THE SAFETY REPORT ASSESSMENT MANUAL 

Sections 8 to 15 

8 - HOW TO USE THE CRITERIA.............................................................................. 2 

9 - DESCRIPTIVE ASPECTS ................................................................................... 19 

10 - PREDICTIVE ASPECTS.................................................................................... 30 

11 - MAJOR ACCIDENT PREVENTION POLICY & SAFETY MANAGEMENT 

SYSTEMS ASPECTS ............................................................................................... 49 

12 - TECHNICAL ASPECTS..................................................................................... 64 

13 - GUIDANCE FOR ENVIRONMENTAL ASSESSMENT.................................... 125 

14 - EMERGENCY RESPONSE ARRANGEMENTS ............................................. 140 

15 - GLOSSARY ..................................................................................................... 155 

1 
8. HOW TO USE THE CRITERIA 

Scope 2

Principles of assessment criteria 2

Structure of the assessment criteria 3

Use of the criteria 3

Request for further information 4

Serious deficiency and other deficiencies 6

Demonstration 7

’Suitable’ and ‘sufficient’ 8

Assessment of the demonstration of ALARP 8

Concluding an assessment 9

Revision plan 9

Intervention strategy 10

Human factors assessment 10

Figure 8.1 Links between schedule 4 and assessment criteria 11

Figure 8.2 - Information required in a safety report 13

Appendix 8.1 Requests for information – Examples 14

Appendix 8.2 – Main questions to be answered 17

Scope 

1 This section of the manual provides guidance on principles and the approach to 

using the assessment criteria. The assessment criteria are contained in subsequent 

parts of the manual and are used by assessors to examine safety reports, submitted 

under the COMAH regulations, to reach conclusions on the extent to which reports 

meet their purposes under the regulations. The conclusions are then used to inform 

the intervention strategy for the establishment and/or its installations. 

Principles of assessment criteria 

2 For the purposes of a safety report, Schedule 4 Part 1 paras (1) to (4) of the 

regulations identifies 4 elements that need to be demonstrated by the operator. The 

extent of the information required for each demonstration to be made depends on the 

type of safety report required by Regs. 7 or 8. 

3 The different report types that may be submitted for assessment include: 

• the initial report for each existing establishment, 

• pre-construction reports 

• pre-operation reports for new establishments, 

• modification and periodic updated reports for all establishments 

throughout their life. 

4 Assessment criteria provide a framework to promote consistent 

consideration of matters to be examined during assessment. The criteria do not 

constitute a mandatory process for assessment and assessors are not obligated to 

address every criterion, nor to the same depth of detail. Criteria are intended to be 

used with professional judgement and experience, based on their application to 

specific hazards and risk at establishments, and the demonstrations provided in 

reports. The aim is to achieve a consistent and proportionate approach to 

assessment within a framework. 

2 
5 The information required in a safety report, both for making the necessary

demonstrations and for action by the competent authority and local authority, is 

written in terms of goals to be achieved. In doing this, the operator should ensure the 

links to the required demonstrations are properly made and clear. The assessment 

criteria help assessors gather information and understand how goals might be 

achieved. 

6. The criteria are presented in Sections 9 to 14 of this manual. The links between 

the assessment criteria, the purposes in Schedule 4 Part 1of the regulations and the 

type of information required as a minimum by Schedule 4 Part 2 of the regulations 

can be seen in Figure 8.1. 

7. The criteria are necessarily quite general. This reflects the broad nature of the 

type of establishment which is covered by COMAH and the range of hazards to be 

encountered. The criteria apply when assessing information relating to all health, 

safety and environmental issues. 

8. A diagram showing the information required in a safety report can be seen at 

Figure 8.2. 

Structure of the assessment criteria 

9. The criteria are set out in 6 groups that are then divided into a number of 

“categories” as outlined in the following paragraphs. These “categories” are the main 

issues upon which the assessment team should come to a common view. 

10 The criteria in SRAM are the primary guidance for assessors. These criteria 

are supported by explanatory text. 

11 More detailed technical guidance supporting the topics covered by Sections 10, 

12 and 13 of SRAM exists on the relevant agency Website and/or Intranet. This 

guidance is subject to review and development as part of the CA’s corporate 

knowledge base to address technical issues and practices. 

12 Guidance to the criteria in SRAM appears in a 'tick list' style and should be 

interpreted as 'prompts' for an experienced assessor. The guidance is not a checklist 

for report writers and will not constrain assessors from considering or asking for other 

information if the circumstances dictate. 

