1 

### Quantified Risk Assessment (QRA) the HSE offshore experience

A personal perspective prepared by Ian Whewell former Director of Offshore Division

of The UK Health and Safety Executive for the US Chemical Safety Board

Background

QRA has been used extensively for many years by the UK Health and Safety Executive (HSE) and considerable work has been done on its appropriate use in regulating safety. It has been used particularly in the ‘major hazard’ types of industry such as chemical, offshore oil and gas and nuclear. In such industries the consequences of an incident are such that some means of enabling the levels of risk to be quantified and relative risks to be evaluated is essential when making regulatory decisions.

For onshore sites the safety (as opposed to envi ronmental) risks extend to the broader off-site ‘societal’ area in addition to the population employed on the major hazard site. For this reason the first extensive use of QRA by HSE was in the nuclear industry where the need to have some means of identifying the relative levels of off- site risks was essential to enable regulatory decisions to be made on levels of risk control. The nuclear model introduced the concept of ‘tolerable’ and ‘intolerable’ risk levels based on numerical analysis using QRA. The approach was subsequently extended to other industries where the off-site risks were considered such that the levels of risk to the surrounding population needed to be evaluated to reduce exposure or to provide criteria for encroachment. HSE published guidance on levels of societal risk to facilitate decisions on land use planning, and for many years this guidance represented a definitive view on acceptable risk levels and influenced thinking on what did or did not represent legal compliance in high risk industries.

The incidence of events such as Flixborough in the UK in 1974, Seveso in Italy in 1976, Bhopal
in India in 1984 reinforced the need to evaluate offsite risks and to control societal risks adjacent to major hazard plants. During the 1970s and 1980s QRA became increasingly popular as a tool not only for evaluating off-site risks but for ev aluating on-site risks, i.e. risks to the working population on the site. Indeed as the levels of sophistication developed QRA increasingly became the method of choice for judging whet her risks were being effectively controlled and whether measures had been taken to reduce risks as low as reasonably practicable (ALARP). It was in this environment that the Piper Alpha offshore disaster occurred, resulting in 167 deaths
in what is still the world’s worst offshore accident.

The Cullen Report and the Safety Case Regulations

The Lord Cullen judicial inquiry into the Piper Alpha disaster revealed a number of catastrophic failures in the management and control of risk on the installation, and the subsequent report made 106 recommendations intended to prevent the reoccurrence of such an event. At the time of the inquiry there was considerable evidence presented to indicate that the hazards and risks on the Piper Alpha installation were neither understood nor had they been properly evaluated. The failure to properly manage risk was a critical factor contributing to the incident. It was clear2 that major hazard risks (i.e. those which posed a risk of multiple fatalities) were not being effectively managed and controlled because t he assessment of those risks and hazards had been inadequate. A number of experts in QRA methodology gave evidence to the inquiry with the result that much of the emphasis was on its use as a primary tool for evaluating and controlling risk.

To address the failures identified the Cullen recommendations proposed new regulations to replace the existing prescriptive regulations. In particular these regulations were to contain requirements to identify major accident hazards , to evaluate risks and to implement measures to reduce those risks to the lowest level that is reasonably practicable. Given the extensive use of QRA at the time of the Cullen inquiry and the evidence presented there was an implicit understanding that QRA should be used as the primary tool to demonstrate to the regulator that risks were being effectively controlled but, most importantly, controlled to as low a level as is reasonably practicable. This was reinforced by a specific legal requirement to carry out suitable and sufficient QRA with respect to certain measures to protect persons on the installation. Indeed the first edition guidance to the Safety Case Regulations specified a maximum ‘temporary refuge impairment frequency’ an output which could only be determined by QRA.

Early experience of QRA in Safety Case demonstrations

Thus in the early days of the implementation of the Safety Case Regulations many of the regulatory discussions were characterised by complex arguments involving QRA ‘experts’ in the industry and in HSE. Many risk management and control demonstrations contained in Safety Cases were extensively numerical and often prepared by specialist consultant companies detached from the day to day management and control of installations. Increasingly QRA was being used to justify not only the adequacy of risk controls but reasons why additional risk control measures need not be implemented. In other words rather than QRA being used as a tool to progressively improve safety standards, it was being used to hold back the implementation of innovative improvements. This was exactly the opposite outcome to that which the ‘goal setting’ legislation intended.

At the same time it became increasingly appar ent that as a tool for accurately quantifying absolute levels of risk there were serious deficiencies. Variables and assumptions in the methodology meant that any two QRA ‘experts’ using the same basic data could arrive at different conclusions. The results therefore could be manipulated to achieve the desired outcome if required. The concern in HSE was that the numerical outputs from consultants rather than from the companies managing the installations became increasingly detached from the real world as the inputs did not fully take into account differing conditions on individual
installations.

The methodology was also frequently too theoretical to inform management risk control decision- making and there was often too broad an approach to enable effective risk control improvements to be identified. Indeed the identification of an overarching QRA ‘acceptable risk’ figure for an installation militated against any risk control improvements being willingly accepted by duty holders. There was an increasing belief that QRA alone could demonstrate ‘safe operation’ with aspects of risk control such as qualitative assessment and good engineering judgement relegated to minor contributions or not really featuring at all. QRA almost became a3 one stop ‘go, no go’ tool for deciding what was ‘safe’ and what was not. In short what was a valuable tool for assessing levels of risk in appropriate circumstances was being inappropriately applied, frequently to the exclusion of other risk assessment and evaluation techniques.

