(SPC/Permissioning/12)

Purpose

The HSE document "Reducing Risks Protecting People" ( R2P2) was republished as an information document on the 13th December. The purpose of that document is to address external stakeholders about HSE`s approach to regulatory decision making. This is accompanied by the so called "ALARP Suite" comprising three documents; Principles for Regulators, Good Practice and Design which give guidance to HSE staff. Each part of HSE will be expected to provide supplementary sector specific guidance to support implementation. This document aims to give interim guidance specifically on ALARP demonstrations in the COMAH context and an outline of further work. This guidance should be read in the context of the policy document (SPC/Permissioning/09) together with a new generic safety report assessment guide (SRAG) revised in the light of experience in assessing safety reports (to follow).

Legal background

• The principal health and safety legislation in the uk is the Health and Safety at Work etc. Act 1974 (HSW Act). It requires risks to employees, and others, to be reduced ‘so far as is reasonably practicable’ (SFAIRP). The meaning of SFAIRP has been the subject of legal judgment in the UK courts (Edwards v National Coal Board). Risk assessments are also required by The Management of Health and Safety at Work Regulations, Reg 3.
• Regulation 4 of the COMAH Regulations requires Operators to "take all measures necessary (AMN) to prevent major accidents". This is interpreted as the equivalent of reducing risks "as low as reasonably practicable" (ALARP). In terms of what they require of duty-holders, HSE considers that duties to ensure health and safety so far as is reasonably practicable ("SFAIRP") and duties to reduce risks as low as is reasonably practicable ("ALARP") call for the same set of tests to be applied.
• The demonstration that AMN have been taken to reduce risks ALARP for top tier COMAH sites should form part of the Safety Report as required by regulations 7 and 8 of the COMAH Regulations. The required level of detail is specified in Schedule 4 to the Regulations.

Existing guidance

• HSE has produced a suite of guidance documents concerning ALARP. These are designed to give high level principles which separate parts of HSE can then use to promulgate sector specific advice. The documents are:

• Reducing Risk, Protecting People(R2P2);
• Principles and guidelines to assist HSE in its judgements that duty-holders have reduced risk as low as reasonably practicable;
• Assessing compliance with the law in individual cases and the use of good; and
• ALARP in Design - Policy and Guidance.

• The HSE discussion document "Reducing Risks, Protecting People - HSE's decision making process" (R2P2) sets out, in more detail, HSE’s approach to making decisions about SFAIRP and ALARP. It is a further development of ideas previously promulgated in HSE’s Tolerability of Risks from Nuclear Power Stations (TOR) document (1992) which defined three regions of risk, delineated by an unacceptable region and a broadly acceptable region; the region in between defining a region of tolerable risk, but only when those risks are ALARP.
• R2P2 makes some important statements of principle:

Principle 1

"HSE starts with the expectation that suitable controls must be in place to address all significant hazards and that those controls, as a minimum, must implement authoritative good practice irrespective of situation based risk estimates".

Principle 2

"The zone between the unacceptable and broadly acceptable regions is the tolerable region. Risks in that region are typical of the risks from activities that people are prepared to tolerate in order to secure benefits in the expectation that

the nature and level of the risks are properly assessed and the results used properly to determine control measures;

the residual risks are not unduly high and kept as low as reasonably practicable (the ALARP principle); and .

the risks are periodically reviewed to ensure that they still meet the ALARP criteria, for example, by ascertaining whether further or new controls need to be introduced to take into account changes over time, such as new knowledge about the risk or the availability of new techniques for reducing or eliminating risks."

Principle 3

"both the level of individual risks and the societal concerns engendered by the activity or process must be taken into account when deciding whether a risk is acceptable, tolerable or broadly acceptable’ and ‘hazards that give rise to …. individual risks also give rise to societal concerns and the latter often play a far greater role in deciding whether risk is unacceptable or not".

• For high hazard sites, societal risks/concerns are normally much more relevant than individual risks, but individual risk must still be addressed. Although R2P2 gives clear guidance on individual risk criteria, it gives only limited guidance on criterion values for societal risks (50 fatalities at less than 1 in 5000 per annum, point on the boundary between the ALARP band and intolerable band).
• ALARP guidance specific to the COMAH regulations is provided in:

• SHAG) 190 (Appendix 4);
• L111 (Regulation 4);
• The Safety Report Assessment Manual (SRAM) (Part 2, Chapter 3); and
• The Safety Report Assessment Guides (SRAGS).