Use of the criteria 

13 There are overlaps between a number of criteria in different chapters, but these 

reflect the fact that the same piece of information may be used to help more than one 

demonstration. However, where assessment by an assessor leads to areas that are 

likely to interface with another discipline assessor’s principal scope of assessment, 

assessors will, where appropriate, seek to reach an agreement at an early stage on 

who will lead on a topic or on issues arising. This is to avoid unnecessary duplication

of assessment. (Note: further guidance to technical discipline assessors is provided 

in Section 12 of the manual.) 

14. As a general guide on assessing COMAH safety reports, the following overview 

of the assessment process may be helpful to assessors in forming their overview of 

the demonstrations in the safety report. 

Assessors should be able to: 

3 
a) Gain a clear understanding of the processes, plant and environs of the 

establishment (or installation). 

b) Consider the hazards described, whether they are appropriate and 

representative of the activities carried out and the appropriateness of the

measures identified to control them, i.e. there should be clear links 

between the measures provided and the major accident scenarios 

identified. 

c) Focus on systems and outcomes that show how the operator has reduced

risks to ALARP and how they achieve continuous improvement in relation

to preventing and limiting major accidents. 

d) Consider the operator’s MAPP and SMS, and how it relates to the 

requirements of the COMAH regulations, taking into account the 

described adequacy and reliability of the measures when assessing 

whether the MAPP and SMS will work in practice. 

e) Immediately pursue and verify any measures that, on reading, are 

suspected of being seriously deficient. These deficiencies should be 

resolved independently of reaching assessment conclusions. 

15 Remember that the assessment of a safety report is not a discrete activity but 

leads to further action under the intervention plan for the operator at that 

establishment. 

16 The individual assessment criteria are used in detail to come to conclusions 

about the measures provided and whether the purposes required of a safety report 

under COMAH have been met. Assessors should record details of their assessments 

on the templates provided on CA internal computer systems. 

17 The effort put into the assessment should be sufficient solely for the CA to 

reach conclusions on the safety report, based on the questions in Appendix 8.2 

(Overall Purpose). 

Request for further information 

18 Assessment does not result in a pass or a failure for a safety report but the CA 

will ‘communicate’ its conclusions to the operator. 

19 Assessors may decide that there is insufficient information to conclude that the 

required purposes in Schedule 4 Part 1 of the regulations have been met. In making 

requests for further information, it is assumed that such information should already 

exist (or be rapidly produced) if the company has conducted the necessary work in 

preparing the demonstrations in the report. In this event, it is assumed that the 

operator can readily supply such information (typically within around 4 weeks, though 

longer may be agreed provided this does not impact upon the assessment schedule 

for completion). 

20 An assessor may suspect with good reason that essential information is 

missing because it is not available and requires extra work to develop it. However, 

the operator must be given the opportunity to provide the required information – it 

may be available, but just not included for whatever reason, or they may be able to 

4 
produce it quickly. It is for the operator to say that they cannot produce information 

when required, not for assessors to assume they cannot provide it when required. 

21 Information might be obtained in writing, or from a site visit, e.g. from interviews 

or from documents held on site by the operator, or other means that best achieve the 

required outcome in the time available. Information obtained following site visits, or 

other informal route should be formally requested or logged in writing with the 

company, via the Assessment Manager. This is because any further information 

which is obtained and contributes to the purposes of the report, such as the 

demonstrations to be made, will be kept with the safety report and placed on the 

Public Register (subject to the determination of an application for personal or 

commercial confidentiality, or because of national security). In all circumstances, 

assessors will be obtaining information to support or clarify the arguments in the 

safety report and not undertaking inspection to verify statements made. 

Additional information obtained by an assessor should be distributed to others in the 

assessment team. (For further guidance see also Procedures 5.1.) 

22 If, following a request, the operator is unable to produce the required 

information without conducting significant additional work, thereby resulting in a delay 

in supplying the information such that the assessment cannot be completed within 

the required assessment timescales, the assessment should be concluded as further 

outlined in ‘Concluding An Assessment’ below. 

23 Requested information SHOULD: 

a) be directed at reaching an assessment conclusion on the 

demonstrations in accordance with the requirements of the regulations. 

Requests for information SHOULD NOT be used to: 

a) ask the operator to undertake additional work (i.e. such as would extend 

response to more than 4 weeks). 

b) obtain information to resolve issues that would be regarded as 

inspection (i.e. verification of demonstrations). 

24 When making written requests for further information, assessors should ensure 

that: 

a) The issue under consideration is clearly explained, preferably with an 

outline of how the report fails to address the issue. Reference to the 

relevant assessment criteria to which the deficiency relates and to the 

relevant COMAH regulation(s) and/or schedule(s) should be made. 

b) There is a clear link to how the further information relates to meeting the 

required demonstrations, with reference to the regulations. 

c) The nature of the required information that is expected in order to resolve 

the issue(s) is indicated.

d) An indication of the importance of the information to the demonstration is 

given, i.e. necessary to make, or to clarify understanding of, the 

demonstration (medium/low); potential significant deficiency in the 

measures (major). 

