repair often due to failure to: 1. Use proper PSM precaution 2. Failure to abide by SOP - lock out, hot works, etc. 3. Undetected corrosion or stress crack failure 4. Lack of pre-emergency readiness 5. Careless behavior while performing high risk routine activities like defrost	Immediate impact on those standing within 15 feet of the release or fire - eyes, respiratory, and/or skin burns; those that are protected (eyes, respiratory and skin protection) are most likely available to engage control and containment of the problem. Those that are not protected require immediate access to eyewash and shower and emergency medical care; those trapped in the Hot Zone require rescue.	1. Proper PPE that protects eyes, respiratory, and total skin coverage 2. Eye wash and shower 3. Size up and report based upon LANCE acronym: Life safety in Hot Zone Alert facility responders Notify 9-1-1 Control/Contain - system and responder readiness to stop the problem small Escape, evacuation or SIP 4. When the operator is trained and equipped with PPE he/she may engage incidental control of the problem and/or rescue procedures.
Scenario 3: Sudden component failure from system failure while the operator is present	A Hot Zone area increases with risk and threat and the opportunity to control the problem lies in the ability to  engage quick action. The highest priority threats are for live safety in the hot zone and flammability (flash fire potential). Systematic control is available if trained responders engage 'defensive SIMPLE' strategy	1. Priority concern for clearing the Hot Zone, controlling flammability/flash fire, and warning the Protective Action Zone (500 to 1,500 feet downwind) 2. System controls to engage "defensive SIMPLE" Sources of ignition controlled Isolate the upstream and downstream flow Manage pressure - high side and low side protocols Pressurized ventilation - engaged with a downwind plan LANCE again - re-assess the hot zone and assure regulatory notification Emergency Response Plan - prepare an Incident Action Plan and Safety Plan
Scenario 4: Sudden component failure of major impact that may have catastrophic impact within a short period of time. The failure can range from a sudden uncontrolled fire, over-pressure failure, or release of hazmat.	The nature and degree of the problem will be dictated by the speed of recognition and the availability of automated control. The likeliness of a single catastrophic event is most likely during and after a major disaster such as an earthquake or from a long term undetected system failure that is occurs in a very poorly prepared and maintained system that is not equipped with proper system mitigations.	1. The priority for the first response remains on setting the Hot Zone perimeter and for assuring that life safety is accounted for within the Hot Zone. The second priority is to engage "defensive SIMPLE" to assure that flammability and flash fire potential is mitigated. The third priority is to assure personal accountability of all personnel in the downwind plume "Protective Action Zone" with priority on the first 500 to 1500 downwind where the levels of hazmat and smoke may still have potential to do serious harm e.g. under 750 ppm for anhydrous ammonia. 2. Public Safety and Facility response personnel must work together to develop an incident action plan and safety plan that assures a safe and methodical control or the problem. The management of the Protective Action Zone and assurance of mitigation of environmental mitigations in the downwind and downstream is a priority concern.

The Three Golden Rules to One Plan Readiness:

The first golden rule to "One Plan" readiness is to promote the importance of the responder action within the first five minutes. The operator and first responders MUST BE PREPARED by wearing proper personal protective equipment (eye protection, respirator, total skin coverage) while engaging a coordinated and well thought out service and maintenance action plan during the Pre-Emergency phase of an incident so that system controls and responder engagement is swift and well designed. The goal is to control the problem in the Incidental or Discovery phase and in most cases conditions should improve by the time the Initial Response phase is engaged. It is imperative that the first responder effectively engage LANCE, (Life safety in Hot Zone and downwind, Alert the facility responders, Notify 9-1-1, Control/Contain the problem, and Escape/Evacuate or SIP). This strategy "stops problems when they are small" and is the first secret to preventing the catastrophic impacts of an emergency event.

The second golden rule to One Plan success is to improve the safety and readiness for the operator and first responder so as to engage 'defensive SIMPLE' control within the first five minutes of discovery of the emergency incident.  The challenge is to reduce risk and threat by increasing responder access to system control measures without having to enter the Hot Zone.