ALARP demonstration requirements

• HID will consider AMN to be in place for people when S2 and S3 risks are demonstrated to be ALARP and that demonstration has been accepted and verified. AMN must be in place for each MA. HID’s assessment will be proportionate, particularly for safety critical events.
• The tools used in Safety Reports to demonstrate ALARP will vary depending on the level of risk. However, the measures in place to prevent or limit major accidents should be described in the safety report and be at least to 'relevant good practice’. The assessor will need to focus on these measures to be satisfied they do represent good practice etc. HID will regard relevant good practice to have met the AMN requirement when:

1. the societal risks can be shown (subject to uncertainty) to be broadly acceptable, e.g. by use of an approximate risk integral ^[1] (ARI) or other societal risk methodology; and
2. no group, or individual, is subject to relatively high individual risks that are not ALARP.

• HID regard good practice as being subject to the process of continuous improvement and will encourage industry to keep it up-to-date as technology advances and societal concern about MAHs varies.
• Having been satisfied that the measures in place represent relevant good practice, the residual risks will be in one of the following category bands:

Intolerable risk

Clearly, if the risk is in this region (whether for individual or societal risk) then ALARP cannot be demonstrated and action must be taken to reduce the risk irrespective of cost.

"Tolerable if ALARP" Risk

If the risks fall in this region then a case specific ALARP demonstration is required. The extent of the demonstration should be proportionate to the level of risk.

Broadly acceptable risk

If the risk has been shown to be in this region, then the ALARP demonstration may be based on adherence to codes, standards and established good practice. However, these must be shown to be up-to-date and relevant to the operations in question.

This is shown diagrammatically in Figure 1.

• A case specific ALARP demonstration is essentially a simple concept which can be satisfied by the Operator answering the following fundamental questions in relation to the identified MAH scenarios: ^[2]

Q1 "What more can I do to reduce the risks";

The answers to this question are qualitative in nature. The operator should look systematically at the risks from his operations and draw up, in a proportionate way, a list of measures which could be implemented to reduce those risks. Only in a minority of circumstances will there be nothing further that the Operator could do without shutting the plant down completely. Operational Policy Unit (OPU)4 have initiated research work to produce a database of risk reduction measure to assist assessors in determining if anything more might be done. However, the need to act is determined by answering the second question.

Q2 "Why have I not done it"

The answer to this question may be qualitative or quantitative in nature depending on the predicted level of risk prior to the implementation of those identified further measures. Whichever way the question is answered, if the measure is "prima facie reasonable", based on engineering considerations, and it cannot be shown that the cost of the measure is grossly disproportionate to the benefit to be gained, then the Operator is duty bound to implement that measure.

• Inspectors will require guidance on determining whether an Operators arguments on gross disproportion are valid (see para 48 and Annex).

Proportionality decisions

• Proportionality must be considered for at least 2 aspects of Safety Report assessment; the rigor (or robustness) of the risk assessment used and the depth of the ALARM demonstration. It may also be appropriate when considering the appropriate level of gross disproportion, a specific element of the overall ALARP demonstration (see para 48).

Proportionate risk assessment

• The existing HSE published guidance states ‘the depth of the analysis in the operator's risk assessment should be proportionate to (a) the scale and nature of the major accident hazards (MAHs) presented by the establishment and the installations and activities on it, and (b) the risks posed to neighbouring populations and the environment i.e. the assessment has to be site specific.’ The risks referred to here include both individual and societal risk.
• The depth of analysis that needs to be present depends on the level of risk predicted before the identified additional measures are applied. The nearer the risk is to the intolerable boundary (i.e. the greater the proportionality), the greater the depth of analysis. There are various kinds of risk assessment that may be used depending on proportionality. These range from Qualitative at the lowest level, through Semi Quantitative up to Quantitative at the highest level.

Risk criteria

• Criteria for the boundaries of tolerability of risk have been developed for Individual risk, but there are no adopted UK criteria for Societal Risk other than that in R2P2.

Individual risks

• Where individual risks have been satisfactorily quantified in a Safety Report , then it is possible to compare the value with the individual risk criteria published in R2P2. The risk criteria are risks of death (to be distinguished from other types of risk such as risk of dangerous dose used in HSE`s land use planning approach).

