Emergency Planning For Industrial Hazards - H.B.F.gow

EMERGENCY PLANNING FOR
INDUSTRIAL HAZARDS
Proceedings of the European Conference on Emergency Planning

for Industrial Hazards, organised by the Commission of the
European Communities (Directorate-General Environment,
Consumer Protection and Nuclear Safety (DG XI) in collaboration
with the Joint Research Centre (JRC) Ispra Establishment) and
held at the Congress Centre, Villa Ponti, Varese, Italy, 46
November 1987.
TECHNICAL COMMITTEE
A.AMENDOLA
A.BAUN
G.CAPRIULO
G.DEL BINO
CEC-JRC, Ispra, Italy

National Police, Denmark
Department of Civil Protection, Italy
CEC-DG XI (Chairman), Bruxelles,
Belgium
M.GENESCO
Ministry of the Interior, France
J.HEFFERNAN
Department of Labour, Ireland
R.KAY
Health and Safety Executive, Great
Britain
K.B.KRISTOFFERSEN Civil Defence Corp., Denmark
P.LAGADEC
Ecole Polytechnique, France
L.ALCON
Ministry of the Interior, Spain
H.J.PETTELKAU
Ministry
of
Environment
Nature
Protection and Reactor Safety, Federal
Republic of Germany
E.L.QUARANTELLI
Disaster Research Center, USA
A.SAMAIN
Ministry
of
Public
Health
and
Environment, Belgium
H.SCHNADT
TV Rheinland, Federal Republic of
Germany
J.NICOLAU
National Service for Civil Protection,
Portugal
MRS P.TESTORI
CEC-DG XI, Bruxelles, Belgium
G.VOLTA
CEC-JRC Ispra, Italy
C.J.VAN KUIJEN
Ministry of Housing, Physical Planning
and Environment, The Netherlands
M.VASSILOPOULOS
Ministry of the Environment, Greece
B.WYNNE
University of Lancaster, Great Britain
LOCAL ORGANISING COMMITTEE
H.B.F.GOW
MRS A.MANARA
CEC-JRC Ispra, Italy

CEC-JRC Ispra, Public
Press, Italy
Relations
and
iii
MRS M.P.MORETTI CEC-JRC Ispra, Public Relations

Press, Italy
T.SMYRNIOTIS
CEC-DG XI, Bruxelles, Belgium
and
EMERGENCY PLANNING
FOR INDUSTRIAL
HAZARDS
Edited by
H.B.F.GOW
CEC Joint Research Centre, Ispra
Establishment,
Ispra (VA), Italy
and
R.W.KAY
Formerly Health and Safety Executive,
London, UK
ELSEVIER APPLIED SCIENCE

LONDON and NEW YORK
ELSEVIER SCIENCE PUBLISHERS LTD

Crown House, Linton Road, Barking, Essex IG11 8JU, England
This edition published in the Taylor & Francis e-Library, 2005.
To purchase your own copy of this or any of Taylor & Francis or Routledges
collection of thousands of eBooks please go to www.eBookstore.tandf.co.uk.
Sole Distributor in the USA and Canada
ELSEVIER SCIENCE PUBLISHING CO., INC.
52 Vanderbilt Avenue, New York, NY 10017, USA
WITH 19 TABLES AND 39 ILLUSTRATIONS
1988 ECSC, EEC, EAEC, BRUSSELS AND LUXEMBOURG
British Library Cataloguing in Publication Data
European Conference on Emergency Planning for
Industrial Accidents.
Emergency planning for industrial hazards.
1. Chemical engineering plants. Accidents.
Emergency action
I. Title II. Commission of the European
Communities. Consumer Protection and Nuclear
Safety. Commission of the European Communities.
Joint Research Centre. Ispra Establishment.
Gow, H.B.F. Kay, R.W.
363.11966028
ISBN 0-203-21605-9 Master e-book ISBN
ISBN 0-203-27238-2 (Adobe eReader Format)

ISBN 1-85166-260-X (Print Edition)
Library of Congress CIP data applied for
Publication arrangements by Commission of the European Communities,
Directorate-General Telecommunications, Information Industries and Innovation,
Scientific and Technical Communications Service, Luxembourg.
EUR 11591 EN
LEGAL NOTICE
Neither the Commission of the European Communities nor any person acting on
behalf of the Commission is responsible for the use which might be made of the
following information.
No responsibility is assumed by the Publisher for any injury and/or damage to
persons or property as a matter of products liability, negligence or otherwise, or
from any use or operation of any methods, products, instructions or ideas
contained in the material herein.
Special regulations for readers in the USA
This publication has been registered with the Copyright Clearance Center Inc.
(CCC), Salem, Massachusetts. Information can be obtained from the CCC about
conditions under which photocopies of parts of this publication may be made in
vi
the USA. All other copyright questions, including photocopying outside the USA,
should be referred to the publisher.
All rights reserved. No part of this publication may be reproduced, stored in a
retrieval system, or transmitted in any form or by any means, electronic,
mechanical, photocopying, recording, or otherwise, without the prior written
permission of the publisher.
Preface
Recent events worldwide have again highlighted the need for

effective emergency measures for hazards connected with the
process industries and the large scale storage of dangerous
substances. The Commission of the European Communities, DG
XI, in collaboration with the JRC Ispra Establishment, has
therefore organised the European Conference on Emergency
Planning for Industrial Hazards in order to promote an exchange
of information on the current situation.
Within the European Communities, the Directive on the Major
Accident Hazards of Certain Industrial Activities (82/501/EEC)
requires that on-site and off-site emergency arrangements should
be made for certain potentially hazardous industrial activities.
However, the Directive does not specify the way in which these
objectives are to be achieved and one aim of the conference was to
discuss the approaches adopted by the different national
authorities and other organisations. The conference also provided
an opportunity to explore the considerable research effort which is
going on throughout the world on the improvement of systems for
emergency planning.
The conference was arranged in six main sessions which dealt
with organisational aspects, design of plans, exercises and
auditing, appropriate techniques, lessons learned from past
incidents and providing information for the public.
H.B.F.Gow
R.W.KAY
Contents
Preface
Opening Addresses
G.R.BISHOP
G.DEL BINO
Session 1:
vii
xiii
xv
Organisations Implementing
Emergency Planning
1.
Protection of Areas in the

Vicinity of Hazardous Industrial
Plants in the Federal Republic of
Germany
H.J.UTH
2.
The Italian Situation Concerning

the Monitoring of Industrial
Activities with Significant
Possibility of Risk and the
Availability and Application of
Associated Exterior Emergency
Plans
G.CAPRIULO and L.BINETTI
15
3.
Emergency Planning in the UK:

A View from the Inside
G.INNES
30
4.
Emergency Plans in France

R.GROLLIER BARON
41
Session 2:
On-Site and Off-Site Emergency

Planning Design
5.
Guide for the Establishment of

an Emergency Plan
J.BOISSIERAS
44
ix
Emergency Plan and Alert

System at MONTEDIPE
L.CORIGLIANO and
F.ANTONELLO
57
7.
On-site Emergency Plans

G.L.ESSERY
61
8.
Emergency Plans According to

the Law for Protection against
Catastrophes and On-site
Hazard Protection Plans
According to the Major Hazard
Regulations
W.STEUER
70
9.
Co-operation in Emergency
Planning
T.DICKIE
77
10.
Emergency Response Planning

Off-site of Chemical Plants
B.KIER and G.MLLER
82
11.
Industrial Emergency Planning

in The Netherlands
H.O.VAN DER KOOI and
H.K.VUYK
90
12.
Emergency and Intervention

Plans: The French Experience
M.GENESCO
95
Session 3:
Exercises and Auditing of

Emergency Planning
13.
Plan for Off-site Exercises

A.M.PARANHOS TEIXEIRA
102
14.
Exercise Study for an

Emergency of Chemical Origin
G.MACCHI, A.MORICI and
G.POILLUCCI
110
15.
Effective Organisation and

Incident Control
W.D.C.COONEY
127
16.
Assessing the Response

Capability and Vulnerability of
an Emergency Plan: Some
Important Issues
R.MAX-LINO, P.HARRISON and
C.G.RAMSAY
140
17.
Exercises and Auditing:

Experience Gained in the FRG
S.NEUHOFF
147
18.
Auditing and Exercising of

Emergency Plans for the Danish
Oil and Natural Gas
Transmission System, Including
Fixed Installations
H.HAGEN and P.JOHANSEN
154
Session 4:
Techniques for Emergency Plans

19.
The Computer Program TIGRE

and its Application to the
Planning of Chemical
Emergencies
A.SENY, B.SIGALS and
A.TRUJILLO
158
20.
Expert System Technology to

Support Emergency Response:
Its Prospects and Limitations
S.BELARDO and W.A.WALLACE
161
21.
Improved Emergency Response

after Release of Toxic
Substances: Application of the
System SMART
D.HESEL, H.DE WITT,
H.D.BRENK and A.G.KNAUP
175
22.
Emergency Management of a
Gas Escape
C.M.PIETERSEN
181
23.
Effective Emergency Planning

Design by Means of Risk
Analysis Models
190
xi
A.DONATI, L.LAMBARDI,
V.SICILIANO and E.SILVESTRI
24.
Major Industrial Risks:

Examples of the Technical and
Predictive Basis for On- and Offsite Emergency Planning in the
Context of UK Legislation
K.CASSIDY
196
25.
Decision Support Systems for

Emergency Management
V.ANDERSEN and
J.RASMUSSEN
211
Session 5:
Lessons Learnt from Emergency

Management of Major Incidents
26.
Experience Gained from Recent

Major Accidents in the Federal
Republic of Germany
S.NEUHOFF
235
27.
Community and Organizational

Preparations for and Re-sponses
to Acute Chemical Emergencies
and Disasters in the United
States: Research Findings and
their Wider Applicability
E.L.QUARANTELLI
242
28.
Experience Gained from the Oil

Pollution Control Operation at
Ls in 1985
F.LIND ARPE
267
29.
The Accident at DSM: Learning

from a Major Accident in The
Netherlands
M.J.VAN DUIN
274
30.
Lessons Learnt from Major Fire

Accidents in Greece
M.VASSILOPOULOS
285
31.
Organizational Learning from

Disasters
B.A.TURNER and B.TOFT
289
xii
Session 6:
Information to the Public Prior to

and During an Emergency
32.
Communicating Industrial Risk

in The Netherlands: Principles
and Practice
P.J.M.STALLEN
308
33.
Hazard Protection Measures in

the case of the Release of Toxic
Gases: Principles and
Description of the Concepts
W.HALPAAP
318
34.
Industrial Risk and Information

to the Public
R.GROLLIER BARON
325
35.
Requirements for the Planning

of Industrial Hazard Alarm
Systems with a View to the
Application of Modern
Communi-cation Systems
W.ULRICI and G.GUTMANN
334
Concluding Session: Panel Discussion and Conclusions

36.
Summary of the Concluding

Session
350
List of Participants
357
Index
369
Opening Address
G.R.BISHOP
Director of the Ispra Establishment, Joint Research Centre
It is an honour and a pleasure to welcome you as participants to

this European Conference on Emergency Planning for Industrial
Hazards.
As background to this event I remind you that the EEC directive
on major hazards for certain industrial activities (Post Seveso
Directive) imposes that Emergency Plans be prepared to mitigate
the consequences of major industrial accidents. I do not need to
regale you, the experts in these matters, with the steadily
lengthening list of accidents which serve to alert public opinion
and anxiety, but scarcely a week passes without some minor or
major alarum underlining the need for a fresh approach towards
effective actions.
Since the consequences of industrial accidents are rarely
confined to the location of their occurrence, and notoriously do
not respect even national frontiers, the intervention of the
Commission of the European Communities is natural and
desirable. The Commission has the task of formulating those
policies aimed at promoting the harmonious development of
economic activity within the community of Member States, a good
neighbours policy. Good neighbours do not throw their trash into
each others backyards!
As an initial step towards the definition of effective measures for
dealing with such problems the Commission decided to organise
this meeting at which experts can explain what their respective
countries and organisations are doing to cope with hazards in
their process industries. It was decided purposely to exclude
discussion on disasters in the nuclear field and in the transport of
dangerous materials; the former has been extensively ventilated,
especially after the Chernobyl accident; the latter will be treated in
another specialised conference to be organised later.
Within the Commission the appropriate bodies are DirectorateGeneral XI for Environment, Consumer Protection and Nuclear
Safety and Directorate-General XII-Joint Research Centre. In
xiv
broad terms the relationship between any DG and the JRC is that
the DG is the policy-formulating body which can call upon the
JRC for scientific and technical research support. Commission
policies thus guide the JRC in the orientation of its research
activities and in defining its priorities: these are not only the
establishment of the Internal Market and its corollary the
improvement of industrial competitiveness, but also the protection
of the environment and improvement of safety.
While the Commission is today the main client for JRC work,
this does not imply an exclusive recourse to the JRC in the
assignment of Community tasks. In fact the Commission has
adopted expert reccomendations that the JRC look for other
clients, by placing its specialised neutral and independent
scientific potential at the disposal of organisations or industries in
the Member States by means of research contracts, service work,
cooperative projects industrial clubs and other suitable means.
One of these means is illustrated by the present conference. In
February of this year (1987) a call for papers was made after
extensive publicity. Over one hundred papers were submitted and
a selection made by the Technical Committee (whose composition
is listed in the conference brochure) in Brussels last June for oral
or poster presentation in Varese. The Technical Committee was
chosen from Member State nominees, invited experts and staff
members of DG XI and the JRC. They chose 36 papers for oral
presentation and 11 for poster presentation. Similar care was
exercised in proposing the session Chairmen and the session
Rapporteurs to provide as large a representation as possible of the
Member States. Attendance also surpasses expectation since more
than two hundred registrations are made; there should be a
healthy interest therefore in the Conference proceedings which
will be published by Elsevier Applied Science Publishers Ltd.
I wish you a successful and fruitful conference and trust that
you will make durable new contacts or reinforce existing ones in
an endeavour to render in concrete terms the intentions of the
Commission policies.
Opening Address
G.DEL BINO
Head of the Division of Chemical Control, Industrial Risks and
Biotechnology (DG XIA/2), Brussels, Belgium
INTRODUCTION
I would like to welcome you today, to this European conference on
Emergency Planning for Industrial Hazards, organised by the
Directorate General for Environment, Consumer Protection and
Nuclear Safety and the Joint Research Centre in Ispra (Italy).
I must say that this conference could not have been timed any
better. Last Thursday over 20 000 people had to be evacuated from
their homes, near to Nantes (France) because there was a major
threat from a poisonous gas cloud as a result of a fire. Apparently
the fire broke out in an 850 ton storage silo containing ammonium
nitrate compound fertilizer, which then led to a yellow gas cloud, 5
km wide and 15 km long, moving at 7 km per hour, 250 metres
above the ground. Fortunately the wind direction was such that
the gas cloud was pushed towards the sea, so the heavily
populated city of Nantes was not at risk.
Furthermore, only a year ago last Sunday, early in the morning
of 1 November 1986 in Basel, a thousand tons of chemical
products caught fire on the premises of Sandoz, and in the
process of fighting the fire, somewhere between 10 and 30 tons of
chemicals were washed into the Rhinea major environmental
accident if there ever was one, never mind the health hazard, a
major accident can pose.
It has been said many times, and I believe it is worth repeating
here today, that the Sandoz accident has further confirmed the
need for international, and in particular Community, action to
prevent major accidents and to limit their consequences. This, of
course, implies the necessity, and where appropriate an obligation,
to have, to develop, to improve effective emergency measures both
for hazards connected with process industries as well as large
storage and transportation of dangerous substances.
xvi
THE DIRECTIVE ON MAJOR ACCIDENT HAZARDS

As you are well aware, the Directive on Major Accident Hazards
does request, in the notification to be submitted by the
manufacturer to the national competent authorities, information
relating to possible major accident situations, that is to say
emergency plans, including safety equipment, alarm system and
resources available for use inside the establishments in dealing
with a major accident.
On the other hand, the Directive also requires that the
competent authority, account being taken of the responsibility of
the manufacturer, is responsible for ensuring that an emergency
plan is drawn up for action outside the establishment in respect
of the notified industrial activity.
Thus, on-site competence for emergency planning is clearly the
responsibility of the manufacturer, while off-site emergency
measures are for the administrative authorities responsible,
whether they be local agencies, emergency services or regional or
central government.
EMERGENCY PLANNING
The planning and experience which went into the development of
the Directive on major accident hazards from all parties involved,
was not entirely comprehensive enough to foresee all the
problems, and furthermore, it was not appropriate to define all the
necessary technical and scientific standards and details with
regard to emergency planning. Thus, the Directive only establishes
the general requirement that both on-site and off-site emergency
planning measures should be taken, but it does not indicate the
procedure and ways in which the emergency planning should be
prepared and carried out.
ON-SITE EMERGENCY PLANNING
When the Directive was adopted in 1982, the Federal Republic of
Germany and the Netherlands had legislation on on-site
emergency planning. All the other Member States introduced new
legislation or are in the process of adopting it in order to comply
with the Directive in respect of on-site emergency planning.
Many Member States have already a substantial number of onsite emergency plans in operation and the Commission hopes that
xvii
in the near future, all Member States will develop such plans for
the industrial installations covered by Article 5 of the Directive.
Most Member States have had to introduce new legislation in
order to comply with the Directives provisions, since the Directive
not only requires site-specific emergency plans which protect
man, but also the environment.
The level of responsibility for drawing up a plan varies from
Member State to Member Statelocal, regional or central levels
while the competent authority may be an inspectorate (UK,
Ireland) or a committee (Luxembourg, Italy) or a governmental
department (Denmark, Greece, Belgium) or a local authority
(Germany).
CO-OPERATION AND COMMON UNDERSTANDING
The Commission does see an essential need for an exchange of
information, at Community level, on all matters concerning
procedure and scientific and technical aspects of emergency
planning. This is necessary in order to promote co-operation and
common understanding and appreciation of the difficulties
involved in planning emergency measures, and in the case of a
major accident, tackling the problems.
This will facilitate the development of common approaches
throughout the Community. However, the Commission believes
that it would not be correct or fruitful to turn its efforts towards
achieving a complete harmonization of the varied kinds of
emergency measures and of the different levels of authorities
involved in the various Member States of the Community.
IMPLEMENTATION OF THE DIRECTIVE
At the same time the Commission is looking for an effective
implementation of the Seveso Directive in all 12 Member States.
There are, of course, problems which are to be expected where
there are 12 different national realities and where administrative
practices, scientific and economic measures and development are
all rather heterogeneous.
We, in the Commission, struggle to ensure the implementation
in practice and in aiming to do this we undertake all kinds of
activities: regular meetings with national authorities, technical
workshops of national industrial inspectors, exchange of
information at all levels, legal, administrative and scientific,
research and training programmes, common data banks,
investigations to monitor the national and local situations.
xviii
However, this process only started a few years ago and we are
continually making progress.
Indeed, the idea for a conference of this kind arose out of
discussions in the Committee of National Competent Authorities
responsible for the Directive on major accident hazards. While the
Commission, together with this Committee, looks at the practical
and legal aspects, we look on the technical side to exchange
information and explore new ideas and avenues in order to
identify areas of possible future action.
As I look at the programme in front of me and all of you here
today, I am sure that over the next few days there will, indeed, be
interesting discussion, and fruitful ideas. Thank you, good luck.
SESSION I
Organisations Implementing
Emergency Planning
Chairman: A.BAUN
(Danish National Police, Denmark)
Rapporteur: H.B.F.Gow
(Joint Research Center Ispra, Italy)
1
Protection of Areas in the Vicinity of
Hazardous Industrial Plants in the
Federal Republic of Germany
HANS-JOACHIM UTH
Umweltbundesamt (Federal Environment Agency),
Berlin, FRG
1
INTRODUCTION
Spectacular industrial accidents, such as the ones in Bhopal,
Mexico City and Basle, have in recent times made the risks
associated with the modern chemicals industry unmistakably
evident. An analysis of events showed that when on-site safety
precautions fail effective emergency plans for the people living in
the vicinity of an installation become particularly important [13].
Emergency plans can be a matter of life and death. For quite
some time now they have been part of a comprehensive system to
protect areas in the vicinity of hazardous industrial installations
from the harmful effects which can result from a major accident.
The most important elements of this system were laid down in
the Regulation on major industrial accidents (Strfallverordnung
[4]; a regulation which implements on a national level the EEC
Directive 82/501/EEC, the Seveso Directive) which will be briefly
described here.
Neither the legal basis of the emergency plan system nor specifie
problems connected with it will be discussed here since this will
be covered in the course of the conference by other speakers from
the Federal Republic of Germany.
2
HAZARD ANALYSIS
In order to provide protection from risks it is first necessary to
know what they are. Man and the environment in the vicinity of
hazardous industrial installations can be endangered by fires,
explosions and/or the release of toxic substance.
ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 3
The potential hazard is directly linked to the specific properties

of chemical substances. This threat can become reality in the
event of uncontrolled release of such a substance. In order to
prevent this a number of on-site safety precautions are taken.
These precautions can, however, become less effective due to
interaction with internal and external influences (e.g. flooding,
earthquakes, explosions, fire).
In the event of accidental release of a dangerous substance the
consequences depend upon
the quantity released;
the dispersion behaviour of the substance;
the conditions in the surrounding area (e.g. population density,
state of the ecosystem).
A comprehensive analysis of the threat posed to man and the
environment therefore requires
identification of industrial installations using dangerous
substances and processes;
identification of the influences which can lead to uncontrolled
release of substances (hazard sources);
analysis of the structure of the area which could be affected.
2.1
Identification of hazardous industrial
installations in the Federal Republic of Germany
In accordance with the stipulations of the Seveso Directive the
actual scope of the Regulation on major industrial accidents [4] is
established by drawing up a list of the installations and
substances in question. Only installations subject to licensing
procedures, which are included in the list and in which
substances included on the substance list are handled or could be
formed in the event of an accident, are regarded as hazardous
installations. At present 17 types of installation are listed. The
substance list includes 142 individual substances as well as 3
groups of substances which comprise some 150 further individual
substances. The Regulation on major industrial accidents may
only be applied to installations in which the given substances
exceed a certain threshold quantity [5].
4 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS
2.2
Installation structure
In all, approximately 850 installations were registered with the
authorities (as of autumn 1985). This number corresponds to
approximately 15% of the total number of installations subject to
FIG. 1. Types of hazardous installation in the FRG; StVO refers to

Strfallverordnung (German hazardous incident ordinance) [4].
licensing in the Federal Republic of Germany under the Federal

Immission Control Act (BImSchG). The majority (99%) come under
the regulation due to the fact that dangerous substances are
present under normal operating conditions. In only 1 % of
installations are dangerous substances not formed unless a major
accident occurs (as was the case in Seveso). Of the installations
registered, the registration obligation was waived for around 10%
because their stock of dangerous substances was below the
threshold quantity laid down. Figure 1 gives an overview. Around
95% of all registered installations can be assigned to 4 categories

of installation. The proportion of installations which belong to the
chemicals industry heads the list with around 60%.
Approximately one-third of all installations which could be subject
to registration on the basis of the installation list are not
registered.
2.3
Categories of substances
Of the 145 substances/groups of substances (positions) which
could be subject to registration on the basis of the list of
substances, only 61 have been registered (approx. 43%); 50% of
the installations are registered under 5 positions, 85% under 20
positions (Table 1). Approximately 30% of all installations
registered fall into the groups of substances flammable gases and
highly flammable liquids. The major dangers connected with
these installations are fire and explosion. In particular, the
combination of toxic substances and substances which pose a fire
hazard, as present in installations in the chemicals industry and
the petroleum refining industry, can lead to moments of acute
danger in these installations [6].
Table 1 Relative placings of 20 of the most common substances
Appendix II, Accident decree [4].
FIG. 2. Average distribution of fire hazard substances in the chemical and

petroleum refining industry.
In the chemical industry, all substances listed in Table 1, with

the exception of explosive substances, have been registered. The
most frequently occurring substances are
chlorine (14%);
hydrogen sulphide (11%);
bromine (8%);
alkali cyanide (7%).
Figure 2 shows the ratio of the stocks of substances which pose a
fire hazard and those which are toxic in those installation
categories with the highest potential danger. This is based upon
the overall installation structure, not on individual installations.
FIG. 3. Average inventory in relation to the threshold B according to Ref.

5.
In view of the fact that the 850 installations registered under the
Regulation are located on only 150 sites, installations where there
is a fire or explosion hazard and those where there is a hazard
posed by toxic substances are often in close proximity to one
another. This must be taken into account when planning safety
precautions (domino effect).
An indication of potential danger is also the quantities handled.
It is estimated that some 30000 tonnes of toxic substances are
held in stock in the installations in question (not including

potentially toxic substances in the groups highly flammable
liquids and flammable gases). If one determines the mean
volume of substances per installation in relation to the threshold
quantity B (for a definition of B see Ref. 5) it can be seen that the
threshold quantity is in practice exceeded to a great extent
(Fig. 3). By definition this implies a high potential danger [7].
2.4
Distribution
The 850 installations are located at 150 sites. Those within the
chemicals industry are concentrated in the areas traditional to the
industry in North Rhine Westphalia, Hesse, Rhineland Palatinate
and Bavaria. Here there are often several installations in one larger
complex. The large storage plants for highly flammable liquids
are, in those cases where they are not operated directly by the
refineries, situated mostly in the northern regions of the country
(on the coast). Many individual installations outside the industrial
centres are distribution points for liquid petroleum gas [8].
3
SAFETY CONCEPT IN THE FEDERAL REPUBLIC
OF GERMANY
The first point to be considered is the substitution of dangerous
substances by innocuous or at least less harmful ones. This basic
approach has its roots in Germany in the federal legislation on
chemicals [9]; it will not be discussed in depth here but it should
nevertheless be seen as part of a comprehensive safety concept.
From the elements of a hazard analysis mentioned above, a
comprehensive, integrated three-stage safety concept was
developed, which formed the basis for the Regulation on major
industrial accidents (see Fig. 4):
Stage 1 includes all measures in the installation which assure
the safe containment of dangerous substances and the
prevention of inadmissible operating conditions.
Stage 2 brings together all measures designed to limit the
effects of fire, explosion or the release of chemicals,
which might occur as the result of a major industrial
accident.
Stage 3 includes the measures taken off-site to protect the
surroundings. They limit the effects of harmful
FIG. 4. Scheme of the 3-step security system.
Specification
Safe enclosure of inventory
Restriction of emission
Restriction of adsorption
Step
I
II
III
substances, heat radiation or the consequences of an

explosion on the objects to be protected.
In view of the fact that detailed safety measures are dependent on
the specifie requirements of the plant and its location, every
installation has to be regarded individually. This takes place in the
form of the safety analysis required by the Regulation on major
industrial accidents. In it all factors relevant to the safety of the
installation must be analysed and proof provided that the safety
obligations have been fulfilled. (For requirements regarding the
form and content of the safety analysis see Ref. 10.)
3.1
On-site safety precautions (Stages 1 and 2)
On-site safety precautions are designed to prevent major industrial
accidents from occurring or, if they do occur, to limit their effects.
The precautions can be of a technical or organizational nature.
Their basis is to be found in the technical compendium of
regulations which has to be taken into account when planning,
constructing and operating engineering plant. Included in it are
state regulations, e.g. the Commercial Activity Act
(Gewerbeordnung) and the Regulations issued under it, the
Federal Emission Control Act and its Regulations, the
Chemicals Act, the Dangerous Machinery Act, etc.;
regulations made by the employers liability insurance
associations (accident prevention stipulations);
regulations made by trade associations such as DIN, Vdt, VDI,
VDE;
internal regulations.
The safety aspects begin with the planning of an installation and
end with the organization of the operating procedure.
The amount of regulations depends upon the safety stage in
question. The density of regulations tends to decrease from one
stage to the next and general principles take the place of concrete
stipulations. Most problems are posed by the regulations in Stage
2, the limitation of the effects of a major industrial accident. Only
in exceptional cases is any mention made of this problem in the
technical compendium of regulations. The crux of the problem is
that a hypothetical accident has to be assumed in order to design
the parts of an installation correspondingly. Economic
considerations are an important factor here (cf. Ref. 2).
3.2
Off-site safety precautions (Stage 3)
In the event that the precautions taken under Stages 1 and 2 fail,
the dangers then posed to man and the environment can be
limited if precautionary measures are taken. This begins with
actions such as location of industry, i.e. separation of industrial
and residential areas, licensing of dangerous production plants
only if they are at a certain distance from residential buildings,
etc. These principles are laid down in the Federal Republic of
Germany in the Town and Country Planning legislation (see e.g.

Ref. 11).
Further precautionary measures are taken within the scope of
emergency plans which begin off-site. The relevant stipulations
within the technical compendium of regulations require alarm
plans to be established for the employees which include
descriptions of appropriate behaviour. In incidents in which
internal emergency plans no longer suffice to control the accident
off-site, emergency plans have to be implemented. The point at
which the responsibility of the plant operator ends and that of the
authorities in charge of emergency plans in the area surrounding
the plant begins must be accorded special importance. On-site
and off-site emergency plans must be carefully co-ordinated. Any
emergency plans must take account of the type of danger, e.g. fire/
explosion, release of toxic substances, etc. This means in
particular that suitable substances for extinguishing fires,
measuring equipment, first aid provisions, etc. must be readily
available. When drawing up plans, use can be made of the data
given in the safety analysis as prescribed by the Regulation on
major industrial accidents and of the description of possible areas
of danger which can be expected in the event of an accident.
For emergency plans to be effective the participation of people
living in the vicinity who could be affected by an accident at the
plant is essential. The local population must be prepared in
advance so that they would know what action to take in the event
of an accident. This necessitates honest explanation of possible
dangers and maybe involvement of the public in the plans [1214, 16
].
3.3
Flanking safety precautions
Experience has shown that it is not sufficient to issue safety
regulations and bans in order to achieve in practice an optimal
safety standard. Control instruments are also necessary, so as to
monitor whether the regulations are being adhered to, as well as
measures to increase the motivation of the employees to act in a
safety conscious manner (including training schemes).
There are various possible ways of monitoring adherence to the
regulations. They begin with the licensing procedure, in which
checks are made to ensure that an installation complies with the
latest technological developments, and extend to individual
assessments of the safety of special components.
The analysis of accidents is extremely important for the further

development of safety technology [15, 16]. This necessitates
provisions requiring the notification of accidents in industrial
installations. Work is being carried out at present to set up a
system for the central evaluation of these incidents.
4
EVALUATION OF CURRENT PRACTICE
Since the Regulation on major industrial accidents came into
force 6 years ago the discussion of industrial safety has intensified
and the safety concept behind the Regulation has started to be
accepted as a general principle. In particular, the obligation to
compile safety analyses which also applied to existing
installations
(those
already
in
operation
before
the
Regulation came into force) meant that all installations within the
scope of the Regulation were looked at from a safety point of view.
In the course of this process a number of defects were corrected.
In some cases the stocks of dangerous substances were reduced
and in other cases harmless substances were substituted.
Furthermore certain concrete principles of the Regulation had an
effect on other areas to which they were not formally applicable
(e.g. safety precautions for the storage of liquid petroleum gas. in
smaller quantities).
There are several problems of a legal and technical nature which
can be observed in practice regarding emergency plans. The local
and regional authorities bear the responsibility for disaster
precautions. Special precautionary plans for protection from
dangerous installations are the exception rather than the rule.
Apart from a few exemplary plans for large chemical works which
take special account of the specific dangers connected with
particular chemicals, it must be said that emergency plans are
often inadequate, especially in rural areas.
In many cases disaster control teams are ill-equipped and
inadequately trained. The necessity to make specific emergency
plans has not yet become generally accepted. This is particularly
true regarding the willingness to provide the public with frank and
comprehensive information and involve them in the establishment
of the plans.
As far as Town and Country Planning is concerned it must be
said that in older, traditionally evolved areas there is still often
insufficient separation of industrial and residential areas [17]. In
larger industrial complexes, any particularly dangerous plants are
situated as far away from housing as possible.
5
OUTLOOK
Recent experience with major or more minor accidents in the
chemicals industry has shown that the discussion about safety
and protection of areas in the vicinity of industrial installations
was not definitively concluded when the Regulation on major
industrial accidents was issued. These incidents have shown up
very clearly where the limitations of the Regulation lie. Whilst the
Regulations main aim was to protect society from acute dangers
(fire, explosion, pollution of the atmosphere by toxic pollutants),
these accidents have made it clear that the Regulation must be
revised to include protection of the ecosystems (water, soil) [18].
In particular, it would seem necessary to extend the scope of the
Regulation, to improve the stipulations requiring notification of
major accidents and to tackle the problem of compiling a
compendium of safety regulations which take account of the
specific nature of individual plants. Instructions should be issued
to the competent authorities to clear up the concrete difficulties
involved with implementing the Regulation on major industrial
accidents [19, 20]. In doing this, care must be taken to ensure
that the general principle of regarding systems as a whole and not
just a sum of parts must be adhered to in all stages of the safety
legislation, that the emergency plans and disaster precautions are
tailored to the specific (chemical) hazard, and that accidents which
are notified are systematically recorded and centrally evaluated in
order to be of use in the further development of safety technology.
The up-dating of the Regulation on major industrial accidents,
which is at present being undertaken in the Federal Republic of
Germany, and the compilation of instructions for the competent
authorities will contribute to better emergency plans for the
protection of areas in the vicinity of industrial installations.
REFERENCES
1.
2.
3.
4.
The Chemical Industry after Bhopal, International Symposium,

London, 78 November 1985.
UTH, H.-J. (1986). 1st Bhopal in der BRD mglich? Sicker ist Sicher,
37(6), 298306.
PIETERSEN, C.M. et al. (1985). Analysis of the LPG Incident in San
Juan Ixhuatepec, Mexico City, 19 November 1984, TNO-Dossier 8727
13325, 6 May.
12.
Verordnung
zur
Durchfhrung
des
Bundesimmissionsschutzgesetzes, 27.6.1980, BGB1.1, Nr. 32, Seite
772,1980, zuletzt gendert durch Verordnung zur Neufassung und
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
nderung von Verordnungen zur Durchfuhrung des BImSchG, 24.

7.1985, BGB1. I, Nr. 41, Seite 1586, 1985.
1. Verwaltungsvorschrift zur Strfallverordnung, 23.04.1981, GMB1.
(12), 32, Seite 178, 1981.
LEES, F.P. (1980). Loss Prevention in the Process Industries,
Butterworths, London.
SCHFER, K. Kommentar zur Strfallverordnung, Kohlhammer.
DEUTSCHER FLSSIGGASVERBAND eV (1986). Jahresbericht
1985, Kronberg.
Gesetz zum Schutz vor gefhrlichen Stoffen (Chemikaliengesetz), 16
September 1980, BGB1. I, Seite 1718, 1980.
2. Allgemeine Verwaltungsvorschrift zur Strfallverordnung, 27 April
1982, BMB1, Ausgabe A, Nr. 14, Seite 205, 1982.
Abstnde
zwischen
Industriebzw.
Gewerbegebieten
und
Wohngebieten im Rahmen der Bauleitplanung Runderlass v. MAGS,
25.7.1974/2.11.1977 MB1. NW Seite 1688/SMB1. NW 280, 1978.
ALBRECHT, H.G. (1981). Sonderschutzplnewarum und wofr?
ZS-Magazin, November, p. 17.
METREVELI, S. (1976), Katastrophenstrategie und Partizipation. 18.
Deutscher Soziologentag, 28.91.10, Bielefeld.
CLAUSEN, L. et al. (1983). Einfhrung in die Soziologie der
Katastrophen, Bonn.
KUHLMANN, A. (1981). Einfhrung in die Sicherheitswissenschaft,
Vieweg und Sohn, Kln.
GREEN, A.E.(Hg.) (1982). High Risk Safety Technology, John Wiley.
INSTITUT FR LANDES- UND STADTENTWICKLUNG NORDRHEIN
WESTFALEN (1981). Abstandsregelung in der Bauleitplanung,
Dsseldorf.
BUNDESMINISTER
FR
UMWELT,
Naturschutz
und
Reaktorsicherheit (Hg), Rhein-Bericht, Umweltbrief Nr. 34, 12
February 1987.
UTH, H.-J. (1986). Probleme bei Sicherheitsanalysen, gwf-gas/
erdgas, 127(6), 229.
UTH, H.-J. (1987). Sechs Jahre Strfallverordnungsind
Chemieanlagen sicherer geworden? Gewerkschaftliche Umschau, IG
Chemie-Papier-Keramik Nr. 2/3, Seite 10.
2
The Italian Situation Concerning the
Monitoring of Industrial Activities with
Significant Possibility of Risk and the
Availability and Application of
Associated Exterior Emergency Plans
G.CAPRIULO
Ministry of Civil Protection, Rome, Italy
&
L.BINETTI
Ministry of Public Health, Rome, Italy
1
INTRODUCTION
There are about 100000 chemical substances on the market. Of
these, however, about 10000 are of great importance from the
point of view of quantity, production and use at the industrial level,
and many of these present greater or lesser danger to man and
the environment. This really high number gives an idea of the size
of the problem presented by the production, employment, use and
elimination of chemical substances. It is thus necessary for the
risks that they present to be evaluated at different levels, to
identify the conditions of acceptability without prejudice to the
preservation by the health authorities of man and the
environment.
Until fairly recently the presence and use of chemical
substances were accepted passively, often without knowing either
their characteristics and properties, or even their suitability. The
awakening of a critical knowledge has sometimes led to reactions
which are extreme and not at all rational, with a very strong
emotional component. On the other hand, insufficient industrial
prevention produces or has encouraged, in some cases, the
occurrence of chemical accidents which have sometimes caused
irreversible damage. All this required and continues to require the
need for man to be able to live with these sources of activity and
of progress.
In the past, consideration has been given almost entirely to the
benefit derived from the use of chemical substances, without also
taking account of the consequences of damage, which have

sometimes been catastrophic. For several years, however, an
attempt has been made to redress the balance by evaluating the
risk which the production and use of a chemical substance might
cause.
Chemical substances are therefore of prime importance in the
programmes of the CEC and also Italy, and during recent years
important and concrete initiatives have been set up including, in
the first place, the CEC Directive 82/501 which has recently been
modified by Directive 87/216.
2
DIRECTIVES 82/501 AND 87/216 OF THE CEC
These represent the standards which the CEC has adopted to
prevent and deal with important accidents. The directives have
two aims:
to detect, as soon as possible during the initiatives design
phase, the probability of accidents which could occur, by
conducting research into possible causes, the identification of
critical points, the prediction of combinations of events which
could lead to accidents, and the introduction of associated
safety measures;
to prevent any accident that occurs from having disastrous
consequences, by adopting the safety and control measures
which are indicated in the emergency plan.
To summarise, the Community standards treat the problem of
industrial risk with a single approach and envisage two different
phases, i.e. the prediction and prevention phase and the phase of
emergency action in the case of an accident.
3
PREDICTION
In this respect the community standards mentioned above have
fixed a series of objectives to be achieved, and have also indicated
some general principles to be followed. The practical application of
these principles is, however, left to the initiative of the various
member States who will make their own choice depending on the
interior structures available.
The choices made in Italy have been dealt with in a coordinated
programme according to which, following successive stages which
are linked together, one must arrive, in a reasonable time, at

complete monitoring of the entire industrial sector involved in the
problem of the risk of serious accidents. The stages of this
programme are as follows.
3.1
Identification of the national list of industries
concerned
The programme was started in February 1985 with two different
procedures, one based on a system of self-declaration by the
industries which took place under the control of the Ministry of
Public Health, the other based on the direct collection of data from
industries identified with the banks available at different central
and local public offices, which took place under the control of the
Ministry of Civil Protection.
All the data collected (which are relative to about 10000
industries) have been examined, evaluated and finally divided into
three different lists:
List A collects together all the industries which perform
activities of deposition and/or production in the
installations indicated in Appendix I of Directive 82/
5101 and which use the substances listed in Appendices
II and III of the directive but in quantities greater than
the levels indicated.
List B collects together all the industries which perform
activities similar to those of list A but where the
quantities of substances are lower than the same levels.
List C collects together all the other industries which have
provided data.
The overall response obtained was considered satisfactory; in fact,
by using other sources of information available, it was very close
to the real national situation.
At present the list is being revised to take account of the
modifications made with Directive 87/216. At the end of this last
procedure the list may be conclusive and in line with the needs
which it must control. In any case one should remember that for all
undeclared situations the penal code will be applied. In this
respect a programme of inspections is underway which is being
organised in coordination with the central and local public State
organisations.
3.2
Risk maps
Using data from the list, it has been possible to define the first
risk maps which take into account all of the most dangerous
industrial activities, i.e. the activities covered by Article 5 of
Directive 82/501.
3.3
Safety reports
As they form the fundamental knowledge base for the definition of
the external emergency plans, this programme has been given the
biggest impulse in considering also the technical requirements of
industries. As a result, in September 1986 each industry involved
was asked to prepare, within a year, safety reports for all the
industrial activities to be notified. To facilitate this procedure and
make the various reports homogeneous, an appropriate technical
guide was made available to all the industries.
3.4
Evaluation of the safety reports and
classification of the industries depending on
their risk level
The safety reports are being examined by the Italian public
authorities, according to a programme which has fixed priorities
for the most dangerous situations either because of the complexity
of the installations or because of their proximity to an inhabited
centre.
The verification programme must finish as quickly as possible;
in any case it is predicted that it will be complete by July 1989. At
the conclusion of this examination, as well as having available a
complex series of data and technical information, a final
judgement will be given which will apply, in general, the following
cases:
(a) The industrial activity is acceptable from the point of view of
interior and exterior safety.
(b) The industrial activity is not totally acceptable but may be
made to conform to acceptable levels with the introduction of
new measures.
(c) The industrial activity is not compatible with the place, and
consequently must be closed and/or moved.
3.5
Industrial activities with no obligation of
notification (Articles 3 and 4 of Directive 82/
501)
While for activities to be notified the CEC directive has laid down a
series of actions which allow the public authorities to have
available, according to the case, all the useful information, for
those covered by Articles 3 and 4 the situation is less well defined.
As the ratio of these activities to notified activities is roughly 10:1,
one can easily see the importance of being able to bring them
under uniform control. In fact these activities are included in the
areas where there are almost always activities to be notified too.
Considering that emergency plans must be set up for these
activities, it would be a good idea to know about all possible risk
sources which could have some effect.
The Italian authorities are therefore in the process of deciding
on a programme for the monitoring of the safety of all industrial
activities covered by Articles 3 and 4 of the directive. In this
programme, which should come into force on 31 July 1989, a
simplified procedure has been laid down according to which each
industry, after having evaluated all the installations concerned,
must establish if it is
(A) included in the field of application of Articles 3 and 4 of
Directive 82/501; if this is the case it must be established if
the greatest existing risk
is limited to inside the establishment,
could also affect the outside;
(B) not included in the field of application of Articles 3 and 4.
A formal communication must be sent to the public authorities.
4
PREVENTION
When each safety report has been examined and evaluated, it will
then be necessary, first of all, to adopt all the measures, which
could differ from case to case.
If the activity is considered incompatible at the internal and
external safety level, measures for closing it and at the same time
for providing economic support must be adopted. The possibilities
of moving it to a more suitable place must also be evaluated on

the technical and policy level.
If the activity is compatible with the territory but the safety level
is not considered sufficient, then a series of appropriate technical
measures must be adopted which the industry must satisfy within
an appropriate period.
Only after this complex programme has been completed will it
be possible to define the external emergency plans with the
precision necessary.
5
THE EMERGENCY PLANS
The obligation to furnish external emergency plans for the
industrial activities, which are covered by Art. 5, CEC 501/82, is
the responsibility of the Prefects, as is that of giving the necessary
information to the public. Such plans must be based on
(a) elements contained in the safety reports on the evaluation of
security, on their evaluations and on the measures
consequently adopted;
(b) the elements deduced from simplified communications laid
down for industries which are not at high risk according to
Articles 3 and 4 of CEC 501/82.
As has already been said, both phases of the survey programme
will be completed in July 1989. While it is being carried out, a
national sectorial plan called CHEMIC has been prepared to come
to the aid of the public and the environment in the case of a
disaster due to industrial risk; it provides a framework for
provincial and local plans.
The CEC directive refers only to certain categories of industry
(chemical, petrochemical, release of solid or liquid substances by
combustion or chemical decomposition, treatment of energy
gases, dry distillation of coal and lignite, production of metals and
metalloids, and gas and inflammable liquid depots). The CHEMIC
plan also considers power stations, the manufacture and storage
of explosives, powders and munitions, installations for the
disposal of toxic or dangerous wastes, extraction activities and
other mining activities.
In the range of industries mentioned above, the CEC directive
only considers the activities of transforming and handling toxic
substances, and their storage inside and outside the
establishment. The transport of these goods is, on the other hand,
governed by the RID (International Regulation for Railways), by

the standards of the European agreement (ARD) stipulated at
Geneva in 1966 for road transport, by the International Code of
IMCO (Intergovernmental Maritime Consultative Organisation, not
ratified by Italy) for sea transport, and by IATA (International Air
Transport Association) standards for air transport.
FIATA has created FIAT-SDT (shippers declaration for the
transport of dangerous goods), common to any type of transport
which is the direct responsibility of the compiler, who is the most
appropriate person to warn the carrier against the dangers which
the goods described may pose to people or things.
The transport of dangerous substances through oil and gas
pipelines, following losses or breaks, may lead to pollution of
watercourses, lakes and pools, or explosions.
The accidental or deliberate pouring of hydrocarbons into the
sea or the leakage or destruction of containers of toxic substances
into the sea because of shipwreck may cause pollution of beaches
and territorial or international waters. Law 979/82 was passed to
defend the sea from pollution. The general criteria to be followed
when drawing up and organising plans are well represented by
clarity and conciseness;
flexibility;
involvement of all public organisations;
revision and updating of emergency management;
concrete definition of tools for emergency management.
From the operational point of view, it laid down
(a) procedures:
definition and location of forces available;
mode of intervention;
criteria of use;
hierarchical organisation;
human resources and materials available;
(b) intervention phases:
pre-alarm;
alarm.
The following emergency actions are laid down for accidents which
occur in various situations:
(a) At establishments or depots:

evacuation, if necessary;
isolation of the zone (police, etc.);
containment (fire services, etc.);
re-establishment of road and rail networks (ANAS and
FFSS);
protection and re-establishment of water supplies and public
services (bridges and embankments, municipal enterprises,
ENEL, SNAM, etc.);
demand for consultation with experts, specialised actions,
analysis of the help of intervention by firemen.
(b) In means of transport; oil and gas pipelines:
as in the preceding case;
the technical action of plugging and non-pollution will
mainly be the responsibility of the manager.
(c) At sea or in ports:
The harbourmaster has primary responsibility for actions.
He will act with his means and with those of the fire services
and other administrations who have the necessary means,
and will thus proceed to
isolate the zone;
chemically identify the dispersed substance;
take samples for analysis on the surface and in the pool;
stop the drinking water supply if necessary;
contain, absorb, recover, or dispose of the pollution where
possible;
neutralise it chemically where possible;
set up temporary dams, floating barriers or other forms of
barrage;
in the case of pollution which is lighter than water and which
does not mix with it, suck the surfaces with pumps and
drainage pumps;
clean the beaches;
use chemical or other solvents;
put health regulations into practice by advising the public
and giving instructions for behaviour;
protect agriculture and livestock.
In addition to these general standards, initiatives are underway to

set up a global approach for certain areas where there are
important industrial installations which involve dangerous
activities not covered by the CEC directive. This particularly
concerns potential areas where the risk factors are aggravated by
the movement of dangerous goods by sea and by land and by the
existence of a pipeline.
6
DATABANKS
To guarantee rational, suitable and efficient action in the case of
an emergency, the Civil Protection Department uses a specific
service, the CASI (Centre for the Application of Software Studies)
which has a data processing centre. It manages the hardware
which comprises two computers, graphic equipment and
terminals, and the software which includes the departmental data
bank and the mathematical models.
Many systems are already in operation and others are being
developed.
Those already in operation and which are of particular interest
for industrial risk include
(a) The data bank at the local level which collects together, for
the 8050 Italian local authorities, some hundreds of items of
information, either statistical or related to resources.
(b) The risk source data bank which collects together
information from surveys performed by the CPD (or for the
CPD) on dams or barrages, high risk industries, the disposal
of toxic wastes, debris, etc.
(c) An automatic map-drawing programme which can create
thematic maps using certain programmes.
(d) A meteorological model which is used to provide, in real time,
a spatial distribution of temperature, humidity etc., by
introducing, on a statistical basis, the data detected by the
MA (Military Aviation) meteorological stations.
(e) An assistance model on the basis of a diagram reproducing
the road network schematically and, on the basis of a stored
distribution of resources, which is used to evaluate the needs
for assistance by locating the nearest available resources and
suggesting the best route for the arrival of assistance.
Under development are
(a) The perfection of area data bases already available, and the
report of all the data no longer by administrative unit (Local
Authority) but by a specific geographical point referred to by
its coordinates.
(b) An accident and event data bank, which records and
processes all the news on accidents and events in Italy and
abroad which are of interest to the CPD (Civil Protection
Department).
(c) An accident data bank when catastrophic events occur,
which allows deduction from files on site, thanks to portable
processing systems, of the number and type of people injured
following a catastrophic event, and management of health
and logistics assistance for them.
(d) The development and improvement of existing models;
seismic models, assistance models, and meteorological
models are systematically updated and adapted in the light
of experience acquired when real events occur.
(e) Liaison with data banks of all the administrations of the
State concerned in the emergency, and in particular with the
Health Ministry (availability of health structures) and with
the Superior Health Institute (dangerous substances data
bank), is being planned or set up.
7
CIVIL PROTECTION STRUCTURES
The organisation of Civil Protection at the central level is made up
of a Department of the Presidency of the Council of Ministers
which is responsible for coordination; it has no special personnel
or budget and is the only example of a State organisation which
acts by function and not by subject. Now a Minister for the
Coordination of Civil Protection has been appointed.
This department includes
(a) The Cabinet Office.
(b) The organisations which assist the Minister in his activity:
EMERCOM (Operational Committee for Emergencies); the
Health Commission; the Committee for voluntary activities;
the Coordination Committee for activities concerning safety
in the industrial sector.
(c) Four services: Coordination; Public Works; Budget and AAAA;
Emergencies.
EMERCOM plays a particular role. It coordinates the

administration of all the organisations and the emergency service.
The emergency service has the task of ensuring rapid action and
assistance to people affected by catastrophes; it puts the
Ministers orders into practice and looks after liaison with the
scientific organisations which monitor major risks using the
following operational services:
(a) The CESI (Situation Centre) formed of a group of operators
which receive and evaluate news 24 hours a day, inform
Department heads of events which are occurring, respond in
the first instance to safety requirements, and maintain
contacts with regional and provincial operation rooms; it has
a telecommunication centre which has telephone links pointby-point (armed forces, Carabinieri, Minister of the Interior),
normal telephone links, links by radio (fire service, ham radio
operators, etc.) and telex links (RAI, press agencies).
(b) The COAU (Unified Air Operations Centre) which directs
assistance by air, particularly by aeroplane, for fighting
fires.
(c) The COEM (Sea Emergency Operations Centre) which
coordinates and plans action at sea in the case of serious
pollution or an aeroplane accident.
(d) The Sanitary Emergency Service which deals with the
sanitary aspects of each event.
(e) The CASI, which has already been described.
Organisations subordinate to the Department help in the
coordination of actions:
(a) Ministry of Defence*
(b) General Command of Police and Financial Agents
(c) Police
(d) Fire Service
(e) Ministers
of the Interior* (i.e. responsible for the Prefectures, Police,
Fire services, etc.)
of Transport* (i.e. responsible for bridges and embankments,
railways, State water services, public works, the road
network)
of Education (i.e. responsible for the Academies)
of Industry and Commerce (i.e. responsible for Provincial
Work Offices and the Regional Work Inspectorate)
of the Environment
of the Merchant Marine (i.e. responsible for the harbour
masters)
of Post and Telecommunications* (i.e. responsible for the
Directorates of Post and Telegraph, national companies for
telephone services)
of Agriculture and Forests*
of Health* (i.e. responsible for national health structures)
(f) Associations of Volunteers:
International Red Cross (IRC)
Ham Radio Operators Centre (CER-ARI)
Italian Alpine Club (CAI)
Caritas
Sovereign Military Order of Malta (SMOM)
(g) the large service companies such as
ENEL (electricity);
SIP (telephones);
SNAM (national company for water and gas supply=ENI);
etc.
The peripheral Civil Protection organisation is formed of
(a) At the Regional level: the person regionally responsible for
civil protection and the Regional Operations Centre.
(b) At the Provincial level: the Prefect and the Provincial
Operations Centre.
(c) At the Local level: the Mayor and the Local Operations
Centre.
From the operational point of view, in the case of an emergency,
the peripheral structures of organisations described above go into
action each with prescribed tasks.
* Ministers who have their own representatives in EMERCOM.
8
CIVIL PROTECTION TODAY AND THE SNPC
ACCORDING TO THE DRAFT BILL BEING
EXAMINED BY PARLIAMENT
The standard is applicable to four main groups:
1. The first is represented by the Minister of the Interior (Law
996/70, DPR 66/81) and concerns all the situations which involve
serious damage or danger for people and goods. The Minister of
the Interior takes charge, through the Prefectures, of emergency
and helping services, assistance for people affected by natural
catastrophes or accidents, whether they are the responsibility of
Regions or other institutional organisations or whether they are
the responsibility of the Minister for the Coordination of Civil
Protection when he decides to intervene with extraordinary
powers.
2. The second group is at the Ministry of Health and the
Ministry of Labour (TU LLSS 1934, DPR 303/56, L.833/78 and
DM23 December 1985). They deal, in particular, with health and
safety in places of work. In particular the TU of 1934, in Articles
216 and 217, classifies industrial installations which produce
vapours which are unpleasant and dangerous to general health in
two groups: those which belong to the first must be sited in areas
away from inhabited centres; those which belong to the second
must satisfy special conditions. The authorities may refuse
authorisation for the setting up of installations or impose special
conditions. In any case the installations must be constructed
respecting numerous standards which concern the environment,
activities and fire.
Art. 24 of Law 833/78 delegated the Government to issue a
Unique Text on the subject and laid down the directives to which
the exercise of the procural must conform. In this case it covers
all the aspects concerning ndustrial risk, such as the unitary
character of the safety objectives in the place of work and life.
The following have been prepared: updating of standards;
training courses; procedures for monitoring the safety of the
environment and the state of health of workers; obligations and
responsibilities concerning the use of materials; checks and needs
of the working environment; productive programming; monitoring
procedures; precautions to be adopted to avoid internal pollution
which, as well as external, can be caused by chemical, physical
and biological poisoning factors; criteria and ways of acting when
there is a serious and imminent risk; ways of producing, selling
and using dangerous products; special procedures for specific
risks; ways of determining and updating limiting values for

noxious factors, the temporary standards which already exist for
industries; reorganisation of public offices and services
responsible for safety at work; coordination between State and
territorial organisations and the definition of problems of
standardisation.
However, the procural has twice reached expiry and must be
renewed. Article 32 of the same law lays down that the Health
Ministry, the President of the Regional Court and the Mayor may
issue contingent and urgent orders on hygiene, public health and
veterinary policy, with greater efficiency than national, regional
and local authorities.
Finally there is the DM of 23 December 1985.
3. The third group concerns the decisions taken by the Minister
for the Coordination of Civil Protection who, having exceptional
powers, coordinates all the public administrations, organisations,
institutes and voluntary organisations for preparation in case of
emergency, on the site of the emergency, which because of its
seriousness and extent cannot be tackled by the administrations
in the field of their ordinary competence. In this case the Minister
may himself take charge of action against the emergency.
The Minister also presides over the committee which coordinates
the security activities in the industrial sector created with CPDM,
on 18 Dec. 1985, with the task of: analysing the risk situation and
of drawing up safety reports, risk cards and internal and external
emergency plans; setting up organisations for the prevention,
control and monitoring of industrial installations; checking safety
reports and emergency plans; encouraging Regions and
Prefectures to adopt uniform criteria in the development of
administrative action, training of personnel and safety of places of
work. The Commission created by the DM of 23 Dec. 1985 of the
Health Ministry, which has the same aims, must work as part of
this committee.
4. The fourth groups concerns the CEC directives. Those
concerning wastes (445/75 and 319/78) have been received (DPR
915/82 and Order of the Interministerial Committee in Art. 5 of
the same DPR) and those which concern industrial risk (501/82
and 216/87) have not yet been received.
Overall, therefore, Civil Protection is a pyramid-shaped
structure with territorial base, divided into successive channels,
which come into action by steps, starting from the local step, to
satisfy each need of people affected by an event, in relation to the
nature and gravity of this event.
If such an event becomes a disaster or a catastrophe, and if the

resources prove insufficient to satisfy demand, a State of
Emergency is declared. As has already been said, the Minister for
the Coordination of Civil Protection assumes responsibility for
action; the power of the orders is put into action for him and he
can use the Fund for Civil Protection.
The Unified Text of the draft law presented on 5 Feb. 1982 by
Deputy G. Zamberletti and Senator G.Spadolini, and approved by
the II Permanent Commission, is intended to perfect the
organisation of Civil Protection by eliminating the gaps in the
present legislation which emerged during the earthquake in
Irpinia, 23 Nov. 1980.
In this text assistance is not the only component of Civil
Protection: prevention is re-evaluated; the structures for the
management of smaller emergencies are the basis for
interventions in catastrophes; voluntary organisations are given
the chance to participate in the Committees laid down by law 996/
70 in relation to prevention activities. The Regions, Provinces and
territoral and institutional public organisations will participate
with the State in setting up the SNPC. Even if it remains the
responsible organisation, the Region and Province have a
permanent function of coordination on their respective territories,
and the mayor and local community are of great importance.
In the draft there is a substantial revision of the organisation
criteria presented in 996/70 and a new orientation towards the
creation of a modern conscience on Civil Protection through the
psychological and operational preparation of the public, as well as
through the promotion of civil voluntary actions.
3
Emergency Planning in the UK: A View
from the Inside
GEORGE INNES
London Fire and Civil Defence Authority, London, UK
HISTORY
First, it will be helpful to explain the terminology used. Unlike
most other Member States of the European Community, in the UK
the term Civil Defence means emergency planning for war.
Emergency planning for peace is referred to simply as civil
emergency planning. In 1986 the Government decided that the
term Civil Protection would be adopted to cover emergency
planning for both peace and war. In this connection it is noted
with interest that a draft document published by the European
Commission in April 1987 covering civil emergencies contained
references to Civil Defence policies. However, in the final
document issued in June under reference 87/C176/01, the
generic Civil Protection has been substituted for Civil Defence.
In the UK no single organisation is responsible for making
contingency plans to deal with major emergencies whether for
peace or war. This may seem a bit untidy but could be said to be
typically British. It is common knowledge that the UK has no
written constitution. Yet, somehow or other, by virtue of political
cohesion and the judiciary the bureaucracy has, over the years,
generally produced effective programmes to implement the
decisions of democratic government.
Traditionally, the primary responsibility for caring for the local
populacewhatever the contingencyhas been devolved from
central to local government. It is the responsibility of local
governments to feed the hungry, house the homeless and,
generally, restore the aftermath of a major emergency to normality
as soon as practicable. Local authorities therefore prepare
emergency plans for peace (civil emergencies) and war (civil
defence) and are empowered by Parliament to spend public money
to these ends. Civil defence expenditure by local authorities is
almost totally refunded by central government under a grant-inaid scheme.

