Review
The Seveso II Directive in New European Member States: the Case of Slovenia
Mitja Kožuh
Faculty of Chemistry and Chemical Technology, University of Ljubljana, Slovenia * Corresponding author: E-mail: mitja.kozuh@fkktuni-lj.si
Received: 28-07-2009 Dedicated to the memory of the late Prof. Dr. Valentin Koloini
Abstract
New member states have adopted European legislation in the field of environmental protection and after its adoption they put this legislation into power. The article deals with the problems with implementation of the Seveso II Directive,1 which have been discovered by the reviewing safety reports, submitted to the competent authority. At first glance the legislation does not seem to be very problematic, but after a closer look a number of problems can be unveiled which we think could be of interest to a wider community. Operators of the upper tier facilities should according to legislation prepare safety reports which should demonstrate that they identified the hazards and that they know how to deal with them. This can be done only by knowledgeable people who can also make the use of the results for improving safety.
Keywords: Seveso Directive; control of major accident hazards; Safety reports; Guidance documents; Industrial safety
1. Introduction
Slovenia joined EU on May 1st in 2004 and after that time companies with larger quantities of dangerous chemicals were obliged to comply with the Seveso II Directive demands. In Slovenia Seveso II Directive was covered by two major legislative entities, namely the Decree on prevention of Major Accidents involving dangerous chemical substances, issued by the Ministry of the Environ-
OVERALL MANAGEMENTSYSTEM MAPP
SAFETY MANGEMENT SYSTEM
RISK ANALYSIS
Figure 1: How safety is incorporated within the management sys-tem.44
ment and Spatial Planning2 and the Decree on Emergency Planning, issued by the Ministry of Defence.3
The problem with transferring the Seveso II Directive into the Slovenian legislation lies in the fact that the responsibility was split among two one being responsible for the safety and risk management part of the Directive, and the other for the Emergency Planning. The compatibility of the two parts is not very high and therefore the consequences due to this fact can be seen in practice.
The Guidelines15 issued by Major Accidents and Hazards Bureau to help operators to describe in Safety report how the Major accident prevention policy (MAPP) and Safety management system (SMS) have been put into practice was not promoted to help operators and not taken into account during Safety reports preparation.
Safety report should incorporate following data:
-	Information on the MAPP and on the SMS
-	Presentation of the environment of the establishment
-	Description of the installations(s)
-	Hazard identification, risk analysis and prevention methods
-	Measures of protection and intervention to limit the consequences of an accident
The safety report may be combined with other re-
ports produced in response to other legislation to form a single safety report in order to avoid unnecessary duplication or repetition of work.44
Preparation of the accessing country for the compliance with the Seveso II Directive dates back to the year 2002, when along with the legislative process some preliminary activities started to prepare industry to cope with the legislative demands. A number of pilot studies started in the framework of PHARE projects in collaboration with EU companies, which were selected on the basis of tenders. These studies included guidelines for risk identification, description of possible accidents, modelling of accidents and their consequences, guidelines for internal emergency plans, guidelines for external emergency plans and working example for Liquefied Petroleum Gas (LPG) storage. The aim of the studies was to present the methodology and to train certain number of people to be able to perform studies in compliance with the Directive. From the domestic side, experts from research institutes were selected to lead the process. The problem with this approach was a lack of practical experience while reports were brief and were referencing other literature which was later rarely or not used at all. This was demonstrated when the results were presented in the safety reports.4,5,6
After the first results were published on the Internet pages of the Ministry of the Environment and Spatial Planning, they showed only the information which was allowed to be published, without the necessary details. The message sent to the public set the standard to which all the companies were to comply. The problem was that too little emphasis was given to the process and to the output results which were necessary to obtain during the safety analysis. On the Internet there were no schematic drawings like the one Figure 2. which are necessary for the safety analysis. It was assumed that these schematic dia-
grams were not necessary for the safety report since they were not presented in the pilot reference documents
One of the pilot studies concerned the storage facility for LPG, which was taken as an example of how to treat LPG storage facilities in general. The problem connected with this was that storage facilities do not have the same technology and the same operation practices even the substances kept on the site are different. Since this was not taken into account, some of the later studies nearly copied the Hazard and Operability Study (HAZOP) tables of the example, without taking into account the differences between the example location and their own.
Safety is not a very widespread topic in the technical curriculum in Slovenia. Only one Faculty in Slovenia, namely the Faculty of Chemistry and Chemical Technology of the University of Ljubljana, has safety training and risk assessment in one of the undergraduate programmes.
Safety studies are not new in Slovenia since they were applied to study Nuclear Power Plant safety and along this task a number of experts gained a great deal of knowledge with the help of International Atomic Energy Agency (IAEA), which was used to perform PSA (Probabilistic Safety Assessment levels I and II for the Krsko Nuclear Power Plant (NPP). The story is different in chemical industry, where this knowledge was neither gained nor implemented in every day routine to investigate safety concerns connected to problems with dangerous chemicals in batch and continuous production. Why was it so lies probably in fact that there were no major accidents in the field and also that the legislation was not demanding such studies. More emphasis was given to the safety at work at that time. The first HAZOP study in Slovenia was performed in 1992, on a chemical resin synthesis plant,9 which was caught by fire and the analysis was ordered for the new one based on legislative demands for work per-

Figure 2: Schematics of ISOM unit in Texas City30
mit. After that time there were opportunities to perform HAZOP analyses on some other facilities (Resin synthesis plant, Chemical plant for production of polyurethane and LPG storage), due to legislative pressures on facility operators, during the building and environmental permit level. Legislation on this subject came with joining the EU in 2004. However, there was no inside interest to gain safety analysis results in order to perform better or to have safer and more reliable operation. During these studies a number of interesting findings were reported but they became interesting only when accident scenarios described in the reports became a reality. Some of the accident scenarios occurred only a few months after the safety reports were delivered to the owners of the facility.10
If we compare approach taken in nuclear field and the one in process industries we have to move back to the 80s, when the first attempts to prepare safety analyses of NPP were made in Slovenia. At that time a number of experts were sent abroad to learn the trade from the world's best experts with the help of IAEA (International Atomic Energy Agency). There was interest in the west that nuclear power plant sold to the East European country operates as safely as possible so the knowledge and expensive software for deterministic and probabilistic safety assessment was delivered more or less free together with the technology. Now, thirty years later, the results are good, because knowledge and tools to master deterministic and probabilistic safety analyses were gained on all sides: the legislative side, the user's side, as well as the independent expert side, so the number of experts in this field has reached a critical mass at which the quality is increasing.
