Major Hazard Risk Assessment
for Existing and New Facilities
Katherine (Kate) Filippina and Lachlan Dreherb
a
ModuSpec USA, Inc., Katy, TX 77450; kate.filippin@moduspec.com (for correspondence)
b
ModuSpec Australia Pty Ltd., Melbourne VIC 3000, Australia
Published online 29 November 2004 in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/prs.10045
This paper outlines a risk assessment methodology
that has been developed through work with major haz-
ard facilities, including ammonia plants in Australia,
satisfying regulations equivalent to the European
Seveso II Directive. The methodology is an approach for
ensuring an undertaking of effectively assessing the
risks associated with major hazards that will not only
satisfy regulations and corporate requirements, but
also, more importantly, provide a framework for sus-
tainable business processes, by enabling the methodol-
ogy to be integrated into normal business management
processes. The approach enables existing management
systems to be effectively incorporated into the evalua-
tion processes. Common pitfalls encountered during
the risk assessment process are also discussed. © 2004
American Institute of Chemical Engineers Process Saf
Prog 23: 237–243, 2004
INTRODUCTION
The concept of managing major hazard facilities is
not a new one, but there is a growing regulatory envi-
ronment that requires more analysis and better docu-
mentation of how a facility is being managed and,
specifically, how the risks are being managed. The
European Seveso directive, risk assessment regulations
in Norway, COMAH regulations in the United King-
dom, Major Hazard Facility Regulations in Australia,
and U.S. OSHA PSM and the U.S. EPA Risk Manage-
ment Program all require a thorough understanding of
major hazards and risks for these types of facilities
[1– 6].
Operators, as well as other relevant parties (such as
contractors), have a duty to ensure that appropriate risk
analyses are carried out for the activities in which they
are involved. The aim of these risk assessments is to
identify hazards that are present, then remove or re-
duce the occurrence of potential incidents or minimize
their associated consequences. Risk analyses provide
knowledge concerning risks resulting from an enter-
© 2004 American Institute of Chemical Engineers
Process Safety Progress (Vol.23, No.4)
prise’s undertakings and thereby constitute critical
input to the enterprise’s overall risk management
strategy. A sound and systematic approach to risk man-
agement, based on a coherent and logical risk manage-
ment strategy, facilitates compliance with relevant leg-
islation and in-house corporate policy where
applicable.
This paper outlines a risk assessment methodology
developed through work with a range of major hazard
facilities in Australia. The methodology is an approach
for ensuring a full understanding of the risks associated
with major hazards that will not only assist with meet-
ing regulations and corporate requirements but, more
important, also provide a framework for sustainable
business processes and a safer environment for em-
ployees and the wider community. Common pitfalls
encountered during the risk assessment process are
also discussed.
OBJECTIVE
The objective of the methodology is to reduce the
risk from major hazards to as low as reasonably prac-
ticable (ALARP) [7] or so far as practicable (SFAP) [4].
This is achieved through reducing risk associated with
the facility’s:
• Identified largest hazards
• Identified largest potential major incidents
A flow diagram of the basic steps in this process is
shown in Figure 1. The stages of this process are dis-
cussed in the following sections.
HAZARD IDENTIFICATION
A systematic hazard identification study must iden-
tify all potential major incidents associated with the
facility operations. This is a critical component of the
risk assessment. To ensure a successful risk assessment
outcome, it should demonstrate site participation and
involvement.
Employee involvement can have a significant impact
on developing a risk-reduction culture in the organiza-
December 2004 237
Figure 1. Risk assessment process.
tion. This is a major benefit, as employees through all
levels of the organization gain a greater understanding
of the risk from the operations and how the tasks that
they are involved in control that risk. The major benefit
of site participation is a high level of ownership and
acceptance of the outcomes at the conclusion of the
risk assessment process. This will allow easier imple-
mentation of any recommendations, either procedural
or design related.
The facility will also get a better result if the whole
risk assessment process is part of the culture and not
done in isolation. We have had significantly more suc-
cess by incorporating the personnel undertaking the
risk assessment into the facility’s working process and
involving a high level of operating personnel. This is
contrasted with minimizing the risk assessors’ involve-
ment in the plant and using them only to answer
specific questions when difficulties with compliance or
difficulties with the regulators occur.