Perhaps understandably for an island people, arrangements for
the defence of our shores by the populace as a whole have figured
prominently in our history since the Middle Ages; hence, in
formulating civil defence policy, there has been a natural tendency
to look to past examples which then serve as precedents for the
future, For instance, in 1914 a government committee, established
to consider what should be done in the event of an invasion, came
to much the same conclusion as its predecessors had in planning
to deal with Napoleons threatened invasion of 1803/4. Even then
the planners had looked back to the arrangements made to deal
with the Spanish Armada of 1588. Civil defence in the United
Kingdom has quite a long history.
Shortly before the Second World War a number of publicspirited people in politics, the armed services, industry and
commerce became determined that the British people should not
have to face the prospect of aerial attack as unprotected against
its effects as the people of Spain had been during their civil war,
so the Air Raid Precautions (ARP) system came into being during
the war. This organisation was locally funded with links into the
respective local authorities and enjoyed government support. The
then Lord Privy Seal, Sir John Andersonafter whom a domestic
air raid shelter was namedis on record as saying: I cannot too
strongly emphasise that whilst it is the Governments business to
fight the war, as for what people are to do it is the business of the
community to prepare itself (authors emphasis). Thus the first
links were forged between local government and its now well
established responsibility for co-ordinating responses to major
emergencies whatever their character. One could easily go on to
draw the parallel here between a bomb dropping on a populated
district and a 10 tonne road tanker full of flammable material
exploding and burning; the causes may be different but, so far as
people and property in the vicinity are concerned, the
consequences could be remarkably similar.
Thus, Sir John Andersons historical assertion remains valid.
Emergency planning, for peace and war, is local government
business.
THE DEVELOPMENT OF CONTEMPORARY
POLICIES
The intellectual development of British contemporary civil defence
cannot be easily broken into discrete phases. However, there are
some identifiable turning points, namely, the Civil Defence Act

1948, the 1968 dismantling, the 1972 care and maintenance
policy, and the 1980 enhanced commitment subsequently
reinforced by statutory Regulations made in 1983 and monitored
since then by the Home Department in what is referred to as the
Planned Programme for (their) Implementation (PPI). These
developments are especially relevant, because it is to match them
that a body of professional emergency planners has emerged
(specifically in the top tier local authorities) upon whom falls the
responsibility for making emergency plans, not only for the war
emergency but also for other major emergencies.
The post-war years have seen tremendous strides in modern
technology leading to the development of new products and
materials. Unfortunately a by-product of these developments is
the growing dependence of industry and commerce on the use of
hazardous materials. Partly as a consequence of this, and partly
in response to the major accident which destroyed the caprolactam
plant at Flixborough, Lincolnshire, in 1974, the Home Department
issued a policy circular to local authorities (since embodied in that
departments Emergency Planning Guidance to Local Authorities,
1985) suggesting that officers employed on civil defence planmaking should be employed on making plans to deal with civil
emergencies also. In addition to the promise by the Home
Department of grant-aiding the staff costs for a modest amount of
this civil emergency activity, the Local Government Act 1972
already empowered local authorities to incur expenditure to
avert, alleviate and eradicate the effects of any emergency or
disaster which could be foreseen as representing a danger to life
or property within their jurisdictions.
Local authorities were thus inter alia recommended to prepare
general local emergency plans to deal with any emergency. These
general, or so-called catch all, plans are still in being in many
authorities and have proved their worth. For example, if a school
is identified as a reception centre for those who suffer as a result
of a local accident, it matters little whether the activation of this
part of the plan has been occasioned by an explosion in a nearby
site or a chemical spillage from a road tanker passing through the
locality. At least the main ingredients of the plan are available for
implementation. However, general plans do suffer from some selfevident limitations in that they are not specifically addressed to a
specific scenario in a specific locality.
Another consequence of the Flixborough accident was that the
Governments Health and Safety Commission appointed the
Advisory Committee on Major Hazards who, in 1976,
recommended in their First Report the introduction of a

notification and hazard survey scheme for installations where
specified quantities of certain dangerous substances were
involved. This culminated in 1978 with the issue of draft
regulations for notification and survey of hazardous installations
which, in turn, became law in 1983. The Committee also
recommended complementary changes to planning legislation to
deal with development at, and in the vicinity of, such
installations.
THE SEVESO DIRECTIVE AND THE UK RESPONSE
Following the disasters in Italy at Seveso and Manfredonia, the
now well known Seveso Directive was issued in 1982 by the
European Council, requiring site-specific plans to be made for
certain specified industrial hazards. This directive was translated
into UK Statutory Instrument No. 1902, The Control of Industrial
Major Accident Hazards Regulations 1984, commonly referred to
as the CIMAH Regulations. In pursuance of these regulations
some 220 such sites have been identified by the Health and Safety
Executive which, among its other functions, enforces the
regulations.
During 1985 in Greater London, for example, 7 site-specific
plans were made by the Emergency Planning Division of the now
abolished Greater London Council. These plans included chlorine
storage and processing areas, liquid petroleum gas and natural gas
sites. More sites are still being identified and it is expected that by
the end of 1988 some 1012 sites in London will be embraced by
the CIMAH regime.
It is of interest that, when the CIMAH planning cycle started,
London had its own government, the Greater London Council
(GLC), but with the reorganisation of local government in 1986 the
GLC and the six Metropolitan County Councils in England were
abolished and their duties were inherited in the main by a lower
tier of local government. Two exceptions were fire and civil defence
(including CIMAH) which passed to successor Fire and Civil
Defence Authorities.
Also in 1986, with the enactment of the Civil Protection in
Peacetime Act, came the coining of that term. Thus the London
Fire and Civil Defence Authority, in which the author is serving,
now has two functional responsibilities, namely fire-fighting and
civil protection embracing preparedness for peace and war. The
costs of the emergency planning staff are met by 100% grant-inaid from central government.
EMERGENCY PLANS
Why do we need emergency plans? What does a professional
emergency planner aim to achieve by making a plan in the first
instance? What would happen if an emergency of one kind or
another did arise and there simply was not a plan to achieve
appropriate and coordinated responses to it? These questions can
perhaps best be answered by reference to the recent and well
publicised Bhopal disaster.
On 3 December 1984 a lethal cloud containing some 15 tonnes
of methyl isocyanide (MIC) covered some 30 square miles of the
Indian town of Bhopal. Some 2500 people died. Much evidence
has been gathered about this accidenteven if some aspects of it
are still shrouded in mysteryand of course the human interest
element has been widely covered by the world media. The technical
details of the disaster have been extensively ventilated in the
scientific press and at seminars, notably the World Conference on
Chemical Accidents held in Rome in July 1987, but doubt remains
on some aspects.
It is not proposed to address such matters now, neither is it
appropriate to discuss the medical treatment of the affected
population, but one relevant question remains: Why was there no
off-site emergency plan to provide for such an eventuality? Had
there been one, it should have addressed the various measures
outlined below.
Because it is generally accepted that the best protection in a
toxic environment is to be indoors behind shut windows etc., the
public would have been given prior advice to do just that. In
Bhopal a public warning siren was actually sounded, albeit late,
but nobody knew what the signal meant or what action to take
upon hearing it. Moreover, according to one reliable source, the
siren was sounded only briefly lest the public became alarmed!
The measures that a professional emergency planner would
have included in his plan would have been to ensure than the
people within the vicinity of the site were
made aware of the existence and nature of the hazard;
told of the significance of the audio warning;
told what to do immediately on hearing the audio warning.
These three measures, of which the last is most important, would
have constituted the basic preliminary elements of the Bhopal
plan.
It is common knowledge that some parts of Bhopal comprised

temporary and frail domestic shelters and that there were even
many pavement sleepers, but there were also some buildings
which could in the event have been used for protection, and not
all the people slept in the open. Indeed, if a relevant hazard
analysis of the Union Carbide operation at Bhopal had been
undertaken, the emergency scenario would almost certainly have
been foreseen and appropriate steps taken, perhaps including the
contingency provision of temporary shelter.
The existence of a hazard analysis would have had a
fundamental effect. Plant procedures and safety measures would
have been examined in depth and, hopefully, action taken,
thereby reducing the risks to such a level as to make the
execution of an off-site emergency plan only a remote possibility.
If Bhopal and, before that, Flixborough, Seveso, and others
sadly becoming too numerous to mention, had been embraced by
the Seveso Directive regime, the disasters now taking these names
into the history books might not have occurred; even if they had,
effective contingency plan-making would have significantly
minimised the damaging consequences for life and property.
EFFECTIVE PLAN MAKING
How then do the professional emergency planners involved in
CIMAH plan-making in the United Kingdom go about making
effective and meaningful plans with a view to achieving
coordinated and cohesive responses by all the agencies which
have contributions to make in given emergency situations?
Step 1:
Hazard analysis
As already indicated, the first step is to obtain from the user of the
hazardous substance(s) a hazard analysis that has been endorsed
by an independent and competent agency such as the Health and
Safety Executive, and record a suitable synopsis in laymans
language early in the planning document. It should not be just a
statistical risk appraisal of probabilities, or the determination of
mean time between component failures, or the assessment of how
many times per million years this or that might happen, but it
should clearly and consistently reflect the scenario or scenarios as
to what could hypothetically constitute the worst credible event(s).
For example, in the case of a toxic substance, the hazard analysis
should state that the worst credible event would
(a) cause a release at x kg/min for a duration of, say, y min;

and
(b) involve a potential total quantity of toxic gas released of,
say, z tonnes.
When this information is available it is possible to determine the
area which could potentially become affected and to adjust the
data in relation to weather, topography, population density etc.
and, of course, to devise a method of applying these variables to a
real world situation.
Step 2:
Aim
With the hazard analysis in his possession, the emergency
planner moves to the second step. Here he determines the aim of
the plan. The implicit assumption in the plan is that the worst
credible accident will happen. The aim must therefore be realistic
and, above all, attainable. In the case of a massive release of a
lethal substance, it would be a mistake to convey the notion that
all the lives in the affected area must be savedif such an
idealised objective cannot be fulfilled. The aid must be to minimise
the worst potential effects of the emergency. Every one of the
planned activities must contribute to the attainment of the aim.
The aim of the plan should be clearly and concisely stated before
the execution section is considered.
Step 3:
Execution
This third step is the very heart of the plan, namely the
execution or implemention. In this section, the planner should
first outline the resources needed to attain the aim, and follow
with a description of the resources actually available from
contributions by the various agencies. Specifically, it should
answer the questions Who?, What? and When? This should be
followed by an outline of the operational organisation needed to
apply the available resources effectively to the hazard, including
the important matter of the arrangements for command and
control. The emergency planner should not, however, concern
himself with how it is to be donethis is strictly a matter for the
professional disciplines concerned. The plan maker will simply
provide for the interactive coordination of all the agencies
involved.
What the plan should also usefully provide are convenient

checklists for the participants covering those generally relevant
matters outside the specialist disciplines. For example, the
checklist of the firefighter responding to a given emergency would
advise him which route to follow, where to go, what equipment
will be needed, or what sort of protective clothing will be necessary
in the face of the particular hazard. Such information would also
be of value to other contributors, in particular the police.
Step 4:
Communications and logistics
Even the best plans will fail to achieve their aim(s) unless the
contributors have adequate communications and appropriate
logistics back-up. It is absolutely essential in crisis management
because it is what a major emergency requiresthat at least the
principal officers concerned should be able freely to communicate
with each other and be supported by adequate equipment and
material.
Step 5:
Plan validation/training/exercising/
maintenance
Finally, once the plan has been made it must be validated or
tested. This is usually done by running an exercise which has the
further advantage of serving to train the contributors in their
respective roles. Such exercises undoubtedly generate lessons for
all to learnnot least the plan maker himself. Emergency plans
are not born fully formed like Venus rising from the sea but are
subject to a process of continuous evolution, progressing from a
broad rudimentary start to greater and greater detail and coverage
but in which perfection is never likely to be achieved. All plans
need to be maintained and updated on a regular basis.
The emergency planner
It follows from the obvious importance of the emergency plan that
the emergency planner must be a professional trained to analyse
the problem and to identify the resources and actions required as
well as those available in practice to solve or counter it. He must
then devise an organisation to apply the resources and actions to
the solution of the problem in the most effective and efficient (in
FIG. 1. Age structure.
that order) manner. London has, on the whole, been successful in

obtaining people with many, if not all, the required talents.
The illustrations show the mixture of talents and qualifications
brought together in the London Fire and Civil Defence Authority
(LFCDA). Figure 1 shows the breakdown by age and reflects the
general high level of experience (incidentally, the Authoritys
retiring age is 65). Figure 2 shows the differing backgrounds of
formal higher education and, for those exuniformed service,
formal staff college training, for it is a sad reflection that it is
presently only at such establishments that the skills of planning
are thoroughly taught to the necessary extent. Figure 3 shows the
differing work experience and the considerable number of officers
with experience of more than one of the relevant categories. In
terms of quality of work experience, just over 50% of the officers
are members of the Institute of their previous professions while all
but some 13% of the ex-uniformed members of staff held senior
rank.
The LFCDA Emergency Planning Division is organised into
teams of 4 with as great a mixture of talents and experience as
possible, and with team leaders who are either former scientists or
people with considerable backgrounds of relevant experience; a
very high proportion of the staff is engaged upon second careers.
The total number of officers directly employed on emergency
planning in a full-time capacity is not readily available. Most
officers, however, join either the County Emergency Planning
Officers Society or the Association of Civil Defence and Emergency
Planning Officers. While membership of the Society is restricted to
FIG. 2. Formal academic qualifications. Twenty-four per cent of the

staffhave had the benefit of post-graduate Staff College Training.
FIG. 3. Nature of previous work experience. Thirty-three per cent of the

staff have had previous experience in the field of Emergency Planning.
the heads of the emergency planning teams formed in local

authorities, membership of the Association is open to all officers
employed full-time on emergency planning. Indeed, many
members of the Society are members of the Association but not, of
course, vice versa. Current membership of the Society is 58 and of
the Association it is 392.
CONCLUSIONS
Emergency planning in the United Kingdom is an old activity
which has only relatively recently developed into a full profession.
The principal thrusts of the function lie in the areas of civil
defence and industrial major accident hazards. However, there are
smaller but equally important areas of activity such as oil
pollution and nuclear radiation. Probably the largest number of
professional emergency planning officers is to be found in local
government employment, though membership of the Society of
Industrial Emergency Services is believed to be on the increase.
There is a growing need for a centre of learning to address the
subject of emergency planning. A formal course for aspiring
emergency planning officers is needed leading to, at least, the
award of a diploma.
A properly developed career structure would also be beneficial to
both the producers and receivers of emergency plans; among
other things, it would reduce the considerable dependence on
second careerists. On the wider issue of improving the quality of
our emergency planner training, the Resolution of the European
Council in June to encourage, in cooperation with the
Commission, exchanges of persons responsible for civil protection
as part of training programmes undertaken by the Member
States is a most encouraging contribution to the development of
the profession. It is to be hoped that the Commission will not be
slow to take the initiative in that regard.
In that connection, the article Major catastrophes: our
vulnerability in the Councils May 1987 edition of Forum was of
particular interest. One sentence in the article reads as follows: If
a rescue operation is to be efficient it must be properly organised,
in other words, have a structure and chain of command like a
military division on the battlefield. Clearly, the creation of the
organisation referred to is the function of the emergency planning
profession. In the same article there was a reference to the new
European Disaster Medicine Centre at San Marino so that at
European level there should be a single corpus of theory on the
organisation of medical help; this initiative by the medical
profession is to be applauded. Where, may one inquire, is the
single corpus of theory on the organisation of multi-discipline
responses to major emergency and disaster situations being
formulated and taught at the European level, or even at the
national level?
4
Emergency Plans in France
R.GROLLIER BARON
Institut Franais du Ptrole, Vernaison, France
French regulations have long provided for measures to be taken in

the case of an accident in industrial establishments, and there are
labour laws concerning personnel training and control facilities
that such establish-ments must have.
The 1976 Law of Classified Installations replaces the former
1919 Law of Classified Installations. For some dangerous
activities, and starting with certain amounts of products,
manufacturers must obtain an operating authorization including
the description of what is to be done in case of an accident.
The 1967 petroleum regulation, resulting from the accident at
Feyzin, requires a defence plan to be drawn up under the
authority of the Prefect to define the course of action to be taken
in case of accident, and stipulates the responsibilities of the head
of the establishment and those of the Public Authorities.
The EEC Seveso Directive makes emergency plans mandatory
for member countries, while stipulating a certain number of
principles.
The 1952 interministerial instruction, called the ORSEC plan,
which was improved in 1971, aims at ensuring the command, the
mobilization of means, the inventory of these means and their
distribution. This plan has been elucidated by the following
appendices:
ORSECRAD for nuclear activity
ORSECTOX for chemicals
ORSECHYDROCARBURES for petroleum products
In 1985 a new interministerial instruction entitled Technological
Risks stipulates plans of action for chemical and petroleum
installations. It applies to activities covered by the Seveso
Directive, but the Prefect can extend its application to other
establishments. It has two parts:
The in-house operating plan (POI), worked out under the

responsibility of the head of the establishment, concerning
what is to be done inside the establishment when an accident
occurs.
The special action plan (PPI), worked out under the authority of
the Prefect, for an establishment or industrial complex when
the accident has or-may have consequences going beyond the
boundaries of the establishment.
In addition, it deals with the POI/PPI interface during the time the
accident is increasing in gravity.
Mr Boissieras will discuss POIs in Chapter 5.
A PPI has two parts: (1) the organization; (2) the means. It is
based on scenarios leading to the assessment of the needs, to the
identification of the means available, to searching for
supplementary means, and it defines the public alarm to be set
off. Its aim is to enable the Public Authorities to ensure the
protection of persons, property and the environment.
POIs and PPIs reinforce one another, thus requiring solid
coordination at the level of how they are worked out. Likewise the
implementation of public means also requires good coordination
of means in keeping with the definition of missions. Exercises
must serve to check proper procedures. The scenarios are
constructed from reference accidents. We are interested in their
consequences and not in preventing them.
Among the missions included in the PPI are, in particular:
Alarm
Firefighting
Safety perimeter
Access routes
Instructions to the public
Assistance and relief for the wounded
Pollution control
Relations with the media
etc.
A leader and means correspond to each mission. Command is
ensured by an operational command post and a logistical
command post. The general manager of assistance and relief is the
Prefect or his delegate.
SESSION II
On-Site and Off-Site Emergency
Planning Design
Chairman: J.A.S.NICOLAU
National Service for Civil Protection, Portugal
Rapporteur. R.GROLLIER BARON
Institute Franais du Ptrole, France
5
Guide for the Establishment of an
Emergency Plan
J.BOISSIERAS
Rhne Poulenc, Safety Directorate, Lyon, France
1
GENERAL COMMENTS
1.1
Definition
The Emergency Plan is the guide on the setting up of internal and
external equipment at the Establishment, previously inventoried,
and of actions to be taken when there is an accident situation.
For the Establishments alluded to in the Order ORSEC Plan:
Technological Risks, the Emergency Plan corresponds to the
requirement for the establishment of an Internal Plan of Operation
(IPO), for which the Head of the Establishment is responsible, and
it contains all the information to be given to Public Authorities to
carry out the Special Intervention Plan (SIP) prepared under the
Authority of the Commissaire of the Republic:
Starting from a study of the potential dangers presented by the
installation, the IPO defines the organisational measures, the
methods of intervention, and the necessary means which the
operator must put into practice in the case of an accident, to
protect personnel, the public and the environment.
The SIP aims to ensure the safety of the public and to protect
the environment when the accident entails or may entail danger
outside the Establishments boundaries.
ON-SITE AND OFF-SITE EMERGENCY PLANNING DESIGN 45
1.2
Why an emergency plan?
The Emergency Plan forms part of a policy of prevention and
protection of people and goods, of business and its environment,
in agreement with the general policy of Public Powers. In the case
of an accident it is too late to develop a strategy of actions taking
account of all the possible consequences. To avoid improvisations,
it is a good idea to predict and to plan.
The Emergency Plan also has a legal foundation based on:
the Working Code through the obligation to give safety training
(R23134/35/36/37) and to put into practice fire-fighting
equipment, including material for the rescue and evacuation of
personnel (R23338/39/40/41);
the Regulations of the Classified Installations; the decree of 2
Sept. 1977 applying law 76.663 of 19 July 1976 in particular
envisages the organisation of safety means (Art. 35). Decrees of
classification may lay down specific protection measures.
For installations covered by the Petroleum Regulations and their
extensions, a defence plan must be organised (decree of 4 Sept.
1967, Art. 10) and an internal operation plan, plus an overall
defence plan (decree of 9 Nov. 1972 on hydrocarbon deposits, Art.
10):
Texts of application proceeding from the CEC directive 82/501
of 24 June 1982 (Seveso) concerning the major risks of some
industrial activities, which has been applicable to the Member
States since 8 Jan. 1984.
The ORSEC Plan: Technological Risks, an interministry order of
12 July 1985 on intervention plans in the case of accidents
which, fulfilling the needs of the Seveso directive, replaced, in
France, the ORSEC Hydrocarbons and ORSECTOX plans.
1.3
Field of application
The Emergency Plan concerns any situation involving the putting
into practice of safety actions or of protection of people, goods and
the environment.
Although it is intended to allow mastery of serious situations
(fires, toxic emission, pollution), it appeared necessary not to
exclude from its field of application accidents or incidents of
medium seriousness as far as they need non-routine actions of

help or information. The corresponding procedures will be
distinguished as a function of the nature, importance and
psychological impact of the accident or incident.
Account should be taken of all the situations linked to the
presence or absence of personnel in the Establishment (working
hours, periods of leave, social conflicts, etc.) and of its
accessibility. It must be operational whatever the situation, and be
able to deal with the specific risks of each situation; from this, one
can see the essential role of permanent monitoring (caretakers,
compulsion, remote observation, etc.).
1.4
Manual
The Emergency Plan is formalised by the drawing up of
documents, which are collected together in an Emergency Plan
manual, which contains all the information necessary to manage
an accident situation. This manual is drawn up by the
Establishment Head, in liaison with the Public Powers, and
generally under the coordination of the Safety Head, who is
responsible for updating it as a function of the evolution of
risks or knowledge;
the organisation, structures;
the environment;
means of intervention.
The Establishment staff who are asked to organise or take
decisions in the case of an accident must know and have
mastered the contents of these manuals, particularly the classes of
compulsion.
Outside the Establishment the manual will be sent to the people
responsible for Civil Safety. To facilitate checking and updating,
all the copies will be numbered and named with the function. In
the Company there will be a control copy as evidence of
updatings. These can be made when intervention exercises are
being performed.
2
STAGES FOR THE REALISATION OF AN
EMERGENCY PLAN
(1) Examine the accident situations which merit actions to be
taken into account in the Establishment Emergency Plan, with
nature and location of the risks;
gravity of the consequences.
This evaluation results from the danger study, which is obligatory
for all classified installations subject to authorisation.
(2) For each possible and probable scenario, define the internal
and/or external means of intervention, human and material, to be
put into operation to limit the consequences.
(3) Draft the procedures of
intervention;
information;
returning to normal after the accident;
as well as the advice for carrying them out. Take the advice of
those concerned.
(4) Organise the whole in an Emergency Plan manual, which
must be in the form of single sheets which can be used by anyone
involved.
3
EMERGENCY PLAN MANUAL
This may act as a specimen scheme for the internal operation
plan.
3.1
Alert
Description in the form of an organigram of the progress of the
alert from the first sign through to the services concerned
List of the telephone numbers and addresses as an appendix
3.2
Geographical situation
Plan of the location positioning the factory in relation to its
environment on the scale of the major risk and showing the
access and assistance routes
General plan of the Establishment with the reception sites
Meteorological data such as the wind rose of the site
3.3
Risk
For each unit, zone or workshop, the plans of the inside of the
establishment show in particular
the possible ways of access;
the zones to be protected in an emergency;
the zones which might be affected by a toxic cloud or by a shock
wave caused by an explosive cloud.
3.4
Means of intervention
List of the Establishments fire-fighting equipment with its
potential.
List of the external public and private defence equipment, with
its potential, where it comes from, and the time needed to make
it operational (after the call)
Private or public water services
List of the various materials or products with their potential,
where they come from, and the time needed to make them
operational (after the call)
3.5
Organigram of the services
Organigram of the assistance services, with the names of the
people in charge and the staff needed to ensure the following five
tasks:
Operation: stopping units and making them safe; fighting
against the accident
Communication: making and keeping available means of

communication
Logistics: supplies of material, fuel, men,
External relations: administration, public, media, functional
services.
Observation: preparation of the log-book, files, etc.
3.6
Operations
For each unit, area or workshop, the strategy will be studied in
relation to the potential danger classes, and each intervention
sheet will include the following elements:
Risk definition:
Fire/Explosion
Escape of toxic gas or liquid
Escape of inflammable gas or liquid
Aims of the fight against the accident
Location of the PC and the organisation of the assistance
Evacuation and counting of personnel
Staff necessary and their role
Means necessary and where to find them
Information on the administration, the media and the public
Operations to be carried out.
Appendices
Inventory of dangerous products and files produced
Plans of the installations
Remark
This schema may be changed depending on the characteristics of
the Establishment itself.
4
RECOMMENDATIONS
4.1
Emergency plan always operational
The modes of work of Establishments vary, but an accident can
occur at any time and often in the least favourable situations. It
should therefore be possible in any circumstances to summon
Personnel who can take decisions (personnel present, according
to regulations, or who can come in quickly when called);
Material and human means of intervention.
Safety functions must always be envisaged in the organisation. The
list of people who must fulfil these tasks in the case of an accident
must be available and the people must be informed. The
personnel outside must be easily contactable and be supplied with
passes in cases where traffic restrictions are set up.
Permanent readiness is ensured by the existence of a fixed
point where the tasks and means defined in the organisation lead
at least to the transmission of the alert.
4.2
Alert
It is the duty of any witness of the beginning of an accident or of
an anomaly which might lead to an accident to give the alert and
to act with the means at his disposal and within the limits of his
ability (1 st intervention step).
The alert is the information given to ask for assistance, in
principle using alarms which are inside or outside the
Establishment.
Staff should be trained to give a brief and precise warning
message indicating the place, type and seriousness of the
accident.
Generally the message is received by another person at the
Fixed Point (assistance centre, guard post, telephone switchboard,
or remote sensing centre). The means of intervention
corresponding to the type of accident are triggered by alerting
the Establishments permanent or auxiliary fire service, or
outside firemen (possibly put on pre-alert);
medical service and/or first-aiders;
people with a specified task (e.g. reinforcing guards), etc.

There will be differentiated alert levels (internal and/or external)
depending on the type of accident and on its potential
consequences, depending on whether it concerns
a zone of the Establishment;
the entire Establishment;
outside the Establishment (cf. Section 4.10).
The alert level is decided by the most senior person present at the
time.
4.3
Means of intervention
The means will be adapted to the nature and importance of the
risks.
The Working Code obliges the Establishment Head to ensure
a minimum of protection against fire (extinguishers,
instructions,), including staff training;
the training of first-aiders in all the continuously established
teams. In general the quarter-Heads will be first-aiders.
In the Establishments subject to the Classified Installation rules,
the means of intervention are defined in relation to risks examined
by the study of dangers and by the scenarios considered possible
for accidents. The most pessimistic scenarios which are least
likely to occur may be taken into account.
In all cases, the assistance systems which must be ensured are
both internal (those of the Establishment) and external (those of
the Public Powers or Mutual Assistance). The coordination of
actions implies delays which must be taken into account in
evaluating the efficiency of the assistance.
Practically, the preparation of procedures and information for the
mastery of each risk must allow definition of
who acts (name, address, how he can be informed,);
with what means (location and performance of the materials);
how to coordinate the performance of the intervention.
4.4
Triggering of the emergency plan
As soon as the alert is received, two tasks must be ensured:
Define the actions for treating the accident (tactical choice=stop
the unit, put into a safe state, evacuation,); this task is the
responsibility of the most responsible person on the site
Put into action the means of intervention (strategical
choices=controlling the accident, zones to be protected, help for
people,); this task is the responsibility of the intervention
head (2nd rank and others)
These two tasks can only be accomplished with perfect
coordination between the operation hierarchy and the different
intervention levels.
If the accident cannot be mastered in the framework of the
workshop, the following must be set up:
An advanced operational CP, near to the accident, directed by
the person responsible for the intervention
Then, if necessary, a Central CP housing the Assistance
Directorate, in a room where liaisons with the advanced CP on
the one hand and the outside world on the other will be
organised
In an Establishment which has a Security organisation and
means of intervention, the Assistance Directorate comes under (as
part of the IPO) the Establishment Chief or his representative. The
person responsible for Exterior Assistance receives a task from the
Director of Assistance. He deals with its performance and puts the
necessary means into effect.
The ORSEC Plan: Technological Risks envisages that, in the
case of an accident extending outside an Establishment, and
without waiting for the starting of the SOP, the Establishment
Head must act outside his Establishment under the responsibility
of the public authority and in the framework of previous and clear
agreements with this authority, stated in the SOP.
4.5
State of emergency: internal evacuation,
counting
If the nature of the accident implies the evacuation of a zone, the
workshop must set up a state of emergency. To do this, special
instructions will be established to make the workshops safe with a
small number of manoeuvres and without any risk of making the
accident worse, while admitting the possibility of some leaks, in
particular of products. If necessary these manoeuvres will be
performed with a small number of personnel and/or means of
protection such as individual masks.
When the order for evacuation of a zone is given, the personnel
must go to a prescribed assembly point and be counted. Emotional
reactions might lead some people to flee. Part of in-service training
is for personnel to acquire the right reflexes.
An up-to-date staff list, including home address and telephone
number, must always be available.
As far as possible the staff will be counted through the
hierarchy, without forgetting
part-time staff (maintenance, administration,);
outside organisations;
visitors.
4.6
Means of communication
Inside the Establishment the people in charge will generally have
radios for communication, as well as the telephone. It is advised
that radio posts should be made available for outside assistance
(firemen). The orders to be given to the staff should be given by
means of telephone, radio, loudspeaker, megaphone, messenger,
Communication with the outside will be mainly by telephone.
Telephone lines must thus be available to organise assistance.
Taking account of the risk of breakdowns, there should be two
independent systems for communication with the Main Assistance
Centre.
Lines should be reserved for outgoing messages (be careful of
the risk of blockage of lines which go through a guard-post).
4.7
Reception
Following the accident, various categories of people might come to
the plant, so a reinforced guard is needed at the Establishment
entry. These guards will direct
the assistance towards a pre-established assembly point or, if
not, towards the site of the accident (operational CP);
the authorities towards the Directorates representative, or the
usual person who receives visitors (special room);
the media towards a specially set up room; accompany
journalists who are authorised to visit accident sites.
Curious onlookers must be kept outside and they will be asked to
keep away from dangerous zones while waiting for barriers which
might be set up by the public authorities.
4.8
Information procedures
These should not be confused with alert procedures or with the
orders given as part of the intervention procedures.
The aim of the information is to inform people of the nature and
the consequences of the accident. It must be quick, objective, and
limited to the facts. Do not formulate any assumption on causes
or responsibilities. The information must be given by the
Establishment Director or a person designated by him and trained
for this job.
Information for families should be organised quickly, especially
if there are injured people or people who are being kept on the site.
The information will be the subject of a precise plan
incorporated in the emergency plan and structured depending on
the seriousness of the accident. A scheme is proposed in the
Appendix.
4.9
Analysis
Independent of any legal enquiry, it is a good idea to set up
quickly a technical analysis which allows the drawing up of an
accident report.
Spontaneous eye-witness accounts should be collected quickly,
if possible on tape. They should then be confirmed in writing.
To do this, one may use audiovisual apparatus (camera, video

camera, film camera,). There should be at least an instantly
developing camera in the first-aid vehicle.
4.10
General information of the public
When the consequences of an accident may overflow the limits of
the Establishment and affect neighbouring populations (e.g. toxic
emission), an alert procedure must be set up in the Special
Intervention Plan. The public must be informed of this alert
procedure in advance by the distribution of a card giving details of
the security measures and the procedures to follow.
On 22 July 1986 the UIC published a technical circular
recommending the conduct for this subject.
APPENDIX: EXAMPLE OF AN INFORMATION PLAN
For any incident or accident, even those which a priori appear
harmless, and in any case as soon as the alert is given, immediately
inform
the Company hierarchy following special instructions.
If there is damage which temporarily puts the installation out of
action, risks that the accident might extend outside, signs
perceptible from outside, and emission or danger of emission of
pollutants, the factory Director or his representative will inform,
as quickly as possible,
the inspector of classified installations and, in the most serious
cases, the Commissaire of the Republic,
then, as quickly as possible,
the local authorities,
the police, if they have not been informed as part of the alert.
Then one will inform
the factory inspectorate,
the advising engineer of the CRAM,
and, as a courtesy,
neighbouring factories.
If personnel are kept on the site or if there are injuries, one will
warn
the family of the personnel concerned.
Finally, for serious cases, a communique will be drawn up in
agreement with the Public Authorities, to inform the public.
6
Emergency Plan and Alert System at
MONTEDIPE
L.CORIGLIANO & F.ANTONELLO
MONTEDIPE, Milan, Italy
Provision of appropriate information about the actions to carry out

and the correct behaviour in case of accident has always been a
primary requirement in the chemical industry.
Of course, the development of process plants demands a
continuous updating of the emergency rules and procedures,
checking their feasibility and adaptability to different possible
events, considering the latest available studies and technologies.
This concern is clearly expressed in the legislation and
particularly in the EEC Directive on the major accident hazards of
certain industrial activities which also requires linking of on-site
preparedness emergency planning with off-site Territorial Civil
Protection Plans.
The several situations of MONTEDIPE factories (MONTEDIPE is
the petrochemical and polymers company of the MONTEDISON
group) have made necessary different approaches to achieve this
goal, considering the extent of factories, the number and type of
plants, the organisation and constitution of personnel, etc.
As an example, we report here the case of the larger
MONTEDIPE factory (i.e. P.to Marghera), for which three levels of
emergency have been defined:
1. The local emergency, referred to a limited event whose
possible consequences are confined to the plant where the
accident takes place.
2. The zonal emergency, when the area affected by expected
consequences can include several plants.
3. The general emergency, when the area that can be affected
involves all or most of the factory.
The three aforesaid levels are covered by the specific Department
Plan and the General Plan, which is linked to the Territorial Civil
Protection Plan for chemical Hazard. Obviously the three steps are
inter-connected in such a way as to allow the gradual transition
from one level to the higher one in the case of anomalous

evolution of the situation.
The Department plan is developed on the basis of a range of
reasonable hypotheses of specific events. Assessments of
occurrence likelihood are made, and possible consequences are
evaluated providing adequate operations and measures both to
reduce the likelihood and to mitigate the consequence.
As a general rule, the Department plan (first level) includes
the indication of charged employees who must accomplish the
emergency operations and the relevant tasks;
a map of the plant on which is plotted the route to follow in
order to perform the task;
a list of Departments and Managers to give notice about the
event and its possible evolution;
the ultimate meeting point from which to abandon the plant in
order to evacuate.
This plan provides in particular for quickly warning the in-house
fire brigade, other plants involved in the situation, and the
emergency planning coordinator.
Afterwards, in relation to the development of the situation, and
on the basis of a predetermined check, one may extend the
emergency to the second level. In this case, an Emergency
Committee will meet in a centre equipped with
personal protection equipment;
plan of the factory;
direct phone lines to Company headquarters, public authority,
emergency services;
the most important technical files for all the different plants and
utilities.
The method of notifying employees of the actual situation is the
first concern in the case of accident, particularly in the second
and third levels of the emergency plan.
Panic caused by uncontrolled rumours and feelings or lack of
knowledge can also create an emergency. For this reason the
factory has a departmental selective communication warning
system, from the oper-ations centre to the control rooms of the
plants and other specific workshops. Such a procedure allows shutdown and evacuation of the plants or the areas affected by the
emergency without spreading alarm and without involving
needless general emotional upset of other departments. .
The warning system, consisting of software for a

microcomputer, can represent on the display the map of the
factory or the part of it concerned with the event, illustrating the
likely affected area according to the chosen type of accident. The
operator may find
typical emergency cases;
the appropriate procedure to adopt;
the area that can be typically affected.
From the keyboard it is possible to check the availability of the
system at any time. These areas have been estimated by
computerised mathematical models simulating the consequences
of chemical accidents in the typical range of reasonable
hypothesis.
The warning system is connected to meteorological stations in
order to collect data on wind direction and velocity. This affords
the possibility to supply information about the accident and to
issue the appropriate guidance how to operate.
Moreover, the warning system is connected also with the
network of alarm points, allowing the spread of preparedness
recorded messages that are appropriate to the actual situation. A
continuous alarm signal (sirens) will however, be heard in all the
departments in the case of a widespread emergency.
Periodic simulations of different types of emergency are
performed, in order to train the operators, to test the correctness
of the procedures, and to improve expertise. It is therefore possible
to check the reliability and functionality of the warning system.
The trainers may choose from among several typical hypothetical
events and test, simulating the alarm, the preparedness of the
operators in the receiving stations.
The fire-fighting and the first-aid within the works are entrusted
to the fire brigade and the medical department, which have
specialist teams working on shift.
This type of organisation has encouraged the development of a
suitable professional attitude to the problem; in addition to the
availability of appropriate equipment, it has proved to be of use
also for emergency measures taken outside the works itself. In
fact, for some years now the emergency teams of some works have
proved themselves able to act on the request of the authorities, or
of other companies in the event of accidents during transportation
or in other sites.
A set of emergency protection equipment is available to deal with
different situations, e.g. self-contained breathing apparatus, gas
masks with universal and specific filters, chemical safety goggles,

acid-proof and gas-proof clothing, face shields, etc. Moreover, the
teams have special equipment at their disposal, e.g.
hydraulic pumps ensuring safe operation even where flammable
mixtures are present;
a flare that can be assembled on the site of the accident to burn
any flammable gas;
neutralising products which inhibit the evaporation of toxic or
harmful substances;
kits for repairing leaks.
For some years now it has therefore been possible to respond
efficiently to all the requests for help received, working together
with the appropriate authorities to prevent harmful consequences
and to mitigate the effects of accidents occurring even hundreds
of kilometres away from the works itself.
Moreover, MONTEDIPE runs, on behalf of Federchimica, a
database of more than a thousand substances to comply with any
emergency situation. A public authority, such as the fire brigade,
can call this database, named SIET, at any time; there will be an
expert who will answer questions after a quick scan of the
database.
7
On-Site Emergency Plans
G.L.ESSERY
Imperial Chemical Industries, Billingham, UK
1
INTRODUCTION
The Seveso Directive, which was enacted in the UK as the Control
of Industrial Major Accident Hazard Regulations 1984 [1], requires
inter alia that a site on which is stored more than specified
quantities of certain hazardous materials shall have an on-site
emergency plan. In most cases these plans had been in place for
many years, because manufacturers had recognised their value in
mitigating the effects of serious incidents.
Overall the protection of people both on-site and off-site who
might be affected is best achieved by using procedures designed to
ensure that the risk of a serious incident is low and that, if it does
occur, its consequences are minimised. These procedures will
normally be directed towards:
1. Hazard elimination (e.g. use of non-flammable rather than
flammable solvents)
2. Hazard reduction (e.g. use of smaller inventories in process
and storage)
3. Hazard containment (e.g. pressure vessel design, provision of
bunds, etc.)
4. Incident mitigation if all else fails
To achieve items 1, 2 and 3, plants processing hazardous
materials need to be designed, constructed, operated and
maintained to high standards. The use of multi-stage hazard
studies, strict adherence to design codes, proper maintenance and
regular tests of key plant items and safety devices all contribute to
ensuring that plant hardware is reliable. Equally important is the
selection and training of operators, the provision of operating
instructions and safe working procedures, their maintenance with

audit and review and good supervision.
However, even with high quality plant and adherence to
carefully considered procedures, it is still possible that an
improbable event, or more likely an unforeseen series of events,
could lead to a serious incident. Should this occur, a sound
emergency plan is essential.
Guidance on emergency planning has been published by the UK
Health & Safety Executive [2], and another paper [3] includes a
simple quantified approach, which could be used to give a rapid
consequence assessment of a toxic gas release. Where the effects
of a major accident could extend beyond a site boundary, it is
essential that the on-site plan should integrate effectively with
those of the external Emergency Services. Such integration can be
achieved only by close liaison with the planners and the operating
teams from these services. Guidance on off-site planning is
available from the UK Chemical Industries Association [4], and
more general advice is available on emergency planning for Local
Authorities [5] and for industry [6].
It is not possible to provide a detailed description of an on-site
plan in this short paper. What follows is therefore an outline of
some aspects that need to be considered in preparing an on-site
plan.
2
EMERGENCY PLANNING: AIM AND GENERAL
PRINCIPLES
The prime aim of an emergency plan should be to restore
normality as far and as quickly as possible with minimal adverse
effect on people and the surroundings. In the case of a minor
incident which affects a single plant area only, this aim can
generally be met fairly easily. However, this may not be true of a
major incident which affects a much wider area. In this case the
people trying to contain the incident at source are often unaware
that the effects of the incident are causing problems further away
and the people trying to ensure that the correct actions are taken
elsewhere often have great difficulty in obtaining enough
information to enable them to give sound advice and instruction.
As rapid, accurate information is essential, the procedures and
training must prompt and condition people to act correctly.
Unlike a normal plan, which starts from a single clearly defined
point, an emergency plan has to be able to start from any one of
many abnormal situations. As many of the people who will be
called upon to perform key roles in the major incident response

team will not normally be involved in dealing with emergencies, it
is essential that the emergency plan should be simple and flexible.
It needs to be simple so that those called upon to implement it can
do so readily, despite the wide range of start-points, and it needs
to be flexible to allow for easy escalation or de-escalation to match
changing situations. Simplicity will also reduce training
requirements and increase the likelihood that all those covered by
the plan will react in the desired manner in the event of an
emergency. Furthermore the simple, flexible approach will ensure
an easy dove-tailing of the on-site plan with the off-site plan
prepared by the Local Authority in conjunction with the Police,
Fire and Ambulance Services, with whom there should be
consultation during the planning stage and following regular
exercises thereafter.
Before starting to draw up the plan, it is necessary to postulate
the various types of major incident which could arise and the
likelihood and severity of these hypothetical events. Apart from
possible fire, explosion and toxic release scenarios, it may
sometimes be necessary to consider the normally absent products
of a runaway reaction such as dioxin at Seveso or the toxic
products of combustion following a major fire. Possible
contamination of the environment may also need to be
considered.
The next stage will be to consider the appropriate countermeasures at the scene and elsewhere. There will have to be a
rapid means of calling in both the Emergency Services and the
Company personnel required to respond to the incident. It will
also be necessary to warn people who might be affected by the
incident, but it should be recognised that this warning might
come after an explosion or a gas cloud has affected the people
concerned. Where containment has been lost, it should be reestablished as quickly as possible. Personnel must be accounted
for or searched for and where necessary casualty treatment must
be initiated.
In dealing with a major incident, it is advisable to establish both
an Incident Control Point and an Emergency Control Centre. The
Incident Controller (who needs to be readily recognised by the
Emergency Services) is likely to be the shift supervisor until he is
relieved by a more senior manager with knowledge of the area in
which the incident is occurring. He will be responsible for
ensuring that the actions outlined above are taken and, in the
initial stages of an incident, he may also have to act as the Site
Main Controller. The Site Main Controller will operate from the
Emergency Control Centre once this is established. He will be

primarily concerned with co-ordinating the required actions
across the site other than at the incident, advising the Emergency
Services about the way the incident is likely to develop, and
arranging backup support for the Incident Controller. To perform
these tasks he will need information about the current situation,
likely weather changes, resource availability, etc. The main
objective of his support team will be the seeking out of this data to
aid joint decision-making with the Emergency Services. Good
communi-cations with the decision-makers in the Emergency
Services is therefore essential.
The Site Main Controller should also ensure that adequate
consider-ation is given to the provision of data for the Public
Relations team, data preservation, traffic movements, shift changeovers, etc.
33
IN-PLANT INCIDENTS: SOME ASPECTS TO BE
CONSIDERED
As has been long appreciated by fire-fighters, a quick response by
a well trained person can prevent a minor fire escalating into a
major conflagration. Similarly, a plant operator is often able to
limit the scale of an incident provided that he has been made
aware of the potential non-routine situations and given
appropriate training and practicereal or hypothetical. In order for
this training to be soundly based, it is necessary for the local
management team to assess the various types of incident which
could occur in its area. In addition, the team should consider how
the superimposed effect of a partial or total loss of essential
services would influence their procedures for re-establishing
containment. For example: Would remotely operated valves still be
operable? Would the shutdown purge systems still be operable? Is
the emergency lighting adequate? Do the communication systems
have standby power supplies?
Having identified the various undesired events and their
potential consequences, appropriate counter-measures need to be
considered. For example:
Are the plant fire-fighting resources adequate for the initial
attack prior to the arrival of the professionals? Is the equipment
adequately maintained? Is the plant team adequately trained?
Are there some situations where a fire should be allowed to
burn or be contained rather than extinguished?
Can the drains cope with the fire-fighting water? (Inadequate

drains can lead to the spread of hydrocarbon fires.) Should the
fire-fighting water be contained to avoid contamination of water
courses?
Are instrument and electrical cable ways adequately protected
against fire?
Has similar thought been given to structural steel and stock
tanks?
Are relief valves and vents sized for fire conditions?
Could sub-zero liquids enter systems not designed for low
tempera-tures, thus causing failures which could exacerbate
the incident?
Can all the necessary isolations be made easily?
Should more isolation valves be motorised so that they can be
operated quickly from a safe location? Should some isolation
valves be actuated automatically by gas sensors?
Are the plant alarm, evacuation assembly and roll-call
procedures adequate for the events postulated? What about
contractors, drivers and visitors?
Is there more than one method of communication?
How is additional help summoned?
How is the decision taken to declare a major site emergency
which will require the call-in of the Emergency Contol Centre
team?
Before moving on to consider some aspects of dealing with a major
incident, it is worth commenting on a very natural human
reaction which sometimes leads to a less than optimum response.
Some people like to believe that they can cope with an incident on
their own. This reluctance to ask for help early enough can lead to
an incident not being tackled in the best way and to a shortage of
the information needed for advising the Emergency Services. It is
better to have far too much help at hand than to be just a little
short, especially if escalation could occur unexpectedly.
4
MAJOR INCIDENTS. SOME ASPECTS TO BE
CONSIDERED
All the comments relating to in-plant incidents are still applicable,
and in addition there will now be a need to ensure than an
Emergency Control Centre is established as quickly as possible.
This centre will act as the main communication link with the
Emergency Servicesparticularly the Police. It will act as a data-
gathering point for information gathered from many sources. To

take account of different wind directions, it may be necessary to
have two centres allocated, preferably dedicated to and well
equipped for the purpose. It may be prudent to locate this centre
some distance from the site, providing that it can be manned
quickly and that it has excellent communication facilities.
Having decided that a major incident is occurring, many actions
are required in quick succession:
1. The Emergency Services need to be called. They must be
given the location and nature of the incident and, to identify
a safe approach route, they should be told the direction from
which the wind is blowing.
2. The site needs to be told of the incident, possibly using
audible (and zoned?) alarms backed up with a looped tape to
emergency telephones.
3. A mobile analytical team for monitoring the environment may
be needed together with a readily usable means of estimating
the extent of a toxic cloud.
4. A more senior Incident Controller may be needed.
5. A Site Main Controller and his team may be needed.
6. A Public Relations team will be needed. (Media interest even
in minor incidents is much more rapid and demanding than
it used to be. Good information flow is essential.)
7. Additional telephonists may be required to re-route calls to
the Police Casualty Bureau or to the Public Relations team or
to the Emergency Control Centre.
All these calls need to be made quickly when the Works resources
are fully stretched dealing with the emergency. Can the calls be
automated or cascaded? Remember that the travellers may need
to be told of the direction from which the wind is blowing.
Remember also that police road-blocks might restrict the access of
those called into work. It is therefore advisable for non-uniformed
personnel to carry some form of identification.
Bearing in mind the difficulty of establishing what is happening
in the first hour or so of a major incident, it is essential that good
communication links are established between the Emergency
Control Centre, the incident and, where appropriate, the mobile
analysts. (On occasion it may be advisable to allocate a radio
channel solely for these three users, particularly if problems arise
from interference with other users on different channels.)
Difficulties arising from interference or ill-disciplined radio
procedure can also be overcome by using telephones in preference
to TELRAD or radio. (The absence of a telephone near the incident

is easily overcome with a modern plug-in telephone and a long
extension lead carried on a Works emergency vehicle.) A police
presence in the Emergency Control Centre is also strongly
recommended; the police may have information which will assist
the control room staff, and the police representative is able to
obtain a better picture of the Works situation.
In assessing a situation based on a limited amount of
information, some of which may be of poor quality, there is
sometimes a temptation to make assumptions. This should be
resisted as it could lead to the giving of the wrong advice. It is also
important to provide the police with information in a form which
will help them. They need to know the effect of a particular gas
concentration rather than its actual value.
In most cases the advice for the protection of the public from
fire, explosion and toxic release will be to go indoors and shut all
windows and doors. However, in the event of a toxic release, and
as shown in HSE papers [7, 8], it is then important to go outdoors
once the gas cloud has passed.
In the event of there being many casualties, it may be beneficial
to have a company personnel presence in the police casualty
bureau. This representative should be able to work directly with
his personnel colleagues in dealing with the next of kin without
needing to involve anyone in the Emergency Control Centre.
While in-plant incidents are clearly owned by plant personnel,
difficulties could arise with incidents in interface zones or in pipe
trenches if areas of responsibility for dealing with major incidents
are not adequately defined. These cases must be recognised and
appropriate arrangements made.
5
TRAINING
Apart from the in-plant training needs identified earlier, everyone
with an active role in the control of a major incident should be
aware of the emergency procedures overall. Furthermore each
individual should know what to do in the one or more posts which
he may be called to occupy in an emergency. The use of checklists
can be of great assistance when under pressure in an abnormal
situation. Practice in radio procedures may also be necessary.
A training package [9] which gives guidance on emergency
planning and includes seven in-depth case studies is now
available. Another useful training aid is a video prepared for
CONOCO called April Storm. It shows a major table top exercise

with the involvement of several external organisations.
The most essential training will be in conjunction with the
Emergency Services. It should take the form of a carefully
designed and scripted exercise to test the emergency procedures
which have previously been prepared following detailed
discussions with the Emergency Services. Table-top exercises in
which most of the participants are present in one room are useful
in that they cause minimal interference with plant operation and
they can be conducted at a speed which allows the testing of the
teams reaction to more than a single train of events. A somewhat
more realistic testing of a sites major emergency procedures is
provided by a Control post exercise, preferably held out of normal
office hours. In this case the participants are called out as they
would be in a real incident, and they act in accordance with the
information received at the place required of them by the
emergency procedures. With this arrangement, all necessary
communication systems can be tested properly.
These joint exercises are of particular value in that they expose
any weaknesses in the procedures to which the several teams of
participants are working, and in the interaction of these
procedures. Equally importantly, the exercises help in building
understanding and trust between the participating teams. In the
essential joint debriefing sessions after such exercises, there is
also scope for a helpful interchange of ideas to overcome some of
the problems which have been identified.
6
FINAL COMMENTS
For sound business reasons, planning to avoid a major incident
has been the normal practice of industry for many years.
However, it has also been recognised that the potential for a major
incident still exists and that appropriate pre-planning for such an
incident should be done in order to minimise its consequences.
The process of identifying possible release mechanisms and rates
should result in a full appreciation of the possible major incident
situations, which in turn will allow the drawing up of procedures
to handle such situations. These procedures should be simple,
flexible and widely understood.
In many cases over the years there has been close co-operation
on a voluntary basis between industry and the Emergency
Services in the drawing up and testing of the various emergency
procedures. The Seveso Directive and the associated UK CIMAH
Regulations now require that both on-site and off-site emergency

plans are completed. As these plans must operate together, this
requirement has brought industrys emergency planners into even
closer contact with the local Emergency Services, with benefits to
all concerned.
REFERENCES
1.
2.
3.
4.
5.
6.
7.
8.
9.
Guide to the Control of Industrial Major Accident Hazard Regulations,

Health & Safety Series Booklet, HS(R)21, 1984.
Control of Industrial Major Accident Hazard Regulations: Further
Guidance on Emergency Planning, Health & Safety Series Booklet, HS
(G)25, 1985.
LYNSKEY, P., The Development of an Effective Emergency Procedure
for a Toxic Hazard Site, European Federation of Chemical
Engineering Publication Series No. 42, 1982.
Guidelines for Chemical Sites on Offsite Aspects of Emergency
Procedures, Chemical Industries Association, 1985.
Emergency Planning Guidance to Local Authorities, The Home Office,
1986.
Industrial Emergency Planning Manual, Society of Industrial
Emergency Services Officers, 1987.
PURDY, G. & DAVIES, P.C., Toxic Gas IncidentsSome Important
Considerations for Emergency Planning (HSE), European Federation
of Chemical Engineering Publication Series No. 47, 1986.
DAVIES, P.C. & PURDY, G. Toxic gas risk assessments: The effects
of being indoors. Refinement of Estimates of the Consequences of
Heavy Toxic Vapour Release, IChemE Symp., 8 January 1986.
Preventing Emergencies in the Process Industries, a video training
module available from the Institution of Chemical Engineers.
8
Emergency Plans According to the Law
for Protection against Catastrophes
and On-Site Hazard Protection Plans
According to the Major Hazard
Regulations
W.STEUER
Bayer AG, Leverkusen, FRG
1
GENERAL
Instruction systems are a vitally essential prerequisite for the
management and control of unusual malfunctions and
catastrophes. Without such systems the task forces cannot be
deployed with maximum efficiency.
In the North Rhine-Westphalian Law for Protection against
Catastrophes, passed as long ago as 20 December 1977, the
legislators specified the following in Article 18:
The disaster prevention authorities shall prepare and update
plans for protection against catastrophes and Emergency
Plans for particularly high-risk objects. These plans shall,
above all, specify the alarm procedure, the preparatory
measures and all authorities, units and establishments, as
well as other organizations, to be called upon for assistance
in the event of a catastrophe.
The local disaster prevention authorities and district disaster
prevention authorities shall draw up and update a description of
the hazards of all establishments which, by way of their special
nature, may be the source of a catastrophe risk.
Article 5 of the 12th Directive on the Implementation of the
Federal Air Pollution Control Act (Major Hazard Regulations),
dated 27 June 1980, defines the requirements for limiting the
effects of incidents: In order to fulfil his obligation arising from
Art. 3, Para. 3 (safety obligations), the operator of a plant shall, in
particular, prepare and update on-site alarm and hazard
protection plans which are harmonized with local disaster
prevention and hazard protection planning.
As a result of these statutory regulations, not only have the

terms Emergency Plan and on-site Hazard Protection Plan been
defined, but also their general contents.
2
PLANNING HIERARCHY FROM THE VIEWPOINT
OF A LARGE WORKS
In large works and with large plant units, it is possible that various
buildings of one and the same plant have their own alarm codes
which, taken as a whole, form the Hazard Protection Plan of that
plant. If there are several Hazard Protection Plans for plants
within a works, they are combined to form the Hazard Protection
Plan of the works.
The Emergency Plan, a cooperative effort of the authorities and
the works, adopts the contents of the Hazard Protection Plan of
the works which are of importance for the activities of the
authorities. Finally, the Disaster Prevention Plan of a community
also includes all the existing Emergency Plans.
The following paper (Chapter 9) will give a more detailed
description of Emergency Plans in accordance with the Law for
Protection against Catastrophes and on-site Hazard Protection
Plans according to the Major Hazard Regulations.
3
EMERGENCY PLAN ACCORDING TO THE LAW
FOR PROTECTION AGAINST CATASTROPHES
On the basis of the legal requirement, the Office for Fire Protection,
Rescue Services and Civil Defence of the City of Cologne drew up a
specimen plan, which has been introduced by the President of the
Cologne regional administration as a guideline for drawing up
Emergency Plans for this administrative district. This plan will be
presented here.
The Emergency Plans are always kept by the competent district
disaster prevention authority (e.g. Town Clerk, District Clerk) and
contain the special information required for implementing
measures to protect the public in the event of a catastrophe.
Emergency Plans are only intended for use in conjunction with the
general disaster protection plan of the authorities and the alarm
plan of the operator. The Emergency Plans are updated annually
by the district disaster prevention authority.
The Emergency Plan is compiled in the form of a checklist. The
necessary details are described more precisely in the appendices
to the Emergency Plan. This checklist gives the Head of disaster

prevention a concise management tool allowing him to delegate
orders to the members of his disaster prevention management
team, while the latter use the appendices to initiate and monitor
the individual measures.
The Emergency Plan consists of five sections:
1. Description of the object
2. Reporting and alarm-raising paths
3. Immediate actions in event of an emergency
4. Follow-up actions
5. Appendices
A little more information will be given on the following subsections of Part 3 Immediate actions in the event of an
emergency:
3.1 Establishing the type of hazard
3.2 Establishing the endangered area
3.3 Measuring the gas concentration
3.4 Warning and informing the public
These items cover the essential elements of what is known as the
Leverkusen Model.
4
HAZARD PROTECTION PLAN OF THE WORKS
The Hazard Protection Plan of the works is the plan ranking above
the Hazard Protection Plans of the individual plants. It represents
an overview and summary of the essential measures in relation to
the entire works and establishes the link to the Emergency Plan.
The Hazard Protection Plan of the works regulates tasks and
competences relating to deployment of the fire brigade and other
unusual malfunctions where decisions coordinated between
several managerial areas have to be taken. This includes the
notification and/or alarming of management staff, as well as
internal and external emergency services.
The Plan consists of five sections:
1. General rules
2. Tasks of the management areas
3. Special risks situations
4. Addresses
5. Appendix
Among other things, Section 1 contains the legal principles on
which the specifications made are based. The tasks of the
Technical Task Force (TEL) and the Works Task Force (WEL)the
central managerial bodiesare shown, together with the general
scheme for informing and reporting to agencies outside the works.
Section 2 contains the tasks and competences of the individual
managerial areas, particularly in relation to the required
notification of other or high-ranking areas. As regards the
responsibility for informing, a distinction is made between a main
line and a secondary line.
Section 3 describes the defensive measures in the event of
particular risk situations, for which separate regulations or rules
exist.
Section 4 contains the telephone numbers and addresses of the
management staff of the works nominated by the areas to be
responsible for the organization and implementation of all the
tasks specified in this Hazard Protection Plan. The external
agencies and authorities are also listed.
Section 5 lists all the plans, including those of the public
disaster prevention authorities.
5
ON-SITE HAZARD PROTECTION PLANS
ACCORDING TO THE MAJOR HAZARD
REGULATIONS
It should be pointed out that there are currently some Hazard
Protection Plans which have to be drawn up because a plant is
subject to the Major Hazard Regulations, while others are set up
by the plant in an effort to achieve the greatest possible degree of
passive protection. Regardless of whether or not a plant is subject
to the Major Hazard Regulations, the contents of the Hazard
Protection Plans are identical in both cases.
The Hazard Protection Plan is part of the on-site safety
organization of a plant. It contains information required for
planning and updating defensive actions in the event of danger. In
a system of coordinated organizational measures, it ensures the
greatest possible degree of protection of life and property in the
event of danger.
Thus, the Hazard Protction Plan covers all potential on-site
hazards (e.g. fire, explosion, accident) and off-site hazards (e.g.
malfunctions in neighbouring plants, tanker collisions), names on-
site safety facilities, and specifies special behavioural measures

for the plant staff in the event of an emergency.
The Hazard Protection Plan is directed at the senior staff of a
plant, who should put their colleagues in a position to react
correctly in the event of an emergency. Thus this plan also serves
as a document for plant staff training and drills. In the event of an
emergency, it tells the senior staff what they need to know and what
actions should be taken, also showing the alarm scheme for
deployment of all the necessary on-site technical task forces.
Drawing up the Hazard Protection Plan
Ideally, the Hazard Protection Plan should be drawn up by the
person responsible for the plant in cooperation with the Fire
Protection and Occupational Safety departments. It is important
that, whenever the plan is updated, e.g. following changes in the
materials used, the updated contents are also made known to the
competent task forces. The specimen Hazard Protection Plan
presented here can be regarded as a recipe for drawing up such a
document.
The specimen Hazard Protection Plan consists of two parts, an
organizational part and an informational part.
The organizational part contains all the measures in the form of
on-site instructions governing the special behaviour of plant staff
in the event of an emergency. Lists of actions describing the
behaviour to be adopted in the event of special hazards are
enclosed.
The informational section contains all the information on the
plant which might be of importance in the event of an emergency.
It serves, among other things, as a basis for the fire brigade
deployment plan, which must be coordinated with the plant
management. The informational section is subdivided into three
parts:
Plant overview. A brief description of the plant is provided here
to give the task forces a general idea of the size, type and location
of the plant. All information on the plant which might be of
importance in the event of an emergency should be listed in plans.
These plans should be simple, clearly arranged and easily
manageable.
The following subdivision is recommended:
Processes (e.g. special requirements of license)
Block plan
Buildings plans
Hazard sour ce overview. During normal plant operation, hazard

sources are prevented from becoming dangerous by means of
prophylactic safety measures. However, in the event of unusual
malfunctions, they can create a hazardous situation and lead to
property damage and personal injury. A knowledge of all on-site
hazard sourcesand of those in the immediate vicinityis an
essential prerequisite for successful operations in the event of an
emergency. Consequently an overview must be compiled.
Hazardous substances
Hazard areas
Technical facilities which may be potential hazard sources.
Safety equipment and systems overviews. This document should
list all equipment and systems which are designed to ensure the
safety of the plant staff and the use of which is governed by the
safety instructions.
Systems
Equipment
An overview of these systems is also necessary to allow the
responsible person in the plant to check the presence and
condition of such systems and equipment more easily, and to
facilitate rapid orientation in the event of an emergency. The task
forces need this overview in order to coordinate their actions in
the plant.
Depending on the requirements of individual plants, the
subdivision of the sections can be adopted as described,
condensed or expanded. However, whatever form of subdivision is
used, it must always be ensured that the groups and/or
departments requiring to be instructed and/or informed are
included as target groups. Thus the list of recipients of these
Hazard Protection Plans can be based on target groups. The
structure in Table 1 is just one possibility. Heads of department,
plant managers, safety officers, plant engineers, fire prevention
and occupational safety officers receive the complete Hazard
Protection Plan. Drawing up plans takes time and effort, as does
any planning. Be prepared to sacrifice this time. You may then
already have won half the battle for safety.
Table 1 Recipients of Hazard Protection Plans
9
Co-operation in Emergency Planning
T.DICKIE
BP Chemicals Ltd, Grangemouth, UK
1
INTRODUCTION
The town of Grangemouth, on the River Forth, hosts a number of
companies in the oil, petrochemical, chemical and associated
businesses. Since 1968 these companies, together with the
Emergency Services and statutory bodies, have formed a voluntary
Major Incident Control Committee (MICC) with the original, and
still valid, purpose of examining the material in each works and
its hazard potential, examining the organisation in each works for
dealing with it, exploring the integration of the various systems
and setting out methods for controlling the emergency should a
Major Incident occur. The following list of the current members
may give an indication of the Committees scope:
Borg Warner limited
BP Chemicals Limited
BP Oil Limited
BP Oil Grangemouth Refinery Limited
Central Regional Fire Brigade
Calor Gas Limited
Central Scotland Police
Central Regional Council
Enichem Elastomers Limited
Falkirk District Council
Forth Ports Authority
Health & Safety Executive

Macgas Limited
Imperial Chemical Industries Limited
Rohm & Haas (UK) Limited
Ross Chemicals and Storage Company Limited
Scottish Ambulance Service
2
DEFINITION OF A MAJOR INCIDENT
The definition of a Major Incident has developed over the years as
earlier definitions were tested by incidents which appeared to
approach the borderline; the current wording is
A Major Incident is defined as an industrial incident which
(a) is likely to affect, or is affecting, the safety of people outwith
the undertaking, and/or
(b) requires external aid in fire-fighting, police and ambulance
services etc. beyond the normal call-out attendance, after
consultation by these Emergency Services and site
managements.
3
MAIN COMPONENTS OF THE EMERGENCY PLAN
The Committee has long recognised the importance of having the
individual emergency plans of the Emergency Services and the
industrial organisations dovetail into the overall MICC plan, and
for this and other reasons the overall tone is that of simplicity.
The plan provides for a main control centre in Grangemouth
Police Station and forward control nearer the scene of the incident.
Main Control is housed in a suite of 3 rooms designed, equipped
and maintained specifically for the purpose. There is a central
room used by the Police with one adjacent for the use of Technical
Advisers and another for officers of the Fire and Ambulance
Services.
Each industrial members site is linked to the Police Station by a
dedicated
Omnibus
telephone
system
which
allows
communication between the Police Station and either individual
sites or groups of sites. This is very simple, and perhaps rather
old-fashioned, but it works and can be tested readily and
regularly. It is, of course, supplemented by the radio

communications of the Emergency Services and the industrial
members, but it is quite common to encounter difficulties with
radio trans-mission/reception in and around plant structures. To
eliminate any doubt or hesitancy at the outset of an incident, the
first call to the emergency services goes through via the normal
telephone system in the standard way.
The reference to Technical Advisers above comes from the plan
which provides that, in the event of a Major Incident being
announced, each industrial member sends one senior member of
staff to Main Control to assist with technical advice and
information on the availability of mutual aid.
The plan provides for an industrial gas detection service by
which three of the industrial members provide radio-equipped vans
manned by suitably trained staff to monitor the level of gas in the
atmosphere in any given area.
The plan has specifie sections for the Grangemouth Docks area,
for gas releases and for radioactive substances. It also has a
section listing the equipment which can be made available from
member companies on a mutual aid basis if required in the event
of an incident.
The plan is co-ordinated with the Central Regional Council offsite contingency plan prepared under the CIMAH Regulations. The
Committee is used to obtain the agreement of the companies to
the off-site contingency plan and any amendments to it. The
Committee was also used as the vehicle for a joint approach by
the top-tier sites through Falkirk District Council to implement
the requirements of the CIMAH Regulations regarding notifications
to the public.
4
EXERCISES
The main purposes of exercises are to train staff in the procedures
and to test and improve the procedures themselves. There are
three levels of exercise in use at present. Each week the Police
Service tests the Omnibus telephone circuit by calls to each
member. This very simple test not only ensures that the equipment
is working properly, but provides a regular opportunity for new,
replacement or stand-in staff to become familiar with its use.
Also, each week, one of the industrial members initiates a small
exercise by calling the Police Station on the Omnibus telephone,
notifying the Police of an incident and asking for assistance which
may be in one of several forms such as setting up road-blocks or
having another member provide some specified emergency

equipment. Again, this is simple but ensures familiarity with the
system.
Less frequently, currently about twice per year, more ambitious
exercises are held. These involve setting up and manning forward
control and main control and working through a scenario devised
by an exercise sub-committee. These exercises have involved the
deployment of police to road blocks but, due to restricted
availability of manpower, have not involved the deployment of fire
and ambulance personnel beyond the attendance of officers at
forward and main control.
5
EXPERIENCE OF AN ACTUAL INCIDENT
In 1986 the plan was used in earnest when a small leak of bromine
gas from one of the factories affected people in neighbouring
premises and threatened to affect people in houses nearby.
The arrangements worked well and it was clear that the time
spent in developing the plan and training people meant that the
administrative side fell into place, allowing staff of the emergency
services and the technical advisers to concentrate on dealing with
the implications of the incident.
One lesson learned which had not become apparent from the
exercises was that the Department of Environmental Health of
Falkirk District Council became a main contact point with the
public for the flow of information, and the plan has been modified
to reflect this.
The Emergency Planning Officer of the Regional Council used
the incident as a springboard for further training of Local
Authority organisations such as the Housing or Education
departments and voluntary organisations such as the WRVS in
the roles which they might be called upon to play. This aspect
belongs to the Regional Councils off-site contingency plan, and
the Emergency Planning Officer arranged a suitable training
course making use of speakers from the MICC.
6
UPDATING THE PLAN
The Committee meets quarterly with ad hoc Sub-Committees, e.g.
on communications or on updating the manual, meeting
separately as required. The plan itself is not static. For example, in
the last year the arrangements for information flow within Main
Control have been improved, and the locations of anemometers

held by members have been listed in the manual. (Experience has
shown that wind direction and speed can vary considerably within
the area.)
In conclusion, the Committee members recognise that, while
they strive to ensure that the plan is effective and that personnel
are trained in its implementation, it represents one part of a wider
safety process which has the prime aim of preventing emergencies
as well as containing any which may occur.
10
Emergency Response Planning OffSite of Chemical Plants
BENNO KIER & GNTHER MLLER
Rheinisch-Westflischer Technischer berwachungsVerein eV, Essen, FRG
1
INTRODUCTION
In the past, emergency response and contingency planning was,
on the whole, based on lessons learnt from previous events. The
majority of these events were usually natural disasters, such as
floods, large fires, avalanches or earthquakes, which to some
extent occurred periodically in specific areas. Because of the great
danger this caused to the life, health and property of those
affected, additional steps were taken to prevent these disasters
and plans developed to limit their effects. Generally, these plans
encompassed the provision of aid for combating disasters, the
rescue and the care of the population, as well as the selection and
training of suitable personnel for these tasks. Urgent decisions
were taken by those responsible in each case without any forward
planning of support services.
This procedure was also adopted in principle for those additional
dangers which arrive with the increasing mechanisation of traffic
installations and industrial plants. The organisation, training and
equipment needed for disaster management were geared to the
aftermath generally to be expected from serious accidents in these
installations mainly to the fighting of fires, the recovery of and
caring for victims, as well as the evacuation and accommodation of
parts of the population in special cases. There was no evidence of
any major link between the actual causes of accidents and
sources of hazard on the one hand, and a preventive protection
plan on the other.
Specific disaster management planning was first undertaken
with the introduction of nuclear power because of all the Radiation
hazards associated with it. The type, scope, chronological
sequence and range of possible accidents were incorporated into
this plan, as were the special technological aspects of the

individual plant and its respective location.
This concept allows detailed prior planning of all necessary
defence measures against each particular incident, and also a
reality-based testing for such measures.
Conventional industrial plants, especially in the chemical
industry, in which hazardous substances are produced, treated,
stored and handled, also have a high hazard potential
Over the past few years this technical development has led to
ever larger production units being erected and, at the same time,
to the concentration of an increasing number of different
installations and works on single sites. In addition, existing
installations near residential areas are, increasingly, being
renovated, developed, or replaced by new processes. It can be
assumed that, thanks to the efforts of manufacturers, operators
and authorities, the safety of such installations regarding
incidents and the associated effects has been constantly adapted
to keep up with the developments in process technology.
Even so, basic scientific considerations and actual far-reaching
incidents in chemical installations, both in Germany and abroad,
show that accidents with adverse effects on the surrounding area
cannot be completely eliminated by acceptable technical means.
Even though emergency response plans have already been
drawn up available for a range of installations in the Federal
Republic of Germany, and preventive measures have been
organised in certain areas between the operators and the
authorities responsible for the prevention of catastrophe under
special agreements, there is still a shortage of uniform
regulations. For this reason, experiences accumulated to date are
being evaluated and supplemented. It is especially necessary to
adapt the emergency measures to the situation at the specific
plant (e.g. type, size and hazard potential) and at the specific
location (e.g. population density, traffic routes, orography), to
harmonise them with the plant-based safety precaution plans and
to ensure an exchange of information between the public bodies
responsible for contingency planning, without any secrecy
restrictions.
In order to draw up suggestions for a common guideline, the
Federal Office for the Environment in Berlin instructed us to
conduct a study in 1981. The aim was to throw more light on the
use of the existing emergency response plan, both in Germany and
abroad, as well as to compile the major requirements for plantspecific emergency response plans.
2
RESULTS OF THE INVESTIGATION
Operators of plants, authorities and competent associations were
questioned and the relevant literature was evaluated in order to
determine the state of emergency response planning in Germany
and abroad. It became clear that the legal stipulations represent a
substantial prerequisite for effective emergency response planning
and are particularly important for the allocation and demarcation
of the tasks and areas of competence of those involved. Converting
them into concrete plans, however, depends to a crucial extent on
the circumstances of each individual case. Accordingly, within the
legal framework, there were found to be considerable differences
with regard to the measures to be taken to meet these
requirements. This applies to both the organisational
requirements and the personnel and technical equipment needed.
On the basis of general disaster management planning, the official
emergency response plans include specific and specialised
measures and preparations with regard to particular hazardous
objects. Such measures and preparations relate in each particular
case to the specifie features of the particular objects whose
storage facilities, production facilities or special properties mean
that the possibility of a hazard arising cannot be discounted.
Planning must also take account of the residential and traffic
structure of the site, the orographie conditions prevailing and the
current meteorological conditions.
The investigation revealed that the spectrum of planning
variants ranges between two basic views. Dynamic emergency
response relies on high flexibility in the leadership and services
without the detailed prior planning of corresponding individual
steps. It concentrates on the decision-making capacity of the
leadership of the services, the rapid mobilisation of personnel and
the constant availability of technical equipment and aid. In
contrast to this, detailed planning provides for highly
differentiated instructions, descriptions and prepared specific
measures. This is because of the high physical and psychological
burden on all those involved in a hazard situation. It provides
decision-making aids with regard to immediate measures and
provides all the necessary information for further procedure.
Specifically, the following aspects were evaluated:
Structure and content of disaster response plans
Characterisation of hazard potential (description of object,
hazard and location)
Cooperation between operators and authorities

