Business Continuity and Disaster Management for ...

Business Continuity and Disaster Management for Industrial Installations 2013 Petroleum and Chemical Industry Committee Technical Conference Chicago, IL - September 23-25, 2013

Authors • Paul “Eddie” Guidry - FLUOR • David Vaughn - FLUOR • Richard P. Anderson, Jr., P.E. - FLUOR • Janet Flores - Rockwell Automation

Business Continuity and Disaster Management for Industrial Installations

2

IEEE IAS PCIC 2013

Researchers at Rice University found that had (Hurricane) Ike (Sept. 13, 2008) struck slightly further West on Galveston Island it would have… • Inundated scores of chemical plants and refineries • Shut down the source of 40% of the nation's jet fuel • Lost ≥ 27% of the nation’s gasoline production • Lost 42% of the nation’s chemical feed stocks Source: Houston Chronicle June 2, 2013 Business Continuity and Disaster Management for Industrial Installations

3

IEEE IAS PCIC 2013

To stay competitive risks must be managed • Impact to physical facilities is minor when compared to the cost impact measured in terms of Business Interruption • Impacts from events can be very devastating ▫ Japan 2011 earthquake and tsunami ▫ Super Storm Sandy 2012 ▫ Oklahoma City 2013 tornado

▫ Drought, wildfire, flooding, severe storms, etc 1. Nearly all of these risks are known 2. Risk models have been developed to predict these risks 3. Plans can be made to counter the negative effects


4

IEEE IAS PCIC 2013

U.S. Natural Disaster Map


5

IEEE IAS PCIC 2013

Have We Learned From Natural Disasters?

2,000,000

Number of people killed

4,000,000

Number of people killed by natural disasters 1900-2011

0

1900

1950

2010 EM-DAT: the OFDA/CRED International Disaster Database – www.emdat.be – Universite Cathollque de Louvain. Brussels - Belgium


6

IEEE IAS PCIC 2013

Have More People Been Affected by Natural Disaster in Recent Years? Number of people reported affected by natural disasters 1900-2011

Number of people reported affected

700 MM

400 MM

100 MM 0

1900

1950



7

IEEE IAS PCIC 2013

Has There Been an Increase in Natural Disasters in Recent Years? Natural disasters reported 1900-2011

Number of disasters reported

550

400

EM-DAT created (1988) CRED created & OFDA began compiling (1973) 200

OFDA created 1964

0

1900

1950



8

IEEE IAS PCIC 2013

Has Damage from Natural Disasters Increased in Recent Years? Estimated damage (US$ Billions) by natural disasters 1900-2012

Estimated damage (US$ Billions)

Honshu Tsunami 350

Hurricane Katrina Wenchuan Earthquake 200

Kobe Earthquake

0

1900

1950



9

IEEE IAS PCIC 2013

0

1900

1950


2010 10

IEEE IAS PCIC 2013

Number of people reported affected

100MM

200 400 Number of disasters reported

200K

0

Number of people reported Killed

500K

500

Natural disaster summary 1900-2011 (linear-interpolated smoothed lines)

250MM

How Has The Death Rate Dropped While The Number of Natural Disasters and The Affected Population Have Increased?

Industry Densities vs. Earthquake and Hurricane Hazards


11

IEEE IAS PCIC 2013

Hazard Modeling – Hurricanes Do You Understand The Impact of a Natural Disaster?

Sustained Winds


Displaced Households

12

IEEE IAS PCIC 2013

Hazard Modeling – Earthquakes

Magnitude 6.8 Earthquakes


Bridges with Moderate Damage

13

IEEE IAS PCIC 2013

National Standards What are the U.S. National Standards for Business Continuity and Disaster Management?

Overview Presidential Policy Directive 8 (PPD-8) National Planning Frameworks


14

IEEE IAS PCIC 2013

National Preparedness System (NPS) The New and Improved Preparedness Cycle under PPD-8 Threat Hazard Identification and Risk Assessment (THIRA)

Remedial Actions

Exercises

Planning

Community Prep

Validating Capabilities

Planning to Deliver Capabilities

Identifying and Assessing Risk

Reviewing and Updating

Building and Sustaining Capabilities

Estimating Capabilities Requirements

Assessments

Organize and Equip (NIMS!)