5 
25 Assessors should avoid information requests that: 

a) ask open ended or vaguely worded questions. 

b) do not have a clear link to making a demonstration. 

Failure to clearly define the requirements for further information is likely to result 

in inadequate or wrong information being received. 

[Note: See Appendix 8.1 for examples relating to information requests.]

Serious deficiency and other deficiencies 

26 The report may describe measures that appear to be seriously deficient for 

preventing or controlling a major accident. The assessment team will form a view 

about these measures and will balance them against the likelihood of the related 

major accident hazards and their consequences when considering serious deficiency 

as applicable to Regulation 18. 

27 The CA has a duty to prohibit that part of the seriously deficient operation that 

could lead to a major accident. The CA will visit the site to check whether the 

measures signposted by the report are actually seriously deficient, before taking 

action under Regulation 18. 

28 It is only the measures provided by the operator that can be considered 

‘seriously deficient’ under COMAH and not the report itself. 

29 There is no legal precedent in health and safety legislation as to what serious 

deficiency might mean. The dictionary definition of ‘deficiency’ refers to ‘defect’, and 

‘a lack of completeness’. The assessment team must form the consensus

professional view that a major gap or defect exists in the measures provided, linked 

to prevention or limitation of a major accident, for serious deficiency to be

determined. 

30 Assessors should not consider a measure(s) to be seriously deficient just 

because it might be reasonably practicable to achieve higher standards of protection. 

This would be a matter that should be addressed during subsequent inspection. 

31 Deficiencies in individual measures may be found, some of which might be 

considered significant, but not ‘seriously deficient’ as described in the guidance to 

Regulation 18. Action to address measures that are considered to be deficient (but 

not ‘seriously deficient’) should form part of the intervention strategy for the 

establishment, prioritised on a risk basis. Consideration should normally be given to 

the totality of measures to prevent and limit major accidents before proceeding to the 

issue of prohibition notices under Regulation 18.

32 In the context of the safety report, the assessment team may consider that the 

depth of information contained is so low that a decision may be reached to return the 

safety report to the site operator for resubmission, tied to an agreed plan for 

resubmission: 

a) An omission of information leading to the return of a safety report would 

apply to significant or large-scale omission of information required to meet 

the demonstrations and not to smaller discrete omissions. 

6 
b) An example might include failure to provide sufficient information on the 

process used for identifying the listed major hazards. In this example, 

there might be a failure to describe who has identified the hazards, no 

description of the methods that were employed or how suitable methods 

were determined, and no information on how the identified hazards were 

developed into representative scenarios for further analysis. This 

omission would be a large gap in a significant area of the total risk 

assessment process and has strong implications for the assessment of 

later stages in the risk assessment cycle, including selection of measures. 

c) Failure to identify a possible major accident scenario may not by itself be

so deficient as to warrant return of the safety report as measures may 

exist that provide a level of protection that is not ‘seriously deficient’. 

Similarly, failure to describe risk assessment team competencies would 

not on its own be so deficient for return of the report if methodology for 

hazard identification and scenario selection and prioritisation were broadly 

described. 

d) There should be no action to prohibit an activity, following a substantial 

omission in the information in the report leading to the return of the report, 

unless a ‘serious deficiency’ in applied measures were also established at 

a site visit. 

Demonstration 

33 There are a number of demonstrations to be made. These are linked to the 

criteria as outlined in Figure 8.1. The report should demonstrate the link between the 

measures taken and the ‘major accident hazards’. Having examined the information 

in the report, the judgement about whether the report demonstrates that the 

necessary measures have been taken should be linked to the adequacy of the MAPP 

and SMS. 

34 For the purposes of a safety report required by COMAH, ‘demonstrate’ means 

‘show’, ‘justify’ or ‘argue the case’ by the information given. It is NOT taken to 

mean ‘pursue by extensive in-depth scrutiny’ or ‘exhaustive examination to prove 

beyond reasonable doubt’ whether the relevant criteria have been made and the 

demonstrations achieved. 

35 The safety report should:

a) Show the application of due process for identification and analysis of 

hazards that is sufficiently rigorous, systematic and proportionate to risk.

b) Show how all measures necessary have been identified and linked to 

specified major accident hazards, and implemented to reduce risks to 

ALARP. 

c) Justify why identified measures are not implemented by argument under 

ALARP principles (i.e. gross disproportion of effort or cost linked to risk 

benefit gained). ‘Argument’ can be made using qualitative or quantitative 

statements appropriate to the level of risk. 

d) Show that an on-site emergency plan is in place, based on sound 

principles and reflecting the major accident scenarios identified. 