Organisations involved; equipment and aids available
Service strategies (determination of situation, alerting of the
general public, traffic control, evacuation, assistance)
Practical instructions and decision-making aids for the alerting
of disaster services, initiation of measures and control of the
defence operation
Interaction of various types of service teams
Documentation of the incident chronology and the defence
measures taken
3
CONVERSION OF THE TEST RESULTS FOR A
DRAFT GUIDELINE
The legal framework for the preparation of hazard prevention
plans in the vicinity of conventional plants with high hazard
potential is laid down, on the one hand, by disaster management
legislation and, on the other, by anti-pollution legislation.
The Disaster Response Act (Katastrophenschutz-Gesetz) obliges
govern-ment bodies to go beyond the safety of plants and
transport facilities by also ensuring that the effects of any residual
risk remain limited. Such a risk may be rated as a very minor
factor in the technical rules, but its possibility cannot be excluded
entirely. The government bodies are also to ensure that the effects
of the residual risk are countered without delay when there is an
alarm. This obligation is covered by a series of regulations on a
Federal and State level. The existing regulations contain the legal
possibilities for emergency response for such planning as well as
clear statements regarding their requirements.
The Federal Anti-Pollution Act is mandatory for the plant
operators. Its purpose is, in conjunction with the ordinances and
administrative regulations passed on the basis of the Act, to
protect humans, animals, vegetation and other objects from
damaging environmental influences and, inasfar as plants are
concerned which are subject to licensing, also from hazards,
substantial disadvantages and substantial burdens which may be
caused in some other way, and to prevent damaging
environmental influences from arising.
Already this statement of the Acts purpose directly imposes an
obligation to ensure preventative protection against hazards,
entailing not only state-of-the art safety precautions but also
emergency response measures. This requirement is put into
concrete form in the Incidents Ordinance (12th BImSchV). This
ordinance lists, among other things, operational alarm and

emergency response plans to limit the effects of incidents, plans
which are to be drawn up and updated to fit in with the local
disaster management and emergency response planning. The
Second General Administrative Regulation to the Ordinance
Decree (2nd Strfall VwV) expressly mentions related details of
organisational protection facilities and operational emergency
response plans. From this we obtain starting points for objectrelated or plant-related emergency response. These starting points
are reflected in the requirement for special protection plans in the
disaster response acts of a number of federal states. Such plans
have to be drawn up for special hazardous objects within the
framework of general disaster management. Further federal and
state regulations can be consulted to back up and fill out specific
prevention planning in the surrounding area of hazardous plants,
especially chemical plants and refineries.
The planning, strategy and logistics of the plant-specific
emergency response have to be based on the type and scope of the
potential hazards for a particular plant, and on the special
conditions and prerequisites in the area around the site.
Thus a hazard analysis should be considered as a first step. An
object description is drawn up first of all, including a list of all
identifiable hazard sources and hazards. In addition, further
information is useful to ensure emergency response, such as
Apparatus and vessels for hazardous substances and
hazardous processes
Possible but undesirable reactions of substances being handled
Pipelines and pipe bridges for hazardous substances
Loading sites for hazardous substances
Sites with high fire hazards
Where there is a hazardous situation, it is crucial to have
information on the type and properties of substances with which
the emergency services or general public will be confronted. In a
works analysis, the substances to be anticipated are allocated to
the individual plant parts. For the individual substances,
instructive details should be provided of
The properties of the substances
Their possible reactions
The effects of the substances on the human organism, on
animals and vegetation, on water and fish, on the soil, on
agricultural areas and on food supply operations
The DIN safety data sheet, which is to be drawn up by the

producers of hazardous substances, can serve here in particular
as a source of information.
In addition to the effects of substances, the following details are
also relevant at this stage, with specific reference to individual
substances, in order to cope with the consequences resulting from
a discharge:
Protective facilities (e.g. filters)
Possibilities for counter-measures
First aid measures for injured persons
Therapy in the case of hospitalisation
Finally, the conceivable forms the hazards could take should be
listed:
Fire over a very wide area
Gas discharge: possible quantities, discharge rate, duration of
discharge, propagation characteristics
Shock wave with distance parameters for the effects of the
pressure (e.g. 035 bar, 003 bar, 001 bar)
Devastated areas (e.g. in the case of a tank explosion)
Explosion, deflagration
Contamination of soil and water, with indication of the effect
boundaries
With a view to the fact that there may be an alarm or evacuation of
the population affected by a hazard, details of the chronology of an
event are also important. Such details include
Estimation of the time spans between when a hazard situation
arises or is detected and conceivable effects in the surrounding
area
Establishment of the probable remaining time to alert the
emergency services, warn the public, take measures
Details of the probable chronology of hazard effects (e.g. in the
case of airborne emissions in various meteorological conditions)
To delimit the surrounding area which the plans are to cover, the
maximum range of the effects has to be estimated in detail, and in
addition the objects requiring special protection in the potential
impact area have to be determined. Objects requiring special
protection include, for example
Installations and facilities which themselves have a hazard

potential
Densely populated residential areas
Hospitals
Schools, social welfare facilities, meeting places, lodging
facilities
Drinking water source areas, waterways and stretches of water,
traffic routes
Plants and stores connected with foodstuffs
Other objects of high value in the meaning of Article 2,
Paragraph 2, No. 3 of the Incidents Ordinance
The details are listed in a practical form and presented in plans. A
valuable aid in hazard analysis, in particular with regard to
determining the causes, the chronological sequence and the
spatial extent of the effects of accidents, is the evaluation of past
events. Events which necessitated major counter-measures are
especially useful in indicating how to draw up new plans and
updating existing emergency response plans. Specially suitable for
this purpose is the documentation of accidents and incidents
where the events have been recorded in standardised form, i.e. as
has been done in the systematic recording of facts relating to
damage events, accidents and incidents, where such facts are
important for damage prevention and emergency response.
When an alert situation has been established, suitable
measures have to be initiated immediately. To enable the
competent bodies to take necessary steps in a correct and
complete fashion without any delay, alert calendars should be
drawn up and made available at the individual points. Alert
schedules are a list of the conceivable activities and arrangements
for the various bodies, as needed in the specifie situations, bodies
such as
Management of the disaster services
Police
Fire brigade
Medical services
Social welfare services
Since they can be used as check-lists, they make possible a
reliable and complete check of the measures to be taken.
The alert procedure should be divided into stages which involve
the relevant services according to the increasingly hazardous
nature of the situation.
Evacuation of large areas in the vicinity is an especially difficult

task in emergency response. It may be necessary to evacuate
neighbouring plants or residential area if
after the onset of an event it is found that no adequate
protection is provided by staying in enclosed rooms there, or
it has to be feared that, as the disaster develops (e.g. spreads),
this protection can no longer be guaranteed
The possibilities for evacuation are thus determined to a crucial
extent by the time-related nature of the incidents level of impact
on the surrounding area. The preparation and implementation of
any evacuation measures and the decision to set them in motion
have to take account of this time dependence.
Evacuation after the onset of an incident is only meaningful if
persons in enclosed rooms are at direct risk because of a
persistent exposure of the area concerned (e.g. through high
concentrations of hazardous substances in the ambient air, toxic
deposits, severe thermal radiation). On the other hand, it must be
noted that the exposure of these persons and the disaster services
to the effects of an incident during evacuation may also constitute
a considerable hazard. A decision on the relevant procedure to be
adopted can be taken with the help of an estimation as to the
impact alternatives to be expected.
A preventive evacuation of areas in which a hazardous impact
may arise, or can be expected as an incident develops (e.g. spread
of a fire, subsequent explosion, change in the direction of
propagation of toxic substances), assumes the most detailed
knowledge possible of the hazard situation and its further
development. The earlier such preventive measures can be
initiated and concluded, the smaller the effort involved in the
evacuation and the risk for the persons and services affected.
With sudden, short-lived incidents which have an impact lasting
only up to a few minutes, evacuation can be practically discounted
because of the practice already described and the preparatory
time needed.
11
Industrial Emergency Planning in The
Netherlands
H.O.VAN DER KOOI & H.K.VUYK
Ministry of Social Affairs, Voorburg, The Netherlands
1
INTRODUCTION
Although there are nowadays many chemical factories, producing
thousands of dangerous chemicals, only in certain big companies
are there extended emergency plans and schedules. Generally,
small and medium-size chemical industries have not such well
developed emergency plans. However, it is the duty of the
authorities in the European countries on behalf of the EC Seveso
Directive to ensure that there should be emergency plans in
companies with major hazard risks.
An explanation will be given about the practical situation
concerning the Industrial Emergency Plan in Holland. There are
two main parties involved in the action to be taken in emergency
situations:
Public authorities
Companies
With respect to the activities of the public authorities, the
obligations are laid down in the Act on Calamities. Since January
1985 this act has been in force. In this act it is stated that in case
of calamities, of whatever nature (airplane crashes, the aftermath
of large-scale incidents at a chemical plant, railway accidents,
etc.), the supreme responsibility in righting the disaster is in the
hands of the public authorities, particularly the Mayor. In case the
effects of such a disaster extend beyond the municipal borders
this act lays the competence at a higher administrative level (e.g.
the Provincial Governor or even the Minister of Home Affairs). As a
second point, this act gives the obligations to the authorities to
draw up emergency plans with respect to disasters which can
happen at undefined places. Thirdly, the authorities have to set
up so-called calamity fighting plans in case the risk of such a

calamity is confined to a distinct area and connected with
industrial activity.
With respect to the activities inside industry, there is a
requirement in accordance with the Working Environment Act of
November 1980 to have an industrial emergency plan. This
requirement can be ordered to major hazard companies. These
companies are already obliged to draw up an occupational safety
report, in accordance with the so-called notification in the EC
Seveso Directive. The designation of the major hazard companies
takes place on the basis of having certain minimum amounts of
dangerous chemicals. The requirements of an industrial
emergency plan are given in a publication Guideline for the
setting up of an industrial emergency plan, which will be officially
published by the Directorate General of Labour in the near future.
2
INDUSTRIAL EMERGENCY PLAN
In our opinion the following starting points are important in
making an Industrial Emergency Plan:
Evaluation of the risks based on safety analysis
(a) Insight in the amount of fire-fighting and rescue equipment
(b) Nature of the dangers as toxicity, explosion hazard
(c) The possible extent of the effects of pressure waves, heat
radiation, dispersion of toxic clouds
(d) The probability that such a calamity can take place
Preceding research of the companys own means and services
Relation with the organizational set-up of emergency response
systems by the public authorities
Participation in mutual assistance systems
Among the basic elements of an Industrial Emergency Plan are
(A) Management and coordination. Industrial Head Coordination
has the overall management and coordination in the emergency
activities inside the establishment. In most cases this function
belongs to the managing director of the company. He is located in
a head coordination centre which is equipped with all the
necessary facilities.
(B) Industrial coordinator at place of accident. It is preferable to
coordinate the actual activities of assistance and fighting by a
person closely involved in the industrial activity. He declares the

state of emergency on the industrial area and eventually orders
shut-down of installations. The production manager is most
suitable for doing this job. In any case there must be rules of
consignment to be sure that at any time such a functionary can
be committed immediately after the event. The Industrial
Coordinator at Place of Accident contacts the assistance services
and the head coordination centre by means of telephone or
orderly.
(C) Overall management and coordination in the affected area. In
the case of a great catastrophe this is in the hands of the Mayor of
the municipality. All people who take part in fighting the calamity
are under the command of the Mayor. The Fire-master is in
charge of the operational management.
3
FIRE-FIGHTING AND ASSISTANCE IN
EMERGENCY CASES
Various industrial services have a duty in fighting, assisting at,
and controlling an accident. Each service acts according to a
prepared action-plan, fitting into the total industrial emergency
plan. Such an action-plan varies in accordance with the severity
of the emergency situation.
(a) Industrial fire brigade. The tasks of fire brigades are of course
the firefighting, the prevention of escalation, the protection of
apparatus and the rescue of victims. The plan of attack should
describe the detailed situation in the plant: storage and amounts
of chemicals, properties of the chemicals, provisions of firefighting water, extinguishing foam and special appliances,
knowledge of the electrical power system, emergency power
provisions and, not least, the relations with the Industrial
Coordinator at Place of Accident and the Head Coordination
Centre.
(b) Security service in emergency cases. Control of the traffic
through the gate, blocking the disaster area, keeping the roads
free for fire-brigade and other assistance, registration of visitors
and announcing the special situations to them, removal of
unauthorized persons, being informed about the admission of
emergency staff and people and also the authorities etc. These
tasks and instructions should be recorded in an action-plan fitted
into the Industrial Emergency Plan.
(c) Industrial safety service. Assistance in the evaluation of the
appearing hazards, giving recommendations concerning safety
measurements, determining the dispersion of toxic emissions.

Reports all necessary information concerning the accident, causes
and course of the fighting, to the Industrial Coordinator at Place
of Accident and the Industrial Head Coordinator.
(d) Industrial health service. For effective medical assistance a
medical emergency plan is desired. In such a plan the
organization of this service, the coordination during the various
stages of the accident, and the relations with the other services
should be stated. Besides that, the procedures for alerting the
health service, the regional health service and the ambulance
service, the medical help, the assistance of other organizations,
e.g. Red Cross places for the interception of wounded people, their
identification, the transport priority to hospitals and the
consultation of the National Toxicity Information Centre should be
described.
(e) Production departments. The production manager has the
coordination about all activities on plant-operational level in case
of an emergency. Plant control and emergency shut-down are his
responsibility and should be described in emergency procedures.
(f) Engineering services. There should be a technical emergency
action-plan which describes the emergency power provisions, the
disposition of electricians for securing of apparatus for safe
extinguishing, etc.
(g) Specialists. It can be important to have certain specialists at
hand in case specifie hazards are present, e.g. gas specialists,
specialists on radioactive materials, and gas surveyors for
determination of explosive and toxic gases.
(h) Public relations. During a major emergency the Industrial
Head Coordinator will report to the media. In case another PR
functionary has been designated, provisions must be made for his
accommodation. Specific instructions must be available for this
functionary.
4
ALARMS, MOBILIZING PROCEDURES AND
COMMUNICATIONS
Procedures must be available for triggering and sounding the
alarm if the latter is initiated from a central communication post.
Also procedures should be described for the call-out of key
personnel and for mobilizing emergency services, as well as the
systems and devices for communicating information to staff and
plant personnel. If there is a hierarchy of alarms (minor, fire, gas,
major emergency) each particular alarm will have to be described
as well as alternative means or back-up systems in case the

normal system fails. Also the required action of key personnel and
emergency services, in accordance with the particular alarm type,
should be indicated.
4.1
Declaration of the major emergency situation
and evacuation
This is a primary task of the Industrial Coordinator at Place of
Accident. In case of a calamity/emergency situation it should be
obvious for everyone in the company when, and in which area, an
emergency situation exists.
At the same time the public authorities should be informed
about the emergency situation. In most cases the fire brigade is
alerted at first. Also the surrounding companies should be
informed about the situation.
An evacuation action-plan must describe how workers can be
evacuated safely. The decision of evacuation is made by the
Industrial Head Coordinator in consultation with the Industrial
Coordinator at Place of Accident.
Procedures should also be included with respect to giving the
all clear signal. In major emergency situations the decision will
be taken by the public authorities.
4.2
Training and exercises
Having established the emergency plan, it is essential that all
people involved are trained and exercised with adequate frequency
in emergency situations to create expertise and confidence in the
emergency plan. This is to be developed from simple to fully
simulated exercises for various scenarios in which external
services participate.
12
Emergency and Intervention Plans:
The French Experience
M.GENESCO
Direction de la Scurit Civile, Paris, France
Emergency planning for natural or technological disasters is at

present based on the ORSEC plans for each of the French
geographical departments and the technical annexes to those
plans. The emergency plans make it possible to mobilise and
commit resources on a large scale, generally throughout an entire
department when local emergency arrangements prove
inadequate.
The operational validity of the concepts on which these plans,
which have moreover been adopted by several foreign countries,
are based has been successfully put to the test on numerous
occasions. However, the experience of recent years has shown
that accidents can occur which exceed the risk management
capability of a single department.
To deal with situations resulting from such major disasters it
has been decided to apply the principle of the ORSEC plans to
larger areas (zones de dfense). However, these new operational
arrangements, which establish in general terms how official
intervention is to be organised, will not replace planning for
specifie accident situations.
As regards hazards connected with the storage, transport or
processing of chemical and toxic substances, new emergency
planning was necessary similar to that already undertaken for
radiological hazards, to cover accidents within industrial
installations capable of causing damage to the population or the
environment. This is the objective of the new departmental plan
known as ORSEC risques technologiques which will replace the
plans known as ORSEC hydrocarbures dating from 1967 and
ORSECTOX dating from 1973.
This revision of operational planning to deal with technological
hazards was essentially the outcome of the following factors:
The development of modern industry and technology had
engendered new hazards which, whatever the degree of
prevention or of industrial safety and reliability, could never be

entirely eliminated
Industrial change had, in particular, led to the creation of
petrochemical complexes within which there were a variety of
plans with the same objective, e.g. the ORSECTOX plan, the
Hydrocarbure plan, the special protection plan
The ever increasing complexity of the chemicals industry has
meant an increasing concentration of risks and required better
emergency planning to cope with all eventualities, despite the
strict preventive measures imposed by French legislation.
In this context, the so-called Seveso Community Directive of 24
June 1982, concerning major accident hazards posed by certain
types of industry, prescribed various measures relating to both
prevention and protection of the population of which account had
to be taken. For this purpose, the heads of the emergency services
have, in close collaboration with the government departments
concerned, drawn up operational emergency plans for
technological hazards (chemicals, hydrocarbons) on the lines of
those prepared since 1978 in regard to radiological hazards.
Henceforth the indispensable collaboration between industry
and government in the event of accident, both to provide
information and to carry out relief operations, will take the form of
a narrow interface between an on-site emergency plan (POI) for
which the operator will be responsible and a special (off-site)
intervention plan (PPI) drawn up and implemented by the
commissioner of the Republic.
This new form of emergency planning will apply to industrial
establishments or plants covered by the Seveso Directive, i.e.
some 300 in France, including stocks of hydrocarbons with a
capacity of over 600 m3. It will be accompanied by an evaluation
or revision of the risk assessments for each establishment and
correlatively by an exhaustive and detailed analysis of possible
accident scenarios.
A considerable part of these plans deals with emergency
warning arrangements and information for the population, local
authorities and the media, notably by the conclusion of
information agreements between the commissioner of the Republic
and the plant operator.
The
departmental
plan
known
as
ORSEC
risques
technologiques is therefore the outcome of inter-ministerial work
over a two-year period involving the Ministries of the
Environment, Industry, Defence, Health and the Interior. It was
sent out in July 1985 to all local authorities concerned, together
with a time-table for the preparation of a POI and a PPI for each
installation affected.
The POI (on-site emergency plan) lays down what the plant
operator must do to safeguard his installation and workers. It also
stipulates exactly how internal and external emergency resources
are to be used. Such resources are initially to be implemented
under the authority of the plant manager and subsequently,
should the accident spread or threaten to spread outside the
plant, under the responsibility of the commissioner of the
Republic or his representative.
The POI naturally reflects the pre-established risk assessment
and lists appropriate resources and facilities at the disposal of the
operator to deal with the situation. The PPI (special intervention
plan) deals primarily with how outside relief is to be organised and
with information to be provided to people living near the site.
Like all plans of this type based on the ORSEC approach, it
states how emergency warnings are to be given, how the various
command posts are to be activated, and what is to be done by
local and regional government services. In addition, the plan has
three levels of application depending on the scale of the accident.
Level 1: Non-toxic accident
Level 2: Toxic accident confined to the installation
Level 3: Toxic accident with off-site consequences
The PPI also covers situations arising as a result of unlawful acts
perpetrated against installations.
To ensure that the new plan is operationally effective, numerous
arrangements have been or are about to be made:
Mobile chemicals emergency (CMIC) have been set up in the
departments which are most at risk, owing to the number of
installations requiring a PPI, or in terms of the volume of
hazardous substances transported, i.e. in 15 departments in
1986 and a similar number in 1987.
Rapid emergency warning and information arrangements have
been made for populations which could be affected by the
consequences of an accident.
Heads of agreement have been established between the
authority responsible for emergency relief operations and local
radio stations.
An intervention unit of the emergency services (UISC) has been
created, specialising in nuclear and chemical hazards, and will
represent a significant additional capability in this area.
Lists have been prepared of computer data-banks providing

information about hazardous and toxic substances so that
relief workers on the spot can be better informed.
The following appendix deals with the fire which occurred at
Nantes just a short while ago (29 October 1987).
APPENDIX: THE NANTES ACCIDENT
A.
Products involved
NPK fertiliser in the form of chloride and nitrate. A nearby silo
containing 850 tonnes of ammonium nitrate did not explode. The
combustion of these products gave rise to emissions containing, in
particular, HNO3, NO and NO2, Cl2, and NH4.
B.
Protection measures taken
1. Immediate evacuation within the security perimeter
2. Preliminary confinement of the population to their houses
3. Evacuation of the population of 7 parishes (i.e. 45 000
inhabitants including 8000 school-children and several old
peoples homes)
4. Interruption of traffic on the Loire and the Nantes-St Nazaire
railway
C.
Lessons to be learnt from this event
1. Application threshold of the Seveso Directive
2. Evaluation of the consequences:
difficulty of discovering the origin and composition of the
products (industrial secret);
difficulty of quick disposal because of the nature and
concentration of the toxic products generated by the
combustion;
need to be able to mobilise specialised means quickly, in
particular: a) protection of individuals, and b) analysis and
identification.
3. Measures for protecting the population:

benefit in having radio communications available;
exemplary reactions of the population;
solidarity observed between the evacuating parishes and the
welcoming parishes;
effectiveness of the ORSEC plan.
Chronology for 29 October 1987
09.36 Beginning of the fire alert
10.08
10.20
11.20
11.40
14.15
16.00
16.10
17.00
18.30
19.00
22.00
07.00
Fertiliser
silo
(Frensit
storage)
Installation of the mobile First sampling of toxic
PC
vapours
Setting up of the 500m Evacuation of 3 poisoned
safety perimeter
people
Alert
of
the
national
authorities. Setting up of
the crisis PC
Sending
of
airborne Preliminary confinement of
monitoring systems and the population
specialised
means
of
analysis
Triggering of the ORSEC 43 000 people involved
plan
20 000 evacuated
Evacuation
of
the 25 taken to hospital
population
Results
of
the
measurements
Fire contained
The
toxic
emissions
continue.
The
wind
direction
changes.
Supplementary means of The evacuation continues
protection for people and
accommodation proposed
Fire not extinguished.
Sources of supply lacking
End of toxic emissions
Return of evacuated people The
checks
continue
to their houses
throughout the night
The
ORSEC
plan
terminated
100
SESSION III
Exercises and Auditing of
Emergency Planning
Chairman: H.SIGEMUND
State Ministry of the Interior, FRG
Rapporteur: J.HEFFERNAN
Department of Labour, Ireland
13
Plan for Off-Site Exercises
A.M.PARANHOS TEIXEIRA
National Service for Civil Protection, Lisbon, Portugal
1
GENERAL COMMENTS
1.1
Responsibility for the civil protection plans
The drawing up of civil protection plans and the carrying out of
civil protection operations in Portugal is limited to the effects of
major accidents outside manufacturing installations. Within these
installations, the company where the accident takes place is
responsible.
The Portuguese National Civil Protection Service is a very
decentralised service and, consequently, responsibility is assumed:
at
at
at
at
the
the
the
the
municipal level (mayor) by the SMPC;

regional level (regional government) by the SRPC;
district level (prefect) by the SDPC;
national level (prime minister) by the SNPC.
When there is a major accident, however, or a catastrophe which

has considerable effects on large areas and their populations, and
for which one can see, as soon as it begins, that the lowest level
will not be able to deal with it, responsibility is assumed by the
National Service (SNPC) which draws up plans and carries out
civil protection operations.
As an example we may cite a serious earthquake at Lisbon, or
the massive escape of several tonnes of toxic gas in the Estarreja
region. We will now deal with this last example.
EXERCISES AND AUDITING OF EMERGENCY PLANNING 103
1.2
Characteristics of the Estarreja case
Estarreja, with local government offices, is situated north of Aveiro
in the coastal plain where the height above sea level is less than
50m. The population of the town and its surroundings is about 15
000 inhabitants, who are mainly employed in the agricultural
sector, as the region is one of the most fertile in the country.
The nearest heights above 50 m are to the east of the town about
2 km away. The town and these heights are separated by the
Antua river which is thus an obstacle to rapid evacuation of the
towns population to the higher surrounding ground.
The region is crossed by roads and paths in several directions
and by the Lisbon-Porto railway in the N-S direction. This railway
crosses an industrial area situated NNW of the town; the industrial
region is surrounded to the east and west by large tree-covered
areas (Pinus pinaster and Eucalyptus globulus).
The dominant winds generally blow, with some regularity:
from NW to SE for about 8 months per year;
from SW to NE for about 3 months per year;
from E to W for about 1 month per year but irregularly.
The average speed is about 45 km/h, except for the SW winds, of
which the average is about 2030 km/h with gusts which may
reach 5060 km/h.
Some 3 km to the NW of the town there is a group of four
chemical factories which produce several very toxic, and
sometimes explosive, gases which are heavier than air:
Quimigal factory: ammonia, NH3 (toxic and explosive vapours)
Uniteca factory: chlorine, Cl2 (toxic)
Isopor factory: phosgene, COC12 (toxic)
Cires factory: vinyl monochloride, CH2CHC1 (explosive and
toxic)
(Chlorine and phosgene were used as combat gasses in the First
World War.) Account must also be taken of how the gases react
together.
These factories have been constructed according to all the
standards imposed by the law and are authorised by the
Portuguese administrative authorities. Their activities are in
accordance with the legislation in force, and all the safety
standards imposed by these authorities are respected.
Furthermore, one may also say that all the industrial equipment
is up to date and conforms to the safety standards established by
the law.
One may thus assume that it is very unlikely in normal
conditions that a major accident which goes beyond the limits of
the industrial area would occurbut it cannot be ruled out. One
must never exclude the unexpected occurrence of violent events
which could suddenly lead to a major accident.
The situations which follow must be envisaged from the need to
have available, in advance, an emergency plan.
2
THE EMERGENCY PLAN
The emergency plan for the town of Estarreja and its surroundings
was prepared by the SNPC in collaboration with the SDPC and the
SMPC. As well as the risk already mentioned, this plan envisages
several other risks which, though probably less serious, still worry
the Portuguese administrative authorities. These risks, which are
considered minor, cover a vast collection of accidents and
catastrophes which range from a road accident of a tanker carrying
dangerous materials to forest fires and problems of pollution of
the environment. Neighbouring villages, such as Murtosa, Avanca,
Anjeja and others of considerable economic importance, could also
be affected.
Thus the plan, based on assumptions which have some
probability, anticipates and governs the use of means (human and
material) and resources of the region, or of the entire country, to
deal with the events.
These means are:
(1) On the local scalemunicipality
coordinated by the SMPC):
(immediate
action
The factories (companies)

The fire service
The Red Cross
The security forces (police)
Health structures (public and private)
Private service organisations (business, transport)
Other voluntary organisations (amateur radio operators, boy
scouts, etc.)
(2) On the complementary district (prefect) and national

(government) level (coordinated by the SDPC or SNPC):
The Armed Forces
Hospitals and health organisations
Public service organisations
Social assistance organisations
The fire service and the Red Cross
etc.
The establishment of such a plan must lay down and regulate the
actions to be performed before, during and after the emergency:
Before:
based on the evaluation of risks and information and

the informing of the population by means of
conferences, diffusion of individual measures to be
taken, in the case of a gas leak, and the performance
of exercises and progressive training, especially in
schools, factories and other places where there is a
large concentration of people
During: by the automatic alert, as quickly as possible, that a
dangerous event has occurred, and by the immediate
triggering of the measures laid down in the plan
After:
by decontamination and neutralisation of chemical
agents deposited on the soil, rehousing of evacuated
people, re-establishment of normal living conditions (of
health, purificationcleanliness, burning of debris,
burial of dead animals, etc.)
3
THE EXTERNAL EXERCISE
Although similar exercises have been carried out in Portugal,
considering the importance of the industrial area of Estarreja and
the fact that its emergency plan has not yet been approved, it has
been decided to carry out an exercise in the region, as part of the
European Year of the Environment, in February 1988. Observers
from Member States may attend.
3.1
Assumptions
This exercise, which will be preceded by a vast campaign
informing the public, takes one of the situations envisaged in the
emergency plan perhaps one of the more severebased on the

following assumptions:
A violent event leads to the uncontrolled release of 50 tonnes of
a toxic gas, heavier than air, from a sphere where it was
enclosed at a pressure of 10 bar. The factory where the gas leak
occurs immediately activates all its warning systems (sirens,
telephones) and its own means of assistance, and informs the
external authorities (SMPC, fire service, Red Cross, hospitals).
It is impossible to repair or remedy the damage before the total
outflow of the gas, which it is estimated will take 1 h.
This release produces a toxic cloud (plume) which has roughly
the shape of an irregular and elongated ellipsoid. According to
the prevailing meteorological conditions, its approximate
dimensions, at the beginning, at soil level, are as follows:
length (in the wind direction) 3500 m
width (transverse) 600 m
height 50 m
This cloud (plume) is formed from a core of pure gas and moves
at wind speed (45 km/h). It dilutes towards the surface and
lasts for about 6 h, until it is completely dispersed (apart from
caves and the lowest points, where it can remain for up to 18
h), being able to reach the villages in its path.
its effects will be felt along a corridor which the cloud follows,
as well as in the houses which are lower than the cloud, in
these places and at this precise moment. The gas may infiltrate
into the houses, by the doors, windows and drain pipes, by the
communicating vessel principle.
3.2
Preparation of the exercise
This is a planning exercise, but there may also be several
practical actions on the ground, particularly simulations of the
evacuation of children in schools, temporary interruptions of road
and rail traffic, evacuation of gassed people by helicopter, actions
of decontamination, etc. This exercise is prepared in three phases.
1st phase (preliminary preparations)
Educating and making the population of the region aware by:
Conference to be organised in the communities, on the radio
and television
Leaflets to be distributed to people, school children and,

indirectly, their parents; the aim is to make people aware of the
risks and the measures without dramatising them
Installation of supplementary alerting systems
Perfecting of a system for obtaining meteorological data
Perfection of telecommunication between factories, the civil
protection service, the fire service, the Red Cross, health
services, etc.
Performance of several sectional sub-exercises to:
(a) give various sectors proper training outside the general
framework of the exercise
(b) avoid dramatisation of the situation by frequent tests;
(c) allow more efficient joint action
This phase must begin at least 3 months before.
2nd phase (preparation)
Preparation
preparation
events
Preparation
information
of a general framework for the exercise, by the

and characterisation of categories of dangerous
of a sufficiently detailed guide, which will include
on:
(a) the creation of several accidents: their nature and sequence

in time
(b) description of each event and its placing in the categories of
accidents envisaged
(c) indication of the organisations which report the events and
those which must receive the information; there will also be
information which will not have a prescribed and available
receiver
Preparation of messages on the events and of respective
envelopes; on the envelope one will write only:
(a) the name of the issuing organisation
(b) the time of the opening and the consequent transmission of
the message
Preparation of a dossier which must contain:
(a) the category of each accident and the situation which it

may cause and which will be envisaged by the civil
protection
(b) the theoretical solution which must be adopted according to
the principles laid down for each of these situations
Formation of an arbitration team and training of its members;
it will have representatives at the various levels of performance
and decision centres; it will not be involved in decisions but will
only observe and remark on the behaviour of the performers,
their reactions to messages, and note the correct and incorrect
procedures as well as their reaction time
Preparation and setting up of places for the performance of the
exercise and the different means of communication
3rd phase (performance)
The exercise will begin at hour H of day D
It will begin with the warning, given by the factory chosen, by
means of a siren and of telephone calls to the support centres
reporting the events
The centres will alert the public
They will proceed simultaneously to activate all the decision
organs and the helping and assistance services
Adoption of measures envisaged in the emergency
plan
The evolution of the exercise is ensured by the transmission of
messages containing the accidents, according to the graduations
established by the guide; these messages must lead to the
immediate reactions of the various participants to whom they are
sent.
These receivers will have total liberty to take their decision,
when they feel it opportune. They are thus under the permanent
observation of members of the arbitration team. They are free to
involve their subordinates and to ask the upper echelon or others
for help, e.g. prohibition of all movement, evacuation of people to
nearby higher points, evacuation of gassed people by ambulance or
helicopter, etc.
The exercise is directed by the National Civil Protection Service.
It represents the top level and can in turn either satisfy the
requests presented or not, and also create new accidents such as
the temporary interruption of one or several means of

communication.
It is also envisaged that means for decontaminating and
neutralising toxic products can be used, asking the fire services
for help or using neutralising products dropped from aeroplanes.
Final phase
After the exercise there will be a critical review organised by the
exercise directorate and by the members of the arbitration team
who were placed at the various echelons and command posts.
14
Exercise Study for an Emergency of
Chemical Origin
G.MACCHI, A.MORICI & G.POILLUCCI
Directorate of Nuclear Safety and Health Protection,
ENEA, Rome, Italy
1
INTRODUCTION
The scope of the study is the arrangement of a preventive technical
tool for a specific emergency exercise following an accidental event
with release of a toxic substance. This tool has to enable the
Emergency Coordinator to define quickly and accurately the actual
areas at risk, in case real-time information support is not
available. The definition of the areas is aimed to optimize the
necessary emergency provisions.
The site where the exercise will take place is a real one in Italian
territory. The selection of the site has been made in order to point
out the most important emergency features.
The performance of the exercise will be based on the following
references:
(a) The Piano Provinciale delia Protezione Civile (Provincial
Contingency Plan of Civil Protection) established by the
competent Prefettura (the Prefecture is the provincial body of
Central Government)
(b) The Piano di Intervento (Particular Contingency Plan)
established by the Prefecture for toxic hazards originating in
the specific industrial plant involved in the simulated
accident. This particular plan has to be considered as an
addendum to the Provincial Contingency Plan.
FIG. 1. Schematic topographical map of the site.
FIG. 2. Scale layout (partial).
2
SITE DESCRIPTION
The selected site is located in essentially flat territory near some
small towns, including an industrial area with chemical and
manufacturing plants. The movement of raw materials and
finished products takes place both by railway and by road. In
particular, the railway traffic is based on a FFSS station adjacent
to the tank farm of a chemical plant. Normally several rail cars are
in transit or parked in the station. Some of these cars contain
hazardous materials, such as chlorine, ammonia, flammables. A
schematic topographical map of the site is shown in Fig. 1; more
details are contained in the plot plan in Fig. 2.
3
PREVENTIVE EVALUATION OF THE AREAS AT
RISK ON A PARAMETRIC BASIS
ENEA/DISP has performed a study to be used by the Emergency
Coordinator as a source term in exercise preparation and as a
decision making tool during the exercise itself. The study supplies
a parametric evaluation of the areas at risk following the
dispersion of chlorine clouds originating in an instantaneous
release from pressurized vessels (cf. the accidental sequence
described in the following Section 4). For this purpose ENEA/DISP
has used the codes Adiabatic Expansion and Dense Cloud
Dispersion, parts of the WHAZAN package, developed by Technica
Int. Ltd in collaboration with the World Bank [1].
The Dense Cloud Dispersion code, based on the Cox-Carpenter
model, is widely used at international level, even if many others
are available [2,3]. The code provides also the evaluation of the
toxic effects in terms of probability of lethality at given distances by
the Probit equation approach. A recent revision of the Probit
coefficients [4] has been taken into account in the present study.
The calculations have been performed for several values of the
released mass and for the most likely meteorological conditions at
site (weather category and wind speed). The results are reported in
Tables 14, expressed as the maximum downwind distances to
have probabilities of lethality (LTL) of 50%, 5% and 1%. These
probabilities refer to population staying outdoors and in absence
of escape reactions. Furthermore, the maximum distance for a
concentration of 25 ppm has been reported. Beyond this limit the
impact has been regarded as negligible, considering also the short
duration of the exposure.
Table 1 Distances to a given hazard level (LTL 50) for instantaneous

releases of chlorine from pressurized vessels in relation to released mass
and atmospheric conditions
In order to enable a more accurate evaluation of the areas at

risk, two more parameters have been defined:
The back-distance (function of the released mass only),
representing the maximum impact distance due to the initial
expansion of the cloud (Table 5)
The spreading angle (function of the meteorological conditions
only), representing the envelope of the transverse impact
distances due to the spreading of the cloud during the
translation (Table 6); this parameter does not take into account
the possible oscillation in the wind direction
On these bases the Emergency Coordinator is able to identify the
contours of the actual areas at risk on the topographical map,
according to the following procedure:

(a) Drawing of the circumference, with centre in the release

point and radius equal to the back-distance (Table 5)
(b) Drawing of the angle at risk with vertex on the said
circumference in the upwind direction and opening given by
the spreading angle (Table 6) plus the possible oscillation of
the wind direction
(c) Drawing of the circular sectors with centre in the release
point and radius equal to the impact distances (Tables 14)
As an example, Fig. 3 shows the case relating to a release of 45
tons of chlorine in meteorological conditions D.3 and a possible
oscillation of 40 in the wind direction.
The availability in real time of the actual meteorological
conditions is a necessary premise to a correct evaluation of the

areas at risk. In case insufficient information is available from

some meteorological services, it is anyway necessary to perform an
estimation on-site with due caution. In particular with regard to
the weather category, whose availability as prompt information
from meteorological services is normally poor, the Emergency
Coordinator may use some rough estimation developed for this
purpose, one of which is shown in Table 7 [5].
A comparison has been carried out between some results of the
WHAZAN code (Tables 14) and the results of two other codes for
the dispersion of dense clouds, namely the DENZ code, developed
by UKAEA SRD [6], and the code developed by the Ontario
Ministry of the Environment [7]. The results of the DENZ code are
reported in Table 8, while those of the Canadian code, limited at
the maximum distance to 25 ppm, are reported in Table 9.
Table 4 Distances to a given hazard level (LTL negl., 25 ppm) for

instantaneous releases of chlorine from pressurized vessels in relation to
released mass and atmospheric conditions
Table 5 Back-distance in relation to released mass
Table 6 Spreading angle in relation to atmospheric conditions
It is clear that some discrepancies that exist in the results of the

different codes cannot be overcome at the present state of the art
[2, 3]. On the other hand, a sure meaningful overestimation is
introduced by any one of these codes, not taking into account the
mitigation effect due to the indoors sheltering. In fact a significant
part of the population, casually or depending on precise advice,
FIG. 3. Risk contours; release of 45 tons of chlorine in meteorological

category D.3.
Table 7 Flow chart for selection of weather category
Table 8 Distances to a given hazard level for instantaneous releases of chlorine from pressurized
vessels in relation to released mass and atmospheric conditions (as per DENZ)
Table 9 Distances to 25ppm for instantaneous releases of chlorine from

pressurized vessels in relation to released mass and atmospheric
conditions (as per Canadian code)
will stay indoors during the cloud passage. The quantification of

this mitigation effect has been made the object of recent studies
[810], as well as the influence of particular characteristics of
vulnerability of the population [11]. These aspects should be taken
into account by the most used codes, as already done in some
particular cases [12].
As the aim of the study is to support the decision-making
process in an emergency, and particularly to enable an optimized
use of limited resources, the selection of the useful results has
been performed accordingly. In this sense an overestimation of the
distances may be negative because it will induce the available
resources to spread over an area bigger than necessary. On the
other hand, an underestimation may also be negative because it
will induce neglect of some indispensable provision.
Therefore, for the purpose of the present study, the intermediate
results of the WHAZAN code have been regarded as a best
estimate. This perspective has to be very well borne in mind by
the Emergency Coordinator in using the present tool.
Further support for this selection is given by the direct
comparison, illustrated in Fig. 4, with the well known
recommendations expressed by the US DOT (Department of
Transportation) about the isolation and evacuation areas in the
case of major chlorine release [13]. This comparison shows not
only good general agreement, but also the greater completeness
and applicability of the present tool, without significant loss of
simplicity and speed of use.
FIG. 4. Risk contours for a release of 45 tons of chlorine; a comparison

with the US DOT.
4
DESCRIPTION OF THE ACCIDENT SCENARIO
The initial event of the accidental sequence is a major fire in the
tank farm of the chemical plant adjacent to the railway station.
Among others, a rail car containing chlorine is parked in the
station (Fig. 2). At this moment, the possibility of getting the fire
under control is remote; on the other hand, the heat radiation
makes it impossible to approach the rail cars and to move them to
a safe place. As thermal collapse of the chlorine rail car must be
expected under these conditions, its protection by water sprays is
attempted.
The probable evolution of the situation makes a major escalation
of the accident inside the plant possible, within about 4 hours.
For this reason, before that moment all the available firefighting
resources, including the water reserves, are directed exclusively to
the protection of primary targets inside the plant.
Within about 20 min (that means 4 hours after the sequence
initiation) the rail car collapses, releasing to the atmosphere 45
tons of chlorine. It has to be noted that no release of chlorine from

the safety valves will take place up to this moment, due to the
cooling by water sprays for as long as possible.
5
REALIZATION OF THE EMERGENCY EXERCISE
The study of the exercise operating details is not a part of the
actual work, being in the charge of the competent Local Authority.
On the whole, the exercise is held according to the procedures
contained in the Provincial Contingency Plan of Civil Protection of
the competent Prefecture and in the on-site emergency plan of the
chemical establishment involved.
The initiation of the exercise will start with the activation of the
on-site emergency plan, followed by the warning given to the
personnel of the railway station. This one, after a preliminary
evaluation, advises the Fire Brigade about the specifie hazardous
situation existing inside the station and undertakes the necessary
provisions regarding the railway traffic.
At this moment, due to the potential release of a toxic
substance, the special procedures contained both in the
Provincial Contingency Plan and in the on-site emergency plan are
activated. The Fire Brigade converges on the site, while an
Emergency Control Centre is set up at the Prefecture, where the
Emergency Coordinator is operating.
The last named, with the aid of the documentation prepared by
ENEA/DISP (see Section 3) and on the basis of the actual
meteorological and accidental data, evaluates the areas at risk.
Knowledge of these areas enables proper consideration to be given
to the following aspects:
Evaluation of the possibility of a safe evacuation and its extent
based on the expected accident evolution, the available
resources, and the demographic and logistic situation
Identification of the area whose population has to be advised to
stay indoors
Identification of particularly vulnerable targets (schools,
hospitals, etc.) inside the maximum impact area
For illustrative purposes only, and referring to Fig. 5 (valid for an
instantaneous release of 45 tons of chlorine in category D.3), a
possible line of action may be as follows:
FIG. 5. Example of risk contours on a schematic topographical map.
Immediate evacuation of the back-distance circle and the area

A50 with the exception of personnel provided with adequate
protective equipment
Indoors sheltering of the population in areas A5 and Al, with
priority warning action in area A5
Warning to the hospitals and evacuation of the schools in area
A0
In the course of the exercise, the possibility of getting assistance
in real time from the ARIES Emergency Centre of ENEA/DISP will
be checked, in addition to the meteorological services normally
available. The ARIES Centre is already operating at national level
for nuclear emergencies [14].
To conclude the exercise, the Emergency Coordinator reestablishes normal conditions and, where evacuation has been
undertaken, provides for re-entry of the population.
6
CONCLUSIONS
The emergency exercise will give indications covering many
different aspects. The scope of the exercise will be first of all to
test the general adequacy of the procedures included in the
Provincial Contingency Plan, and particularly their applicability to
this type of emergency. On the other hand, the necessity for
specific training of key personnel will be verified, as well as their
capability to deal with the technical/scientific aspects of the
problem.
A second objective of the exercise will be to check the adequacy
of the technical aids made available by ENEA/DISP to the
competent Prefecture:
1. Preventive parametric evaluation of the areas at risk,
referring in particular to the clear and correct interpretation
by the Emergency Coordinator
2. Assistance in real time by the ARIES Emergency Centre
Prospectively the exercise should give the necessary indications in
order to prepare a proper format for the realization of other
preventive parametric evaluations.
These measures should be used ad interim in dealing with real
or simulated emergencies, waiting for an adequate real-time
information system to be organized and implemented on the whole
national territory, as already done by the Ministry of the Interior
with the SIGEM system, for fire and explosion hazards only [15].
REFERENCES
1.
2.
3.
4.
Manual of Industrial Hazard Assessment Techniques, The World

Bank, Oct. 1985.
Major Industrial Hazards, Technical papers, Warren Centre,
University of Sydney, Aug. 1986.
McNAUGHTON, D.J., WARLEY, G.G. & BODNER, P.M. (1987).
Evaluating emergency response models for the chemical industry.
Chem. Eng. Progr., Jan.
HARRIS, C. (1987). Mitigation of accidental toxic gases. Int. Symp.
on Preventing Major Chemical Accidents, Washington, Feb.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
LYNSKEY, P.G., The development of an effective emergency

procedure for a toxic hazard site. IChE Symp. Series, No. 93.
FRYER, L.S. & KAISER, G.D. (1979). DENZA Computer Program for
the Calculation of the Dispersion of Dense Toxic or Explosive Gases in
the Atmosphere. UKAEA-SRD, July.
Stern, E. (1986). The portable computing system for use in gas
emergencies. Risk Analysis, 6 (3).
PURDY, G. & DAVIES, P.C., (1985). Toxic gas incidents: some
important considerations for emergency planning. IChE Symp.
Series, No. 94, March.
DAVIES, P.C. & PURDY, G. (1986). Toxic Gas Risk Assessment: The
Effects of being Indoors. Refinement of Estimates of the
Consequences of Heavy Toxic Vapour Release, IChemE, Symp., 8
January 1986.
HAASTRUP, P. (1984). Indoor fatal effects of outdoor toxic gas
clouds. J. Occupational Accidents, 5.
PETTS, J.I., WITHERS, R.M.J & LEES, F.P. (1987). The assessment
of major hazards: the density and other characteristics of the
exposed population around a hazard source. J. Hazardous
Materials, 14.
PAPE, R.P. & NUSSEY, C. (1985). A basic approach for the analysis
of risks from major toxic hazards. IChE Symp. Series, No. 93, Apr.
Isolation and evacuation distance table. US DOT Guidebook.
CARACCIOLO, R. (1987). ARIES: a computer based system for the
real time monitoring of atmospheric dispersion in nuclear
emergency. ENEA/DISP Int. Conf. on Nuclear Power Performance and
Safety, IAEA, Oct.
ROMANO, A., MARCHIONNE, E. & PICCININI, N. (1986). Il sistema
informativo SIGEM: la gestione delle emergenze. Antincendio, May.
15
Effective Organisation and Incident
Control
W.D.C.COONEY
Cleveland County Fire Brigade, Hartlepool, UK
1
INTRODUCTION
The success or failure of any on/off-site emergency plan is wholly
dependent upon effective communications between the public
emergency services, the local government services in the area, and
the industrial/commercial input concerned. Considerable
importance must be placed on all branches of the plan, i.e.
uniformed emergency services, non-uniformed local government
services and, of course, the industrial complex concerned. The
best way to ensure that close consultation and coordination take
place is by exercising. There is no better way to test the
availability of personnel than to undertake the physical exercise.
This means moving manpower and equipment to the scene and
simulating an actual incident. However, this can be an extremely
costly and time-consuming situation. The whole question of the
need to exercise, whether it be in respect of an on-site or off-site
plan, requires a great deal of thought, discussion and
consideration. Emergency plans of any description are worse than
useless if they are prepared and then left on a shelf gathering
dust. The only way to test a plan is by exercising that plan to
ensure that all persons concerned are aware of their duties and
responsibilities. However, this has industrial and commercial
financial implications. Should we exercise or not?
2
BACKGROUND
Cleveland County is situated in North East England, bordering
North Yorkshire and Durham. The County Fire Brigade was
formed in 1974 as a result of local government re-organisation
combining into one authority the former Teesside and Hartlepool
County Borough Fire Brigades with parts of the North Riding of

Yorkshire and Durham Fire Brigades. The present brigade is split
into two divisions (Northern and Southern) which are generally
divided by the River Tees. In order to discharge its functions, the
Brigade has 15 strategically placed fire stations. By national
standards Cleveland County is a small area covering 58 550 ha
with a population of approximately 650000. However, on closer
examination, any visitor cannot help but notice the very highly
concentrated industrial areas which dominate the majority of the
county area. In fact, 13% of the total county area is classed as A
risk, with other areas of special risk. This means in effect that
Cleveland Fire Brigade responds to the largest concentration of
chemical and petro-chemical complexes in Western Europe. The
River Tees now rates as the third busiest port in the United
Kingdom and, in terms of hazardous products, has more
movements than any other port.
3
LEGISLATION
The last ten years have produced a significant number of
regulations which have had a large impact upon the chemical
industry nationally and have, on many occasions, been brought
about to assist the Fire Service in its operations and planning.
As far as the transportation of hazardous materials is concerned,
the springboard for regulatory control was the Dangerous
Substances (Conveyance by Road in Road Tankers and Tank
Containers) Regulations 1981. This regulation came into being
after a voluntary scheme was introduced in Cleveland in the early
1970s and a labelling system was drawn up and known as UKHIS
(United Kingdom Hazard Information Warning System). A panel
was divised which displayed not only the warning diamond but
also three other vital sources of information:
(a) A simple code to give first strike information to fire service
crews attending an incident involving a road tanker or tank
container
(b) The United Nations number which allowed further
information to be sought on the product via chemical
information retrieval system
(c) A telephone number that could be contacted to speak direct
to a source of specialist advice.
The pilot scheme which was introduced in Cleveland attracted

such favourable comment from both emergency services and
industry that, in March 1979, the Hazardous Substances
(Labelling of Road Tankers) Regulations 1978 came into force. The
voluntary scheme had now become mandatory. Later in 1981 this
regulation was enveloped into the Dangerous Substances
(Conveyance by Road in Road Tankers and Tank Containers)
Regulations 1981. These regulations, in conjunction with a list of
applicable chemicals, form the basis for legislation in the United
Kingdom for the bulk transport of chemicals by road.
Whilst the above regulations were a major breakthrough in
providing the fire officer with information upon which to base his
attack on an incident involving hazardous materials, difficulties
were encountered in the form of drums, glass containers, plastic
containers, carboys, cardboard cartons, etc. This problem resulted
in the introduction of the Classification. Packaging and Labelling
of Dangerous Substances Regulations 1984 (CPL) which came into
full operation on 1 January 1986.
The idea of the CPL regulations was to ensure that a composite
label was attached to the package which offered advice and
assistance to the Emergency Services when dealing with that
particular substance. It is very significant that this set of
Regulations came as they did because they mark themselves as the
forerunner to the very latest set of Regulations in respect of the
Conveyance of Packaged Goods. These Regulations are the Road
Traffic (Carriage of Dangerous Substances in Packages, etc.)
Regulations 1986 which came into force on the 6 April 1987.
Once again this Regulation came about as a result of
considerable pressure from the public emergency services to form
some type of marking system for vehicles carrying dangerous
packaged goods. It is widely appreciated that a simple 3-tonne flatback lorry can carry quite a cocktail of dangerous substances in
packages, but imagine the 30-tonne containerised vehicle,
carrying a mixed load being involved in a road traffic accident on a
motorway. From experience, it has been noted that, should any of
these vehicles be involved in such an accident, then it is not
normal practice for the total load to be involved, or indeed for all
the packages to be ruptured and a cocktail situation evolve.
However, there are occasions when a number of packages
contained within the vehicle are in fact ruptured and the contents
escape causing either a toxic hazard or a fire hazard or a
combination of both.
It was with this in mind that the pressure put on the Health and
Safety Executive resulted in a set of regulations for the marking of
such vehicles. When the regulations became law, any vehicle

carrying in excess of 500kg of one or more dangerous substance is
required to be marked with a rectangular orange plate, outlined in
black, the minimum number of plates required is two, Qne on the
front of the vehicle and one on the rear. The reason for this simple
marking system is so that the public emergency services will
identify the vehicle as having dangerous packaged goods and then
use the label on the package as defined under the CPL regulations
for subsequent action in dealing with that particular problem.
Having dealt with regulations designed to assist the emergency
services in the handling of incidents involving hazardous materials
in transit, there are other equally important systems which assist
the emergency services in bringing any incident to a satisfactory
conclusion: Chemsafe and Chemdata.
4
SELF-HELP SCHEMES
4.1
Chemsafe
The Chemical Industry Scheme for Freight Emergencies
(Chemsafe) is a voluntary scheme undertaken by the chemical
industries in conjunction with the Chemical Industries
Association. The scheme does not give to the fire service an all
singing, all dancing means of solving a problem. What it does, in
fact, do is offer a standard procedure that says to fire authorities,
for example, Contact the Specialist telephone number if available
and make direct request from the manufacturer, trader or
supplier of the product to offer advice and/or assistance,
The Chemsafe Scheme goes from there to allow the
manufacturer under the standard procedure to make contact with
another company who is also a member of Chemsafe to assist on
his behalf, should the other manufacturer be closer to the scene
of the incident. However, in all cases it is not possible to have
direct access to the manufacturer or his nominee, as a specialist
telephone number may not be available and, as a result of that,
the Chemsafe Scheme as devised by the Chemical Industries
Association, have introduced a procedure called Longstop.
Longstop is a procedure that involves the National Chemical
Emergency Centre at Harwell, which has a massive computer with
databanks storing most of the known chemical products available,
and qualified staff with practical experience over a very wide range
of chemical substances, to be available to offer advice and, in

some instances, available to be called to the incident to offer on
the spot advice. It is important, therefore, that the Fire Service are
fully aware of the Chemsafe procedures that are available,
whether it be the Chemsafe standard procedure or the Chemsafe
Longstop procedure, should the fire service require additional
advice in helping them to deal with an incident.
4.2
Chemdata
Is a computer based databank, primarily devised for the British
fire service. The idea behind Chemdata was to produce an easy to
understand, simple to operate, and simple to access computer
databank on chemicals. It was also devised that the print out from
the databank would be simple, clear and easy to understand.
After five years of use, the Chemdata system is being used by 45
fire authorities within the United Kingdom and the current
database holds approximately 50000 known chemical substances.
The databank is updated on a regular basis from the National
Chemical Emergency Centre at UKAEA Harwell UK.
5
INCIDENT PROCEDURES
There are a number of areas that require to be considered when
dealing with this particular subject. Evacuation is a simple and
straightforward word but can cause chaos and disaster if not
handled correctly. There is a need in dealing with this type of
incident to have a clearly defined role of command, incident
control and communications. Evacuation must be given
considerable thought with regard to the welfare needs of the
people being evacuated, transportation, documentation and, by no
means least, the protection of property left behind following the
evacuation. The prime movers in an evacuation situation would
normally be the police force. However, before this takes place,
there should be a great deal of consultation between the officer in
charge of the incident, the officer in charge of the local police
service, and all the other senior persons on the ground, to consider
the evacuation procedure that should take place. Nevertheless,
should we evacuate? Is it necessary? Are we placing the people at
risk by exposing them to unnecessary risks out of doors? This
subject requires a great deal of discussion in some considerable
detail to ensure that all parties involved in the control and
implementation of an incident are fully aware of what evacuation

means.
6
EXERCISES FOR ON/OFF-SITE EMERGENCIES
The Control of Major Industrial Hazards Regulations 1984 (CIMAH)
within the United Kingdom place a duty on industrialists and
local authorities to prepare emergency plans in respect of major
emergencies that may occur and primarily in respect of off-site
emergency plans. The majority of authorities have completed, or
nearly completed, their off-site planning and it is important for the
success or failure of any off-site emergency plan that effective
communications between the public emergency services and
industrial complexes operate. It is equally important for the needs
of other areas of local authority services, both from the uniformed
point of view and from the non uniformed viewpoint, to have very
close liaison with each other and this means only one thing
exercises.
There is no better way to test the availability of personnel than
to run some form of exercise. In order to ensure that the plans
have been drawn up to allow sufficient flexibility, exercises need to
be undertaken to ensure that site personnel, the public emergency
services, local authorities, health authorities, etc. are fully in the
picture with regard to the possible problems that could arise
following a major incident. The methods of undertaking exercises
are many fold and the size and format can vary enormously.
However, when all exercises undertaken are analysed in detail,
they fit into two main categories:
6.1
Table-top exercises
Exercises of this type are used to test the emergency planning
procedures by using table-top plans and imaginary situations and
a carefully detailed, written scenario.
The personnel normally involved are primarily:
(i) The principal management from the industry concerned
(ii) Principal officers of the public emergency services, the local
authority, health authority, etc.
The method normally undertaken involves a group of officers
using the plans of the premises and simulated situations in a
written scenario to alert and actuate policies already laid down in

the emergency plans. Telephone contacts and the answering of
specific questions and requests by management would be
normally all that is required.
A table-top exercise is a useful medium to test out management
reaction to receiving telephone calls and being asked specific
questions in respect of, for example, capacities of plants,
inventories, type of product, type of release expected, water
supplies, and a whole host of various other activities that can take
place on site.
This type of exercise also has the desired effect that it does not
interrupt normal industrial activities on the site that are taking
place and that combined on-site and off-site planning can take
place at the same time.
A simple, straightforward, table-top exercise can have
considerable advantages in checking for example the plans in
respect of advice to public, availability of people in the right places
to undertake certain tasks, etc., amending and alteration of the
plans as required, without massive disruptions to output.
This type of exercise is required to take place with site
personnel and emergency services, in conjunction with the local
authority etc. to test the validity of the plan. You will note that I
have used the word required above. You will recall, no doubt,
that the regulations do not specifically state that exercises are
required. However, the only useful method of testing a plans
efficiency is to carry out such exercises. A table-top exercise of the
type described above requires firm and close control in order to
maintain an element of realism.
6.2
Physical exercises
These are by far the most common type of exercise, since it is
necessary on occasions actually to move manpower and equipment
to test their availability and capabilities of handling an emergency
situation. It is therefore important that major physical exercises
be undertaken on a regular basis. These exercises must be well
planned in advance, with a carefully written scenario, and they
should be guided towards certain objectives. It is no good having a
haphazard physical exercise, as no benefit would be gained from
haphazard results. Clear supervision and assessment, plus a vital
debriefing session, should take place after an exercise, and soon
enough for the exercise still to be fresh in the minds of the people
who undertook it. By this means, maximum benefit will be gained
from the problems encountered and any mistakes that were seen.
It is important that this liaison, and this type of exercise, takes
place at a very early stage after the emergency plans have been
drawn up.
6.2.3
Problems associated with the physical type exercise
(1) Wholesale evacuation of members of the public cannot be
undertaken during a physical exercise as there is a
considerable difficulty in evacuating the public in a real life
situation. It would be even more difficult to move people in
an exercise situation. Also, disruption caused to the normal
way of life within that particular community would not justify
involvement at that level.
(2) The actual use of large amounts of personnel has a fairly
large cost implication. Also, it could denude available
resources away from normal activities.
(3) Physical exercises undertaken by the public emergency
services can only allow limited resources of manpower and
equipment so as not to take away the sharp end service to
the public, for example fire appliances off normal activities,
simply to test a plan with a physical exercise.
Exercises, no matter in which form they are undertaken, require
considerable preparation beforehand so that the plans are clearly
understood by all parties before the exercise commences.
Difficulties arise in using personnel who are not normally
acquainted with a fast response time. Most local government chief
officers tend to deal with emergency situations on a very small
scale.
For example, the Director of Education, Director of Social
Services, County Surveyor and Engineer would normally only deal
with small scale emergency situations. Exercises are a way to
bring these officers out of their normal environment and place
them in an abnormal situation to allow them to expand their
horizons and expand the role to be played in an actual situation.
The whole question of the need to exercise, whether it be on-site
or off-site plans of any description, is worse than useless if left on
a shelf gathering dust.
The only way to ensure that a plan is tested is by exercising that
plan. This allows all those people concerned with the plan to be
aware of their duties and responsibilities.
Also, it ensures that consultation continues, that cross-flow of

information and experience continues, and that officers and
personnel do not meet each other for the first time in a live
situation, but they have the opportunity in an exercise situation to
see their other contemporaries at work. Also, this type of exercise
gets the dialogue running between all the parties and as the
dialogue is in being, then the plans will not gather dust.
EXERCISES IN WHATEVER FORM ARE REQUIRED TO TEST EMERGENCY
PLANS
7
INCIDENT CONTROL
The Oxford English Dictionary definitions in respect of Incident,
Control, Communications and Evacuation are as follows:
INCIDENT Public event causing trouble, etc.
CONTROL Dominatecommandexert control over
COMMUNICATIONS Practice of transmitting information
There is no way that I am attempting to teach the readership
English. However, it is important that the definitions of the words
noted above are clearly understood. For example, let us look at the
situation with regard to Incident Control. The dictionary definition
states quite clearly that Incident Control is to dominate or
command a public event causing trouble. This, in fact, is the
subject that is being explored during this particular conference.
Whilst that seems simple to state, it is in fact difficult to
implement. Let us imagine a release of a toxic substance from a
particular source. That release, due to weather conditions, is
moving towards an area of population. Incident control therefore
means a number of things:
Hazard definition and identification
Hazard effect
Effective control of the overall situation
Communications
Evacuationyes or no?
Let me now look at each of these areas in detail. Firstly, one area
that is not identified is the role of command. You will see from the
dictionary definition that to control means to dominate or
command. A major incident situation within the United Kingdom
brings into play all the major emergency servicesfire, police and
ambulance. The command role of such an incident is extremely
important. In the case of an incident not involving fire, then the
Senior Police Officer present would have overall command of the
situation under United Kingdom legislation. If, however, fire was
involved in no matter what form, then the senior fire officer present
would have overall command. This would appear to be a very
haphazard method of operation and, in practice, the command
role does not assume these defined areas. Because of pre-planning
and exercises, the command function under normal
circumstances, be it whatever type of incident, is a combined
effort involving all the senior officers of the public emergency
services in decision making. This, however, does not mean that we
operate a democracy in command. There is a final decision taken
and an autocratic decision must be made.
7.1
Hazard definition and identification
It is extremely important that the senior officer in charge at the
sharp end, i.e. the officer in charge of the operations on the
incident ground, must have a clear indication of the hazard, the
definition of the hazard, and the identification of the problems
that that hazard could cause to the population, and of course to
the workers on the site. You will see from earlier parts of my paper
that within the United Kingdom we have a number of areas for
gaining hazard information. It is very important to ensure that the
hazard definition and identification is understood as well as
possible to ensure that the local health authorities are provided
with sufficient information to provide effective treatment to those
persons who may be suffering from the effects of the incident.
7.2
Hazard effect
Whilst it is important to find out the characteristics of the product
that is being dealt with, it is of paramount importance in any
evacuation procedures to find out the effect that would take place
on the general population. We must, of course, consider weather
conditions, that is whether it is wet, windy, cold, dry, etc. We
must understand the parts per million definitions as to whether
people ought to be evacuated, left in premises, etc. The hazard
effect has a very important part to play in the overall command
role.
7.3
Effective control of the situation
Let me now look at the problems that face a major emergency
service, i.e. a county fire brigade, in the effect of the release of a
toxic substance. Let us assume that we have received all the
information outlined above which clearly indicates that there
could be a serious effect on the population. This, however, is by no
means all the information required by the senior officer present.
There are a number of other factors that come into play:
Do we tell the public? If so, by what method? Public address
from Police vehicles, public announcement on radio and television
stations, or by physically sending in Emergency personnel to
knock on individual doors?
Whilst the methods outlined above are fairly simple, can we be
sure that everybody in the possibly affected area has heard the
messages or have we created a panic situation in areas outside
that designated for possible evacuation? Or, as mentioned above,
is the best method of removing people from their homes, albeit
slow and time consuming, simply to knock on the door and ask
them to leave? This, however, leads to further questions as to
Why? What for? Have you spoken to? etc. All of this is extremely
time consuming and has to be taken into serious consideration.
One of the disadvantages of personal contact is the fact that if you
require to evacuate, e.g. due to a toxic release, is it safe to do so
or, in fact, is it unsafe to send officers into a possible affected area
to carry out such an evacuation? Could we be placing emergency
service personnel in a dangerous situation? Allow me to go back to
the question of evacuation later.
7.4
Communications
The dictionary definition of communications is Practice of
transmitting information which simply states that we should
effectively communicate with each other. However, as we are all
aware, communications play an extremely vital role in dealing with
any incident and are of paramount importance when dealing with
a major incident involving members of the public. There is a need
to ensure that all messages and orders issued are clearly
understood by all persons concerned and acted upon as quickly
as possible. But it is equally important that there is a continual
feed back through the various incident controls, and therefore to
the incident commander, to ensure that he is aware that his
communications, messages, orders, instructions, etc. have been

carried out. One of the pitfalls with regard to communications is
that a number of the emergency services operate on different radio
channels and so incidentally, do a number of the major industrial
sites within the United Kingdom. To set up communications in
post can, to some extent, be detrimental in that radio interference
can occur and cause a number of problems in the transmitting of
information.
7.5
Evacuation
Let me once again quote you the Oxford English Dictionary
definition of this simple word:
EVACUATION Withdraw fromremove occupants fromplace
to be considered dangerous to a safer place.
This is a very simple and straightforward definition which, on the
face of it, appears to be simple and easy to undertake but, if it is
not controlled correctly, what appears to be simple can very
rapidly turn into chaos and disaster. The question really is Do we
evacuate or do we not? We are very close to quoting Shakespeare
in the act where Hamlet states To be or not to be? that is the
question. May I continue to say to evacuate or not is also the
question?
Let us look at the situation that we have been considering before
the release of a toxic substance. If that release is as a result of
an explosion, then it may well be safer to leave the members of the
public in their own homes, offices, shops, etc. and to allow the
normal weather conditions to dissipate the release as quickly as
possible and to consider the fact that the public are safer where
they are than to move them into the open air. On the other hand,
if the release is of a prolonged nature, then of course
consideration must be taken for the movement of the population.
Let me go back to the problem. If we have an area that has been
affected by a toxic release for a considerable period of time, then
the moving into that area of emergency personnel to ask the
population to move places a number of persons in jeopardy. On the
other hand, if a release and/or explosion is imminent, do we take
the decision before it happens to move the population within the
area and away to a place of safety? If the explosion or release is
imminent, would we not, therefore, be placing the population at
risk by taking them into the open air and, should the inevitable
happen, expose them to even greater dangers? Even before you