Training Business Continuity and Disaster Management for Industrial Installations

15

IEEE IAS PCIC 2013

Private Sector and NGOs and The Frameworks Effective, unified national response requires layered, mutually supporting capabilities • The Private Sector supports community response, organizes business to ensure resiliency, and protects and restores critical infrastructure and commercial activity • NGOs performs vital service missions ▫ Assists individuals who have special needs ▫ Coordinates volunteers ▫ Interfaces with government response officials at all levels

State & Tribal Governments

Local Governments

NPFS Federal Government Business Continuity and Disaster Management for Industrial Installations

16

Private Sector & NGO

IEEE IAS PCIC 2013

NFPA 1600 – Standard on Disaster / Emergency Management and Business Continuity Programs Why? •American National Standards Institute (ANSI) has adopted NFPA 1600 as the voluntary standard for private industry (Davis, 2005) •Department of Homeland Security (DHS) references NFPA 1600 directly in Presidential Policy Directive (PPD-8) What? •NFPA 1600 - 2010 is a Standard on Emergency Management, Disaster Management, and Business Continuity Programs •The result is a single integrated approach. NFPA calls this a "Total Program Approach"


17

IEEE IAS PCIC 2013

NFPA 1600 – Overview According to the new NFPA 1600 standard, a Business Continuity Program must include: • Prevention Phase ▫ Vulnerability Assessment ▫ Risk Management

• Mitigation Phase • Preparation Phase • Response Phase • Recovery Phase


18

IEEE IAS PCIC 2013

Planners Versus Non-Planners • Companies must recognize that unforeseen events can severely disrupt business operations.

• Oxford Metrica1 study states that there was a 22 percent positive difference in stock price for those companies that invested in pre-planning of recovery activities. 1

The Impact of Catastrophes on Shareholders Value by Rory F. Knight and Deborah J. Pretty. Templeton College of Oxford University, 1996. A research report sponsored by Sedgwick Group, from the Oxford Executive Research Briefings series from Oxford University.


19

IEEE IAS PCIC 2013

19

The Impact on Shareholder Value Non-Planners

Planners

20 15

Value Reaction (%)

10 5 0 -5

-10 -15 -20 0

20

40

60

80

100 120 140 160 180 200 220 240 Event Trading Days


20

IEEE IAS PCIC 2013

What Have We Learned?


21

IEEE IAS PCIC 2013

What Do You Need To Know To Start Planning? • Recovery Time Objective (RTO) ▫ How long can your operations be off-line? ▫ Do you have any single points of failure? ▫ Is redundancy built into your production process?

• Threat Hazard Identification and Risk Assessment (THIRA) ▫ Have you identified all of your threats? ▫ What size threat do you use for planning purposes? ▫ Likelihood - Probabilistic vs. Deterministic approaches Business Continuity and Disaster Management for Industrial Installations

22

IEEE IAS PCIC 2013

Relationship Between RTO, Threat and Cost to Mitigate

x105

Cost

Annual Cost

2.5 2.0 1.5 1.0 0.5 0 20

40

RTO

60

80

100 120


1

2

4

3

5

6

Threat 23

IEEE IAS PCIC 2013

Resiliency Model


24

IEEE IAS PCIC 2013

Dimensions of Resiliency 1. Governance 2. Financial 3. Facilities 4. Security 5. Logistics 6. Equipment 7. Employees 8. Infrastructure 9. Critical Utilities 10. Communications 11. Information Technology 12. Supply Chain Management Business Continuity and Disaster Management for Industrial Installations

25

IEEE IAS PCIC 2013

Just An Engineer…


26

IEEE IAS PCIC 2013

This Part of The Presentation Will Cover: • Purpose of Risk Assessment • Goals of Risk Assessment • Method of performing a Risk Assessment for an electrical installation • A sample Risk Assessment