7 
’Suitable’ and ‘sufficient’ 

36 The assessment criteria make references to information that is ‘suitable or 

‘sufficient’. For the purposes of assessment these terms are taken to mean: 

a) ‘Suitable’: Valid and appropriate for the operator's situation and 

circumstances as described in the safety report. 

b) ‘Sufficient’: Supporting information and arguments are well 

developed and presented, proportionate to the described level of risk 

based on the circumstances outlined in the safety report. 

Assessment of the demonstration of ALARP 

37 The guidance to Regulation 4 (General Duty) describes the application of all 

measures necessary to reduce risk of a major accident to ALARP based on a 

hierarchical approach (inherent safety, prevention, control, mitigation). The 

assessment process seeks evidence of the application of this principle to the 

identified major accident scenarios.

38 Important elements of the ALARP demonstration include: 

a) Identification of all major accidents and their probability of occurrence

using appropriate and proportionate systems of analysis. 

b) Assessment of the consequences (extent and severity) of identified 

major accident scenarios using appropriate and proportionate systems 

and methods of analysis. 

c) The linking of specified measures to specific major accident scenarios, 

not just a statement, in isolation, of measures that exist at the 

establishment. [Note: it is important that the safety report does not simply 

state what measures exist, but that it also demonstrates how the company 

has examined the link between identified scenarios and the identified 

measures that address those specific hazard scenarios. and the 

identification and implementation of further reasonably practicable 

measures to reduce risks to ALARP.] 

d) Identification of possible further measures that could be applied to lower 

the risk. [Note: it is important that the safety report demonstrates how the 

company has considered what else might be done in the context of further 

measures to address identified hazard scenarios. Hence, breadth and 

depth of assessment of reports also needs to focus proportionately 

towards ‘what more measures could be applied?’.] 

e) Justification for not implementing identified further measures, based on

gross disproportion between the benefit gained in reduced risk and the 

cost and effort required to implement the measures (reasonable 

practicability). 

39 Detailed guidance on the consideration of ALARP is provided on the HSE 

Website and HSE’s Intranet – see COMAH Home page. 

40 Conclusions on the demonstration of ALARP need to be reached by the 

assessment team at the end of the assessment process during the assessment 

8 
closeout meeting. It is unlikely that any one assessor will be in a position to form a 

complete opinion on the demonstration of ALARP in isolation without input from the 

rest of the team. 

Concluding an assessment 

41 Assessment of a safety report may be drawn to a conclusion, with issues 

arising from the assessment remaining unresolved at the time of conclusion. 

42 The assessment process is only a part of the COMAH regime and examines at 

face value the factual information and examines arguments and demonstrations 

contained in the report against the requirements of the regulations. Criteria are used 

as a framework for assessment. Conclusions on the adequacy of the report in 

meeting the purposes identified in the regulations are reached at the end of the 

assessment process. These conclusions are used by the CA to inform and prioritise 

further intervention with the company. 

43 The assessment conclusions reached by the assessment team need to clearly 

describe why a demonstration has not been met and refer to the relevant SRAM 

criteria to which the deficiency relates and to the relevant COMAH regulation or 

schedule. Appendix 8.2 lists the main questions to be asked to help the assessment 

team to reach conclusions. 

44 Assessors may make a request for further information during assessment, 

raised on the assumption that such information should be readily available. Upon 

receipt of this information, the assessor should decide whether concerns have been 

adequately addressed or if further intervention is needed. A conclusion should be 

reached at this stage. If information is not readily available upon request (e.g. 

requiring further work by the company), the assessment conclusions should be 

drawn on the basis of information supplied. 

45 Drawing assessment to an end at this stage with written conclusions sets a 

baseline for future intervention strategy for the site. This allows the work to be 

prioritised in context with any other work, not necessarily directly linked to the 

assessment process, that may need to be undertaken with the site. If the ‘further 

assurances’ sought by an assessor are simply about demonstration and do not have 

a likely outcome of further necessary measures, then this might be prioritised ‘low’ on

the risk scale. If however, further measures linked to preventing a major accident are

suspected to be a likely outcome, then it would be prioritised more highly, taking 

account of the scale of the consequence and risk. 

46 Concluding assessment in this way reduces possible interference with progress 

on potentially more important intervention activity concerning other possible high risk 

issues affecting the site. It allows the relative importance of outstanding assessment 

issues to be programmed into the overall site intervention plan dealing with all 

outstanding matters for the site, not just assessment. 

Revision plan 

47 Where the assessment team concludes that significant further information is 

required to make adequate demonstrations then a revision plan will be required. The

output from the plan is a revised safety report in which the demonstrations are made, 

or the assessors are satisfied that they have sufficient information to decide whether 

there are serious deficiencies, or the assessors are content that there are no longer 

significant shortfalls in the demonstrations made in the safety report. Measures that 

9 
are found to be deficient at this stage will be included in the intervention plan for the 

establishment. 