reach any of the decisions outlined above, there are a number of
other factors that come into play, involved in mass evacuation
and, by the word mass, I do not envisage tens of thousandsit
could be two or three hundredbut nevertheless, it is a mass
evacuation. We need to consider, as officers controlling the
incident, are the following factors available:
(a) Local authorities. Have they manned rest centres? Can they
provide sufficient food and shelter? Can they, in fact, ensure
that the people moved from their normal residence can be
adequately looked after?
(b) Public transport companies. Can we provide large numbers of
public vehicles to transport people to rest centres, food
centres, shelter, etc.?
(c) Police. Are there sufficient members of the Police Force
available to control traffic, to undertake documentation, to
control looters, etc.?
(d) Hospitals. Are they fully equipped to take care of the injuries
occurring as a direct result of the incident, i.e. injuries to
firefighters, police personnel etc., and are they also prepared
to undertake normal medical requirements for the general
public who will suffer as a result of evacuationold persons,
heart attacks, strain, shock, etc.?
(e) Media. Are we prepared for the media? All forms of the media
will descend on the incident seeking news, clogging main
roads, attempting to gain information from whatever source
is available. We must be sure that relations with the press
are adequate to fulfil the situation.
I have outlined only a few of the problems that have to be faced
when considering evacuation. If the decision is made to evacuate,
there are numerous other examples. Water supplies, feeding
personnel engaged at the incident, relief personnel, additional
stocks of equipment and fuel, informing relatives of those persons
evacuated, etc. You will see, therefore, that serious consideration
must be undertaken as to whether to evacuate or not. IN MY
OPINION, EVACUATION SHOULD BE CONSIDERED TO BE THE
LAST RESORT WHEN ALL OTHER METHODS OF CONTROLLING
A HAZARD TO THE PUBLIC HAVE FAILED.
16
Assessing the Response Capability
and Vulnerability of an Emergency
Plan: Some Important Issues
R.MAX-LINO, P.HARRISON & C.G.RAMSAY
Technica Ltd, London, UK
1
INTRODUCTION
In Technicas experience, addressing the response capability of
emergency plans involves examining both the quality and the
quantity of the response resources, and their suitability for the
emergency environment.
The notion of quality in this context refers both to the quality of
the individual component resources and to the dynamic
relationships and functions within the emergency plan as a whole.
It is often the case that while emergency plans focus mainly on the
capacity of response resources (i.e. quantities of fire hydrants,
numbers of first-aiders available, control room hardware, etc.)
these are not necessarily all utilised effectively in an emergency
situation. By focusing first on the quality factor during the
auditing of an emergency plan, an assessment of the efficiency
and of the quantity of the resources required can be determined.
One approach to auditing the response capability of an
emergency plan is that of high-fidelity simulation. By high-fidelity
it is meant that the emergency can be simulated to match the real
situation as closely as possible. Its major advantage is that it
allows the evaluation of the effectiveness of all the functional
components (i.e. emergency organisations) of an emergency plan.
Each organisation may well be proficient in its own function,
having had some training and experience of the relevant
requirements. However, this experience may have been obtained
in isolation. The high-fidelity characteristic is important because
factors such as time pressure, physical obstruction or danger will
significantly influence performance.
Another approach is that of functional analysis. This is an
analytical technique for assessing the relationships between the
components of any system. The relationships may include those
between equipment, communications, and physical interactions

between personnel in the sharing and coordinating of resources.
The main advantage of functional analysis is that it can be used to
assess on paper the logical flow of events, workload distribution,
the coordination of events in time, and man-machine interactions.
This paper aims to illustrate how a simulation of the emergency
plan, coupled with a functional analysis of the data obtained,
allows an evaluation of a variety of issues. These include:
Assignment of responsibility
Notification methods and procedures
Communication
Public information
These issues are not mutually exclusive. They will be discussed in
this paper in the light of Technicas experience in the assessment
of emergency plans.
2
ASSIGNMENT OF RESPONSIBILITY
This includes the roles and dynamics of the organisations which
must be coordinated. For the purposes of this paper, it will be
assumed that the emergency has originated at an industrial site
which has its own operational management but can call on
regional emergency services for support. The plan should define
clearly the role of the site management with respect to the
emergency response professionals. Attempts by the management
to take active control could lead to conflicts between themselves
and the emergency response teams, both on-site and off-site.
Equally important is the knowledge of how these two distinct
groups must be able to coordinate effectively to conduct their
responsibilities successfully. It may also be the case that in-house
emergency response officials need a clearer definition of their
individual roles and responsibilities, and how these should be
effectively coordinated.
To illustrate from one case study, it was not clear to the on-site
officials which of two emergency control rooms they should be
communicating with. As a result, some tasks were duplicated by
each control room, and some omissions of functions were made.
Auditing the roles can be conducted on paper by documenting the
tasks/activities required of the key personnel. The assessment
team can determine:
the tasks that can be performed simultaneously without

conflict;
the tasks that must be done sequentially.
In this way those tasks and resources/roles which need to be
further developed/altered for the benefit of the emergency plan
can be determined. A high-fidelity simulation can then be
conducted to ensure operational viability.
It is true, however, that some conflicting activities may not be
filtered out of the plan during a functional analysis because there
is no access to realtime data. This is where a high-fidelity
simulation can be most effectively utilised. To illustrate the type of
operational problems that may be inherent in an emergency plan,
the following example may be quoted.
An emergency response control room operator became
overloaded with communications duties within a few minutes of
the commencement of an exercise. It was found that this operator
was using two telephones (one at each ear)trying to brief the
Chief Fire Officer and trying to handle several simultaneous
communications on the radio. This operator was also required to
brief several incoming personnel of the situation, yet there was no
assistance or relief provided for the first 36 minutes of the
simulated emergency.
This example illustrates the necessity for the emergency
response plan to avoid workload excesses on emergency response
officials. The functional analysis will then determine the
appropriate resources to reduce the possibility of such workload
excesses.
3
NOTIFICATION METHODS AND PROCEDURES
It is important for the on-site emergency response officials to be
aware of requirements procedures for the notification of
government officials. Significant in this issue is the determination
of when an emergency situation requires such notification. That is,
in the event of an incident which is likely to escalate beyond the
site, early detection of this likelihood and early notification of the
appropriate officials are important for a variety of reasons. These
include the reduction in time for determining what resources are
needed and, logically, the potential need to coordinate extra
resources beyond the back-up teams already considered.
Another issue to address is that the methods by which early
warning and clear instructions are given to the population at risk
should be determined. How, for instance, do officials ensure that

the population is given early warning such that any necessary
evacuations have the required time for safe and effective conduct?
The warning system should be able, as far as possible, to take
advantage of the available time from the onset of the incident.
In Technical experience, for instance, there appears to be some
reluctance on the part of notification officials to warn the
population at risk, for fear that this will cause panic. Another
example is that some on-site personnel during a simulation were
unaware than an emergency situation did exist. In other words,
the warning systemauditory alarmdid not notify some of those
in potential danger. On the other hand, it inhibited the
performance of emergency personnel, by making conversation
difficult. This latter point is discussed further in the section on
communication.
Within the approach to auditing the emergency plan, a
functional analysis of the potential for early warning and of the
instructions to the population at risk can be conducted. This may
be done by considering credible scenarios, determining the
shortest time from the onset of a threat to reaching a given
population at risk. A simulation would then provide data to help
determine whether the available time allows you to to:
assess, during the emergency, the risk to the population;
notify the relevant emergency officials accordingly;
notify the population at risk.
The time taken to complete the above three tasks should ideally be
much less than the time taken for the release to reach the
population, especially where the release may render sheltering
ineffective. Where sheltering is not the appropriate response to a
release, the time taken to evacuate the population must be
included in the analysis, in order to determine the potential
hazard to the population.
No high-fidelity simulation has been conducted by Technica
which has involved the issuing of orders to the general population
for evacuation or sheltering. It is possible, however, to simulate
release scenarios by computer modelling techniques, and
estimates of the times to reach the population at risk can then be
evaluated.
Previous work on the evacuation of the public has also identified
some of the significant factors in the notification process which
will affect population evacuation. These include the warning
content and the source of the warnings. Some discussion of these

will be conducted in the section on public information.
4
COMMUNICATION
Inherent in previous examples have been some of the effects of
communication system and information transfer failures. In the
first example, where the emergency response operator is described,
the issue of information transfer and the overload that occurred is
well illustrated.
However, another issue is that of the failure to identify/
appreciate what constitutes time-critical information. By this we
mean information that must be known as early as possible, and
which must be transferred to the relevant personnel for action.
This information is rather difficult to determine using a functional
analysis alone, simply because it is not easy to predict the
dynamics of a given incident and its effects on the emergency
response personnel. Some assumptions about the emergency
scenarios can be made, and these scenarios may be simulated to
provide data on the types of critical information required for the
resolution of these emergencies. The identification of critical
information can then be conducted within the framework of a
functional analysis and, once specified, the appropriate factors
can be incorporated into the training of the officials responsible
for information transfer.
This information is particularly important for systems in which
a queueing system is employed for simultaneous communications
to the control room. This may result in trivial information delaying
critical information, and techniques for avoiding this include
specific training for those transmitting information and/or
separate channels for critical data.
One other problem within the communication issue is that of
the masking effects of background noise on the performance of the
operators who are transferring information. Specifically, we refer
to situations in which numerous auditory alarms are going off in
an emergency control room. These may detrimentally affect the
identification of critical information and its subsequent
communication beyond the control room. In the case of major
industrial accidents, the event itself may be associated with
extreme noise levels, such as from escaping high-pressure gases,
fires or mechanical impacts.
Outside of the control room, but still on-site, the effects of
external sirens in the vicinity of emergency officials (such as
firemen) may also produce masking effects on communication

between them.
In the above situations, it is inadvisable to allow alarms to be
switched off by the incident control room operators because, as
experience shows, this can become a regular reflex and so
undermines the effectiveness of the alarm. The resolution of this
problem will depend very much on the context in which the
auditory alarm is sounded. Whilst the operators in the indicent
control room may wish to silence an alarm to which they have
already responded, this possibility should not be applied in
blanket terms to other locations.
One suggestion from a case study was that, where auditory
alarms were being sounded, the emergency officials could be
allowed to make announcements over the tannoy system. To
ensure that these announcements were audible, the sirens were
attenuated for the duration of the announcement by the official
transmitting the message. Additionally, redundancy and diversity
should be incorporated into the alarm systems such that, where
one mode fails, the other may still be available and functioning.
One solution would be to use visual alarms as well.
5
PUBLIC INFORMATION
It is possible that, whilst an effective emergency plan has been
developed for an on-site emergency, it fails to cope with the many
variables that are evident in the off-site situation. Of most
relevance to this paper is the capability of the emergency plan to
utilise effective methods by which information to the public can be
disseminated.
In Technicas experience, the requirement of the public for
information is straightforward: unambiguity about what the threat
characteristics are, instructions on how to mitigate these, and the
ability to confirm the threat. It is simply inadequate to expect
sirens to provide the public with such specific information on the
nature of an emergency.
Responsibility for the officials/authority giving such information
must be clearly defined. Research conducted by Technica suggests
that careful consideration needs to be given to those responsible
for information dissemination and to the type of information that
will be given. In other words, a good authority figure, clear
instructions, and preferably two-way communication are
necessary. This would enhance the publics perception of the
origin and reliability of the information. It is common for the
public to jam communication lines as they try to confirm the

threat. This should be avoided if possible.
For obvious reasons it is unlikely that a simulation exercise
involving large numbers of the public can be economically
conducted. However, data from a simulation exercise (e.g. threat
characteristics and their relation to the proposed warning
methods and content) could be used to assess the capability of the
warning system to effect the appropriate response in
the population at risk. Data on the efficiency of the warning
process in evoking the appropriate response have been obtained
by Technica, and these can be used in a predictive analysis of the
emergency plan.
6
SUMMARY
This paper has not attempted to discuss all the issues important
to emergency plan assessment. It has, however, documented the
issues that Technica has found, in previous work, to be
important. Additionally, no attempt has been made in this paper
to produce a complete methodology for assessing emergency plans.
The paper does, however, document the use of two approaches.
The first is a high-fidelity simulation, of which we have experience
in implementation for auditing purposes. The second, functional
analysis, is a complement to the first approach, but can be most
useful when a full-scale high-fidelity simulation is not viable. Such
an analysis is more economical than a high-fidelity simulation.
However, the functional analysis, on paper at least, may not have
access to real-time data. We would therefore suggest that the two
approaches be used together. In this way, the benefits of each can
be reaped to the advantage of the emergency plan.
17
Exercises and Auditing: Experience
Gained in the FRG
STEPHAN NEUHOFF
Berufsfeuerwehr Kln/Cologne Fire Brigade, Cologne,
FRG
1
DISASTER RISKS AND PREVENTION
In North-Rhine-Westphalia every city must carry out a disaster
prevention exercise at least twice a year. These exercises must be
directed at specifie local risk factors.
Cologne is a city with an important chemical industry as well as
being an important traffic junction. 25% of the total German
production of chemical materials is produced in Cologne and the
surrounding areas. The city is surrounded by a belt of large
chemical factories as well as many small businesses which
process chemicals or are involved in chemical trade and
transport. Large amounts of dangerous chemicals are transported
by road, rail, ship or pipeline. Cologne is a major road, rail and air
transport junction not only for freight but also for passengers. The
exercises must therefore be aimed at handling these two risk
factors.
In Cologne the city fire brigade is responsible not only for firefighting and emergency services but also for disaster prevention.
As long as a fire or accident can be controlled by the professional
fire brigade, by the volunteer fire brigade and by organizations
involved in emergency services, such as the German Red Cross,
the operation is directed by the chief of the professional fire
brigade. If the situation cannot be brought under control by these
organizations, then units of the Disaster Prevention Service must
be brought in, and a Disaster Alarm is given. The operation is then
directed by the town clerk. An operations staff group, the Disaster
Prevention Management (Katastrophenschutzleitung, KSL), is
available in a specially equipped control centre. This operations
staff group consists of officers of the professional fire brigade
together with the directors of various city offices such as the
Health Office or the Press Office. It also includes members of state
agencies such as the police and military services, and (if

necessary) members of private companies.
Depending on the situation at the site of the emergency, one or
several Technical Operations Management Groups (Technische
Einsatzleitung, TEL) are established. They consist of an officer of
the professional fire brigade together with a small operations staff.
The TELs direct the units which have been put under their
command.
2
THE AIM AND THE EXECUTION OF EXERCISES
The exercises should enable a realistic simulation of a disaster
and also the testing of disaster prevention measures. They should
include the following procedures:
1. Notification of the management and units of the Disaster
Prevention Service and other agencies
2. Communications between the KSLs, the subordinate TELs,
the supervisory authority and other state agencies and (if
necessary) private companies
3. Situation assessment and decision making by the operations
staff
4. The execution of measures such as warning, evacuating and
assisting large numbers of injured people
Three types of exercise can be performed depending on the specific
aim: alarm exercise, staff exercise, or a complete exercise. Any
combination of these exercise types is also possible. The alarm
exercise is only performed in order to check the time between the
alarm and the ready for action state. A staff exercise is only
performed by the operations staff; the units at the disaster locality
are simulated. During a complete exercise the KSLs, TELs and all
units perform the exercise in a simulated emergency situation.
The most frequent exercises are the staff exercises. Alarm
exercises for the 4500 assistants of the Disaster Prevention
Service in Cologne only take place every 3 years. Complete
exercises are only performed approximately every 5 years due to
the extensive preparations which are necessary.
3
ALARM EXERCISES
The most recent unexpected alarm exercise in Cologne showed
some rather sobering results. The exercise was performed on a
weekday at 18.00 hours (6 pm). The members of the Disaster
Prevention Management (KSL) were notified by telephone or, if
available, by radio receivers. In cases where a simultaneous
notification of all radio receivers could take place using a collect
call (i.e. just by pressing a single button) the staff members
arrived at their positions after approximately 30 minutes. Giving
the alarm by telephone required much more time: an average of 3
minutes for each call. In addition, the telephone lines at the fire
brigade control centre were blocked, and staff members whose
presence would have been essential, especially during the early
stages of a disaster, were not available. This problem will be
tackled by the installation of a computer which automatically dials
the stored telephone numbers and plays a prerecorded tape, after
which the staff members who have been notified are registered
and a list is printed. The fact remains, though, that at least 1
hour is required before the management staff members can
commence their work. This means that in the meantime the
situation must be managed by leading staff members of the
professional fire brigade, the emergency services and the police
who are on duty at the time of the incident.
The units of the Disaster Prevention Service were alerted by
sirens and by telephone calls. In the units which were notified by
sirens, 20% of the members were available after the first halfhour, 40% after 1 hour, and 60% after 25 hours. In the units
which were notified by telephone calls, approximately 10% arrived
during each half-hour, resulting in a total of 46% after 25 hours.
The conclusions are that notification of leading staff members
and units of the Disaster Prevention Service must be done by
sirens or by using a collect call for radio receivers. Plans must also
be made for employing units with only 50% of their personnel.
4
COMMUNICATION PROBLEMS
All technical means must be employed together to ensure efficient
communications between the Technical Operations Management
(TEL) at the site of the emergency and the Disaster Prevention
Management (KSL).
The radio communications network is often overloaded or even

jammed during the early stages of an emergency. It is also
frequently used by reporters. Therefore communications using
mobile telephones in vehicles should be established as soon as
possible. This can then be replaced by connecting the Technical
Operations Management (TEL) with existing private telephone
lines. A prerequisite for the use of telephone communications is
the availability of secret telephone numbers for the Disaster
Prevention Management (KSL) which cannot be blocked by calls
from the public, from town councillors or from the press. Longer
written reports can be transmitted by radio telex, and plans and
maps can be forwarded by using telefax machines.
Not only during exercises but also during real emergencies does
it take a long time for the Technical Operations Management (TEL)
at the emergency location to forward a first detailed report of the
situation to the Disaster Prevention Management (KSL). As the
Technical Operations Management (TEL) is nearly always
overloaded, especially during the early stages of an emergency, it
can take 45 minutes or more. The Disaster Prevention
Management (KSL) must therefore have their own scouts, who can
use motorcycles or 4WD vehicles to reach the emergency area and
to report from there. The use of video cameras has turned out to be
a successful measure in Cologne. The city of Bonn even has
facilities which allow the direct transmission of video recordings
from a helicopter into the control centre of the Disaster Prevention
Management (KSL).
The long time needed by the Technical Operations Management
to investigate and report the situation has an additional
consequence: it must not affect protection measures for civilians,
for example if an accident occurs in a chemical factory! In Cologne,
chemical factories must therefore report each incident using the
code numbers D1-D4 depending on the suspected amount of
danger to the public. If the fire brigade is notified of a chemical
accident with the code number D3, the endangered area is
immediately warned by sirens, radio stations and vehicles with
loudspeakers, and closed off by the police.
5
ASSESSING THE SITUATION AND MAKING
DECISIONS
We have noticed, during all staff exercises, that the management
groups can only work efficiently if they are kept as small as
possible. The positions and tasks within the group must be
defined beforehand, so that the group members can prepare

themselves and practise properly. Every position must be occupied
by two people in order to enable shift work during longer
emergencies.
The performance of a management group depends very much on
whether the individual group members are capable of working
together. The most common problem is the incorrect behaviour of
superiors at the highest level. These problems increase in
significance if the exercise is being prepared, supervised and
evaluated by staff members of this superior. Therefore exercises in
Cologne are regularly planned and supervised by groups from
other cities or by disaster prevention schools. This has resulted in
a less restricted viewpoint and a more critical approach. It also
reduces the probability that information about an exercise is
released too early.
So far, in Cologne, 4 staff exercises have been undertaken
together with chemical factories. Cooperation was good as staff
members were exchanged with members of the factory
management as liaison officers. The emergency situation during
the exercise consisted of a transport accident inside or in the
direct vicinity of the factory area. The factories were not prepared
to simulate an accident in a production area or at a storage area.
Possibly they did not want to discuss the number of fatalities or
injured persons which could result from an accident in these
areas.
Two of these factories are directly on the boundary between
Cologne and neighbouring city areas. Exercises and real accidents
have indicated the problems which can occur during the required
cooperation. Planning and protection for the entire factory area
must be the responsibility of the city which has the larger
potential and facilities for protection. Tasks, information exchange
and responsibilities must be defined precisely in advance.
6
EXECUTION OF PROTECTION MEASURES
The protection measures which are required during a chemical
accident, such as
warning,
closing off areas,
investigation,
care of injured persons,
evacuation, or
decontamination,
can be planned during an exercise by the management group
without being executed, or they can be planned and then actually
executed by units, or complete preplanned measures can be tested
by the units.
In Cologne the endangered area is defined by superimposing a
template or pattern on a map of the city, the position of which
depends on the prevailing wind direction but not on the type and
amount of toxic material released or on other prevailing weather
conditions. Other cities use several templates or simple empirical
formulae for a calculation. National or EC recommendations are
necessary. In order to do this, past accidents should be evaluated
and future hypothetical accidents should be simulated.
Use of loudspeaker-equipped vehicles for alarms has been
extensively tested in the Cologne area and the results have been
used as a base for planning purposes. Eighty-four fire brigade
vehicles which are either permanently occupied, or which can be
employed immediately, were equipped with loudspeakers, cassette
tape decks and prerecorded cassette tapes. The success of a
combined alarm using sirens, radio broadcasts and loudspeaker
vehicles is not known, however, as it has not yet been tested. This
exercise would require a large amount of participation from the
general public.
The handling of large numbers of injured persons was practised
in Cologne by assuming the case of a crash-landing of a JumboJet At the simulated crash site the main problem was the
management of large numbers of doctors and ambulance
personnel in order to ensure rapid examination and treatment
depending on the gravity of the sustained injuries. The second
problem area was the hospitals. At night and on weekends they
are understaffed and, depending on their size, even had problems
when confronted with two badly injured patients at the same
time. It is therefore necessary to install systems which can rapidly
give the alarm to additional operating teams.
The storage of antidotes depends less on the number of possibly
poisoned persons than on the time available for the administration
of the antidotes and the number of available doctors.
Unfortunately it has not yet been possible to test the treatment of
a large number of poison cases in an exercise in order to gain some
knowledge of the requirements for an antidote storage system.
A staff exercise is to be undertaken in Cologne in 1988. The test
case is a railway accident, in which a fire threatens a filled LPG
tank car. According to a state recommendation, the area within a

1 km radius of the accident site is to be evacuated.
In the Cologne city area this would require the evacuation of
between 10000 and 100000 inhabitants. The planning of an
evacuation on this scale, which is extremely complex and requires
a large number of individual measures, can be practised by the
operations staff. As the incident in Mississauga is difficult to
compare with the situation in a large European city, it would only
be possible to indicate the problems involved in evacuating 10000
or more people by a practical exercise, but this would reach the
limits of this kind of exercise. The participation of hundreds of
people can be organized, but the involvement of thousands
exceeds our present organizing capacities.
18
Auditing and Exercising of Emergency
Plans for the Danish Oil and Natural
Gas Transmission System, Including
Fixed Installations
HANS HAGEN & PETER JOHANSEN
Danish National Fire Service, Copenhagen, Denmark
1
INTRODUCTION
After the discovery of oil and natural gas fields in the Danish part
of the North Sea, the concession for import, sale, transmission
and storage of natural gas was given to Dansk Olie & Naturgas A/
S (DONG) in 1979. This concession was later extended to include
crude oil.
Based on this concession, oil and gas transmission and storage
systems including fixed installations have been built. The
systems, of which the first part was put into service in 1983,
today include 3 fixed installations covered by Article 5 of the EEC
Major Hazard Directive 82/501/EEC. The facilities are a gas
treatment plant, an oil storage facility, and a natural gas cavern
storage facility.
2
NATIONAL REGULATIONS COVERING OIL AND
NATURAL GAS TRANSMISSION SYSTEMS
The above-mentioned systems were established in accordance
with the Acts giving DONG the concession. The safety regulations
for the systems were established jointly with the Natural Gas
Coordinating Committee headed by the Energy Agency comprising
all planning and safety authorities.
As safety code, the US ASME Code for Natural Gas
Transmission and Distribution systems was used, supplemented
with specific Danish requirements. The specific requirements for
the internal emergency plan are part of the safety requirements
laid down by the Ministry of Labour in Order 406/1979 regarding
the safety of natural gas facilities. This order also requires that the
operator must obtain construction as well as operation
authorization. A condition for such authorization is that the

internal emergency plan has been prepared and implemented.
As regards the external emergency plan, the responsibility rests
with the Ministry of Justice. This Ministry lays down the general
requirements whereas the implementation rests with the police,
the fire authorities, the Civil Defence Corps and the hospitals.
3
INTERNAL EMERGENCY PLAN PREPARED BY
DONG
In accordance with the requirements of the order by the Ministry
of Labour, DONG has prepared an emergency plan covering the
organizational structure, the emergency control centres, the
communication systems, the technical procedures, and the
equipment to minimize the consequences of accidents, alarm
plans, and liaison with the external emergency authorities. The
emergency plan consists of a plan covering all DONG oil and gas
systems together with specific plans for individual facilities. The
emergency plan also includes the necessary staff training and
exercises. The exercises specified in the emergency plans include
local exercises and exercises involving the whole system and the
external emergency services.
4
EXTERNAL EMERGENCY PLAN (EEP)
The main principle in making the EEP in Denmark is that the fire
brigades available in the area in which the plant is situated must
be adequate. This means that the authorities in approving the
project have to take this into consideration and if necessary set up
requirements for the companys own fire brigade and/or fixed
installations for fire-fighting. The EEP is prepared by the local fire
authorities in coordination with the police and sent to the Danish
National Fire Inspectorate (DNFI) for approval.
As an example of the EEP, the treatment plant for natural gas in
Nybro will be considered. The plant is located in the community of
Varde, which has approximately 20000 inhabitants and a fire
brigade consisting of 2 first attendances. Within a short range of
the plant there are two small communities, each with 1 first
attendance. The nearest big town is Esbjerg with approximately 80
000 inhabitants and a fire brigade consisting of 3 first
attendances. Besides the fire brigades mentioned, the Civil
Defence Corps send the following appliances to the plant in a case
of great alarm: within 1520 minutes there will be 31 firemen and

9 vehicles, and within 50 minutes a further 36 firemen and 8
vehicles.
5
PLANNING OF EXERCISES
The exercises are planned by DONG in collaboration with the
external emergency services, with the following objectives:
(a) Testing the alarm procedures
(b) Testing the collaboration between DONG and the external
emergency services and the availability of special equipment
(c) Making on-site and off-site personnel familiar with their
equipment, the facilities, and possible accidents
6
AUDITING OF THE EMERGENCY PLAN
After each exercise a short report is made by the participating
DONG units and the external emergency services. These reports
normally cover the following items:
(a) Tasks carried out during the exercise
(b) Communications with other participants and the press
(c) Lessons learnt
SESSION IV
Techniques for Emergency Plans
Chairman: M.F.VERSTEEG
Ministry of Housing, Physical Planning and The Environment, The
Netherlands
Rapporteur: H.SCHNADT
TV Rhineland. FRG
19
The Computer Program TIGRE and its
Application to the Planning of
Chemical Emergencies
A.SENY,a B.SIGALSb
aDepartamento de Ingeniria Nuclear, b Departamento de
Termotecnia, Universitat Politcnica de Catalunya,
Barcelona, Spain
&
A.TRUJILLO
BRAIN Ingenieros SA, Barcelona, Spain
The computer code TIGRE [1] is an expert system, specially

designed to fill the needs of off-site Emergency Plans prepared
under the requirements of the 82/501/CEE directive. It has been
applied to the plans of the chemical complexes of the provinces of
Tarragona and Huelva (Spain), known respectively as PEE/
PLASEQTA and PEQHU. These two provinces contain
approximately 70% of the Spanish chemical industry.
In order to accomplish its objectives, TIGRE contains two data
bases. The first deals with major accidents. It contains a complete
catalogue of the accidents taken into account in the Response
Guide [2]. The second data base contains the information needed
to estimate physical and chemical properties of hazardous
substances.
In addition, TIGRE uses mathematical models to calculate the
values of some variables representative of the physical phenomena
due to major accidents. The models used are derived from those
proposed by the Netherlands Organization for Applied Scientific
Research (TNO) and described in the so-called Yellow Book [3].
In this way it is possible to alter the meteorological conditions
and also the source term adopted in the Response Guide. So the
program TIGRE allows the operator to determine the real
consequences of the accident and also the best counter-measures
to be taken.
TECHNIQUES FOR EMERGENCY PLANS 159
It is worth noting that the models used have to be simple

enough to be capable of offering responses during the emergency.
They also have to be complete enough to provide reliable results.
The option chosen is a compromise between the two needs. Due to
that lack of precision they have to be supported by the Chemical
Security Group [4].
The emergency starts when a chemical factory notifies the
CECOP [5] of an incident. At this moment the Emergency Plan
becomes active, as also does the code TIGRE. When the Chemical
Security Group has assessed the accident, one can use TIGRE in
two different ways:
(1) If the accident is similar to one of those contained in the
Response Guide, it is possible to obtain a forecast of the
consequences of the accident in a few seconds. The only
additional information needed is meteorological data.
(2) If the accident is not similar to one of those contained in the
Response Guide, it is also possible to use TIGRE to predict
its consequences. The sole difference is that the operator has
to provide some more information about the characteristics
of the accident and the place where it has taken place. If the
substance involved in the accident is not one on the data
base [6] it is also necessary to supply properties data.
The use of TIGRE has been simplified as much as possible in
order to make it suitable for use during emergencies by
unqualified personnel. In addition, it contains a great number of
safeguards to minimize erroneous operation. The simplicity of
TIGRE is improved by a very detailed users manual and by short
courses given to the personnel responsible for its use. Finally,
emergency simulacra are prepared periodically so as to maintain
the operability of the whole system.
NOTES
1.
2.
3.
TIGRE stands for Tratamiento de la Information y Gua de

Respuesta en la Emergencia (information treatment and response
guide during the emergency).
The Response Guide contains a great number of hypothetical major
accidents covering a wider range of severity. It has been deduced
from a meticulous analysis of the installations.
TNO. Methods for the Calculation of the Physical Effects of the
Escape of Dangerous Material (Liquids and Gases). Report of the
Committee for the Prevention of Disasters, Directorate General of
4.
5.
6.
Labour, Ministry of Social Affairs, Voorburg, The Netherlands,

1979.
The Chemical Security Group is one of the four task groups that are
included in the Emergency Plan. It has to assess the accident and
provide all the information needed to the Direction of the Plan.
CECOP stands for CEntro de Coordinacin OPerativa. It is an
operations centre from where the emergency procedures are
directed.
The substances data base contains more than 60 substances.
Among them are the most commonly used of the classified
substances under the 82/501/CEE directive.
20
Expert System Technology to Support
Emergency Response: Its Prospects
and Limitations
SALVATORE BELARDO
State University of New York, Albany, New York, USA
&
WILLIAM A.WALLACE
Rensselaer Polytechnic Institute, Troy, New York, USA
1
INTRODUCTION
The capabilities for computer technologies to provide decision
support in emergency response are now well recognized [1]. The
information flow prior to, during, and after potentially
catastrophic events must be managed in order to have effective
response. We feel strongly that computer technology can be a
crucial component in this management process.
We will first review a relatively new facet of computer technology
expert systems. We will then provide a conceptual framework for
decision making under crisis, a situation typified by emergency
response. We follow with a discussion of a prototype expert system
for response to an accident at a nuclear power generation facility.
Our final section discusses the potential advantages and
limitations of expert system technology in emergency response.
2
EXPERT SYSTEMS [2]
The origins of artificial intelligence (AI) date back several decades.
AI has its roots in the mathematical logic systems of Frege,
Whitehead, Russell and Tarski, and in the theories of computation
developed by Church and Turing, among others. These theorists
addressed thinking by formalizing some aspects of reasoning into
a relatively simple framework. The formal systems of logic and
newborn computers were then linked by these systems of logic.
The crucial advance was the recognition that computers were not
limited to numeric calculations but could process symbols.
The introduction of symbolic processing opened the door for

attempts to mimic the human mind. Studying the ways humans
solve problems, AI researchers have developed techniques that
attempt to represent human decision making. Knowledge
representation, the searching for possibilities and alternatives,
and learning processes are all ingredients in AI research.
Expert systems have recently emerged as the leading practical
application of AI. The user of an expert system interacts with the
computer in a consultation dialogue, much as he or she would
approach a human expert on the same problem. The user explains
his or her problem, perhaps performing some tests, and then asks
questions about the computers proposed solution.
2.1
Representing expertise
Representing the various types of knowledge that characterize
expertise constitutes one of the main themes of expert systems
research. Expert systems are often designed with knowledge
concerning:
(1) facts about the domain;
(2) hard rules or procedures;
(3) problem situations and potential solutions;
(4) general strategies; and
(5) conceptual models of the domain.
Much of this information must be stored in the program of the
expert system using special techniques for knowledge
representation. Many systems use production rules of the form IF
A THEN B to store information types (2), (3) and (4). Domain
information is often stored in tables or matrices, while the
designers conceptual model of the problem is usually built into the
program logic.
The clearest distinction between expert systems and
conventional computer programs is the flexibility of the artificial
intelligence design. Much of the knowledge that is used by human
experts does not constitute definite decision sequences, rather it is
hunch-like.
2.2
Transfer of expertise
The primary bottleneck in the development of expert systems is
the acquisition of the knowledge of the expert. Typically the system
designers consult with one or several experts for long periods of
time during the development stages. Since intuition and opinion
are part of this knowledge, this process is often arduous and
inexact and can lead to long delays in producing a working expert
system [3].
2.3
System processing
Expert systems attack problems by feeding all the available
information concerning the problem into the knowledge base that
makes up the heart of the system. Often this consists of
production rules that generate possible hypotheses or solutions to
the problems. Once initial possibilities have been determined, the
process of confirming or narrowing the solution begins. In systems
involving diagnostic problems, the program uses its conceptual
model to suggest tests to be performed or questions to be
answered. These narrow the solution range in order to enable the
system to reach a valid conclusion.
2.4
Explanation of knowledge
A key feature of many expert systems is their capability to explain
their reasoning in understandable terms. This ability is one of the
distinguishing features of consulting with human experts and is
implemented on computer systems to improve the users
confidence in the systems judgment. With the availability of the
exact reasoning process followed by the system, it is easier to
convince users that the solutions are valid and reliable. However,
differing philosophies are used to explain whether the system can
actually mimic the reasoning processes of the expert. Several
systems use an elaborate solution technique but then attempt to
explain their solutions in conventional ways. The issue of
knowledge presentation is also an open research question [4].
3
DECISION SUPPORT FOR EMERGENCY
RESPONSE [5]
In an emergency, managers face a unique decision making
process. Dynes and Quarantelli [6] state that decision making
during crises is marked by a rapid increase in the number of
decisions made and the volume of information that must be
processed. As a result, crisis managers cannot analyze options
available to them. Feeling intense time pressure and operating
under the stress created by dealing with life-threatening events,
they ignore critical information (which they are unable to process
or relate to the events facing them) and resort to rule-based
behavior. The success or failure of the response operation is
dependent upon the validity of the rules selected. Successful
emergency managers are people who have a valid mental set of
rules or can instantly determine upon which experts they can
rely.
The probability that information-free, trust-based decision
making will succeed is diminished by the fact that emergency
management involves rapidly changing ad hoc organizations.
Communications and control are difficult at best, and these
organizations are likely to include many members with inadequate
expertise. The sequence of events and decisions at Chernobyl,
Bhopal, and in Switzerland are evidence that the heuristics of the
first-line responders and crisis managers may not be appropriate
to the scale of the crisis that they face.
Information technology, appropriately used, can support the
judgment of crisis managers and can also aid in the actual
management of a crisis response. Knowledge-based support and
control systems may be used to evaluate and determine correct
courses of action, to perform functions automatically (thereby
diminishing the volume of decision making that must be done), or
by calling attention to exceptional conditions.
The need to provide decision support to emergency managers is
readily apparent from theories of decision making. One theory
suggests that a decision maker has an optimal band of
information processing capability that, when breached, will result
in a reduced quality of performance. Another theory suggests that,
when information handling capabilities of an individual are
overwhelmed, individuals try to compensate for their deficiencies
by constructing a simplified representation of the problem and by
behaving rationally within this representation [7]. The latter
concept is related to the psychological phenomenon known as
FIG. 1. Flow of action in emergency management operations.
cognitive strain, caused by the inability of the decision maker

to match his or her information processing capabilities to the
information demands. Stress occurs and resultant dysfunctions
are apparent in the decision makers performance.
Decision making performance is not only a function of the
psychological attributes of the individual, but also a product of the
individuals role in an organizational system and of the availability
of appropriate resources to support the decision making process,
i.e. information technology decision aids. Decision making can be
improved, therefore, by selecting people with the proper
psychological prerequisites, or by engineering the environment so
that better decisions result. Our interest is in this latter category
and, in particular, in the selection and design of expert systems to
support emergency response decision making.
Figures 1 and 2 illustrate the flow of decisions in a crisis event.
The flow of actions in emergency management operations follows
the dynamics of the event. The decisions made in one stage of the
disaster are constrained by the time available and they, in turn,
constrain the decisions made in later stages. Figure 2 is based
upon Smart and Vertinskys [8] conceptualization of the decision
process during crisis. The quality of the decision made by an
individual in a crisis setting (box I) is a function of the quality of
the information received (box H), his or her cognitive capabilities
(box A), and an assessment and evaluation of the tradeoffs
associated with the various alternatives (box G). The quality of the
information used in the decision process depends on the ability of
the information system to monitor and, when necessary, to reduce
data flows to prevent information overload (box C), as well as the
ability of the system to insure that the data are in a form
meaningful to the user and of value in the decision process.
The major difference between emergency response situations
and routine decision situations is highlighted by the loop in
Fig. 2 (from box A to box E). The closed-system nature of the
conceptual model indicates the large degree of dependence among
the factors, specifically with regard to surprise (box D), stress (box
E), and information processing abilities (box B). A decision aid
(box F) can dampen feedback in the loop (and thus lessen the
impact of stress and surprise on the decision maker) by reducing
the decision makers information overload, real or perceived.
Reducing the information overload results in an increase in
available response time, a reduction in stress, and improved
information processing, which results in a more efficient use of
the decision makers cognitive processes.
FIG. 2. A conceptual model of the role of a decision aid in an individual

crisis decision process.
4
EXPERT SYSTEMS AS A DECISION AID FOR
EMERGENCY RESPONSE
We have identified the components of a decision support system
for emergency management in Fig. 3. The five subsystems are (1) a
data bank, (2) a data analysis capability, (3) normative models, (4)
expert systems, and (5) an interactive technology for display and
use of the data and models. This system would interact with the
decision maker and collect data from the environment, either
directly to the data bank or from the user.
The data bank stores information obtained from the operating
environment. This information is typically obtained prior to the
decision situation, but data on current conditions can also be
stored and processed as needed. The data are then presented to
the decision maker in their original configuration or after
transformation according to one or more models.
In many circumstances the data are processed statistically to
provide specific types of information that may be useful in
obtaining appropriate decisions. For example, projections of
human resource requirements and staffing constraints can be
combined to yield a forecast of future recruitment and selection
goals. Normative models can assist the decision maker by
providing solutions that are not obvious, evaluating tradeoffs
FIG. 3. Components of a decision support system.
between alternative solutions, and providing recommendations on

a specifie course of action to be taken. The expert system
technology, as we indicated in the previous section, takes the data
from the data bank and assesses their applicability to the decision
process in question. It then provides a recommendation to the
decision maker using the system rules.
Although not explicitly shown in Fig. 3, a model management
system could act as an interface between the decision maker and
the various models. Conceptually the system could manage the
interaction between the models and provide advice to the decision
maker on the appropriate model(s) for a decision situation.
The last subsystem, the technology required for display and
interactive use, may be the most important part of the system.
Even the most optimally designed system may go unused if the
information is not presented in a form that supports the decision
maker. The decision aid must take into account the differences in
how individuals approach the problem solving process. Thus the
interface technology must be flexible and provide several display
and retrieval alternatives.
5
AN EXAMPLE IN NUCLEAR PLANT EMERGENCY
RESPONSE [9]
Since the TMI-2 and Chernobyl accidents, the nuclear industry
has undertaken a major initiative to improve nuclear plant
emergency response capabilities. Progress has been made in
developing computerized data systems to support the emergency
response facilities. However, response management must include
federal, state and the private sectors as well as the coordination
among them. It includes activities such as direction and control,
communication, public notification, accident assessment,
protective response action, public information, evacuation, etc.
Typical response proceedings during a radiological emergency are
depicted in Fig. 4.
FIG. 4. Typical response proceedings during a radiological emergency.
A prototype expert system was built to provide decision support

for emergency response. The knowledge base was taken from the
emergency level classification for the Indian Point Nuclear Power
Plant and the procedures from the State of New York Radiological
Emergency Preparedness Group in the USA.
The system was built using the GEN-X expert system shell
product of General Electric. It consists of 64 modules, of which 57
are AND/OR trees and 7 are IF/THEN tables. The system can run
in two modes: interactive or semi-automated. In the first one,
questions are asked of the user at each step of the inference
process, whereas in the second a data base or file is interrogated
and the user is only required to confirm or supply judgmental
answers.
The objective of this prototype system is to aid in the decision
making process. The system queries the user for identification and
then prints a list of procedures that have to be followedmatched
to the responsibilities of the user.
FIG. 5. Logical structure of the expert system.
The system has several levels of nesting, i.e. a CANT ANSWER

response at one stage will produce a call to an inner module that
asks for more specific parameters. This process goes on for
several levels until an answer is obtained. A schematic of this
process is shown in Fig. 5.
The plant conditions can be one of the following: normal
operation, unusual event, alert state, site area emergency, general
emergency. The events that determine the above conditions are
classified as: thermohydraulic, radiological, power loss, safety
systems actuation, natural hazards or other type. The user can be
any individual involved at the federal, state, local or private
sector.
This can be accomplished by taking advantage of its modular
design as well as its ability to perform forward and/or backward
chaining. It is designed using a hierarchical top-down approach,
i.e. going from general to specifie questions until an answer is
obtained or can be inferred. It has two running modes: interactive,
asking questions at every step, and semiautomated, interrogating
a fact/data base and asking the user only a few questions.
This prototype system is being validated by implementing
various plant scenarios from past drills, and comparing the
answers with those obtained in the field.
6
DISCUSSION
We have attempted to demonstrate the role of expert system
technology in providing support to emergency managers. The
example we used was the case where these managers are faced
with an incident at a nuclear power generator facility that has the
potential for catastrophic consequences.
Artificial Intelligence as a discipline is just in its infancy. We
have only discussed one area in this rapidly expanding (and often
confusing) field. The area of expert systems seems to hold promise
for implementation in a meaningful way, i.e. it is used
operationally. The difficulty with its use in emergency response is
the lack of routine in the activities required to manage the
emergency. We can, and have, simulated the events surrounding a
nuclear accident, but have not tested this technology even in that
environment [10].
We might also consider other new advanced information
technologies as possible candidates for supporting emergency
response. Of particular note is the use of mobile cellular telephone
systems with expert system technology [11]. The availability of
rapid, accurate digital information will complement the judgment

capturing and processing capabilities of expert systems. The
result would be recommendations for emergency response,
displayed graphically in real time, i.e. in time to support the
decisions that have to be made to protect life and property.
NOTES AND REFERENCES
1.
2.
3.
4.
5.
6.
See BELARDO, S., KARWAN, C.R. & WALLACE, W.A. (1984).

Managing the response to disasters using microcomputers.
Interfaces, 14(2), 309, for examples, while a US government report
by the Congressional Research Service of the Library of Congress,
Information Technology for Emergency Management, US Government
Printing Office, Washington, DC, 1984, surveys the topic.
This section draws heavily upon HURLEY, M.W. & WALLACE, W.A.
(1986). Expert systems as decision aids for public managers: an
assessment of the technology and prototyping as a design strategy.
Public Administration Review, Special Issue, 56371, and MICK, S. &
WALLACE, W.A. (1985). Expert systems as decision aids for disaster
management. Disasters, 9, 98101. Other references used are BARR,
A. & FEIGENBAVIN, E.A. (Eds) (1979). Handbook of Artificial
Intelligence, Vol. 1, Stanford University Press, Stanford, CA, and
WATERMAN, D.A. (1985). A Guide to Expert Systems, AddisonWesley, Reading, MA.
The problem of transfer of expertise or knowledge acquisition has
yet to be resolved; one example of ongoing research is GRABOWSKI,
M. & WALLACE, W.A. (1987). Knowledge Acquisition Using
Prototyping: An Empirical Investigation. Technical Report No. 3787
120, Decision Sciences and Engineering Systems Department,
Rensselaer Polytechnic Institute, Troy, NY.
The impact of advanced technology will be most evident in the way
the user interacts with computing and communication technology.
Very realistic and useful graphics and voice interactive capabilities
will be available within the next few years. The issue of knowledge
presentation, how we instil confidence in the user of expert systems,
becomes the key to user acceptance and understanding; see
LAMBERTI, D. & WALLACE, W.A. Presenting uncertainty in expert
systems: an issue in information portrayal. Information and
Management (in press).
A more detailed discussion may be found in BELARDO et al. (see
Note 1), and BELARDO, S., HARRALD, J. & WALLACE, W.A.
Knowledge based decision support systems for responding to
chemical accidents. Proc. 1987 World Conf. on Chemical
Emergencies, Rome, Italy (in press).
DYNES, R. & QUARANTELLI, E. (1976). Organizational
Communication and Decision Making in Crises. DOD/ARPAN00014
7.
8.
9.
10.
11.
75C0458, Department of Defense, Advanced Research Projects

Agency, Washington, DC.
TAYLOR, R.H. (1975). Psychological determinants of branded
rationality: implications for decision-making strategies. Decision
Sciences, 6(3), 40929.
This diagram is based upon SMART, C. & VERTINSKY, I. (1980).
Designs for crisis decision units. Administrative Science Quarterly, 22
(4), 64057.
SALAME, A.A., GOLDBOGEN, G., RYAN, R.M., WALLACE, W.A. &
YEATER, M.L. (1987). An expert system for improving nuclear
emergency response. Artificial Intelligence and Other Innovation
Computer Applications in the Nuclear Industry: Present and Future,
Snowbird, Utah, USA, 31 August-2 September.
We have assessed (fortuitously) simulation as a basis for training in
BELARDO, S., PAZER, H.L., WALLACE, W.A. & DANKO, W.D.
(1983). Simulation of a crisis management information network: A
serendipitous evaluation. Decision Sciences, 14(4), 588606, and
have used gaming to test decision aids; see BELARDO, S.,
KARWAN, K.R. & WALLACE, W.A. (1984). An investigation of system
design considerations for emergency management decision support.
IEEE Trans. Systems Man and Cybernetics, 14(6), 795804.
WALLACE, W.A. (1987). On Managing Disasters: The Use of Decision
Aid Technologies. Technical Report No. 3787118, Rensselaer
Polytechnic Institute, Troy, NY, and to be published in Proc. NSF
Workshop on Natural and Technological Hazards. University of
Colorado, Boulder, CO. (in press).
21
Improved Emergency Response after
Release of Toxic Substances:
Application of the System SMART*
D.HESEL
TV Rheinland, Cologne, FRG
&
H.DE WITT, H.D.BRENK & A.G.KNAUP
Brenk Systems Planning, Aachen, FRG
An accidental atmospheric release of toxic substances can take
place in chemical factories, it can be caused by a fire or it can
follow a transport accident with hazardous materials. Emergency
response forces have to be able to act properly in all these cases.
Whatever the reason for the contingency may be, a quick and
accurate estimate of the toxic air concentrations in consequence
of the accident must be made and a decision on protective
measures must be deduced from this estimate.
This important decision in off-site emergency management as to
which protection measure must be taken for the general public is
generally left to the first on the scene, the fire brigades. Once they
have an idea of which material has been released, they require
information on emission rates and meteorological data to estimate
the consequences of the release to people in the vicinity of the
accident site. To date the instrumentation and the tools to achieve
this are very simple and unreliable.
Identification of the material released is achieved by UN number,
or by questioning the manufacturer. Measuring is carried out with
absorption tubes, if it is carried out at all. Prediction of the
propagation of the released material is effected with the aid of some
precalculated plume models (Fig. 1). If this is compared with the
actual course of a released cloud (Fig. 2) we can see that the
prediction made using Fig. 1 can lead to a severe misjudgement of
the real conditions.
* SMART: System for Measurement-based Assessments of Released

Toxicants.
FIG. 1. Example of a precalculated plume model (variables: wind

direction, wind speed).
FIG. 2. Actual shape of a propagating cloud under realistic weather

conditions.
To improve this situation, the German Ministry for Research

and Technology has sponsored us to develop a mobile unit for use
by the fire brigades. The developed unit consists of a command
vehicle, a personal computer with relevant software, input and
output devices, a meteorological mast and three very simple
measuring units equipped with absorption tubes. Figure 3
presents a rough sketch of the unit and its equipment.
Concerning the air concentration measurements, we found out
that all other devices, such as infrared spectrometers, dosimeters
for individual substances, portable GC/MS devices and so on, are
not (or not yet) suitable for use by fire brigades. The main reasons
for this are the expertise required to operate and to maintain the
systems, the lack of versatility of the devices and the costs. This
disappointing result of our study forced us to stay with the
absorption tubes and to incorporate them into the system.
The key to the developed system is the computer software,
which was designed to help the fire-fighter perform his tasks of
identifying the released
substance, assessing the released
quantities, following the released and dispersing cloud, measuring
air concentrations and of course making a decision on which
protective measure to take. The software provides masks on the
screen of the PC, which guide the operating fire-fighter through
FIG. 3. The mobile unit and its basic equipment.
the programme. Figure 4 summarizes the modules which make up

the programme. All these modules are controlled and initiated
from a main programme, which also takes care of the input and
output.
In short, the modules perform the following tasks:
Identification of the released material
Estimation of the released quantity using plant-specific data
Recording and processing of meteorological data
Processing of air concentration data
Estimation of source parameters
Dispersion calculation with adjustment to the measured air
concentration data
Output of prediction and recommendations
While most of these modules can be found in similar approaches,
the module which carries out the dispersion calculation and
adjusts it to the actually measured air concentration data is
unique.
This module SMART permits best possible elimination of
uncertainties connected with each of the two factors dispersion
calculation and measurement, by means of two key elements; see
FIG. 4. Modules of the computer code applied in the emergency response

system.
Fig. 5. The first element is the feed-back of current air

concentration measurements into diagnostic calculations in order
to adapt the calculations to the measurements. This results in a
more realistic set of model parameters, including the source term.
Subsequently these parameters are used as input data for the
second key element of SMART which is real-time projection of the
dispersion situation.
The feed-back of current air concentration measurements into
diagnostic calculations is realized by the following adaptation
sequence. After the release of a toxic substance a first
approximation of the dispersion situation is made as usual,
without knowledge of measured air concentrations. In the second
step, the computer module SMART incorporates the current
concentration values measured at different locations and
compares them with the modelled concentration values. The
fundamental calculation procedure, which is then initiated, can be
described as quasi-continuous adjustment of the calculated to the
measured concentrations. This is repeated for each time interval,
e.g. 10 minutes, for which measurements are provided.
Depending on the specific question to be answered, the
adjustment may be accomplished by evaluating 5 model
parameters such that the procedure results in a best fit within the
scope of the prediction accuracy of the dispersion model used. In
mathematical terms this is realized with the aid of the following
equation which is a modified least-squares fit formula:
FIG. 5. Logical scheme of the corrective/predictive procedure of the

System for Measurement-based Assessments of Released Toxicants
(SMART).
where CC and CM are the calculated and measured off-site air

concentrations of each measurement location i at the end of the
time interval n; N is the total number of absorption tubes and k is
the number of trials to find the best fit.
The model parameters are:
Wind direction
Wind velocity
Standard deviation of horizontal and vertical wind direction
fluctuations
Source term
These parameters are evaluated according to a particular trial and
error strategy, based on Monte Carlo techniques and guided by
their sensitivity with respect to the dispersion calculations.
The adjustment procedure provides a most realistic and

accurate set of effective model parameters to describe the current
dispersion situation. This set is then used to project pollutant
concentrations for subsequent time periods. The projection is
based on the assumption that the meteorological conditions and
the release rates are constant during the prediction time. This is a
restriction which is not necessarily true, particularly for long time
periods. It can be opened, however, by repeating the
measurements and the adaptation procedure within sufficiently
short time interval such as 10 minutes. This allows a proper
adaptation to both changing weather conditions and varying
releases of toxicants.
Test applications with experimental dispersion data and first
implementation in the emergency response system have revealed
good operational performance of SMART. Therefore it can be
stated that it provides very realistic and accurate information on
the dispersion situation after an accidental release of toxicants to
the atmosphere. It thus enables the first on the scene to make a
quick decision about necessary protection measures. The
complete system which is installed in the mobile unit performs a
number of tasks. It helps the emergency forces to identify the
released substance; it recommends measuring points and
measuring equipment; it measures and records meteorological
data; it registers every step of the accident; above all, it acts as a
decision aid. The equipment used is still relatively simple, easy to
maintain and reasonably priced. At the moment, the system is in
its test phase in a joint effort with the Cologne fire department.
22
Emergency Management of a Gas
Escape
C.M.PIETERSEN
Division of Technology for Society TNO, Apeldoorn, The
Netherlands
1
INTRODUCTION
Large industrial disasters that happened recently, like the LPG
escape in Mexico and the methyl isocyanate escape in Bhopal
(both at the end of 1984), again show the need for good
preparation for such situations. It is the responsibility of the
industry as well as the authorities to reduce risks to a minimum,
but that does not mean that industrial disasters will cease to take
place.
One of the means to reduce the risk that people on-site as well
as off-site will suffer from the consequences is to draw up an
emergency management plan. Such an emergency response plan
should be drawn up after a thorough analysis of the particular
situation. Several elements can be distinguished:
(a) Risk analysis of the hazardous activity; what types of accident
will happen:
magnitude of the escape
possible consequences (area, number of people involved)
development of the disaster in time
(b) Analysis of the type of action which will be the most effective
during an emergency (and what type of organization should
be set up)
(c) Development of the tools to be used in an actual emergency
An analysis of accidents that actually occurred will be of great
benefit for all three steps mentioned. In this paper the TNO analysis
of the Mexico and the Bhopal disasters will be used to illustrate
the necessity for all three elements. These accidents represent
completely different situations, for which completely different

emergency responses will be necessary.
It also leads to large differences in requirements with respect to
the type of organization (number of people, delay in being present
at the site etc.). The diversity of possible disaster situations by
type, magnitude, location and time requires an automated
decision support system, to be used in actual emergencies. TNO is
currently developing such a system on behalf of the Dutch
Ministry of Internal Affairs (Fire Inspectorate). This paper gives a
short description of the possibilities of that system.
The importance of preparing an on-site emergency schedule (for
the workers) is based on risk assessment techniques and is
illustrated with TNO wind tunnel modelling of NH3 escapes at a
Dutch chemical plant.
2
RISK ANALYSIS OF HAZARDOUS ACTIVITIES FOR
EMERGENCY RESPONSE PLANNING
In order to be able to set up an emergency response plan for a
particular industrial activity (installation, transport or handling), a
risk analysis of the activity should be drawn up:
(1) Identification of representative accident scenarios: What can
go wrong? A certain indication of probability of the scenarios
will be useful, in order to set priorities. Quite often the
maximum credible accident approach is followed. The
judgement of what is and what is not credible is of course a
subjective one.
(2) A calculation of what will happen to the surroundings of the
activity in the case of an escape:
(a) Effect calculations:
concentrations in vapour cloud as a function of distance
passage time of a vapour cloud
heat radiation as a function of distance
overpressures upon explosion etc.
These effects can easily be calculated via existing models
[1], also available in software packages for personal
computers.
(b) Consequence calculations:
number of injured and killed people as a function of toxic

dose, heat radiation dose etc.
damage to different types of building
These calculations need introduction of a specific
environment. TNO has currently developed software for
personal computers that will make these calculations
possible [4].
An analysis of comparable accidents that actually occurred will be
useful in order to verify the models that are used to estimate the
development in time and to learn from already taken emergency
response actions.
Accident data are available for instance in the TNO databank
FACTS. However, it is worthwhile to analyse some accidents in
more detail. The Mexico and Bhopal accidents are examples of
such an analysis, also with regard to the emergency response
aspect.
3
THE GREAT DIFFERENCE IN EMERGENCY
RESPONSE REQUIREMENTS OF THE MEXICO
AND BHOPAL ACCIDENTS
3.1
Mexico LPG disaster, 19 November 1984
In November 1984 a disaster involving an LPG installation in
Mexico City resulted in the death of over 500 people and 7000
people were injured. A TNO team visited Mexico shortly afterwards
to carry out an investigation [2]. This investigation was mainly
directed to a check of the existing damage and effect models and
to the emergency relief that had taken place. Some figures in
relation to the emergency relief are given below. The area in
question is given in Fig. 1.
During the disaster 985 medics, 1780 para-medics and 1332
volunteers were giving medical assistance. They handled 7231
wounded, of which 5262 were treated in provisional emergency
centres. Of the 1969 wounded taken to 33 hospitals,
approximately 900 had to stay there for further treatment. By 25
February 1985, 710 patients had recovered, 32 were still in the
hospitals and 144 people had died there.
For transportation purposes, the emergency services used 363

ambulances and 5 helicopters. Eleven provisional shelters were
established for 39 000 homeless and evacuated people. Each day
35 000 hot meals were provided, with a total of approximately
125000 hot meals.
The Mexico disaster developed very rapidly. A vapour cloud
formed and was ignited shortly after the first leak (10 minutes).
The escalation to a complete disaster took place in the next few
minutes.
Generally it can be stated that in this type of accident the
warning time is very short; however, some time may be available
to take certain actions:
Removal of ignition sources (traffic etc.)
Evacuation of people
Stoppage of leak
Some time can be gained by effectively cooling (water spray) the
tanks; due to the rapid sequence of events this should be an
automatic system
The emergency relief organization for this type of disaster
should be able to act very fast and to be present within a very
short time
FIG. 1. Reproduction of the area in which the damage occurred.
3.2
Bhopal disaster, 4 December 1984
Shortly after the Mexico disaster, a massive escape of methyl
isocyanate caused the death of at least 2500 people and over
100000 people were injured in Bhopal, India. A toxic cloud
developed during the night. In a TNO report [3] the accident and
its emergency management are extensively described. At the
request of the official Indian scientific investigation team, the
Union Carbide plant itself was also visited.
Compared with the Mexico accident this type of accident shows
important differences with respect to emergency relief. Important
points are:
A warning time (even before any gas escape) may be available;
in Bhopal it might have been obvious 1 hour prior to the escape
that a very dangerous situation was rapidly developing.
The development of the disaster allows time for important
mitigating actions: evacuation etc.
In Bhopal hardly any action was taken with respect to emergency
response in the sense described above [3]. In Fig. 2 is illustrated
how people started to run into the direction of the hospitals
without any guidance. In fact this running worsened the
situation; they were running in the wind direction and therefore
stayed within the cloud.
FIG. 2. Movement of people to the hospitals during the Bhopal disaster.
The scope of an emergency response organization to take

effective actions is quite large for this type of accident. It is also
mainly for these accidents that TNO developed an automated
information and calculation system, to be used in actual disaster
situations.
4
ON-SITE EMERGENCY MANAGEMENT
It is important to base on-site emergency management schemes
on realistic accident scenarios. This can be achieved by studying
accidents from the past and/or via risk assessment techniques.
However, the calculation of concentrations of toxic or inflammable/
explosive gas clouds, for the relatively small distances involved,
may be rather difficult, depending on the circumstances. The
influence of obstacles (buildings etc.) may be such that at present
only wind tunnel modelling can predict the shape and
concentrations of the cloud.
For emergency management it is important that, in built-up
areas like chemical plants, not only the down-wind area is covered
but also the area up-wind and in the lateral direction. This should
be realized in the case of an accidental release of a heavy gas.
Running in the up-wind direction is not necessarily valid.
From descriptions of several accidents involving NH3 there is
clear evidence that staying inside a building in the event of a
release has an advantage. For instance, it has been reported [6]
that 10 men survived in a control room 80 m from the release;
they put wet cloths over their faces. Five men left the control room;
two of them were killed. More people outside or on their way
outside were killed (see Fig. 3).
The dispersion of the gas in all directions and the protection by
(relatively) gas-tight rooms has set clear requirements for on-site
emergency management in the case of toxic heavy gas releases.
Gas-tight rooms are to be created and clearly indicated; people
should run to these rooms. Adequate protective means and
communication equipment should be present at the spot.
FIG. 3. General layout of Potchefstroom plat.
5
INFORMATION AND CALCULATION SYSTEM FOR
EMERGENCY RESPONSE
Commissioned by the Dutch Ministry of Internal Affairs (Fire
Inspectorate) and the Ministry of Housing, Physical Planning and
Environment (Directorate General for Nuclear Accidents), TNO
developed an Information and Calculation System to support
decision making in
FIG. 4. Information and calculation system for emergency response.
disaster situations with toxic and nuclear material. The user can
interact with the system, in order to get informed:
The system calculates and shows the size of the threatened area
and the number of people involved. It also calculates the
number of people that will survive and the number of people
with several degrees of injury. The system also gives an insight
into the development of the situation as a function of time.
The system is capable of analysing the effect of possible
measures relating to a reduction of numbers of victims.
The structure of the program is given in Fig. 4. The system is still
in a demonstration phase and will shortly be implemented in fire
brigade regions in the Netherlands.
REFERENCES
1.
2.
3.
4.
5.
6.
Calculation of the physical effects of the escape of hazardous

material (gases and liquids)The Yellow Book. Directorate General
of Labour, Voorburg, the Netherlands, 1979. Also available as a
software package (EFFECTS), TNO.
PIETERSEN, C.M. (1985). Analysis of the LPG Incident in San Juan
Ixhuatepec, Mexico City, 19 November 1984. TNO report.
PIETERSEN, C.M. (1987). Bhopal: Risk Assessment and Emergency
Management. TNO report.
Software Package RISKCURVE for Personal Computers. TNO, 1987.
GULDEMOND, C.P. The behavior of denser than air ammonia in the
presence of obstacles: wind tunnel experiments. Plant/Operations
Progress, 5(2).
LONSDALE, H. (1975). Ammonia tank failure: South Africa.
Ammonia Plant Safety, 17, 12631.
23
Effective Emergency Planning Design
by Means of Risk Analysis Models
A.DONATI, L.LAMBARDI, V.SICILIANO & E.SILVESTRI
Ansaldo SpA, Genoa, Italy
1
INTRODUCTION
This paper discusses the analysis and design of emergency
planning in an integrated framework of risk analysis. Two aspects
are taken into consideration:
Risk analysis of the installation (industrial or civil), for deciding
upon the reference accident scenarios, both in terms of their
consequences and their probability
Detailed representation and modelling of emergency plans, to
quantify their effectiveness in risk reduction
This approach, in effect, considers emergency plans as virtual
safety systems and quantifies their effectiveness and reliability as
such.
2
THE OVERALL MODEL
The initial phase of the analysis consists of the risk analysis of the
installation. This phase implements system models, like fault
trees, event trees, models of accident analysis (fire, toxic release, or
whatever is relevant for the installation being considered). This
phase identifies the accident scenarios presenting the most
significant risks for which an emergency procedure is required.
Then each emergency procedure combining to form the
emergency plan is evaluated with a systems analysis approach,
and introduced into the overall plant model, like any other system
or physical process already modelled, to identify the sequence of
events/failures leading to an undesired outcome.
This approach requires the emergency procedures to be

evaluated in terms of their physical effectiveness and of their
probabilities to be effective (a standard probabilistic risk
assessment approach).
3
SYSTEM MODELS FOR AN EMERGENCY PLAN
In order to evaluate the efficiency of a designed emergency plan, it
is necessary to develop a model of the egress flow of people which
points out the main parameters that may affect the success of the
emergency procedure.
The construction of the model passes through many phases; the
main ones are:
Modelling the structure of the plant (e.g. a room, a floor, a
building) and routes (doors, passages, stairs, open spaces,
obstacles, bottlenecks)
Modelling the dynamics of people involved (e.g. reaction time to
the alarm, speed, behaviour in stress conditions)
Introducing the use of possible means of conveyance (e.g. lifts,
vehicles, ambulances) and their availability
Analysing the phenomenology of the accident (fire, smoke, toxic
release propagation)
A complete model will take into account all the parameters and
should evaluate the possible interaction between them.
To evaluate the adequacy of an emergency plan for a building it
is necessary to be able to estimate the egress times of individuals
(or homogeneous groups of people), and the probability that this
time is less than a predetermined value.
Egress time is here considered to be that elapsing between the
alarm signal and the moment the group reaches a pre-assigned
zone. During this time the plant or site situation may change (e.g.
because of the accident or the environmental situation), and the
pre-established safety course may then be unfit for use.
Ansaldo has carried out a study of the first two steps and has
developed, in an initial stage, two computerized models, one for
the dynamics of peoples movements and another for peoples
egress probabilities.
Interactions with the phenomenology of the accident will be
developed in a successive stage.
The code EPDES (Emergency Planning DESign) is able to model

the emergency traffic with the goal of evaluating the single person
or group position, depending on the varying plant conditions.
The code takes into account the topological situation, the
variation of the environmental conditions (e.g. amount of smoke),
the presence of obstacles on the escape routes.
At each time, the code provides extension of the accident-related
zones, positions of people, forbidden routes, and non-evacuable
zones. It is also capable of searching routes alternative to the
standard ones, to reach safe zones; consequently the traffic model
permits march inversions and route changes, depending on the
situation as known by single persons.
Basic entities of the model are the group, the zone and the
route:
Group: homogeneous composition of people who, in
emergency situations, run along a preset route to reach a
safe zone. It is characterized by a mean speed and by various
factors that may change it.
Zone: each area into which the plant is subdivided. It is
characterized by a length and a surface. With each zone is
associated a typical speed which corresponds to that of a
person crossing it, alone and in optimum conditions; this
speed changes depending on the number of people present,
on the environmental conditions and on the shape of the
exits.
Route: ordered succession of zones that each group
crosses. It is characterized by a direction. A route may be
interrupted at a certain time, and this may force the group to
go back to look for a junction with a free route; if no
alternative route is found, the group is to be considered lost.
Three different egress modes are envisaged:
Independent groups, with no exchange of information among
people about route practicability
Groups exchanging information about route practicability
Panicking groups
The group speed, V is evaluated through the equation:
where Fg is the product of group factors, Fz is the product of zone
factors, Vz is the typical speed in the zone. Factors and speeds are
obtained from experimental correlations (see, for example, Refs 1

and 2).
The EPDES code is part of a code family for the design of
emergency plans relating to a reference scenario; it is thus linked
both with codes of accident analysis and, in the future, with codes
of probabilistic evaluation (presented by Ansaldo on the general
organization of the methods and codes).
The code provides a 3D graphic representation that shows the
state of the system at different time steps. This graphic
representation allows identification, in an interactive way, of the
consequences of events forced by the code operator; also, subcases of different egress paths can be studied by means of the
restart option.
To predict the probabilistic outcome of this traffic model, a
stochastic simulation is performed on it. This can be
accomplished in various ways, such as a direct Monte Carlo type
simulation of the dynamic model by assigning appropriate
probability distributions to input variables (in this approach
response-surface methodologies may represent an aid) or by using
an appropriate logical model, for example (see Refs 3 and 4) a
state transition (Markov) model (the latter is applicable if nonlinear effects, i.e. the dependence of state transition probabilities
on the visited states is shown not to be important), where the
values of state transition probabilities are based on the physical
model just discussed.
Implementation of these models with the appropriate input data
will produce the various degrees of success of the emergency
procedure at various times with associated probabilities.
The results of this analysis can be coupled with the risk
analysis of the installation, thus determining the accident
situations that are most relevant, with account taken of the
emergency plan. This resulting risk can be then, for design
purposes, verified according to pre-defined acceptability criteria.
The EGRESS program models the transient states of occupancy
of a building by means of a Markov model. The transition matrix
can be automatically constructed and reduced by checking the
consistency of its states and its topological characteristics.
At the present stage of development, the modelled emergency
plans can only consist of a rigid procedure, which means that
each group of people has an a priori fixed and known route to exit.
So no arbitrary choice of route is allowed; even the alternative
route in case of obstacles is fixed.
In this way it is possible to compare different egress paths, and
therefore different emergency plans, checking the peoples time to
egress at a given level of probability (or vice versa). At present no

search for optimal routing is performed.
The basic entities of the model in this case are groups, states,
egress rates, and routes. Groups and routes have the same
physical interpretation as in the EPDES code, whereas states and
egress rates are physically correlated with the concepts of zone
and of group speed, and are defined as:
State: possible configuration (occupation by people) of the
rooms or spaces
Rate: the mean flow of people from one zone to another; the
rate depends on various factors: speed of people, type of exit,
door, etc.
A sensitivity analysis can easily be performed to check the relative
influence of the parameters; this can be used to find the areas of
the problem that need more details on data or on the model.
In this way the probability of success/failure of an emergency
plan may enter into the plant system event trees as a nodal
probability like that of a protection system.
4
DESIGN OF AN EMERGENCY PLAN
The overall model just described can be used for design purposes
with the aim of reducing the risk generated by the process that
takes places in the installation, by modifying the process intrinsic
or active safety or, in particular, if the installation is already in the
operational state, by improving the emergency procedures to be
foreseen for its safe operation.
This can in general be obtained by introducing or modifying
engineered or procedural features with the general effects of:
increasing the effectiveness of the emergency plan through
improved performance (e.g. a reduction of expected times of
execution of the procedure, or reduction of dependence of its
success on the success of single items or factors);
increasing the probability of reaching a successful terminal
state under various conditions by reducing the effects of such
factors of variability that may cause a large dispersion of the
probability distribution of the parameters of merit like the time
for people to leave the site), even if their expected or mean value
is adequate.
The choice between various alternatives at all levels, if it exists,

must then take cost-effectiveness and cost-benefit considerations
into account.
REFERENCES
1.
2.
3.
4.
CASCARINO, A. and other authors (19821987). Various articles.