The third golden rule to One Plan success is to provide a emergency plan that engages a phased approach to emergency management, starting with Pre-Emergency and Pre-Alert response and then engaging Discovery, Initial Response, Sustained Response, and Termination phases of response. The strategy developed between facility and public safety will be documented with detailed informational to support the potential Incident Action Plan and Safety Plans needed to engage effective emergency management. Emergency management guidance starts with "glove-box" check lists used during the Discovery and Initial Response Phases (30-Minute Plan and Emergency Guide Cards), and if the incident progresses to the Sustained Response Phase it will be supported with detailed emergency plans for the specific actions used to engage a written Incident Action Plan and Safety Plan developed during the latter part of the Initial Response and continued in the Sustained response phase. The Termination phase requires business recovery and regulatory compliance details needed to return to day-to-day operational effectiveness. The One Plan will be the source of training for all responders so that a transparency exists for all responders when engaging action during all phases of the emergency response experience.

Responder and System Control Readiness to Engage the One Plan

Automatic Emergency Management Control System: There is no doubt that most facilities can get more out of automated controls and detection systems to successfully manage emergency events. The technology exists to accomplish all that we need for preventing or stopping emergency incidents when they are small. The biggest missing link is the connection between the system controls and the operator and emergency responder's ability to engage those controls. The emergency control system should also provide the responder with critical information to engage life safety and control and containment action plans. The operator and first responder must be trained to use the system to engage a methodical and well thought out incident action plan. A well designed emergency control system must integrate the day-to-day programmable logistics controls, security systems, and the fire and gas detection systems so that ‘defensive SIMPLE’ can be quickly engaged.

Successful outcomes rely on the service readiness and capacity of the race car, race car driver, and the pit crew. A winning team is supported by an effective response plan and a raceway that is safe and well managed; fellow drivers abide by protocol and response safety. So it goes for the industrial team and public safety; responder skill and community safety requires an effective game plan and safety while dealing with the emergency event.

The metaphor that most closely resembles the operator/first responder challenge is that of a race car driver. The capabilities, service and maintenance readiness, and automated control systems that exist on the race track and in a race car allow for raceway speeds of over 200 MPH. When the car overheats or losses oil pressure the automated warning systems help the driver and pit crew to mitigate the risks and threats. Even more importantly when the race car driver uses the brakes or begins to lose traction while making a speedy move on a raceway corner he/she relies on the auto’s control systems to steer out of harm’s way. The race car driver is in continual contact with his pit crew who are the first responders for problem solving and emergency management.

The system operator and first responder to an emergency event must be prepared to engage system controls when trouble circumstances such as over-pressure, fire or release of hazmat occur. The action plan must be swift and appropriate to prevent a domino-effect, that if not controlled may lead to catastrophic results. In some cases automatic system control measures, like engaging fans, closing solenoid valves, and/or triggering excess flow valves help to control the problem. But emergency events like race cars bring on a series of complications that the operator/responder must figure out…the system controls require logic and analytic skill that a trained system operator and emergency responder must figure out.

There are several questions that must be asked when preparing the operator/responder to “steer the system out of harm’s way”. The following questions must have clear and achievable answers so that a new era of emergency response effectiveness will virtually eliminate injury, significant damage, and/or catastrophic loss!

1) How well trained are operators and first responders to engage emergency control systems? History proves that emergency control systems exist, yet the operators and emergency responders fail to use those controls to maximize the quick control options. For example the manual pressure control system we call “diffuser” or “ammonia dump” is an excellent tool to control over-pressure, yet it is rarely used during an emergency event because the operator and responders are not trained to use the system. Today the diffuser has been removed from the fire code considered to be an option that never really worked…but did we give it a fair chance for use? The One Plan for the ammonia industry and public safety must clearly explain how to use system controls to engage ‘defensive SIMPLE’ as a first step to emergency event control.

2) How do we access and integrate the many and varied control systems and mitigations that exist or are to be added to the system over time? The refrigeration control systems, security systems, and the gas and fire detection alarm systems operate independently on a day–to–day basis, and that’s appropriate. An emergency control system that engages system mitigations and gives critical information to the responders is vital for effective action plans. The emphasis should be on defining the hot zone, removing life threat from the hot zone, control explosion and fire threat and ensure accountability of people 500 to 1,500 feet downwind of the hot zone.

