Causes of the Incident
54The causes of the Incident are set out in a report entitled Investigation into Overflow from Weak Ammonium Nitrate Solution Tank at Orica Australia's Kooragang Island Nitrates Plant 7th November 2011 prepared by an Independent Engineer, Mr Robert Weiss, of Honeywell Process Solutions ("the Incident Report"). The reference to "7 November 2011" is a typographical error and should read "7 December 2011". The report is dated 24 December 2011 and a copy was provided to the EPA by Orica on 20 January 2012.
55In summary, the Incident Report concluded that the direct causes of the Incident were:
1. Both primary and secondary controllers in DCS control station STN18 were not operating. Consequently they were unable to sense the high level and shut off either the three-way valve HV 2610 or the Concentrator Product Transfer Pump 17-04J08. the outputs were configured to hold their last values in this situation, rather than to fail to the safe state.
2. There was no means independent of the DCS to sense the high level and shut off the inlet flow. WANS is regarded as non-hazardous and the hazard and risk studies for the project did not identify that one was required.
3. The control room operators could not monitor the level in the WANS mixing tank because the DCS controllers were offline.
4. The plant is located remote from other operations, and the fact that the WANS mixing tank was overflowing was not apparent without deliberately visiting the WANS building. The incident occurred in the time between regular periodic checks of the WANS plant. These normally would have occurred every 2-4 hours once the plant was handed over. However, as the plant was still being commissioned, surveillance was being provided by the process engineer who identified the overflow as part of his periodic surveillance.
5. The AN2 plant was shut down at the time. The technicians working on the DCS control station (identified as one of two "ANP2" control stations) and the control room operator were unaware that it was controlling any currently running plant. In order to rectify a fault identified during trip testing, the instrument technician therefore downloaded both controllers, causing the online controller to go offline. Because the download was being performed in a different location to the control station, it was not immediately apparent to the technician that the controller had gone offline.
6. The scope of the original Permit to Work had progressively changed from testing a trip in the effluent plant to reloading software in a DCS control station that could impact areas other than the SIF under test. This "scope creep" on the permit was not recognised by the Permit Receiver, and consequently he did not seek re-authorisation of the permit in accordance with clause 2.13 of the Permit to Work Model Procedure PW-01A.
7. The detailed work instruction for testing the SIF did not provide any guidance on rectification of faults found and limitations on what could be performed under a testing permit.
8. The WANS plant was new and in the final stages of commissioning. Control had been added to the existing ANP2 control station. Even if permit reauthorisation had been sought, it is not clear that the Permit Issuer would have recognised that the work being performed on the DCS would impact the WANS plant.
9. It was not readily apparent without referring to detailed system documentation what equipment was controlled by the specific DCS control station being worked on.
56The indirect or underlying causes of the Incident were described as follows:
1. The work on the clearance certificate for trip testing extended beyond the original scope of the clearance such that systems in addition to that being tested were impacted by rectification work.
2. When working on a specific part of the DCS or SIS, it was not readily apparent what process systems would be impacted. Permit issuers rely on the knowledge of the permit receiver who is not necessarily aware of the non-critical systems that may be impacted. Consequently the technician stopped both controllers without realising that it would impact operating plant.
3. The risk criteria for providing SIL-rated and/or independent high level trips did not require such protection for low severity events, and so no independent high level trip was provided.
4. The DCS outputs were configured to hold their last value when both controllers stopped. Although this was the site standard, it was not necessarily appropriate for the WANS plant.
57Orica agreed with the causes of the Incident identified in the Incident Report, although it submitted that the cause described in paragraph 4 of 4.1 was a contributing factor rather than a direct cause. I accept that operationally this must be so, but ultimately it makes little, if any, difference.
58In his affidavit sworn 3 December 2012, Mr Winstone deposed to the fact that Orica had commissioned six hazard studies between July 2009 and June 2010, before the WANS Plant was commissioned, and that Orica's SHEMS system applied to the WANS Plant. The SHEMS system required identification of hazards and implementation of appropriate controls to appropriately manage the risk of hazards.
59Although the hazard studies identified that there was a risk of a spill of WANS from the WANS Mixing Tank, because WANS was considered non-hazardous, the project team responsible for the design and commissioning of the WANS Plant did not consider that independent trip protection was required to prevent overflow. Instead it was determined that the instrumentation and DCS provided sufficient protection.
60After the hazard studies were completed in June 2010, a number of controls against overflow of the WANS Mixing Tank were implemented. These were described by Mr Winstone in his 3 December 2012 affidavit and it is not necessary to repeat them here. They included the provision of alarms, the provision of a bund around the WANS Mixing Tank having a similar capacity to the Tank, the restriction of the maximum filling level to 60% and pumping time limits. These controls were, however, reliant on the DCS and when the Incident occurred, both the online and offline standby systems were affected, which meant that the overflow protection systems that relied on the DCS did not activate to prevent the Incident.
61Further, at the time of the Incident a procedure was in place that required a "permit to work" for all work on the KI premises, which included the work by the Nitrates I/E Technicians. During the Incident the Nitrates I/E Technicians undertook further work not covered by their work permit without seeking, as required, a new or amended work permit or discussing the change in the scope of work with the permit issuer. This was not in accordance with Orica's procedures in this regard.
62At the time of the Incident, there were procedures that guided personnel at the KI premises in responding to environmental incidents, including overflow and loss of containment. These procedures were followed by relevant personnel in responding to the Incident.
63Mr Winstone stated that, as the WANS Plant was still in the commissioning stage at the time of the Incident, there were status updates on the commissioning through group emails to relevant operational parties, project team members and shift operators and meetings. Mr Winstone acknowledged, however, that the above measures were not sufficient to ensure that the Nitrates I/E Technicians conducting the work to rectify the fault that they identified with the Ethernet Card, were aware that the WANS Plant was in fact operating.
64Training in relation to the WANS Plant was provided to Nitrates operators, but it was not provided to the I/E maintenance teams or the Nitrates I/E Technicians because the WANS Plant was still in the commissioning phase.
65Mr Winstone accepted that the Permit to Work Procedure, training and other measures put in place to prevent an overflow "were not adequate to prevent the incident" and that these needed to be improved, with additional controls to be implemented.