27

IEEE IAS PCIC 2013

Purposes of Risk Assessments • To determine which types of hazards need to be analyzed • To determine how the hazards could impact the facility • To come up with a written plan on how to deal with the hazards • To implement the plan that was developed


28

IEEE IAS PCIC 2013

Goals of Risk Assessments • Prevent injury or death • Protect the environment • Protect local, state, and national economies • Continue to meet the customer’s needs • Prevent loss of revenue and loss of income


29

IEEE IAS PCIC 2013

Basic Steps for Performing Risk Assessments • Identify the Hazards • Assess Vulnerabilities • Perform Impact Analysis • Determine Prevention, Mitigation and Response to Risks • Prepare Recovery Plans


30

IEEE IAS PCIC 2013

Identification of Hazards • Determine which hazards will be analyzed • Consider hazards that could occur external to the facility • Use the Hazards Checklist for Electrical Installations in Industrial Locations


31

IEEE IAS PCIC 2013

Hazards Checklist For Electrical Installations In Industrial Locations • The Hazards Checklist lists of different types of hazards that may analyzed • General categories and examples are ▫ Natural Geological Hazards – Earthquake or Tsunami ▫ Natural Meteorological Hazards – Hurricane or Snowstorm ▫ Electrical Specific Hazards – Arcing Fault or Animal in Equipment ▫ Accidental Events – Hazardous Material Leak or Transportation Accident ▫ Other Human Caused Events – Vandalism or Terrorism


32

IEEE IAS PCIC 2013

Assessing Vulnerabilities • Assess the facility vulnerabilities to the hazards • Use the Risk Assessment Checklist For Electrical Installations In Industrial Locations


33

IEEE IAS PCIC 2013

Risk Assessment Checklist For Electrical Installations In Industrial Locations • The Risk Assessment Checklist lists who and what might be at risk • General categories and examples are: ▫ People – Employees or Community ▫ Electrical Systems – Utility Power or UPS ▫ Operations – Production or Administration ▫ Environment – Land or Air


34

IEEE IAS PCIC 2013

Performing Impact Analysis • Analyze the impact of the hazards being evaluated on the assets being evaluated • Base the analysis on the mitigation techniques that are currently in place • Develop the Risk Assessment Matrix for Electrical Installations in Industrial Locations


35

IEEE IAS PCIC 2013

Simplified Risk Assessment Matrix for Electrical Installations in Industrial Locations Hurricane

Flood

L

Process Area Fire

Probability of Occurrence during plant life

H

Assets At Risk:

Impact Analysis (Probability-Severity)

Incoming Utility Power

H-H

M-H

L-H

M-L

Main HV Substation or Switchyard

H-H

M-H

L-H

M-L

Standby Generator

H-M

M-M

L-M

M-L

Grounding System

H-L

M-L

L-L

M-L

Overhead Cable Distribution System

H-L

M-L

L-L

M-M


M

Vandalism

M

36

IEEE IAS PCIC 2013

Determine Prevention, Mitigation and Response to Risks • List all of the scenarios from the Risk Assessment Matrix in the Risk Mitigation/ Risk Response Plan • Explain in detail the how the hazard can impact the facility • Use the Risk Assessment Matrix and judgment to place the scenarios in order • Place the scenarios which are in the most need of prevention or mitigation at the top of the list


37

IEEE IAS PCIC 2013

Simplified Risk Mitigation / Risk Response Plan Hazard and Scenario

Severity Rating with Existing Mitigation

Additional Risk Prevention or Mitigation

Risk Response Plan

Hurricane downs Utility Company power lines into facility

H-H

Discuss with Utility Company

Develop a plan to provide temp power from other nearby HV switchyard

Fire damages overhead cable distribution system

M-M

Fireproof cable tray in fire hazardous areas

Not required

Flood waters damage Standby Generator

M-M

None

Determine where rental unit can be obtained

Vandals damage Main HV Switchyard

L-H

Install better fence and security cameras

No

Vandals damage grounding system

L-L

None

No


38

IEEE IAS PCIC 2013

Prepare Recovery Plans • Facility Recovery Plan (FRP) – a site specific plan to bring the affected facility back on-line in the shortest period possible ▫ Includes the Risk Mitigation / Risk Response Plan ▫ Includes execution plans, drawings, and cost estimates ▫ Includes a timeline for implementing the prevention or mitigation measures


39

IEEE IAS PCIC 2013

Why is Grounding on the Risk Assessment?