These are illustrated in Figure 2.

• A diagram similar to Figure 2 can be constructed for societal risks but with appropriate criteria. These criteria will be discussed later (see para 32, Figure 4).

Societal risks

• Societal risk is the relationship between frequency of an event and the number of people affected. Societal concern includes (together with the societal risk) other aspects of societies reaction to that event. These may be less amenable to numerical representation and include such things as public outcry, political reaction, loss of confidence in the regulator, etc. As such, societal risk may be seen as a subset of societal concern. Alternatively, societal concern may be regarded as all the factors that go into making a judgement as to whether the costs of further risk reduction are grossly disproportionate.
• One way to determine proportionality for societal risks is to use the maximum potential fatalities (Nmax). This value must be estimated as part of the ‘assessment of the extent and severity of the consequences of identified major accidents’ which is mandatory minimum information. The value of Nmax can be combined with the frequency of the event causing Nmax (fNmax) to determine an indicator of societal risk levels. This can be compared with suitably determined criteria. Methodology and Standards Development Unit (MSDU) have developed a societal risk methodology (ARICOMAH) to help Inspectors assess this aspect of safety reports. The methodology will be described later (see Section 6).

Risk assessment rigor

• The level of risk (either individual or societal) can be used to determine the type of risk assessment an assessor would expect to see in a Safety Report as illustrated in Figure 3

• The definitions of Q, SQ, QRA, etc. are based upon definitions of types of risk assessments set down in HSG 190 and developed further in the Generic SRAG (with intermediate levels where appropriate), but in essence the type of risk assessment which is appropriate in a demonstration will vary gradually in depth and level of quantification from qualitative (Q) at one end to full quantified risk assessment (QRA) at the other.

Risk Matrices & their use in COMAH Safety Reports

• Risk assessment techniques range from a simple qualitative approach to a detailed quantitative assessment. Fully quantified risk assessments are very costly and time consuming exercises, and there is within the chemical industry resistance to adopt such practices. One method which may help to bridge the gap between purely qualitative and full QRA approaches is to use a risk matrix. This type of approach has been widely used by many operators in their COMAH safety reports.
• Risk is interpreted as the combination of consequence (severity) and likelihood (frequency). Both these are minimum requirements of COMAH safety reports (Schedule 4 Part 2). A risk matrix enables this combination to be represented graphically. It is a reasonably quick and easy method to visualise the spread of risk and consequently is commonly used during (or after) hazard identification studies (such as a HAZOP), to screen hazards or to conduct a simple risk analysis. The main advantage of the matrix is its easy representation of different risk levels, and the avoidance of more time consuming quantitative analysis where this is not justified.
• The basis for the risk estimate is usually qualitative, although it can be quantitative (for either the consequences or the frequencies or both). The matrix, as illustrated below, typically comprises a square divided into a number of boxes, with each box representing a different underlying risk level.

Risk Matrix (Illustrative)

Likely > 10-2	Intolerable	Intolerable	Intolerable	Intolerable	Intolerable
Unlikely 10-4 - 10-2	Tolerable (Intolerable if Fatality >10-3)	Tolerable (Intolerable if Fatality >10-3)	Intolerable	Intolerable	Intolerable
Very Unlikely 10-6 - 10-4	Tolerable	Tolerable	Tolerable	Tolerable	Intolerable
Remote 10-8 - 10-6	Broadly Acceptable	Broadly Acceptable	Tolerable	Tolerable	Tolerable
	Single Fatality	2-10 Fatalities	11-50 Fatalities	50-100 Fatalities	100+ Fatalities

• Further advice on this is attached to the SPC on Lines to Take (SPC/Permissioning/11 – COMAH Safety Reports: Technical Policy Lines to Take for Predictive Assessors) and a similar document appears in the September edition of The Chemical Engineer ^[3]. Whilst that article is authored by Mark Middleton of DNV, the risk matrices part is based on work commissioned from DNV by HID OPU and has been disseminated to Land Division's Field Discipline Team. The article also had some editorial input from OPU and MSDU.
• Another approach suggested by MSDU is to use a non cumulative fn (frequency, numbers of people killed) plot to visualise the spread of risk and guide the proportionality to be used for examining risk reduction options. Further advice on this should be sought from MSDU.