In process safety, on the other hand, there was some training on the legislative level regarding the methodology for risk identification and control, and some on the independent expert level, but very little was done to activate the owners to change the attitude towards safety and methods to improve and then to maintain it. When in 2002 the Seveso Directive was introduced to the industry, there was no written guidance on the subject and the methods were explained to the participants through brief seminars which were insufficient to teach attendants how to perform safety analysis and write safety reports; it only gave them some references. The problem was that information was not delivered to the top management, since they always delegated subordinates to participate in seminars and events during information campaigns. Therefore the policy of the management was unclear and safety was again looked at as another burden to be put on the industry, which already has to work and compete in a very difficult environment. So when time was running out, most of them hired the most aggressive experts on the market to write the reports for them with as little as possible of their own participation, since the reports were considered an unpleasant obligation which, however, had to be fulfilled. The result was that the reports were written without anybody learning the essence of the process. In the meantime,
the Ministry of the Environment and Spatial Planning issued Guiding documents in Slovene to give some support to industry, but it was essentially too late for this.7,8
What we see as essential is that there should be critical mass of experts in all areas: legislative, expert and operators. It is of course possible to use experts from Nuclear Safety for support to Process safety but not without participation of the operator staff since they only master methods but not the subject. Critical mass is important also to enable communication among the stake holders which is otherwise impossible. Problem is also with computer codes which can help with safety studies. Software for consequence modelling is very expensive and not all the operators can afford the best on the market which can help them in emergency planning activities.
In the Report on the application in the Member States of Directive 96/82/EC on the control of major-accident hazards involving dangerous substances for the period 2000-2002 there is statement that the total number of establishments that have sent safety reports as required under Article 9 to the competent authorities by the end of 2002 was 3057 (93.3%). In the same document there is statement that 1334 (43.6%) were examined which was explained to be due to large amount of work connected with reports. Regarding internal emergency plans at that time 2983 establishments or 91% had drawn their internal emergency plans while only 1129 (34.4%) establishments had external emergency plans.47
In Slovenia for the year 2005 all 96.2% of upper tier establishments had present safety reports to the competent authority and 100% internal emergency plans while external emergency plans presented 73.1%. 0% of the establishments have informed public on safety issues and none of the external emergency plans were tested.
2. Review and Analysis
Safety reports should be used to inform four different categories of stakeholders, namely:
-	The management of the facility, who must know where the hazards are and how they should be dealt with.
-	The employees of the facility, to make them aware of the hazards, so they can try to prevent them and are prepared in case of an accident scenario, in order to mitigate the consequences. The results of the safety report should be applied in the training of employees, which should be a constituent part of their job.
-	The public, which should be aware of the threat from technology and acquainted with the emergency plan, as well as on their role in case of accident.
-	The authority, which should be informed on the measures taken to prevent a possible accident and
measures to mitigate the consequences following accident occurrence. The report should be written in clear language with explanations to show competency of the operator of the facility, not in a manner just to fulfil the legislative demand. The above target groups should be informed according to the suggestions of experts dealing with risk communication.11,12,13,14
2. 1. Review and Analysis of a Larger Number of Safety Reports
The upper tier SEVESO establishments were obliged to present safety reports according to the article 9. of the Seveso II Directive. In Slovenia there are 26 such establishments and 15 of them were reviewed by external expert which was 58% and more then 2000 pages to review.
First we have to stress that no formal guidance in written form was given to the operators on how to prepare the safety reports. Guidelines were published later by Ministry of Environment and even now they are not very comprehensive. References such as15,16,17 were not used in their preparation. Knowledge on Process Safety was not enhanced with literature like.18,19,20,21
After the deadline given to the companies to submit their safety reports most of them comply by submitting the reports. Most of the submitted reports were given a thorough review by experts outside the Ministry of the Environment and Spatial Planning.22 As a result 4 reports were acceptable with minor improvements, for 7 reports bigger improvements were needed and 4 reports were not acceptable.
The number of these companies is such that insight into their reports is representative enough to suggest the overall quality of the reports in all other companies.
The length of the documents differed enormously, from twenty pages up to five hundred pages, but mostly with the same results and nearly the same deficiencies.
The most common problems with safety reports
In Slovenian legislation it is written that the operators of the facility should demonstrate that they
a)	control Major Accidents with dangerous chemical substances, so that they:
-	are aware of possible accident hazards
-	are aware of Major Accident consequences
-	know scenarios of Major Accidents in the facility
-	are aware of the consequences for people (workers and people in the vicinity) and for the environment
b)	control the probability of occurrence of a Major Accident with appropriate and sufficient means
c)	control and mitigate with appropriate and sufficient means consequences if a Major Accident occurs,
d)	have prepared an Internal Emergency Plan,
e)	have informed the public on the risk and on the safety measures they have to follow
The first set of the safety report problems concerns the authorship of the safety report. It is not always obvious who the author is which according to the HAZOP methodology important data. In most cases, companies hire experts to help them with the safety report. Even though the experts have studied the literature and they even participated in the ARAMIS project23 the overall knowledge is still not sufficient because there is lack of practical experience with the methods due to the fact that safety subjects are not part of the normal engineering curriculum. To be able to draw a fault tree and an event tree which are the tools of probabilistic safety assessment, you have to do it and not just go through the examples in the literature.