To ensure that all the potential major incidents are
identified, a number of hazard identification techniques
should be used. These are outlined in the following
sections. It should also be noted that the selection of
the appropriate hazard assessment technique should
consider a range of issues, including:
• Nature of the potential hazards
• Culture of the facility’s workforce
• Position of the facility in relation to the surround-
ing community
• Complexity of the process
238 December 2004
• Sensitivity of the local environment
Historical Incidents
A review of historical incidents in the industry will
provide valuable information about the major incidents
that are known to the industry and their causes. These
should be reviewed for the particular process or type of
industry, such as ammonium nitrate plants, ammonia
plants, urea plants, and ammonia storage facilities.
Consideration should also be given to other industries
that operate similar facilities.
Facilities that are already operational should also
review their site incident database. Companies with
several sites should also review incident databases
from other facilities within the same organization. This
should cover any incidents that have occurred as well
as any near misses. Near misses provide a much greater
number of potential incidents to consider, above actual
incidents. These can provide information about inci-
dents that did not happen, but may need additional
controls to ensure they are not likely to happen in the
future.
A common mistake made by operators is to disre-
gard or not follow up on near misses. Near misses are
a warning and should be used to the advantage of the
organization, not left with the potential to reoccur in
the form of an incident.
If an incident database does not exist, then one
should be set up to record any incidents or near misses.
These should be regularly followed up in detail.
Process Safety Progress (Vol.23, No.4)
 Another common oversight involves organizations
that are limited to single or few facilities. When con-
ducting the hazard identification process in these orga-
nizations, it is common to encounter the attitude that “it
hasn’t happened to us, therefore it will not happen.” It
is very important that such organizations take a broad
view to hazard identification and consider the experi-
ence of the wider industry and not purely their own
site.
The review of historical incidents should be under-
taken early in the risk assessment process. The infor-
mation arising from the review can then be considered
as part of the remaining hazard identification steps [8].
Sample of Historical Incidents
Date of incident. 21 September 2001
Location. AZF (Azote de France) in an industrial
zone on the outskirts of Toulouse, southwest of France
Type of facility. Ammonium nitrate fertilizer factory
Incident description. The explosion had occurred in
a warehouse in which granular ammonium nitrate was
stored flat, separated by partitions. The amount was
reported to be between 300 to 400 tons of ammonium
nitrate, which is used to make fertilizers. A representa-
tive for the Interior Ministry in Paris ruled out a criminal
attack. He reported that the explosion had been caused
by an accident following an “incident in the handling of
products.” As a result of the incident, 30 people died:
22 inside the factory and 8 outside.
Comments. The theory of an accident remains for
the explosion at the AZF factory. One of the theories
examined relates to contamination of the ammonium
nitrate in the warehouse by chlorine compounds.
References. [9, 10, 11]
Review significance. Although the details of the in-
cident cause were not completely clear at the time of
writing, one of the lessons to learn from this incident
was to make sure there is clear segregation of chemi-
cals. This information is used in the hazard identifica-
tion.
In one case we studied, this issue was examined in
detail to document the reason why the operator did not
consider an explosion of the ammonium nitrate storage
(attributed to contamination) to be a significant risk.
Complete segregation of chemicals from storage was
only part of the argument for why this hazard was not
considered a threat. A detailed management system
that recognized the dangers of breaching this system,
with procedures, training, and regular auditing were
also present to ensure management of this issue was
fully understood.
Date of incident. 13 December 1994
Location. Terra Industries, Inc. Nitrogen Fertilizer
Facility, Port Neal, IA
Type of facility. Ammonium nitrate plant
Incident description. Initially an explosion occurred
in the plant. The explosion resulted in the release of
approximately 5,700 tons of anhydrous ammonia to the
air and secondary containment, approximately 25,000
gallons of nitric acid to the ground and lined chemical
ditches and sumps, and liquid ammonium nitrate solu-
tion into secondary containment. Off-site ammonia re-
Process Safety Progress (Vol.23, No.4)
leases continued for approximately 6 days after the
explosion.