Proportionate ALARP demonstration

• Proportionality is also relevant to the determination of the depth of analysis used to demonstrate ALARP.
• With reference to Figure 1, the higher the risk is within the "tolerable if ALARP" region, the greater will be the depth of demonstration required (e.g. Greater effort needed to determine potential risk reduction measures) to show that those risks are ALARP.

A tool for combined ALARP determination using Societal Risk (ARI_COMAH)

• However much care is taken in designing, constructing and operating an installation that uses large quantities of dangerous chemical substances there remains a possibility that a release will occur resulting in a multi-fatality accident. The best available technology for studying this "societal risk" is full scope application of quantitative risk assessment (QRA). However, the technique is time-consuming and requires a high level of technical capability. Given the realities of limited time and money, Operators have been reluctant to embark on such a course in preparing COMAH Safety Reports. Recognising this, MSDU have developed a methodology (ARICOMAH) that can be applied by assessors to provide a rough but rapid indication of the magnitude of societal risks ^[4]. This can be used to come to a view on:-

• the type of risk assessment required;
• the extent of the ALARP demonstration; and
• the level of gross disproportion to be assumed when deciding if a risk reduction measure is "reasonable".

The tool can be used to make judgements on proportionality for i), ii) and iii).

• Within the methodology a parameter is defined, suitable for comparison with criteria, and its value calculated. Evaluation of the parameter by hand is not practicable so a simple software routine has been developed by MSDU. The inputs to the model are:

• the highest number of fatalities from a single event (Nmax);
• the frequency of that event(fNmax) expressed in chances per million per year (cpm); and
• a judgement as to whether the event is directional in nature (e.g. toxic cloud dispersing with the prevailing wind) or not (e.g. a BLEVE).

• If the calculated value is sufficiently low then HSE might be satisfied that nothing further is required. For higher values, a more comprehensive site-specific risk assessment and ALARP demonstration may be deemed necessary.
• A value for the boundary between the intolerable region and the "tolerable if ALARP" region on the societal risk equivalent of Figures 2 and 3 can be determined from the societal risk criteria given at paragraph 136 of R2P2 if this value is assumed to be a point on an F-N curve with a slope of -1 (as confirmed by RAPU). This ARICOMAH value is calculated to be approximately 500,000 see Figure 4 below).
• The boundary between the broadly acceptable region and the "tolerable if ALARP" region is assumed to be two orders of magnitude below the intolerable boundary. This ARICOMAH value is calculated to be approximately 2,000 (see Figure 4 below).

• Inspectors should be aware that there may be considerable uncertainties attached to the ARI_COMAH inputs and that the values calculated should be used to give an indication of the level of societal risk rather than an absolute value.

Decisions by assessment teams that ALARP has been demonstrated

• In relation to COMAH Safety reports, the decision as to whether ALARP has been demonstrated will be one for the whole Assessment Team to make collectively, taking account of the application of individual inspectorial discretion. Inputs to that decision will include:

• The level of risk (both on and off site, individual and societal);
• The arguments used in making the demonstrations in the Safety Report;
• If there are further risk reduction measures that the Operator has not considered; and
• Other factors that the Team feel are relevant.

Differences of opinion will arise and these should be resolved at the appropriate management level.

Work in progress

• Whilst the basic framework and tools for determining the suitability of ALARP demonstrations are in place, there are a number of areas where guidance for assessors is still being developed. These are described below.

Risk Reduction Measures (RRMs) database

• In order to assist Assessors in determining if Operators have considered all the relevant RRMs, a database is being developed by HSL/Amey Vectra which draws together unstructured, paper based lists of measures which have been considered within HSE in the past, together with measures discussed in the open literature or research reports written for HSE.

Calculation of Nmax

• The dimensions of the worst-case accident footprint are calculated using the appropriate fire, explosion or toxic gas dispersion model, the endpoint being that thermal dose, overpressure or toxic dose that corresponds to the LD50. Allowance is made for attenuation of toxic dose for an indoor population when appropriate (e.g. a residential population at night). The number of survivors within the contour is assumed to equal the number of fatalities outside the contour. This will be cautious in most cases.
• The information on Nmax should be provided by the occupier in his `severity and extent` calculations. However, not all Safety Reports are providing this information and a decision will have to be made whether to await this or for predictive assessors to estimate the value of Nmax. Options for this are being explored but, in principle, if the safety report does not contain the required information then it ought to be rejected at the Early Predictive Screen stage.
• Other options include providing hazard ranges in graphical form, provision of software for hazard range calculation, or asking Health and Safety Laboratories to make estimates on the assessors behalf. Inspectors should be aware that there may be uncertainty in the value of Nmax.

