The First 10 Minutes Are Not in the Safety Basis

I have read a lot of hazard analyses for Chemical, Biological, Radiological, Nuclear and Energetic (CBRNE) facilities. Very few of them answer a simple question: How does an injured person get off the hot side?

Before I did this work, I ran calls as a paramedic. That is probably why the question has always stuck with me. On the engineering side, a facility is a set of hazards, safeguards and separation distances. On the response side, it is a place people have to maneuver in and out of on its worst day. Those two pictures are usually drawn by different people, and they are almost never checked against each other.

The Analysis Stops Where the Event Starts

Most of what we produce is preventive. A dust hazards analysis identifies ignition scenarios and credits protection. A process hazard analysis works through deviations and safeguards. An explosives safety submission establishes siting and quantity-distance. All of it is aimed at keeping the event from happening or keeping its effects inside a purposely drawn boundary.

The emergency response plan picks up after that boundary has already been crossed. It is usually written later, by a different group, against a different set of assumptions. Nobody is assigned to check whether the two documents describe the same building, which can create a critical gap. 

Three Places It Shows Up

Decontamination treated as a procedure instead of a design constraint. 

Decontamination shows up in the response plan as a set of steps. It rarely shows up in the design as a throughput number:

• How many people?
• How fast?
• How much water?
• And going where? 

If these answers are not in the design basis, the space allocated to it is whatever was left over, and the drainage becomes an uncontrolled hazard, or environmental concern.

Egress that assumes a clean occupant. 

Egress analysis assumes people leave. In a contaminated release, some of them cannot leave, at least not by the route the analysis credited, and not without taking the hazard with them. A path that satisfies the building code can still be the path that spreads the problem into the administrative area.

Mutual aid that cannot enter the boundary we created. 

Siting and separation are built to keep exposures out. That same geometry decides where an ambulance can stage, how far a crew has to walk with a patient, and whether the responding department has ever seen the inside of the fence. If the answer to the last one is no, everything upstream of it is theoretical.

Why it Persists

It persists, not because anyone did their job badly, but because the seam has no owner.

The engineer owns the hazard analysis. 

Environment, Health and Safety (EHS) or security owns the emergency plan. 

Operations owns the procedures. 

Each product is reviewed inside its own discipline, by people qualified to review it, against criteria that do not require them to open the other documents. There is no step in the process where somebody sits with all three and asks whether the assumptions match.

Nothing in a standard tells you to do that. It has to be somebody's assigned job, or it does not happen.

What to Raise in Your Next Design Review

Three questions. None of them require a new study.

1. What is the decontamination throughput assumption, and where did it come from? If the answer is a procedure rather than a number, you have found the gap.
2. Was the emergency response plan written against the current layout or the one from concept design? 
   While layouts move, response plans usually do not move with them.
3. When did the responding fire department or Emergency Medical Services agency last walk the site?
   Specifically, not whether they have the plan on file, but whether they have been inside.

The Point

CBRNE work is often described as chemical, biological, radiological, nuclear and energetic hazards in one place. That is accurate, but it undersells the actual difficulty. The hard part is not that the hazards coexist. It is that each one arrives with its own analysis, governing requirements and set of people, and the failures show up at the joints between them rather than inside any one of them.

The response interface is one of those joints and it is the one we look at the least. We spend enormous effort making sure an event does not happen, and comparatively little on what the facility does to the people who have to work through one.

The measure of a safety basis is not how many studies it contains. It is whether the building behaves the way those studies said it would, on the day it matters, for the people who are still inside it.

If your facility handles energetics, industrial chemistry or high-hazard materials, the response interface is worth an hour of somebody's attention before a plan revision is made. We are happy to talk through what that review would look like for your unique needs.