In a large number of cases there is no evidence of thorough co-operation between the experts and operators of the plant during the preparation of the safety analysis. Generally speaking, the experts use their knowledge and only ask questions to operators, maintenance people and others in order to verify their assumptions, while these assumptions are not always communicated to the plant personnel. So the plant personnel have only been bystanders in the safety study instead of being active participants in the process.
The history of precursor events is part of some safety reports, but these data are not later reflected in the HAZOP tables, which are a key part of the safety report. The problem with these HAZOP tables is that there are several locations which have similar but not identical activities. Since all of them used the same experts, the results were too similar. The re is a parallel here with James Reason in the book Human error24: once we have found out that the hammer is a good tool for solving problems, we use it all the time, regardless of the nature of the problem.
Almost no HAZOP was properly documented even if done correctly. Traceability of the results is difficult since there is no clear evidence of where they came from and what assumptions were behind the reasoning in the reports.
In some safety reports there were evaluations of safety systems. The results of these evaluations were such that probability of failure was higher than the generic human error failure rate, that is higher then 10-2.
Several reports deal with storage safety. In all of them no special attention was given to the safety systems installed. The safety equipment is nowhere described and assessment of safety elements was done for the scenarios which were taken into account. No attempt was made either to improve safety by redesigning and improving safety systems.
In HAZOP tables there are no recommendations on what to improve and who should be responsible for the improvements. No problems are identified within the HAZOP or there are no reactions to some problems. At the same time, during the HAZID phase, authors proclaim certain problems as safety problems and make a scenario of a
possible accident without any attempt to reduce the probability of such an accident or to reduce the possible consequences of it.
Most of the reports adopt a fatalistic approach to consequences. For example, after filling five tank wagons, all of them burn down in the case of fire. Here we face the question on what grounds we will design an emergency plan.25- 26
Going through the reports one wonders, who is the beneficiary of the report and of the risk identification process.
In some of the reports there are tables with past historic events on the location. Where there were multiple occurrences it is often recognised that there were no proper reactions to the events, and the HAZOP tables do not reflect these historic events in their conclusions and in the forecast of the scenarios. It has been noted that there is sometimes no connection between the HAZOP tables and the history of the plant.
Due to poor or no schematics at all it is difficult to identify HAZOP findings in proper light. It is therefore impossible to understand the findings by people other than the authors themselves, which of course is not the purpose of the report.
Reports in general do not seek to prevent accidents but tend to report the safety status of a process in a very general and superficial way. The aim of the Seveso II Directive is to make plants safer and their owners to be aware of safety issues, in order to be prepared for emergencies and to be able to prevent or at least reduce the consequences of the possible accidents.
In the reports there is mention of human error, but it in general it is treated in a very general and unclear manner. There is often an assumption that the operator will be able in the critical time to perform around ten different actions in proper sequence and that at the same time he will be capable of changing positions of several critical valves listed in the report as appropriate.
Based on all the critical observations above, we can say that what is needed is not a different methodology, which would be even more sophisticated than the methods which are in use throughout the world. What we need is education of people in the plants and also in the regulatory bodies, since both groups need more knowledge than they have today.
When dealing with consequences, use of computer codes is very poorly documented, assumptions are not properly specified and the input data are neither documented nor specified. The problem lies in the use of data, which are gathered from different sources but not documented in a proper way. No attempt has been made to calculate the site specific numbers from the site history, which in some cases would give better or worse numbers than the generic ones.
In some studies it is obvious that when the authors used literature examples, they did not follow the sugge-
stions in the literature to calculate certain parameters.
Scenarios which are taken into account are generally not based on HAZOP results but are somehow deduced from reasoning which was outside of the analysis, and without a sound and clear description of the way in which the scenario was developed.
In scenario one should define how and what should we try to save and how should we prepare for this task? In my opinion, there should be better guidance on how to develop scenarios and what the responsibilities and goals of the people preparing safety reports are.
The following points should be taken into account:
-	Setting priorities
-	Who will be using the methodology
-	What are normal ways of learning safety techniques
-	What kind of experience people using the methodology have
-	What is better - simple and easy to understand or complex and difficult to understand
-	What is the aim of such a study
-	Is it for the benefit of the user
-	Is it for the benefit of the legislator
-	Is it for the benefit of the public, the environment and the user
-	Can we prevent accidents with complex and diffi-cult-to-understand methodology or can we do this with simpler tools
-	Where should more complex methodology be used and where and to whom use of complex results can give more information for:
-	Accident prevention
-	Emergency planning
-	Consequence prevention
-	Consequence modelling
-	Do prefabricated event trees for determining accident scenarios really catch the spirit of the reality of the facility, or do they merely give suggestions which will lead the analyst away from the details which are crucial for safety.
-	The devil lies in the details, as the proverb says.
2. 2. Comparing the Results of the Safety Report Assessment with Several Recent Accidents in Process Industry
In Europe during the last two decades there were number of accidents the number and categories, which can be seen from the following charts:
Safety reports are following demands from legislation so they are in some way standardized. Several recent accidents showed some very important issues which should be detected during preparation of safety report for SEVESO II Directive in Europe or for OSHA requirements in US. Normally information on these accidents is restricted but for some of them is openly available on the
Note: Coverage for the years 1980-1983 is not complete. Figures until 2000 are for EU Member States (EU-9 from 1980, EU-10 from 1981, EU-12 from 1985 and EU-15 since 1995). Figures from 2001 onwards are for European OECD member countries (*).