Calculation of f_Nmax

• The frequency of the worst-case release is then set using either the generic value normally used in MSDU’s QRA methodology RISK AT [9] or a site-specific value if sufficient information is available to satisfy HSE that that value is warranted. Where the consequence is unidirectional additional multipliers are then introduced, making the frequency of the worst-case accident equal to:-

Failure frequency (RISKAT or site-specific)

    * conditional plume probability

        * weather and wind speed probability

            * wind rose bias factor

                * population distribution factor.

• Guidance on these parameters is given in the Hirst and Carter paper. Information to enable the appropriate value of each parameter to be determined should be included in the Safety Report. Again, Inspectors should be aware that there may be uncertainty in the value of fNmax.

Distribution of ARI_COMAH Software

• The most appropriate method to enable assessors to access this small piece of software has yet to be decided.

CBA guidance

• Guidance for Assessors on Cost Benefit Analysis is being developed. Annex 2 provides some examples of how CBA can be used in a relatively simple way to make decisions on reasonable practicability.

Guidance on gross disproportion

• All RRMs will involve a cost to the Operator. Equally, an RRM is intended to reduce risk from an operation and this reduction will bring about a benefit (reduction in lives saved, etc.) which can be expressed in monetary terms. The ratio of the costs to the benefits can be described as a "proportion factor" (PF). Generally, the value of avoiding a statistical fatality is approximately £1m. It should also be noted, however, that the benefits might also include the avoidance of such thing as environmental cleanup costs, increased insurance premiums, loss of asset value, the costs of increased regulatory interference, etc.
• If this PF is greater than some defined value, then the costs can be said to be grossly disproportionate to the benefits and the RRM would not be "reasonably practicable". The difficulty lies in defining what this limiting value of PF should be.
• It is assumed that, within the "tolerable if ALARP" region, the minimum value of PF will be 1 since values below 1 imply a bias against safety. It is further assumed that the value of PF will increase in some way as risk increases. That is to say, the operator would be expected to pay more to reduce risk by a given amount if the initial level of risk is close to the intolerable limit than if the risk were just above the broadly acceptable limit (Principles and Guidelines document, para.25). In the intolerable region, RRMs must be implemented almost regardless of cost, implying an very high, or infinite PF (though it is recognised that CBAs and gross disproportion are not applicable in this region).
• The difficulty lies in defining the upper limit of PF and the way PF increases with risk. An upper value for PF of 10 has been suggested but the way PF changes with risk is still unclear. However, the basic principle is shown in Figure 5.

• Within the Broadly Acceptable region, providing DH’s comply with relevant good practice, additional RRMs are assumed to be not reasonably practicable implying a PF of zero. However, if there are obvious and cheap measures that could be taken they should at least be considered. Some guidance on proportion factors is given in Annex 1 to this paper.
• Case specific ALARP demonstrations should only be based on the societal risk from a site and not the societal concerns (Principles and Guidelines document, para. 34).
• HID believe that there may be a number of site specific issues which should be taken into account by the assessment team. These include the presence of hospitals or significant numbers of children or the elderly. Here, difficulties in organising and evacuating these groups means there is an additional risk factor to be taken into account. Also, due to factors such as physiology, state of health, etc., people in these groups may also be more vulnerable to the effects of the hazard. The assessment team may decide that the presence of these groups calls for an increase in the societal risk based gross disproportion factor (i.e. an increase in PF)

Review of Relevant Good Practice (RGP) for HID sites

• HID need a view on whether the codes standards and good practice currently used by Operators (e.g. LPGA Cop1, HS(G) 28, etc.) can be considered as relevant and up to date. Work has begun but this may only indicate the scale of the problem in a few selected cases (e.g. LPG). A more thorough review may be a longer term goal and would require the significant involvement of Industry bodies.