Four people were killed as a direct result of the
explosion, and 18 were injured and required hospital-
ization.
Comments. The investigation team concluded that
the explosion resulted from a lack of written, safe
operation procedures at the Terra Port Neal ammonium
nitrate plant. The lack of safe operating procedures
resulted in conditions in the plant that were necessary
for the explosion to occur.
Reference. [12]
Review significance. The significance of this incident
is that the documented cause (inadequate safe operat-
ing procedures) is not restricted to the ammonia indus-
try. Thus, it is also suggested that wide reading of
historical incidents would be advantageous because
the fundamental causes of many accidents are not in-
dustry specific. These shortcomings (poor procedures)
can be addressed by the involvement of employees in
the risk assessment process. A greater understanding of
the risks and the importance of various procedures will
reduce the likelihood of employees making mistakes.
As with the previous example, training and regular
auditing were also required to ensure that management
of this issue was fully understood.
Hazop/Hazid
The classical “Hazop” technique has been devel-
oped over four decades, and is centered on “process
flow,” as would be seen in a chemical plant. It is a
widely used technique to identify potential hazards and
operational difficulties associated with the specific de-
sign of a process plant [13].
Hazops tend to identify lower level hazards and
risks. This is why the Hazop is only one in a suite of
hazard identification tools that should be used. The
advantage, however, is that the whole process is re-
viewed and there is less likelihood of missing a hazard
that may initially seem insignificant, but with more
study can actually lead to a much larger scenario. The
Hazop can capture a significant amount of information
that can be fed into the later stages of the analysis. For
example, the Hazop can identify potential major inci-
dents that can be flagged for later follow-up.
This stage of the analysis is conducted in a work-
shop format, with the involvement of a number of site
personnel from each section of the facility. A series of
guidewords are used to determine whether there are
possible deviations from expected operation. Hazops
help efficiently identify the steps needed to move the
design and safety management process forward, and to
formally record and document that safety and opera-
bility issues have been addressed. This assists in for-
mally demonstrating that hazards have been identified
and avoided or the resulting risks have been reduced to
an acceptable level.
It is important that there is a thorough examination
of each specific process deviation and that the com-
ments made in the meeting are summarized fully. This
should be done in all cases and not just for those items
where deficiencies are found. Shortcuts are often taken
in this area for the sake of expediency at the time of the
December 2004 239
Hazop, but this has a significant downside later. Re-
cording the reasons why a hazard is not likely to occur
is just as important as documenting why it is likely to
occur. Full documentation of the Hazop is invaluable in
ensuring that the design intent of a facility is captured.
When future modifications are made, the designers can
revisit the original process purposes and design limita-
tions to ensure that any proposed modifications do not
introduce any unforeseen hazards. This stage of the
assessment can significantly reduce the amount of
work later, if the documentation is thorough.
Checklists
A checklist can be incorporated into a Hazop or
hazard identification workshop. Checklists provide a
systematic means of checking that potential scenarios
have been analyzed. The checklist should incorporate
the generic known failures that could occur in the
process. It should also incorporate the lessons learned
from the historical review. For example, a checklist for
an ammonium nitrate facility would include contami-
nation as a result of the previous example of historical
incidents. The checklist is another systematic tool to
provide guidance for the workgroup and ensure that
the analysis covers the full range of possible scenarios.
An example checklist is shown below.
Checklist Example
Equipment Type/Area Initiating Event
Pressure vessels Overfills and spills
Vessel shell failure
External event
PSV release
Pumps Mechanical seal failure
Coupling failure/fracture
Casing failure
External event
Tank (Refrigerated) Material embrittlement
Overfills and spills
External event—Dropped
objects
Ammonium nitrate Contamination with
storage • chlorides
• copper
• zinc
• chromate
Contamination by
• hydrocarbon fuel
• organic substances
Sources of heat
CONTROL IDENTIFICATION AND RISK EVALUATION
The control identification and risk evaluation will
provide the basis for ensuring that the risk is reduced to
as low as reasonably practicable.
The proposed methodology provides an advantage
in that the details of all risk controls considered and
discussed are recorded for future reference. The rea-
sons for choosing an alternative control, or the reason
for rejecting a specific control, are documented. This
240 December 2004
provides the supporting information to demonstrate
control of risk to an ALARP condition at a facility.
