Land Use Planning & Major Hazards

Risk! Engineers Talk Governance
Episode 5, Season 1

In this episode of Risk! Engineers Talk Governance, due diligence engineers Gaye Francis and Richard Robinson discuss land use planning and major hazards. They share some work they’ve been involved with and how design engineered controls are very reliable, and there are precautions and mitigations that responsible parties can put in place to protect themselves against major hazards facilities.

Transcript

Megan (Producer) (00:01):

Welcome to this edition of Risk! Engineers Talk Governance. In this episode, due diligence engineers Richard Robinson and Gaye Francis talk about land use planning and major hazards. We hope you enjoy the episode. If you do, please give us a rating. Also, remember to subscribe on your favourite podcast platform and check out the other episodes.

Gaye Francis (00:30):

Hi Richard, welcome to another podcast session. How are you today?

Richard Robinson (00:35):

It's good to be here.

Gaye Francis (00:37):

Now we are going to talk about today land use planning and major hazards. We've been doing a little bit of work in that space at the moment and some of the confusion around that. So where do you wanna kick off?

Richard Robinson (00:52):

Well, I think it might just be worth explaining R2A's current position and where we got to. Basically in Victoria, the 2004 OHS Act came in and from R2A's viewpoint, that changed the way in which land use planning around major hazards ought to be done. Up until that point, what everybody seemed to be doing was this quantified risk assessment using target levels of risk and safety. In Victoria, that's (1 x 10) - 7 /year for a single fatality. And in New South Wales, that's (1 x 10) - 6 /year for a single fatality. As well as some societal risk curves and things like that. Now, from our point of view at R2A after the Buncefield incident, that's where you had the giant vapor cloud explosion in the UK, which basically decimated the fifth largest oil storage facility.

(01:37):

And it might just be worth briefly explaining what that incident was, just so everybody understands the context of all this. Basically, they overfilled a petrol tank by 300 tons of petrol that splashed out into the bun, and there were a whole lot of reasons why that happened; people missing calculations and overflow, the switches which didn't work and a few other things. But the short answer was that about 10% of it turned into a vapor cloud. So that's 30 tons of vapor floating around looking for a problem. That 30 tons of vapor, up until that point, unconfined vapor cloud explosions weren't really deemed to be credible. What was expected to happen in those instances that you get a deflagration, that is a defined ignition source and the flame front would progress through the cloud, but at subsonic speeds; it wouldn't go supersonic and create a shockwave.

(02:26):

Obviously, if you're in the cloud when this was happening, that would be bad. But the detonation wasn't supposed to happen. Now this was a very odd collection of events. In order for the vapor cloud to hang around, you had to have the right atmospheric conditions. And then according to the Professor of Fire Engineering in Scotland, Dougal Drysdale, they'd pollard the trees. You know how when you try to mix chemicals up, you have to have a really interesting sort of shape of twisty things. And apparently the pollarded trees facilitated the mixing of the vapor. So that actually firmed the perfect stoichiometric mixture. So when it found the ignition source, which apparently was a fire pump, sort of ironically, the thing actually detonated, which was obviously, and you can see by all the factors that I've just articulated, a rare event by the definition.

Gaye Francis (03:16):

It wouldn't expect all of those things to come together in one sequence.

(03:19):

Very unlikely and very unlucky. Right. But the consequence was from R2A's viewpoint - and we kept talking with relevant major hazards and regulators in all states, especially Victoria and New South Wales - And they persisted in using the quantified risk assessment approach using target levels of risk and safety.

(03:37):

Where the likelihood just downgraded all of those incidents to say that it wasn't going to happen.

Richard Robinson (03:43):

Correct. Because it was so rare. They just pulled it back to the ten to the minus seven or the ten to the minus six fatality.

Gaye Francis (03:49):

And tick, we got our license to trade.