Guidance on Lines of Defence analysis

• Arguments that risks have been reduced ALARP based upon `strength in depth` concepts such as Layers of Protection (LOPA) or `Lines of Defence` may be used by companies in making demonstrations that all measures necessary have been taken. Some research is being undertaken with Vectra/HSL with a view to guidance.

Demonstration frameworks

Flowsheet approach

• HSE choose not to be prescriptive on how demonstrations that all necessary measures have been taken should be made, but one way of approaching this is set down in the attached flow sheet at Fig 6. This method assumes that the risks are not intolerable.

Stepwise approach

• Alternatively we have found that some Duty Holders have used the following stepwise approach. This approach assumes that the risks have been shown to be in the "tolerable if ALARP" region and that a case specific ALARP demonstration is required:

• Identify controlled substances, their inventories and locations. Show the local environment including on and offsite populations that may be affected and other hazardous installations (including those at designated domino effect sites) that might be affected by major accidents or be initiators of a major accident. Show that the required measures are, at least, to current authoritative good practice.
• Identify all major accidents and develop a qualitative view on the significance of each one. In the light of the view on the significance of all the identified major accidents, choose a representative subset for detailed consideration.
• Refine the prediction of the hazard range and its likelihood, for each event in the chosen representative subset.
• Refine the prediction of the consequences, for each event in the chosen subset, including estimates of the number of fatalities, major and minor injuries to man and damage to the environment, and develop a view on the extent of lesser harms such as major and minor injuries to persons.
• Show the consequences and the likelihood, for each event in the chosen subset, on a suitable matrix or fN plot (with suitable error bands).
• Divide the area of the matrix (or plot) into 3 bands (broadly acceptable risk, tolerable if ALARP, intolerable risk) and calibrate these bands against criteria. Suitable numerical criteria for individual risk are set down in R2P2.
• For intolerable risks immediate action should be taken to reduce risks. For those events in the broadly acceptable region a comparison with relevant standards should be appropriate. For those events in the TIFALARP region look at the major accidents in a particular consequence band and select the ones with the highest frequencies.
• For these, determine what additional risk reduction measures, beyond relevant good practice standards, (software as well as hardware) may be implemented.
• Implement these measures unless a reasoned argument is presented showing the costs to implement this scheme are grossly disproportionate. Arguments based upon `strength in depth` concepts such as Layers of Protection (LOPA) or `Lines of Defence` may be used when these have been developed sufficiently. Where the risks have been assessed as high, the use of formal cost benefit analysis may be required to test the cost-benefit balance for the prospective remedial measures.
• Revisit step 7 for lesser consequences and continue until proportional demonstrations are made.

Further information

For further information, please contact CD2.4, St Anne’s House, Bootle (0151 951 4062).

(Exemption 13 applies to section A1.3 of Annex 1: Commercially confidential information)

Figure 6: ALARP demonstration flow sheet

---

ANNEX 1: guidance on proportion factors

A1.1 Work by RAPU and ESAU

Le Guen, Hallett and Golob produced a paper on the "Value of preventing a Fatality" which was circulated to HSE Board members and presented to the Risk Assessment Liaison Group (RALG) (RALG/Sep00/03). That paper discussed the ratio of the cost of preventing a fatality (CPF) to the value of preventing a fatality (VPF). The starting point for VPF was taken to be the DETR figure of approx. £1m used in new road schemes. Other values of VPF were then described. These were 2 x DETR for deaths from cancer and 3 x DETR for some aspects of railway safety. It is HID OPU4’s contention that the values of 2 and 3 represent proportion factors (PF) similar to those described in Section 8F earlier.

The paper also examined the implied ratios of CPF to VPF in a number of CBAs (and RIAs) carried out prior to the implementation of a number of sets of regulations. Part of that table is reproduced below. To this has been added a column reflecting a estimate for the number of people who may be affected in any given incident controlled by the relevant Regulations (taken from, or implied by, the text in the Board paper):-

Regulations	Year	CPF/VPF (or PF)	Nmax?
Control of Legionellosis Regs. And ACOP	1990	2.6 - 8.5	6
Gas Safety (Management) Regs.	1996	1.4 - 1.7	1 to 2
Adventure Activities Licensing	1996	5.4	>2?
Confined Spaces	1996	1.0 - 2.2	1 to 2
Railway Safety	1999	7.1 - 10.5	Approx. 30? (Ladbroke Grove)

Whilst in no way definitive, the above data could be seen to show an increase in PF with increase in numbers affected.

