This document has been written to help Assessors to evaluate safety reports written for installations that manufacture or store explosives, and in particular to decide whether these reports meet the "predictive" criteria specified in the COMAH Regulations. To this end the document provides an interpretation of the predictive criteria based on useful examples, as well as background information on explosives hazards. It should be noted that the information given in this guide supplements rather than supplants that given in the Safety Report Assessment Manual (SRAM).
It is assumed that Assessors are familiar with:
The COMAH Manual (only available on HSE’s intranet)
The contents of the COMAH SRAM, particularly
the guiding principles and the procedures for handling and assessing safety
reports.
To comply with the predictive criteria, an Operator must crucially undertake a suitable and sufficient risk assessment to show that the risks of the installation and the operations undertaken on the site have been reduced "as low as reasonably practicable" (ALARP). The following sections provide guidance on the depth of analysis that the Assessors should expect to see.
Before assessing a safety report, Assessors need to be clear about:
These issues are outlined in the remainder of this Introduction and are revisited as appropriate in later sections of the guide.
On receiving a report for the first time, the Predictive Assessor will carry out a preliminary assessment, known as an "early predictive screen" (EPS). A major aim of the EPS is to determine whether the report contains the minimum information required by Schedule 4 Part 2 of the COMAH Regulations. Examples of the type of information that is considered key is given in Appendix 12 of Part 1, Chapter 4 of the SRAM, but essentially the report has to provide:
Without this information, Assessors will not be able to evaluate the adequacy of the safety measures in place on the installation and whether these measures reduce risks ALARP.
After carrying out the EPS, the Assessors will come to one of the following conclusions:
The predictive assessment is pivotal to the demonstrations required under Schedule 4, Part 1 paragraph 2 of the COMAH Regulations, which requires that:
At this point it should be noted that the role of the predictive Assessors relates solely to the risks to people both on site and off site. Risks to the environment are for the Environment Agencies to evaluate and are not addressed here.
When the assessment of the predictive aspects of a safety report is complete, the Assessors should return the completed Assessment Form (AF) to the Assessment Manager giving conclusions about whether:
The assessment form allows Assessors to comment against each criterion and sub-criterion. This guide provides a set of questions relating to each criterion to help Assessors identify any weaknesses and write succinct "deficiency" statements to make clear what is required, e.g. further information or analysis or both.
When filling in the assessment form the paragraph number and page number in the report should be shown for cross-referencing purposes. For example:
| Criterion | Safety report refs | Comments |
Issue* category |
|---|---|---|---|
|
3.3 The safety report should identify all potential major accidents and define a representative and sufficient set for risk analysis. |
pxx para yy |
The safety report does consider how fire might cause a major accident. The report fails to meet criterion 3.3; the Operator has to provide more information. |
Decided by team at final meeting. |
* The Issue Category relates to the inspection plan only.
The assessment approach needs to be consistent and proportionate.
Consistency does not mean that similar sites should pose identical risks: it means that all sites should be evaluated by consistent procedures. In some cases, Assessors may need to exercise professional judgement in order to reach a decision on whether the demonstrations in a report are fit for purpose. The criteria and the associated guidance are designed to help Assessors exercise this judgement in a consistent way. Occasionally, before reaching a decision, they may need to discuss some issues with HID colleagues who are familiar with the installation, the land use planning situation, or the Operator's approach to discharging Section 3 responsibilities.
The assessment team has a key role to play in achieving consistency in the overall assessment of safety reports and in the drawing of the Competent Authorities’ (CAs) Conclusions. Other ways assessment teams can achieve consistency include:
Proportionality is a fundamental consideration when exercising judgement on whether the assessment criteria have been met or not, and Assessors should come to a view on proportionality before starting to assess a report. HSE guidance (L111, HSE 1999a) on the COMAH Regulations (paragraph 74) states that ‘there must be some proportionality between the risk and the measures taken to control the risk. The phrase "all measures necessary" will be interpreted to include this principle’.