48 The revision plan should specify the information required, the reasons why 

(e.g. In support of what demonstration and why it is thought lacking) and when the 

information is required by. The time for producing the required information will 

depend on the significance of the matters, any representations that the operator 

makes and the resources available to the CA in its assessment and intervention 

programme. The information can be supplied as revised pages of the report or in a 

separate letter. All required information received will form part of the safety report. 

Intervention strategy

49 As an outcome of the conclusions of the assessment process the assessment 

team may make recommendations for inclusion in the intervention strategy for the 

establishment. Recommendations should identify topics for inspection or other 

intervention, estimate resources and indicate when such intervention should take 

place (prioritisation) over the following 5 year period until the next periodic 

resubmission of the safety report. 

Human factors assessment 

50 The consideration of human factors potentially affects all disciplines. The 

criteria in Section 10, 11 and Section 12 of SRAM include outline guidance on areas 

where human factors may be an issue relevant to specific disciplines. Additionally, 

guidance on human factors is covered in a stand-alone Appendix 4 in Section 12 in 

respect of technical measures and is available for use by all assessors during 

assessment. 

51 Not all safety reports will necessarily receive a dedicated assessment by a 

Human Factors specialist assessor (to be agreed when setting the target assessment

agenda). This is because the most effective assessment of human factors issues is 

often achieved by direct contact with the site as part of the intervention strategy. It 

will also depend upon the nature and depth of human involvement in safety critical 

functions at the establishment or site. 

52 Assessors of all disciplines should therefore take account of human factors as 

it affects their discipline, using the guidance provided. This approach does not 

prevent assessors seeking the specialist support of the Human Factors team during 

assessment if deemed appropriate. 

10 
Figure 8.1 Links between schedule 4 and assessment criteria 

The figure below shows the links between the relevant Schedules of the COMAH 

Regulations in terms of the purposes contained in Schedule 4, Part 1 and the 

information required by Schedule 4, Part 2 and the primary blocks of assessment 

criteria. Paragraph numbers in column 1 (Purpose) and column 3 (Information 

required) relate to paragraph numbers in the respective parts of Schedule 4. 

PURPOSE (Sch4 Pt 1) ASSESSMENT CRITERIA INFORMATION 

REQUIRED (Sch4 Pt 2) 

Para1. Demonstrate 

MAPP and SMS put into

effect. MANAGEMENT OF RISK 

Description of MAPP and 

SMS in place (Sch 2). 

Para1. Information on 

management system and 

organisation re major 

accident prevention. 

Provide knowledge to help 

CA with each of the 

demonstrations. 

Basic understanding 

Para 4. Supplying 

information to enable offsite emergency plan 

to be drawn up. 

Para 5. Provide 

sufficient information to 

CA for land use planning

purposes. 

DESCRIPTION AND 

OTHER INFORMATION

Para 2. Presentation of

'environment' of 

establishment (2a, b, c).

Para3. Description of

installation (3a, b, c(i), (ii), 

(iii)). 

Para 2. (1st part). 

Demonstrate major 

accident hazards 

identified. MAJOR ACCIDENT 

SCENARIOS 

Para 4a. Probability or

conditions under which 

they occur. Summary of

initiating event for each.

 

Para 4b. Consequence

assessment - severity and 

extent. 

11 
PURPOSE (Sch4 Pt 1) ASSESSMENT CRITERIA INFORMATION 

REQUIRED (Sch4 Pt 2) 

Para 2. (2nd part). 

Demonstrate necessary

measures taken to prevent 

major accidents. 

Para 3. Demonstrate 

adequate safety and 

reliability incorporated into: 

(a) design and 

construction

(b) operation and 

maintenance. 

PREVENTION OF 

MAJOR ACCIDENTS 

Para 4c. Technical 

parameters and 

equipment used for safety

of installation. 

Para 5a. Equipment 

installed to limit 

consequences. 

Para 2. Demonstrate 

necessary measures 

taken to limit 

consequences of major 

accident (2nd part). 

 

Para 3. Demonstrate 

adequate safety and 

reliability incorporated into: 

(a) design and 

construction

(b) operation and 

maintenance. 

Para 4. Demonstrate onsite emergency plans 

drawn up. 

LIMIT CONSEQUENCES 

OF MAJOR ACCIDENTS 

Para 5b. Organisation of

alert and intervention. 

 

Para 5c. Mobilisable 

resources (internal and 

external). 

 

Para 5d. Summary of 

5(a), (b) and (c) for 

drawing up on-site plan.