The dawning reality

As experience with the submission of safety cases built up the early doubts and concerns about the value of complex QRA within the safety case as, in most cases, the primary methodology for demonstrating ‘safe’ operations were confirmed. In addition it was apparent that the use of QRA to demonstrate legal compliance to show ma jor hazard risks were ALARP, was consuming considerable resources both by companies submi tting safety cases, and within HSE as the regulator. As the initial concerns about the value of such complex calculations within the safety cases were not reducing Offshore Division (OSD ) of HSE began to consider options to address
these concerns.

Ironically the offshore industry also began to question the way that QRA was being used in safety cases. Because the legislation clearly mandated the use of QRA to demonstrate certain aspects of the safety case, the industry had initially decided to adopt the approach across the board and to use QRA as previously described to determine overall risks on the installation to establish ‘tolerable risk’. This, in itself, would not necessarily have been detrimental, but the use of specialist consultants and the high degree of complexity associated with a document which was intended to be accessible to, and to have a contribution from, the workforce, meant that the value of the safety case as a working practical document was undermined

Discussions with the offshore industry and presentations at conferences by OSD sought to change the overly- heavy emphasis on QRA in safety cases, and to develop instead demonstrations of risk management and control based on good engineering practice and qualitative risk assessment. The reference to impairment frequency of the temporary refuge contained in the guidance to the Safety Case regulations was removed to help to clarify the intentions of the legislation. Nonetheless the legislation still contained a specific requirement for ‘suitable and sufficient’ QRA with respect to certain demonstrations in the safety case. Despite an attempt in the guidance to clarify the extent to which it was necessary to use QRA many offshore companies continued to use the full rigour of QRA.

At the same time it was clear that the requirement to demonstrate in the Safety Case that major hazard risks were ALARP was also pushing many offshore companies to prepare (or have prepared for them) complex QRA demonstrations. The HSE recognised that there was a lack of guidance and practical advice on the question of ‘so far as is reasonably practicable’ and its equivalent ALARP. This again was contributing to duty holders using full QRA as a fall-back to ensure compliance.

The new approach to QRA

As a first step, to clarify the requirements to demonstrate ALARP and to clearly indicate that QRA should not be the primary tool for such demonstrations, HSE published a suite of guidance for HSE inspectors which was simultaneously made available to the industry. The current version last updated in 2003 1,2,3 attempted to clarify the legal requirements to demonstrate ALARP. A key change to the approach was the specific emphasis on the role of good practice4 in establishing that risks had been reduced as low as reasonably practicable. Indeed QRA was not specifically mentioned in the guidance to emphasise that the ALARP demonstrations may be effectively made without the need for QRA to be used as the primary tool.

In 2005 HSE took the opportunity to revise the Safety Case Regulations and in doing so to clarify the role of QRA within the safety case. The specific requirement to use ‘suitable and sufficient’ QRA within the safety case was removed and the demonstration requirements focussed not simply on ALARP but on the broader regulatory requirements which were then fully in place to support the Safety Case requirements. In effect, rather than an abstract requirement simply to demonstrate major haza rd risks are ALARP, the duty holder is now required to demonstrate how the law is being complied with. The supporting legislation contains all the necessary requirements which, if fully comp lied with, will ensure the installation is being operated safely.

The nature of the safety Case, therefore, is intended to change from what had become a very complex numerical analysis to a much more practical and user- friendly document giving increased accessibility to the workforce in particular. Equally important, the nature of the demonstrations should both enable input from the workforce and provide a much more focussed
view of the situation and circumstances on each individual installation.

It is important, however, to clarify that whilst the emphasis with respect to QRA has changed (in particular the way it is used in safety cases) it still represents a valuable tool in establishing levels of risk. However because of the variables, a nd at times its misuse, HSE’s view was that it should be integrated into the broader risk assessment approach and used more sparingly and with the appropriate caution. As an absolute measure of risk there are a number of issues, but it still represents a very useful tool for measuring comparative risk and to assist judgements in deciding options. OSD has published guidance 4 intended to clarify the role and status of QRA. The document contains the following statement:

SCR92 tended to focus the attention of a duty holder on the extensive use of detailed QRA, frequently prepared by a specialist contractor on their behalf. This approach has been useful for advancing the understanding of risk on offshore installations, or from activities in connection with them. However, now that this understanding is more mature, it is suggested that risk assessment should now become increasingly focused on where it can add value (e.g. in evaluation of risk reduction options) rather than provided as “off the-shelf” assessment. Thus any risk assessment should answer the fundamental question of whether there is anything more that can be done to reduce the risk, while adding value. There is also a shift in focus from contractor-owned risk assessment back to management ownership.

The document goes on to outline the staged approach to risk assessment and demonstrations of compliance, starting with a qualitative approach and moving where necessary and appropriate through semi quantitative to full quantitative techniques. This approach has been welcomed by the offshore industry as a more pragmatic methodology and has reduced the frequency of complex theoretical discussions based entirely on complex numerical analysis. This adds to the regulatory efficiency as well as being more cost effective for the offshore industry. In the UK QRA has, therefore, found its rightful place in the toolkit for risk control and reduction. It still has a key role to play, but no longer dominates as before.5 References

1. Principles and guidelines to assist HSE in its judgements that duty-holders have reduced risk as low as reasonably practicable. http://www.hse.gov.uk/risk/theory/alarp1.htm 2. Assessing compliance with the law in individual cases and the use of good practice. http://www.hse.gov.uk/risk/theory/alarp2.htm 3. Policy and guidance on reducing risks as low as reasonably practicable in Design. http://www.hse.gov.uk/risk/theory/alarp3.htm
4. Guidance on Risk Assessment for Offshore Installations. Offshore Information Sheet No.
3/2006. http://www.hse.gov.uk/offshore/sheet32006.pdf