Richard Robinson (03:52):

Now the problem with all this is, and this is what Maxwell QC specifically said, now I'm actually summarising a conversation I had with somebody who'd been talking to him and an example he was giving, but he's sort of saying, look, it's like this; somebody lost an arm in a press somewhere and a workplace inspector turns up and said, "how the hell did this happen?", and you know, "This is an XYZ press that should have a guard". And the answer was, and under the old Act in Victoria at least you had to do a risk assessment and you could do a risk assessment using target levels of risk and safety, and you could multiply the likelihood by the consequence, and if it would be in the green zone, you didn't have to do anything.

(04:31):

Now, obviously the consequence didn't change. If you put your arm on the press, you lost it. The likelihood factor is determined by multiplying how often you do it by the probability of the event. And so if you only ever use the press every one or two years...

Gaye Francis (04:48):

The probability's really small; likelihood's really small.

Richard Robinson (04:50):

Yes. But you still lost your arm. <affirmative>. And one of the points about the Common Law and the OHS Act so far as we're concerned took the common law and elevated the statute law. It basically says; everybody's entitled to an equal level of protection. <affirmative>. So if you use that press at all, it doesn't matter if you use it 10 times a day or once a year, you are entitled to an equal level of protection. And that equal level of protection, the minimum, must achieve is recognised good practice.

Gaye Francis (05:15):

Yes.

Richard Robinson (05:16):

And that means it's consequence driven. So what happened to R2A was we kept trying to persuade major hazard regulators to adopt a criticality driven consequence, credible risk consequence approach. And they all kept using...

Gaye Francis (05:32):

Risk.

Richard Robinson (05:32):

Quantified risk assessments. And so R2A had to walk away from it.

(05:36):

The other point about that though was, and that's why R2A changed ourselves from being risk engineers to due diligence engineers, because that's what you're trying to demonstrate. And the only way to do that was to actually use the criticality driven vulnerability type approach.

(05:52):

Now, why we're interested in this and why the subject came up and Gaye's looking at me slightly strangely, but anyway, the reason why this popped up was that we got this request to have a look in Victoria at a couple of major hazard proposals that were nearby a major hazard facility. And it turns out very recently...

Gaye Francis (06:11):

Some developments.

Richard Robinson (06:12):

...some developments, very recently, that the area that you have to consider for major hazards planning purpose has suddenly increased.

Gaye Francis (06:22):

The contours have changed.

Richard Robinson (06:23):

The contour's changed. And nobody knows quite why this has happened.

Gaye Francis (06:26):

We have a bit of an inkling that they've gone... they're now being driven by the consequences rather than the likelihood.

Richard Robinson (06:33):

We think they're taking the credible worst case consequences. And the way you normally do that, from R2A's viewpoint, you do a zonal vulnerability analysis. You basically say, where's the largest energy storage on the site? Like a gas sphere, for example. And if that dropped as low, what's the credible worst case that could happen? And the consequence for that is, you then say; well, this is the credible worst case consequence from this site. You then look at where you are in proximity to that and design for that accordingly.

Gaye Francis (07:00):

They've still got a little bit of buffer in there because they're still taking a lot of their measurements from their boundaries.

Richard Robinson (07:06):

Correct.

Gaye Francis (07:07):

So there's a little bit of a buffer in there, but yes, they appear to be consequence driven rather than risk driven. The contours.

Richard Robinson (07:13):

We think so. We don't know so, because nobody's saying. <laugh>

Gaye Francis (07:18):

Very hard to get all of this confirmed.

Richard Robinson (07:20):

Absolutely. Cos all you get is a public summary of whatever the safety case with the major hazard regulator and the major hazard site is. And that actually doesn't tell you. And that is particularly frustrating. We at R2A very much support the view of the US Supreme Court Judge Louis Brandeis in his happy little book "Other people's money and how bankers use it" where he spells out; 'sunlight is the best disinfectant, there is no sunlight in here at all'.

Gaye Francis (07:47):

I think one of the... and I guess where we are coming from now... So yes, they've changed to that consequence driven, what appears to be consequence driven contours. What they're still doing though, is they're not applying the full precautionary approach that's been required by the OHS and WHS legislation. They're still concentrating their controls only in the controls of what they have. So they're not looking at the overall controls that could be put in place to deal with a major hazard facility, that all parties, reasonable parties or responsible parties could put in place.