Source: Major accident reporting system (MARS) managed by the Major Accident Hazards Bureau (MAHB).
Note: Release refers to the leakage of anv
dangerous substance from its container to the environment (air, water or soil).
Source: Major accident reporting svstem (MARS) managed bv the Major Accident Hazards Bureau (MAHB).
Chart 1: Number of major accidents in Europe within 1980 and 2002 and release category.4"
internet and is therefore very convenient for benchmarking the findings of the analysis with the findings of accident investigations. The key issue is can we persuade owners of SEVESO facilities to improve their safety reports to be able to cope with accidents such as Texas City, Bun-cefield, ConocoPhillips Humber Refinery, BP Grange-mouth, Enshede, Toulouse etc.
2. 3. 1. Texas City Accident
Why did we choose the Texas City Accident? Because it is one of the most extensively researched accidents in the process industries ever and there were a number of reports 27,28 prepared by different organizations and on different aspects to cover the accident and also its context. It shows the importance of organization as well as how the common safety and process knowledge has to be disseminated through the company in order to prevent an accident and in order to reduce and mitigate the consequences if it occurs.
2. 3. 1. 1. Comparison with Stanley's Report
In Stanley's report, which followed two months after the occurrence of the accident, there were several areas where the assessment team felt that the problems had come from. We can see that the recommendations are often identical to the findings regarding safety reports.
The areas of recommendations in Stanley's report29:
-	Leadership
-	Risk Awareness
-	Control of Work
-	Workplace Conditions
-	Contractor Management
With regard to Leadership it was recommended that the Leaders should explicitly define their expectations regarding safety. It was found that there was no clear message to the employees regarding safety expectations in the plant. Managers should make supervisors and superintendents accountable for the implementation of rules and procedures in their areas of responsibility.
All processes within safety reports show that managers mostly do not define safety as a priority in business policy. Therefore safety reports are made by outside companies with as little involvement as possible of the plant staff. Due to this approach safety procedures are mostly non-transparent and unclear, if they are present at all.
Risk Awareness is also a problem in safety reports. Because plant personnel have a limited access to participation in the safety report, they also have a limited knowledge of safety issues and also of the operation of the plant. From past experience we know that people from the investment group and designers do not transfer their project knowledge to the operation personnel; therefore this knowledge can be transferred through the HAZOP process if it is carried out appropriately.
Furthermore, when the accident scenario is defined, it should also be explained how the accident started. Thinking about possible causes of the accident gives the participants of the process an opportunity to be aware of the possible risks, which is not possible if they are not aware of the reasons for safety solutions in the plant.
Past accidents and near misses are also important for the potential course of the accident, as well as for focusing our attention to the right direction.
Carrying out HAZOP at a more generic level is very dangerous since the team falls into the pattern of copying a previous analysis, forgetting to find out and to analyze differences. These differences are connected with operation, because there are different people with different training and previous experience controlling the process, so these differences should be identified. In most cases the differences have not been identified so Risk Awareness has been low.
It is important that project knowledge and operating experience are passed also to new workers, so that they know what and why to do in critical moments and also at normal operation assignments.
Control of Work is very important as it is a guarantee that the operating procedures are executed in accordance with safety rules established for the work. To avoid different interpretations and wrong practice spreading, a Single Point of Accountability should be formed to review all project work and all maintenance. All work concerned with safety should be executed in accordance with the existing Control of Work processes.
Workplace Conditions should be examples of good 'housekeeping'. Workers should develop an ownership attitude towards the facility. The control room activities should be limited to essential work processes.
Contractor management is one of the main problems which have to be solved to increase safety on the facility. The attitude of workers on the site towards the contractor workers should be improved.
If we compare the findings with the CSB report 30 we find even more From the above problems which were identified at Texas City only a few are such that they are not valid universally across the industry. Most of them are also valid for new processes because there is always a lack of time, lack of resources and lack of money for safety, especially for process safety. In most safety reports transition states were not included in the analysis (start-ups and shut-downs). There was no analysis of needed redundancy for the process instrumentation. There was no record on how the training was to be accomplished.
The main problem was that the written procedures were not in place or if they were their quality was questionable.
Since the personnel did not participate in the safety analysis it is doubtful if their knowledge of the process was sufficient to cope with problems during emergency. Because the HAZOP analysis did not contain the past accidents from the site it is doubtful if the operators would be able to cope even with what already happened on the site.
In most safety reports there is an exaggerated belief that personnel will always respond in a proper manner without written procedures. In some cases they were confident that they would execute as many as ten steps of the
emergency procedure in proper order, no matter what the initiating event would be. The main problem would be to close the appropriate valves without defining which valves are appropriate.
2. 3. 2. Comparing the Identified Issues with the Buncefield Accident Recommendations
If we compare what we found in the safety reports with the Buncefield recommendations31, 32 we can say that these recommendations were just a response to the prevailing problem which occurred there. This problem is common in industry and as such it is always present. The problem is that the obvious things are the hardest to master. Buncefield was a highly automated storage with more indicators than usual and automatic systems taking care of the processes to take the burden from the operator. During the filling of the tank, the operators lost control of the process and since the level meter did not change the position, there was no alarm for several hours, when the tank was already filled. So the attention of operators was not oriented towards the process and they lost control over it. It was forgotten until an explosion occurred.