12 
Figure 8.2 - Information required in a safety report 

Sufficient information 

All necessary measures 

to prevent MAs and limit 

consequences (Reg.4)

MAKE

DEMONSTRATIONS 

(Sch.4 Pt.1)

Identify MAHs Take 

necessary 

measures 

Emergency 

Plan 

Provide information for 

others to use 

(Sch.4 Pt.2)

Domino 

Effects 

Siting new 

activities 

Offsite 

emergency 

Quantities 

Properties 

Dangerous 

Substances

Environment 

of site 

Adequate 

safety & 

reliability 

MAPP & SMS

put into effect 

Establishment 

Processes 

13 
Appendix 8.1 Requests for information – Examples 

This appendix provides examples of requests for information (RFIs) that assessors of 

safety reports may make to operators during the assessment process. The 

expectation is that information requested should normally be available and therefore 

can be readily supplied by operators in support of their demonstrations. 

Where possible, RFIs should be clearly stated, linked to the requirements of the 

regulations and should state or imply the nature of required information that is 

needed to resolve the issue being raised. 

Example 1 

The following is an example of an RFI request based on one that was made to, and 

on the response received from, an Operator. Comments on how the aims of 

information requests are met are included as comments within brackets. 

Issue raised to Operator

’Pt 1, Management of Health & Safety, Section 3 , para7 in the safety report – 

Isolation Procedures: It is stated in the safety report that any isolation not meeting 

minimum recommended isolation standards must be risk assessed before the 

isolation is approved. The dutyholder is requested to clarify what practical steps and

responsibilities are described in the isolation procedures (or related documents) to 

initiate a feasibility review to upgrade isolation provisions for future interventions. 

Continued (i.e. repeated) interventions using less than minimum standards of 

isolation, albeit supported by a Level 2 risk assessment (as defined in the

procedures), is not an acceptable longer term strategy for isolation, without 

reasonably practicable measures being taken to achieve minimum (or better) 

recommended standards to meet foreseeable future requirements (i.e. reduce the 

risk to ALARP of a major accident due to loss of containment during maintenance) 

[Basis: Reg. 4; Sch. 4 Pt2 (1); SRAM Criterion 12.2.5.1. Importance ‘Medium’.].’ 

[Comment: The above example describes the assessor’s concerns by explaining in 

the 2nd paragraph what the issue is, viz. that if there is a deficiency in isolation 

arrangements, it is not sufficient simply to repeatedly exercise a fall back isolation

assessment procedure to justify a substandard isolation every time the maintenance 

procedure needs to be carried out. It may be justified to adopt ‘exceptional’ 

arrangements the first time. However, once the deficiency has been identified, there

should be follow up steps taken to improve the (isolation) arrangements for the future

if reasonably practicable (i.e. the ALARP principle to take reasonably practicable 

measures to prevent major accidents). This could be planned at a suitable plant 

shutdown opportunity. 

The first paragraph clearly states what information is sought in the SMS to address 

this concern. Details should be readily available and can be supplied, either as a 

statement in a letter from the Operator with reference to existing procedures, or the 

entire procedure could be provided. The basis of the request within the regulations 

and SRAM and an indication of the importance of the issue to the demonstration is 

stated.] 

14 
Operator’s Submitted Response 

A letter from the Operator explained: 

’The Safe Isolation and Reinstatement of Plant Procedure (para 2.1) states: ‘Any 

isolation which does not meet the minimum recommended isolation standard ....... 

must be assessed using the Level 2 Risk Assessment...... Should any noncompliant isolation have to be repeatedly justified by risk assessment, consideration 

shall be given to a permanently engineered solution.’ 

[Comment: This short response broadly meets the concerns expressed in the 

assessor’s request for further information, with the exception that there is no clear 

definition that consideration of permanent solutions should be triggered following first 

non-compliance and where similar future intervention can be anticipated. The 

assessment of this issue can be drawn to a close at this point as there is no evidence 

to suggest a serious deficiency. 

The text taken from the isolation procedures could be read to imply that several nonconforming isolations could be applied before action is taken to review potential 

design modification to upgrade the isolation to at least meet minimum required 

standards. (Risk Assessment could be repeatedly implemented to justify authorising 

the substandard isolation. This increases the risk of a failure leading to loss of 

containment if the risk assessment is not fully effective on every occasion – a human 

factors issue that can be readily remedied by strengthening the procedure to assign a 

clear responsibility on the isolating authority.)] 

Assessment Conclusion 

An assessment conclusion that can be drawn from the above is a recommendation 

for improvement to the isolation procedures to place a responsibility on the 

appropriate isolation authority to initiate a design / modification review whenever a 

non-conforming isolation is first presented for their authorisation. Action at this point 

should be taken to assure risks are reduced to ALARP at the earliest opportunity. 

The implementation of this is a detail that can be noted for further examination as 

post assessment intervention activity (inspection). 