One of the mistakes often made is to keep a record
of just the controls recommended for implementation.
Without details of additional controls that have been
considered and the reasons for their rejection (such as
cost, impracticality, etc.), a facility cannot truly demon-
strate that their risks are controlled to ALARP.
Layer of Protection Analysis (LOPA)
LOPA [14] can be considered as an extension of the
hazard identification process. It is a simplified fault and
event tree technique used to identify and assess what
safeguards are in place to prevent a hazard from oc-
curring.
The concept of a LOPA is to list the sequence of
events associated with the manifestation of a hazard in
time order. This provides various insights into what
could or could not happen. The concept relies on the
notion that injury, damage, and ill-health are the result
of the loss of control of damaging energies.
A fault tree is effectively a statement of what matters
have to conspire together to bring about an undesired
event. This shows the sequence of events giving the
loss of control of energy.
An event tree is a similar device except that it an-
swers the questions associated with a particular event
occurring with several possible outcomes. It shows the
outcome after the loss of control of energy.
When combined, these provide a cause– conse-
quence picture (also known as a bow-tie diagram).
When the safeguards in place are added to the
picture, they are shown as layers of protection. These
layers of protection show whether sufficient safeguards
have been provided for the hazard.
It is possible to incorporate a qualitative assessment
to evaluate the adequacy of the controls for a particular
incident. Otherwise, the information can be fed into a
quantitative assessment for further evaluation. The
LOPA can also be used to identify the critical controls
for an incident. This information can then be used to
ensure that appropriate systems are in place for that
control to be effective.
Case Study
An example of the basic information in a LOPA
analysis is shown in the following example.
Hazardous scenario progression
• Incorrect metal alloy used for storage tank pipe-
line joint
• Change in storage conditions favorable to em-
brittlement
• Rupture of pipeline joint and release of ammonia
The layers of protection identified are
• Standards used for material selection during de-
sign
• Management of change procedure for changing
materials
• Management of change procedure for change in
process conditions
• Temperature/pressure alarms on tank for change
Process Safety Progress (Vol.23, No.4)
 in process conditions outside designed operating
envelope
• Ammonia gas detectors and alarms in storage
plant
• Concrete bund/dike surrounding storage tank
• Foam monitors surrounding storage area to knock
down ammonia vapors
This information must be examined to evaluate the
frequency with which the scenario is likely to occur
and the protection that each of the controls provides to
reduce the frequency of occurrence.
Quantitative or Qualitative Risk Assessment
Quantitative risk assessment (QRA) describes a tech-
nique that is used systematically to calculate the cumu-
lative likelihood of the consequences of all possible
hazards associated with a plant or facility [15]. The
primary focus of a QRA in this context is the assessment
of events that have the potential to cause injury or
death to people either inside or outside the facility
boundary.
The risk assessment process incorporates the use of
a QRA, particularly when the location of the facility is in
a populated area and when risk acceptance criteria or
guidelines must be satisfied for individual risk and/or
societal risk [16]. The QRA can be used to determine
whether the risk is managed at a level considered
acceptable. By examining the major contributors to the
risk, and applying mitigation measures to reduce the
risk from these contributors, the overall risk from the
facility can be reduced.
In the case of a facility located in a remote area or an
unpopulated area, a qualitative assessment can be
used. This is a more coarse approach and will not
provide the same level of detail as the QRA. The qual-
itative assessment uses a risk matrix to determine the
level of risk associated with different hazards. The
matrix will have regions of acceptability for assessing
the hazards.
Case Study
A QRA was undertaken for an ammonium nitrate
plant. The individual risk guidelines included the fol-
lowing:
• Residential developments and places of continu-
ous occupancy, such as hotels and tourist resorts,
should not be exposed to individual fatality risk
levels in excess of 1 ⫻ 10⫺6 per year.
To demonstrate that the risk was reduced to meet the
criteria, the individual risk contour for a risk of 1 ⫻
10⫺6 per year was determined. The nearest residential
area was approximately 1 km from the site. This area
did not fall within the contour for a risk of 1 ⫻ 10⫺6 per
year and therefore was not affected by this risk level.