2. 3. 3. Benchmarking with the Public Report of the Fire and Explosion at the Conoco-Phillips Humber Refinery
In the ConocoPhillips Humber Refinery there was an explosion33 on the Saturate Gas Plant de-Ethaniser. The problem was an inside corrosion of the pipe elbow where nearby water was added into the pipeline and there was corrosion/erosion of the elbow downstream of the addition point. The critical point had not been examined for twenty years in spite of the fact that corrosion problems had been identified before, during routine inspections, without a follow-up of more thorough examination of the critical points.
In most safety reports no corrosion/erosion problems were mentioned even though such problems exist.
The problem of mechanical integrity should be one of the most important ones and so measures should be taken to prevent loosing integrity due to corrosion and other mechanisms.
2. 3. 4. Benchmark Against Incident Report BP Grangemouth Scotland
In Grangemouth Refinery34 there was a fire and an explosion on the Fluidised Catalytic Cracker Unit, where a pipeline failed due to vibration cracking. Vibrations were a consequence of the missing support of the pipeline which was under the insulation and thus hidden from eye inspection.
Numerous start-ups were imposed on the unit before the accident, due to problems caused by several previous
modifications performed on the unit. These start-ups caused the vibrations of the pipeline, which was left unsupported. The vibrations caused fatigue of material, which lead to the accident.
The lesson learned is that we have to verify whether the supports of the pipelines are where they have to be. This can be verified by checking the vibrations of the pipelines or by examining the onsite state with project drawings.
2. 3. 5 Experience with the Enschede Accident
The accident happened in a fireworks factory, following a fire in the complex.35,36 Because of this accident, the Seveso II Directive was amended. This gives the accident a special status since it was the reason for changing the most important directive regulating the chemical field. In the final Considerations it is stated that there were problems with the facility under a previous owner, and later these problems escalated with the new owners. The problem was that the competent authority did not supervise the facility according to the permission issued. The escalation of violations continued until an explosion occurred after a fire started in the area of the facility which was overloaded with fireworks of a much heavier class than permitted. The factory place, which at the beginning stored 18 t of fireworks ended with 180 t of fireworks. Only 150 were eligible and two containers were not within the permit and of a much higher class than permitted.
2. 3. 6. The Toulouse Accident and its Impact on the SEVESO II Directive and Safety
On September 21st 2001 there was a catastrophic explosion in a fertilizer plant Grande Paroisse in Toulouse.37, 38, 39 On the site, where there was a large amount of dangerous substances, there was an explosion of approximately 400 t of ammonium nitrate in different forms which did not meet the production specifications. More detailed data on the accident can be obtained from literature but the most important message is the following:
The establishment was governed by the SEVESO I Directive and then the SEVESO II directive, due to the presence of ammonia, chlorine, toxic or combustive substances, ammonium nitrate, and nitrate-based fertilizers. Several risk studies were conducted since 1982. They were updated every 5 years, some of them were carried out in 2000 and the most recent one in 2001. In these studies, several dozens of accident scenarios were analysed, but the detonation of ammonium nitrates was disregarded based on the available feedback; the contingency plan did thus not foresee a scenario of this type.
The site was inspected periodically (approximately twice per year). The last inspection was conducted on May 17th, 2001 by the Registered Installations Inspectorate (DRIRE), and it focused on several elements of the safety management system.
It was established that the method of evaluation of risk proved to be insufficient. In our opinion it is difficult to say whether the method was deficient or whether it was used with a bias by the assessors who were confident that the explosion of the ammonium nitrates (used in compliance with the standard) was improbable. However, there was a small amount of products which did not meet the product specifications. Nobody was aware of the safety problem with these ammonium nitrates, which were contaminated with impurities, and which may have caused the accident. In the analyses which were done afterwards to establish the cause for accident40 they found, for example, that in a fire, pools of molten ammonium nitrate may be formed and if the molten mass becomes confined (e.g. in drains, pipes, plant or machinery) it could explode, particularly if it becomes contaminated. Although the exact cause of the accident was not found, it showed that we must not underestimate the possible outcomes with dangerous substances, even if we are 100% sure that there is no danger when we follow the standards.
We can assume that the method of risk evaluation is as good as our knowledge of the substance in question. Therefore, we should not blame the method for our failure to recognize the threat. If a new method is needed which would improve our ability to recognize the risk from ammonium nitrates fertilizers, this is not one of the existing ones.
It might be more effective to concentrate on the prevention of accidents instead of analysing the risk.
3. Discussion
There are some assumptions which are implicitly hidden in the legislation. These assumptions are that the operators will produce report which will be of use to the facility and also to the competent authority. The next assumption is that the methodology is not a problem since the operators can master it through its own personnel or through the hired experts from the market.
3. 1. Is Process Safety a Methodology Problem?
From the above it is obvious that operators, maintenance people and other workers in a plant really need to know the status of the plant and what is going on with the processes in it.
It is often the case that money-saving methods rob operators of the most needed information signals, which should be monitored during the operation and during the other operation states. Some signals which should be made redundant are not due to money shortcuts and sometimes due to equipment failures which were not being recognized or given attention in timely manner.
Going deep into the process of hazard identification and assessment, in using the results of this process we find out that in general there are problems only with the use of the results of Risk Assessment and Process Safety Assessment.
The existing methods are more or less good; they are simple enough, so the results should be communicated to the four stakeholders of this process.
Although it seems easy task to accomplish it is very difficult task because it is essential when we would like to explain the results of safety study to people who are from very different professions than we are and are mostly concerned about safety of their live, environment and the loved ones.
We find that most of the problems come from lack of communication.
Wrong reasoning is that numbers are the essential substance from safety analysis. Essentially the most precious result is gathered from the process of safety analysis. That is where the knowledge coming from the group session is getting widespread along the departments and across the facility.