Antincendio (in Italian).
La Sicurezza contro Vlncendio degli Edifici a Struttura di Acciaio.
Monografia 6 della Ricerca: II comportamento delle strutture
portanti de acciaio alle azioni sismiche Parte II, 1979.
SCHULTZ, N. (1985). Fire and Flammability Handbook. Van
Nostrand.
SAATY, T.L. (1961). Elements of Queueing Theory with Applications.
Dover.
24
Major Industrial Risks: Examples of a
Technical and Predictive Basis for Onand Off-Site Emergency Planning in
the Context of UK Legislation
K.CASSIDY
Technology Division, Health and Safety Executive,
Bootle, UK
1
INTRODUCTION
There is nothing new about major hazards; it is only their
character that has changed over the years. Intially, of course,
large-scale threats to man and his environment had a natural
origin, mainly storm, flood and fire, although the archaeological
record amply demonstrates the potential for disaster that arose
from mankinds early attempts to harness the potential of fire. In
the Middle Ages the manufacture, storage and accidental ignition
of black powder may well provide the first examples of large-scale
damage from manufactured substances and artefacts. In the last
couple of centuries, large-scale water dam failure and boiler
explosions accompanied the onset of the Industrial Revolution.
The entry of chemistry, and particularly of chemical
engineering, on to this stage has been relatively recent; it is even
more recently that the threats posed by large-scale chemical
engineering and energy processes have attracted the attention,
first of risk analysts, and then of legislators, as a response to
growing public concern. The justification for such concern has
been demonstrated at regular intervals, by a succession of
incidents causing widespread damage and death. Many lists of
such incidents could be produced; most would include
catastrophes such as those at Oppau, Texas City, Flixborough,
Seveso and Manfredonia, Bantry Bay, San Carlos, San Juan
Ixhautepec, and Bhopal, all of which have been seminal in terms
of public and regulatory response. Nor is the catalogue confined to
damage to humans. Many major hazard risks have an element
(which may indeed predominate) of environmental damage where
effects may persist long-term. It may well be that the recent
pollution incident at Basle will prove to be a watershed of equal

significance to the incidents listed above.
2
THE UK APPROACH
The UK has been a leading architect in the framing of legislative
control for major industrial hazards. We have a system, based
mainly on the advice of the Advisory Committee on Major Hazards
[1] and confirming European standards [2], which is centred in
the following concepts [3]:
Identification: via the Notification of Installations Handling
Hazardous Substances (NIHHS) Regulations [4]
Assessment and control: via the Control of Major Industrial
Accident Hazard (CIMAH) Regulations [5]*
Mitigation: via the CIMAH Regulations (involving emergency
planning and information to the public and land-use planning
control [6, 7]
This approach is very much an interdependent package of controls
and responses, appropriately tailored to the relevant risks.
3
IDENTIFICATION
There are in the UK some 1750 installations subject to NIHHS,
and several hundred more now notified under CIMAH, many of the
latter in particular presenting environmental as well as humandamage risks. The requirement for statutory notification has a
number of effects: it gives priority to HSE attention; it permits
identification of such sites to land-use and emergency planners,
and to emergency services; and, hopefully, it stimulates greater onsite awareness of the hazards and risks.
4
ASSESSMENT AND CONTROL
The general requirements of the CIMAH Regulations apply to sites
which store or use hazardous substances which satisfy criteria
* Extensive guidance on and interpretation of the CIMAH Regulations can

be found in a guide to the Regulations, published by HSE [17].
related to toxicity, flammability, reactivity or explosiveness. Several

thousand such substances have been identified as being in
regular use in UK industry. In such cases, the operator of the site
must:
notify the HSE of any major accident which has occurred on his
site, with details of steps taken to prevent its recurrence (to be a
major accident it need have no more than the potential for
harm);
be prepared to demonstrate to an inspector, on request (and
produce documentary evidence as appropriate), that he has
considered the potential for major accidents from his
operations, and has taken all appropriate steps both to prevent
their occurrence and to mitigate the consequences of any which
may occur.
Further, more specific duties under the Regulations apply to sites
on which are stored or used certain substances in excess of
specified thresholds. These sites are known as large inventory top
tier sites (LITTS), which store large quantities of flammable toxic
or explosive materials, and small inventory top tier sites (SITTS),
which store or use materials that are considered particularly
toxic, and for which much lower thresholds (1 tonne or less) are
prescribed. In the UK there are over 200 LITTS and several
hundred SITTS notified to HSE.
The additional duties which fall to the occupiers of such sites
are:
Preparation of on- and off-site emergency plans
Provision of appropriate information to the public
Submission to HSE of a safety case
4.1
The safety case
Emergency planning and information to the public are measures
primarily designed to mitigate the consequences of any major
incident, should it occur (the probability of a major accident
should, however, be remote), or, in the case of some aspects of
emergency planning, to intervene in the escalation process. This
latter approach apart, such questions should be concerned with
the residual risk after all appropriate, reasonably practicable
precautions have been taken. This is a general requirement of UK
law [8]. In the case of hazardous installations, however, it is
reinforced by a specific requirement to present to HSE a written

report (the safety case) which:
describes the installation, and places it in its geographical and
social context;
identifies any relevant major accident hazards;
analyses the effectiveness of the safeguards (both hardware and
software) that have been applied;
reaches conclusions about the risks presented by the
installation; and
on the basis of the above analyses, effectively justifies the
continuation of the operation, whilst identifying any remedial
action.
This is not a process of approval, or one of licensing. Neither is it a
once and for all exercise, as there are revision and updating
requirements. The analysis is, however, a written demonstration
of the application of good management techniques to major hazard
control. It identifies the critical areas, which can then be
addressed on a concentrated and continuing basis, and the
hazard analysis carried out at an early stage of the assessment
process highlights inter alia the relevant areas for potential
mitigation, including that provided by adequate emergency
planning.
3
MITIGATION
The main elements of mitigation are
planning, and information to the public.
location,
emergency
5.1
Location
Adequate mitigation of major hazard risks is best achieved by
planning control of incompatible land uses. Such controls have
been applied in the UK, on a formal basis, since 1972. We are,
however, the inhabitants of a small island (where intensive landuse is at a premium), and the hazard ranges of some of our
industrial processes may be very great. Additionally, there is an
existing legacy of previously permitted and continuing
incompatible development. Many of our hazardous installations
are not ideally located with respect to adjacent developments. This
most powerful tool of control is therefore only partially applicable
to the existing situation, despite continuing developments in UK

planning law [9] which will shortly introduce a consent procedure
for hazardous installations. Additional, operational measures are
therefore required.
5.2
Emergency planning
CIMAH requires effective arrangements for on- and off-site
emergency plans, involving close cooperation between the site
operator, the local authority, the county authority and the
emergency services.
General advice on emergency planning has been published in the
UK by both the HSE [10] and industry [11, 12]. The recent SIESO
booklet is an important addition to this corpus of advice [13].
Similar guidance is being produced in other countries, e.g. the
USA [14].
The following principles are relevant in the production of
emergency plans.
5.2.1
Assessment of the hazards and risks
Manufacturers need to assess their activities to ensure that all
that is reasonably practicable is being done to avoid or reduce
danger. They should then assess what dangers could arise to
people on- and off-site as a result of foreseeable emergencies and
what the effects of an incident could be on the environment. This
should be followed by consideration of how these could be
mitigated by preplanned remedial and rescue measures using,
when necessary, the combined resources of the organisation
concerned and the public emergency services.
The objectives of emergency plans are to contain and control
incidents, to safeguard employees (and anyone nearby who might
be affected), and to minimise damage to property or the
environment. The spectrum of possible incidents may be very
wide. The smallest, if promptly detected and dealt with, may have
virtually no ill effects. If allowed to escalate, however, any incident
may have serious consequences both on and off the site. Any
relevant analysis will therefore involve an investigation of hazard,
vulnerability, and risk. As a minimum, the following criteria will
apply.
(a) Hazard identification.

Types and quantities of hazardous materials located in (or
transported through) a community
Location of hazardous materials facilities (and routes)
Nature of the hazard most likely to accompany hazardous
materials spills or releases.
(b) Vulnerability analysis.
Extent of the vulnerable zone (the significantly affected area)
and the conditions that can influence the impact (e.g. size of
release, wind direction, topography)
Population, in terms of size and types (residents, employees,
sensitive populationshospitals, schools, old folks homes
etc.), expected to be at risk within the vulnerable zone
Essential support systems which may be affected by any
incident
Any particular risks to the environment
(c) Risk analysis. This will assess the probability of damage (or
injury) to individuals or to the community due to a
hazardous materials release, and the actual damage which
might occur, in the light of the vulnerability analysis. It will
include information on:
Event probability
Relevant environmental phenomena
Domino effects
Types of harm to people (including high risk groups);
whether acute, delayed or chronic
Types of damage to property (temporary, repairable,
permanent)
Types of damage to the environment (repairable, permanent)
Indirect hazards/risks
There are many uncertainties in the predictive modelling of all the
above issues; similar uncertainties occur in real situations. For
these reasons, a relative simple broad-brush approach is the
preferred option. Assessments purporting to give closely defined
accuracy are suspect, and may be misleading; in any event, such
precision is more relevant (if achievable) to a developing incident
than to a preplanning protocol, where a degree of realistic
conservatism and pragmatism is desirable. Flexibility of response

is a paramount requirement.
Examples of hazard ranges from substances presenting
explosive, flammable and toxic hazards will be presented at the
seminar, with some indication of the likelihood of each type of
event and its relevance for emergency planning. A selection of
these examples is given in the Appendices.
Emergency plans must be capable of dealing with the largest
incidents that can reasonably be foreseen, but detailed planning
should concentrate on those events that are more probable. Plans
must also have sufficient flexibility so that the response is tailored
to the severity of the incident. Flexibility will also allow the
response to be extended and increased if extremely remote
combinations of adverse events and circumstances lead to
consequences larger or more severe than those that formed the
basis for the emergency plans. For example, the risks of aircraft
crashing on to an installation that is not within a few miles of an
airfield are remote and the consequences need not be considered
in detail. If such a disaster occurred, there is no doubt that, in
practice, the existing peace-time emergency plans would form the
basis of the response by the emergency services. Seismic effects
are unlikely to result in major vessel failure in the UK, but more
minor events may need to be considered.
5.2.2
Content of the emergency plans
(a) On-site plan. Key personnel will be identified. These will include
the Incident Controller, whose primary task is to take charge at the
scene, and the Site Main Controller, with overall responsibility for
directing operations from the Emergency Control Centre.
Nominated key personnel having immediate tasks to perform will
always be available, as well as the Incident Controller or deputy
and an emergency team. Provision will need to be made for the
call-out of the other key personnel when they are absent from the
site. Where the level of manning does not give cover round the
clock, arrangements will be made to ensure adequate emergency
response.
The plan will also set out the arrangements for initiation of the
plan, raising the alarm, the emergency control centre or centres,
safeguarding those on-site, and the action by the emergency team.
(b) Off-site plan. The off-site emergency plan will be based on
events identified by the manufacturer that could affect people and
the environment outside his premises. The manufacturer has to
provide the emergency planners with information on the nature,

extent and likely effects of such incidents. The plan will need to
cater in detail for those events identified as being most likely, but
it must be sufficiently flexible to allow for the remedial measures
to be extended and increased to deal with extremely adverse
combinations of circumstances and consequences or with an
escalating situation. Several different responses may be necessary
at a single site, depending on the size and characteristics of
potential incidents. This is particularly so in the case of mixed
hazard sites, or where there is significant risk of escalation.
The Chief Executive of each Emergency Planning Authority will
normally designate an Emergency Planning Officer to oversee the
plan. The emergency services, fire authorities, police, ambulance,
etc. have duties to deal with emergencies and accidents of all
sorts. In the UK, the police will have overall control of an incident,
with control on the fire ground by the fire authority. The plans
will ensure coordination of existing services targetted to hazards
specific to the industrial installation. The plans should set out a
command structure and identify the respective roles and
responsibilities of the senior personnel involved, so that a
command and response structure is in place before the event. An
Emergency Coordinating Officer may be designated; he will take
overall command of the off-site activities. It is essential that any
arrangements include a suitable off-site Emergency Control
Centre.
The plan will identify and detail immediate action to be taken to
protect those in danger and arrangements for caring for those
affected by an incident. In many cases the advice on immediate
action may be to stay or go indoors, shut doors and windows, tune
in to the local radio and await further instructions (normally from
the police). Evacuation may present special problems. Indeed,
being indoors may provide initial protection, but on the longer
term it could increase the risk [15, 16]. Where environmental risks
are present (and especially where they predominate), special
arrangements will be necessary. Potential hazard ranges may be
very great, and potable water and food supplies may be at risk.
Such risks may, however, be delayed rather than immediate.
The recovery phase should also be preplanned; again, special
problems may be associated with environmental risks.
5.2.3
Rehearsals and training
Both on-site and off-site emergency plans need to be tested when
first devised, and thereafter to be rehearsed at suitable intervals,
for a number of reasons:
(a) They familiarise on-site personnel with their roles, their
equipment and the details of the plans
(b) They allow the professional emergency services to test their
parts of the plan and the coordination of all the different
organisations; they also familiarise them with the special
hazards
(c) They prove the current accuracy of the details of the plan
(d) They give experience and build confidence in the team
members; in the initial shock and confusion of a real
incident, preplanned procedures are essential, as was clearly
shown at San Juan Ixuatepec and Bhopal
After each rehearsal or practice, plans should be reviewed to take
account of any shortcomings highlighted by the exercises. In
addition, its effectiveness should be reviewed every time it is used
to deal with a real emergency.
5.3
Information to the public
Any emergency planning depends for its success on an
appropriate response from those covered by the plan, and this
necessitates adequate briefing of those liable to be affected. Onsite personnel should receive this briefing (and training, as
appropriate) as part of the preparation and realisation of an
emergency plan. Off-site, however, such detailed briefing and
preparation will rarely be possible. For this reason the UK
CIMAH Regulations impose an additional duty to inform persons
who are within an area that it is for the HSE to define (usually the
land-use planning consultation distance). The minimum
information to be given is:
that the hazardous installation is notifiable, and has been
notified to HSE;
a description of the operations on site, and of the hazards and
risks that might affect the recipient of the information; and
any emergency measures (including appropriate personal

behaviour) to be taken in the event of an incident
Methods of giving information will vary, as will frequency. Advance
and regular information can be given to those resident or working
in the area; those in control of public amenities can be similarly
informed. However, transients may well receive the information
only in an emergency situation.
Adequate and relevant information is therefore a prerequisite for
control and response in an emergency situation.
6
CONCLUSION
The UK has set in place a system of major hazard controls which
should help to prevent major accidents and minimise the effects of
any that may occur. The controls are a combination of discrete
but interdependent elements. On- and off-site emergency planning
are essential parts of the overall system of control.
REFERENCES
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
Advisory Committee on Major Hazards. Three Reports: 1976, 1979,

1984. HMSO.
OJEC Directive No. 82/501/EEC
CASSIDY, K.Hazardous installations and the law. Eurochem 86.
I.Chem.E.
Notification of Installations Handling Hazardous Substances
Regulations 1982. HMSO.
Control of Industrial Major Accident Hazard Regulations 1984.
HMSO.
Department of Environment Circular 9/84. HMSO.
Town and Country Planning (General Development) and (Use
Classes) (Amendment) Orders, 1984.
Health and Safety at Work etc. Act 1974. HMSO.
Housing and Planning Act 1986. HMSO.
CIMAH Regulations 1984. Further guidance on emergency plans HS
(G)25. HMSO.
Recommended procedures for handling major emergencies (and
supplement), 1977. CIA.
General guidance on emergency planning within the CIMAH
Regulations for chlorine installations 1986. CIA.
Guide to Emergency Planning. SIESO, 1986.
Hazardous Materials Emergency Planning Guide. National Response
Team Report NRT, 1 March 1987.
15.
16.
17.
DAVIES, P.C. & PURDY, G.I. (1986). Toxic gas risk assessments: the
effects of being indoors. Chem. Eng., January.
PURDY, G. & DAVIES, P.C.Toxic gas incidents: some important
considerations for emergency planning. I.Chem.E., 1986.
A guide to the CIMAH Regulations 1984 HS(R)21. HMSO.
APPENDIX 1
Criteria
Heat
Blast
Toxic
300 kJ/m2 (e.g. 30 kW/m2 for 10s): severe burns

200 kJ/m2: burns
2 psi (14 kN/m2): some severe injuries
1 psi (7 kN/m2): injuries; buildings repairable
e.g. chlorine: 100ppm/10min: severe effects
C1667 /(min)=104 (Dicken fatal level)
C275 t=32106 (HSE criterion)
Consultation distances
For example:
APPENDIX 2:
FLAMMABLES
(a)
Criterion: effects of thermal radiation
For a few seconds exposure, 300 kJ/m2 is dangerous (e.g. 20 kW/

m2 for 15s)
(b)
Application: Basic assessment (LPG)
(c)
Other variables
Ignition may be immediate, delayed local, delayed remote, or none
Immediate ignition
Small leak
Medium leak
Vessel burst
Local fire: escalation hazard

Jet, torch: immediate and escalation
Fireball: immediate hazard (and domino effect)
(d)
Examples
(i)
Fireball effects (propane)
(ii)
Large cloud
Ranges to LFL (m):
(iii)
Vapour Cloud Explosion (VCE)
Violent, large release; short delay to ignition; partial confinement:
explosion
(vi)
VCE (Propane)
For hydrocarbons: M(TNT)=M(half contents)042
M(H/C)=2flash fractionvessels
(v)
Other explosions
Solids (ammonium nitrate, sodium chlorate, etc.): like TNT
M(TNT)=(Expl) Efficiency
e.g. Sodium chlorate: Efficiency=(l/4)Ammonium nitrate=(1/8)
TNT
Blast: related to scaled range, i.e. distance/(m) 1/3)
e.g. 50 te sodium chlorate gives 14kPa (severe damage) at 400 m
4000 te ammonium nitrate gives 80 kPa (devastation) at 300 m,
14 kPa at 850m
(e)
Mitigation?
Escape
Shelter
APPENDIX 3:
TOXICS
(a)
Criterion: Chlorine toxicity
Immediately fatal, 500 ppm
Very quickly fatal, 300 ppm
Fatal cnt=A (or probit)
(b)
Application: Basic assessment (chlorine)
(c)
Mitigation?
Shelter
Escape
Wind direction
(d)
Other substances
25
Decision Support Systems for
Emergency Management
V.ANDERSEN & J.RASMUSSEN
Ris National Laboratory, 4000 Roskilde, Denmark
1
INTRODUCTION
The current trend in the industrial development is towards large,
centralized production units, and consequently there is an
increasing potential for severe accidents. This in turn creates an
increasing demand on methods for systematic risk analysis and,
in the case of release of the accident potential, means for effective
emergency management. At the same time, there is a dramatic
development within electronic information technology and, quite
naturally, widespread efforts to exploit this technology in the
design of systems for support of systematic risk analysis, decision
support systems for operating crews during plant disturbances
and accident control, and for support of the general emergency
management organization.
2
REVIEW OF THE STATE OF THE ART OF
DECISION SUPPORT SYSTEMS
As a basis for discussing the use of information technology in
support of emergency management, we will briefly view the
general development of decision support systems.
2.1
Management information and decision support
systems
Development of managerial decision support systems has been
pursued separately in two schools, one based on a management
science perspective, focusing on the formulation of rational,
normative decision making strategies based on objective economic
analysis of the problem domain, another based on a social science

perspective and focusing on the social system and considering the
roles and needs of the people in the system. The two approaches,
considering what are generally labelled management information
systems and decision support systems, respectively, have been
considered alternative paths to a solution, an attitude which has
caused considerable controversy. However, due to increasing
understanding of the cognitive aspects of decision making, a more
integrated view of the system has recently been evolving. These
lines of development will be briefly reviewed.
Management science approach. A major class of proposals for
decision support systems has been based on decision making
research rooted in economic theories, in particular the expected
utility theory developed by economists and mathematicians. The
approach focuses on decision making from a prescriptive point of
view only. It is a logical structure for decisions and makes no claim
that it represents or describes the information processing of
human decision makers. The emphasis is not on what they do,
but on what they should do. A general criticism of this approach
has been that the formal models based on economic or decision
theories fail to appreciate the complexity of the challenges under
which real-world decision makers must operate. Critics of decision
theory also argue that it is not useful as a guide because human
beings do not behave in accordance with the fundamental
assumptions of the theory.
Social science approach. Whereas the management science
approach is focused on the problem characteristics, the
perspective of the social science is primarily concerned with the
characteristics of the decision makers and their social roles. This
means that there will be no formal basis for evaluating the
performance of such a system; the only basis for judgement will
be user-acceptance, and there will be no structured way to plan a
functional system design, which therefore will be based on bottomup integration of the requirements of the individual activities.
System science approach. Recently, a more integrated, top-down
approach to the design of management decision support systems
has been taken by system scientists. An illustrative example is the
discussion presented by Sutherland [1]. He compares the
approaches taken by the two schools based upon management
science and social science, respectively. His conclusion is that
both approaches are too schematic and drawn to unacceptable
extremes, and that a more balanced view should be taken. His
discussions relate to business decision making, but the
conclusions are well related in the present context. In doing so it
is necessary to take into consideration that decision making in the

different levels of organization cannot be covered by one theoretical
model, and will require different tools for effective support
Four levels of decision types are identified and correlated with
decision processes and support models:
(1) Goal programming and long range planning at the highest
level are related to the sequential state model for heuristic problem
solving procedures or structured decision making procedures.
Support in this function is essential for executives who are
responsible for development of the policy over the long run.
(2) Strategic analysis at the next lower level includes
contingency planning related to stochastic-state techniques to
provide for deductive techniques for problems the state outcomes
of which are variable, such as game-theoretic models or logical
analysis programs. This technique underlies most classic military
contingency planning.
(3) The tactical programming, one level further down, includes
equilibrium maintenance mainly based on statistics-based
decision and control instruments for dealing with probabilistic
problems, such as econometric methods, parametric decision
theory, etc.
(4) The lowest levels concerned with the operations
management, based on discrete-state instruments which are
primarily algorithmic and analytical methods that allow optimal
solutions of deterministic problems. This is the domain of
methods of industrial engineering and operations research.
The basic idea of this system theoretic approach is that any
properly conceived management support system should include
tools for all of these levels. This is so, whether or not it is
requested by the existing management authorities.
Sutherland emphasizes the need for a structured design
methodology:
1. The first step is to identify a population of decision
requirements that is derived by examining organizations in
aggregate in terms of universalistic (e.g. ideal-type or categorical)
as well as context specific properties.
2. The next step is an attempt to reduce a population of
functionally abstracted decision requirements to their most
fundamental constituents, i.e. to decompose into elementary
operations or primitives.
3. Then the set of all primitives is reduced into a prime set, in
order to remove redundancies.
4. Given this prime set, attention shifts to the instrumental
capabilities they imply in terms of a collection of decision aids. All
integral decision aids or model base components are now

decomposed into their lowest order transformational components
the microfunctions which are the basic elements of any
structured model-base.
5. Now a prime set of system facilities is generated, to have a
mutually exclusive set which in aggregate should be able to
perform all the functions associated with the set of decision aids
from which they were derived.
6. Any of the higher-order decision requirements should thus be
able to be met by synthesizing in effective real-time the functions
pertinent to the integral decision aid.
The prerequisite for this concept will be that the analytical
procedures or techniques underlying a support system are
congruent with the nature of the problem at hand. Therefore the
tools for the different levels in an organization will be different.
This congruence is discussed with reference to a generic problem/
instrument domain. Four levels of problems are considered:
deterministic,
probabilistic,
equifinal,
and
indeterminate
problems. Also four instrument categories are used: discrete state
(operations research, industrial engineering, or AI algorithms),
finite state (statistical decision theory, correlation, regression),
stochastic state (contingency planning), and sequential state.
Optimal tools are then to be found in the diagonal of the
representation, while choice outside the diagonal will be either
ineffective (insufficient) or inefficient (too sophisticated) for the
purpose.
The rationale for this solution will be to ensure that
organizational decision problems get all the precision and
discipline they deserve, but no more.
2.2
Expert systems: artificial intelligence
approaches
While the approaches to decision support systems mentioned
above are predominantly problem driven, the solutions based on
artificial intelligence approaches are by nature tool driven.
Expert systems. In the present context the term expert system
is used in the classical sense to characterize a decision support
system based on heuristic rules derived from experts and intended
to support a well defined decision maker having a uniform set of
decision tasks within a bounded information context.
Recent reviews of the historical development of expert systems

[2] focus on expert systems for application in domains of very
uniform characteristics, such as:
Dendral: for analysing mass spectroscopic, nuclear magnetic
resonance, and other such data to infer molecular structures
Mycin: for medical diagnosis of infectious blood disease
Expert, Caduceus: for other domains of medical diagnosis
Prospector: for geologic survey support, etc.
The present expert systems are laboratory demonstration
systems, of which only few are in actual, serious use. In order to
be accepted by a user, advice from an expert system in a risky
decision context will require a more elaborate explanation
capability than is presently available (see, for instance,
Rasmussen and Goodstein [3]. Likewise, Hayes-Roth et al. [2] have
formulated that todays expert systems typically show up badly
when measuring along a number of dimensions:
They are unable to recognize or deal with problems for which
their own knowledge is inapplicable or insufficient.
They have no independent means of checking whether their
conclusions are reasonable.
Explanation of their reasoning process is frequently silent on
fundamental issues.
From this review, use of expert systems for support of the
decision making process on-line seems to be premature. However,
AI tools for organization of the distributed data base available to
emergency management may be feasible.
Other artificial intelligence approaches. More differentiated
approaches have been taken to the design of decision support
systems, when AI techniques have been considered tools in a
design effort based on analysis of the problem requirements.
A system oriented approach to design of a system for support of
distributed decision making, based on the tools made available by
artificial intelligence research, has been proposed by Thorndyke
[4]. This proposal will be reviewed in some detail because
distributed problem solving appears to be an important feature of
emergency management.
Thorndyke describes a system for model-based situation
assessment and planning based on expert system architecture.
Applications are described for military strategic planning, air
traffic control, as well as location and identification of hazardous
chemical spills. To model the organization of time stressed

situation analysis and planning, the cooperating experts
paradigm is used.
For the organization of these activities the Hearsay-II paradigm
is used [5]. A number of experts are organized around a common
data base, the world model: a sensor, a plan generator, an
evaluator, a communicator, and a controller.
The conclusion of this review is that the structure offered by the
Hearsay system concept for communication and coordination in a
distributed group of decision makers appears to match the needs
for data base support in emergency management, and should be
considered in more detail for future developments.
2.3
Decision support in emergency management
The present problem of information systems for emergency
management appears to be characteristic in the following
respects:
The problem domain is poorly denned. The system should
support decision making related to a large variety of
emergencies, caused by very different physical processes. The
resources to consider in emergency control may belong to
different technical service fields.
The decision maker(s) are difficult to identify in advance, being
dependent on the size and nature of the actual case.
Several organizations and technical services may be involved,
and decision making will have the nature of a cooperative effort
in a distributed system.
Support from the system may be relevant during dynamic
emergency situations, as well as for planning purposes.
The information needed for decisions may stem from a large
variety of sources, such as engineering textbooks, laws and
regulations, risk analysis, analysis of prior accidents,
procedures, and instructions.
Key problems for system development will therefore be to
consider:
Organization of large, inhomogeneous data bases, information
retrieval, requirements for analysis supplying data in order to
have proper data attributes and formats compatible with user
needs
Analysis of the organization of the cooperative decision making,

and the structure of the communication network involved
The nature, in general terms (covering typical situation
scenarios), of the control and decision task, and the related
information needs
At present it appears very plausible that a coordinated data base
and a consistent specification of the information needs of the
various decision makers, as well as of the requirement for the
information formats used by the information sources, will be an
important area of development for advanced information
technology.
3
A FRAMEWORK FOR ANALYSIS AND DESIGN OF
DECISION SUPPORT SYSTEMS
In consequence of the discussion in the previous section, the
approach to the design of a decision support system based on new
technology should be taken from a cognitive point of view, and
should include an analysis of the decision task and the
information processing requirements in terms referring to human
cognitive functions.
In general, when designing systems for support of decision
making, the problem is to design systems which are also effective
during situations which have not been foreseen during design,
and which are not familiar to the user.
For design it is necessary to structure the great variety of real
life work conditions into domains which correspond to design
decisions. By use of a multi-facet description system it is possible
to represent a great variety of conditions by a rather low number of
categories in each domain, related to general features. From this
point of view, the following dimensions of a conceptual framework
for description of a cognitive task have proved useful for the
analysis of cognitive tasks, and hence for design of decision
support systems.
The problem domain. The first domain of an analysis which will
serve to bridge the gap between the purely technical description of
the work content and the psychological analysis of user resources
should represent the functional properties of the system in a way
which makes it possible to identify the control requirements of the
system underlying the supervisory task. This is an analysis in
technical systems terms and will result in a systematic and
consistent representation of the problem space.
Since decision making in emergency management, as in many

other contexts, is a resource management problem, an
appropriate representation of the problem space should reflect the
varying span of attention in the part/whole dimension, and the
varying level of abstraction in the means/and dimension. Change
in representation along both dimensions is normally used by
decision makers in order to cope with the complexity of a decision
task [6, 7].
The decision sequence. The next domain of analysis to consider
is related to the decision process which has to be applied for
operation upon the problem space. It is generally accepted that
the decision process can be structured into a fairly small number
of typical decision processes representing the various phases of
problem analysis and diagnosis, evaluation and choice of goal
priority, planning of resources and, finally, execution and
monitoring.
Mental strategies and heuristics. An analysis in this problem
domain can serve to identify the information processing strategies
which are effective for the different phases of the decision
sequence in order to identify the required data, control structures,
and processing capacities. It is generally found that a given
cognitive task can be solved by several different strategies varying
widely in their requirements as to the kind of mental model and
the type or amount of observations required.
Cognitive control domain. While the information content should
be included in the messages from a decision support system from
an analysis of problem space and mental strategies, the form of
the displays should be selected from consideration of human
cognitive control mechanisms.
4
IMPLEMENTATION FOR EMERGENCY
MANAGEMENT SUPPORT
It follows from the preceding section that the most important
domain of analysis for emergency management will be the problem
domain and the decision task, including the role and cooperation
of several decision makers.
4.1
Problem domain
The first aspect to consider will be the problem domain, i.e. the
representation of the relationships controlling the state of affairs
in the emergency management context.
Emergency management can be considered a resource
management problem in a means-end hierarchy representing the
functional properties of the environment. In this hierarchy, these
properties are represented by concepts which belong to several
levels of abstraction.
The lowest level of abstraction represents only the physical form
of the system, its material configuration. The next higher level
represents the physical processes or functions of the various
components and systems in a language related to their specific
electrical, chemical, or mechanical properties. Above this, the
functional properties are represented in more general concepts
without reference to the physical process or equipment by which
the functions are implemented, and so forth.
At the lower levels, elements in the process description match
the component configuration of the physical implementation.
When moving from one level of abstraction to the next higher
level, the change in system properties represented is not merely
removal of details of information on the physical or material
properties. More fundamentally, information is added on higher
level principles governing the cofunction of the various functions
or elements at the lower level. In man-made systems these higher
level principles are naturally derived from the purpose of the
system, i.e. from the reasons for the configurations at the level
considered. Change of level of abstraction involves a shift in
concepts and structure for representation, as well as a change in
the information suitable to characterize the state of the function
or operation at the various levels of abstraction. Thus an observer
asks different questions to the environment depending on the
nature of the currently active internal representation.
In other words, models at low levels of abstraction are related to
a specific physical world which can serve several purposes or
violate different goals. Models at higher levels of abstraction are
closely related to a specific purpose which can be met by several
physical arrangements. Therefore shifts in the level of abstraction
can be used to change the direction of paths, suitable for transfer
FIG. 1. Domain of potential risk.
FIG. 2. Domain of emergency management resources.
of knowledge from previous cases and problems. For the

emergency management systems, the information related to the
decision space will be discussed for two separate categories, the
domain of the potential risk, and the domain of mitigation
resources.
4.2
Domain of potential risk
This part of the representation includes information identifying
the potential risk sources, their functional physical properties
making it possible to predict the accidental propagation of effects
of accident releasing mechanisms, and the possible higher level
consequences in relation to social norms and legal rules. This part
of the data base will supply the basis for the analytical part of the
representation, and the information will be available from risk
analysis, technical manuals, and analysis of the technical features
of prior cases. Examples of the information at the various levels
may be seen in Fig. 1.
4.3
Mitigation resource domain
This domain includes the information about functions, processes,
and equipment/personnel which is available to form the
counteracting and mitigating force. It represents the problem
space for the planning part of the representation. The information
included at the various levels can, for instance, be as shown in
Fig. 2.
4.4
Use of problem representation
This representation of the problem space will be a multi-level
representation in terms of available/required equipment-processfunction-purpose elements, and decision making in a specific
situation will be a resource management task aiming at a proper
relationship in the potential many-to-many mapping between the
levels. A property of the total emergency management system
considered at an individual level can be characterized in three
different ways: (1) what it is, i.e. its causal properties in
interactions at that particular level; (2) why it may be chosen, i.e.
its role at the next higher level; and (3) how it may be
implemented by resources at the next lower level. This means that
the data element in a data base should be characterized from at

least three different points of view. Decision making in a
particular situation will be an iterative consideration of the
resources at the various levels until a satisfactory relationship
through the levels has been identified, connecting the various,
possibly conflicting, goals and constraints with the available
physical resources. This will involve the task of keeping track of a
many-to-many mapping in a complex net, and the use of
information technology should be considered not only for advice
giving to the expert system, but also for support of the decision
process itself (for instance by alerting the user to consider other
relevant means-end mappings than the one behind an actual
information request).
The nature and the related sources of information to be included
in a data base should be specified for each of the cells in the
domain abstraction/decomposition matrix (Figs 3 and 4).
The form in which the information should be stored in the data
base depends entirely upon the users formulation of their
problems and needs (cf. Pejtersens work on information retrieval
in libraries [8]). This, in turn, depends on the identity of the
actual decision maker, and the boundaries of his information
needs in terms of location in the problem space chart (see Fig. 5),
as well as upon the hierarchical structure of the operating
organization.
The data base representing the problem domain in terms of risk
potential and emergency management resources will include
structural information about functional properties and causal
relationships which must be transformed into procedural
information in order to be operational in the actual accident
situation. This transformation can be based on heuristics derived
from prior experience or deductions based on state information
from the case actually present. If procedural transformations are
incorporated in the data base, it will have to be rather general
rules, unless
very specifie information can be supplied. If the
procedural information has to be generated on-site, it will either
have to be done by the decision maker himself, or information on
the actual state of affairs will have to be transmitted to the advisor
in possession of the necessary general background knowledge or
the intermediary working on the available data bases (see Fig. 6).
This advisor can be a human domain expert or an expert system
inference machine attached to the data base.
FIG. 3. Information sources; domain of potential risk.
Fig. 4. Information sources; domain of emergency management resources.
FIG. 5. Information users; domain of emergency management resources.
FIG. 6. Problem domain in emergency management.
The conclusion of this preliminary analysis is that the meansend hierarchy is well suited to structure the information content
of the data base which is underlying emergency management
decisions, during preplanning as well as during the actual
situations. Thus structured, it will be possible in a consistent way
to identify the proper search terms to use for retrieval design, and
to specify the format in which information should be supplied by
the numerous data sources, such as risk analysis, incident

analysis, plant design, operations planning, and inspections.
5
EMERGENCY MANAGEMENT IN NUCLEAR AND
NON-NUCLEAR INDUSTRIES
The problems involved in industrial emergency management
appear to fall into two rather distinct groups. One group includes
the rather frequent, smaller scale accidents related to fires, toxic
spills, etc. The emergency management organization is established
ad hoc, and must be able to cope with a wide variety of accidents.
The other group includes emergency management related to
accidents in hazardous industrial installations for which
emergency organizations have been carefully planned and for
which risk analysis typically has been made. Nuclear power
installations are typical for this category. Figure 7 shows a
schematic representation of different types of emergency
situations, where the focus of optimal support for a given situation
is found in the diagonal of the representation. Outside the
diagonal the task will be either insufficient or ineffective. Most
non-nuclear emergency situations will be located in the upper left
of the diagram, while most nuclear power-plant emergency
situations will be located in the lower right of the diagram. A
decision support system for the latter is being developed as a joint
Nordic programme NKA/INF, where a top-down approach has
been taken by analysing the requirements needed to satisfy the
specified goals for an emergency management system. A short
description of the content and status of this programme will now
be given.
5.1
NKA/INF project content
The basis for the study of the potential use of advanced
information technology for accident and emergency management
was established in a pilot project undertaken in 1985. The
subjects addressed in this project led to a preliminary description
of accident and emergency scenarios [9], a state-of-the-art review
of models and methods available for construction of a conceptual
system [10], and a review of available tools from artificial
intelligence, e.g. expert systems [11].
The programme, at present, has two lines of development. One
is to analyse the present emergency management organizations
FIG. 7. Different types of emergency situation.
and procedures, to evaluate the problems perceived and the

possibility of remedy by means of modern information technology.
Another, concurrent line of approach has been to establish models
of the distributed decision making involved in operations like
emergency management, in order to evaluate whether advanced
information technology will influence the effective way of
organizing. The approach taken to such a model may be to
consider decision making a control task involving a number of
decision makers each controlling only part of a loosely coupled
problem space. For concerted activity communication between the
decision makers is necessary.
The programme consists of five main activities:
(1) The study and detailed analysis of accident and emergency
scenarios based on records from incidents and drills in
nuclear installations
(2) Development of a conceptual understanding of accident and
emergency management with emphasis on distributed
decision making, information flow, and control structures
that are involved
(3) Development of a general experimental methodology for
evaluating the effects of different kinds of decision aids and
forms of organization for emergency management systems
with distributed decision making
(4) Development and test of a prototype system for a limited part

of an accident and emergency organization to demonstrate
the potential use of computer and communication systems,
data base and knowledge base technology, and applications
of expert systems and methods from artificial intelligence
(5) Production of guidelines for the introduction of advanced
information technology in the organizations based on
evaluation and validation of the prototype system.
In an early stage of the project a limited target area must be
defined. Based on the scenario descriptions, a vertical slice is
identified dependent primarily on two criteria: it must be able to
display the major features of the conceptual system, and it must
be limited to the extent where the prototype development is
possible using the available resources.
In the later phases of the project the scenario descriptions will
gradually change to data and knowledge acquisition, and the
conceptual work will be followed by development of a general
experimental methodology and by experimental work using the
prototype as test bed. The prototype system will experience a
dynamic development throughout the major part of the project.
The keyword for the project is system studies with emphasis on
system integration. This will be reflected in the recommendations
and guidelines developed in the final phase of the project.
5.2
Status of the NKA/INF programme
The programme has developed conceptually, in data acquisition
and specification of data and knowledge base, and in prototype
implementation, but in the present context only the status of the
conceptual work will be described.
Conceptual work. The general point of departure for the
conceptual work has been to design a framework for analysing
different kinds of emergencies.
In the first stage, we have been concerned with the problems of
hierarchical organizations in emergency management. Such
organizations were found to present problems under certain
conditions because [12]:
all kinds of emergencies cannot be foreseen, and this may
create a need for a more flexible structure with the capacity to
reconfigure itself;
information delays would make it hard to exercise control by

means of a hierarchical system that would be too slow;
some aspects of emergency management cannot be modelled
hierarchically but require a different control structure; and
hierarchical command and control systems are not needed for all
kinds of emergencies.
In the second stage, we have tried to create a general framework
for analysing emergency management based on the view of
emergency management as a control system, which [13]:
provides a clear specification of the goals of an emergency
management system;
provides a specification of what the components of such a
system should be;
specifies the information needs; and
specifies what can, and what cannot, be controlled in
emergency management.
Further work is now directed towards solving two problems:
1. To develop a conceptual framework for those aspects of
emergency management that cannot be controlled hierarchically.
The problems here are those of coordination in a system
characterized by distributed decision making.
2. Using the time-area diagrams developed as part of the
analysis of emergency management as a control system to analyse
a variety of emergencies. This is done in an attempt to test the
general usefulness of these diagrams as an analytical tool for
analysing information needs in emergency management.
In addition, some first thoughts on how the decision support
system should be evaluated have been looked into. Here a
distinction between two forms of evaluation has been discussed:
analytical evaluation and empirical evaluation. It is recommended
that an analytical evaluation be performed first. This comprises
two steps:
Mapping the decision support system onto a set of general
decision tasks
Assessing the extent to which these tasks are supported by
analysing (a) the nature of the situation, (b) the kind of displays
that are provided, and (c) the knowledge required for
understanding these displays
It is also recommended that the empirical evaluation be directed

towards limited and well defined functions of the decision support
system. DESSY-D, a general interactive program for simulating
dynamic systems, is being developed for this purpose in Uppsala.
The methodological problems in using this system for the
evaluation of a decision support system are now being analysed.
6
CONCLUSIONS AND RECOMMENDATIONS
The conclusion of the present feasibility study will be that the
recent development of advanced information technology, together
with the trend towards more cognitively oriented approaches to
studies of decision making, offer promising lines of development of
improved tools for emergency management. Such improvements
will be necessary in order to cope with the increasing potential for
unacceptable consequences of accidents which is the result of
industrial centralization together with the widespread use of
hazardous substances. In addition, a reconsideration of the
information basis of emergency management will be relevant now
because much information of great importance for emergency
management will be generated or collected from activities such as
systematic risk analysis, safety inspections, quality assurance
programmes, etc.
REFERENCES
1.
2.
3.
4.
5.
6.
SUTHERLAND, J.W. (1983). Normative predicates of next generation

management support systems. IEEE Trans. Syst. Man. Cybern., 13
(3), 27997.
HAYES-ROTH, F., WATERMAN, D. & LENAT, D. (1983). Building
Expert Systems, Addison-Wesley, Reading, MA.
Rasmussen, J. & GOODSTEIN, L.P. (1985). Decision support in
supervisory control. 2ndIFAC/IFIP/IFORS/IEA Conf, on Analysis,
Design, and Evaluation of M an-Machine Systems, Varese, Italy, 10
12 September.
THORNDYKE, P.W. (1982). A Rule-based Approach to Cognitive
Modelling of Real-Time Decision Making, ORNL/TM-8614.
Erman, L.F., HAYES-ROTH, V., LESSER, V. & REDDY, D. (1980).
The Hearsay-II speech understanding system: integrating knowledge
to reduce uncertainty. Computing Surveys, June, 21352.
RASMUSSEN, J. (1985). The role of hierarchical knowledge
representation in decision making and system management. IEEE
Trans. Syst. Man. Cybern., 15(2), 23443.
7.
8.
9.
10.
11.
12.
13.
RASMUSSEN, J. (1985). A Framework for Cognitive Task Analysis,

Ris-M-2519. Also in: Hollnagel, E., Mancini, G. & Woods, D. (Eds),
Intelligent Decision Support Systems in Process Environment, Springer
Verlag, Berlin, in press.
PEJTERSEN, A.M. (1980). Design of a classification scheme for
fiction
based
on
an
analysis
of
actual
user-libarian
communications, and use of the scheme for control of librarians
search strategies. In Theory and Application of Information Research,
O.Harboe & L.Kajberg (Eds), Mansell, London, pp. 14659.
JOHANSSON, R., ANDERSSON, H. & HOLMSTROM, C. (1986). A
Descriptive Analysis of the Management of Nuclear Power Plant
Emergencies, Studsvik Technical Note NI-86/7.
RASMUSSEN, J. (1986). A Cognitive Engineering Approach to the
Modelling of Decision Making and Its Organization, Ris-M-2589.
BERG, . & YOKOBAYASHI, M. (1985). Review of Expert System
Techniques Relevance to Computerised Support Systems in
Emergency Management, Institutt for Energiteknikk, INF-630(85)1.
BREHMER, B. (1986). Organization for decision making in complex
systems. Unpublished note.
BREHMER, B. (1987). Emergency management as a control system.
Unpublished note.
SESSION V
Lessons Learnt from Emergency
Management of Major Incidents
Chairmen: M.VASSILOPOULOS
Ministry of the Environment, Greece
U.POLI
Istituto Superiore per la Prevenzione e la Sicurezza del lavoro, Italy
Rapporteur: E.L.QUARANTELLI
Disaster Research Center. USA
26
Experience Gained from Recent Major
Accidents in the Federal Republic of
Germany
STEPHAN NEUHOFF
Berufsfeuerwehr Kln/Cologne Fire Brigade, Cologne,
FRG
1
FIRE IN THE CHEMICAL FACTORY KALK IN
COLOGNE
On 8 September 1982 at 11.02 a.m. the factory fire brigade of the
Chemical Factory Kalk (CFK) notified the professional fire brigade
in Cologne by radio of a fire in the factory.
The CFK is a chemical factory which produces and stores
nitrogencontaining fertilizers. Several smaller plants also produce
organic and inorganic bromine compounds. The factory is located
in the central city area in the direct vicinity of residential areas.
The bromine plant No. II is a steel-framed skeleton structure
with thin asbestos-cement walls. It covers an area of 450 m2 and
is 15 m high. It contains apparatus for producing brominecontaining flame-protecting substances for plastics. Methanol and
other alcohols are used as cleaning fluids.
During the refilling of a 2000 litre plastic container, about 150
litres of methanol leaked from a faulty pipeline. The methanol,
which is electrically conductive, caused the generation of sparks
on an electricity cable which led to an ignition process.
The fire rapidly spread through the entire production plant and
threatened a neighbouring storage area with barrels of solvents
and other chemicals as well as an additional production plant.
The professional fire brigade and the CFK factory fire brigade,
comprising a total of 109 firemen, used 6 water cannon and 5
lines to restrict the fire to the bromine plant and to extinguish it
after 2 hours.
Dense smoke moved over the neighbouring residential areas.
The area was closed off by the police. Radio broadcasts were used
to request that civilians remain inside and close all windows and
doors. As bromine in the smoke was suspected, an evacuation

seemed to be necessary.
A meeting of the Disaster Prevention Management, directed by
the town clerk, was held in order to prepare first measures.
Measurements then indicated however, that no halogens were
present in the smoke.
The bromine plant was completely destroyed. The damage was
estimated at approximately 20 million DM. The plant was not
rebuilt.
The following conclusions were arrived at:
1. The plant had been approved 6 months before the incident.
The plastic container, however, was not approved.
2. Cooperation between the professional fire brigade and the
CFK was excellent. A definite advantage was the fact that a
joint exercise had been held in the factory area 5 months
before the incident, in which a similar scenario had been
assumed.
3. The police as well as the fire brigade had set up separate onsite Technical Operation Management Groups. As liaison
officers were not exchanged immediately, an optimum
coordination of the protection measures was not possible. In
future a joint command centre should be established.
4. Measurements and analyses were made by the fire brigade,
the industrial inspection board and by the factory. There was
no centralized control and evaluation of the measurements.
2
LEAKAGE FROM AN LPG TANK IN
WILHELMSHAVEN
On 23 January 1985 a gas tank in the Mobil Oil AG refinery in
Wilhelmshaven was being filled with pressurized liquified butane.
During the filling procedure it was noticed that liquified gas was
being emitted at the top of a support brace and a visible cloud
drifted past several other storage tanks towards a nearby river.
The spherical tank had been constructed in 1975. Its diameter
was 19m and its volume was 3500 m3. The authorized operating
pressure was 66 bar. The wall of the container was 18 mm thick
in the support brace area.
The construction of the tank was officially supervised. It was
then subjected to construction and pressure tests as well as a final
acceptance test. External inspections were made every 2 years. The
LESSONS LEARNT FROM EMERGENCY MANAGEMENT OF MAJOR INCIDENTS 237
inside of the tank was inspected every 3 months by refinery

personnel. No faults were detected.
The refinery area was closed off immediately. Shipping
movements on the river were also stopped. The liquified gas was
pumped into a nearby tank. Fortunately ignition of the gas did not
occur.
The incident was caused by a crack in the tank. During the
construction of the tank, the tops of the hollow support braces
were at first covered by welding on a cover sheet, in order to
prevent rainwater from entering the support brace. This cover
sheet was also welded directly onto the spherical tank. This
however, led to strong tensions so that the welded joint was
separated again. Instead of being welded, the cover was bolted on
with clamps, and a rubber gasket was inserted between the cover
sheet and the support braces.
This gasket obviously did not seal properly and rainwater
entered the support braces. Due to a separating sheet inside the
support braces, 1 m3 of water was sufficient to fill the tops of the
support braces. This water then froze during a frost period. The
pressure of the ice pushed in the tank wall at the tops of the
support braces. At one of the tops an 860 mm long and up to 15
mm wide crack was formed.
The crack was not noticed earlier due to the intense cold in
January. The pressure in the tank was only slightly higher than
atmospheric pressure. Gas was only emitted when the tank was
filled with liquified gas.
The incident could have been avoided by drilling holes in the
separating sheets and in the lower ends of the support braces, in
order to let trapped rainwater flow out.
3
EXPLOSION IN THE RHEINISCHE OLEFINWERKE
IN COLOGNE
On 18 January 1985 at 15.47 hours (3.47p.m.) the control centre
of the professional fire brigade was notified that an explosion had
occurred in the southern area of the city. At first it was assumed
that a tanker had exploded and caught fire in the harbour.
The control centre sent several fire-fighting vehicles to the
harbour. Telephone calls to a refinery and investigations from a
helicopter led to the conclusion that a fire was burning at the
Rheinische Olefinwerde (ROW). At 16.07 hours (4.07 p.m.), 26
minutes after the explosion, the ROW finally called to report the
explosion.
The ROW is a large chemical factory, which uses the products of

a nearby refinery to produce ethylene and plastics such as
polyethylene and polypropylene.
The accident occurred in the distillation section of an ethylene
plant; 4t of propylene leaked from a cracked pipe. The gas
emission was registered by the gas warning system, but the
immediate emergency shut-down of the entire plant could not
prevent the ignition of the gas cloud by a heater. The pressure
wave caused extensive damage and several fires started in the
plant. In the area surrounding the factory, windows were
destroyed up to 9km away, 43 employees were injured by
splinters, but in a nearby residential area only one person was
slightly injured.
The ROW factory fire brigade and the professional fire brigade,
with a total of 104 firemen, used 24 water cannon and up to
60000 litres of water per minute to cool the plant. The fire could
not be extinguished completely. Remaining gas was allowed to
burn itself out. The fire brigade operation was only completed 9
days later. The plant has since been rebuilt. The damage
amounted to 100 million DM.
The gas had escaped through a crack in a 100mm diameter
pipe. During the investigations an identical pipe was filled with
water and cooled. The ice which formed did not lead to any cracks
in the pipe. Only after a second test with the same pipe did it
crack due to being over-stressed in the first test.
Before the accident it had been generally accepted that the
propylene did not contain any water. The investigations, however,
revealed a water content of 1 ppm. At a production rate of 130
000t per year, 70 litres of water accumulated in the pipe. Two
periods of severe frost during the winter of 1984/1985 then
caused the damage.
The following conclusions were drawn:
1. The ROW took much too long to report the accident. After
this incident the city of Cologne reached an agreement with 7
chemical factories, with the aim of much quicker reporting of
fires and accidents.
2. The extensive water supply network with 257 installed water
cannon permitted rapid cooling of the plant.
3. A world-wide investigation of comparable plants was
undertaken to check for possible water accumulation in lowlying pipeline sections.
4. The suspended ceiling in the plant control station collapsed.
However, it was still possible to shut down the plant. Special
explosion protection measures were included in the new

control station.
5. A safety analysis was undertaken during the reconstruction
of the plant. The factory concluded that the worst possible
damage was the failure of a support brace which would
result in a 2 m long flame.
4
LEAKAGE FROM A LIQUIFIED GAS TANKER IN
DIELHEIM
The village of Balzfeld with a population of approximately 1000 is
part of the municipality of Dielheim. On 23 December 1986, at 13.
52 hours (1.52 p.m.) a slight east wind was blowing, it was
snowing, and the temperature was approximately 0C.
At the edge of the village, but still surrounded by houses, the
driver of a liquified gas tanker truck was filling a fixed liquified gas
tank. The vehicle contained 481 of propane. When the truckmounted pump was switched on, the drive shaft to the secondary
drive came loose and damaged the connecting pipe between the
tank and the pump. The propane which was pressurized at 95
bar immediately started escaping through the leak. The gas cloud
spread out and was visible as a 1 m thick fog which covered an
area of 500m2. The truck driver, with great presence of mind,
immediately switched off the engine and called the fire brigade.
The operations chief of the fire brigade immediately evacuated
the nearby houses and had the central heating systems switched
off. Dut to the dense fog and ice formation, it was at first difficult
to determine the exact position of the leak, and it could not be
sealed. An attempt to seal the leak by spraying water on it failed
due to the high pressure.
The danger of igniting the gas stopped any attempt to tow the
truck out of the village. Finally a water curtain from 4 lines was
used to push the gas cloud into a low-lying field. The sewage
system was flushed with large amounts of water.
In the meantime the entire electricity supply to the village had
been cut off by the electric supply company. This also resulted in
a shut-down of the water supply system, so that water had to be
transported by fire brigade tank trucks.
After 1 hour the gas concentration in the centre of the village
dropped to values below the detection limit. In the field into which
the gas had been moved, the lower explosion limit could only be
measured at a distance of 60m from the tank truck.
As soon as the over-pressure in the tank truck had

disappeared, the tank was flushed with nitrogen until gas could
no longer be detected at the leak. Measurements were then made
in all nearby houses. The highest value reached only 10% of the
lower explosion limit. Flushing the air in the houses was therefore
felt to be unnecessary and the inhabitants could return to their
homes.
A total of 48 t of propane, approximately 2400 m3, had escaped
without being ignited. A different pipe location, a stronger pipe, or
some type of protection for the pipe between the tank and the
pump could have prevented the incident.
5
LIQUIFIED GAS EXPLOSION IN A HOTEL IN
GARMISCH-PARTENKIRCHEN
The Hotel Riessersee with 350 beds had been opened in May
1985. For environmental protection reasons it was heated with
liquified gas which was stored in a covered underground pressure
tank. The tank contained 641 m3 and was constructed for a
permitted filling of 85% at an operating pressure of 156 bar. The
lower part of the tank could be heated by a warm water pipe
system. Two over-pressure safety valves were installed on the
tank.
Three pipes, the gas pipe and the inlet and outlet pipe for the
warm water heating system, connected the gas tank with the
heating apparatus in the heater room in the cellar of the hotel.
The tank heating system was constructed as a closed secondary
system. The tank heater was regulated by a pressure controller
which switched off the pump for the warm water cycle as soon as
the tank reached an over-pressure value of 4 bar.
At 15.45 hours (3.45 p.m.) on 27 December 1986 the safety
valve on the gas tank, which was 54% full, opened and large
amounts of liquified gas escaped. A strong smell of gas was
reported to the hotel reception and the hotel personnel tried to
evacuate the hotel. At 16.00 hours (4.00 p.m.) ignition occurred.
The police and the fire brigade had not yet arrived at this time.
Gas had invaded both underground floors through windows and
ventilation openings. Most of the damage occurred in the fitness
centre (sauna, squash courts, swimming pool), in the heating room
and in the underground garage. The pressure shock wave caused
extensive damage to the exterior of the three-storey hotel and to
nearby buildings.
Seven people were killed instantly in the fitness centre, and 4

died during the following days. Eight people were injured. The
explosion had ignited the gas escaping from the safety valve. The
public prosecutor prohibited any alterations to the system. The
dome shaft was therefore flooded in order to cool the fittings. The
gas was left to burn for 4 days. The remaining liquefied gas was
then pumped out by a tank truck.
The investigation of the heating system for the tank showed that
the pump for the warm water cycle could be controlled either
automatically or manually. When the system was operating
automatically the pressure controller on the tank was switched on
and controlled the pump. During manual operation, however, the
pressure controller was switched off. The warm water could
continue heating up the gas tank until the safety valve opened
and gas escaped.
After this accident a special investigation was undertaken in
Bavaria. Only 56 out of a total of 40 000 liquefied gas tanks were
heated with warm water. Six tanks had exactly the same
configuration as the one in Garmish-Partenkirchen. An additional
26 tanks were found to have either no pressure limiter or no
temperature limiter. A total of 23 heating systems were shut down
immediately.
There is no technical need for a heating system for liquefied gas
tanks, as increased amounts of gas can be removed through an
evaporator. A total ban of heating systems on liquefied gas tanks
is therefore being considered.
27
Community and Organizational
Preparations for and Responses to
Acute Chemical Emergencies and
Disasters in the United States:
Research Findings and Their Wider
Applicability
E.L.QUARANTELLI
Disaster Research Center; University of Delaware,
Newark, Delaware, USA
1
INTRODUCTION
There appears to be general agreement that the number of
accidents, disasters and catastrophes involving dangerous
chemicals has been increasing in the last decade or so. The Bhopal,
India, incident was a public manifestation of what many observers
have known has been a growing increase of problematical risky
events in the chemical area.
Considerable technical research has been undertaken on the
handling of hazardous chemical occasions. However, little
attention has been given to the behavioral features of the problem,
i.e. the human and group aspects. To begin to close this gap in
knowledge, the Disaster Research Centre (DRC) in 1977 began a 4year study of socio-behavioral preparations for and managing of
chemical disasters. This study was the first systematic and largescale effort of its kind undertaken by social scientists.
In 45 field studies, DRC examined organizational and
community preparedness planning for, as well as the
management of, response to sudden dangers resulting from
hazardous chemicals. In the first phase of the study, systematic
and comparative data on preparedness were obtained from 19
communities in the United States that had varying degrees of risk
due to dangerous chemicals. In the second phase of the research,
DRC studied 26 managements of responses to major emergencies
or disasters that resulted from toxic releases, explosions, spills,
fires, or other acute chemical threats.
The on-site data in both phases of the study, obtained primarily

through intensive interviewing of key personnel and collection of
documents, were subjected to a variety of quantitative and
qualitative analyses, the specifics of which have been reported in
publications elsewhere [17]. In this paper a general overview is
presented of these findings. We will first briefly summarize what we
learned about preparedness planning for chemical threats.
However, the bulk of the paper reports what DRC found in its
studies of response management, with special attention being
given to emergencies and disasters resulting from transportation
accidents. More specific information about the methodology and
theory, as well as different substantive foci of the study, is
contained in the publications previously cited. A general report on
the full study has been given [8].
Since that initial research, which was concluded in 1981, DRC
has done additional work on chemical disasters. Two explosions
were separately studied in field studies: (a) a chemical tank
explosion in 1982 in Taft, Louisiana [9], and (b) a major
catastrophe outside of the United States: the liquified petroleum
explosion in November 1984 in the Mexico City metropolitan area.
In addition, for other purposes, a series of official reports on
chemical incidents was recently systematically examined (e.g. the
report on an incident in Somerville, Massachusetts, where in 1980
a cloud resulted from a spill of phosphorus trichloride as a
consequence of a train accident; 418 people were injured and
there was a forced evacuation of a 15 square mile area which
contained 23 000 inhabitants). We also recently undertook a
comparative analysis of transportation accidents that involve
phosgene gas versus those that involve dangerous nuclear wastes
[10]. Currently, as part of a series of field studies on organizational
functioning in crisis occasions, DRC has also looked at seven
more chemical incidents, including the phosphorous spill from a
train derailment in Dayton, Ohio, in 1986 and another similar
spill in the Pittsburgh metropolitan area. There later field studies
and analyses have been used to test and to extend some of the
observations and conclusions that were drawn from the initial
large-scale research. Thus, while this paper is primarily a
summary presentation of the first systematic research, it does
take later work into account.
2
RESEARCH FINDINGS ABOUT DISASTER
PREPAREDNESS PLANNING
2.1
Threat perceptions
There is a degree of perception that chemical agents, compared
with other agents, have more potential as disaster agents.
However, different communities, sectors, and organizations
selectively vary in their perceptions of chemical threats [11]. In
particular, there are noticeable differences between threat
perceptions of public and private groups, with the latter seeing
chemically based disasters as less likely than the former. This
variability in perception may partially be the result of role
expectations as they apply to these different sectors of the
community. That is, many public sector groups (such as fire
departments) have official responsibility for emergency
preparedness and are expected by the community to carry out
these responsibilities. This type of role expectation can sensitize
these groups to the various demands of their domains. On the
other hand, fewer private sector groups (with the exception of
chemical companies) have formal responsibility for preparedness
planning and, therefore, are less likely to be aware of disaster
threats in general.
2.2
Availability and mobilization of resources
In principle, but not in fact, there are many potential resources
available to prepare for chemical emergencies and disasters. Many
tangible resources either are unknown, are unrecognized as such,
or are the property of private groups, and, even when available
tend to be segregated inefficiently from other kinds of community
disaster resources. More intangible resources are also
undependably and unevenly available, and a lack of leadership
and responsibility for their availability prevails, particularly in the
public sector.
There is little collective mobilization of resources except in a
minority of communities with local comprehensive mutual aid
systems (i.e. networks of relevant organizations from both the
public and private sectors that form for the express purpose of
sharing resources in disaster preparedness and response). Such
systems are particularly strong with respect to resource sharing
and communication, although they are usually weak in risk