Proportionality is essentially determined by the severity of the worst possible consequences, i.e. those resulting from the worst case scenario, and the levels of risk (individual and societal), that remain after taking account of the prevention and mitigation measures the Operator has put in place. The following factors (see also paragraph 292 of HSG 190) are therefore important:
Societal risks considerations are implicit in b), c) and d) above. Where the risks of an installation are ALARP, but are nonetheless sufficiently high to cause concern, the installation would deserve more inspection/assessment and the Operator required to produce more evidence and arguments to support the various ALARP demonstrations than if the risks to people had been towards the bottom end of the ALARP band.
The information contained in a safety report should enable Assessors to understand fully site-specific circumstances so that a view on proportionality can be reached. To this end the report should describe the processes, the hazardous substances involved and their effects on people, the distribution of people off site, and the numbers of people on site and their distribution in relation to the various danger buildings on the installation.
Regulation 2 (1) defines a major accident as: "an occurrence (including in particular, a major emission, fire or explosion) resulting from uncontrolled developments in the course of the operation of any establishment and leading to serious danger to human health or the environment, immediate or delayed, inside or outside the establishment, and involving one or more dangerous substances".
This information will allow Assessors to reach a view on proportionality.
Proportionality will influence the type and level of analysis that Assessors might expect to underpin the various demonstrations in the safety report (see paragraph 292 of HSG 190). HSG 190 defines three levels of risk assessment:
It is implicit in paragraph 292 of HSG 190 that as proportionality increases from a low level to the highest level, the form of risk assessment is likely to change from qualitative, through semi-quantitative to quantitative risk assessment. This is depicted in the diagram below, which shows the tolerability of risk (TOR) framework (see HSE, 2001) for ALARP decision-making. This emphasizes the need to take account of both IR and societal concern when making ALARP judgements. When risks are in the tolerable region, they must also be ALARP. The nearer IR and/or societal concerns (SC) are to the intolerable boundary the greater the degree of proportionality that applies and hence the greater the amount of detail required in the risk analysis. Although QRA is not a legal requirement, some Operators (and certainly those who choose not to comply with the quantity-distance rules) may find it expedient to use quantified arguments and cost benefit analysis (CBA) when demonstrating that AMN are in place and further risk reduction is not reasonably practicable. CBA alone cannot be used to rule out a measure that is prima facie reasonable for the site specific circumstances.
In the case of explosives installations, it will usually be individual risks to workers on site that drive the proportionality considerations, as QD licensing will normally ensure that risks to the public are somewhat below an intolerable level. In this regard it is noted that since at least 1946 there have been no accidents at licensed explosives sites that have resulted in off-site fatalities. However, in this time there have been over 90 fatal explosives accidents within licensed manufacturing sites, and these have resulted in over 100 fatalities amongst workers.
With regard to societal risk, this may be estimated by the use of an approximate risk integral (ARI). A discussion of the COMAH ARI is beyond the scope of this document (further guidance can be found in Appendix 5 of the generic SRAG) sufficed to say that it can be used to obtain an indication of the level of societal risk and aid the assessor in coming to a judgement on proportionality. ARI values can be used to define a TOR framework for societal risk.
When considering proportionality, Assessors should exercise judgement against the expectation shown below:
| IR worker | IR public | Type of risk assessment | ARI COMAH |
|---|---|---|---|
|
>10-3 |
>10-4 |
QRA & full options analysis – risk reduction required |
>500,000 |
|
10-3 – 10-4 |
10-4 – 3.10-5 |
QRA/SQ+ |
500,000 |
|
10-4 – 3.10-5 |
3.10-5 – 10-5 |
SQ+ |
200,000 |
|
3.10-5 – 10-5 |
10-5 – 3.10-6 |
SQ |
20,000 |
|
10-5 – 10-6 |
3.10-6 – 10-6 |
Q+ |
5000 |
|
< 10-6 |
< 10-6 |
Q |
<2000 |
Where: Q = qualitative; SQ= semi quantitative; and QRA= quantitative RA. The '+'sign reflects increasing depth of analysis or quantification, e.g. Q+ is somewhere between the expectation for Q and SQ levels. See Appendix 5 of the Generic SRAG for details of ARI methods.