The problem sensed in the safety community is that researchers have to have sound results which are supported by numbers. Due to run for numbers the most important issues are lost, beginning with the identification of accidents scenarios.
We see the ARAMIS project as a trial to improve the safety analysis with numbers and by giving generic scenarios which can help to a certain point, but in our view it fails to make a step forward by giving new value to process safety.
The essential question is whether we can detect more hazards by using the ARAMIS methodology or is it just that we add numbers to the existing methodology, but in my view we also add unnecessary complexity, which is a problem when we want to communicate the results to the above mentioned stakeholders.
When a new methodology is developed, it should be tested on several case studies and also by different teams to obtain similar results on benchmarking. But before we do that we have to answer the following questions.
-	Do we need a new methodology?
-	Why do we need a new methodology?
-	What is its aim?
-	Is it simple enough to be used across the field?
-	Where do we expect benefits?
-	Will the facilities be safer because of it?
-	Who are its target users?
When we answer these questions, we have a rough answer as to what we need. A while ago there was an article in zSafety Engineering and Systems Safety' entitled zDo not repair if it ain't broken', dealing with the introduction of new methods in probabilistic safety assessment. In my view we are at the same point today with more sophisticated approaches when we are not even able
to use the present, relatively easy methods because of our tendency to simplify where simplification is not appropriate.
Would the assessors find out the cause of the Toulouse accident or would it stay hidden behind the noise of the other scenarios.
Safety analysis can only be done with experienced people who are trained in methods but who also have experience with the processes. It is mandatory that the participants in the process are delegated by the managers of the facility since only then are they cooperative and valuable for the safety analysis process.
3. 2. Opinion of the Slovenian Operators on the Need to Comply with the Demands of the Seveso II Directive
The Ministry of the Environment and Spatial Planning initiated a project to verify the compliance with the Seveso II Directive41. A questionnaire was sent to all of the 49 owners, and 31 of them responded (63%). In Slovenia there are at the moment 34 lower-tier companies and 24 upper-tier companies which have to comply with the Seveso II Directive.
The questionnaire sent to the owners of the companies consists of 37 questions, 16 of which concern the status of fulfilling of legislation, 5 relate to how they meet the requirements, 6 to how they are introducing various standards ISO 14000 and OHSAS 18000 and the other 8 to how the legislative demands have improved safety performance and safety indicators, and also to what is the real safety status. The last two questions ask for suggestions from the owners. The result of the questionnaire analysis confirmed the findings from the safety reports review. Only 6 out of 31 owners think that complying with legislation is beneficial, while all the others see it as a legislative burden which gives very little to the owners in the form of added value. The lack of numerical safety indicators gives no clue if safety is sufficient. Industry feels that the great workload of preparation of the safety report is not rewarded, because their reports are rejected by the ministry partly on formal ground and partly without substantial explanation of how to improve the quality of the report and at the same time also the safety and the safety culture.
The Safety Management System is seen as another format of standards ISO 9000, ISO 14000, OHSAS 18000, or as a group documents which do not function in practice, since work is done quite differently from the way this is described in the safety report.
Because industry has to fulfil demands of several legislative bodies, they feel that they are doing work several times, just in different formats. The complaint is that the most valuable men are used for several months to prepare the safety report and are therefore not available for operation in production.
4. Conclusions
Council Directive 96/82/EC on the control of major accident hazards involving dangerous substances was clearly aimed at preventing accidents and to mitigate the consequences of these accidents. Although the Directive was in place, there were some major accidents in Europe, as well as in the world, which have challenged its effectiveness to first prevent and later to mitigate the consequences. The Enschede and Toulouse accidents forced the EU legislators to amend the Seveso II Directive due to these accidents.
On the other hand, new member states have started to comply with the directive, but are having problems due to the fact that the methods and approaches used to prepare safety reports in accordance with the Seveso II Directive are not part of the daily routine but something new. Although the methods were known, they were not used to improve the safety of the installations. The last but not the least important reason for problems with these methods is that they are not being taught at the university level; they are either part of the some brief seminars or are learned from literature, which is only possible if there is enough practice associated with these studies.
Another problem connected with the use of methodology is also the lack of experience, which is present also in the developed EU and non-EU countries, and also disregarding the history of accidents, which makes it possible to learn from the past and also to prevent repetition of accident scenarios. We can use the MARS data base for this purpose, in order to find problems that are similar to our own. In the last ten years there were several accidents which had a great impact on safety thinking and also on the attitudes towards the SEVESO II compliance, both on the side of operators and on the side of regulators and the population.
The effectiveness of legislation can be estimated by reviewing safety reports and by comparing the results of the reports with the recommendations which were made after some of the major accidents in the last period of time. By going through the recommendations we can observe that almost nothing new appears on the list. The problem with these rather old issues is that operators and their advisers do not take the threats seriously and mostly act as if nothing can happen to them.
The importance of identifying as many scenarios as possible is connected with the fact that when we expect a scenario to occur, then the surprise is not the 'fundamental surprise' defined by Z. Lanir.42 If we do not take into account certain scenarios then we do not respond in a proper manner and instead we are paralyzed due to the fundamental surprise which prevented us to respond.
The Safety Management System is demanded by the Directive and is closely related to the leadership, which is the first and most important issue, because everything goes through the hierarchy of the organization. The next
important thing is risk awareness of the people on the site. People must and should be acquainted with the risks so as to be able to manage them. Even though people know what they should do there has to be an established control of work which can capture in due time deviations from work procedures, which in turn must be clear and transparent. Working conditions should be designed so that the workers could master the most important jobs. Overworking should have its limits, especially when transient conditions are underway.