Richard Robinson (08:23):

Correct. Because, you see, it's not the level of risk that's important. It's a level of control. I mean, if you want to be safe and live next door to a major hazard facility, you might be in an underground reinforced concrete bunker with its own air supply, which will be stupendously expensive and the amenity will be terrible.

Gaye Francis (08:40):

Very ugly!

Richard Robinson (08:41):

But you will be safe.

Gaye Francis (08:42):

Yes.

Richard Robinson (08:43):

That's not the issue. It's just a question of designing for what you've got. And what puzzles us is every site has problems. There can be flood,

Gaye Francis (08:51):

Cyclone,

Richard Robinson (08:53):

Lightning, bushfire, overlays. Designing for bushfires as one of the critical ones that people do now. <affirmative> You've gotta take into account. And the worst part about it is, and this is the bit that really bothers us, is that by not actually articulating this properly, they're leaving the people who are currently there potentially exposed. I mean, if you're dealing with explosions, the things you're really fret about. And I mean this is just a standard terrorist modus operandi, is that you put a bomb outside a building and you let it go 'bang' and if the glass isn't properly laminated and things like that, the glass just turned into shrapnel and pails everybody inside the building. And with an explosion, it's not so much the over-pressure that causes the biggest amount of grief.

Gaye Francis (09:32):

It's the shards of glass exploding.

Richard Robinson (09:34):

It's bits of materials that get picked up, tiles and things like that get flung out at high speed. I mean, that's what killed that poor girl Katie Bender in Canberra when they took the hospital down, remember? And they blew it up and the metal shard came flying across the lake and killed her. I mean, you know, you've got a plan for what the credible, critical worst case consequences are.

(09:54):

And so far as we can tell, all these municipalities that have major hazard facilities, they haven't been told what the credible, critical, worst case is. It's just opaque. And so anybody who's living there doesn't really know what they should or should not be designing for. And the council's actually not actually in a position, in terms of building and planning controls, to actually answer that question correctly. And what's probably something I don't think they fully comprehend... Whilst the OHS Act of Victoria and the WHS legislation in all the other jurisdictions, is the enabling legislation for major hazards. And whilst Ministers are exempt from the legislation, they make the rules. And local government elected counselors, I think are too, although I'd have to double check, that's a legal question. That doesn't invalidate the responsibility of the planners, designers, architects, engineers, all the other people from not providing appropriate safe (advice) consistent with their obligations.

(10:53):

And since, Victoria in 2020, Premier Andrews made Criminal Manslaughter, following the rules from the Common Law, admittedly it's gotta be on a beyond reasonable doubt basis. But what disturbs us about this is, we're fairly confident that the major hazards facilities and the major hazards regulator know what these credible worst case consequences are.

Gaye Francis (11:15):

And maybe not sharing the details with the responsible, other parties that really need to know about them.

Richard Robinson (11:21):

Well, yeah. Like the people who are actually at risk, for one! And it's a duty under legislation, you must consult. It's an offense if you do not consult at the front. So there's something really peculiar here that hasn't properly been addressed.

Gaye Francis (11:34):

But I think if all of the responsible parties take that role of what they can do, you're gonna make those developments so much safer than what they currently are. There's so much more that you can do outside of just what the major hazards facilities can do.

Richard Robinson (11:50):

Remember we did that place in Queensland all those years ago now where they had the hospice on the hill overlooking the

Gaye Francis (11:57):

Major hazard

Richard Robinson (11:57):

And they had four major hazard facilities. <affirmative>. And remember we turned up... You see, I do have a certain sympathy for the major hazard facilities because they're kind of cranky because they keep getting all these people building closer and closer to them.

Gaye Francis (12:09):

Yes. They have been there for a very long time.

Richard Robinson (12:11):

And I can see why they're frustrated. In this particular case, the hospice on the hill was there before the major hazard facility. So there's some moral...

Gaye Francis (12:19):

Yep.