assessment, in providing a role for the medical area, and in
addressing the problem of evacuation [12]. Extra-community
resources are seldom part of any individual or collective
preparedness planning for the mobilization of resources for
chemical disasters.
2.3
Patterns of community social organization
A variety of social linkages were found (i.e. formal or informal
contacts between and among organizations and groups) for
chemical preparedness planning in most of the communities we
studied. In particular, there tend to be links between local fire
departments and the chemical companies in their areas. The
general pattern, however, is one of weak vertical rather
than horizontal linkages within communities. That is, the
structure tends to be hierarchical in nature, with authority vested
in the uppermost levels and with few provisions for effective crosscommunication among the various disaster relevant groups. There
is also an almost total absence of local extra-community linkages,
even though the collective resources of the latter sources are
extensive in nature. More integrated linkages are slowly evolving,
but overall evidence shows a pattern of weak community social
organization for chemical emergencies and disasters.
2.4
Social climate
As a whole, the social climate in most local communities in the
United States is not favorable to preparedness planning. While
some of the existing norms, values, and beliefs provide incentives
for planning, most do not. There is a tendency to believe that
communities could respond to emergencies and disasters better
than they probably do. This reinforces a disinclination to disturb
local economic benefits from chemical plants or to argue against
what is seen as a public unwillingness to spend governmental
funds for almost anything, including disaster preparedness
planning.
2.5
The planning process and preparedness
Only a low degree of preparedness planning for chemical
emergencies and disasters exists in most communities in the
United States. In fact, such planning is frequently non-existent
among public emergency organizations, with the exception of
some fire departments. Preparations for chemical disasters are
especially handicapped by the public-private sector split in the
United States. An additional impediment to local planning efforts
is the fact that the most relevant resources rest in the hands of
extra-community groups (i.e. state and federal level organizations)
rather than with the local community organizations that
invariably are confronted with problems associated with the
immediate post-incident response.
Preparedness is often incorrectly equated with formal disaster
plans, an end product of the planning process, or viewed as an
extension of everyday operations. However, good preparedness is
actually a knowledge-based, realistic process stressing general
principles aimed at reducing the unknowns in a problematical
situation. As such, it comprises all the activities, practices,
documents, formal and informal agreements, and associated social
arrangements that, over the long or short term, are intended to
reduce the probability of disaster and/or the severity of the
community disruption occasioned by its occurrence.
Community disaster preparedness for chemical problems is
generally poor, if not nonexistent, in most localities. However, the
private sector is relatively well prepared, especially for in-plant
accidents. Extra-community groups that do have resources for
chemical crises are seldom incorporated into local planning.
Nonetheless, to the extent that preparedness planning of any kind
exists, it tends to make for a better response to chemical
emergencies and disasters.
We should observe that, while the above observations reflect our
field studies in the last decade, much is happening with respect to
chemical disaster preparedness planning in the United States in
the last few years. Partly triggered by the Bhopal catastrophe, both
the chemical industry and United States governmental agencies
have initiated a variety of programs aimed at improving local
community preparedness for chemical accidents and disasters.
The effectiveness of this planning and its contribution to the
better management of hazardous chemical incidents has not yet
been documented. Almost certainly this preparedness planning
will make the situation better than it was; however, we would
suspect that what we report from the past will generally be what
will be found in future studies. In the disaster area, as most other
areas in life, improvements tend to occur incrementally and
slowly, not massively and quickly.
3
RESEARCH FINDINGS ABOUT MANAGING
RESPONSES TO CHEMICAL DISASTERS
3.1
Fixed and in-transit sites.
There were some major differences in the patterns of response to
hazardous chemical incidents that occurred at fixed sites
compared with those that resulted from an accident that occurred
while a vehicle was in transit. Fixed-site situations generally are
those that occur in chemical plants or on their property. In-transit
incidents are the result of transportation accidents, such as those
that involve trucks, trains, barges, or aircraft carrying hazardous
chemicals, and that occur on publicly accessible lands. Which
organizations participate in the response to the crisis and what
they do, as well as the difficulties that emerge, differ somewhat in
the two types of situations.
Although there are many common elements between the two
types of crises in the United States, there are enough differences
in the responses to make them worthwhile noting. For example,
emergencies that occur at a fixed site, such as a plant, are likely
to involve only company-related groups, such as the plant fire
squad, rather than the fire department of the local community. In
contrast, in-transit accidents will, usually quickly, evoke
the appearance of community emergency agencies, such as the
local police and fire units. Fixed-site incidents, such as those that
occur at a plant, usually generate responses that are specific to the
particular chemical hazard involved. In-transit accidents, on the
other hand, often initially trigger general accident response
measures rather than specific chemical disaster responses. Also,
in-plant chemical emergencies tend to lead to actions to contain,
if not to prevent, the threat from developing. In contrast, many of
the initial activities in in-transit accidents are devoted to
measures to protect the community.
The differences in the managing of the two types of crises are
the result of a variety of factors. Chemical plant incidents in the
United States almost always occur on private property. In
contrast, in-transit accidents, even though they may involve a

private carrier, usually occur in what normally is viewed as a
public setting. This is related to the low social visibility of
incidents that occur at plants. Unless the accident is of major
magnitude, only the workers and officials immediately present in
the plant may know that there has been a chemical mishap.
Although incidents beyond a certain level of impact are supposed
to be reported to the public authorities, this does not always
occur. In contrast, most (although not all) in-transit accidents are
more socially visible; usually it is difficult to prevent the
community from finding out about the accident. In our study we
discovered some attempts to maintain secrecy about hazardous
incidents in railroad yards, but most efforts of this kind were
unsuccessful.
The major differences, however, between responses to fixed-site
accidents and responses to in-transit accidents probably are the
result of other factors. Chemical companies generally have good
emergency preparedness programs, and the extent of
preparedness is usually related to the size of the company. Larger
companies are more likely to have detailed and extensive
preparedness planning for chemical mishaps, especially if the
plant is part of a nationwide or international corporation. There is
a tendency to equate accident preparedness with disaster
preparedness; however, even if an incident is an accident that is
not a disaster, the mobilization of resources to alleviate the
accident will probably help alleviate the potential for a disaster
occurring.
Moreover, not only is there likely to be less preparedness
planning for intransit accidents, but there are more problems that
must be coped with in transportation related events. There are
often complicated jurisdictional questions and multi-level
organizational issues when trains, tank trucks, ships, or planes
carrying dangerous chemicals are involved in a transportation
accident. For example, any incident in the United States that may
lead to the pollution of any body of water could lead to the
activation of the national contingency plan for such events and
the active participation of the US Coast Guard, regardless of local
and state plans and the activities of community and state
agencies.
In summary, responses to chemically threatening incidents are
better when the accident occurs in a fixed facility than when the
accident occurs in transit. Often minor mishaps in chemical
plants are so well handled that they never develop a potential for
becoming a disaster. Also, when level of risk for an accident to
occur is considered for different modes of transportation, our

study found that motor vehicle incidents are generally handled
less efficiently and effectively than those occurring on railroads. In
part this results from the relatively little systematic chemical
disaster preparedness planning for accidents that occur on roads
or highways; railroads have undertaken far more elaborate
planning for chemical threats.
On the other hand, according to our study it appears that the
potential for the occurrence of catastrophic chemical disasters
compared with the potential for occurrence of non-catastrophic
incidents is greatest in fixed installations. The next most
vulnerable type of accident is that involving railroads. Motor
vehicle incidents are least likely to result in catastrophic
accidents. Our study did not obtain enough information to form a
conclusion about the potential for the occurrence of chemical
catastrophes as a result of barge-ship and airplane accidents.
There are many factors that can affect the magnitude of the
possible danger in an incident. In general, it appears that the
locations that have the greatest risk of occurrence of a chemical
catastrophe or major disaster are those where better preparedness
and response measures are likely to be found. That is, better
preparedness for accidents generally exists in plants that produce
the most dangerous and greatest volume of hazardous chemicals.
Thus, it is in such locations that the quickest and most efficient
initial responses to a chemical mishap are likely to occur in the
United States.
3.2
First responders
The importance of the initial response in a chemical emergency is
widely recognized. One major American chemical manufacturer
has produced a safety training film entitled Those Vital First
Minutes to emphasize the necessity of proper and quick actions
during the period immediately following a chemical mishap or an
accident that involves chemical substances. It is often the actions
taken in the first few minutes, just before a release or just
following a spill, that determine whether there will be a minor nonchemical mishap or the threat of, or actual occurrence of, a
chemical disaster.
In incidents that occur inside chemical plants there usually is
no lack of understanding that a hazardous chemical is involved.
However, a far more problematical situation usually exists in the
early stages of an in-transit mishap. We observed in the study
that in transportation accidents first responders seldom initially

perceive a dangerous chemical threat unless there are obvious
sensory cues, such as a strong pungent odor or eye and skin
irritations. This is true even when first responders are from
emergency organizations such as fire or police departments. Motor
vehicle or train accidents are initially seen only as transportation
accidents or wrecks. The general tendency of first responders is to
define the situation as it appears to be on the surface, namely a
transportation incident. In doing this, responders are acting in a
way that has long been observed in the disaster literature; that is,
there is a tendency to consider all cues in terms of normal or
expected events. If an occurrence appears to be a transportation
accident, it will be perceived and defined as a transportation
accident.
The problem with misperception of the initial situation is
compounded in that organizational and community disaster plans
rarely discuss the combination of a transportation accident and a
hazardous chemical incident. A DRC content analysis of plans
determined that separate consideration of the two types of events
was almost universal. One consequence is a tendency for
responding groups in transportation accidents to initially use their
routine accident standard operating procedures; they seldom
initially activate the disaster plans of their organizations, and even
more rarely do they activate the plans specifically for chemical
disasters.
In principle, first responders should be aware of the various
placards and symbols that are mandated by law in the United
States to be carried on tanks and other containers of hazardous
materials. Unfortunately, various studies have determined that
the legal requirements are not always followed. One systematic
study of trucks in Virginia found that 41 % of the trucks stopped
for inspection were violating placard requirements for hazardous
materials [13]. It is stated, in another unpublished report from a
railroad, that its own study showed that required placards were in
place on only 77% of the railcars. The view that placarding
requirements are often widely ignored is supported by the
observations of our study.
However, even when placards and symbols are in place and
readable after an accident, they are not automatically recognized.
Our study revealed that first responders do not always note the
signs that identify hazardous materials; even if aware of them,
they do not always fully understand their meaning. (This excludes
situations in which placards and symbols had either been
destroyed or were made illegible as a result of the transportation
accident.) Also, first responders seldom have easily accessible

manuals or booklets that would define the symbols or indicate
how they should respond to the incident according to the type of
dangerous chemical substance, identified by the placard, that is
involved.
Sometimes first responders to transportation incidents do
initiate searches for invoices or other relevant papers. However,
even if a search is initiated, it is sometimes difficult to find the
invoices or shipping bills for the material that is being transported.
Moreover, the relevant papers are not always carried on the
vehicle; one survey found that 23% of trucks carrying hazardous
materials failed to carry required shipping papers [13]. If the
papers are found, they are not always understandable to people
without an appropriate technical background. Personnel from law
enforcement agencies, usually the first responders to
transportation accidents, seldom have the knowledge to read
technical papers correctly.
Personnel from the transporting carrier are sometimes killed,
injured, or disappear from the accident scene, thus precluding
questioning by first responders. Of course, such personnel do not
always know exactly what type of goods the vehicle had been
carrying. There have been cases in which first responders have
been unintentionally misinformed by truck or train personnel
about the dangerous cargoes that were being carried. Also, it was
observed in the study that personnel from the carriers were
sometimes reluctant (if not actually uncooperative) to provide
relevant information to first responders.
Thus, for all these reasons, first responders are frequently
uncertain about the specific nature of the chemical threat even
after they suspect that the incident is more than a routine accident.
It was rare in the chemical emergencies that resulted from a
transportation accident for first responders to learn quickly what
they had to face. Also, in some instances, and frequently in
accidents that involved multiple dangerous chemicals, responders
learned about the hazards long after the incident was over.
Some of the DRC observations on these matters have also been
reported by others, especially operational personnel. In a US
National Transport-ation Safety Board hearing, witnesses from the
fire service area indicated that reliance on technical manuals,
placards, computer printouts, and waybills did not fulfill their
informational needs. They stated that all too often placards
located on hazardous materials tank cars were destroyed, the
knowledge of the train crew was limited as to the exact placement
of tank cars and the materials carried, and in immediate
emergency conditions there was not adequate time to search for

waybills and cross-reference materials with an emergency manual
to determine general emergency actions [14].
In accidents that occur in chemical plants in the United States,
in contrast to in-transit accidents, there seldom is a problem of
identifying the chemical threat, although in one case it took
company officials hours after an explosion to realize they had a
poisonous gas episode potentially present in the situation.
However, there are other kinds of problems that result from the
typical behavior of first responders to fixed-site accidents that
occur in plants. We observed more than once that company
personnel often failed to report promptly to outside authorities
fixed-site accidents that involved chemicals. This failure to
communicate existed even when the threat expanded or continued
to develop outside of the plant grounds. We noticed in our study
that community emergency officials often learned by chance about
the possible danger to their localities. Not infrequently, the outside
community agencies did not find out about a chemical threat
until there were obvious sensory cues, such as a toxic cloud.
Given such circumstances, it is understandable that the
responders from outside of plants often remain unclear for some
time about the specific nature of the chemical threat. They may
recognize that the community is possibly endangered and that
some chemicals may be involved, but they have no specific
knowledge beyond these impressions. A few situations were
observed in which an evacuation was initiated even though the
community did not officially know the nature of the danger from
which people were being evacuated. In the face of a very unclear
and uncertain threat there is likely to be a delay in doing anything;
this is the general principle stated in the disaster literature [15]:
faced with responding or not responding to an uncertain threat,
the latter course of action is most likely to be followed.
All efforts by first responders to identify the exact nature of the
chemical threat in transportation accidents are beset by a number
of difficulties. As previously noted, correct identification of the
chemical involved by the first or early responders sometimes does
not occur. Incorrect identification may be diffused to many others
through rumor among local officials outside of a plant or near the
site of a transportation accident. As students of rumor phenomena
have stated, the function of rumor behavior is to provide some
definition of a situation when none is otherwise readily or officially
available [16].
Because it is known that a danger exists does not necessarily
mean that the exact nature of the danger is understood.
Hazardous chemicals may have varied and multiple effects on

human beings and on the ecology of the environment. Thus, it was
observed in some chemical incidents that, even when the
identification of the chemical substance was correct, an
equivalent recognition of the specific dangerous nature of the
threat was not always known. To identify something as a threat
does not automatically mean that there is knowledge about the
specific nature of the threat or how to handle it.
Our study also found that first responders to transportation
accidents tend to overlook two important and dangerous
possibilities. In almost all cases there is an initial overlooking of
possible synergistic effects, e.g. the volatile reaction that will occur
if water is combined with calcium carbide. First responders tend
to be oriented to the existence of a single chemical agent rather
than a multiple chemical agent. In addition, responders to on-site
accidents generally do not recognize the different and various
kinds of multiple hazards that might be present because of a
variety of dangerous chemicals on the same train or truckload.
Thus, if a fire is perceived or if one chemical is identified as
capable of burning, this is focused on, but explosive,
asphyxiating, or corrosive threats that might result from other
chemicals involved in the transportation accident are overlooked.
The lack of widespread knowledge about correct stabilization
and neutralization procedures is especially significant at the local
community level. First responders to chemical incidents often
literally do not know what to do, even if they correctly identify the
dangerous chemical and know its effects. Thus, even when a
chemical threat is correctly identified, fire department personnel
(most likely the first responders to the danger) may not act
appropriately. Their traditional routine of quickly putting water on
a blaze tends to be done automatically; unfortunately; in some
instances this can be one of the worst things to do.
Trained personnel also may act inappropriately. In the DRC field
work, direct observations were made of trained company
emergency response teams who acted incorrectly and endangered
themselves and others. Trained teams normally do what should be
done; however, it is possible for mistakes in judgment to be made,
given the complex nature of dangerous chemicals and the various
contingencies involved.
In general, fire departments are not well prepared to respond to
most sudden chemical incidents, with the exception of some in
large communities and other special cases. They usually lack the
appropriate equipment, materials, and protective gear. Moreover,
perhaps surprisingly, they often do not know where to turn for
information. For example, DRC discovered more than one fire

department that had personnel who had never heard of
CHEMTREC, the nationwide chemical emergency reporting center.
Although the situation has been changing rapidly in recent years,
relatively few local personnel have had training in dealing with
hazardous chemicals. Many of these weaknesses in coping with
chemical incidents result from the primarily volunteer nature of
the staffs of the nearly 30 000 fire departments in the United
States. Yet it is these volunteer groups that are often among the
first responders and that usually are the lead organizations in
fighting hazardous chemical threats in transportation accidents.
A major observation of the DRC study was that the initial
responding activities of emergency organizations usually follow
standard operating procedures. This generally facilitates action
being taken by the organizations, but they are not necessarily
doing something relevant to the problem at hand. As the nature of
the chemical threat becomes clearer, there usually is a tendency
to try to adjust to the newly recognized situation. A vast majority
of first responders do not have experience from a similar situation
that they can rely on. Therefore, experience in responding to any
unusual emergency in the past is likely to influence the response
to the current situation. We observed in field work during our
study that some emergency organizations have relevant technical
manuals available; however, they are often inaccessible to the first
responders. Moreover, there is considerable variation in the use of
such manuals, and frequently, as mentioned earlier in this paper,
the manuals are not consulted at the height of the emergency.
There is an ad lib quality to the pattern of the first response,
especially in transportation accidents. Trying to clarify the
situation is often a prime activity. Defining what is happening and
what can and should be done is a large part of the early response,
but such definitions are not always correct. There is often a delay
in defining a transportation accident as one that has the potential
to be a chemical disaster. This is in part because there can be
many contingencies present in a potential disaster situation. A
discussion of the possible contingencies is presented in the next
section.
3.3
Impact and situational contingencies
Different types of contingencies can influence the way in which a
community will respond to a particular chemical threat, as well as
the degree to which they respond. These contingencies can be
divided into two categories: impact variables (or chemical agent

variables) and situational variables. However, even though the
managing of a chemical incident and its effectiveness will be
affected by differences in the chemical agents impact
characteristics as well as by variations in the social aspects of the
particular situation, we do not argue for the importance of
idiosyncratic factors. In fact, the opposite is stressed in this
paper; aspects which appear to be idiosyncratic when
observations are made of only one or a few cases turn out to be
more general features or happenings when enough incidents are
observed. To a considerable extent, what we shall be discussing as
the tactical problems posed by contingencies are what often
appear to an unsophisticated disaster planner or operational
emergency worker as idiosyncratic or unique in a specific
hazardous chemical threat incident.
3.3.1
Impact contingencies
Impact contingencies include those characteristics of the chemical
agent that can affect the organized response. Different chemical
agents generate different risks and threats. While risk assessment
essentially involves a perceptual component, there are dimensions
of risk that are inherent to the chemical agent. For example, some
chemicals are toxic, but most are not; a few chemicals can
explode, others cannot; certain chemicals only become dangerous
when they combine with other chemical substances, other
chemicals remain inert.
Thus, the specific characteristics of the chemical agent or
agents involved in a major accident will influence the risk and
threat to a particular environment. Given the variety of
characteristics that might be involved, myriad possibilities of risk
could be present. However, many of these variations can be
reduced to one of two types of possible consequences: the
damaging or destructive potential of the chemical or chemicals,
and the ability to control the chemical or chemicals. Both of these
characteristics will have implications for the manner in which
responders to an incident can and will attempt to neutralize the
threat. The situation is complicated, of course, in that responders
to the crisis may not correctly perceive either the damaging and
destructive potential or the controllability of the chemical threat.
Nevertheless, the potential consequences of the risk still remain,
even if they are incorrectly perceived.
The damaging destructive potential of any chemical agent is the

amount of damage and destruction it can do to people and to the
ecological environment. Certain agents have a greater potential for
damaging results than others. In general, the high-risk chemicals
are those that are extremely volatile or that exhibit an unstable
molecular structure. Chemicals that have a high-risk potential are
exemplified by the inherent dangers of compressed gases or the
hazards posed by gases such as butadiene and vinyl chloride,
which are both highly reactive and have a tendency to polymerize.
The typical first responder (whether police or fireman) to a
chemical accident, unless it occurs within the confines of a
chemical plant, usually has little idea of the destructive potential
of such substances.
Those managing a chemical threat can be faced with widely
differing dangers depending on which chemical or chemicals
happen to be involved. Thus, in one emergency the responders
might be faced with a relatively low-risk situation. In another
emergency the risk may be extremely high. One result is that
multiple exposures to chemical risks may not provide a good
learning experience that can be used in other emergency
situation. Unlike in many natural disasters, experience in one
chemical disaster does not necessarily transfer well to the next
incident. This great variation in possible damaging destructive
potential is an inherent agent contingency in a threatening
chemical situation.
There can, however, be more than a threat of impactthere can
be actual impact; again there is often substantial variation in the
damaging or destructive consequences. DRC studied some actual
chemical incidents in which populations that were dozens of miles
away from the actual disaster site were endangered. Yet other
chemical disasters were examined in which the actual destructive
impact was confined to the part of the truck or railroad tank car
involved in the accident.
Those managing a localized disaster are presented with
operational and response problems different from those faced by
the responders to a diffused disaster. Thus, there can be a
tremendous difference in threat or impact of a chemical accident,
depending partly on inherent qualities of different substances.
In both of the situations previously noted, responders may be
presented with different contingencies that are primarily
dependent on the inherent properties of the type of chemicals that
are involved in the accident. Chemical properties of an agent
include flash point, toxicity, vapor density, and synergistic
possibilities, all of which can be further affected by meteorological
conditions such as precipitation, wind velocity, and other similar

factors. This is in addition to the possibility that responders may
have incorrectly perceived the chemical danger or even not
perceived any threat at all. Perceptual differences aside, however,
different dangerous chemicals provide different threat of actual
impact contingencies to which those managing the disaster must
react
The magnitude of a disaster can also complicate the response
pattern. In a large-scale disaster, the magnitude of which partly
depends on inherent properties of the chemical or chemicals, a
number of representatives of agencies from different jurisdictional
levels will respond to the event. We usually have more
involvement of state and federal organizations. This often
complicates jurisdictional problems because there are often
discrepancies in responsibilities among different governmental
sectors. If a disaster is large enough to necessitate a response from
state, regional, or federal level of government, or some
combination of levels, these representatives will often attempt to
exercise authority and control in the situation, sometimes over the
opposition of local officials. Thus, the contingency of the damaging
destructive potential of any chemical agent may influence the
coordination of inter-organizational response.
In addition to potential or actual destructiveness, there is also
the factor of the uncontrollability of chemical agents. Here too
there may be considerable variation between the inherent
uncontrollability of a chemical agent and the responders
perception of this uncontrollability. Our study determined that
most community officials are likely to assume there is a high
degree of uncontrollability in most chemical agents. While the same
perception exists for most natural disaster agents, the belief is
sometimes expressed that this should not be the case for chemical
substances. In actuality, a chemicals controllability is only partly
dependent on the properties of the chemical agents. Controllability
also depends on the amount or volume of the chemicals, as well
as on the capability of the community to respond appropriately in
the critical period of time immediately following the onset of an
accident that has a potential to be a disaster. Usually, the greater
the volume, the greater the uncontrollability, everything else being
equal. Finally, controllability is partly dependent on the
communitys ability to perform certain initial response tasks.
While both destructiveness potential and uncontrollability of the
agent are inherent to the properties of the chemical, they are not,
insofar as response is concerned, independent of the perceptual
factors. The results of our study suggest that there is
misunderstanding with respect to both destructiveness potential

and uncontrollability. In general, community officials and the
public tend to overestimate the damaging and destructive potential
of dangerous chemicals. As in projections of risks at nuclear
plants, the threat presumed to exist due to a chemical emergency
often exceeds the inherent possibilities of most chemical
substances. Chemicals can present major risks and result in
major consequences, but they are seldom major threats acrossthe-board. Most chemicals are not inherently dangerous, but our
study showed that the reverse is often the common view; the
perception that chemicals are involved in an accident often leads
to a perception of danger.
Probably one reason for a general misunderstanding of the
potential effects of chemical agents is that, except within the
chemical industry, few people have any experience in viewing
chemicals and certain risks associated with technological
accidents. Although chemical agents are widespread throughout
American society, they are relatively random in their
manifestations of hazard. That is, the risks posed by dangerous
chemicals are not restricted to certain localities or regions of the
country. They are non-specific in this respect. In contrast, most
natural disaster agents such as earthquakes, hurricanes, or
tornadoes are specific to certain localities. Therefore, it is unlikely
that any given population group will have had much, if any, direct
experience with dangerous chemicals. Consequently, the image of
the risk presented by chemical agents is vague and tends to be
exaggerated.
Impact contingencies add to the possible variation and
complexity of the response in chemical incidents. In some actual
chemical disasters, the situation is further compounded for those
managing the event by the multiplicity and variety of hazardous
aspects that may be involved. In some acute chemical cases there
are often multiple elements of a disaster occurring either
concurrently or sequentially. For example, in the derailment of a
train carrying dangerous chemicals, the derailment is a problem
that must be solved, and there may be resultant fires and
explosions due to the derailment. In turn, these may create a
chemical spill or toxic cloud that might not otherwise have
occurred from the derailment alone.
3.3.2
Situational contingencies
Situational contingencies include those specific characteristics of
the particular social context in which a chemical mishap first
occurs. A chemical incident does not just happen; it happens in a
particular locality, in a place with distinctive features. A chemical
problem also occurs at a specific point in timemore accurately,
at some social time in the community life. Likewise, there are
particular circumstances associated with each chemical
emergency; for example, the overturned truck carrying a
dangerous chemical cargo may or may not have displayed the
required warning placards or signs.
In the following subsections, situational contingencies will be
discussed that can be classified as variations in location, time or
circumstances affecting the response to, or the managing of, a
chemical incident.
(a) Variations in location. The location at which a chemical threat
or disaster occurs significantly affects the response. A chemical
incident, for instance, can occur on private property, a mixed
public-private setting, or a public location. These possibilities have
implications for a variety of factors, ranging from the degree of
knowledge the public will have about the event to the possible
courses of action that responding organizations can take. For
example, we observed during our research that, when chemical
accidents occurred inside plants or chemical company property,
the larger community seldom found out quickly about such events
unless there were immediate casualties. In nearly every case there
was a delay between the time that the accident on private property
was turning into a potential disaster and when this happening
became public knowledge.
There were also situations in which local fire departments were
denied entry onto private property on which a chemical emergency
was occurring. Situations were studied in which, because the
chemical emergency was in a public setting, the response was
delayed and confused because no local agency believed it had
exclusive responsibility for, and jurisdiction over, the incident.
Such a lack of clarity over response initiative would not occur in a
private setting. Thus, the location (actually property
responsibility) and whether that property is a private, public, or
private-public responsibility (which is a contingency) have an effect
on the patterns of managing chemical emergencies.
Another locational contingency involves the geographic and
demographic setting of incidents. An obvious possibility that may
affect the pattern of response is whether the incident occurs in a

rural or urban setting. An accident that might have only minor
consequences in a rural area could have potentially catastrophic
consequences in an urban area with high population density and
heavy concentrations of buildings. The inherent destructiveness of
the chemical agent might not differ, but it could vary depending
on the geographic setting in which the destructive agent manifests
itself.
Each of these events creates different demands, and thus a
single situation may involve multiple disaster potentials that
generate different demands to which the affected community must
respond. Moreover, the incident may generate different emergencyrelated tasks that are incompatible with each other. For example,
the water needed to douse the fire might actually trigger a
dangerous chemical reaction that otherwise would not occur. This
example represents an extreme, but not uncommon, manifestation
of the complexities that can be generated for responding
organizations by impact contingencies.
Furthermore, we frequently noted in our research that
interjurisdictional and interagency problems may arise, depending
on the location in which the chemical incident occurs, because
many jurisdictional boundaries and domains are often vague.
Therefore, if an emergency occurs near the uncertain boundaries
of two or more separate jurisdictions, ambiguities can surface
about who has the major responsibility for managing the disaster.
In particular, chemical disasters that occur in port areas or that
involve bodies of water appear to generate jurisdictional problems
in the response, although the same difficulties also frequently
surface outside of city boundaries. Many rural or quasi-rural
areas in the United States are locales where organizational
responsibility, authority, and domain are unclear and often
overlapping. A chemical incident in such a location is certain to
elicit interagency confusion, if not competition or conflict. Thus,
the contingency of the location in which a chemical emergency
occurs can have a major impact on the managing of the response.
(b) Variations in time. The time when a chemical threat or
disaster occurs also has an important effect on the response.
However, it is not chronological time but social time that creates
an effect. These two types of time are not equivalent. In every
community, there is a rhythm to social life, with certain activities
ebbing and increasing in particular patterns and cycles. These
patterned activities vary (and not always directly) in relation to the
time of day, the day of the week, and the season. Thus, there are
community social phenomena such as the rush hour, major
sports events, and holiday weekends [17, 18]. Such social times
affect where people will be concentrated and what they will be
doing, as well as the state of readiness of emergency organizations
and how quickly resources can be mobilized.
We noted in our study that there was a significant variation in
response, depending on the time at which the incident occurred.
For example, evacuation is easier to carry out when it is light than
when it is dark. At the Mississauga (Ontario, Canada) chemical
incident, massive evacuation was partly delayed, according to
police reports, because of a reluctance to try to move a large
number of people at night [19].
Even organizations that operate on a shift basis, and most
emergency groups are on a 24-hour basis, do not have either the
same quantity or quality of personnel available at all times. Some
chemical incidents were studied in which the response developed
slowly because higher level emergency officials were not
immediately available because the incident occurred outside of
regular weekday working hours. In a few cases, certain material
resources could not be easily located and used because the
organizations owning them were closed and it was difficult to find
any personnel with relevant information on how the resources
could be obtained or the authority to do so.
Thus, similar to variations in the location of an accident,
variations in time can create different contingencies. With respect
to time, the rhythms of community life (or social time) can create
significantly different situations with which responders must
cope. The chemical risks might be identical in two chemical
emergencies, but because of the time at which the accidents occur
there could be somewhat different situations for the responders
and managers to face in the two cases.
(c) Variations in circumstances. In addition to contingencies due
to location and time, there are still other possible variations. There
may be other circumstances affecting the situation; two of these
factors will be illustrated here: the duration of the threat and the
speed of onset.
In our research, chemical incidents were observed in which the
response activities ranged from a few hours to nearly a week. As
indicated earlier in this paper, some events that eventually
become chemical emergencies may initially be no more than a
transportation accident or a plant mishap. Thus, a railroad
derailment may produce no chemical toxic release for several
hours, days, or perhaps not at all. However, responding
organizations must maintain site security and mobilize certain
resources for the duration of the episode.
The residual polluting effects of a dangerous chemical

neutralized can likewise extend the duration of an incident. In
other cases, the circumstances are such that the threat is over
quickly, and hours after the initial indication of an emergency
there is little sign that anything happened. This can create greatly
differing consequences, depending on the kind of community in
which it occurs. For example, we noted that smaller communities
were more adversely affected by a prolonged emergency. Among the
negative consequences noted in the study were lost wages for
volunteers in emergency organizations, substantial losses to the
local economy because of closed businesses, and rapid depletion of
certain kinds of resources. A chemical emergency of the same
duration would not have the same consequences in a metropolitan
area. Although an urban area might suffer more in absolute terms,
our observations were that smaller communities tended to incur
relatively higher losses for chemical incidents of the same
duration.
Speed of onset is another situational variable that may affect
response patterns. Depending on many factors, including
properties of the chemical agents as well as how the potentially
dangerous substances are initially treated, there may be little or
no advance warning of an impact. In such cases, preventive efforts
cannot be taken and the response management generally focuses
on recovery efforts. However, in many transportation accidents the
initial accident does not always produce an immediate chemical
emergency. In many such cases, the response can be directed
primarily at preventing a chemical emergency from developing. As
illustrated in the examples, circumstances can create different
types of situation, and in that way circumstances partially
structure the managing of the response which should occur.
It is easy to think of impact contingencies in individualistic or
idiosyncratic terms. However, we have indicated that there are
some general aspects even of contingencies, including impactrelated contingencies, in almost any chemical incident. This
realization should encourage general tactical planning that takes
contingencies into account.
Much of what happens after the arrival of the first responders
and their initial definition of the situation can generally be
visualized as convergence and outflow patterns. There is a
movement of organizations, things, and information outward from
the disaster site, and a similar flow toward it. Both the outflow
and the convergence patterns are marked by much uncertainty
and un-evenness of knowledge of the situation by selectively
involved organizations. What flows out is even more erratic than
what converges, and some behaviors tend to compound the

difficulties in the situation and almost ensure lack of
coordination. There are also special problems in chemical
emergencies with respect to exactly how to handle the often
overwhelming numbers of mass media representatives, how to
obtain accurate information relevant to the diagnosis and
treatment of victims (often the chemical agent is unknown or, if it
is known, medical personnel are uncertain on measures to take,
especially in relation to very unfamiliar chemicals, and no
centralized sources are available for quick references), and how to
identify appropriate procedures for neutralization of the chemical
threat.
3.4
A few implications
What are the implications of our study? From a general
perspective, our work suggests that locally based preparedness
planning using existing resources can lead to an improvement in
integrated community responses. From a more specific
perspective, preparedness planning ought to consider three
aspects. There is a major public-private sector split, with weak
linkages between the two sectors. The split hinders chemical
disaster preparedness and is not helpful in chemical disaster
management. Also, chemical disasters are more problematical
than disasters resulting from most other kinds of agents. A
chemical disaster can be occasioned by rather different things,
can physically have rather different outcomes, and frequently
requires rather different coping mechanisms. Put another way,
chemical disaster agents tend to be relatively more heterogeneous
than other kinds of disaster agents. This also makes for problems
in preparedness and response. Finally, a strong technological bias
exists in the planning activities and operational measures
undertaken with respect to hazardous chemicals. There is the
strong belief that technical solutions can be found both to prevent
and to soften chemical disasters. While in one sense this is
undoubtedly true, there are social as well as technical aspects of
preparing and responding to acute chemical emergencies and
disasters. Even if all the technical problems were solved, problems
would still be inherent in the group and human aspects of the
situation. These require the application of a sociological
perspective, which we have partly tried to illustrate in this paper.
3.5
Cross-societal applications
The great majority of social science studies of hazardous chemical
incidents has been done in the United States. There has been only
limited research in other highly industrialized and urbanized
societies in Western Europe and in Japan [2022]. Also, until
Bhopal there had been almost no study of acute chemical
disasters in developing countries. Additionally, outside of the
research in the United States and Canada there has been little
systematic research on hazardous chemical incidents resulting
from transportation accidents.
Thus, there is the question of the applicability of what we have
reported to all other types of societies. Our view is that the work
done so far, including all the recent studies of Bhopal, suggests
that, while there may be cross-societal differences along some
lines with respect to preparedness planning and response
managing of chemical incidents, there are more similarities than
differences [23, 24]. To the extent that societies vary from one to
another, there may be variations in social organizational
structures (e.g. the degree of centralization of the governmental
structure) as well as cultural values [25] which could affect both
preparedness and response. But these kinds of differences will
also manifest themselves in non-chemical types of disasters, e.g.
as found in a comparative national level study of natural disaster
response in the United States, Italy and Japan [26]. Even the often
drawn distinction between developed and developing societies
does not appear very useful for disaster research and policy
purposes [27].
Overall our position is that what has been learned so far about
planning for and managing of chemical disasters should be taken
as generally applicable unless future research shows the necessity
of taking some distinctions into account.
ACKNOWLEDGEMENTS
Part of this research was supported by National Science
Foundation (NSF) Grant PFR-7714445 but all views expressed are
those of the author and not necessarily those of NSF. Some of the
observations in the middle sections of this paper have been
reported previously [28].
REFERENCES
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
QUARANTELLI, E.L. & TIERNEY, K. (1979). Social climate and

preparations for sudden chemical disasters. In Sociological Research
Symposium IX (Ed. E.P. Lewis, L.D.Nelson, D.H.Sculley &
J.S.Williams), Department of Sociology, Virginia Commonwealth
University, Richmond, VA, pp. 45760.
TIERNEY, K. (1980). A Primer for Preparedness for Acute Chemical
Emergencies, Disaster Research Center, University of Delaware,
Newark, DE.
GRAY, J. (1981). Three Case Studies of Organized Responses to
Chemical Disasters, Disaster Research Center, University of
Delaware, Newark, DE.
GRAY, J. & QUARANTELLI, E.L. (Eds) (1981). Social aspects of
acute chemical emergencies. J.Hazardous Materials, 4 (Special
Issue), 30994.
TIERNEY, K. (1982). Developing a community preparedness
capability for sudden emergencies involving hazardous materials. In
Safety and Accident Prevention (Eds H. Fawcett & W. Woods), Wiley,
New York, NY.
GRAY, J. & QUARANTELLI, E.L. (1983). Sociobehavioral aspects of
chemical hazards: summary findings on preparations for and
responses to acute chemical emergencies at the local community
level. In Sociological Research Symposium XIII (Eds M. Larkin, J.
Honnold & J.S. Williams), Department of Sociology, Virginia
Commonwealth University, Richmond, VA, pp. 11518.
QUARANTELLI, E. L (1984). Chemical disaster preparedness at the
local community level. J.Hazardous Materials, 8, 23949.
QUARANTELLI, E.L. (1984). Sociobehavioral Responses to Chemical
Hazards: Preparations for and Responses to Acute Chemical
Emergencies at the Local Community Level, Disaster Research
Center, University of Delaware, Newark, DE.
QUARANTELLI, E.L., PHILLIPS, B. & HUTCHINSON, D. (1983).
Evacuation Behavior: Case Study of the Taft, Louisiana, Chemical
Tank Explosion Incident, Disaster Research Center, University of
QUARANTELLI, E.L. (1982). Transportation Accidents Involving
Hazardous Chemicals versus Those Involving Dangerous Nuclear
Material, Disaster Research Center, University of Delaware, Newark,
DE.
HELMS, J. (1981). Threat perceptions in acute chemical disasters.
J.Hazardous Materials, 4, 32130.
GABOR, T. (1981). Mutual aid systems in the United States for
chemical emergencies. J.Hazardous Materials, 4, 34356.
SCHMIDT, J. & PRICE, D. (1977). Virginia Highway Hazardous
Materials Flow, Virginia Polytechnic Institute and State University,
Blackburg, VA.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
Analysis of Proceedings of the National Transportation Safety Board

into Derailments and Hazardous Materials, National Transportation
Safety Board, Washington, DC, 1978.
QUARANTELLI, E.L. (1984). Perceptions and reactions to emergency
warnings of sudden hazards. Ekistics, 309, 51115.
SHIBUTANI, T. (1966). Improvised News: A Sociological Study of
Rumor, Bobbs Merrill, Indianapolis, IN.
LAUER, R. (1981). Temporal Man: The Meaning and Uses of Social
Time, Praeger, New York.
ZERUBAVEL, E. (1981). Hidden Rhythms: Schedules and Calendars
in Social Life, University of Chicago Press, Chicago, IL.
SCANLON, T.J. & PADGHAM, M. (1980). The Peel Regional Police
Force and the Mississippi Evacuation, Canadian Police College,
Ottawa, Canada.
WESTGATE, K. (1975). FlixboroughThe Human Response, Disaster
Research Unit, University of Bradford, Bradford, England.
LAGADEC, P. (1982). Major Technological Risk, Pergamon Press,
Oxford, England.
IKED A, K. (1982). Warning of disaster and evacuation behavior in a
Japanese chemical fire. J.Hazardous Materials, 7, 5162.
SHRIVASTAVA, P. (1985). Bibliography of Publications on Bhopal,
Industrial Crisis Institute, New York.
SHRIVASTAVA, P. (1987). Bhopal: Anatomy of a Crisis, Ballinger,
Cambridge, MA.
DOUGLAS, M. & WILDAVSKY, A. (1982). Risk and Culture,
University of California, Berkeley, CA.
McLucKiE, B. (1977). Italy, Japan and the United States. Effects of
Centralization on Disaster Responses 19641969, Historical and
Comparative Series No. 1, Disaster Research Center, University of
QUARANTELLI, E.L. (1986). Research findings on organizational
behavior in disasters and their applicability in developing countries.
Preliminary Paper No. 107, Disaster Research Center, University of
GRAY, J. & QUARANTELLI, E.L. 1986. First responders and their
initial behavior in hazardous chemical transportation accidents. In
Recent Advances in Hazardous Materials Transportation Research:
An International Exchange, Transportation Research Board, National
Research Council, Washington, DC, pp. 97104.
28
Experience Gained from the Pollution
Control Operation at Ls 1985
FLEMMING LIND ARPE
Danish Civil Defence and Emergency Planning Agency,
Copenhagen, Denmark
1
INTRODUCTION
With its situation between the North Sea and the Baltic Sea,
Denmark, her peninsula of Jutland and c. 400 bigger and smaller
islands, is a typical coastal nation. The total coastline is c.
7000km, of a highly varying nature (sandy and stony beaches,
marsh, salt meadows and a few rocks).
The Danish sounds and belts are among the most crowded in the
world. Apart from the traffic to and from Denmark, a large
number of tankers, freighters and bulk-carriers pass to and from
the Baltic states (FRG, GDR, Poland, USSR, Finland and Sweden).
The high sea traffic has been assigned a special international
passage called Route Tango.
Many special conditions add to the risk of pollution hazards in
Danish waters. Heavy sea traffic, the narrow sounds and belts,
difficult navigational conditions, frequently bad weather and a
considerable cross-traffic all present a constant risk of collision
and grounding.
The relatively short distance between the individual coasts
means that in a very short time (a few hours) a spill will wash
ashore, even with favourable winds and currents.
The National Agency of Environmental Protection (NAEP) is
responsible for directing and coordinating control operations in
cases of oil and chemical spills at sea. NAEP has its own pollution
combatting vessels and units stationed at the Copenhagen and
Korsr naval bases (the Sound and the Great Belt).
The national maritime preparedness also comprises the Civil
Defence Corps whose task it is to combat sea pollution in
nearshore areas and if possible stop it from washing ashore. The
forces of the CD Corps (professionals and conscripts) are stationed
at 6 regional barracks and equipped with oil booms, skimmers,

tools etc. These forces are trained in pollution control operations.
The local authorities are responsible for shoreline clean-up. In
cases of comprehensive and complicated shoreline pollution, local
government may apply for practical assistance (know-how and
strike teams) from the national authorities (NAEP and CD Corps).
2
THE OIL POLLUTION CONTROL OPERATION AT
LS IN AUGUST 1985
One of the biggest oil spills ever in Danish waters was caused by
the West German tanker Jan of Bremen. The result was a major,
complicated pollution of Ls, a small Danish island in northern
Kattegat.
2.1
The island of Ls
The island of Ls (112 km2) is a municipality with 2600
inhabitants and a very attractive recreational tourist area due to
the beautiful and varied nature (fine sandy beaches, dunes,
plantations, marsh and salt meadows). Ls also an important
nature reserve with sea birds and seals, thus very sensitive to any
pollution.
This small community, of course, does not have sufficient
resources to combat a large-scale, complicated oil pollution.
2.2
The situation
On 2 August 1985, at 02.40a.m. (local time), Jan of Bremen
rammed into the Hals Barre lighthouse near the eastern entrance
to the Limfjord, in the northern part of Kattegat (position: 5654
05N 103007E). The total cargo was 3000 tonnes of heavy fuel
oil. In the collision Jan received a 20 m long gash in the forepeak
tank and the cargo tanks Nos 1 and 2.
The first effect of the collision was the immediate spill of c. 200
tonnes of oil. (During the rescue operation later, another spill of
more than 100 tonnes occurred; however, this oil was recovered
on the spot by one of the combatting vessels.)
NAEP at once dispatched their vessels to the area and early in
the morning started air reconnaissance. In the afternoon a large
oil slick was observed drifting in north-easterly direction c. 65
nautical miles (NM) from the collision site. (Denmark has not yet
any remote sensing equipment.)
The weather in the area had deteriorated considerably. Owing to
high seas, the strong current (speed 08 knots, course 050) and a
large spread of the oil, the sea clean-up operation was very
difficult.
It soon became clear that the south-west coastline of Ls (c. 24
NM from the collision site) was threatened. The next day (3
August) oil was observed drifting only 12NM from the coast.
NAEP ordered a combatting strike team (20 men) dispatched
from the North Jutland CD column at Thisted. Their primary task
was to evaluate the situation and the extent of the pollution, and
try to prevent the oil from drifting ashore. The team arrived at
Ls on 4 August at 02.00 a.m. with their own vehicles, materials,
staff, and communications equipment and outfit for a longer stay
on the island under primitive conditions.
2.3
The combatting operation
In the course of the first 2 days it became clear that it was not
possible to prevent the oil from washing ashore. The use of oil
booms could not be considered because of extremely difficult
weather conditions (strong current and wind, high sea and tidal
water). The oil was washed over the booms (the current sucked
the skirt towards the sea bottom) and it was impossible to keep
them stationary in the high waves.
An oil belt 60100 m wide polluted 8 km of salt meadow. The
tidal water had also pressed the oil into the small inlets and
draining canals in the area where it had settled in a layer up to
30cm thick.
Since the oil was now actually on the coast it had become a
local task to organize the shoreline clean-up. The local
government asked for central government assistance, and the CD
Corps over the next 10 days carried out the practical work in
cooperation with the local authorities. A vast, difficult and dirty
job had begun.
The force Was increased to c. 100 men from the CD columns at
Thisted and Herning (Jutland). The practical work was organized
and controlled by the mobile staff and communications unit. All
decisions were made in daily meetings with the local authorities.
Owing to the special nature of the area (salt meadows) and its
considerable sensitivity to mechanical impact, the clean-up had to
be done manually. Only very light vehicles could be used for
transport of the large quantities of waste (oil and polluted

vegetation, sand, stones etc.). The waste was temporarily stored in
pits dug out in the area and lined with oilproof plastic.
Very simple equipment, such as shovels, forks, buckets and
special vegetation cutters was mostly used for the clean-up
operation. The men worked every day from early morning to
sunset. The dirty nature of the work made it necessary to equip the
men with protective clothing (waders and gloves).
Cleaning of materials, equipment and personnel had to be
improvised in the open. Special cleaning sites were established in
the area where the men daily underwent a systematic and efficient
cleaning procedure whereby they were completely cleaned of oil.
This proved essential for their working morale.
With c. 100 men working continuously for almost 2 weeks, it
was necessary to have a well functioning logistic service to keep
operations going efficiently (feeding, supply, materials, equipment
and workshop services). The means to maintain these services
were brought from the barracks in Jutland.
The operation was carried out with efficiency and capability by
the staff, the strike team and the logistic service. The CD Corps
won national and international praise for its efforts.
The oil spill had hit a large number of sea birds in the Les
area. About 1000 birds, mostly terns, became victims of the
pollution. The cleaning of Ls was so efficient that no damage
was done to nature (fauna and flora). Nor were any negative effects
on tourism registered.
The total costs involved in the oil spill from Jan of Bremen were
c. 11 million DKK (16 million US$). The CD Corps share of this
amount was c.45 million DKK (about 06 million US$).
3
LESSONS LEARNED FROM THE OPERATION
The CD Corps gained some general and specific experience on
Ls.
(a) We learned the importance of:
having an overall, coordinated preparedness plan to ensure:
speedy and certain judgement of the situation;
speedy communications with/alerting of all responsible
authorities;
a standing combatting force at a sufficiently high state of

preparedness;
a distinct delegation of tasks and responsibilities among
authorities;
ample and efficient resources;
current updating;
being able to muster a well trained, well functioning staff,
capable of turning theoretical knowledge and previous
experience (also at international level) to practical purpose,
and able to improvise;
having staff who can master planning, coordination and
control under difficult circumstances;
having well trained leaders and strike teams with great
stamina and good working morale;
having an independent and well functioning communications
system (internal and external communications on own radio
and telephone networks);
establishing close cooperation and coordination among all
local authorities involved to be able to:
profit from local and special knowledge;
discuss ideas, methods, proposals, resource needs,
working plans, operations, etc.;
ensure back-up from the local authorities;
establishing cooperation or contact with other interested
parties to be able to inform about the situation or to seek
professional assistance or back-up, such as environmental
organizations and hunts (to kill polluted birds), insurance
companies etc.;
using valuable international contacts who are able to offer
concrete advice due to their own research or practical
experience;
ensuring that the formally responsible local authority is not
deprived of its competence but is submitted all important
operational suggestions from the staff for the final decision
(of great psychological importance);
resources being earmarked for current information of the
press through briefings and excursions on the spot (the
press must always have real and updated information on the
situation);
resources also being earmarked for information of the many

national and international experts and observers who wish to
gain practical experience during the operation;
the press and observers being handled without disturbing
the combatting operation.
(b) We also learned:
that, due to the absence of remote sensing equipment, it was
not possible to verify, sufficiently early the captains
statement of the volume of the spill (just a few tonnes);
that the time factor is essential; the existing mechanical
recovery equipment is not sufficiently efficacious in rough
seas if thin oil slicks are spread over a large area;
that modern machinery, large beach cleaners and sludge
sucking equipment cannot be used in such a situation (the
sensitive salt meadows could not endure being exposed to
heavy mechanical traffic); use of military temporary roads to
ensure the absolutely necessary traffic had the result that
after 2 weeks operation in the area the salt meadows were
almost intact;
that use of sludge sucking equipment in the wet areas
(draining canals) had to be given up as it sucked up an
unacceptable amount of water, which added drastically to
transport costs (use of oil separators was impossible owing to
the weight of the vehicles);
that the nature of the area and of the pollution made beach
cleaners worthless for the purpose;
that the existing coastal oil booms and skimmers are of
limited use and are completely useless in high seas and with
strong currents along the coast;
to make daily plans for the work and carry them out
according to detailed schedules for each working team;
to put down and mark all relevant facts (resources used,
supply needs, pollution situation etc.) to be able to maintain
control of the operation;
to put down all improvised procedures and all practical
experience gained in order to be able to prepare manuals at a
later date for future operations; it is essential in order to
achieve a good result of the operation that differentiated
decision tools are available (use of modern technology will
possibly make the decision process easier);
that good working morale is of vital importance to achieve a
favourable result of the operation (this is why many
resources were used to ensure efficient cleaning of the men

every day after work in the extremely dirty environment); a
great effort was also made to ensure that the men had
sufficient rest and food, as this is also important for morale;
that working in a tight protective suit in the summer heat
creates a need to consume liquids; symptoms of lack of
liquid and salt (headache and nausea) were remedied by
giving ample quantities of refreshing drinks with salt added.
(c) We finally learned:
that it would be a good idea to undertake research into the
sensitivity of our national coast stretches; this would make it
possible to launch an immediate operation in the areas most
sensitive to pollution, thus achieving the best possible
results.
29
The Accident at DSM: Learning from a
Major Accident in The Netherlands
MENNO J.VAN DUIN
Leiden University, Department of Public Administration,
The Netherlands
1
INTRODUCTION
This paper deals mainly with the accident at DSM (the Dutch
Mining Company) on 7 November 1975 in the Western Mining
District (of the province of Limburg in the south of The
Netherlands), in which 14 employees lost their lives.
This accident will be looked at from three different points of view.
First, the situation in Limburg and the Western Mining District
before the accident will be described. Second, the accident itself
will be examined, with special attention given to the role of the
authorities and questions of coordination. Finally, the major
consequences of the accident with regard to the policy-making
process will be discussed.
2
THE SITUATION BEFORE THE ACCIDENT
One of the most important events that influenced both public and
governmental attitude towards DSM was the disaster on 1 June
1974 at Flixborough, England. In the explosion, caused by ignition
of a cloud of escaped vapour (due to a broken pipeline), 28 people
were killed on the premises of Nypro, a daughter company of
DSM, Holland.
Members of parliament as well as members of local and
provincial councils raised questions as to what would happen if a
comparable accident should occur at DSM in The Netherlands.
The regional department of Civil Defence in Limburg made an
analysis of the consequences of such an accident in the Western
Mining District. In its conclusions, the lack of professional
personnel by the local fire squads and other rescue organizations,
including those for medical care, was emphasized as a major

problem in coping with a major accident at DSM.
In the meantime, at the beginning of 1975, a committee was
formed with respesentatives from different municipalities, the
province and the management of DSM. Its main concern was
issues of town and factory planning and the environmental
problems of DSM. Also, a working group on disaster management,
serving to analyse the potential dangers of DSM, was organized.
Half-way through 1975, several local authorities of
municipalities around DSM developed some preliminary
operational plans for specific accidents like those involving faulty
gas lines and chlorine leaks.
Although there were some initial preparatory activities,
incidental plans here and there, the predominant feeling was still
that a disaster like the one in England was unlikely to happen in
Limburg.
3
7 NOVEMBER 1975: THE BIG BOOM IN BEEK
On that morning, 7 November 1975, at about 9.48 a.m., a leakage
in one of the pipelines occurred. This formed a gaseous cloud
which, within 2 minutes, exploded. The explosion caused
tremendous fires to break out through the piping system and
nearby storage tanks.
At about 10.10 a.m., while members of DSMs own fire squad
attempted to extinguish the fire, the first attempts were made to
find and rescue possible victims. About 1 hour later, public fire
squads of different municipalities arrived at the scene. The first
body was not retrieved until 1.45 p.m. Meanwhile, a great number
of wounded people were found and 45 of them were brought to
different hospitals in the area. Altogether, by 4 p.m., 9 persons
had been found dead. Attempts to put out a tank fire continued.
Due to the difficulty of the task and the bad cooperation between
the local and DSM fire squads all efforts were in vain.
Suddenly, around 6 p.m., the entire situation changed
dramatically. One of the tanks in the tank park cracked open,
spreading burning petrol all over the place and forcing the firemen
away from the immediate area. The entire tank park flew up in
flames. This was a setback in itself, but the main danger was the
threat of a huge explosion of the two nearby gas balls. Attempts to
cool them were frustrated by the wind sending the flames and
heat towards them.
In 1966, in a similar situation, an explosion had occurred in

Feyzin, France. This explosion led to a great disaster. If the same
were to happen here in the Western Mining District the
consequences would be tremendous. At that stage the danger of
such an explosion was apparent.
The situation remained critical for about 1 hours. At 8 p.m.
the municipal firemen returned to the scene. Eventually, on 12
November, the last fire in the tank park died out.
3.1
Some specific problems on 7 November 1975
Although it is not possible to discuss in detail all the problems
encountered, a concise picture of the problems concerning
operational activities and management of the operations of the
responsible authorities is discussed below.
3.1.1
Problems of traffic congestion and disaster tourism
The accident occurred less than 100m from a busy highway quite
near to the major intersection in the southern part of Limburg.
The necessary blockage of this intersection (Kerensheide) led to
traffic chaos on the surrounding secondary roadways. As if that
was not enough, traffic was already hindered at another
intersection due to road repairs. During the day, hundreds of
curious people came to see the big fire; as a result, several car
crashes occurred. By 3 p.m. the traffic started moving again after
the opening of the Kerensheide intersection. At 6 p.m., when the
accident radically escalated, the police had to close the main
routes again. At this time a lot of people, mostly disaster tourists,
were very close to the burning tank park and the gas balls.
3.1.2
Some operational problems
The public fire departments from the surrounding municipalities
functioned far from optimally, partly due to operational problems.
Firstly, there were technical difficulties such as mismatching
connections for water pumps and hoses, and the lack of adequate
means of communication. In addition, the coordination between
the local fire squads and that of DSM left much to be desired.
Notably, DSM never officially requested assistance from the 8
local fire squads; they entered the grounds of DSM on their own
initiative. Three years earlier in Amsterdam (Marbon explosion)

five local firemen died on the premises of a private firm when
helping the firemen of the firm. Later the question was posed as to
who would have been responsible if one of the public firemen had
been killed at DSM.
3.1.3
Information and communication problems
Directly after the enormous explosion at DSM all the telephone
lines were blocked in almost the whole Western Mining District.
Everyone had heard the boom and wondered what had happened.
Women tried to telephone their husbands working at DSM. This
total blockage in Beek and Geleen lasted for hours. For example,
the police and the mayor of Geleen did not make direct contact
with representatives of DSM until only a few minutes before noon,
more than 2 hours after the explosion. Not until 12.16 p.m. did
the mayors of Beek and Geleen, the cities most involved, manage
to contact each other.
In one of the early reports, at about 10 a.m., operational
services spoke of a fire at DSMs northern location. Although this
report was quickly corrected to the southern location, several
firemen went to the north. At 1.30 p.m. the regional radio station
was still reporting an evacuation of schools at Borne (in the north)
instead of at Beek, once again proving how persistent mistakes
can be.
3.1
Lack of coordination
The most important problem experienced on 7 November was the
rather chaotic and uncoordinated management of the local and
provincial authorities involved. DSM was situated in no less than
6 different municipalities. The situation of the accident itself best
illustrates the complexity and the strangeness of this situation.
The border between the towns of Beek and Geleen cuts right
through the tank park. The explosion took place on the territory of
Beek. The fire burned in two cities. The gas balls are situated in
Beek but, in the case of an explosion, the residents of Geleen, and
to a lesser degree Stein, would be threatened initially. For some
hours the mayors of Beek and Geleen were not sure if the
accident was in their city.
There were six local crisis centres set up and one provincial
centre in Maastricht, but during the day, partly due to the
communication jams, there was hardly any contact between them.

Of the various local authorities, each handled their own problems.
The public received very little or sometimes no information from
these centres. Thousands of people had heard the big bang from
the explosion that morning; hundreds of windows were shattered;
alarming reports were sent out over the radio. Yet the local
citizens heard nothing from the authorities about what had
happened and whether there was any further danger. So the
police warning around 6.30 p.m., issued by just a few policemen,
to open the windows because of the new threat of a big explosion,
came as a complete surprise for most of the people of Geleen. They
had heard that everything was under control, that the roads were
opened again, and now it appeared that the danger was still
acute. Of course a lot of people missed this message, as well as
the message at around 9.25 p.m. to close the windows again.
When members of the Provincial Council asked their Governor
(Commissaris der Koningin) why he did not intervene to
coordinate activities during that day, he answered (incorrectly)
that only one municipality (Beek) was directly involved because
everything had happened in the municipality of Beek. However, it
appears that lack of experience played a far greater role in his
decision not to act than this legal reason (which was mistaken in
itself).
The lack of coordination was the most important issue in the
aftermath. Of course, the inadequate means of communication
influenced this element.
3.2
After 7 November 1975
The accident at DSM had particular influence on several matters
at the local, provincial and national levels of government. It is
evident that measures taken on the local level are more often
directly related to the accident than measures at the central level.
In the following we will begin the analysis at the central level,
followed by the provincial and local levels.
3.2.1
The central level
At the national level, several areas can be distinguished in
connection with the accident at Beek/Geleen. Disaster
management, and internal/labour safety will be discussed
successively.
(a) Disaster management. At the beginning of 1975, the Minister

of Internal Affairs presented a bill on Assistance in the Event of
Disasters and Accidents (Nota hulpverlening bij ongevallen en
rampen). The bill was discussed in a committee of the parliament
but broader debate had not yet been planned. The accident at
DSM caused the bill to be discussed before the Christmas recess.
The accident fell into the parliament like a bomb. The weak
management, the lack of disaster preparation plans and the
administrative chaos did not go unseen by the parliament. All
political parties, speaking of the accident, agreed to new
legislation. This new law should oblige all the municipalities in
The Netherlands to make local disaster preparation plans. A more
far-reaching law dealing with disasters not only in times of peace
but also war, as announced in the 1975 bill, would have to wait.
The interim law (local disaster preparation plans) became the top
priority.
Within l years a concept law was ready. Although only
marginal changes were made, it took another 3 years before the
law came into force. Several years later this law, the Law on Local
Preparation Plans (Wet gemeentelijke rampenplannen), was
replaced by a more extensive version, the Disaster Law
(Rampenwet). In the meantime the existing Civil Defence
organization was abolished and regional fire departments had
been formed.
(b) Internal/labour safety. Flixborough, Marbon (Amsterdam,
1972), DSM and later Seveso (1976) all influenced policy regarding
labour protection and labour safety in firms. For many years the
most important law on this subject was the Safety Law
(Veiligheidswet). Recently this law has been replaced by the
Labour Circumstances Law (ARBO-wet, 1981).
In 1977, due to the above-mentioned accidents, the Safety Law
has been changed. Since then, the bigger and more complex
industrial and chemical firms have been obliged to make internal
safety reports about their organizations. The main reason for
these reports was the fact that the labour inspectorate was no
longer able to check most of these complicated and high-tech
organizations by their traditional methods. This new regulation
gives more responsibility to the management of the firm; they have
to make an analysis of both the industrial process and the
organizational structure. These safety reports should help the
labour inspectorate to do their job adequately. Eventually more
than 2000 of these reports will have to be made; up to now about
400 have been finished and approved.
3.2.2
Provincial level
Following the accident, during the first meeting of the Provincial
Council (Provinciale Staten), the Governor reacted as if the entire
event had been only a matter of local involvementthe role of the
province was and should be only marginal, and only when more
municipalities would be directly involved and coordination is badly
needed would the Governor step in.
Three months later the Governor and the Deputies
(Gedeputeerde Staten) reacted in quite a different way. In order to
deal with the powerful DSM, the municipalities of Geleen, Beek,
Stein, Urmond and Elsloo should be combined into one big
municipality. By purposely by-passing several regular advisory
procedures, the provincial government was able to develop this
proposal quickly. This drastic proposal, which went further than
mere cooperation between the different municipalities, was made
in an atmosphere of urgency and a feeling that it was now or
never.
Criticisms against this proposal naturally came from the
municipalities affected. The Municipal Council of Beek reacted by
pointing out that this newly developed municipality model
completely differed from earlier proposals about the restructuring
of the municipalities from 1968 and 1975; they described it as an
explosion model initiated by a panic reaction to the explosion at
DSM, and said that the possibility for future explosions would not
be reduced by this reorganization. That it did not come to
anything was to be expected. Support for the proposal was lacking.
The result of the proposal would have been a municipality with a
very big firm in the centre surrounded by a number of townships.
Eventually, in 1982, a total restructuring of all the
municipalities in the middle part of the province (not only the
Western Mining District) came into being. Years of lobbying, and
protest meetings ended with the formation of 17 new
municipalities from the original 56 municipalities. It was for a long
time uncertain if Beek would be one of them. The mayor of Beek,
however, had managed to convince his party member Wiegel, the
Minister of Internal Affairs. Beek survived. All industrial grounds
belonging to DSM came under the jurisdiction of the municipality
of Geleen.
3.2.3
Local level
After the accident, the events around the DSM disaster were
discussed in different Municipal Councils. In these settings the
whole atmosphere was defensive: Dont talk too much about our
own mistakes and be nice to DSM (the biggest employer in the
whole district).
A good example of this can be seen in the speech of the mayor
of Beek a couple of days after the accident: All those questions
asked by MPs and in the Provincial Council can only lead to
panic. We should not talk about the few mistakes made, but talk
about the positive role of the DSM fire squads and the fine job
these men have done. Why so anxious? It is better to trust the
authorities. This seems to be the reaction of a man who does not
understand how the citizens felt during and after the accident of 7
November.
In the long run hardly any changes were made in the different
municipalities. The authorities have waited for initiatives by the
provincial and central government on restructuring of the
municipalities, restructuring of the fire departments and the
changes with regard to disaster management.
4
CONCLUSIONS
Although the analysis of all eight cases is not finished yet, some
preliminary remarks can be made about the learning possibilities
and the learning capacity of the different governmental agencies
and authorities involved.
(1)
Accidents, especially when death and injury are
involved, are a matter of political interest
Members of Parliament, local and provincial Deputies will ask
questions about what has happened and what can be done to
prevent a future occurrence. Attention to the issue is one thing;
enduring attention and necessary adjustments after the accident
are another. The saying 4We want to learn from the accident is
more often than not a clich. Accidents are not only occasions
from which we can learn, occasions for policy innovation.
Accidents are also situations which we, or the authorities,
sometimes like to forget. The mayor of Beek was angry about all
the attention to the things that went wrong. The only thing that
counted, he said a few days after the accident, was the adequate
and brave behaviour of the DSM fire squads.
(2)
Appropriate critical mass
If an organization wants to learn from an accident, as well as from
normal circumstances, the organization must have a built-in
capacity to cope with information. The organization needs to have
a policy memory.
This presupposes a certain degree of size and intelligence, but
also a state of stability of an organization. In the case of DSM both
the local and the regional level lacked this critical mass. In the
entire area only a handful of professional firemen were available.
Local authorities were not able to counterbalance the power of
DSM. The different municipalities lacked the knowledge to be
equal partners with the DSM management. Local governments
were not able to learn from the accident. Only some marginal
adjustments were made on the local level. Authorities waited for
national help and national guidance in the form of new legislation.
As a result of the over-reaction by the province, it was 1982 before
one municipality got control over the whole DSM area. The
provincial proposals from 1976 were perhaps useful in terms of
learning, but they were a total denial of the vested interests and
the power structure in the area.
(3)
Policy making is time-consuming
People often believe that adjustments, regulations and laws are
made only after the calf has been drowned. Something went
wrong, an accident occurred and everyone agrees that something
must be done, if not today, then tomorrow. After an accident one
expects firm but, even more important, quick response.
Investigations and, if necessary, changes and adaptations should
closely follow the accident. Accidents break into the established
order and become a top priority.
Unfortunately the real situation is often not so impressive.
Policy making is a time-consuming enterprise, even after
accidents and disasters. After an accident, investigations begin but
the importance of the accident decreases with time. New things
come to the fore.
In the case of DSM this pattern of diminishing interest and

decreasing priority can be seen clearly. Dutch members of
parliament and the Minister of Internal Affairs both agreed on the
need for a rapid regulation of local preparation plans. In the
beginning everything went well, but it took more than 5 years for
the law to be enacted. Political problems were not the cause of this
delay. Rather, it was ordinary administrative factors, such as
ministerial changes and a gradual decrease of policy priority,
which account for this dramatic delay.
(4)
Learning by informing
One of the conditions for learning from accidents is to
communicate to others what has happened and what has been
done with regard to evaluation etc. To evaluate is one thing, to
inform others about the evaluation is another.
Unfortunately this second step seems to be far less developed.
The knowledge acquired is often hardly disseminated at all.
Technical reports often remain secret. For instance, the present
author had difficulty in obtaining the different reports made after
the accident. Fortunately some articles have been written about
the technical aspects of this accident.
With regard to evaluating and learning from the non-technical
aspects (social consequences, the role of the authorities, the way
to inform the public, etc.) this situation is far worse. For example,
for some years the alerting and informing of people has been a
non-issue. Only recently have people in the Western Mining
District received information on how to act in the case of an
accident.
(5)
Learning and blaming
There may exist a conflict between the will to learn from an acident
or disaster and the tendency to cover up the mistakes that have
been made by the authorities and organizations involved. Often
the goal of an evaluation is not only to learn but also to blame or
to punish.
Organizations and authorities often do their utmost to make the
evaluation reports seem as favourable as possible for them. They
can profit from positive reports (more prestige, more money) but
negative reports can lead to less prestige or even dismissal.
In the case of DSM (and not only in this case) only technical
reports have been made. At least four different organizations have
made more or less technical reports (about the cause and about
the operation of the fire squads). The weaknesses of the local and
provincial authorities have hardly been evaluated (see the example
about the mayor of Beek). After the accident, authorities stressed
the fact that the accident was a technical event in a private
company. They almost completely neglected the fact that this
accident had, at the time of the explosion, far-reaching social
consequences. The explosion not only struck DSM, it also scared
and affected the people in the neighbourhood.
30
Lessons Learnt from Major Fire
Accidents in Greece
M.VASSILOPOULOS
Ministry of the Environment, Athens, Greece
1
INTRODUCTION
It is good accident prevention practice to ensure that all possible
lessons are learnt from an accident. In this paper an attempt is
made to apply this principle to the Jet Oil terminal plant at
Kalochori in February 1986 and to present action taken by the
state and the company itself to further the increase of safety in
Greek industry. The widely accepted principle that a majority of
accidents are a result of human error is confirmed by this first
major technological accident in Greece. The lesson learnt from
this is the need to change the method of working, training,
instruction, inspection etc.in other words to improve risk
management.
2
THE FIRE
At about 12.00 on 24 February 1986 a fire occurred at the Jet Oil
terminal near Kalochori in West Salonika, where some 65000 tons
of crude oil and 55 000 tons of fuel oil were stored plus 100 tons of
naphtha (total capacity 180000 tons).
Kalochori is an industrial area located about 7 km from the
centre of Salonika (1 million inhabitants), the capital of Northern
Greece. West of the terminal, at a distance of 1 km, there is a
village with 1000 inhabitants. Close to the Jet Oil facilities there is
a terminal of Greek refineries (total store capacity 500 000 tons)
and close to them a liquefied ammonia storage tank of 15 000
tons capacity.
In the vicinity of the terminal there are also LPG storage
facilities of AGIP and BP, a Mobil Oil terminal and a pesticide
warehouse of Bayer.
There is evidence that the original fire started in waste oil