On the site there should be a strict contractor management system in order to achieve similar safety standards also for the outside sources, which is sometimes rather difficult.
From the accidents described in the paper we can derive certain problems which are connected to instrumentation, pipelines and installation. The American OSHA 29 CFR 1910.11943 deals with Mechanical Integrity, which in our opinion is a very important aspect. When a safety report does not include corrosion/erosion issues and when there is no mention of testing of control equipment, it is very doubtful if the Safety Management System is in place.
Another big problem, according to our findings and also according to the follow-up report on Seveso II implementation, are External Emergency plans, which are all at very early stages throughout Europe, while Internal Emergency Plans are more or less part of the Safety report and are finished.
The last but not the least important problem is connected with the ownership of the facility, which in our opinion should be treated as a major change in operation (Texas City and Enschede accidents) and it should involve safety report revision due to the fact that the present operator was not the one to fulfil the demands of the Directive. He should be the fully acquainted with the hazards and preventive measures to be able prevent accidents or, if they occur, to mitigate them.
The Directive should stress the importance of having trained personnel, and should therefore include training based on safety analysis as mandatory in a formal way, as well as dealing with Management of Change.
On the side of the regulator we see problems with inspections, which tend to focus on the formal rather than on the contents part, as seen in the case of the Toulouse accident.
In Slovenia, preparation of safety reports in accordance with the Seveso II Directive is generally viewed by operators as a burden with little impact on safety. The same goes for the preparation of the internal Emergency Plan. Only 20% see the importance of preparing the safety report, while all others see the work connected with the preparation of the safety report as a bureaucratic burden which does not contribute much to the level of safety. In the report there is a remark that the ministry's attitude of not accepting reports and demanding revisions is proble-
matic, since there is no guidance for improvement. Nobody sees the problem in insufficient understanding of the process and in the wrong attitude towards the process as a whole.
A final suggestion would be to try to change the approach which is not giving the best results and not the methods of risk identification.
5. References
1.	Directive 2003/105/EC of the European Parliament and of the Council of 16 December 2003 amending Council Directive 96/82/EC on the control of major-accident hazards involving dangerous substances
2.	Regulation on prevention of major accidents and mitigation of their consequences (Official Gazette RS No. 88/2005)
3.	Regulation on content and preparation of emergency plans (Official Gazette RS No. 3/2002 (17/2002 amended) Amendment Official Gazette RS, No.17/2006
4.	Project: Preparedness for accidents with dangerous substances in Slovenija, task 1 a) Guidelines for hazard identification and risk assessment (360006-23-RP-101), Project Management Group, 27. November 2002
5.	Project: Preparedness for accidents with dangerous substances in Slovenija, task 1 b) Possible Accidents by organizations, which work under SEVESO II Directive ((360006-23-RP-102), Project Management Group, 27. November 2002
6.	Project: Preparedness for accidents with dangerous substances in Slovenija, task 1b) Modeling of Accident Scenarios and their consequences (360006-23-RP-103), Project Management Group, 27. November 2002
7.	Ministry for the Environment and Spatial Planning: Guidelines for environmental risk reduction plan, Ver.2, Ljubljana, February 2006
8.	Ministry for the Environment and Spatial Planning: Guidelines for preparation of Safety report, December 2006
9.	M. KOŽUH, B. MAVKO, Dj. VOJNOVIC,. Safety and reliability problems in chemical plant recognized during preope-rational phase and operating experience backfitting. V: SCHUELLER, G.I. (ur.), SHINOZUKA, M. (ur.), YAO, J.T.P. (ur.). Proceedings of ICOSSAR '93, Vol. 2 : The 6th International Conference on Structural Safety and Reliability, Innsbruck, Austria, 9-13 August 1993. Rotterdam: A. A. Bal-kema Publishers, 1994, pp. 1941-1944
10.	M. KOŽUH, J. PEKLENIK: A method for identification and quantification of latent weaknesses in complex systems. Cognition, technology & work, 1999, vol. 1, no. 4, pp. 211221
11.	B. Fischhoff et all: Approaches to Acceptable Risk: A Critical Guide, NUREG/CR-1614, 1980
12.	B. Fischhoff: Improving Risk Communication, Appendix C: Risk: A Guide to Controversy, National Academy Press, Washington D.C. 1989
13.	V. Covello: Risk Communication
14.	P. M. Sandman: The Boss's Outrage: Talking with Top Ma-
nagement about Safety, The Synergist, pp. 39, 41-42, December 2006
15.	G.A. Papadakis, A. Amendola: GUIDANCE ON THE PREPARATION OF A SAFETY REPORT TO MEET THE REQUIREMENTS OF COUNCIL DIRECTIVE 96/82/EC (SEVESO II) JOINT RESEARCH CENTRE EUROPEAN COMMISSION, INSTITUTE FOR SYSTEMS INFORMATICS AND SAFETY, EUR 17690 EN, 1997
16.	N. Mitchison, S. Porter: Guidelines on a Major Accident Prevention Policy and Safety Management System as required by Council Directive 96/82/EC (SEVESO II) - EUR 18123 EN, European Commission - Joint Research Centre, Institute for Systems, Informatics and Safety
17.	L. Fabbri, M. Struckl, M. Wood: Guidance on a Preparation of a Safety Report to meet the Requirements of Directive 96/82/EC as amended by Directive 2003/105/EC - Report EUR 22113 EN, European Commission - Joint Research Centre, Institute for Systems, Informatics and Safety
18.	S. Mannan: Lees' Loss Prevention in the Process Industries, Third Edition, Elsevier 2005
19.	R. King, R. Hirst: KING'S SAFETY IN THE PROCESS INDUSTRIES Second Edition, Arnold, 1998
20.	Kletz T.: Hazop & Hazan Notes on the Identification and As-sesment of Hazards, Second Edition, The Institution of Chemical Engineers, Rugby, UK, 1986
21.	Roberts H. R., Vesely W. E., Haasl D. F., Goldberg F. F.: Fault Tree Handbook, US NRC, NUREG-0492, 1981
22.	M. Kožuh: Report on review of thirteen safety reports submitted to Ministry of the Environment and Spatial Planning for satisfaction of demands of the Regulation on measures for environmental risk reduction due to major accidents with dangerous chemicals (Official Gazette RS No. 46/2002) respectively SEVESO II Directive
23.	ARAMIS Accidental Risk Assessment Methodology for Industries in the Context of the Seveso II Directive: USER GUIDE, December 2004
24.	J. Reason: Human Error, Cambridge University Press, Cambridge 1990
25.	Erik Auf der Heide: Disaster Response - Principles of Preparation and Coordination 1989
26.	P. M. Sandman: Worst Case Scenarios, Posted: August 28, 2004
27.	J. Baker et al:The Report Of The BP U.S. Refineries Independent Safety Review Panel, January 2007
28.	J. Mogford: Fatal Accident Investigation Report, Isomeriza-tion Unit Explosion, Final Report Texas City, Texas, USA
29.	J.W.Stanley: Process and Operational Audit Report, BP Texas City June 15, 2005
30.	U.S. Chemical Safety And Hazard Investigation Board: Investigation Report Report No. 2005-04-I-Tx Refinery Explosion And Fire, March 20th 2007
31.	Ken Rivers et al: Buncefield Standards Task Group Safety and environmental standards for fuel storage sites, Buncefield Standards Task Group (BSTG), Final report, 24 July 2007
32.	Buncefield Major Incident Investigation Board: Recommendations on the design and operation of fuel storage sites, March 2007
33.	HSE: Public Report of The Fire And Explosion At The Conoco Phillips Humber Refinery On 16 April 2001, December 2005
34.	HSE & SEPA: Major Incident Report, BP Grangemouth, Scotland, 29th May, 10thJune 2000, 18th August 2003
35.	Ministry of the Interior and Kingdom Relations: Final Report - Final Considerations on the firework disaster in Ensc-hede, March 2001
36.	Feedback seminar - IMPEL / ICPE inspectors - Reims, June 12 - 13, 2001, "LESSONS LEARNT FROM INDUSTRIAL ACCIDENTS" ICPE / IMPEL inspectors
37.	Paris, Tuesday 30 October 2001 Press Release: EXPLOSION AT THE AZF FACTORY IN TOULOUSE: THE GENERAL INSPECTORATE FOR THE ENVIRONMENT HANDS OVER ITS REPORT TO YVES COCHET
38.	Feedback seminar - IMPEL / CI inspectors - Bordeaux, June 11 - 12, 2002, LESSONS LEARNT FROM INDUSTRIAL ACCIDENTS, Classified installations / IMPEL inspectors
39.	Henri Farreny Explosion d'une usine chimique à Toulouse, SPS n° 250, décembre 2001, Marie-Astrid KORDEK
40.	INERIS RAPPORT D'ÉTUDE 2/05/2005 N° 65281 Les engrais solides à base de nitrate d'ammonium risques, types d'accidents, enjeux laboratoires d'evaluation des matieres dangereuses, direction de la certification,?
41.	B. Kontic, M. Gerbec: Questionnaire on implementation of Seveso II Directive in Slovenija, IJS-DP-9436, Ljubljana, July 2006
42.	Z. Lanir: Fundamental Surprises; Decision Research 1201 Oak Street Eugene, Oregon 97401 And Center for Strategic Studies University of Tel Aviv Ramat Aviv, Israel 2006
43.	Summary of Process Safety Management (PSM) of Highly Hazardous Chemicals (29 CFR 1910.119)
44.	EUR 22113 Guidance on the Preparation of a Safety Report to Meet the Requirements of Directive 96/82/EC as Amended by Directive 2003/105/EC (Seveso II), Luciano Fabbri, Michael Struckl and Maureen Wood (Eds), ISBN 92-7901301-7
45.	Environmental issue report No. 35: Mapping the impacts of recent natural disasters and technological accidents in Europe, European Environmental Agency, EEA Copenhagen 2003
46.	Impel network European Network for the implementation and Enforcement of Environmental Law "Interrelationship between IPPC, EIA, SEVESO Directives and EMAS regulation" Final report December 1998
47.	DRAFT REPORT FROM THE COMMISSION Report on the application in the Member States of Directive 96/82/EC on the control of major-accident hazards involving dangerous substances for the period 2000-2002, (Text with EEA relevance)
48.	Report on the application in the Member States of Directive 96/82/EC on the control of major-accident hazards involving dangerous substances for the period 2003-2005
Povzetek
Nove države evropske unije so sprejele evropsko zakonodajo na področju varstva okolja in po sprejetju lete so jo tudi spravile v življenje. Članek obravnava probleme z implementacijo Seveso II smernice1, ki so bili identificirani pri pregledu varnostnih poročil , ki so bila predložena pristojnemu organu. Na prvi pogled se zakonodaja ne zdi problematična, toda ob podrobnejšem pregledu se pokažejo številni problemi, za katere menimo, da bi bili zanimivi za širšo javnost. Upravljavci obratov z večjo količino nevarnih snovi morajo skladno z zakonodajo pripraviti varnostna poročila, ki morajo pokazati, da so identificirali nevarnosti in da vedo kako se njimi spopasti. To se lahko opravi samo z usposoblja-nimi kadri, ki lahko rezultate uporabijo za poboljšanje varnosti.