Richard Robinson (12:20):

..there. But when we turned up to talk to them, the question we asked them; "Right guys," Cos they're so used to being beaten to a pulp by the community for creating dangers for the community. Right. And we sort of turned up and said, "Look, we gotta live together here. What do we have to do as a site to protect ourselves against the credible worst case consequences that you guys can produce?" And I remember them looking back at us saying, "You're not here to beat us up? You're just here to ask something?"

Gaye Francis (12:45):

"Did you really ask that question?" <laugh>

Richard Robinson (12:47):

"We're really here to find out what we need to do to protect ourselves against you from the credible worst case things you can do. That's in the interest of the major hazards facility and that's in the interest of the,

Gaye Francis (12:56):

the site.

Richard Robinson (12:57):

Tthe site and the people doing things. It's in everybody's interest. Remember we had to go and see the Deputy Premier about that one.

Gaye Francis (13:03):

But what was interesting about that was there were things that could be put in place, to make the facility safe or the site safe, against the major hazards. And it wasn't that complicated and didn't cost a lot more money when they were in the planning and the development stages to put in at a site that already existed.

Richard Robinson (13:23):

Well, I think it actually has a larger social implication too. Because one of the things we suddenly realised dealing with the council, and so forth, there were no engineers around. Council had just been de-engineered. Now this has all been decided by town planners and building surveyors. I don't think they had a clue about what could actually be done. And, I mean, I was trained as a highly protective risk engineer in the US with Factual Mutual all those years ago. I'll perhaps not go into too much history, but the whole point of the Factory Mutual system, it's an engineering underwriting organisation. You can't join the pool unless you have achieved and developed your site and facility to recognised engineered management standards. You simply can't join the pool. So the idea that you can't engineer this sort of stuff, it was just preposterous. It's been being done from Factory Mutual since the 1840s. And the idea that major hazards, regulators and councils aren't fulfilling their duties under our legislated obligations by our parliaments, I just find extraordinary.

Gaye Francis (14:18):

And I think they're, they're really doing themselves a disservice in and in the development stages or in the development of their communities as well because they're really relying on one set of controls that are often after the fact, and not concentrating on a set of precautions that could easily be put in place.

Richard Robinson (14:35):

Following the hierarchy of controls. There's something really peculiar. And the idea that people are actively breaching the legislation and knowingly doing so, well, perhaps, I wouldn't say knowingly, it's inadvertent, but from the way in Victoria passed the legislation, it is not just recklessness anymore - you knew or made or let it happen - it's also ought to have known.

Gaye Francis (15:00):

Yeah. And I think that makes a big difference.

Richard Robinson (15:02):

And, and I'm confident major hazards and the major hazard site, they have studied their site, they know what the credible worst case consequences are. And by spelling these inner and outer safety areas, they're actually ineffectively spelling out what they believe the relative consequence around the site would be. And that should enable appropriate design controls.

Gaye Francis (15:24):

And I think that's the summary of this podcast, isn't it? That major hazards have existed in our communities for a long time. There's some controls that are there, that they put in place. But there's a whole lot of other controls and precautions and mitigations that other parties, responsible parties, can put in place to protect themselves against these facilities.

Richard Robinson (15:44):

Design engineered controls are very reliable, robust controls, not emergency procedures. So if you're dealing with an explosion, I mean explosion of travel at the speed of sound.

Gaye Francis (15:53):

You're not gonna get anyone out in that time.

Richard Robinson (15:54):

It's 340 meters per second. Okay. The inner outer safety area is sort of between 300 to 1,000 meters. This is all going off in three or four seconds.

Gaye Francis (16:05):

But robust building designs and precautions you can put in place and they will be very effective.

Richard Robinson (16:12):

Always.

(16:13):

Otherwise you abrogate the entire basis of an industrial civilisation and 200 years worth of effort and it's quite peculiar.

Gaye Francis (16:21):

Okay. So that's sort of our summary. Don't sterilse a whole lot of land from major hazards facilities, just because you don't think there's other precautions that can be put in place, because there are.

(16:34):

So we hope you found our podcast interesting and we look forward to you joining us next time. Thanks, Richard.

Richard Robinson (16:40):

Thanks Gaye!