dispersed on the soil, during welding work on a pipe. The main
cause, according to the only scientific publication on the event,
presented by a group of chemical engineers, was the absence of
any observation of the safety regulations during welding work on
the plants. Also, the absence of skilled personnel to implement the
emergency plan at an early stage, together with improper safety
maintenance, attributed to the enormous spread of the fire.
As expected in such cases, an interministerial council was
established under the auspices of the Vice Minister of Defence and
the Minister for Northern Greece, who took control of the situation
during the fire. Apart from the local fire brigade, units of the
Greek army, personnel from the forestry service and the
neighbouring industries (Greek refineries and EKO) were involved.
A number of firemen were wounded, mostly by heat radiation, but
fortunately no other victims were recorded.
The total cost of the site damage was estimated to be about 22
million US dollars. Nine of the twelve tanks were demolished
together with the buildings and electromechanical equipment. A
truck of the fire brigade was also destroyed. Hundreds of tons of
vegetables were destroyed because of the dispersion of toxic
pollutants such as benzo(a) pyrene over a wide area, fortunately
not in the direction of Salonika.
As was previously stated, the fire started in the area of tank No.
1 and, through the drainage system, was transferred to the
bunker of tank No. 7 where 4500 tons of fuel oil were stored. It
increased rapidly because of leakage at a sluice valve.
At about 14.00 an explosion of tank 7 took place and the fire
spread to tank 8 where 15 000 tons of crude oil were stored. Due
to the unsuccessful attempts to put out the fire at this early stage,
the fire brigade decided to cool tanks 14 and 10. It is noted that,
after a heavy rain shower just before the event, it was not possible
to approach the bunkers of tanks 7 and 8 from the outside of the
terminal.
To reduce the danger of fire spreading to the whole industrial
area, the army constructed a dam around the terminal.
On Wednesday 26 February a new explosion took place in tank
7 and the fire expanded to tanks 14, and to a lesser extent to
tank 10. The fire brigade managed to extinguish the fire in this
area.
At midnight on 17 February, an enormous boilover in tank 8
took place and the fire spread to all the bunkers of the terminal.
This was followed by an explosion of tank 2.
On Sunday 2 March the fire had gained access to all areas of

the terminal through an explosion of tanks 5 and 6. Action was
concentrated on tank 5 with success, and on Monday morning at
03.30 the fire was finally extinguished.
It is to be noted that, during the fire, major effort was put into
avoiding its spreading to the Greek refineries terminal by cooling
the two tanks nearest to the fire.
To prevent possible damage to the ammonia tank, the contents
were pumped into the storage process tanks of the fertilizer and
refinery plants, and the major part into a ship. Also, to avoid
possible dispersion of pesticides in the area, the Bayer storage
facility was transferred using military trucks, because of a strike,
to a safe distance.
3
LESSONS LEARNT
For the reconstruction of the terminal, three major safety aspects
were taken into account:
(1) Every part of the terminal can be approached easily from
inside or outside. Safe distances between the new tanks have
to follow the new regulations, including appropriate storage
and drainage systems.
(2) Continuous control using skilled personnel and electronic
equipment.
(3) Automatic fire alarm systems.
The major accident in Salonika either accelerated or induced
measures to increase risk management in Greece. Two new laws
were ratified in 1985 and 1986 covering safety aspects for the
workers and the environment respectively. Also, ministerial
decrees about new technical regulations, especially for flammable
liquids and gases, were promulgated.
The lack of scientific and technical personnel in the fire brigade
was recognized, and such personnel are now being recruited. The
fire brigade created, promptly after the event, a special unit for
use in cases of major technological accidents.
Inspections were performed on almost all industrial units where
a major accident could occur, and contingency plans were
reviewed.
An expanded training programme for inspectors and industry
engineers is in hand, and risk assessment for dangerous facilities
has to be prepared by the year 1989, as forecast by the Seveso

directive.
Risk management in Greece has been started. To hope to avoid
accidents in the future is unrealistic; to reduce their impact
through continuous effort is possible.
31
Organizational Learning from
Disasters
BARRY A.TURNER & BRIAN TOFT
Department of Sociology, University of Exeter, UK
1
INTRODUCTION
We can learn from the past only if we are able to recognize
similarities between our past experience and our present situation.
All forms of learning based upon feedback require that we link
patterns from the past with those cues which might alert us to
related patterns in the foreseeable future. In many fields of
industrial engineering we have become skilled at making such
links, with the result that thousands of routine industrial
operations can now be carried out much more safely than they
were 50, 20 or even 10 years ago. Where we are less skilled is in
learning fully the lessons offered to us by major failures in largescale complex systems.
To extend such learning it is necessary to start with the
assumption that major failures in large-scale systems are not
wholly unique, so they can be analysed to provide information
which will reduce the chances of similar events recurring. It is
gradually becoming clear that many disasters and large-scale
accidents display similar features and characteristics, so the
possibility of gaining a greater understanding of these disturbing
events is presented to us [1].
Although major large-scale failures are high-intensity events,
they also occur with low frequency within any one industrial
sector, so to learn from them we must make use of a wide range of
comparisons from different industrial sectors. To facilitate such
comparisons a framework must be developed which aids
recognition of similar types of causal patterns, disregarding the
differing contexts in which they may occur. Much recent research
has been moving towards the development of such a
framework, suggesting that the majority of large-scale accidents
arise from combinations of individual, group, social and
organizational factors, and that these combinations display

recurring configurations when detached from their specific
technical contexts [15].
Public accident inquiries have an important role to play in these
learning processes, but they are normally under pressure to give all
of their attention to the matter in hand, and they have little
opportunity to develop more wide-ranging analyses or to
contribute directly to the emerging debate about system patterns
which might aid learning.
Public inquiries after major accidents already have to serve a
number of purposes: they respond to public concern by trying to
ascertain exactly how the events in question came about; they
provide an authoritative investigatory basis for any subsequent
legal action related to liability; and they attempt to provide
information which will ensure that accidents will not arise from
similar causes in the future. To make any progress at all towards
this latter goal an inquiry must, of course, be efficiently carried out,
any resulting conclusions must be disseminated effectively and
their implications must be translated by individuals and by
organizations into appropriate preventive action. These cycles of
events are, however, rarely considered in a unified fashion, and in
this paper we wish to correct this omission and to address some
issues which bear upon the problems of the effective generation,
dissemination and use of information relevant to large-scale
accident prevention.
After a major accident, some kind of corrective action is likely to
be initiated spontaneously by operators of similar plant, or
operators in related industries, merely upon the basis of reports of
an accident occurring, or upon the basis of reports of an inquiry in
the national or the technical press. A widely publicised component
failure, for example, might prompt checks upon similar
components elsewhere. But the primary focus for action based
upon the lessons of the inquiry lies in the recommendations of
that inquiry, and if we are concerned to minimize and contain the
adverse outcomes associated with major hazards it is important to
look at the nature of inquiry recommendations and at the
response to them.
In a current study we have been examining the
recommendations made in reports from 19 public inquiries into
major accidents, and in order to determine in detail the nature of
the response to the inquiries we have followed this up by
interviewing representatives of the array of organizations involved
with five of these incidents. We chose to look at public inquiries
into major accidents which took place in Britain between 1965
and 1975, these inquiries having already had their findings

subjected to some detailed analysis [1]. The incidents studied
more intensively were all accidents which triggered fires or
explosions. The study is not yet complete and the analysis
reported here is an interim one.
When we examined recommendations from these major accident
inquiries, we found that it was possible to discern recurrent types
of recommendations [6]. An accident is always a physical event,
and all inquiries made recommendations demanding technical
improvements and requiring that certain physical changes be
made to plant and equipment. But these large-scale inquiries also
normally recognized that the accidents were not solely technical
events. They clearly acknowledged them to be socio-technical in
nature, and over 80% of their recommendations were accordingly
concerned with organizational and procedural matters.
Recommendations were thus concerned to clarify administrative
procedures and arrangements, to draw attention to personnel
issues such as the need for staff training, or to call retrospectively
for improved safety-precautions to be installed by, for example,
the revision or work procedures or by the modification of existing
rules or regulations. Organizational recommendations also
typically exhibited concern about information flows, calling for
improved communication about hazards within and outside
organizations, demanding the formulation and dissemination of
new rules or procedures, and recommending increased
supervision, monitoring or inspection of organizational activities
by in-house staff, by external agencies or both. Finally, most of
these major public inquiries attempted to develop foresight by
making recommendations which offered the possibility of
forestalling future problems, doing this by calling for the initiation
of programmes of experimental investigations, for example, or by
directing calls for action to organizations not immediately
implicated in the particular incident under scrutiny.
Such an analysis of recommendations displays to us both the
areas which were of concern to those conducting these inquiries
and the model of diagnosis and prevention which the inquiry body
tacitly adopted. These particular public inquiries sought to control
hazards and to prevent the recurrence of major incidents by
advocating action at a physical, an administrative and at a
communications level, as well as sometimes proposing actions
which ranged more widely where future plans to deal with a
particular hazard were concerned. The model behind these arrays
of practical recommendations stresses the importance of: selecting
appropriate physical safety precautions; identifying and
eliminating ambiguous situations; keeping working practices,

rules and procedures up-to-date; training staff appropriately;
improving communication about hazardous matters; and
attending to the supervision and monitoring of processes and
individuals within the organizations concerned.
This kind of approach is broadly in keeping with the direction of
the recent research referred to above, but it is presented in
specific rather than general terms in each case. Organizations in
any sector could doubtless learn much about emergency planning
for industrial hazards merely by considering their own operations
alongside this very general checklist. But we should ask here
whether there are also other ways of making maximum use of the
considerable volume of investigation which goes into such
accident inquiries, in order to ensure that any wider applicability
of their findings is brought to notice and that the response to their
recommendations is effective.
One of the problems which such inquiries face in attempting to
learn from their investigations is that of marshalling the evidence
so that appropriate relationships can be observed and the
appropriate deductions made. Since the evidence taken by an
inquiry will run to many hundreds of thousands of words, it is, on
occasion, difficult for the interrelationships between events to be
fully appreciated.
It may then, in turn, prove difficult to extract all the lessons to
be learnt from an incident; if members of the investigating team
are not able to comprehend fully all the implications of the
evidence which they have at their disposal, they may unwittingly
end up with a limited set of recommendations. The complexity of
events associated with large-scale incidents may thus generate
blind spots in the lessons drawn from them, and it would be a
contribution to organizational learning if such blind spots could
be reduced or eliminated.
A technique known as Schematic Report Analysis has been
developed in the course of examining public inquiry reports, in
order to explore the combinations of unnoticed events which
develop in the incubation period prior to a major disaster. This
technique has been used not only to summarize a number of
public inquiry reports but also to analyse other types of incidents,
for example, the build-up to the Yom Kippur War [7] and the
causation of instances of structural failure [8].
In recent developments of this technique, Schematic Report
Analysis has been used first to translate the written synthesis of
evidence gathered about a particular incident into a graphic form,
and then to locate recommendations within this format in a way
which links them to the relevant aspects of the accident

investigation. Thus, by summarizing large amounts of information
into a readily comprehensible form, such diagrams could assist
those investigating accidents to clarify their own diagnoses and to
identify more clearly the connections being proposed between
diagnosis and recommendation.
A fuller account of this technique is available elsewhere [9], but
the accompanying figures give some indication of the approach
which has been used. Figure 1 illustrates how the events of the
incubation period of one particular unwanted incident, in this
case a methane explosion at Cambrian Colliery, Wales, can be
displayed in a single schematic presentation. In Fig. 2, the various
branches of the causal analysis have been isolated and each
recommendation of the inquiry has been related to the train of
events which it is intended to prevent recurring. It can readily be
seen that the schematic diagram subdivides into six separate yet
interrelated clusters of events, but the recommendations made as
a result of the inquiry seek only to intervene in three of those
clusters. Whether this omission was due to an oversight on the
part of the investigators, or whether, as seems more likely, they
were unable to formulate appropriate corrective courses of action,
the diagram set out in Fig. 2 points up the relationship between
the inquiry and the recommendations more clearly and more
immediately than does the original report. The development and
wider use of this and related techniques clearly have a part to play
in improving organizational learning after major accidents. As well
as assisting the analysis of the evidence, they can help to spread
the findings of the inquiry in a more readily accessible form. Very
full versions of Schematic Report Diagrams can be stored as
nested sets using proprietary programs such as Macintosh
Filevision, and diagrams generated from such stores can readily
be used as training aids.
As indicated above, work currently in hand at Exeter (with the
support of the Economic and Social Research Council) is
investigating the long-term feedback cycle instituted by accident
inquiries. Following the examination of inquiry recommendations,
this project is making a detailed exploratory investigation of the
response to recommendations made by five major inquiries
concerned with large fires and explosions 10 years or more ago.
The recommendations of the five inquiries called for action by a
total of 23 organizations. Of these, only one refused to cooperate
with the research, although four other organizations declined
indirectly, on the grounds that no one with knowledge of the
incident and its aftermath was now available, staff having died,
FIG. 1. Outlining of individual event SRAD Cambrian Colliery accident.

Source: Ref. 1.
retired or moved on. A further four organizations had gone out of

business since the incident, but interviews were conducted
satisfactorily with representatives of the remaining 14
organizations involved.
Although the analysis of these interviews is still in an early
stage, some preliminary observations arising from them seem to
be of sufficient interest
to set out here. A point which is
immediately striking is the emotional impact which involvement in
a major accident has upon those concerned. Even after an
interval of 10 years or more, these effects appear to be massive
and enduring. One senior manager still did not wish to talk about
the incident which his organization was involved with, because it
still upset him to think about it, even though his organization
bore no responsibility for the accident. As a result of the effects of
the accident, some of those interviewed reported that their
connection with the accident had triggered a major shift in
preoccupations and activities. One architectural practice, for
example, had shifted emphasis of its work so that the bulk of its
work was concerned with safety matters, whilst an individual in
another practice responded to the shock of discovering the fire
potential of furniture used in his building by spending several
years designing safer alternative fittings.
A second observation relates to the clarity of recall about the
incidents in question by individuals, even after an interval of 10
years or more. We have no independent means of confirming the
accuracy of recall, and all studies of memory and recollection
would lead us to expect systematic distortion in such retrospective
accounts, but informants discussions of what had taken place
had a very vivid and immediate quality. They had no difficulty in
presenting their clear account of what had taken place, of the
lessons which had been learned, and of how the implementation
process had been carried out. They had all clearly carried away
and retained, in a very accessible form, their own personal lessons
from the incident.
If such an incident recurred, of course, these personal learning
experiences would not be the only issue which it would be
important to ask about. It would be equally relevant to ask
whether the lessons absorbed by these individuals with direct
responsibility for response to the earlier accident had been
satisfactorily transferred to the memory of the organization; for
this to occur, they would need not just to have made an impact
upon this particular band of individuals, but to have been
translated into a form where they had become a pervasive and
accepted part of the organizations mode of operation [10]. Our
FIG. 2. SARD showing main cluster of events for Chambrian Colliery accident.
inquiries are centrally concerned with the extent to which this

institutionalization occurred, but as yet we have no conclusions to
offer on this point.
As far as organizational responses are concerned, the accounts
collected did suggest that action was taken to implement relevant
recommendations from the inquiry, and that it was taken very
quickly, delays in implementation occuring only when large
outlays of capital expenditure were needed. In such cases, the
shortfall in safety during the interim period was typically made
up by the devising of new rules and regulations, and by safety
campaigns to make staff particularly aware of the problem. A clear
preference was expressed within these organizations for forms of
safety training which actively involved employees in safety
practices and procedures, rather than merely making them the
passive recipients of additional sets of regulations or directives.
As one would expect following incidents which had excited
considerable public concern, the recommendations for action were
considered at the highest level in all 14 organizations, followed
subsequently by a meeting or a series of meetings with lower
levels of management, and supplemented in some organizations
by information programmes aimed at the general workforce. Such
a pattern of endorsement of action from the top of the organization
clearly contributed to the speed and scope of the reaction to the
recommendations within the organizations.
Whilst the diffusion of information about the response to hazard
within organizations could readily follow the normal hierarchical
pattern used for other types of in-house communications, clear
differences could be discerned when issues of broader diffusion
were discussed. In very large national organizations which
constituted industries in their own right, difficulties of
communication arising from sheer size were compensated for by
the possibility of using standard communication channels to
ensure widespread and rapid dissemination of a particular warning
or instruction to all parts of the industry with a reasonable degree
of certainty about its delivery. By contrast, in a fragmented or
decentralized sphere of operations, the differential response of
small organizations to information about hazard seemed to be
associated with a lack of cross-communication between small
competitors about such matters, few enquiries being made of
others about their level of hazard awareness.
A SYSTEMS MODEL FOR THE REDUCTION OF

SOCIO-TECHNICAL FAILURES
These preliminary observations from our study may serve to raise
some questions about the manner in which recommendations
contribute to feedback and learning, about the assumptions which
underlie them, and about mechanisms for ensuring that they are
more widely known after an investigation. They raise the question
also of whether it would be desirable and feasible to establish
some kind of unitary hazard reporting system which would
overcome
the
problems
of
hazard
communication
within fragmented and decentralized sectors of activity to which
we have just referred. To help to clarify discussion about
organizational learning and adequate feedback after major
incidents, it might be helpful to try to formulate such a system in
model form.
The elements of such a hypothetical model are set out in Fig. 3,
which is based upon earlier work in which one of the authors was
concerned to apply systems thinking to the problem of reducing
the incidence of socio-technical failures [6, 11]. It is sketched out
here not as an immediate policy proposal, but in order to
illuminate the issues which proposals that moved any way
towards such a system would need to confront.
The schematic model in Fig. 3 is best understood by considering
a proposal to initiate a project which would bring about some
change in the environment, a proposal to build a bridge, say, or to
construct a power station. The left-hand side of the diagram sets
out in a schematic form the kinds of events which might then be
expected to follow, as the design is specified and transmuted into
more detailed proposals which can be reviewed for their
acceptability The implementation of the accepted design and the
development of operational instructions for the project enable the
accepted cycle to be completed by the generation of the changes
initially envisagedthe bridge is built and carries traffic, or the
power station is finished and generates electricity.
What this cycle does not include are the activities suggested on
the right-hand side of the diagram, activities concerned with
learning about design. Typically we do have some kinds of
activities which provide us with opportunities for design learning
but these are rarely seen either as complete elements in
themselves or as key contributors to an overall learning system,
particularly when the information from failures is being
considered. Here we are pointing to the need for a set of
procedures which could help to ensure that the lessons which can
FIG. 3. A socio-technical failure reducing system.
FIG. 4. Expanded socio-technical failure reducing systems model.
be drawn from socio-technical failures are incorporated into

training and working practices in the future. This could be
achieved by making wider provision for the collection, collation
and analysis of data from known socio-technical failures, as well
as from other sources, and by making arrangements to
incorporate this information into design and implementation, and
into the management of these processes.
We have expanded the model further in Fig. 4 to move a little
way away from the wholly schematic, by trying to specify some of
the sub-systems which a unitary arrangement for reducing sociotechnical systems failure might contain. We hope that this model,
initially formulated earlier this year [6] by the application of a
Systems Approach [12, 13], might provide
an organizing
framework within which discussions of the improvement of the
management of industrial hazards might take place.
In the expanded model, operations have also been separated out
into three levels of functioning. At the first level the Design
Implementation and the Operational Socio-technical Systems are
to be found. The second level contains the first level plus the
Design and the Design Specification Systems, whilst the third
level of the model adds the Design Learning System to the first two
levels. Within each system, the sub-systems shown are intended
to be illustrative of the activities likely to be taking place, rather
than being an exhaustive specification.
The core sequence assumed in the model is the same as that
already discussed for Fig. 3: a desire for change in the
environment prompts the specification of a possible project
design, which will, we hope, be devised with the benefit of
opinions sought from concerned actors in the system. The
completed specifications will then be translated into firm
proposals, through the activities of sub-systems concerned,
among other things, with problem-solving and the collation of
designs from separate sections of the project in order to avoid
difficulties of mismatching.
A Simulated Systems sub-unit is included in the model to
emphasize the importance of the possibility of non-destructive
testing of proposals in as many failure modes as possible before
the design to be implemented is finalized. Here, as in other parts of
the system, good communications and a two-way dialogue are
important in reducing the possibility of failure.
As in the simplified model, the Design Implementation System
translates the proposals of the Design System into operational
instructions which would include information about cost, the
provision of labour, the ordering of materials and so on. A token

sample of sub-units is included here for illustrative purposes.
The Operational System can then be brought into action to start
to engineer the proposed project, setting up the required sociotechnical system in order to do so. This should generate both the
changes initially specified for the project, and also condition data
which may be used to monitor the project, and to initiate
corrective control action where this is possible.
As with the earlier diagram, the principal focus of interest for
present purposes is to be found at the highest level of the model,
in the interaction of the processes already outlined with the
Design Learning System, which is here sketched out in a little
more detail. Should the project fail catastrophically, or should it
malfunction to a level which produces a nearmiss catastrophe,
the procedures indicated here would be brought into play. The
three processes specifically identified here set out some of the
important general modes of reaction which are involved.
As discussed earlier, this part of the system is expected to
receive information from a variety of sources about socio-technical
failures, together with relevant academic research findings. As
these are accumulated, the system would be expected to:
(a) transmit information directly to the Designer Education
Systems, so that information about failures and the
responses to them could be made available to designers,
engineers, managers and others in training, making them
much more aware of the problems and mechanisms of
failure;
(b) pass information on to sub-systems concerned with the
production of Codes of Practice and Safety Legislation in
order to influence procedures and work practices; and
(c) communicate the knowledge gained directly to industry via
trade journals and other publications, special notices (as at
present in civil aviation), and training courses, to ensure that
current experience influences practice as soon as possible.
To many there will be little that is novel in this model, except
perhaps in its clear diagrammatic formulation; it merely proposes
that in designing and operating large-scale socio-technical
systems we should make maximum use of available information
by setting up and maintaining negative feedback loops to improve
our control of such systems. But when we look at practice, the
logic of the model looks less self-evident. Engineering institutions
are resistant to suggestions that they might install procedures for
reporting on and learning from failures. Research into such

matters can only be carried out with extreme circumspection if at
all, and specialists in the insurance industry who possess
information which is vital to the operation of a Design Learning
System are reluctant in the extreme to consider making use of this
information in the way outlined by the model, either because they
fail to see any connection between such discussions as the
present one and their own commercial concerns, or because of the
contraints and anxieties imposed upon them by the need for
confidentiality and by associated legal limitations upon the
dissemination of failure-related information.
We suggested above that this model might provide a framework
for the discussion of some of the issues connected with learning
from disasters. The difficulties in moving current practitioners a
very small step along the way towards the constructive use of
failure-derived information indicates clearly that a sociological
analysis of current practices in any industry operating large-scale
hazardous systems would reveal a pattern much different from the
model outlined, with the partial exception, perhaps, of the nuclear
industry [14, 15].
We should note too that the model itself has its drawbacks. An
all-embracing information-gathering and reporting system would
be difficult to devise and to operate, and it might generate
undesirable side-effects by accelerating current trends towards
the over-centralization of information in our society. It could also
be accused of placing an undue faith in a purely cognitive
approach to issues of hazard management and failure prevention,
neglecting many of the social, emotional and aesthetic aspects of
the processes discussed, and making no overt provision for
assessing the way in which issues of commercial, political and
military power might impinge upon our understanding of, and our
response to, large-scale systems failures. With all of these
provisos, however, serious discussion of the issues raised by the
model is needed if we are successfully to confront the potential for
catastrophic losses which results from the continued development
in our societies of large-scale systems with high energy
concentrations.
CONCLUSIONS
At every large-scale accident inquiry the hope is expressed that
the investigations will ensure that this shall not happen again.
But, in practice, adequate learning is often constrained. Several
factors contribute to this: frequently there is an assumption that
the particular large-scale incident is unique and unlikely to recur

even, perhaps, that it is pointless to look for regularities in such
Acts of God. Often there is also no readily available perspective
making it easy to interpret findings at an appropriately general
level, and no set of techniques for discerning all relevant patterns
in the events surrounding the accident. Learning about such
failures is further inhibited if too limited a range of possible
comparisons is scanned. Large-scale failures do not recur with
great frequency in any single field of activity, and we need to look
outside our own industrial sector, examining incidents in other
industries and in non-industrial settings if we are to maximize our
chances of spotting repeated patterns and of learning from them.
The final stage in developing adequate organizational learning
after a disaster requires the lessons identified to be passed on
effectively to those who need to know about them, and that they
be passed on in such a way that appropriate action indicated by
them is encouraged.
In general, then, as the model discussed in this paper indicates,
learning from
disasters
requires:
first,
a
wide-ranging
investigation; second, an outlook and techniques which enable
appropriate lessons to be drawn from events which are often
similar only at some general systemic level; and finally, an
efficient capability to transmit information from these lessons to
those most in need of it. Much remains to be done in identifying
patterns of contemporary institutional reactions to failure, and in
devising ways of minimizing such failures in the future.
REFERENCES
1.
2.
3.
4.
5.
TURNER, B.A. (1978). Man-made Disasters, Wykeham Press,

London.
BIGNELL, B. & FORTUNE, J. (1984). Understanding Systems
Failures, Manchester University Press, Manchester.
PERROW, C. (1984). Normal Accidents: Living with High-Risk
Technologies, Basic Books, New York.
PIDGEON, N.F. & TURNER, B.A. (1986). Human error and sociotechnical systems failure in structural engineering. In Modelling
Human Error in Structural Design and Construction, (Ed. A.Nowak),
ASCE, New York.
PIDGEON, N.F., TURNER, B.A. & BLOCKLEY, D.I. The sociological
management of safety. Paper presented to the British Sociological
Association Conference on Science, Technology and Society, Leeds,
69 April.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
TOFT, B. (1987). Schematic Report Analysis Diagramming: an aid to

organisational learning. Unpublished research paper, Department
of Sociology, University of Exeter, UK.
STECH, F.J. (1979). Political and Military Intention Estimation,
Mathtech, Bethesda, Maryland.
PIDGEON, N.F., BLOCKLEY, D.I & TURNER, B.A. (1986). Design
practice and snow loading: lessons from a roof collapse. The
Structural Engineer, 64A(3), 6771.
TOFT, B. & TURNER, B.A. (1987). The Schematic Report Analysis
Diagram: a simple aid to learning from large-scale failures.
International CIS Journal, 1(2), May, 1223.
KLETZ, T.A. (1980). Organisations have no memory. Loss Prevention
Manual, 13.
TOFT, B. (1984). Human Factor Failure in Complex Systems,
unpublished
undergraduate
dissertation,
Department
of
Independent Studies, University of Lancaster, UK.
LOCKETT, M. & SPEAR, R. (1980). Organisations as Systems, Open
University Press, Milton Keynes, UK.
CHECKLAND, P. (1981). Systems Thinking, Systems Practice, Wiley,
New York.
KALFSBEEK, H.W. (1987). The Organisation and Use of Abnormal
Occurrence Data, Technical Note No. 1.87.72, PER 1320/87, Ispra
Joint Research Centre, Varese.
AMESZ, J., FRANCOCCI, G., PRIMAVERA, R. & VEN DER PAS, A.
(1982). The European Abnormal Occurrences Reporting System, PER
672/82, Ispra Joint Research Centre , Varese.
SESSION VI
Information to the Public Prior to
and During an Emergency
Chairman: A.SAMAIN
Ministry of Health and the Environment, Belgium
Rapporteur: B.WYNNE
University of Lancaster, UK
32
Communicating Industrial Risk in The
Netherlands: Principles and Practice
PIETER JAN M.STALLEN
Institute for Environment and Systems Analysis,
Amsterdam,
The Netherlands
1
INTRODUCTION
Risk communication to the general public is becoming a central
feature of policy in the area of public health and safety as it
relates to technological hazards [1, 2].
In response to the Bhopal tragedy, the US Chemical
Manufacturers Association unveiled its Community Awareness
and Emergency Response program in 1985. This program has
been widely adopted and has generally received local support.
Initial legal developments in the US have been scattered, mostly at
State level. However, in 1986 Congress enacted the Emergency
Planning and Community Right to Know Act as Title 3 of the
Superfund Amendments and Reauthorization Act. Title 3 applies
to facilities dealing with one or more of some 400 extremely
hazardous substances. It calls for the establishment of local
emergency response committees which, among other things, shall
make provisions for public meetings to discuss emergency plans.
In 1982, the European Commission passed Directive 82/501/
EEC on Major Accident Hazards of Certain Industrial Activities.
The European Council of Chemical Manufacturers Federations
has generally supported this so called Seveso Directive. Its Article
8.1 states: Member states shall ensure that persons liable to be
affected by a major accident originating in a notified industrial
activityare informed in an appropriate manner of the safety
measures and of the correct behaviour to adopt in the event of an
accident. Although with great variety in phasing and quality,
most member states are now envisaging procedures to respond to
the EEC requirements for public information practices.
Communicating about industrial risk may appear to be a simple
and direct issue. However, it will often turn out to be an issue of
great scientific, economic, social and political complexity.

Limitations in the science of risk assessment, in media coverage,
in risk management institutions, in public perception and
understanding or in other resources may pose serious obstacles to
risk communication. For example, risk communicators may place
undue emphasis on information central to their own regulatory
policy, on information regarding the best understood issues, or on
information regarding risks to the detriment of information about
benefits or the trustworthiness of the risk management institution
[3]. Perhaps even more important, though less visible, is the
political culture which may shape the subject of the risk
communication process. For example, it has been suggested [4]
that, in open and individualized cultures like the US and, to a
lesser extent, The Netherlands, the public administration in order
to show its accountability will favour explicitness and sciencebased decision rules. Thus, the argument goes, there will be a
strong preference for quantitative risk analyses to determine the
standard setting process.
In view of the value of social and cultural divergences, on the
one hand, and of the desirability to provide an equal level of public
protection throughout different countries, on the other hand, it
would be worthwhile to identify a number of principles (if not
practical rules) to guide the development and evaluation of risk
communication activities. These principles might be derived from
a variety of sources of applied scientific knowledge since, to some
extent, risk communication can be seen as a commodity that has
to be marketed, as a clinical treatment that has to be monitored
carefully, as a warning signal that has to be responded to, as an
attempt to mediate between community conflicts, and as a way to
educate the public about the difficult trade-offs in regulatory
decision-making. Also of importance is the focused effort of more
than a decade of risk perception research.
2
PRINCIPLES
Many of the following principles may seem obvious but
nonetheless they are often violated [5]. Such violations not only
make effective communication on health and environmental
matters unnecessarily difficult; they may also create an
adversarial atmosphere which will be counterproductive in future
attempts to communicate.
(1)
Know your risk problem
Risk problems emerge in a variety of policy contexts. These may
be:
(a) Identification of hazardous substances and installations
(b) Siting of facilities and the zoning of neighbouring activities
(c) Management of hazardous processes, its control and
enforcement
(d) Establishment of emergency plans
Each of these has its own characteristic uncertainties, social
environment and potential for conflicts which must be realized
when initiating communication.
(2)
Know your risk communication objective(s)
Viewed from the position of the source of communication, risk
communication can be undertaken for one or more of the following
three major purposes:
(A) To convince the public of the trustworthiness of the risk
management activities. Other relevant terms under this
heading are: to assure that safety arrangement are adequate,
to create an open and responsive atmosphere.
(B) To stimulate behavioural change and encourage the taking of
protective action. This purpose is important in so far as one
is anticipating emergency situations and, most clearly so,
when such situations in fact exist.
(C) To inform the audience. Providing factual information about
the risk and its context (e.g. standards set to acceptable risk)
is the typical thing to do when operating under this mode.
In some circumstances a secondary purpose will be to solve
problems jointly and to mediate risk disputes. Too often one
admits priority to the information purpose (C) whereas the real
motive for risk communication (which one fears to communicate
publicly) is to achieve credibility for ones efforts to manage the
risks.
(3)
Know your limitations in achieving your objectives
Knowing your limitations is just another way of saying know your
resources. Often resources are insufficient and sometimes they
may even be lacking. Limited resources can be: absence of the
proper legal mandate to cover the risk issues; lacking financial
support; inadequate training of manpower; insufficient knowledge
of communication target. When identifying such limitations the
particular situation should be anticipated where the initial
message may lead to a public response that will require a second
communication effort.
(4)
Benefit from existing practices
In most countries one will find, at scattered places, companies
and local authorities who are already experimenting with risk
communication in some form. Such practices are important not
only because typically they have been developed by trial and error,
and have thus become very sensitive to practical constraints to
risk communication, but also because one would like them to be
part of the larger, nationwide programs rather than replacing the
existing practices by new legal and institutional requirements.
(5)
Establish the necessary institutional liaisons
Risk is a complex institutional phenomenon as well. The
management and regulation of industrial hazards concerns three
stages of risk: accident prevention, exposure reduction, and
consequence mitigation. Risk communication concerns not only
the behavioural and technical measures taken at each stage, but
also the decision processes involved (e.g. standard setting,
licensing, enforcement procedures). In most member states the
preventive aspects of hazard control are the mandate of a different
institution (ministry, inspectorate, and agencies at the
municipality level) from that for the reactive aspects. Also, there
are often several intermediary groups, carrying out related
activities, that will see risk communication as of interest to them
too (e.g. the media, fire departments, health services). Experience
with emergency situations shows that it is effective to establish
personal links between the relevant sources [6]. Evidently, such
commitment is all the more when one has to rely on the resources
of others as well.
(6)
Determine the audiences needs
One of the most difficult tasks facing risk communicators is to
develop messages that, both in form and substance, show
sensitivity to the different contexts (personal, local, historical) in
which the message may be embedded. Many public information
campaigns fail because they expose the public to information and
values without linking these to the information and concerns that
it already shares. Without such linkages, not only may the
individual be simply unable to process the message presented
appropriately, but he may also make the inference that the risk
communicator is not really interested in his problems, and thus
judge this source as untrustworthy.
(7)
Empower the audience with opportunities to control
As a general rule it is necessary to use simple and non-technical
language, both written and visual, to make the public understand
and control the hazards to which it is exposed. The presentation
of quantitative information on exposure levels (e.g. of the 106
type) and the like is only one aspect of providing cognitive control.
Risk communicators should also, and probably more importantly
so, provide qualitative information on accident prevention,
opportunities for protection and remedies for harm. Preferably,
this information should be structured so as to enable the
interested citizen to use easily accessible secondary opportunities
to gain additional information. Such a form of behavioural control
will help prevent anxiety and frustration. It is for much the same
reason that the establishment of local emergency committees with
public representation is effective, as it too offers an indirect
opportunity for such behavioural control.
(8)
Place the risk in perspective
Risk is not only an objectively verifiable element of a situation; it
is also a culturally determined phenomenon reflecting political
constellations, societal values and conflicts. Thus, provision of
risk information needs to be accompanied by efforts to assist
individuals in understanding the legitimacy of the often implicit

risk context. Types of contextual information include [7]:
(a) Comparisons with other risks of a similar nature (which
needs to be done with intelligence and sensitivity)
(b) Comparisons with regulatory standards or natural
background levels
(c) Comparisons with the extent to which the risk can be and/or
has been reduced and what that requires in resources
Invariably, individuals will need help in understanding the
differences between the societal or management perspective with
its typical focus on statistical lives, and the personal perspective
which concerns a particular individual at risk (often oneself).
(9)
Communicate in good time
The probabilistic nature of risk makes it difficult to decide when to
initiate risk communication. It is tempting to start communication
late in the process, when information and evidence are more
complete and control strategies and supporting rationales more
fully developed. However, experience seems to show that modest
but early activity will be appreciated and will not cause undue
anxiety. In a sense, the mere act of communicating may convey
the most important information. Moreover, risk communication in
its various forms should be a repetitive event.
(10)
Monitor and evaluate communication performance
and effectiveness
Even if the state of risk communication were not so meagre,
failures in practice should be anticipated. Given our limited
understanding, false steps and insensitive approaches are nearly
certain. A well designed risk communication programme should
therefore incorporate an evaluation plan both of communicators
performance (conducted in-house) and of its effectiveness
(probably at best conducted by outside evaluators). Such
evaluation will provide the central means to assure that accurate
information gets through, sensitivity is developed, interaction
between institutions is promoted, and credibility grows in the face
of adversity and the unexpected.
All the above principles have to be taken into account when

designing a particular strategy for public risk communication. As
guidelines they facilitate the making of a great number of concrete
and seemingly insignificant decisions about procedure and
content. For example, risk communication will often necessitate
new institutional relationships; consequently, problems of
overlapping responsibility and legal mandates have to be resolved.
If there are limited resources available (as is most often the case
at the municipality level), one will have to decide whether to spend
them on the most accessible audience or on those most at risk.
Decisions must be made about whether to communicate directly,
e.g. by mail, or indirectly, e.g. by mass media. Also important is
how to structure the information, i.e. what information to present
first and what to provide at later stages.
3
PRACTICE IN THE NETHERLANDS
In The Netherlands a number of cases of industrial risk
communication exist. Since about 1980 the Dutch Association of
Chemical Industries has organized national open days with some
hundred organizations participating (including relevant university
departments and government laboratories). The Royal Dutch
Chemical Association, which is the major professional
organization, is publishing a series of popular leaflets on
properties and risks of a number of chemical substances.
At present there is no legal requirement that forces companies
to communicate actively and directly with the public. However,
there are a number of companies that for various reasons have
initiated a public information campaign. In some cases this has
been triggered by an environmental event like an accident or a
spill (e.g. Duphar BV); in other cases it has been because of what
one might call the management culture with respect to safety (e.g.
Dow Chemical, The Netherlands). In general, information
campaigns by industry seem to focus more on the preventive
aspects of risk management. The objective is to gain trust or to
restore credibility more than to educate the public by improving
factual knowledge; see principle (2) above.
Another source of information on industrial risk is through local
governmental bodies. Most important in this respect is the
Nuisance Act which requires industrial facilities that can cause
danger, damage or nuisance to apply for a license. Additional legal
provisions are currently discussed to meet with the demand for a
more explicit treatment of the risk aspect of the industrial activity.
In most cases to which the directive applies, the licensing body is

the regional authority or Provincie. The application for a license
must be published in the (local) newspaper, at the city hall, and
via (non-personal) letters to neighbouring residents. During a 30day period the public has access to most of the information
presented by the company to the local authority, and it can
express its view and/or ask for additional information. Related to
this practice of passive communication is the increasing number of
municipalities that are planning actively to provide information to
the public about what to do in case of a disaster of an industrial
origin. No doubt the Chernobyl accident has strongly contributed
to this interest.
The (further)* implementation of Article 8.1 of the Seveso
Directive in the Netherlands will be based upon four provisions:
1. Risk communication as required by Article 8.1 must apply
both to the preventive and to the repressive aspect of risk
management by industry and (local) government
2. It should be active instead of passive communication
3. Plans for risk communication should be developed with close
cooperation between industry and government
4. Article 8.1 should be implemented as much as possible
within existing legal and institutional arrangements
On the basis of these preconditions, and with particular emphasis
on the fourth one, it was decided to adopt the following framework
for the implementation of the Directive in The Netherlands:
The Provincie activates (if necessary) the relevant parties, i.e.
the company and the local authority.
The company prepares the information material and aligns it
with information provided by the local authority.
The Provincie is formally in charge of inspecting the
appropriateness of the information presented.
Having opted for this framework, the running theme for risk
communication is more likely to be the company and the safety of
* The European Commission has raised an argument about whether the

Dutch government was lagging behind in implementing the Directive. The
debate centred around the question of whether the Directive demands an
active approach or also permits passive means of informing the public.
Table 1 Proposed items of information to be presented to the public (as a

specification of Article 8.1 of the Seveso Directive).
its environment than e.g. industrial risk and regulations or

industrial hazards and emergency behaviour.
Of course, this general framework still leaves open a number of
substantive and procedural questions. For example, in the context
of the chosen framework, what should be considered appropriate
information? We propose to consider risk communication as
appropriate when it contains information on a number of specific
items; these are listed in Table 1. Even with this list, risk
communication can range from anywhere between a one- or twopage letter and a full-blown brochure. Also, and thus perhaps
better, one can make a structured approach, giving relatively
modest information to all persons liable to be affected by a major
accident and offering secondary opportunities for information to
those who show a wider interest (see item 7 of Table 1). The choice
of the above global framework and of the running theme suggests
that items 1.2, 4.2, 5, 6.1 and 6.2 may be given more emphasis
than the others, as the latter are more general in nature and less
geared to the specific relationship of the company to its
environment.
To deal with the various issues of content and form, and to gain
practical experience with risk communication along the above
global lines, it was decided to conduct a pilot study first. This
study started in January 1986 under the supervision of
representatives from various government agencies and industry.
The first phase was aimed at investigating communication
practices in Europe, and in The Netherlands in particular. It also
surveyed areas of relevant research. During the second phase,
started in January 1987, a concrete campaign for risk
communication around a real facility was designed and tested.
ACKNOWLEDGEMENTS
Research for this paper was supported by a grant from the Office
of Nuisance Act and Risk Assessment of the Ministry for Housing,
Physical Planning and Environment. The help of Jose van
Eijndhoven is gratefully acknowledged in The Netherlands.
However, opinions expressed in this paper are the responsibility of
the author and do not necessarily reflect those of the granting
agency.
REFERENCES
1.
2.
3.
4.
5.
6.
7.
BARAM, M. (1986). Risk communication: moving from theory to law

to practice. Paper presented at Annual Conference of the Society for
Risk Analysis, Boston, MA.
STALLEN, P.J.M. & COPPOCK, R. (1987). About risk communication
and risky communication. Risk Analysis, (in press).
FISCHOFF, B. (1987). Treating the public with risk communications:
a public health perspective. Science Technology and Human Values,
(in press).
JASANOFF, S. (1986). Risk Management and Political Culture,
Russell Sage Foundation, New York.
COVELLO, V.T., VON WINTERFELDT, D. & SLOVIC, P. (1986).
Communicating
scientific
information
about
health
and
environmental risks: problems and opportunities from a social and
behavioral perspective. In Uncertainties in Risk Assessment and Risk
Management (Ed. V.T.Covello et al.), Plenum Press.
SORENSEN, J., MILETI, D.S. & COPENHAVER, E. (1985). Inter- and
intra-organizational cohesion in emergencies. Int. J.Mass Emergency
and Disaster, 3, 3 .
KASPERSON, R.E. & PALMLUND, I. (1986). Paper presented at the
Annual Meeting of the Society for Risk Analysis, Washington, DC.
33
Hazard Protection Measures in the
Case of the Release of Toxic Gases:
Principles and Description of the
Concepts
W.HALPAAP
Bayer AG, Leverkusen, FRG
1
INTRODUCTION
Fire services are faced by a particularly difficult problem in cases
where toxic gases are released and threaten the environment.
Rapid notification of the incident, as well as fast decisions on
suitable measures and who is to take them, decide the
effectiveness of their actions.
In Bhopal there was obviously no concept for hazard defence in
the vicinity, with the result that the population was directly
exposed to the full effects of the chemical cloud. A large area was
evacuated following the Mississauga incident. The area was
apparently not exposed to the escaping chlorine cloud, since this
would have caused injury to any persons out of doors during the
evacuation.
In contrast to ignitable gas clouds, the concentration of which
must be greater by at least 4 orders of magnitude (ratio=ppm: %)
for them to ignite, toxic gases have a considerably greater range.
Ignitable gas clouds thus usually only occur in the direct vicinity
of a leak, and generally leave no time for the fire service to take
action. Consequently this paper will discuss actions to be taken
following the escape of toxic gases, giving consideration to their
effect on the environment.
When such events occur, there are two fundamentally different
tasks to be performed at almost the same time:
Action at the operation site to prevent further escape
Action to prevent effects on the environment
In this paper, special attention will be paid to actions relating to
the effects on the environment, which have attracted growing
attention in public debate. An agreement reached as long ago as
1979 in Leverkusen between Bayer AG and the City of

Leverkusen, on cooperation in the event of such occurrences, has
since become a model, and it can be expected to be applied on a
supra-regional basis, initially in the Cologne area.
2
PRINCIPLES
Let us start with a fundamental statement: If a toxic gas cioud
escapes, there is no alternative to seeking protection in closed
buildings!
Assuming normal impermeability of the windows (w=02), a gas
cloud inside the building reaches a concentration of only 10% of
the outside cloud after 30 minutes. This realization is supported by
the fact that, although the threat to human life is a function of
concentration and time, the concentration has an overproportional effect. A concentration halved by appropriate
measures can subsequently be tolerated for about 4 times as long.
There is no fixed value which can be regarded as hazardous or
safe; the transition is a smooth one.
A hazard is almost always preceded by a clear perceptibility or
nuisance. On the other hand, not every annoying smell is
associated with a hazard. This applies in particular for
decomposition gases occurring during major fires. On the other
hand, only very few gases are odourless, such as CO. However,
these are almost insignificant in relation to their long-range effect.
Nevertheless, no matter what the situation, suitable actions can
reduce an otherwise unavoidable effect and reach better values.
As regards the fundamental effect, it is irrelevant whether
harmful concentrations are to be avoided or simply nuisances.
People should be influenced to react properly as soon as
possible.
People should be prevented from going or driving into the
affected area, or they should seek protection in closed
buildings, as shown here.
In the event of evacuation being ordered, people would be sent out
onto the streets precisely during the rising concentration phase.
The fact that people have not suffered injury when evacuations
have been ordered and performed in the past must be due to the
concentrations having been so low that such injuries could not
occur for this reason despite incorrect behaviour.
This is why the following point should always be kept in mind:

The more hazardous a cloud is, the more important it is to comply
with the procedures discussed here. Evacuation should only be
considered if it can be performed after carefully studying the facts
and taking special precautions.
3
ELEMENTS OF THE AGREEMENT
One essential prerequisite for rapid initiation of action is fast
information as well as specification of the information routes,
contents and subsequent actions. In Leverkusen, this information
is passed from the works fire service to the municipal fire brigade.
The information content determines the actions to be initiated by
the municipal fire brigade in the city district concerned. The works
security department gives the police the corresponding
information at the same time.
If there is no works fire service, or if the technical and
organizational prerequisites are not fulfilled, the municipal fire
service must, as in the case of a transport accident, for example,
obtain this information itself and make its own enquiries.
Realizing how difficult it is to take decisions on far-reaching
actions with the required speed in the first phase of an operation,
and that making enquiries in advance would take too much time,
the following agreements were reached:
(1) Precautionary information is also given on occurrences which
are expected to remain well below the hazard limits, but where a
more extensive risk cannot be excluded. This also includes
occurrences where third parties have the impression of being in
danger, i.e. in cases where the danger is only detected subjectively.
(2) The conceivable effects are initially estimated. This concept is
based on the principle that speed is more important than
accuracy, i.e. that measurements are usually not awaited first.
(3) Even the control room staff of the works fire service has the
authority to send appropriate information to the municipal fire
brigade on the basis of messages received without making its own
enquiries.
(4) The information received (be it from employees, the
population or the plant involved) is used to assess the situation,
i.e. whether a small nuisance or a health hazard must be
expected, must not be expected or cannot be excluded. The result
of this assessment is a precautionary notice Dl or an advance
notice D2, D3 or D4.
D1 means that probably no effects outside the neighbourhood

need be expected, and that consequently no action will probably
be necessary.
D2 means that the possibility of effects on the neighbourhood
cannot be excluded, but that action will probably not be
necessary, an agreement on such action being reached, if
necessary.
D3 means that effects on the neighbourhood must be expected
and that the agreed action must therefore be initiated without
delay.
D4 would additionally mean that a catastrophe warning will
probably also have to be given.
The terms precautionary notice, advance notice or probably
mean that the assessment of the situation may still change, but
estimation of the situation at the earliest possible time is required.
The resultant actions are therefore of a particular precautionary
nature and take priority over the assessment whether or not the
corresponding hazard actually exists. The action taken in
accordance with this system is therefore not a definitive indicator
of the actual hazard existing.
Experience has shown that numerous notices have been
submitted in accordance with this system on events which,
contrary to the initial assessment, had no effects beyond the
company limits. In such cases, these notices are treated only
internally by the authorities. The willingness to provide such
comprehensive information is thus rewarded by this information
being treated with a certain degree of confidentiality.
4
EXPOSURE AREA/WARNING AREA
We have seen just how important it is to initiate any necessary
action as rapidly as possible. In addition to providing information
on an occurrence as rapidly as possible, it is also important to
agree upon the extent of its effects. In this context, it is important
to relate the estimated effect to a certain area, since the hazard
changes considerably as a function of various factors, including
the distance from the point of origin. The effects at distances of
1000 m, 2000 m or 10 000 m will be completely different. On the
other hand, it is difficult to define such an area when such an
event actually occurs. With the same quantity escaping in each
case, the difference in the areas results exclusively from a slight
change in the wind speed or weather situation.
If the tolerance limit (perceptibility, irritation, hazard) and the

quantity escaping were also to be changed, the result would be a
large number of different exposure areas. It is consequently
senseless to expect that an appropriate exposure area could be
selected in a concrete case. Above all, the major parameter, the
quantity escaping, is unknown and cannot be determined rapidly
enough.
It is for this reason that the decision was taken at the very start
not to prepare or determine any such exposure areas related to
concrete occurrences. Instead, an exposure area was selected,
which has been defined as the warning area and is intended to
fulfil the following requirements:
The cigar-shaped area resulting from the progagation model
used is applied in its basic form because it is more likely to
allow rational deployment of the task forces than a sector
warning.
The area selected is so large, or only so large, that the available
task forces, police vehicles and fire brigade loudspeaker vans
can service this area within an acceptable period, e.g. in about
2030 minutes.
The police and fire service control centres direct their vehicles to
the area defined by the wind direction and the templates. The
police take up positions at road junctions outside these areas and
cordon them off. The fire service enters the district with its
loudspeaker vans and begins to warn the population. At the same
time, they also ascertain whether they are inside the cloud (as
assumed) or still outside. They locate the cloud edge and report
back on the actual location and intensity of the cloud. These
reports then show whether the area thus defined is larger or
smaller than the specified area, and whether appropriate
conclusions must be drawn.
There were also debates as to whether a larger area should be
assumed, in the expectation that a larger area would mean greater
safety. However, this proposal was rejected, since a larger area
cannot be covered as effectively as a small one. Furthermore, the
control centres cannot direct any desired number of vehicles
during the initial phase. In other words, a greater area does not
mean greater safety in this phase.
5
INFORMING THE PUBLIC
The current concept is rounded off by an information brochure
containing general rules of conduct which is distributed:
to the company employees by the company management;
to the general public by the town clerk.
It contains the general recommendation that refuge should be
taken in closed buildings and windows closed if unusual gases are
noticed, i.e. even before a warning is issued.
At the same time, the concept foresees the use of existing public
warning sirens and appropriate signals telling the public to switch
on their radios to hear more detailed information on the warning.
6
ADDITIONAL COMMENTS
The major elements of this concept are as follows:
The checklist as a basis for the company informing the
municipal authorities as rapidly as possible
The agreed exposure area as the basis for the action to be
initiated in the first phase, if necessary
The principles for establishing rules of conduct giving particular
consideration to toxic gases
The translation of these principles into rules of conduct for the
population
In conclusion, there are a number of details to be kept in mind
when implementing or further developing this concept:
(a) The entire city has been divided into numbered warning
districts with specified routes for issuing warnings by loudspeaker
vans. The texts have been kept as brief as possible and the vehicle
speeds selected accordingly. The district numbering system is
based on a neutral pointthe Leverkusen motorway junctionnot
on the company grounds.
(b) The information system has also proved of interest for the
exchange of information between public agencies. This again
shows that the importance of the fundamental idea of interlinking
information with the resultant actions has been recognized. It is,
for example, conceivable that a warning area assigned to advance
notice D3 is allocated a further area where the fire brigade and
police control rooms are merely to be informedin the sense of Dl

or D2.
(c) It cannot be emphasized often enough that the actions
described for toxic substances are largely correct, irrespective of
the specific properties of any particular substance. In addition,
the substance escaping can often not be identified immediately.
This is why reports on effects (nuisance, coughing, etc.) take
priority over measurements. (Details of the additional difficulties
in making such measurements or of how difficult it is to obtain
useful measurements suitable for analysis will not be mentioned
here.)
(d) Filter masks will still suffice in the case of large-area
warnings, i.e. protection through simple breathing equipment. The
only exception to this rule should be in the direct vicinity of the
point of origin. A general order specifying complex or selfcontained breathing apparatus would make large-area actions
virtually impossible. Road blocks should always be located beyond
the cloud so that the use of filter masks is not necessary.
The fact that it has been possible openly to discuss and agree on
this concept in Leverkusen is a reason for satisfaction. Such a
concept naturally also gives rise to the question of the occurrence
and effects of possible accidents. Since the Bayer works in
Leverkusen have never experienced an event resulting in such
effects on the neighbourhood, we had to make it clear why such
actions were nevertheless being prepared and rules of conduct
issuedbecause possibly something could happen. People
accepted that such an incident was regarded as not impossible
by way of precaution, but without developing a feeling of fear. On
the contrary, in view of events occurring elsewhere, it is my
opinion that the existence of a clear concept has even created an
additional feeling of safety.
34
Industrial Risk and Information to the
Public
R.GROLLIER BARON
Institut Franais du Ptrole, Vernaison, France
1
INTRODUCTION
When confronted with the development of techniques, the general
public is divided between admiration and the old spectre of the
sorcerers apprentice. Demystification is more difficult when
technologies make use of knowledge which is no longer at the
level of the man in the street. On the other hand, the media (and
particularly television) have a considerable effect on public opinion
the fourth power.
While in recent decades the public has become more and more
aware of problems of the environment, the industries which
manufacture basic materials for the other economic sectors have
made little progress in their communication with the general
public. Most often they have faced nonspecialist journalists when
accidents occur, without preparation and in circumstances when
it is difficult to achieve credibility.
The major accidents which have occurred in recent years, and a
certain number of events the amplitude of which has been
considerably exaggerated by the media, have led to
reconsideration and a change in attitude.
The present ideas regarding information to the public as far as
industrial risk is concerned may be summarised as follows:
To convince the public of the social value of the activity of the
establishment, to counteract the nuisances and risks which it
presents; to acquire credibility in a situation of calm
To prepare for a possible crisis situation and manage
information during the crisis
The first phase, which gives a positive image, is an

indispensable preliminary if one wishes to control efficiently the
second, which gives a negative picture.
2
CREDIBILITY: SOCIAL VALUE
There are two sorts of public for an industrial establishment:
those who live around the establishment and who are exposed to
its nuisances, and those whom one can call the general public.
The first needs reassurance while the second expects more
general information.
2.1
Facts
The enquiry carried out by Adicra in 1980 among populations
living near chemical factories to the south of Lyon showed that the
inhibitants were divided into three segments; at the extremes, 15
20% of people fiercely for or against the industry, and at the
centre 6070% of undecided people whose opinion can be
summarised as follows:
They are satisfied with the presence of the factories which
bring employment and thanks to which the areas benefit
financially thus enabling the building of facilities for the
public (swimming pools, sports complexes, etc.).
They are not worried about pollution by the neighbouring
factory but are worried about pollution created by factories
further away.
With regard to industrial risks, they admit that there is no
zero risk, which is very important, but wish to know whether
all reasonable precautions to reduce the risk of accident
have been taken.
On this subject, they lack credible reference; of the sources of
information, the mayor inspires most confidence (he defends the
interests of his electors). It should be noted that, even though the
credibility of the media is quite small, that of television is greater
than that of the press.
Among other things, when an audio film on pollution was filmed,
it was tested on ecologists; the test showed that the ecologists
were first of all aggressive but then posed questions when they
found that they were dealing with people who were competent to
give them explanations for problems which they had only

encountered through the media.
2.2
What information should one provide?
Following these reports, Adicra on the one hand tried to make the
chemical industry of Rhone-Alpes known through the media and,
thanks to Rhone-Loire scholarships, performed a study on the
actions undertaken in this field in Switzerland, Germany and The
Netherlands.
From this study and from experience of dealing with the media,
the following rules governing the way of informing the public have
been drawn up:
Give information in simple language, accessible to everyone,
avoiding technical or learned terms as far as possible.
Explain what the products are used for if they are not directly
commercialised (which is the case most often in chemistry). In
the case of direct information, show samples of products used or
known by the general public which use substances produced by
the factory (drugs, plastic objects, car parts, medicines, etc.).
On this occasion one can detail the advantages (price, weight,
comfort, efficiency, etc.).
Show the establishments contribution to the local economy:
direct employment, sub-contracting and work created, revenue
for the community and amenities which it has been able to
finance.
Mention the regional prestige of the establishment by e.g.
mentioning its renown in such and such a field, its position at
the national and international level, the originality of its
products, etc.
Indicate its contribution to the national economy: volume of
business, value added tax, exports.
To acquire credibility, one must also discuss the negative
counterpart of these positive aspects:
Pollution and nuisances
Risk of accidents
On these two themes, one must show that the factory has the
permanent aim of reducing nuisances, of avoiding accidents which
are always possible although improbable, and of limiting
consequences. To do this, one should highlight the professional

competence of the factory staff, their training, the regular
performance of safety exercises, the money spent on these
activities, etc. One may also mention the means available for
safety and the performance obtained.
It is very important to be objective on these two themes to
acquire credibility. As an example, one must not deny the
dangerous character of certain products when they are
dangerous, but explain how one can mitigate these dangers. A
triumphant attitude does not favour credibility. One may also help
the public to draw up a balance between advantages and
inconveniences, by comparing the activity of the factory with
familiar activities whose risks are balanced by a certain value (use
of town gas, electricity, cars, etc.).
These risks should also be given a relative value by comparing
them to risks encountered in everyday life (lightning, drowning,
illness, etc.).
In this type of communication it is important to refer to subjects
which are known by the man in the street and to his references in
matters of probability.
2.3
How should the information be given?
There are various means which must be adapted to local
situations and to the people whom one wishes to convince. One
may cite:
Open days which can be oriented towards certain sections of
the public (teachers, pupils, general public, professionals in the
health service, neighbours, etc.). It should be noted that,
although it is a good idea to convince elected officials, these
follow the opinion of their electors whatever their personal
convictions
Use of staff who are particularly credible vis--vis their frends
and relations; they must be encouraged to defend their
establishment
Newspapers and business brochures
Local press:
reception of journalists;
insertion in newspapers of articles on factory life (new
installations, important visits, commercial successes, sports
equipment, etc.);
articles in free newspapers