Example 2 

An assessor raised the following issues (shown in italics) following initial assessment

of a safety report: 

‘Criterion 3.5.5 

The worst case accident is stated to be a delayed ignition fireball following a 

catastrophic failure of an aniline reactor. It appears that the fireball calculations are 

based on a quantity of 2 x flash fraction in the fireball, although the quantity is not 

explicitly stated. 

 

Please provide your evidence to support a “limited local flash immediately” following 

a reactor failure and the assumption of 2 x flash fraction (i.e. 34% at relief conditions) 

in the delayed ignition fireball. The information in CRR 277/2000, Review of 

RELEASE rainout model and the CCPS data (hse.gov.uk/research/crr 

pdf/2000/CRR00277.pdf) and particularly the De Vaull and King correlation, suggests 

that all the aniline, rather than only 34%, could remain airborne 

15 
[Basis: Sch.4 Pt 2(4b); SRAM Criterion 10.5. Importance – clarification issue - 

‘Medium'.]‘ 

[Comment: The assessor’s references disagree with the work done by the company 

and the request is looking to see what information they have to back up their 

assumptions. This could reasonably be put to the company as a further information 

request. The company should not need to conduct further work to explain its 

assumptions used in the assessment of this event. The basis of the request within 

the regulations and SRAM and an indication of the importance of the issue to the 

demonstration is stated.] 

The assessor went on to request: 

‘Please consider the effect on the fireball and toxic gas cloud calculations in the 

report of assuming that all the aniline remains airborne. What would be the impact 

on the hazard/risk ranges and numbers of people affected? ‘ 

[Comment: the assessor wants to get an idea of the significance of what he/she 

feels is an error in the report. However this is actually asking the company to do 

some more work and this doesn't fit in with the aim of a further info request (readily 

available information). The reality is that the company only need to do this work if 

they can't back up their assumption of 34% airborne aniline. Therefore there should 

be no RFI at this stage, as presented. If the company can justify the assumption, the 

matter drops. If not, then the assessment of this issue concludes on the basis that 

there is a flawed assumption and that further work needs to be done via a revision 

plan to accompany the assessment team’s conclusions letter. The assessment 

conclusion are made and are not delayed while the assessor waits for the company 

to do further consequence assessment work]. 

A further request from the assessor was: 

‘Criterion 3.5.5 

The distance to LFL is used in the report for assessing flammable gas dispersion. In 

order to take account of pockets of gas being above the centreline or average 

concentration and modelling uncertainty, the hazard range can be taken to be 

0.5LFL. Please discuss your choice of LFL, and comment on whether a 0.5LFL 

criterion would have any significant impact on the assessed risks.’ 

[Comment: The assessor wants to get an idea of the significance of the change from

LFL (Lower Flammable Limit) to 0.5LFL, before deciding how far to pursue the issue. 

However, this may appear as something of an information fishing exercise, and may 

be seen as a request for further work rather than a request for readily available 

information. If the assessor can accept LFL, then this is fine. If not the assessment 

team may conclude that a possible error is made and again reach conclusions on this 

basis and recommend that further work should be done linked to a revision plan.] 

16 
Appendix 8.2 – Main questions to be answered 

The following questions should be considered, where relevant to the scope of the 

safety report and the assessment target agenda, by the assessment team when 

reaching their conclusions from the assessment of safety reports. Normally, for 

reports where assessment of all topics is required, all questions should be 

considered prior to completion of the Team Assessment Conclusions Record in 

Appendix 4.5. For reports where only a selective scope of assessment is undertaken, 

it is possible that not all questions are relevant (e.g. a revision report where only 

management changes have been made, and there are no material technical changes 

affecting major accident scenarios or technical measures, may not require 

assessment by all disciplines). 

MAIN QUESTIONS TO BE CONSIDERED BY ASSESSMENT TEAM 

Q8.1 Does the report contain: 

(a) sufficient information for the purposes of Schedule 4 Part 1; 

(b) at least the information required by Schedule 4 Part 2? 

Q8.2 Is there: 

(a) a major accident prevention policy (MAPP) and 

(b) a safety management system (SMS) for implementing it? 

Q8.3 Does the report demonstrate that: 

(a) the MAPP and 

(b) the SMS have been put into effect, 

in accordance with the information set out in Schedule 2? 

Q8.4 Does the report demonstrate that the major accident hazards have been 

identified? 

Q8.5 Does the report demonstrate that the necessary measures have been taken to 

prevent and limit the consequences of major accidents? 

Q8.6 Does the safety report demonstrate that a systematic and sufficiently 

comprehensive approach to the identification of risk reduction measures has taken 

place? 

Q8.7 In coming to conclusions on the measures necessary: 

(a) are there any assumptions, 

(b) are these clear, and

(c) are the conclusions valid, 

taking into account any uncertainties in the data provided? 