This was used to show that the risk was acceptable for
this criterion.
Emergency Response Assessment
The emergency response assessment is undertaken
to ensure a comprehensive framework has been set up
to ensure effective response to an emergency.
Process Safety Progress (Vol.23, No.4)
A variety of processes including risk assessments,
training exercises, consultation with external authori-
ties, field tests, and site inspections are used to assess
the emergency response requirements and capability of
a facility and develop appropriate plans.
At least two different levels of response plans should
be developed.
1. Generic response plans that detail characteristic ap-
proaches for the first response to a number of gen-
eral categories of incidents.
2. Specific major incident plans, based on specific sce-
narios and provide response for those events.
The development process should involve opera-
tions/plant personnel, internal and external emergency
response groups, and validation of the scenario at the
incident site. The generic plans will provide informa-
tion about:
• The hazards and possible escalation paths
• The systems and procedures in place for mitigat-
ing the event at different stages of escalation
• The procedures for mobilizing emergency ser-
vices and for evacuation
• The chain of command and control and the ac-
tions required of people in specific response roles
• Integration of emergency response capabilities/
plans
The specific major incident plans provide informa-
tion on a specific incident. Although it may not be
possible to develop a plan for every major incident at a
facility, the selections that are prepared should be se-
lected to provide the most information possible about a
major incident in an area of the plant. These specific
plans should be used for training in response to an
incident. Training can also provide a feedback loop to
implement continuing improvements in the plans, such
as testing their actual effectiveness.
The advantage to using a specific plan for training is
that the training can use information from the risk
assessment, particularly the LOPA, and be developed
around an incident occurring at the initial stages. This
will provide awareness of the type of early warning
signals or alarms that might be seen, which can be
acted on to prevent the incident from developing.
RISK ACCEPTABILITY
Determining the acceptability of risk is often the
most challenging aspect of a risk assessment.
Some regulators provide guidelines or criteria for
use with QRA. These can be used to interpret whether
a facility’s risk is considered acceptable for these crite-
ria [17]. There may also be international or national
standards that have been published for a particular
process or type of plant.
For example, in the state of Queensland, Australia,
the “Guidelines for Major Hazard Facilities” prepared
by the CHEM Unit in association with the Queensland
Government present the following individual risk ac-
ceptance criteria [18]:
• Hospitals, schools, child-care facilities, and old
age housing development should not be exposed
December 2004 241
 to individual fatality risk levels in excess of 0.5 ⫻
10⫺6 per year.
• Residential developments and places of continu-
ous occupancy, such as hotels and tourist resorts,
should not be exposed to individual fatality risk
levels in excess of 1 ⫻ 10⫺6 per year.
• Commercial developments, including offices, re-
tail centers, warehouses and showrooms, restau-
rants, and entertainment centers, should not be
exposed to individual fatality risk levels in excess
of 5 ⫻ 10⫺6 per year.
• Sporting complexes and active open space areas
should not be exposed to individual fatality risk
levels in excess of 10 ⫻ 10⫺6 per year.
• Individual fatality risk levels for industrial sites at
levels of 50 ⫻ 10⫺6 per year should, as a target, be
contained within the boundaries of the site where
applicable.
The results of a QRA can be examined against these
criteria and risk mitigation controls can be imple-
mented to reduce the risk if necessary.
However, meeting any prescribed criteria is only
one part of showing acceptability of risk. The other
aspects that need to be demonstrated are:
• Adequacy of control measures
• Understanding of operations and hazards and
demonstrated plan to reduce risks
• Adequacy of safety management system
A clear picture of the hazards identified and the control
measures in place to protect against them occurring will
show whether an appropriate number of control mea-
sures have been put in place. Having these set out in a
database (as discussed in the next section) will allow easy
assessment of this scenario. Each of the controls must be
shown to be managed to ensure their operability. This
may be as part of the safety management system, or
performance standards. For example, one of the controls
for a high-temperature excursion in a storage tank might
be a high-temperature monitor and alarm. The perfor-
mance measure for this might be to have only one alarm
over a prescribed period of time.
The criticality of controls and their required perfor-
mance are then used as an input into determining the
maintenance intervals, such as trip testing.