3) Are the system control measures set up so that the operator/responder can safely receive and utilize critical information and engage control systems to solve the problem? The information received and the method of processing that information to engage emergency control has to be set up so that remote operation (outside of the Hot Zone) can be accomplished. Remote access to views of the on-scene risks and threats as well as opportunity to remotely operate system controls helps to assure 24 hour per day, 7 days per week readiness.

Design of the system: The connection of the emergency control system to the PLC, security, and detection systems should engage the ASTI developed LANCE and SIMPLE protocols. The emergency control panel and PLC connection could be used to manage many types of emergency events; virtually any fire, overpressure, or release situations that are monitored at the control panel.

Pre-Emergency: When the operator and first responders are ready to respond the best chances of stopping problems when they are small exist. Pre-Emergency readiness is especially important when doing risky service, maintenance, repair and odor investigation.

Pre-Alert: The first level of notification (built into the alarm system) would occur with a "Pre-Alert" warning initiated with a push of a button and/or with automatic detection of 25 PPM of ammonia. The system would allow for digital and/or voice communications to those who are trained responders and systems operators. This would be a system where pre-alert concerns could be communicated to response staff regarding the concern of possible systems problems like over-pressure, minor leak detection (below 25 to 50 ppm) or dangerous service or maintenance is about to occur.

LANCE and SIMPLE: During the Discovery phase LANCE and the SIMPLE protocols are implemented. LANCE and SIMPLE also aids in developing effective Incident Action Plans during the Initial Response and Sustained Response phases.

 

Summary Design Criteria for System Controls for Each Phase of the Emergency Event