The suggested divisions between the boundaries in each column are fuzzyto allow the Assessor to exercise discretion on the type and depth of analysis that is fit for purpose in a particular circumstance, i.e. the suggested ‘boundary’ values of ARI and IR are approximate. However, it would be exceptional to judge that a SQ+ risk assessment was needed when proportionality considerations indicate a Q+ analysis should suffice and vice versa. As the level of proportionality increases the level of detail in the demonstrations and the analysis of risk reduction measures (RRM) should also increase, the increasing depth of risk analysis supporting the demonstrations being represented above by the variation Q, Q+, SQ, SQ+, SQ+/QRA.
Further guidance on proportionality is given in SPC/Permissioning/12.
Criterion 1.7 requires that all necessary measures have been taken to prevent and mitigate major accidents and that any residual risks are ALARP. In general, decisions on whether risks are ALARP for major hazard installations are based on the generalized TOR Framework (HSE, 1992; HSE, 2002 - the latter being referred to as R2P2). For nuclear hazards there is considerable experience in making such ALARP decisions, but the mechanisms for other hazards are still evolving. Nevertheless, some companies have adapted the TOR framework to devise their own major hazard risk criteria. Whatever approach is used, professional judgement is usually needed; the team approach to assessment should help achieve consistency in such decisions for top-tier COMAH sites.
The Operator’s ALARP demonstration should be founded on the degree to which good practice, engineering standards, recognized codes and guidance, etc., have been adopted and incorporated into the General Rules and Special Rules of the Explosives Area. The control measures introduced by this process usually will be satisfactory for low hazard installations, or installations that are compliant with the quantity-distances prescribed in MSER. This amounts to using technology-based criteria for making ALARP decisions, i.e. qualitative risk assessment. Such criteria will usually be sufficient when inherently safe design principles, such as remote working, have been adopted because then the scale of the hazard should have been drastically reduced. As the level of proportionality increases a decision has to be made as to whether further risk reduction measures are reasonably practicable as required by the HSW Act. Basically, two questions have to be answered:
If no further measures can be identified, the Operator must have all necessary controls in place; it is then a matter to verify by inspection that this is the case and that the measures are sufficiently reliable. To answer the second question some quantification and cost-benefit analysis (CBA) is usually required. The degree and rigour of this quantification will depend on the level of proportionality and the site-specific circumstances. Such ALARP decisions usually involve the application of the generalized TOR framework as outlined in R2P2 (further guidance on proportionality is given in SPC/Permissioning/12).
Societal risks must not exceed the criterion in R2P2, i.e. the likelihood of a single major industrial activity producing 50 or more fatalities should be less than 1 in 5000 per year, i.e. less than 2 x 10-4 per year. This is essentially an equity-based criterion for societal risk. If the criterion is met for a single plant it is still necessary to judge whether the risks are ALARP for the installation, which may have several plants.
To assess whether the societal risks are ALARP, utility-based criteria might be applied. These are based on the individual risk levels and CBA to determine the cost of introducing further measures to reduce the fatality risk. By comparing this "value of preventing a fatality" to the value society puts on each life (e.g. £1M), an indication of the level of disproportion is obtained. Judgement on whether this is gross will depend on the site-specific circumstances, in particular the nature of the hazard and the likely value of the number of fatalities from the worst-case scenario (see SPC/Permissioning/12 for further guidance).