Another aspect of showing risk acceptability is to
show that the existing controls are adequate and that
the alternatives have been considered. If the alterna-
tives can be shown to have been examined and con-
sidered and the reasons for not choosing them are
documented; this will assist others in understanding
why the existing system is adequate.
An understanding of operations and hazards will be
shown once the steps of the risk assessment have been
undertaken. A follow-up plan as to how the outcomes
are being managed will help to show that the risks are
being reduced to acceptable levels.
The safety management system is the primary means
of ensuring the safe operation of a facility with respect
to major hazards. No one standard system can be used
for all facilities; rather, individual facilities must imple-
ment a workable system appropriate to their particular
242 December 2004
operation. This will vary depending on the hazards and
controls identified in the process.
RISK DATABASE
In our experience, a risk database or risk register is
a valuable tool for a site to use to manage their risks
effectively. Such a database can be set up to record
details of all the risks identified at the beginning and
during the life of the plant. Each hazardous scenario
can be recorded, along with pertinent information such
as:
• a unique identifier for each risk
• a description of each risk
• an assessment of the likelihood it will occur
• an assessment of the consequences of the risk
being realized
• a ranking of each risk according to a risk matrix
• who is responsible for managing the risk
• an outline of the existing controls in place to
manage the hazard (preventative and contin-
gency)
• an outline of proposed mitigation actions (pre-
ventative and contingency)
• costs for each mitigation strategy
• information about contingency plans that should
be invoked if an incident does occur
The database can be set up to provide reporting func-
tionality, which can include such things as:
• Graphical risk profiles
• Ranking of site risks
• Process operations key risks and risk manage-
ment plans
• Summary reports for specific process areas or
sitewide
• Critical equipment risk ranking
• Recommended risk controls and further analysis
The risk register is a record that may be used for audit
purposes to demonstrate that a risk assessment has
taken place and that risk management is ongoing. To
be of maximum benefit, the risk register must be main-
tained and updated. It is then an important tool used to
demonstrate rigorously the systematic way that hazards
are managed at a facility.
FOLLOW-UP AND AUDITING
The risk assessment process should be ongoing
throughout the life of the facility. To achieve this, there
must be follow-up and feedback to improve the pro-
cess.
An important element of the follow-up process is
periodic auditing of hazards and their controls. Audit-
ing is a sampling technique aimed at gaining an overall
impression of the acceptability of the risk assessment
process. It is a significant component in demonstrating
the ongoing acceptability of the risk. Audits provide
assurance that the assessed hazards continue to be
managed to a high level of competence. Feedback from
audits allows improvements to the process. It is avail-
able to confirm that the controls identified are opera-
tional and maintainable to achieve the required risk
reduction [19].
Process Safety Progress (Vol.23, No.4)
CONCLUSION
There are a number of important issues to address
when undertaking a site risk assessment to address
major incidents.
Hazard identification is one of the most important
elements of the assessment. This needs to be thorough,
involve experienced personnel, and be well recorded for
future reference. Using more than one technique for iden-
tifying hazards will increase the effectiveness of the pro-
cess.
The assessment of the hazards identified is the key to
demonstrating that the risk is as low as reasonably prac-
ticable (ALARP). For maximum effectiveness, multiple
techniques also need to be used. Some techniques pro-
vide a better analysis of preventative controls, whereas
others provide a better analysis of mitigative controls.
Regardless of the techniques used, thorough documenta-
tion is essential, including employee involvement.
Throughout the entire risk assessment process, one
factor that is consistently important at all stages of the risk
assessment is the need for adequate documentation. It is
vital that the full details of the basis for various design and
risk control decisions are recorded. The main reason for
this is to provide traceability. This will save time when the
risk assessment is updated (usually required periodically
by regulators) because the assessment will be under-
standable and not require extensive rework. Traceability
will be vital for audits and demonstrating to third parties
the process used to achieve ALARP risk.
Use of a risk management database aids this process
by recording the information in a consistent form for
the entire facility, thereby avoiding common variations
in the level of detail provided.
A properly constructed risk management database
will provide the traceability that enables each facility to
demonstrate effective management and control of the
risks associated with their operations.
