“I don’t worry about the bullet with my name on it. Can’t do anything about that. It’s the bullet addressed to ‘Occupant’ that I worry about.” — Drew Schmidt
I don’t get as much junk mail as I used to. Now, I get junk emails and junk texts. When I do get junk mail, however, it is often addressed to “Occupant”. It’s mine because I happen to be at the place it was sent. If I were someplace else, it wouldn’t get to me. When the postal service delivers mail addressed to “Occupant” at a vacant building, it just piles up in the mailbox and no one gets it.
If there is no one there to receive it, it doesn’t get to anyone.
Being There
During an incident, a hazardous event happens. In process incidents, the events are typically toxic releases, fires, or explosions. The severity of the incident is not the severity of the event, however; it is the severity of the impact on receptors. Generally, there are four categories of receptors: employees, the community, the environment, and assets. The severity of the impact depends on receptors being present.
During a Layer of Protection Analysis (LOPA), which is a study of likelihood, we consider the likely impact of an event on receptors. The severity of the impact depends on how likely receptors are to be present—their occupancy. The environment is always present. The community is always present, or at least, the presence of the community is not something that can be controlled. Except in the unusual case of portable assets, we can also assume that assets are always present.
That leaves employees, the only receptor whose presence we have any control over. During an incident, when there are no employees present to be hurt, there is no impact to employees, regardless of the severity of the event itself. An explosion at a remotely operated facility in the middle of the desert will not hurt anyone, even if all it leaves behind is smoking crater.
This is the basis of OSHA’s exemption in the Process Safety Management (PSM) standard for Normally Unoccupied Remote Facilities (NURFs), 29 CFR 1910.119(a)(2)(iii)
Regulatory Perspective
From a regulatory perspective, a facility is either unoccupied or occupied. An unoccupied facility is only visited periodically, with no employees permanently stationed at the facility.
When a facility is occupied, fire marshals have an interest in establishing the maximum allowable occupancy for the purposes of assuring escape during a fire. The maximum allowable occupancy is based on the service of the space and its area. The maximum allowable occupancy then drives the number and capacity of the fire exit routes.
When the fire marshal posts a sign that limits the maximum occupancy, they are not judging the structural ability of the space to support that many people or stating that they expect that many people to be present. The maximum occupancy relates to consequences. The maximum occupancy does not consider likelihood, so it does not consider risk.
Occupancy During an Incident
Understanding occupancy during an incident requires understanding what “there” is and understanding the likelihood that personnel will be “there”.
Most LOPA teams have a good instinct for what “there” is. How big will a fire be? How far will the toxic release spread? What will be the extent of the blast wave from an explosion? In any case, there are many tools available for calculating the extent of the “there”. A good starting point is the USEPA Risk Management Program Guidance for Offsite Consequence Analysis.
The USEPA’s guidance doesn’t say anything about the likelihood of being “there”, however. That is because the USEPA’s jurisdiction is not over employee safety, but the community and environment, both of which are assumed to always be present.
To understand the likelihood that personnel will be “there” requires an understanding of how a specific facility is operated and maintained. What fraction of the time are personnel “there”?
If an event occurs without warning—randomly—then the likelihood of personnel being “there” is independent. What percentage of the time are operators “there”? If they are only “there” during rounds, which are done twice per 12-hour shift and take 15 minutes, then operator occupancy is
2 x 10 min / 12 hours x 1 hour/60 minutes = 0.028
What percentage of the time are maintenance technicians “there”? If they are only “there” performing maintenance five times per year, and each maintenance activity takes about 4 hours, then maintenance occupancy is
5 x 4 hours / 1 year x 1 year/365 days x 1 day/24 hours = 0.0023
Combined, the total occupancy in this example is 0.030.
If the event has warning signals, however, it is not random. Instead, those warning signals often prompt us to send someone “there” to check it out. In that case, the occupancy goes from a probability of 0.030, or whatever small number it is, to 100%. The person or persons who are there to check it out are transformed into victims. The risk for the same event can increase by an order of magnitude or more.
During a LOPA, the team needs to include members who understand the details of occupancy during a specific event.
Too Conservative
Some organizations, in an effort avoid the judgment involved in understanding the details of occupancy, have a policy that occupancy cannot be considered. Or, if it can be considered, it can be no lower than 0.1. To put that in context, an occupancy of 0.1 means that someone is “there” for 2.4 hours each day.
If it is true that personnel are “there” for 2.4 hours each day, then use an occupancy of 0.1. If personnel are “there” for more time each day, then use an occupancy that is greater, and if personnel will always be “there”, then do not consider occupancy as a means of risk reduction.
On the other hand, if occupancy averages less than 2.4 hours each day, then use an occupancy less than 0.1. We reduce risk by keeping personnel out of harm’s way. The more we keep them out of harm’s way, the lower the risk. If we have policies that limit the credit we take in a LOPA for keeping personnel out of harm’s way, it has the unintended consequence of discouraging this approach to risk reduction.
Understand Occupancy
It may be that policies prescribe the amount of credit to take for occupancy during a LOPA. For team members on a LOPA, it is what it is. But understanding risk still requires that we understand occupancy, regardless of policies.
Occupancy during a process incident depends on how the process is operated and maintained. Not on the process design or on most of the other documentation that goes with a process. So, understanding occupancy during a process incident depends on consulting with the operators and maintenance technicians who understand how the process is operated and maintained.
To the extent it is possible, let’s all push for policies that allow for careful consideration of occupancy and encourage keeping personnel out of harm’s way.