Response Phase	Mitigation	System Control Measure
Pre-Emergency and Pre-Alert	1. Pre-Emergency Readiness Form 2. Size Up Procedure 3. Mass Notification System Check 4. Emergency Control Panel Check 5. Operational oversight by those monitoring the event 6. Auto Notification for Pre-Alert circumstance	1. Responder Alert and Communications System - method of connecting key personnel to the status of the event; check in system for operator status and repair objective status report; remote system monitoring by Notification Team and those assigned to stand by for high risk maintenance readiness; digital and voice communications between command team and response team as they monitor the emergency situation (cell phone technology) 2. Pre-Emergency Readiness Form and related SOPs highlighting Primary and Secondary Exit, Closest Most appropriate eyewash and shower; recommend lock out, hot work permit concerns, and confined space locations (and permit requirements) - auto reporting to supervisor, safety manager, etc. 3. Monitor system pressures at key points (all vessels) and show the location of liquid ammonia 4. P&ID and Digital Pictures with key control valve locations; set up control scenarios for isolating tanks, pumps, compressors, condensers, and evaporators; highlighting possibility of trapping, hydraulic shock, or slugging of ammonia 5. System readiness report acknowledging the status of PHA, PSM, and Risk Management readiness; ASME code stamp for all tanks and safety relief status 6. Location of containment points (doors and openings) that would be used to confine a hazmat release or fire; show the ventilation flow and sources of ignition concerns 7. PLC Connection: Compressors, King Valve, Exhaust Fans, Liquid Pumps, Evaporator Fans, Evaporator Expansion Valves (isolate individual evaporators), Condenser Water Pump, Condenser Fans 8. All interactions accomplished on the Emergency Control System would be time-stamped and recorded for later reference 9. Pre-Alert notification system set up for quick alert and notification with a print out...either by push button or detection warning system
Discovery Phase	1. Incidental Control 2. Size Up and auto alert for Level I, II, and III response 3. Implementing LANCE 4. Mass Notification Begins for On-Site Challenges 5. Connection to ALOHA and Google Earth geo-files 6. Standard set of icon identifiers	1. Automatic Alert Warning and Communications System: Set up for an auto-notification for Level I, II, or III event; Tracking and communications for facility command team and emergency responders (on-site and off-site capacity) using the Size-Up Form to guide information exchange (auto-populated with monitored information); assure the communications link to key public safety responders; First reporting for corporate contacts - automated contact to those on the call-out list; Cell phone and house-phone connection to emergency hot-line communications targeted for on-site and off-site notified personnel (in the Protective Action Zone); provide a special line for corporate call in and emergency information communications; Regulatory notification warning with a auto-populated print out of report information that can be used by a person assigned to do notifications 3. Perimeter Monitors set at 50 PPM, 300 PPM, and 750 PPM; Hot Zone and Protective Action Zone recommendation maps; pre-load with high risk location information; Flank Measurement Formula for Protective Action Zone; connection to ALOHA software for long term plume prediction; connect to a weather station information system indicating wind direction, humidity, dew point and other weather data that would also auto-populate the ALOHA plume software to aid in getting quick plume model information develop a method for predicting the next 30 Minute growth pattern; map the environmental and geographical concerns for the flow of ammonia dense gas and vapor clouds; access control points and off-site gathering points need to be mapped and printed out. 4. Camera monitoring for high risk locations like the engine room and loading docks, and for locations where people will gather like SIP locations, and outside evacuation points 5. Escape, Evacuation, and SIP recommendations; including best gathering points, and escape paths; Connection for Reverse 9-1-1 and/or auto-dial messaging
Initial Response Phase	1. Defensive SIMPLE 2. Mass Notification Begins for Off-Site Challenges 3. Incident Action Plan and Safety Plan initiated	1. Sources of Ignition Identified/Controlled utility control plan showing the shut off procedure for electric, gas, and other forms of utility (from off-site to the circuitry for system components); Fire control plan – nearest extinguisher, fire wall and exit; fire and smoke spread prediction; construction failure concerns; recommended Protective Action Zone and tank failure prediction and safe distance stand off for emergency services; fire sprinkler controls, hydrant locations, high fire risk locations, smoke spread prediction and monitoring 2. Isolation valve recommendations for each component with warning for trapping, slugging, hydraulic shock warning 3. Managing pressure - recommendations for high and low side problems 4. Pressurized Ventilation – pre-designated ventilation plan and downwind plume and automatic ventilation control plan connected to ALOHA plume model 5. LANCE again – recheck alert to command team with an automatic and auto-populated regulatory notification form 7. Escape, Evacuate, SIP – movement plan and protective action zones and automated voice notification (covered in Discovery block) 8. Community Site Plan evaluation - plume model, check points, status board indicating the status of communication links and notification and accountability of downwind life threat concerns; streets and highway access control points 9. Incident Action Plan Form allowing for auto-population of checklist options for Overall Objective and Tasks 10. Safety Plan with auto-population of safety concerns such as zones/controls, personnel accountability, and high point concerns for safety checks
Sustained Response Phase	1. Written Incident Action Plan 2. Written Safety Plan 3. Long term consequences analysis 4. Technical support information	1. Site Map indicating zones and controls recommendations (icons for the following that can be plotted as the incident grows); Hot Zone, Warm Zone, Cold Zone, Protective Action Zone; location identifiers for: Decontamination, EMS, Rehab, Staging, Operations Section, Plans Section, Logistics Section, Finance Section, Branch leader, Division locations, Group identifiers 2. ICS Organizational Chart and Personnel Accountability System for monitoring command and entry team assignments 3. Technical resources: access to local, state and federal response plans; advanced information about the hazards and risks; auto-access and report information to a toxicological advisor (CTEH agreement) 4. Long term pre-loaded worst case scenarios gathered from the Risk Management Plan
Termination Phase	1. Business Recovery 2. Environmental Mitigation 3. Product Mitigation 4. Regulatory compliance 5. Debriefing 6. Reporting and cost accounting	1. Product temperature monitoring - estimated time before permanent damage occurs 2. Product contamination evaluation and disposal recommendations; estimated disposal load value 3. Contractor readiness and pre-qualification concerns; contractor recommendation for connection to get back on line 4. Amount of ammonia lost with downwind/downstream damage assessment report 5. Downstream monitoring 6. Ammonia neutralization 7. Estimated loss 8. Summary high point concerns 9. History report of timeline and conditions