In the case of societal risks, deciding whether the risks are ALARP can be quite onerous, particularly for complex sites. One of the earliest examples, which underlines the complexity of making ALARP decisions, is the Canvey Island Studies, which are documented in two Reports (HSE, 1978; HSE, 1981). The Canvey studies considered the risks to members of the public from a number of major hazard sites operated by different companies and a proposed new refinery.
An important point stemming from the Canvey studies and the 1992 TOR document is that when several sites contribute to the risk born by an off-site individual, the aggregated fatality risk must be ALARP and less than 10-4 per year. This has implications for multi-installation sites and multi-occupier sites, and for the assessment of safety reports at such sites. This issue is not addressed in R2P2. Should this type of situation arise in the assessment of COMAH safety reports the team should consult HID Operational Policy Unit on the way forward.
In the case of new plant, precedents have been set to apply more stringent ALARP criteria (HSE, 1992). This precedent recognizes that most risk reduction opportunities exist at the design stage, e.g. through the application of inherent safety principles and the application of new technology.
The purpose of HSE’s assessment of a safety report against the criteria in the SRAM, is to come to a conclusion on whether the requirements specified in Schedule 4 Part 1 have been met. The extent of the information required for each demonstration will depend on proportionality considerations and the type of safety report required by the COMAH Regs 7 or 8. The different report types include: the initial report for existing establishments, pre-construction (PCSR), pre-operation (POSR), modification and updated reports.
Operators will write the safety report in a structure that suits them. Whatever structure is adopted, the Operator should ensure that the information is linked to the required demonstrations in a transparent way. The Assessors should bear in mind that the same control measures and arguments may apply to more than one demonstration. Also, information to support a particular demonstration may be found in different parts of a safety report.
The predictive criteria are designed to help Assessors make consistent professional judgements about the adequacy of demonstrations in safety reports. Such demonstrations need to be based on a suitable and sufficient risk assessment (EU, 1998). The criteria are necessarily quite general, but sufficiently broad in nature to cover the various types of installation, the range of hazards to be encountered, and the types of risk assessment that might be employed. Therefore, not all the predictive criteria may need to be considered in the same detail by the Assessors, but all the top-level criteria need to be applied. The issues identified in the assessment plan for close examination should help identify the predictive criteria that are key for a particular assessment. The extent to which the sub-criteria are applied should be proportionate. At the lowest level of proportionality a qualitative risk assessment based on recognized codes or guidance will suffice; no detailed quantification of event probabilities needs to be undertaken so that the associated criteria need not be tested rigorously.
The criteria are provided as a guiding framework with in which professional judgements are made: they are not provided as a tick list. The Assessment Form should make clear that the Assessors have tested all the predictive criteria. The effort put into the assessment should be proportionate and sufficient to enable valid conclusions to be drawn; the reasons behind these conclusions need to be transparent, i.e. recorded for auditing purposes.
Assessors should bear in mind that Operators might rely on published guidance or standards in seeking to demonstrate compliance. However, Operators who demonstrate compliance using company, or other non-published standards will have to show that they are fit for purpose, i.e. the standards are based on risk assessments. They must also show that they have properly identified all foreseeable hazards and that they have implemented all necessary measures to prevent major accidents. This means that the Operator has to demonstrate that HSW Act Section 2 (on-site) and Section 3 (off-site) risks are ALARP. The report will therefore have to address any risks that remain in order to demonstrate that all the necessary measures have been taken. For example, standards may only address risks to workers, in which case the Operator may (depending on the level of proportionality), need to justify their relevance to making off-site risks ALARP. It is then a matter of judgement whether the risks to people on and off site are ALARP.
The SRAM provides guidance on how Assessors should address the various types of safety report. As a general guide, the Assessors should take a quick overview to gain an insight into the installation’s activities, environs, the scale and nature of the hazards, the range of potential major accidents, the controls in place, and the maximum casualty potential. This will enable the Assessors to take a view on proportionality and the most important issues to be considered. The Assessors can then examine the report in detail against the criteria to draw conclusions on the report.
The following points are central to the assessment process:
