Guidance on ALARP Decisions in COMAH

SPC/Permissioning/37

Open Government Status

Fully Open

Author Unit/Section

HID CI5A

Target Audience:

All Inspectors in HID CI 1-5, SI2-3 ; B1s in OSD and HID HQ

Version No:

3

Purpose

1.  The HSE document "Reducing Risks Protecting People" ( R2P2) was republished as an information document on the 13th December 2001. The purpose of that document is to address external stakeholders about HSE`s approach to regulatory decision making. This is accompanied by the so called "ALARP Suite" comprising three documents; Principles for Regulators, Good Practice and Design which give guidance to HSE staff. Each part of HSE is expected to provide supplementary sector specific guidance to support implementation.

2.  This document aims to give guidance specifically on ALARP demonstrations in the COMAH context and replaces SPC/Perm/12 which is withdrawn. This guidance should be read in the context of the policy document (SPC/Permissioning/39), together with the generic safety report assessment guide (SRAG) revised in the light of experience in assessing safety reports (still under review).

Legal Background

3.  The principal health and safety legislation in the UK is the Health and Safety at Work etc. Act 1974 (HSW Act) (see HSE's enforcement policy statement).  It requires risks to employees, and others, to be reduced 'so far as reasonably practicable' (SFAIRP).  The meaning of SFAIRP has been the subject of legal judgement in the UK courts (Edwards v National Coal Board). Risk assessments are also required by The Management of Health and Safety at Work Regulations, Regulation 3.

4.  Regulation 4 of the COMAH Regulations requires Operators to "take all measures necessary (AMN) to prevent major accidents".  This is interpreted as the equivalent of reducing risks "as low as reasonably practicable" (ALARP). In terms of what they require of duty-holders, HSE considers that duties to ensure health and safety so far as is reasonably practicable ("SFAIRP") and duties to reduce risks as low as is reasonably practicable ("ALARP") call for the same set of tests to be applied.

5.  For top tier COMAH sites, the demonstration that AMN have been taken to reduce risks ALARP should form part of the Safety Report as required by Regulations 7 and 8 of the COMAH Regulations. The required level of detail is specified in Schedule 4 to the Regulations.

Existing Guidance

6.  HSE has produced a suite of guidance documents concerning ALARP. These are designed to give high level principles which separate parts of HSE can then use to promulgate sector specific advice. The documents are:

1. Reducing Risks, Protecting People (RSP2);
2. Principles and guidelines to assist HSE in its judgments that duty-holders have reduced risk as low as reasonably practicable;
3. Assessing compliance with the law in individual cases and the use of good practice
4. ALARP in Design - Policy and Guidance.

7.  The HSE discussion document "Reducing Risks, Protecting People - HSE's decision making process" (R2P2) sets out HSE's approach to making decisions about SFAIRP and ALARP. It is a further development of ideas previously promulgated in HSE's Tolerability of Risks from Nuclear Power Stations (TOR) document (1992) which defined three regions of risk, delineated by an unacceptable region and a broadly acceptable region; the region in between defining a region of tolerable risk, but only when those risks are ALARP.

8.  R2P2 makes some important statements of principle:

Principle 1

"HSE starts with the expectation that suitable controls must be in place to address all significant hazards and that those controls, as a minimum, must implement authoritative good practice irrespective of situation based risk estimates".

Principle 2

"The zone between the unacceptable and broadly acceptable regions is the tolerable region.  Risks in that region are typical of the risks from activities that people are prepared to tolerate in order to secure benefits in the expectation that

• the nature and level of the risks are properly assessed and the results used properly to determine control measures;
• the residual risks are not unduly high and kept as low as reasonably practicable (the ALARP principle); and
• the risks are periodically reviewed to ensure that they still meet the ALARP criteria, for example, by ascertaining whether further or new controls need to be introduced to take into account changes over time, such as new knowledge about the risk or the availability of new techniques for reducing or eliminating risks."

Principle 3

"both the level of individual risks and the societal concerns engendered by the activity or process must be taken into account when deciding whether a risk is acceptable, tolerable or broadly acceptable' and 'hazards that give rise to …. individual risks also give rise to societal concerns and the latter often play a far greater role in deciding whether risk is unacceptable or not".  

9.  ALARP guidance specific to the COMAH regulations is provided in:

• HS(G) 190 (Appendix 4);
• L111 (Regulation 4);

ALARP Demonstration Requirements

10.  HID will consider All Measures Necessary (AMN) to be in place for people when HSW Act Section 2 and Section 3 risks are demonstrated to be ALARP and that demonstration has been accepted and verified. AMN must be in place for each Major Accident. HID's assessment will be proportionate, particularly for safety critical events.

11.  The tools used in Safety Reports to demonstrate ALARP will vary depending on the level of risk.  However, the measures in place to prevent or limit major accidents should be described in the safety report and be at least to 'relevant good practice'.  The assessor will need to focus on these measures to be satisfied they do represent good practice etc. 

12.  HID will regard relevant good practice to have met the AMN requirement when:

• 1. the societal risks can be shown (subject to uncertainty) to be broadly acceptable (eg by use of an approximate risk integral such as ARI, QuickFN or other societal risk methodology; and
• 2. no group, or individual, is subject to relatively high individual risks that are not ALARP.

13.  HID regard good practice as being subject to the process of continuous improvement and will encourage industry to keep it up-to-date as technology advances, and societal concern about Major Accident Hazards varies.

14.  Having been satisfied that the measures in place represent relevant good practice, the residual individual risks will be in one of the following category bands:

Intolerable Risk:
Clearly, if the risk is in this region then ALARP cannot be demonstrated and action must be taken to reduce the risk almost irrespective of cost.

"Tolerable if ALARP" Risk
If the risks fall in this region then a case specific ALARP demonstration is required.  The extent of the demonstration should be proportionate to the level of risk.

Broadly Acceptable Risk:
If the risk has been shown to be in this region, then the ALARP demonstration may be based on adherence to codes, standards and established good practice.  However, these must be shown to be up-to-date and relevant to the operations in question.

15.  This is shown diagrammatically in Figure 1, with the individual risk criteria taken from R2P2 (numbers are risk of death per annum):

Figure 1: Types of ALARP Demonstration

16.  The equivalent diagram for societal risk is shown in Figure 2.  It should be noted that the current policy is not to enforce risk reduction for risks which are purely societally based.  In the short term, duty holders should look to implement, on a voluntary basis, risk reduction measures which are low/reasonable cost.  More significant risk reduction may be achieved in the longer term as plant comes to the end of its useful life and may be replaced by lower risk alternative approaches.

Figure 2: ALARP Demonstrations – Societal Risk

17.  A case specific ALARP demonstration for individual risks is essentially a simple concept which can be satisfied by the Operator answering the following fundamental questions in relation to the identified MAH scenarios:²

Q1 – What more can I do to reduce the risks?

The answers to this question are qualitative in nature.  The operator should look systematically at the risks from his operations and draw up, in a proportionate way, a list of measures which could be implemented to reduce those risks.  Only in a minority of circumstances will there be nothing further that the Operator could do without shutting the plant down completely.  HID has commissioned research work to produce a database of risk reduction measures to assist assessors in determining if anything more might be done, which is available on the Process Safety Community of Practice & Interest (CoPI) website.  Having answered Q1, the need to act is determined by answering the second question.

Q2 – Why have I not done it?

The answer to this question may be qualitative or quantitative in nature depending on the predicted level of risk prior to the implementation of those identified further measures.  Whichever way the question is answered, if the measure is "prima facie reasonable", based on engineering considerations, and it cannot be shown that the cost of the measure is grossly disproportionate to the benefit to be gained, then the Operator is duty bound to implement that measure. Inspectors will require guidance on determining whether an Operators arguments on gross disproportion are valid – this is covered  in Section 8C and Annex1.

Proportionality Decisions

18.  Proportionality must be considered for at least 2 aspects of Safety Report assessment; the rigor (or robustness) of the risk assessment used and the depth of the ALARP demonstration.  It may also be appropriate when considering the appropriate level of gross disproportion, a specific element of the overall ALARP demonstration (see section 8C).

Proportionate Risk Assessment

19.  The existing HSE published guidance states 'the depth of the analysis in the operator's risk assessment should be proportionate to (a) the scale and nature of the major accident hazards (MAHs) presented by the establishment and the installations and activities on it, and (b) the risks posed to neighbouring populations and the environment ie the assessment has to be site specific.'  The risks referred to here include both individual and societal risk.

20.  The depth of analysis that needs to be present depends on the level of risk predicted before the identified additional measures are applied.  The nearer the risk is to the intolerable/uncomfortably high boundary, the greater the depth of analysis which is needed to be proportionate.  There are various kinds of risk assessment that may be used depending on the level of risk.  These range from Qualitative at the lowest level, through Semi-Quantitative, up to Quantitative at the highest level.

Risk Criteria

21.  Criteria for the boundaries of tolerability of risk have been developed for Individual risk, but there are no adopted UK criteria for Societal Risk other than that in R2P2.

Individual Risks

22.  Where individual risks have been satisfactorily quantified in a Safety Report , then it is possible to compare the value with the individual risk criteria published in R2P2.  The risk criteria are risk of death (to be distinguished from other types of risk, such as risk of dangerous dose used in HSE`s land use planning approach). These are illustrated in Figure 1.

23.  A diagram similar to Figure 1 can be constructed for societal risks but with appropriate criteria.  These criteria will be discussed later (see Section 6, Figure 4).

Societal Risks

24.  Societal risk is the relationship between frequency of an event and the number of people affected.  Societal concern includes (together with the societal risk) other aspects of societies reaction to that event. These may be less amenable to numerical representation and include such things as public outcry, political reaction, loss of confidence in the regulator, etc.  As such, societal risk may be seen as a subset of societal concern.  Alternatively, societal concern may be regarded as all the factors that go into making a judgment as to whether the costs of further risk reduction are grossly disproportionate.

25.  One way to determine proportionality for societal risks is to use the maximum potential fatalities (Nmax).  This value must be estimated as part of the 'assessment of the extent and severity of the consequences of identified major accidents' which is mandatory minimum information. The value of Nmax can be combined with the frequency of the event causing Nmax (fNmax) to determine an indicator of societal risk levels.  This can be compared with suitably determined criteria.  HID CI5 have developed a societal risk methodology (ARICOMAH) to help Inspectors assess this aspect of safety reports.  The methodology will be described later (see Section 6).

26.  A less approximate methodology (QuickFN) has been developed for use with certain substances (eg chlorine, HF, refrigerated flammables, etc.).

Risk Assessment Rigour

27.  The level of risk (either individual or societal) can be used to determine the type of risk assessment an assessor would expect to see in a Safety Report - as illustrated in Figure 3 below.

Figure 3: Types of Risk Assessment

28.  The definitions of Q, SQ, QRA, etc. are based upon definitions of types of risk assessments set down in HS(G) 190  and developed further in the Generic SRAG (with intermediate levels where appropriate), but in essence the type of risk assessment which is appropriate in a demonstration will vary gradually in depth and level of quantification from qualitative (Q) at one end to full quantified risk assessment (QRA) at the other.

Proportionate ALARP Demonstration

29.  Proportionality is also relevant to the determination of the depth of analysis used to demonstrate ALARP. With reference to Figure 1, the higher the risk is within the "tolerable if ALARP" region, the greater will be the depth of demonstration required (eg greater effort needed to determine potential risk reduction measures) to show that those risks are ALARP.

Tools for ALARP Determination using Societal Risk

30.  However much care is taken in designing, constructing and operating an installation that uses large quantities of dangerous chemical substances there remains a possibility that a release will occur resulting in a multi-fatality accident.  The best available technology for studying this "societal risk" is full scope application of quantitative risk assessment (QRA).  However, the technique is time-consuming and requires a high level of technical capability.  Given the realities of limited time and money, Operators  have been reluctant to embark on such a course in preparing COMAH Safety Reports.

31.  Recognising this, HID CI5 have developed a methodology (ARICOMAH) that can be applied by assessors to provide a rough but rapid indication of the magnitude of societal risks.  An improved tool (QuickFN) has been developed for assessing the most common substances (eg chlorine).  These tools can be used to come to a view on:-

1. the type of risk assessment required; 
2. the extent of the ALARP demonstration; and
3. the level of gross disproportion to be assumed when deciding if a risk reduction measure is "reasonable". 

The tools can be used to make judgements whether the Dutyholder's risk assessment is proportionate in respect of  i), ii) and iii).

32.  Within the methodologies a parameter is defined, suitable for comparison with criteria, and its value calculated.  If the calculated value is sufficiently low then HSE might be satisfied that nothing further is required.  For higher values, a more comprehensive site-specific risk assessment and ALARP demonstration may be deemed necessary.

33.  Recent research has questioned the use of explicit mathematic scale aversion, and so the preferred metric for determination is now the "Potential Loss of Life" (PLL), also know as "Expectation Value" (EV). Both the QuickFN and ARICOMAH tools calculate both Risk Integral (RICOMAH) and PLL values, although the latter should be used to guide judgements on ALARP demonstration.

34.  A value for the boundary between the uncomfortably high and the "tolerable if ALARP" region on the societal risk equivalent of Figure 1 can be determined from the societal risk criteria given at paragraph 136 of R2P2 if this value is assumed to be a point on an F-N curve with a slope of -1 (as confirmed by RAPU).  This value is calculated to be an RICOMAH of approximately 500,000, or a PLL value of 75,000 (see Figure 4 below).

35.  The boundary between the broadly acceptable region and the "tolerable if ALARP" region is assumed to be two orders of magnitude below the intolerable boundary.  This value is calculated to be equivalent to an RICOMAH of 2,000, and a PLL of 520 (see Figure 4 below).

36.  Inspectors should be aware that there may be considerable uncertainties attached to the ARICOMAH and QuickFN inputs and that the values calculated should be used to give an indication of the level of societal risk rather than an absolute value.

Figure 4: Societal Risk Criteria

Decisions by Assessment Teams on whether ALARP has been Demonstrated

35.  In relation to COMAH Safety reports, the decision as to whether ALARP has been demonstrated will be one for the whole Assessment Team to make collectively, taking account of the application of individual inspectorial discretion.  Inputs to that decision will include:

• The level of risk (both on and off site, individual and societal);
• The arguments used in making the demonstrations in the Safety Report;
• If there are further risk reduction measures that the Operator has not considered; and
• Other factors that the Team feel are relevant.

36.  Differences of opinion will arise and these should be resolved at the appropriate management level.

Further Guidance

37.  The basic framework and tools for determining the suitability of ALARP demonstrations is underpinned by more detailed guidance on specific aspects of risk assessment. These are described below, along with areas where guidance for assessors is still being developed.

Risk Reduction Measures Database and Costs Database

38.  A database of Risk Reduction Measures (RRMs) and another of associated costs were prepared for HSE by HSL and external consultants. These are available on the Process Safety Community of Practice & Interest (CoPI) website.

Cost Benefit Analysis Guidance

39. HSE has developed guidance on Cost Benefit Analysis (CBA) centrally, which is publically available on the HSE website. It comprises of two documents, HSE principles for Cost Benefit Analysis (CBA) in support of ALARP decisions, and Cost Benefit Analysis (CBA) Checklist.

Guidance on Gross Disproportion

40.  All RRMs will involve a cost to the Operator.  Equally, an RRM is intended to reduce risk from an operation and this reduction will bring about a benefit (in lives saved, etc.) which can be expressed in monetary terms.  The ratio of the costs to the benefits can be described as a "proportion factor" (PF). This factor is also referred to as the "Gross Disproportion Factor" or GDF – the terms are interchangeable.

41.  The value of avoiding a statistical fatality is generally taken to be approximately £1.65m (2008 figure).  It should also be noted, however, that the benefits might also include the avoidance of such things as environmental cleanup costs, increased insurance premiums, loss of asset value, the costs of increased regulatory interference, etc.

42.  If the PF is greater than some defined value, then the costs can be said to be grossly disproportionate to the benefits and the RRM would not be "reasonably practicable".  The difficulty lies in defining what this limiting value of PF should be.
It is assumed that, within the "tolerable if ALARP" region, the minimum value of PF will be 1 since values below 1 imply a bias against safety.  It is further assumed that the value of PF will increase in some way as risk increases. That is to say, the operator would be expected to pay more to reduce risk by a given amount if the initial level of risk is close to the individual risk intolerable limit than if the risk were just above the broadly acceptable limit (Principles and Guidelines document, para.25).  In the individual risk intolerable region, RRMs must be implemented almost regardless of cost, implying a very high, or infinite PF (though it is recognised that CBAs and gross disproportion are not applicable in this region).

43.  The difficulty lies in defining the upper limit of PF and the way PF increases with risk.  An upper value for PF of 10 has been suggested, but the way PF changes with risk is still unclear.  However, the basic principle is shown in Figure 5.

Figure 5: Change of Proportion Factor with Risk

44.  Within the Broadly Acceptable region, providing DH's comply with relevant good practice, additional RRMs are assumed to be not reasonably practicable implying a PF of zero.  However, if there are obvious and cheap measures that could be taken they should at least be considered. 

45.  During 2008/9, HSE commissioned some research into Proportion Factors, building on earlier work by HSE's Risk Assessment Policy Unit (RAPU). This is summarised, and some guidance on proportion factors given, in Annex 1 to this paper.

45.  HID believe that there may be a number of site specific issues which should be taken into account by the assessment team.  These include the presence of hospitals or significant numbers of children or the elderly.  Here, difficulties in organising and evacuating these groups means there is an additional risk factor to be taken into account.  Also, due to factors such as physiology, state of health, etc., people in these groups may also be more vulnerable to the effects of the hazard.   The assessment team may decide that the presence of these groups calls for an increase in the gross disproportion factor (ie an increase in PF)

Demonstration Frameworks

Flow sheet Approach

46.  HSE choose not to be prescriptive on how Dutyholders make their demonstrations that all necessary measures have been taken, but one way of approaching this is set down in the attached flow sheet at Fig 6. This method assumes that the risks are not intolerable.

Stepwise Approach

47.  Alternatively we have found that some Duty Holders have used the following stepwise approach.  This approach assumes that the risks have been shown to be in the "tolerable if ALARP" region and that a case specific ALARP demonstration is required:

• i.  Identify controlled substances, their inventories and locations.  Show the local environment including on and offsite populations that may be affected and other hazardous installations (including those at designated domino effect sites) that might be affected by major accidents or be initiators of a major accident.  Show that the required measures are, at least, to current authoritative good practice.
• ii.  Identify all major accidents and develop a qualitative view on the significance of each one. In the light of the view on the significance of all the identified major accidents, choose a representative subset for detailed consideration.
• iii.  Refine the prediction of the hazard range and its likelihood, for each event in the chosen representative subset.
• iv.  Refine the prediction of the consequences, for each event in the chosen subset, including estimates of the number of fatalities, major and minor injuries to people.
• v.  Show the consequences and the likelihood, for each event in the chosen subset, on a suitable matrix or fN plot (with suitable error bands).
• vi.  Divide the area of the matrix (or plot) into 3 bands (broadly acceptable risk, tolerable if ALARP, intolerable risk) and calibrate these bands against criteria. Suitable numerical criteria for individual risk are set down in R2P2.
• vii.  For intolerable risks immediate action should be taken to reduce risks. For those events in the broadly acceptable region a comparison with relevant standards should be appropriate. For those events in the ALARP region look at the major accidents in a particular consequence band and select the ones with the highest frequencies.
• viii.  For these, determine what additional risk reduction measures, beyond relevant good practice standards, (software as well as hardware) may be implemented
• ix.  Implement these measures unless a reasoned argument is presented showing the costs to implement this scheme are grossly disproportionate.
  Arguments based upon `strength in depth` concepts such as Layers of Protection (LOPA) or `Lines of Defence` may be used. Where the risks have been assessed as high, the use of formal cost benefit analysis may be required to test the cost-benefit balance for the prospective remedial measures.
• x.  Revisit step 7 for lesser consequences and continue until  proportional demonstrations are made.

Further Information

48.  For further information, contact HID CI5A, 2.2 Redgrave Court, Bootle.

Figure 6: ALARP Demonstration Flow sheet

Footnotes

1. See I.L. Hirst and D.A. Carter A "worst case" methodology for obtaining a rough but rapid indication of the societal risk from a major accident hazard installation, Journal of Hazardous Materials, Volume 92, Issue 3, 10th June 2002, pages 223-237.
   This is based on F-N societal risk plots having a slope of –1, which is supported by past incident experience.
2. It might be impractical to ask Duty Holders to perform case specific demonstrations for all identified events immediately.  A more pragmatic option would be to insist that the "representative set "or "safety critical events" are considered now with the remaining risk generators being subject to scrutiny in a rolling program, leading up to the time of the next safety report submission. Back