40

IEEE IAS PCIC 2013

Example of Risk Assessment / Mitigation • The facility in this example and the risk assessment are fictional • Any similarity to a particular facility is purely coincidental


41

IEEE IAS PCIC 2013

Facility Description • Gulf Coast Refinery within 100-year floodplain • Original refinery in operation for 25 years • Refinery expansion was built a few years ago • AHJ has determined refinery is vital to national economy • Each day of lost production costs $1,500,000


42

IEEE IAS PCIC 2013

Steps Taken • Comprehensive risk assessment of the electrical systems is performed • Prevention or mitigation recommendations are developed where cost effective • Formal response plans are developed for unmitigated risks


43

IEEE IAS PCIC 2013

Finding: Facility Recovery Plan (FRP) Has Not Been Updated Recently • Prevention / Mitigation: ▫ FRP to be updated annually ▫ Hard copy and soft copy of FRP to be kept in multiple locations


44

IEEE IAS PCIC 2013

Finding: Flood Can Damage Transmission Lines Into Original Refinery • Details: ▫ Lines feeding original refinery are routed along a river road which has already flooded many times ▫ Utility company plans to reroute the lines eventually • Prevention / Mitigation: ▫ Refinery Management to discuss NFPA 1600 and PPD-8 with utility company and request reroute ASAP ▫ Include a recovery plan to provide temp power to the original refinery, from the new refinery Business Continuity and Disaster Management for Industrial Installations

45

IEEE IAS PCIC 2013

Finding: 138kV Switchyard is Close to Public Road and Has a Normal (not hardened) Chain Link Fence • Details: ▫ Terrorism and vandalism are risks ▫ Too expensive to move switchyard

• Prevention / Mitigation: ▫ Build a NEW hardened fence


46

IEEE IAS PCIC 2013

Example of Better Fence Concertina Wire

Wire reinforcement Bollards Business Continuity and Disaster Management for Industrial Installations

47

IEEE IAS PCIC 2013

Finding: Interior of 138kV Switchyard Relay / Meter Building Floods Periodically • Prevention / Mitigation: ▫ Install a new elevated relay / meter building

Flood line watermark


Close-up of flooding watermark

48

IEEE IAS PCIC 2013

Finding: Hurricane Vulnerability • Details: ▫ Widespread damage to the facility could occur ▫ Materials and labor could be difficult to secure after a hurricane


49

IEEE IAS PCIC 2013

Finding: Hurricane Vulnerability • Prevention / Mitigation: ▫ Blanket purchase orders ▫ Service agreements with local, regional and national E&I installation contractors ▫ Review business continuity plans for suppliers and contractors ▫ Insure the suppliers and E&I contractors can accept hard copy (paper) releases ▫ Define signature authority for above ▫ Integrated change management system in place Business Continuity and Disaster Management for Industrial Installations

50

IEEE IAS PCIC 2013

Finding: Additional Mitigations • Prevention / Mitigation: ▫ Set up Mutual Aid Agreements with local companies ▫ Mutual Aid Agreements typically include     

Obligation of the Parties Reimbursement Duration of Agreement Severability Effective Date


51

IEEE IAS PCIC 2013

Summary • Disasters cause billions of dollars of damage every year • The 9/11 Commission formerly recommended the adoption and use of NFPA 1600: “…Private-sector preparedness is not a luxury; it is a cost of doing business in the post-9/11 world. It is ignored at a tremendous potential cost in lives, money, and national security." • PPD-8 requires a national preparedness system • FEMA adopted NFPA 1600 as a voluntary standard • Companies, employees, and national economy are the real beneficiaries of BCDM • All disciplines should perform Risk Assessments


52

IEEE IAS PCIC 2013

Just An Engineer…


53

IEEE IAS PCIC 2013

Questions?


54

IEEE IAS PCIC 2013