Local radio and regional television,
Video films shown in schools, for associations or organised
meetings.
3
PRELIMINARY INFORMATION FOR A CRISIS
SITUATION
The CEC Seveso directive of 24 June 1982 concerning the risk of
major accidents in certain industrial activities (82/501/CEC)
states in Article 8: The member states will ensure that people who
may be affected by a major accident caused by a notified industrial
activity in the sense of Article 5 are informed in a suitable manner
of safety measures and procedures to be followed in the case of
accidents.
In France on 12 July 1985 the Minister of the Interior and
Decentralisation issued circular No. 85/170 to the Commissaires
of the Republic on new safety planning for technological risks.
The interministerial communication of 12 July 1985, together
with the circular on the Orsec plan Technological Risks, section
Special Intervention Plan, dealt with the problem of informing
populations: In most cases the systematic application of these
measures will be suitably prepared by information of the
population, e.g. by the distribution of information cards giving
safety advice. The mayors of parishes at risk must receive
privileged information from the Directorate of the Establishment
and the Commissaire of the Republic
Appendix II of the Orsec plan Technological Risks deals with
population information cards:
It is obvious that the nature and magnitude of risks for the
population varies considerably depending on accident
dynamics. The preparation of safety advice in the form of a
card will thus be considered as imperative in all the cases
where risk analysis shows the possibility of rapid dynamic
accidents, implying immediate countermeasures, such as
confinement in the house or evacuation. This will be the case
e.g. when there is danger of explosion or of rapid propagation
of a toxic, corrosive or asphyxiating gas
If one has an industrial complex which includes several
neighbouring installations of different types, it is better to
prepare a single card, including all the useful information

and advice, rather than several documents
Industries thus have an obligation to keep the population
informed of the risks involved in their activity and of the
procedures to follow. They must prepare an information card in
liaison with the authorities concerned, taking account of the
following considerations:
The card will be drawn up on one page with the company or
companies on the heading and the Directorate of Civil Safety or
the municipality of the factory or factories involved. Joint cards
are recommended,
People responsible for public places must receive special
information to enable them to complete the safety advice for
their establishment. Open air amenities (swimming pools,
stadiums, etc.) may pose problems.
A radio warning on a fixed frequency (local radio) is more
efficient than the telephone for obtaining instructions or
information. It is recommended that the telephone system
should not be saturated in crisis periods. The population
should be advised to test the radio warning at normal times (no
danger situation). Preferably stations should be chosen which
broadcast continuously and which have a certain permanence.
Obviously the information card must be adapted to particular
cases. One can note that it would be a good idea to have a
standardised European alert code.
It is a good idea to prepare for the distribution of this card by
preliminary information in order to avoid the creation of
unjustified fears, specifying that it is just a complement to the
efforts already made on safety.
4
INFORMATION IN A CRISIS SITUATION
There is no lack of examples where bad management of
information at the time of an accident or incident increased its
gravity in public opinion well beyond the reasonable (Seveso,
Montlouis, Chernobyl, the Rheims transformer, the Sandoz
accident, etc.).
One should thus keep in mind some characteristics of
information for the media if one wishes to understand how a
process of disinformation can be started:
The media must sell their services, i.e. fulfil public demand; now
the information media sell news or events.
One often says that for journalists a dog which bites a man is
not news; a man who bites a dig is. The media news event is
characterised by its rare, unusual, unexpected, etc. nature; this
is the case in most chemical accidents.
Information very quickly loses its value; it is a perishable
commodity; it has more value when it is fresh; some journalists
even say that it is better to publish unreliable information
quickly rather than wait for confirmation.
When journalists have information they try to verify it by
comparing the points of view to the extent that they have the
time.
Information has more value if its source is credible.
Journalists who deal with different facts (including accidents)
are not specialists and do not have any particular competence.
The journalist who covers an event finds his information where
he can from the most accessible people who are not necessarily
those who are most competent or most objective.
If he wishes to sell his article it must draw the readers
attention with eye-catching headlines.
One can deduce the best way of managing information in a crisis
situation from these characteristics.
One must be able to answer the press very quickly, anticipating
them by taking the initiative of announcing the event as soon as
possible. This supposes that this function is envisaged in the
organisation of emergency plans and attributed in the same way
as other intervention functions. This implies that the designated
people, who must be of a good level, remain available and have
received some training to enable them to inform the public
correctly. Good training consists in receiving the press
occasionally, cold; this also has the advantage of establishing
personal relationships with the journalists and of obtaining a
certain credibility.
It is very important to take the initiative in information to avoid
the propagation of rumours which could cause panic movements
in the population, by anticipating the media.
Answering the press quickly supposes that one does not wait for
the drawing up of a communique by the authorities; such a
communique will very probably be too late and will not answer the
needs of local journalists.
The information must be objective and limited to describing the
facts without making any assumptions, saying what one does and
does not know. One should also say that the press will be kept
informed of the first results of the enquiry.
Initial information and declarations must only concern
indisputable facts:
Type, place and time of the accident
Installation name
Product involved
Control measures put into practice
As long as no precise figures are available, no statement should be
made about the gravity and cost of the accident.
Communiques transmitted to journalists by telephone or telex
could with advantage be confirmed by special courrier.
If the accident is large and will last for some time, once the
operations are terminated, the media should be informed of the
outcome.
Do not try to believe that one can give a smattering of technical
information to journalists concerned with various matters; they
are what they are and they must be dealt with as such.
For major accidents, which involve the PPI, there should be just
one spokesman for industry and the administration. He should be
designated a priori when the PPI is being prepared. In US
emergency plans, the information for the public is carefully
prepared; it includes a detailed list of journalists with no omission
with their details, the procedures to be followed to facilitate their
task according to the importance of the accident (making available
a room with means of communication: telephones, telex, facilities
for photographs, audio-visual material, cards, documentation,
identification badges, record of entries/exits, reproduction
apparatus, provision of food and lodging, etc.).
For very large accidents which may require e.g. evacuation of
the population, there is another problem of information of the
public which has been mentioned above; it involves informing the
people involved in the accident. Local radio and television may
play a very important and positive role in the giving of orders; the
organisation of a press centre thus helps in accident
management. This was shown in particular in Mexico where the
television gave indications on the organisation of transport of
wounded by the underground to the various hospitals. In the
United States, a radio frequency is reserved for the transmission of
these messages.
5
CONCLUSION
For a long time industrialists have believed that, according to the
old proverb, one should let sleeping dogs lie. As A.Giraud said
recently, one must be media-oriented because disinformation is a
considerable risk for our societies and can lead to aberrations, as
can be seen in certain fields.
Industrialists have understood this situation very well; they
have organised training sessions for communication with the
media. In the Grenoble region the head of an establishment where
a risky investment is underway informed the public during the
administrative enquiry with a remarkable card.
It is better to spend a little more on public relations and a little
less on superfluous investments to increase the illusion of safety.
35
Requirements for the Planning of
Industrial Hazard Alarm Systems with
a view to the Application of Modern
Communication Systems
WOLFGANG ULRICI
Ecomanagement Consultant, Bonn, FRG
&
G.GUTMANN
Battelle Institut, Frankfurt, FRG
1
INTRODUCTION
Hazard alarm systems are a special case of communication
systems. Their communication qualities decide their value. The
analysis in terms of communication systems has to cover three
essential aspects:
The semantic aspect: what is the information to be transmitted
and to whom?
The sociological aspect regarding the receivers of alarm
messages: how may the public be informed without producing
unwanted reactions; how may the public be prepared for
potential industrial hazards?
The technical aspect, the proper solution depending on the
specification of the semantic and sociological demands.
We shall not discuss here the balance between increasing efforts
on measures to avoid hazards and increasing efforts on better
alarm system. We start from the notion that incidents can happen
despite every effort to avoid them; however, if they happen they
should be handled in such a manner as to minimize harmful
consequences.
FIG. 1. Hazard communications system characteristics.
2
BASIC GOALS AND MODELS OF HAZARD ALARM
SYSTEMS
First, and basically, hazard alarm systems are simply to indicate
that there is danger imminent. This will advise people to protect
themselves.
The second task of a hazard alarm system is to inform on the
character of the hazard. This is particularly important for
industrial hazards when fast and well founded reactions are
needed in order to protect the plant from technical as well as from
secondary damage.
Third, hazard alarm systems may tell people what they are
expected to do next. The advice may be very simple, such as seek
shelter immediately; in other cases it may be more elaborate,
indicating e.g. why the orders given are necessary.
Fourth, in a later phase, hazard alarm systems will provide for
the means of communication among those concerned in an
incident.
We may distinguish two major kinds of alarm systems for
different stages of the reaction on to hazard. The essential
differences are found in the purpose of triggering passive or active
reactions of those concerned. In this context, passive means
requiring people to take immediate action in order to protect
themselves and leave the hazard to itself for the moment; active
means counteracting the hazard and turning to knowing more
about it, in a later phase. These differences show up in the rates
and amounts of information that are to be transferred. These
characteristics are tentatively drawn up in Fig. 1, with a view to
industrial hazards.
Passive reaction systems are characterized by high information
transmission rates, but only medium to low amounts of
information to be transmitted. Active reaction systems, on the
other hand, are characterized by elevated amounts of information
to be transmitted; high-rate channels are required only between
hazard observers/analysts, hazard management, and hazardcombating services, the other links needing only medium-rate
channels. In addition to this, the number of communication
partners and the direction of the channels (one-way, two-way) will
have to be considered.
3
SEMANTIC ASPECTS
Semantic aspects are of particular importance in all those cases
where information must be transmitted at a high rate, i.e. in the
first, passive reaction phase, and during the active reaction phase
among hazard management, hazard observers/analysts and
hazard-combating services.
In the first phase of industrial hazard alarm, requirements are
strongest for the links between the site of the incident and the
hazard management and further to the authorities, as hazard
management and authorities need sufficient information in order
to be able to decide on triggering the internal and public alert
systems or not. For this, the alarm system must be able to yield
information on the character and the severity of the hazard; any
simple alarm signal must be completed by concise (for time
reasons), specifie information from technical sensors and human
observers/analysts that is sufficient for a well founded decision.
Typical data to be transmitted are: affected plant, process involved,
emissions, potential consequences, time scale of evolution. The
channel width of a telephone link should be sufficient for this
purpose, as the number of decision-makers will be small.
In the active reaction phase, the requirements for the link
between the hazard observers and hazard management will even
grow, as now the information must suffice to make quick and
optimal decisions for combating the hazard. The transmission of
images will be necessarry. Telephone links will no longer satisfy
the needs, as their channel width is insufficient; messengers may
not be sufficiently fast.
The other channels with particular requirements are those from
hazard management and authorities towards the public during
the first, passivereaction phase. The essential requirement is that
alarm messages, being short for reaction time reasons, must be
shaped so as to be unambiguously decoded by those concerned,
particularly as communication both ways may not be feasible
because of the number of communication partners, the bottleneck
being the alarm centres with hazard management and the
authorities.
This imposes restrictions on the amount and the complexity of
the information to be conveyed by the public alarm system. Even
if people have been trained in general, it is never known for sure if
all those concerned in an incident are indeed properly trained and
if they have memorized their parts well. So it is of crucial
importance to shape the passive alarm system so as to convey
easily understood, if possible self-explaining, messages leading to

standard reactions.
In a later stage, needs are for continuously widening public
channels, but their transmission rate may slow down. However,
with the public, the problem of serving a large number of people
with a continuously growing amount of information remains.
Some particular considerations will be necessary for this problem.
4
SOCIOLOGICAL ASPECTS
A sector that is often treated with little care in the planning of
hazard alarm systems is the communication of the hazard
management with the public.
This part of the system is seemingly unimportant for active
reaction purposes. The amount of information that must reach the
public is in many cases considered as minor and restrictable to
the needs of the passive reaction system. In our opinion this view
is inadequate. Even if the potential consequences of the hazard
may be technical at the moment, the intangible consequences of
neglecting the information dimension of hazards may be serious,
particularly in an emancipated and critical society. Confidence in
the technical and political decision structures may be essential for
the survival of an industrial plant
From the sociologists point of view, an incident is not a disaster
by itself; it may, however, develop into one by affecting people and
by wrong reactions. A disaster is formed by the interaction of an
incident and the people concerned.
Thus, knowledge of the characteristic reactions of people and of
their social environment will determine, to a large extent, the
design of the technical realization of the hazard alarm system. The
alarm system is to guide the actions of those concerned; this will
be possible only if the messages are transmitted to all those
concerned, and if they are decoded by them as intended.
The problem is best illustrated with people who are driving in
their cars at the time of alarm. How will they be reached? How
should they behave turn to flight or seek shelter? If the latter,
how are you sure to convince them that an official order to leave
their cars will be to their advantage? After all, our societies are
largely emancipatedsome call them ego societiesand people
are not used to obeying orders if they think they know better;
there is no guarantee that people will behave the way they are
expected to, even if they have been trained for it.
So, in order to improve the efficiency of the alarm system,

sociological reasoning leads to additional requirements (which
translate into technical design requirements) such as:
(1) It will be generally helpful to keep the public alert signals as
simple as possible, e.g. one on and one off sign, and to train
people to just one standard reaction that will be viable in the
majority of cases: seek shelter and turn the radio/TV on. This
implies that people must be kept informed as long as the alarm is
effective; this again implies that triggering an alarm should always
include interrupting the radio programmes in favour of alarm
messages.
Training local people to more elaborate reactions to alert signals
is a good idea in principle. However, this is a delicate point for
industrial hazards, even if it can be done financially, people
potentially wanting to participate in the hazard planning and to
get internal details. Therefore, special training appears to be
necessary only if the alert system and the standard reaction
should be totally inadequate. This is not an argument against
training in general but only against special training.
(2) As often as possible, hazard management and authorities
should provide reasoning together with orders. Arguments may
(and should) be short; e.g. the order seek shelter and close your
windows may be accompanied by the reasoning: fire in chemical
plant at site xyz, emitting noxious gases; turn off air conditioners.
Without this, people might be inclined to turn their air
conditioners to full power.
It is useful to include the shaping of messages and their
reasoning as early as in the hazard alarm planning phase; hazard
managers should be trained for their use. A good example of this
is the French alarm system Grands Barrages in which the
essential messages are precisely formulated and standardized in
advance.
(3) The alarm message should not only contain the reasoning for
the orders but also a positive message such as: You can avoid
harm if you act like this; this will leave you secure for the
moment; further messages will follow soon on radio and TV. This
will be clear from the consideration of the state of people at the
moment of receiving the alarm; they are alarmed, they are
stressed, and they will be inclined to panic. So they will be eager
for precise directives as to what to do for the best and to know
that their needs are cared for.
(4) In an emancipated society, whoever needs more information
should obtain it. This is a rather delicate point with industrial
hazards, as the population and the public media tend easily to
lose confidence in official statements if there remains only the

slightest suspicion that something essential and important for
their well-being is hidden from them; as somehow the bad truth
will come out anyway, it is important for the management to keep
the initiative. On the other hand, there may be some confidential
information involved that should not enter the public scene.
The simplest technical solution, namely the installation, of a
couple of telephone lines to a specially trained PR officer, will not
work because they would tend to be quickly blocked.
In addition to the amount of information needed, there is the
problem of time dependence of information needs. In the first
moments after an incident, the needs of the public concerned may
be fulfilled by just knowing how to protect themselves, whereas
afterwards more precise information will be necessary to suppress
unwanted reactions such as panic or troublesome curiosity.
A solution that may largely satisfy the needs of the public as a
whole may consist in a quasi-intercommunicative system:
telephone lines to the centres of administration and of hazard
management, a link to the next radio station, and the
broadcasting of information that is of common interest. This is not
a solution for private problems, but it may help to manage the
first problems of general interest. Moreover, the appearance of the
hazard managers or their PR officers and of the authorities on the
radio/TV would have the effect of demonstrating that the public is
not excluded from first-rate information but rather included in the
discussion of hazard management and of the consequences of the
incident; this may raise public confidence in the hazard
management and help to calm down public stress. Still, this does
not rule out keeping certain information confidential.
(5) The rules for interaction between hazard management and
the public should be followed for communication among the
hazard-combating services as well. This means that:
Orders to the hazard-combating services should be followed by
the reasoning behind them, and suggestions on when and
where to get more detailed information.
Hazard-combating services should be able to communicate with
the hazard management both ways.
Messages must be unambiguous. This includes even such
simple items as the naming of intervention means. Harmonizing
these terms is felt to be urgent, particularly if helpers from
other countries are involved, which may be the case for
incidents near the borders of a country.
(6) Up to now, the special role of the authorities in industrial

hazard alarm systems has not been specifically considered; it was
assumed that the authorities, being partly hazard management,
partly public, will be informed as comprehensively and as quickly
as possible. It is our opinion that this is in industrys own interest
and will not need further discussion,
5
TECHNICAL DESIGN OF HAZARD ALARM
SYSTEMS
5.1
Basic principles
For any technical solution to the alarm system, there are certain
basic principles to be followed:
The alarm system must be reliable.
The alarm system must reach all people concerned with
certainty.
The alarm system must reach those concerned in time.
The first of these requirements is meant to include a guarantee
against missing alarm as well as against false alarm. These two
demands are to some degree contradictory, as the easier and more
reliably the alarm system is triggered the more it is prone to false
action because of spurious commands. There has to be some
compromise. To provide proper functioning in case of hazard is
probably conisdered by most planners to be more important, and
most technical systems give priority to hazard warning instead of
suppression of false alert, even if this should tend to blunt the
instrument to a certain degree.
The requirement of sure firing in the case of hazard is taken into
account by providing the system with proper redundant elements.
It is good technical practice to do this by establishing different
systems in parallel, such as providing cars with two brake
systems that work on different principles. Another guiding
principle adding to reliability is the passive design of those parts
of the alarm system that have to be most reliable and timecritical, e.g. the alert should be triggered by passive rather than
active elements, active elements being involved only to keep the
system from firing. An example of this is the railway security
system that causes the engine to stop if the driver does not react
in time to a certain periodic signal. Yet another principle that

produces reliability is to provide sufficiently wide and redundant
information channels.
In some cases it may be useful to provide the alarm system with
a monitoring system indicating the orderly status of the alarm
system. However, as this adds to the complexity of the system and
thus provides another potential source of errors, such a monitoring
system should be checked very carefully for usefulness.
The second requirement means that the alarm system keeps
open the lines to those concerned or provides for reliably opening
them in case of hazard. Being weak elements of transmission,
these channels must be properly secured. Apart from technically
securing, i.e. protecting, the lines, there is a problem caused by the
mobility of people. If only a few persons are immediately
concerned, a portable warning system that is permanently worn
may be helpful, but for large numbers of persons, such as the
public, this system is not feasible. So the solution of providing
different alarm systems for different phases of a disaster and for
different degrees of concernedness must be adapted to the
mobility and number problem.
The next requirement rules out certain information media such
as newspapers for high-rate information as they will not add to
the efficiency of combating the hazard. So only the fastest
information transmitters may be allowed at the hazard site.
Finally, the alarm system should be flexible enough to make the
management of unexpected situations possible. It should always
be kept in mind that, even if a hazard system is planned with
much care, hazards usually do not behave according to planning.
The technical alarm system must be planned as flexibly as
possible, without fixing too many details.
5.2
Technical options
Considering the semantic and sociological requirements restricts
the choice of communication means to rather few typical options:
High-rate, high-amount transmission that addresses only a few
partners is provided by TV and special data transmission links.
The future public ISDN (Integrated Services Digital Network)
system applies digital transmission to existing telephone links
and will provide data transfer rates of 64kBaud in the first
stage; the technology should serve well for the purpose of future
hazard alarm systems. These transmission means will be useful
for hazard observers and analysts to reports to hazard

management during the active reaction phase.
High-rate, medium-amount communication among a few
partners will be possible by radio or telephone links. They
should be used by the hazard management to communicate
with hazard observers/analysts, with the hazard-combating
services in the active reaction phase, and with the authorities in
the passive reaction phase.
Medium-rate, high-amount communication among few partners
may be done by couriers or, better, future ISDN systems. They
are to be used for communication between hazard management
and authorities in the active reaction phase.
Medium-rate, medium-amount communication between hazard
management and authorities, with a large number of partners,
poses the greatest problem, not in the technical sense proper
but rather in the sense of organizing it. A possible solution for a
quasicommunicational system, including telephone links
leading to the hazard management centre and to the authorities,
and from there to the next radio station, the information of
general interest to be broadcast from there, has been mentioned
above. Still, newspapers appear to be too slow a way for mutual
communication.
High-rate, low-amount communication addressing a large
number of people appears to be provided best by sound signals
of low information content, i.e. sirens, whistles, bells (the use of
the latter is, however, not recommended, as they are reserved
for religious purposes and not all people are used to paying
heightened attention to them). They will be used for basic alert
signals.
The question may be raised of whether one should combine the
hazard alarm systems for the passive and the active reaction stage
into a maximal hazard communication system (cf Fig. 2). The
answer is no because, for most of the links, there is a strong time
dependence of needs that are best served by different systems,
with the exception of the link between hazard management and the
authorities which may be served now by radio intercom, in the
future with preference for ISDN
5.3
Passive reaction alarm systems
5.3.1
Links from hazard management or authorities to the
public
For reasons of reliable decoding, as feedback will not be feasible
for most of the people concerned, alert signals should be coded as
simply as possible. A single-information alert system, i.e. one that
conveys just the information danger, may be appropriate for
warning the public in a first step, as this will, if necessary in
combination with the appropriate training of local people, suggest
the proper immediate action to protect themselves.
FIG. 2. Maximal hazard communications system characteristics.
The requirement for a warning system that reaches more or less

all people concerned in time with unambiguous messages leads to
recommending the simple siren whose range of signals may be
restricted to:
permanent continuous or oscillating sound as long as the cause
for danger is in effect;
some kind of short all clear, e.g. three long pulses.
For testing purposes, the all clear signal may be fired every now
and then, even without announcement. It is a very important
principle to make sure that the alert signal proper should never be
fired just for test purposes. In some countries, the rather frequent
firing of the whole alarm sequence for the sake of technical testing
bears the risk of blunting the instrument; people tend to ignore
the alarm signals.
If one wants not only to convey the danger information but also
to provide more, this will raise the task of more elaborate coding
(and decoding). An example of a code of proven efficiency is the
Morse code. It contains four elements (the two significant ones
being short pulse and long pulse, and the short and long pauses
used for separation of the elements and signs) that are easily
transferred with few errors. The problem then is the training
needed to decode the information; this is high for radio amateurs,
but there are probably not many who still remember the Morse
code they learnt with the boy scouts, except for the SOS code:
short, short, short, long pause, long, long, long, long pause, short,
short, short. In addition, there is the problem of repeating the
message on short terms in order to reach even those who did not
get it the first time and to permit them to log in and get the whole
message.
So what appears to be possible is to code the information in
short sequences of, say, up to three elements per sign. In order to
decode unambiguously short pause and long pause, singleelement signs shall not be allowed, each sign denoting precisely
one message. The successive elements may be given
mnemotechnically easy meanings, e.g. the first element indicates
the time for reaction (short/long), the second element indicates
the distance to the hazard (short/long), one extra sign (e.g. three
long pulses) means all clear. This means that, in order to be
decoded fast and reliably, the decoding help information that
must be present in memory should be as simple as possible.
The siren does not appear appropriate here because of its
limited potential to transfer more than the most simple signals in
the short time required. Thus, for this case, another instrument
such as a sonore whistle will be better suited. Incidentally, this
kind of instrument is used by vehicles such as railway engines
and ships, e.g. in foggy weather when short message transmission
and reaction time is important. These whistles have proved to be
very reliable.
Even if a whistle for the transfer of complicated signals is
applied, it is useful anyway to provide for siren signals as the
basic alarm. This yields a unified alarm system for general use
and a superposed special system for special use. What adds to it

is the notion that the whistle may be tested apart from the general
alarm system, just by cutting the sirens, without the danger of
misunderstandings. A slight problem exists with the reliability of
this more complicated alarm system. On the other hand, this
system will drastically reduce the probability of false alarm.
An important aspect should be observed. As most people are
equipped with radio and TV, it should be obligatory to cut any
radio/TV programme in the alarmed area in favour of the
transmission of information relating to the alarm and the incident
causing it. Blocking radio/TV transmissions in favour of alarm
messages is recommended in order to inform people
comprehensively, to relieve the telephone system, and to create
general confidence in the efficiency of the alarm system.
5.3.2
Links from hazard observers to hazard management
and authorities
In principle, the hazard management and the authorities will need
high-rate, but only medium-amount, information channels in
order to decide upon the alarm message to the public. The
number problem will not play the same rule as with the informing
of the public; however, there may still be the problem of
simultaneously processing information from several sources. A
couple of telephone lines leading to the hazard management
centre as well as leading to the authorities will probably be
sufficient for the purpose of passive reaction. The links from
sensors may lead decentrally not farther than to the local control
centres on site, where the signals should be interpreted first by
human observers/analysts.
5.4
Active alarm reaction systems
5.4.1
Links between hazard observers/analysts and
hazard management
The rate and amount of information necessary in order to decide
upon the most appropriate action may be enormous, particularly
with industrial hazards, because of the sometimes rapid evolution
of incidents. The widest high-speed information channels required
for hazard management are TV channels, the next best solution

being radio or mobile telephone. So it may be a good idea to equip
the observers/analysts with light video cameras to transmit
images from the hazard site to the hazard management centre.
How can this information be reliably transmitted to the hazard
management centre (and, for reasons of confidentiality, to nobody
else)? One idea is to install a firm-based monitoring, alarming and
guiding system within the firm, using microphones, cameras and
loudspeakers. This will probably raise suspicions that the system
might be used for other watching purposes as well; it appears that
this will argue against such a system. Besides, it has the
drawback of being a rather rigid, additional system that requires
intensive care. Another conception might consist in using the
electric power lines for transmission; they will provide the power
necessary to drive the high-rate, high-information communication
system, and they are available on virtually any spot of the plant.
The configuration of such a system might then look like this: a
portable video camera with a microphone will transmit with weak
power to a local transponder/digitizer that is plugged into the
next socket, from where transmission goes via the lines of the
electric power system to the hazard management centre which is
equipped with a corresponding receiver/decoder. The link back
may be provided just by conventional radio to a receiver with the
observing personnel on site. It is felt that such a system would
provide for optimal flexibility, combined with guarding the
confidentiality of industrial information.
5.4.2
Links from hazard management to hazard-combating
services
The hazard-combating services, i.e. in most cases the fire services,
need portable means of intercommunication. Short-wave
intercoms or mobile telephones should be best, since fixed
telephone and video lack the portability required for the operating
(and not just observing and analysing) personnel.
5.4.3
Links between hazard management and authorities
The authorities may want elevated amounts of information, but
will not need it immediately. A special telephone line, maybe in
combination with a future ISDN, should be sufficient for most
purposes. More than that, a future ISDN system is expected to be
particularly suited just to the needs of medium-rate, high-amount

data transmission such as for the communication between hazard
management and the outside, making other communication links
more or less obsolete. It will be the favourite future link between
them. Remote radio/TV links, possibly via satellite, may be
considered if the hazard management is located far from the site
of the incident; in the case of industrial hazard, the management
will usually be near the site and thus not need remote links.
5.4.4
Links between hazard management or authorities
and the public
An idea for a quasi-commutational system has been described
above. It is assumed that the industrial hazard management
should have access to the authorities public alarm system in order
to fire the alert signal if need be. The probability of misuse
appears to be minimal.
6
CONCLUSIONS
In this paper, it is suggested that sociological aspects be
increasingly considered when planning industrial hazard alarm
systems. It is important that this should include the close
cooperation of industrial systems and of the authorities as well as
the information policy towards the public, and that the technical
systems are designed according to the needs of those.
Regarding new communication technologies, the coming
appearance of wide-channel telephone (ISDN) technology will offer
a good opportunity to reshape the communication systems among
the hazard management, hazard-combating services, and the
public authorities towards better efficiency. However, for the
purpose of triggering the alarm and of setting the passive reaction
system into action, the existing means of sirens, whistles and
radio/TV appear to be sufficient if properly organized.
CONCLUDING SESSION
Panel Discussion and Conclusions
Chairman: R.W.KAY
Formerly Health and Safety Executive, UK
Panel members: P.BOISSEAU, France
H.B.F.Gow, CEC
J.HEFFERNAN, Ireland
E.L.QUARANTELLI, USA
H.SCHNADT, FRG
B.WYNNE. UK
36
Summary of the Concluding Session
ORGANISATIONS IMPLEMENTING EMERGENCY

PLANNING
In the first session, papers were given on the organisational
aspects of emergency planning for chemical accidents in
Germany, Italy, UK and France. Within these countries there were
significant differences in the way responsibilities had been
allocated between various authorities. Three countries had already
implemented laws which dealt specifically with the Seveso
Directive but Italy as yet did not have such a law and was dealing
with the matter through a number of administrative measures in
which a network of ministries and organisations was involved.
Within most countries, a framework had already existed for the
tackling of emergencies, and the introduction of the Seveso
Directive had drawn further attention to the industrial sites which
presented major accident hazards. In such situations, the first
step was the identification of the hazard, followed by an
assessment of the consequences of possible accidents and then
the drawing up of emergency plans which could mitigate these
consequences, both on- and off-site.
In Germany, problems had been identified in some instances in
producing site-specific emergency plans, particularly in rural
areas, and this had led to proposals for amendments to the
regulations and for the preparation of further guidance. In France,
there was a considerable history of emergency planning for
industrial establishments, and the organisation and means
necessary had to be specified. This led to proposals for on-site
plans (POI) which were the responsibility of the manufacturer, and
off-site plans (PPI) which were drawn up under the authority of
the Prefect. In the UK, the responsibility for off-site planning had
been given to the local authority at county or equivalent level.
CONCLUDING SESSION 351
Although there were different legal backgrounds and

organisational structures in these countries, emergency planning
had been organised to produce the same positive effects.
Implementation of the requirements of the Seveso Directive was
easier in cases where there was already a suitable framework in
existence.
ON-SITE AND OFF-SITE EMERGENCY PLANNING
DESIGN
In the discussions of the design of emergency plans, there was a
general convergence of points of view. Some differences did emerge
in the approach of different countries, although these were more
of a practical than a fundamental nature.
The first stage was the preparation of an accident scenario
which determined the type of warning system, the level of
resources required and the amount of coordination that was
necessary. There were many difficulties in predicting the
consequences of accidents, and this was an area in which further
work was in progress. It was stressed that plans must be flexible
and well defined. When a major emergency occurred, the first need
was for a rapid response, and plans should therefore be as simple
as possible.
In the design of emergency plans, an essential feature was the
definition of the people who had to carry out various functions, and
the thorough training of those people in their roles. It was also
necessary to define the type of cooperation that was required, in
particular between industry and the authorities. Two particularly
important roles were identified: the operational controller who is
responsible for the direct response to the incident, and the
coordinator who ensures liaison with outside bodies.
Particular stress was laid on the need for effective
communications to factory personnel, between authorities, to the
outside public and, also very important, to the media.
Finally, there was the need for realistic exercises to check the
design of the plan and to ensure that it was kept up-to-date. In
this way, the roles of the participants and the overall experience
could be evaluated.
EXERCISES AND AUDITING OF EMERGENCY
PLANNING
Throughout the conference, it was emphasised that an emergency
plan that is placed on a shelf to gather dust is worthless and that
there must be effective exercising and review of these plans.

During the discussion of these particular aspects, both theoretical
and practical considerations were addressed.
Examples were given of theoretical models that could be used to
evaluate the effectiveness of existing plans, and to simulate the
results of an exercise. Modelling could also be a useful tool in
designing practical exercises.
It was an essential part of emergency exercises that they should
be drawn up with clear objectives in mind. Table-top exercises
provided a useful way to test procedures, but practical exercises,
which involved moving men and equipment, should also be carried
out. As a result of exercises, faults had been revealed; these
included the non-availability of key personnel, alterations in
telephone numbers, defective equipment, and a lack of
understanding of the roles of others. During the initial stages, the
sequential telephoning of key personnel took time; in some cases
it had taken up to an hour to get management staff members to
their posts. There was also the danger of overloading
communication systems. One consequence of the need for
immediate response, and the lack of immediate availability of
some personnel, meant that units would initially operate with only
50% of their manpower. Once the exercise had been completed, it
was most important to evaluate the experience that had been
gained and to assess the performance of the participants,
particularly those in key positions.
In the course of this session, two issues with general
implications were also discussed. There was the need to provide
the emergency services with information so that they could
instantly identify the dangerous substances involved and their
possible effects. The other question related to evacuation. When
and how to evacuate would always prove a difficult problem. Often,
the safest procedure for the public was to remain indoors with
doors and windows shut, and the point was made that evacuation
should only be considered as a last resort.
TECHNIQUES FOR EMERGENCY PLANS
The great interest in the application of techniques for emergency
plans was reflected in the range of discussions in this section.
There was considerable interest in the use of computers as tools
for planning and protection activities. An overview was also given
of the possibilities and limitations of expert systems and other
artifical intelligence methods. Finally, technical data were provided
from which the hazards presented by industrial installations could
be assessed; from this information, the need and extent of

emergency planning could be determined.
Computers and modern information techniques provided a wide
range of applications, and examples were given of off-line
programmes that had been developed for risk analysis, storage
and retrieval of information, and also for developing the
background for accident scenarios as a basis for planning for
emergencies. A more direct application lay in on-line systems for
computerised alerting systems, assessing the actual extent of an
incident using data from atmospheric sampling/meteorological
measurements, and assessing the possible consequences of
emergency measures.
Because of the rapid nature of the development of major
emergencies, questions were raised as to the availability of
computers and measuring devices in the early stages. With fixed
installations, one solution might be to collect data by means of
permanent monitoring systems.
There was rapid development in the field of information
technology as systems achieved greater and more rapid response
and more flexibility. With respect to the application of expert
systems, it appeared that their use for support of the decisionmaking process in emergencies is premature. However, promising
lines of research were being pursued. There would also be further
opportunities to develop the use of modern information technology
and computerised tools in evaluating problems and assisting in
their solution.
LESSONS LEARNT FROM EMERGENCY
MANAGEMENT OF MAJOR INCIDENTS
The lessons learnt from major incidents were of two kinds: those
related to a specific emergency and those where the lessons could
have a much wider application. Indeed, it was pointed out that the
study of incidents in fields other than industrial hazards would
often establish repeat patterns. In order that a correct
interpretation of these events could be made, it was necessary to
establish a suitable framework for comparison. There was also a
need to ensure that information from the lessons would reach the
people who were most in need of it.
A study of major incidents in America had emphasised the
importance of considering emergency planning as a process. This
led to a deeper understanding of the phenomena arising in
disaster situations and would enable emergency managers to cope
with unforeseen configurations. Unexpected events often occurred
in the crisis phase of disasters; a robust overall plan was needed

which could be applied to these situations.
Examples were given of the way in which post-mortems on
specific incidents had led not only to proposals for technical
improvements but also to the consideration of wider issues, such
as the organisation of the emergency services. In some cases,
because of a poor and confused response to an emergency,
changes had been made to local authority organisations. In
extreme cases, the severity of a major incident could be such that
action was decided on a national level and could lead to changes
in the law dealing with industrial installations.
INFORMATION TO THE PUBLIC PRIOR TO AND
DURING AN EMERGENCY
In the Seveso Directive, Article 8.1 requires that persons liable to
be affected by a major accident be informed in the appropriate
manner of the safety measures and the correct behaviour to adopt
in the event of an accident. There was considerable concern from
industry initially that the provision of this information could cause
unnecessary public alarm. However, experience has shown that
this was not the case and that the public was more realistic about
the appreciation of risks than had generally been believed.
There were a number of areas in which information was
necessary: the need to alert people that they lived near an
industrial activity with the potential to cause a major accident, the
nature of the hazard that could be presented, and the type of
action that should be taken in the event of an emergency. One
result of this process was that industry had found that it paid to
be as open as possible, and it was suggested that, while no
attempt should be made to conceal the hazard, attention should
also be drawn to the efforts that had been made to ensure that the
plant operated safely and, indeed, to stress the economic benefits
provided by the installation. Relationships with the media were
also very important, particularly to prevent misinformation during
an actual incident.
There were different ways in which information could be
supplied but they all should be aimed at clarity and simplicity. It
had been found that there was a much greater impact if personal
contacts were made.
A review was also given of the requirements for alarm systems.
During an actual emergency, it was accepted that radio provided
the best means of communication but there was some difference of
opinion about the effectiveness of loudspeaker vans.
Finally, if an evacuation was required, it would be necessary to

explain to the public the necessity for this step and the facilities
that were available.
SUMMARY AND CONCLUSIONS
The conference has shown that there is worldwide interest in
emergency planning. This was reflected in the number of papers
from different countries and in the information that was presented
and discussed. There is basic agreement on the approach to
emergency planning but some practical differences are inevitable
owing to different national structures.
The presentations showed that some common problems exist.
For example, there are difficulties in predicting the consequences
of an accident and hence the area likely to be affected in an
emergency. Also, the very nature of an emergency plan can require
quite complex relationships between manufacturers, emergency
services and local authorities. The involvement of the public can
also present difficulties.
One of the common themes of the conference was the need to
continue working on the improvement of emergency planning
systems. This leads to some general conclusions:
(1) The problem of communication with the public deserves
further debate. The content of the communication and the means
of its transfer to the media should be further investigated. It might
be food for thought to consider the organisation of a special
workshop to cover these points.
(2) There is a need to continue to exchange information and
experience on emergency planning. The conference provides a
good example, and the Commission (DG-XI) should consider how
to build on the work in progress.
(3) The establishment of general guidelines would be beneficial.
This work could draw on the experience of countries with
advanced emergency planning systems and lead to a consistency
of approach. Such a device could prove particularly useful in
situations where sophisticated resources are not always available,
for example in small factories, in some types of storage and in
rural areas. The framework so created could also provide useful
information for installations that fall outside statutory
requirements. However, there are some issues that need to be
further investigated before formalising guidelines, in particular the
relation between the content of a safety report and emergency
planning, especially those linked with the development of probable
or worst case scenarios and consequently preparedness, when and
how to evacuate, integration of plans from other plant in the

vicinity, safety distances and allowable doses, available monitoring
and alerting systems, existing expert and data base resources,
etc.
(4) The progress occurring in the field of advanced informatic
tools should be carefully followed and encouraged. It is to be
hoped that, in the near future, user-friendly informatics for use in
emergency management will reach maturity and hence play an
important role in this and other related fields.
LIST OF PARTICIPANTS
Amendola, A.
CECJRC Ispra
JRC Ispra Establishment
Ispra
Varese
Italy
Ancarani, A.
CECDG XVII
200 rue de la Loi
Bruxelles
Belgium
Ancillotti, P.
Via Luigi Settembrini 52
Milano
Italy
So Paulo
Brazil
Avouris, N.
CECJRC Ispra
Ispra
Varese
Italy
Bardolet Casellas, J.
Direccio General de Provencio
Via Layetana 69
08003 Barna
Spain
Andersen, V.
RISO National Laboratory
4000 Roskilde
Denmark
Barone, D.
ENICHEM Anic
Piazza Boldrini 1
20097 S.Donato Milanese
Milano
Italy
Arioli, G.
SNAM Progetti
S.Donate Malanese
Milano
Italy
Baun, A.
Danish Police
Ridderstraede 1
2100 Copenhagen
Denmark
Arpe, F.L.
Danish Civil Defence and
Emergency
Planning Agency
18 Vordingborggade
2100 Copenhagen
Denmark
Bellamy, L.
TECHNICA Ltd.
Lynton House
712, Tavistock Square
London WC1H 9LT
UK
Aventurato, H.
CETESBEnvironment Ag.
Av. Prof. Frederico Hermman
Jr., 345
Bellamy, S.
St.Giles College
16 Northumberland Avenue
London WC2 5AP
UK
358 LIST OF PARTICIPANTS
Bernard, P.
BEFA GMBH
Postfach 8901
5030 Huerth
FRG
Binetti, L.
Ministero Sanit
Via Liszt 34
Roma
Italy
Civil Defence Corps

18 Vordingborggade
2100 Copenhagen
Denmark
Bressan, L.GRENFIL
Via Emillia Ponente
Imola
Italy
Birden, J.
Inspection du Travail
26 rue Zithe
Luxembourg
Brynjulusen, J.
Norwegian Petroleum
Directorate
PO Box 600
4001 Stavanger
Norway
Blok, M.
Province of South-Holland
Konigskade 1
2596 AA The Hague
The Netherlands
Caputo, G.
ROHM and HAAS Italia SpA
Via V.Pisani 26
Milano
Italy
Bo, E.
Ass. Europeenne Gas Liquefile
Paris
France
Caroselli, R.
Ministero Sanit
Via Listz 34
Roma
Italy
Boato, P.
Centre Italiano CTL
Corso Venezia 37
Milano
Italy
Boisseau, P.
Ministry of Environnement/
DRIR
84 rue de Faretra
Toulouse
France
Boissieras, J.
RHONE POULENS
TcL 129 rue Servient
69398 Lyon
France
Bork Kristoffersen, K.
Carrasco Arias, V.
Gobierno Civil Protec. Civil
Avda Marques de la Argentera
S/N
Barcelona
Spain
Casarino, S.
AGIP Raffinazione ENI
Piazza Della Vittoria 15
16121 Genova
Italy
Cassidy, K.
HSE
Room 405Magdalen House
HSE
Stanley Precinct
LIST OF PARTICIPANTS 359
Bootle
Merseyside
UK
Chiesa, G.
AGIP Raffinazione SpA
S.S. 33 del Sempione
20017 Rho
Milano
Italy
Cipolla, F.
Ministero Protezione Civile
Via Ulpiano 11
Roma
Italy
Clausen, B.O.A.
Topsikring A/S
4 Borupvang
2750 Ballerup
Denmark
Consolini, L.
SAGERI
2 rue Ancelle
95521 Neuilly-sur-Seine
France
Cooney, W.
Cleveland County Fire Brigade
Endeavour House
Stockton Road
Hartlepool
Cleveland TS25 5TB
UK
Corigliano, L.
MONTEDIPE SpA
Via Rosellini 1517
20124 Milano
Italy
Corti, F.
Gruppo LEPETIT
Via G.Murat 23
20159 Milano
Italy
de Marchi, B.
Inst. of Int. Sociology
Via Malta 2
3417; Gorizia
Italy
de Palma, G.
Vigili del Fuoco
Via Valleggio 15
Como
Italy
de Witt, H.
BRENK SYSTEMPLANUNG
Heinrichsallee 38
5100 Aachen
FRG
del Bino, G.
CECDG XI
200 rue de la Loi
Bruxelles
Belgium
Dickie, T.
CEFICBP Chemicals Limited
Boness Rd
Grangemouth
Stirlingshire
Scotland
Egidi, D.
Regione Emilia Romagna
Via dei Mille 21
Bologna
Italy
Essery, G.
ICI Safety & Environm.
Department
ICI PO Box 8
Billingham
Cleveland
UK
Fary, R.
Energiesystem Nord GMBH

Walkerdamm 17
2300 Kiel
FRG

Jr., 345
So Paulo
Brazil
Feliu, M.
Generalitat de Catalunya
C/Via Layetana 69
Barcelona
Spain
Genesco, M.
Ministry of the Interior
1 Place Boauvau
Paris
France
Filippelli, G.
ENEL
CEN E.Fermi
Saluggia
Italy
Gilby, E.V.
Electrowatt Engineering
Services
Stanford House
Garrett Field Science Park
South Birchwood
Warrington
Cheshire WA3 7BH
UK
Folino, M.
DATAMAT SpA
Via Simone Martini 126
Roma
Italy
Fox, R.
FIAT Engineering-Torino
c/o Ministero Protezione Civile
Via Ulpiano 11
00193 Roma
Italy
Galvan, D.
CRE Casaccia
SP Auguillarese 301
00060 S.M.di Galeria
Roma
Italy
Garay Unibaso, L.A.
Altos Hornos de Vizcaya
C/Carmen 2
Baracaldo Vizcaya
Barcelona
Spain
Garcia, F.
CETESB
Gilby, P.M.
GILBY Associates
Nethertoun
Glebelands Road
Knutsford
Cheshire WA 16 9DZ
UK
Ginex, G.
Comando Prov.le VV.F.
Via Gregorio XVI 3
32100 Belluno
Italy
Ginnity, B.
Bruel & Kjaer A/S
2850 Naerum
Denmark
Giocoli, R.
AGIP Petroli SpA
Via Launentina 449
00142 Roma
Italy
Gomes da Silva, M.E.
Direccae Geral da Industria

Av. Cons. Fernando Sousa 11
Lisboa
Portugal
Gow, H.
CECJRC Ispra
21020 Ispra
Varese
Italy
Graziano, A.
Ind. Chim. FRANCIS SpA
Via Origgio
Caronno P.lla
Varese
Italy
Greenhill, J.
North East Thames Regional
Health
Authority UK National Health
Service
Addison House
3243 Chart Street
London NI 6GP
UK
Gremmen, J.
Dow Chemical Europe Sa.
Aert Van Nesstraat 45
The Hague
The Netherlands
Grollier Baron, R.
Inst. Franais du Ptrole
BP3
69390 Vernaison
France
Guerrini, V.
NIER
Via Stefano
Bologna
Italy
Gullo, F.
Industria Italiana Petroli
S.S.Jonica
74100 Taranto
Italy
Haddad, E.
CETESB Environment Ag.
Jr., 345
So Paulo
Brazil
Heffernan, J.
Department of Labour
Mespil Road
Dublin, 4
Ireland
Heffernan, M.
ASAHI Synthetic Fibres
Killala
Co. Mayo
Ireland
Hesel, D.
TUEV Rheinland
Postfach 101750
5000 Koeln 1
FRG
Holt, E.
Norsk Hydro AS
PO Box 646
5001 Bergen
Norway
Holtbecker, H.
CECJRC Ispra
Ispra
Varese
Italy
Honan, M.
ASAHI Synthetic Fibres
Killala
Co. Mayo
Ireland
Johansen, P.
Statens Brnadinspektion
Kongevejen 207
Copenhagen
2830 Denmark
Kahl, H.
Linde ag Industrial Gas Div.
Seitnerstrasse 70
8023 Hoellriegelskreuth
FRG
Kal, E.
Konigskade 1
2596 AA The Hague
The Netherlands
Kay, R.
(formerly Health and Safety
Executive, London)
Cotswold
St. Johns Close
Penn
Bucks HP10 8HX
UK
Lepore, L.
ISPESL
Via Urbana 167
00184 Roma Italy
Loprieno, N.
Universit di Pisa
Via Damiano Chiesa 5
56100 Pisa
Italy
Lucchini, L.
FAI
Via Cardano 8
Milano
Italy
Macchi, G.
USSL 68 Rho (MI)
Via Galdino da Varese 27
Varese
Italy
Madsen, F.
BRUEL & KJAER A/S
Naerum Hovedgade 18
Copenhagen
2850 Denmark
Lambardi, L.
ANSALDO SpA
Via DAnnunzio 113
Geneva
Italy
Mancini, G.M.
Dipt. Protezione Civile
Ufficio Procivil. Ind.
Via Ulpiano 11
Roma
Italy
Lanzino, M.
ICARO Srl
Via Sonnino 9
Pisa
Italy
Mangialavori, G.
ENEADISP
Via V.Brancati 48
Roma
Italy
Leonardini, L.
ETS
Via Cisanello 32
56100 Pisa
Italy
Mammone, I.
Vigili del Fuoco
Via Gnocchi 22
Como
Italy
Marangoni, G.
DNS SpA
Via Nazionale 59
Merano
Italy
TECHNICA Limited
Lynton House
712 Tavistock Square
London WC1H 9LT
UK
Marchant, T.
Emergency Planning Advisory
Committee
590 Jarvis Street
Toronto
Ontario
Canada
Melis, M.
EDRA Srl
Via Gradisca 8
20151 Milano
Italy
Marchionne, E.
Ministero degli Interni
Via De Pietro
Roma
Italy
Mariano, J.A.M.
ISOPORCa. Portuguesa de
Isoc.
Apartado 30
3861 Estarreja Codex
Portugal
Marlier, G.
ELF France
2 Place de la Coupole B. 24D03
Cdex 45
92078 Paris La Defense
France
Marshall, V.
5 Ivy Road
Shipley
West Yorks,
UK
Mattia, G.M.
BRUEL & KAER
Viale U.Tupini, 116/2
001444 Roma
Italy
Max-Lino, R.
Mellin, B.
BPCI
80 New Forest Drive
Neath
UK
Michell, P.D.
UKAEA Srd
Wigshaw Lane
Culcheth Warrington
Cheshire
UK
Milone, I.
AGIP Petroli SpA
Via Laurentina 449
00142 Roma
Italy
Mocke, F.
ESCOM
PO Box 1091
Johannesburg
South Africa
Montini-Trotti, M.
ENEA (Dir. Studi)
V.Regina Margherita 125
00198 Roma
Italy
Mostarda, M.
FLEXA SpA
Via Custodi 25
Italy
Mueller, G.
Rheinisch Westfaelischer
Technischer
Ueberwachungs-Verein
Steubenstrasse 53
4300 Essen 1
FRG
Neuhoff, S.
Cologne Fire Brigade
5000 Koeln 60
Scheibenstr. 13
FRG
Nicolau, J.
Servigo Nacional de Proteccao
Civil
Rua de Bela Vista Lapa 57
Lisboa
Portugal
Nivolianitou, Z.
Ministry of Housing &
Environment
Athens
Greece
Odou, M.
Min. Van De Vlaamse
Gemeensch.
Belliardstraat 18
1040 Bruxelles
Belgium
Olivier, P.
VINCOTTE
Avenue du Roi 157
1060 Bruxelles
Belgium
Olivieri, M.
DATAMAT SpA
Via S.Martini 126
00143 Roma
Italy
OReilly, C.
London Fire and Civil defence

Authority
20 Albert Embankment
London SE1 7SS
UK
Paesler-Sauer, J.
Kernforsch. Zentrum Karlsruhe
7500 Karlsruhe
FRG
Paranhos Teixeira, A.
Civil Protection Nat. Service
Rua da Bela Vista Lapa 57
Lisboa
Portugal
Pares, X.Cap. del Servei
dOrdenacio
i Seguretat Vial Ajuntament de
Barcelona
Av. Portal de lAngel 8
08002 Barcelona
Spain
Pesarini, M.
GALSTAFF Ind. Ch. SpA
Via Stazione 90
Mornago
Varese
Italy
Picciolo, G.
ENICHEM
S.Donate Milanese
Milano
Italy
Pietersen, C.M.
Society TNO
Aeldoorn
The Netherlands
Poli, U.
ISPESL
Via Urbana 167
00184 Roma
Italy
Pozzi, D.
Ass. Ind. Varese
Piazza Monte Grappa
Varese
Italy
Pruess, M.
Dow Chemical GMBH
PO Box 1120
2160 Stade
FRG
Pucciarelli, L.
ENEADISPARASCA
Via C.Brancati 48
00144 Roma EUR
Italy
Quarantelli, E.
Disaster Research Center
University of Delaware Newark
Delaware 19716
USA
Raadsen, W.
SHELL Int. Petr. My.
PO Box 162
2501 AN The Hague
The Netherlands
Ribeiro de Almeida, A.
National Fire Service
Rua Julio De Andrade 7
Lisboa
Portugal
Ricchiuto, A.
ENEADISP
Via V.Brancati 48
Roma
Italy
Rossi,F.
F.lli Lamberti SpA
Via Piave 18
Albizzate
Varese
Italy
Rubino, F.
SNAM Progetti
S.Donato Milanese
Milano
Italy
Rueda, S.
Cap. Unitat Operativa de Gestio
Ambiental Ajuntament de
Barcelona
Pg. Circumval.laci 1
08003 Barcelona
Spain
Sacchetti, R.
Comandante Vigili del Fuoco
Via Legnani
Varese
Italy
Saltroe, P.
Norwegian Petroleum Director
PO Box 600
4001 Stavanger
Norway
Samain, A.
Min. Sant Publ. & Envir.
Bruxelles
Belgium
Schlanbusch, F.
Norsk Hydro SA
PO Box 646
5000 Bergen
Norway
Schnadt, H.
TUEV Rheinland
Postfach 101750
5 Koeln 1
FRG
Schouteten, L.M.E.
DSMCVMD
PO Box 603
6160 MH Geleen
The Netherlands
Selig, R.
Cons. Engineers & Planners A/
S
Houedgaden 2
PO Box 51
Birkeroed
Denmark
Semprini, F.
SNAM Progetti
V.A.De Gasperi 16
S.Donate Milanese
Malano
Italy
Serafini, A.
Via Bordoni 4
Milano
Italy
Serafini, S.
Comando Prov.le Vigili del
Fuoco
Via Gregorio XVI 3
32100 Belluno
Italy
Sesenna, F.
ENICHEM Agricoltura
VIA Medici del Vascello 26
Milano
Italy
Siegmund, H.
Ministerium des Innerns
Schillerplatz 35
6500 Mainz
FRG
Sigales, B.
Univ. Politecnico Catalunya
Av. Diagonal 647
08028 Barcelona
Spain
Singleton, B.
Dow Chemical Company
Kings Lynn
Norfolk PE30 2JD
UK
Smyrniotis, T.
CECDG XI
200 rue de la Loi
Bruxelles
Belgium
Stallen, P.J.
TNO
PO Box 541
Appeldoorn
The Netherlands
Steininger, S.
Dornier System GMBH
PO Box 1360
7990 Friedrichschafen
FRG
Steur, W.
Bayer AG
Fackbereich Brandschutz
D5090 LeverkusenBayerwerk
FRG
Tasias, A.
Tema-Terr.y Medio Ambiente
S.Juan De La Salle 6
08022 Barcelona
Spain
Testori Coggi, P.
CECDG XI
200 rue de la Loi
Bruxelles
Belgium
Toft, B.
University of Exeter
Department of Sociology
Amory Building
Exeter
UK
Via Desenzano 17
20146 Milano
Italy
Tognoli, M.
ORSA
Via Colombo 60
Gorla Minorc
Italy
Vallmes Rodoreda, M.
INKE SA
Po. Ind. Can. Pelegri
Barcelona
Spain
Tominez, M.
SNAM Progetti
S.Donate Milanese
Italy
Van den Brand, D.

Konigskade 1
2596 AA The Hague
The Netherlands
Tuite, R.
Calor Teo. (LP Gas)
Longmile Road
Dublin, 12
Ireland
Tuohy, B.
Department of Environment
Custom House
Dublin, 1
Ireland
Turner, B.
University of Exeter
Department of Sociology
Amory Building
Exeter
UK
Ulrici, W.
ECO Consult
Bluecherstr. 13
5300 Bonn 1
FRG
Uth, H.J.
Umweltbundesamt
Bismarkplatz 1
1000 Berlin 33
FRG
Valerio, E.
USSL 68 Rho (MI)
Van der Hooft, M.

AKZO NV
PO Box 186
6800 LS Arnhem
The Netherlands
Van der KOOI, H.O.
Ministry of Social Affairs and
Employment
DG of Labour
Balen van Andelplein 2
NL2273 KH Voorburg
The Netherlands
Van Duin, M.
Research University Leiden
Rapenburg 59/2311
GY Leiden
The Netherlands
Van Leidekerke, M.H.
CECJRC Ispra
Ispra
Varese
Italy
Vassilopoulos, M.
Ministry of Envir.
147 Patission Str.
Athens
Greece
Versino, B.
CECJRC Ispra
Ispra
Varese
Italy
Versteeg, M.G.
Ministry Vrom
Drvd Stamstraat 2
Leidschendam
The Netherlands
Villanueva Munoz, J.L.
Jefe Servicio Prot. Civil
C/Caballeros, 92c
Valencia
Spain
Volpe, F.
TOP Srl
Via San Lorenzo 129
16123 Geneva
Italy
Volta, G.
CECJRC Ispra
Ispra
Varese
Italy
Wallace, W.
Rensslaer Polytechnic Inst.
110 Eighth Street
Troy NJ
USA
Wendler, E.
CECJRC Ispra
Ispra
Varese
Italy
Wynne, B.
University of Lancaster
Lancaster LA1 4YN
UK
Zanarelli, G.C.
Stone-Webster
V.le Regina Margherita 11
Monza
Milano
Italy
Zanelli, S.
Universit di Pisa
Via Diotisalvi 2
56100 Pisa
Italy
Zani, F.
Syreco Srl
Via Roma 1
Besozzo
Varese
Italy
Zanuzzi, G.
ENEL
Via F.Ferrara 36
Roma
Italy
Zappellini, G.
NIER Bologna
Via S.Stefano 16
Bologna
Italy
Zaro, G.
CEDA Srl
Via Cagnola 29
Gazzada
Varese
Italy
Index
Accident inquiries, 298, 299301

Accidents, emergency action for,
234
Act on Calamities, 93
Adiabatic Expansion, 118
Advisory Committee on Major
Hazards, 33, 206
Alarms, 151, 152, 1557, 160, 332,
34356
active reaction, 3546
basic goals and models, 345
basic principles, 34951
links between hazard
management and authorities,
355
management or authorities and
the public, 356
observers/ analysts and hazard
management, 3545
links from hazard management
or authorities to the public, 352
4
links from hazard management
to hazard-combating services,
355
links from hazard observers to
hazard management and
authorities, 354
passive reaction, 3524
procedures, 967
semantic aspects, 343, 34556
sociological aspects, 343, 3469
technical design, 34956
technical options, 3512
Alert schedules, 91
Ammonia, 108, 118, 197
Appropriate information, 325
April Storm, 69
ARIES Emergency Centre, 12930
Artificial intelligence, 1712
Association of Civil Defence and
Emergency Planning Officers, 40
Auditing, 15563, 3601
Back-distance, 119, 122
Bantry Bay, 205
Basle, 3, 206
Bayer AG, 328
Bhopal, 3, 35, 36, 191, 194, 205,
251, 255, 317, 327
Bromine, 243
Cambrian Colliery, 301
CECOP, 168
CFK, 243
Chemdata, 137
CHEMIC, 22
Chemical agents, 252
Chemical emergencies, 11531,
1679 25173
cross-societal applications, 271
2
impact contingencies, 263
6 Chemical emergenciescontd.
implications of research study,
2701
initial response, 25762
managing responses to, 25572
protection measures, 15960
369
370 INDEX
situational contingencies, 266

70
Chemical engineering, 205
Chemical Industries Association,
64, 136
Chemical industry, 7, 108, 155,
2434, 336
Chemical installations, 8597
Chemical Security Group, 168
Chemical substances, 17, 43, 81,
137
Chemistry, 205
Chemsafe, 136
Chernobyl, 178, 323
Chlorine, 108, 11822, 1247, 217,
218
CIMAH, 34, 36, 63, 70, 83, 137,
206, 208, 21213
Civil defence, 312
Civil Defence Act 1948, 32
Civil Defence Corps, 2756
Civil protection, 268, 2830, 31
Civil Protection in Peacetime Act
1986, 34
Classification Packaging and
Labelling of Dangerous
Substances Regulations 1984
(CPL), 135
Cleveland County Fire Brigade,
13315
Cologne, 74, 15560, 2436, 328
Communication(s), 378, 967,
143, 1512, 299300, 34356
problems of, 1578, 286
Community Awareness and
Emergency Response program,
317
Community disaster preparedness,
2545
Community social organization
patterns, 2534
CONOCO, 69
Control of Major Industrial Hazards
Regulations 1984. See CIMAH
Co-operation, 814
Coordination problems, 2867
County Emergency Planning
Officers Society, 40
Credibility, 3368
Crisis situation, information for,
3382
Dangerous Substances
(Conveyance by Road in Road
Tankers and Tank Containers)
Regulations 1981, 134, 135
Danish National Fire Inspectorate
(DNFI), 162
Dansk Olie & Naturgas A/S
(DONG), 1613
Data banks, 246
Dayton, 252
Decision making, 1589
Decision support systems, 21940
artificial intelligence
approaches, 2224
cognitive control domain, 226
decision sequence, 225
emergency response, for, 1737
framework for analysis and
design of, 2256
implementation of, 22635
management information, and,
21924
management science approach,
220
mental strategies and
heuristics, 226
mitigation resource domain, 227
nuclear power installations, 235
potential risk domain, 227
problem domain, 225, 2267,
234
social science approach, 220
state of the art, 21924
system science approach, 2202
use of problem representation,
2305
Denmark
oil and natural gas
transmission, 1613
oil pollution control, 17581
Dense Cloud Dispersion, 118
DENZ code, 123
Dielheim, 247
INDEX 371
Disaster
Law, 288
management, 2878
preparedness planning, 2525
Prevention Management, 155,
1578, 244
Prevention Plan, 74
Prevention Service, 1557
Research Centre (DRC), 251
Response Act, 88
tourism, 285
DSM, 28392
Dutch Association of Chemical
Industries, 322
EMERCOM, 26
Emergency Control Centre, 659,
211
Emergency Coordinator, 115, 120,
121, 126
Emergency planning, 20812
accidents, for, 234
organisations implementing,
359
Emergency Planning and
Community Right to Know Act,
317
Emergency Planning Authority, 211
Emergency Planning Officer, 38
40, 211
Emergency plans
definition, 47
design of, 203
establishing, 4757
example, 567
external, 214
field of application, 489
manual, 49, 501
recommendations, 526
stages for realisation of, 4950
technique, 3640
techniques for, 3612
Emergency response
decision support for, 1737
to release of toxic substances,
18590
Emergency Services, 6570, 81, 82
ENEA/DISP, 118, 1289

EPDES (Emergency Planning
DESign) code, 2013
Estarreja, 10713
European Commission, 317
European Disaster Medicine
Centre, 41
Evacuation, 912, 97, 1434, 160
Exercises, 38, 834, 97, 11531,
15560, 212, 3601
aim and execution of, 156
Danish oil and natural gas
transmission, 1613
off-site, 10713
on/off site emergencies, 13740
physical-type, 13940
table-top, 138
Expert systems, 1679, 17183,
2224
Explosions, 217, 2456, 2489,
2835, 301
Explosive materials, 207, 210
Exposure area, 3301
Falkirk District Council, 83, 84
Federal Anti-Pollution Act, 88
Federal Republic of Germany
chemical plants, 8592
exercises and auditing, 15560
major accidents, 2439
protection in vicinity of
hazardous plants, 315
safety concept, 912
Feyzin, 285
FIAT-SDT, 22
Fire accidents, 2935
Fire-fighting, 95
Fire services, 327
Fireball effects, 216
Fixed-site situation, 2557
Flammable materials, 6, 118, 207,
210, 215
Flixborough, 33, 36, 205, 283, 288
France, emergency and
intervention plans, 434, 99113
Garmisch-Partenkirchen, 2489
372 INDEX
Gas escape, 1918

GC/MS devices, 186
GEN-X expert system, 179
Grangemouth, 81
Greece, 2935
Hazard
analysis, 39, 36
areas, 78
assessment, 209
containment, 63
definition, 1412
effect, 142
elimination, 63
identification, 1412, 209
level, 119, 120, 121, 122, 125
protection measures, 32733
Protection Plan, 74, 759
reduction, 63
sources, 78, 89
Hazardous activities, risk analysis
of, 1923
Hazardous installations, 208
identification of, 4
notification and survey of, 34
Hazardous materials, 63, 118
transportation of, 134
Hazardous substances, 78, 89, 206
categories of, 69
Hazardous Substances (Labelling
of Road Tankers) Regulations
1978, 135
Hazards, forms of, 90
Health and Safety Executive, 135,
206, 207, 213
Hospitals, 144
Hydrocarbons, 217
Incident
control, 1405
Control Point, 65
Controller, 68, 211
mitigation, 63
procedures, 137
Incompatible land uses, 208
Indian Point Nuclear Power Plant,
179
Industrial Emergency Plan, 937

basic elements of, 94
Industrial Head Coordination, 94
Industrial health service, 96
Industrial risk, 33542
Industrial safety service, 95
Information and Calculation
System, 1978
Information brochure, 331
Information problems, 286
Information requirements, 55, 152
3, 21213, 3312, 33542, 363
Information sources
emergency management
resources domain, 230
potential risk domain, 230
Information systems for emergency
management, 224
Information technologies, 182
In-house operating plan. See Onsite
In-plant incidents, 667
In-plant training, 6970
Internal Plan of Operation (IPO), 47
In-transit incidents, 2557
Italy, monitoring of industrial
activities, 1730
Jet Oil terminal fire, 2935
Kalochori, 2935
Labour Circumstances Law, 288
Labour protection, 288
Labour safety, 288
Ls, 27581
Large inventory top tier sites
(LITTS), 207
Law for Protection against
Catastrophes, 739
Law of Classified Installations, 43
Law on Local Preparation Plans,
288
Learning from disasters, 297313
Legislation, 20518
Leverkusen, 328, 329
Leverkusen Model, 75
INDEX 373
Limburg, 284, 285

Liquefied gas explosion, 2489
Liquefiee gas tanker, 247
Liquefied petroleum explosion, 252
Local Authorities, 64, 65, 128, 144
Local Government Act 1972, 33
Logistics, 378
London Fire and Civil Defence
Authority (LFCDA), 34, 39
LPG, 1918, 215, 2445
Macintosh Filevision, 301
Maintenance, 38
Major Accident Hazards of Certain
Industrial Activities, 317
Major Hazard Regulations, 73, 769
Major hazards, 205
Major Incident Control Committee
(MICC), 814
Major incidents, 679
definition, 82
experience gained, 2439
lessons learnt from, 3623
Major industrial risks, 20518
Manfredonia, 205
Marbon, 288
Markov model, 202
Mathematical models, 167
Media coverage, 144, 318
Methane, 301
Methyl isocyanate, 191, 194
Methyl isocyanide, 35
Mexico, 342
Mexico City, 3, 191, 193, 252
Mitigation, 20813
Mobilization of resources, 253
Mobilization procedures, 967
Monte Carlo techniques, 190, 202
MONTEDIPE, 5962
Nantes accident, 1023
National Agency of Environmental
Protection (NAEP), 275
National Chemical Emergency
Centre, 137
National Toxicity Information
Centre, 96
Natural Gas Coordinating

Committee, 161
Natural gas transmission, 1613
Netherlands, The
accident at DSM, 28392
communicating industrial risk,
31726
industrial emergency planning,
937
NKA/INF project, 2359
North Rhine-Westphalian Law for
Protection against Catastrophes,
73
North-Rhine-Westphalia, 15560
Notification methods and
procedures, 14950
Notification of Installations
Handling Hazardous Substances
(NIHHS) Regulations, 206
NPK fertiliser, 102
Nuclear activity, 43
Nuclear industries, 2359
Nuclear plant emergency response,
17882
Nuclear power generation facility,
171
Nuclear power installations, 86,
235
Nuclear wastes, 252
Nuisance Act, 323
Nypro, 283
Off-site emergency planning (PPI),
1112, 44, 1001, 20518, 341
Oil
industry, 81
pollution control, 27581
transmission, 1613
On-site emergency planning (POI),
1011, 44, 637, 739, 1001,
1957, 20518, 35960
aim and general principles, 646
Operational problems, 285
Oppau, 205
ORSEC, 43, 47, 48, 54, 99, 100,
103, 339
ORSECHYDROCARBURES, 43
374 INDEX
ORSECRAD, 43
ORSECTOX, 43, 48, 99, 100
Particular Contingency Plan, 115
PEE/PLASEQTA, 1679
PEQHU, 1679
Pesticides, 295
Petrochemicals, 81
Petroleum products, 43
Petroleum refining industry, 7
Petroleum Regulations, 48
Phosgene, 108
Phosphorus trichloride, 252
Plume models, 1856
Police Force, 144
Pollution hazards, 275
Portuguese National Civil
Protection Service, 10713
Potchefstroom plant, 196
Probabilities of lethality (LTL), 118
Propane, 216, 217, 247
Provincial Contingency Plan of Civil
Protection, 115, 128
Provincial Council, 288, 289
Public inquiries, 298
Public Relations, 66, 68, 96
Public transport, 144
Radio, 68, 342
Radiological emergency, 17882
Recommendations, 299
Regulation on major industrial
accidents, 3, 910, 1214
Response capability assessment,
14753
Responsibility assignment, 1489
Rheinische Olefinwerke (ROW),
2456
Risk, probabilistic nature of, 321
Risk analysis, 210
hazardous activities, 1923
models of, 199204
Risk assessment, 209, 295, 318
Risk communication, 31726, 318
appropriate, 325
limitations in achieving
objectives, 319
objective(s), 319
performance and effectiveness,
322
Risk
contours, 124, 127, 129 Risk
contd.
evaluation, 94
information, 321
management, 295, 318
maps, 19
problem, 319
sources, 20
Road Traffic (Carriage of
Dangerous Substances in
Packages, etc.) Regulations
1986, 135
Royal Dutch Chemical Association,
322
Safety equipment, 78
Safety Law, 288
Safety reports, 20
San Carlos, 205
San Juna Ixhautepec, 205
Schematic Report Analysis, 300
Schematic Report Diagrams, 301
SDPC, 107, 109
Security service, 95
Self-help schemes, 1367
Seveso Directive, 3, 18, 34, 36, 43,
63, 93, 100, 317, 323, 324, 338,
360, 363
Seveso disaster, 36, 205, 288
SIGEM system, 130
Site Main Controller, 65, 66, 68
Small inventory top tier sites
(SITTS), 207
SMART system, 18590
SMPC, 107, 109
SNPC, 107, 109
Social climate, 254
Social value, 3368
Socio-technical failures, 30612
Somerville, Massachusetts, 252
Spain, 1679
Special Intervention Plan (SIP), 47
INDEX 375
Special (off-site intervention) plan

(PPI). See Off-site
Special protection, 90
Spreading angle, 119, 122
SRPC, 107
Strfallverordnung, 3
Structural failure, 300
Systems Approach, 307
Systems models, 2003, 30612
Systems overviews, 78
Technical Operations Management
(TEL), 1578
Technical Task Force (TEL), 76
Technological Risks, 43, 47, 48,
54, 339
Telephones, 68
Television, 342
TELRAD, 68
Texas City, 205
Thermal radiation effects, 215
TIGRE computer code, 1679
TMI-2, 178
Tolerance limit, 330
Toxic environment, 35
Toxic gases, 32733
Toxic materials, 207, 210, 217
Toxic substances, 223, 18590
Traffic congestion, 285
Training, 38, 6970, 834, 97, 212,
295, 341
Transport of dangerous
substances, 223
Trial and error strategy, 190
UKHIS (United Kingdom Hazard
Information Warning System),
134
Union Carbide, 35, 194
United Kingdom, emergency
planning, 3141, 20518
United States, chemical
emergencies, 25173
US Coast Guard, 257
Validation, 38
Vapour cloud explosion (VCE), 216
Vinyl monochloride, 108

Vulnerability analysis, 209
Vulnerability assessment, 14753
Warning area, 3301
WHAZAN code, 118, 123, 126
Wilhelmshaven, 2445
Working Environment Act, 94
Works Task Force (WEL), 76
Yom Kippur War, 300

Emergency Planning For Industrial Hazards - H.B.F.gow

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Emergency Planning For Industrial Hazards - H.B.F.gow

Transféré par

Droits d'auteur :

Formats disponibles

EMERGENCY PLANNING FOR

Proceedings of the European Conference on Emergency Planning

CEC-JRC, Ispra, Italy

CEC-JRC Ispra, Italy

MRS M.P.MORETTI CEC-JRC Ispra, Public Relations

ELSEVIER APPLIED SCIENCE

ELSEVIER SCIENCE PUBLISHERS LTD

ISBN 0-203-27238-2 (Adobe eReader Format)

Recent events worldwide have again highlighted the need for

Protection of Areas in the

The Italian Situation Concerning

Emergency Planning in the UK:

Emergency Plans in France

On-Site and Off-Site Emergency

Guide for the Establishment of

Emergency Plan and Alert

On-site Emergency Plans

Emergency Plans According to

Emergency Response Planning

Industrial Emergency Planning

Emergency and Intervention

Exercises and Auditing of

Plan for Off-site Exercises

Exercise Study for an

Effective Organisation and

Assessing the Response

Exercises and Auditing:

Auditing and Exercising of

Techniques for Emergency Plans

The Computer Program TIGRE

Expert System Technology to

Improved Emergency Response

Effective Emergency Planning

Major Industrial Risks:

Decision Support Systems for

Lessons Learnt from Emergency

Experience Gained from Recent

Community and Organizational

Experience Gained from the Oil

The Accident at DSM: Learning

Lessons Learnt from Major Fire

Organizational Learning from

Information to the Public Prior to

Communicating Industrial Risk

Hazard Protection Measures in

Industrial Risk and Information

Requirements for the Planning

Concluding Session: Panel Discussion and Conclusions

Summary of the Concluding

It is an honour and a pleasure to welcome you as participants to

THE DIRECTIVE ON MAJOR ACCIDENT HAZARDS

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 3

The potential hazard is directly linked to the specific properties

4 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 1. Types of hazardous installation in the FRG; StVO refers to

licensing in the Federal Republic of Germany under the Federal

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 5

95% of all registered installations can be assigned to 4 categories

Appendix II, Accident decree [4].

6 EMERGENCY PLANNING FOR INDUSTRIAL HAZARDS

FIG. 2. Average distribution of fire hazard substances in the chemical and

In the chemical industry, all substances listed in Table 1, with

ORGANISATIONS IMPLEMENTING EMERGENCY PLANNING 7