A1.2 DNV Offshore Guidance

The document "A Guide to Quantitative Risk Assessment for Offshore Installations" prepared by DNV includes some guidance on gross disproportion and the value of statistical fatalities.

Section 25.8.3 of that document states:-

"The necessary degree of disproportion is generally considered to be low near the negligible criterion, rising to in effect infinity at the maximum tolerable criterion"; and

"In the UK NRPB (1986) criteria, factors of between 1 and 15 are used, depending on the individual risk"

Section 25.8.5 of that document gives a number of examples of expenditure on RRMs and concludes that there is general agreement that the PF should range between 1 and 10.

è

This paragraph is being withheld under Exemption 13 of the Code of Practice on Access to Government Information (commercially confidential information).

ç

A1.4 NORSOK Standard

The NORSOK Standard Z-013 ("Risk and Emergency Preparedness Analysis) includes an annex discussing cost benefit analysis. Section E5.2 of this annex includes information on the valuation of benefits to personnel and the cost of an improvement to Norwegian helicopter based SAR preparedness. These values can be use to derive an implied PF of approximately 2.5. Generally, PFs up to approximately 15 might be justified.

---

ANNEX 2: CBA examples

A2.1 Introduction

CBA is a technique that provides data to be used in the judgement on whether cost of risk reduction is gross disproportionate or not. It is a judgement and other factors are involved, particularly whether the outcome is so severe that measures are needed to address societal concern (Principles and Guidelines document, paragraphs 34 and 35).

The ratio of costs/benefits (known as the proportion factor) is sensitive to the event frequency, which may be uncertain by an order of magnitude or more. There is therefore little point in expending significant effort over choosing the discount rate or quantifying a value for the remaining life of the plant, as we shall later.

This Annex outlines a simplified approach to CBA that will enable inspectors to take account of the proportion factor and weigh it against risk when judging whether a measure is reasonable practicable or not. If the decision is finely balanced the duty holder should be asked to present more detailed analysis – including a sensitivity analysis. Such requirements are likely to be infrequent.

A2.2 Simple CBA

One way of estimating the proportion factor is to ‘annualise’ the costs and benefits. Suppose a risk reduction measure is equivalent to an annualised cost of £10k per year, and the benefits are equivalent to 0.01 lives saved per year. The cost of preventing a fatality, CPF (see R2P2) is the ratio of these quantities i.e. 10,000/0.01 i.e. £1M. Since HSE generally adopts £1M as the value of preventing a fatality there is no disproportion between the costs and benefits. Since the disproportion must always be gross the measure must be implemented.

A2.2.1 Estimating the annualised costs

First consider the Table below which shows the factor to annualise the cost, C, of a risk reduction measure, when adopting different discount rates (DR) and plant life times. The figures in brackets represent normalised values with respect to a period of 15 year and a DR of 6%. The deviations from the normalising value (0.103) are less than a factor of two; the extremes (0.149 and 0.058) are less than a factor of 3 apart – which is ‘small’, compared with other uncertainties.

Plant life, yrs	DR = 4%	DR = 6%	DR = 8%
10	(1.2)	0.136 (1.3)	0.149 (1.4)
15	0.090 (0.9)	0.103 (1)	0.117 (1.1)
20	0.074 (0.07)	0.087 (0.08)	0.102 (1)
30	0.058 (0.05)	0.073 (0.07)	0.089 (0.08)

Suppose a measure costs £1M and implementation leads to production losses of £15k. However, the duty holder will be able to reduce running costs (lower maintenance costs etc.) by £5k per year for about 25 years – the estimated life of the plant. This ‘benefit’ has to be offset against the costs – see R2P2. Thus for a DR of 6% the annualised costs, based on the annualisation factor of (0.087+0.073)/2 = 0.08 are:

a) annualised cost of measure (see above table)	0.08 x £1M = 80,000
b) loss of production	0.08 x £15k = 1,200
c) reduced operating costs etc.- for simplicity ignore discounting	= -5,000
Net annualised costs	= 76,200

A2.2.2 Estimating the annualised benefits

Before implementation the incident probability is 10^-5 per year and results in an average of 8 fatalities. After implementation the corresponding figures are 10^-6 per yr. and 2. The damage and clean-up costs would be around £25M before implementation and around £10M after implementation. This is approximately equal to a further 25 and 10 lives respectively, taking the value of preventing a fatality, VPF of £1M. So we are saving the equivalent of (25 + 8)x10^-5 – (10 + 2)x 10^-6 lives per year i.e. (33 – 1.2)x 10^-5 = 31.8x10^-5 lives per year.

So the approximate cost of preventing a fatality, CPF is £76,200/31.8x10^-5 i.e. ca £240M. The proportion factor = CPF/VPF = 240, which is clearly disproportionate.

This example is based on one submitted by a duty holder. They used a DR of 6% for costs and 4% for benefits, and a VPF of 1.65M and other details. Using their VPF, the CPF becomes 76,200/(23.1-0.8)x10^-5 i.e. £341.7M, so the proportion factor is 341.7/1.65 = 207. This is, given the uncertainties, very close to the gross disproportion factor estimated by the duty holder i.e. 174. For the purposes of making a judgement the figures are identical.

One further simplification that can be adopted is to, initially, assume that all harms are averted (and hence not have to spend time doing the ‘situation after’ assessment). If the measure is not reasonably practicable on this basis it is not reasonably practicable at all and can be screened out. If it is marginal or appears reasonably practicable then the ‘situation after’ can be assessed and the analysis refined. Alternatively, a duty holder may just choose to implement the measure for the avoidance of doubt and with a view to spending money on measures rather than analysis to show whether a measure is or is not strictly required.

A2.3 Sensitivity analysis

For the example above, suppose the failure rates and estimates of fatalities are optimistic by a factor of 10. Our estimate of equivalent fatalities (VPF=£1M) is (25+80)x10^-4 – (10+20)x10^-5 = 102x10^-4. So the CPF = £76.2k/0.01 = £7.62M The proportion factor is therefore 7.62. Whether this is grossly disproportionate would depend how realistic the casualty count is, on who was killed (vulnerable populations, etc) and how as these parameters affect societal risk. If 80 people die, the decision will probably hinge on the societal risk issue, and whether scale aversion was factored ^[5] into the decision on disproportion.

If the revised estimates were judged to be realistic, there would clearly be a need for more detailed analysis and discussions between the HID team and the duty holder before a decision on gross disproportion could be made. But given that the disproportion must always be gross, very convincing arguments from the duty holder would be needed. Tools like ARI_comah may need to be used with an appropriate aversion index and more detailed CBA to get a better estimate of the proportion factor when aversion is considered.

A2.4 Conclusions

A simple approach to CBA has been presented that only requires a hand calculator. It does not give any credit for scale aversion, which could increase the proportion factor that would be regarded as gross. It is recommend to HID as a quick way of screening out measures that are not reasonably practicable.

Careful consideration of what is a cost and what is a benefit is needed.

When decisions fall into a grey area and there is appreciable societal risk, ARI_comah could be used to assess the influence of scale aversion on the proportion factor and aid the judgement on gross disproportion.

--------------------------------------------------------------------------------

[1] See I.L. Hirst and D.A. Carter A "worst case" methodology for obtaining a rough but rapid indication of the societal risk from a major accident hazard installation, Journal of Hazardous Materials, Volume 92, Issue 3, 10th June 2002, pages 223-237

This is based on F-N societal risk plots having a slope of –1, which is supported by past incident experience.

[2]It might be impractical to ask Duty Holders to perform case specific demonstrations for all identified events immediately. A more pragmatic option would be to insist that the "representative set "or "safety critical events" are considered now with the remaining risk generators being subject to scrutiny in a rolling program, leading up to the time of the next safety report submission.

[3]Mark Middleton & Andy Franks "Using Risk Matrices", The Chemical Engineer, September 2001, pp. 34 – 37

[4] The full methodology is described in the paper by Hirst and Carter (see footnote 1 for full reference).

[5] See Hirst and Carter paper (see footnote 1 for full reference).

This guidance is issued by the Health and Safety Executive.  Following the guidance is not compulsory and you are free to take other action.  But if you do follow the guidance you will normally be doing enough to comply with the law.  Health and safety inspectors seek to secure compliance with the law and may refer to this guidance as illustrating good practice.

back to top