LITERATURE CITED
1. European Council, Council Directive 96/82/EC of 9
December 1996 on the control of major-accident
hazards involving dangerous substances, 1996.
2. Norwegian Directive for Fire and Electrical Safety,
The prevention of fire, explosion and accidents
involving hazardous substances and the fire ser-
vices’ duties connected with rescue operations
(Fire and Explosion Prevention Act), Act No. 20,
June 2002.
3. The Health and Safety Executive (HSE), The con-
trol of major accident hazards regulations 1999,
The Stationery Office Ltd., London, UK, 1999.
4. National Occupational Health and Safety Commis-
sion (NOHSC), Control of major hazard facilities,
National Standard [NOHSC:1014(2002)], National
Code of Practice [NOHSC:2016(1996)], Australian
Government Publishing Service, Canberra, 2002.
5. Occupational Safety & Health Administration
(OSHA), Final rule on process safety management
of highly hazardous chemicals: Explosives and
blasting agents, OSHA, Washington, DC, 1992.
6. U.S. Environmental Protection Agency (US EPA),
Accidental release prevention requirements: Risk
Process Safety Progress (Vol.23, No.4)
management programs under Clean Air Act Section
112(r)(7), 40 CFR Part 68, US EPA, Washington, DC,
1999.
7. The Health and Safety Executive (HSE), Reducing
risks, protecting people—HSE’s decision-making
process, HSE Books, London, UK, 2001.
8. The Health and Safety Executive (HSE), Major in-
cident investigation report—BP Grangemouth
Scotland 29th May–10th June 2000, HSE, London,
UK, August 2003.
9. United Nations Environment Programme (UNEP),
Production and Consumption Branch, APELL,
2001, UNEP, Geneva, Switzerland; http://www.
unepie.org/pc/apell/disasters/toulouse/
home.html (Accessed November 2002).
10. Autofina Corporate Press Release, Grande Paroisse
Toulouse: Reaction following the publication of the
experts’ interim report, Autofina, June 2002; http://
www.atofina.com/groupe/gb/actucomm/d_detail.
cfm?IdComm⫽7322 (Accessed November 2002).
11. Ammonium nitrate explosion at AZF Toulouse,
http://www.sci.fi/⬃ility/PREn (Accessed Novem-
ber 2002).
12. U.S. Environmental Protection Agency (US EPA)
Terra Chemical Accident Investigation Team,
Chemical accident investigation report—Terra In-
dustries, Inc. Nitrogen Fertilizer Facility, Port Neal,
IA, US EPA Region 7, Emergency Response and
Removal Branch, Kansas City, KS.
13. Center for Chemical Process Safety (CCPS), Guide-
lines for hazard evaluation procedures, 2nd ed.,
American Institute of Chemical Engineers, New
York, 1992.
14. Center for Chemical Process Safety (CCPS), Layer
of protection analysis; Simplified process risk as-
sessment, American Institute of Chemical Engi-
neers, New York, 2001.
15. Center for Chemical Process Safety (CCPS), Guide-
lines for chemical process quantitative risk analy-
sis, American Institute of Chemical Engineers, New
York, 1989.
16. K. Filippin and M. Jarman, Management tool for
undertaking quantified risk assessment studies,
Proc 1998 AIChE Ammonia Symposium Safety in
Ammonia Plants and Related Facilities, Charleston,
SC, September 1998.
17. Department of Urban Affairs and Planning (New
South Wales), Risk criteria for land use safety plan-
ning, Hazardous Industry Planning Advisory Paper
(HIPAP) No. 5, 2nd ed., Department of Urban Af-
fairs & Planning, Sydney, Australia, 1992.
18. Queensland Government, Counter Disaster and
Rescue Services, Department of Emergency Ser-
vices, Guidelines for major hazard facilities. Part C:
System risk assessment, Chemical Hazard and
Emergency Management (CHEM) Unit, Brisbane,
Australia, May 2002.
19. Department of Planning (New South Wales), Haz-
ard audit guidelines, Hazardous Industry Planning
Advisory Paper (HIPAP) No. 5, Department of
Planning, Sydney, Australia, 1993.
December 2004 243