Q8.8 Are conclusions drawn from the risk analysis with respect to emergency 

planning soundly based? 

Q8.9 Does the report demonstrate that adequate safety & reliability have been

incorporated into: 

(a) the design, 

(b) construction, 

(c) operation, 

(d) maintenance, 

linked to the major accident hazards in the establishment? 

17 
MAIN QUESTIONS TO BE CONSIDERED BY ASSESSMENT TEAM 

Q8.10 Do the findings and conclusions in the safety report show that the measures 

adopted to prevent and mitigate major accidents make the risks from a major 

accident ALARP? 

[If the answer is NO, then at least one of the questions in Q8.4 to Q8.9 will also be 

answer NO].

Q8.11 Does the report demonstrate that an internal emergency plan has been 

drawn up? 

Q8.12 Does the information supplied enable the local emergency planners to draw 

up an off-site emergency plan which will take the necessary measures in the event of 

a major accident? 

Q8.13 Is there evidence that there is a serious deficiency in the measures taken to 

prevent, limit and mitigate a major accident? 

Q8.14 Does the report provide sufficient information to the competent authority (CA) 

to enable decisions to be made in terms of siting of new activities and developments 

around existing establishments? 

Q8.15 Does the report give sufficient information to enable the CA to identify 

establishments or groups of establishments where the likelihood or consequences of

a major accident may be increased by their proximity because of the "domino effect? 

18 
9. DESCRIPTIVE ASPECTS 

Introduction 19

Scope 19

General guidance for assessment of the descriptive elements 19

Pre-construction and pre-operation safety reports 19

Appendix 9.1 - Descriptive assessment criteria and guidance 20

Introduction 

Scope 

1 This guidance is for assessors concerned with the description of the 

establishment; the dangerous substances and activities on it, and the environment 

surrounding it. This descriptive information provided by the operator plays an 

essential part in achieving the purposes of a safety report. 

Relevant Requirements of the COMAH Regulations 

2 The descriptive information covered by this set of criteria is needed to satisfy 

the demonstration of safety required by Schedule 4 Part 1. 

The minimum information required is given in Schedule 4 Part 2, para 2 

“Presentation of the environment of the establishment” and para 3 “Description of the 

installation”.

General guidance for assessment of the descriptive elements 

3 It is possible that the description of the installation, the demonstration of safety 

and the major accident scenarios are not presented separately. The operator may 

decide to amalgamate information relating to the installation description and the 

demonstration of safety to better make the case, or aid the logical flow of the safety 

report. In this situation, assessment against this criterion would need to be done in 

conjunction with any other criteria that apply. 

4 Some of the information required to assess the impact on the natural 

environment may already have been prepared for environmental impact assessment

or other authorisation procedures. It is permissible for the operator to refer to this 

information. However, assessment is made easier and more efficient if it is submitted 

as part of the COMAH safety report, rather than by reference to authorisations sent 

separately to the Agencies. 

Pre-construction and pre-operation safety reports 

5 Pre-Construction Safety Reports (PCSRs) and Pre-Operation Safety Reports 

(POSRs) should normally be able to provide details on all criteria in this section, 

though some revision may be required in POSRs to reflect design development since 

the PCSR. 

6 Descriptions of the environment and surrounding populations should reflect 

expected conditions once the site becomes operational. Where commencement of 

operations is phased, reports should describe circumstances (including temporary 

arrangements such as use of temporary offices and buildings, inclusion of

construction contractor populations, etc.) as they apply to each phase. 

7 Overview descriptions of the establishment, particularly where relevant to major 

accident hazards, emergency response, monitoring etc. should be described as far 

19 
as information is available at the time of submission of the report. Significant gaps in 

required information should be justified. Principles and design philosophies which 

will govern the eventual choice of equipment should be stated where detailed final 

arrangements are not known. 

Appendix 9.1 - Descriptive assessment criteria and guidance 

Descriptive Criteria Guidance 

General 

Criterion 9.1 

The safety report should 

give details to allow

communication with the 

competent authority

The safety report should include, as a minimum:

• the name of the operator; 

• if the operator is a company, the address of the 

registered office; 

• if the operator is a trading partnership, the names 

and addresses of all trading partners, together 

with the name and address under which the 

partnership operates; 

• the name and address of the establishment and if 

necessary the installation covered by the report; 

• the name(s), address, telephone & fax number 

and e mail address for contact(s) within the 

operator's organisation for communication about

the report. 

Dangerous Substances 

Criterion 9.2 

The safety report should 

identify the maximum 

quantities of every

dangerous substance 

present, or potentially

present, on the 

establishment 

[Schedule 4 Part 2, Para 

3 (c) (i)]

Dangerous substances are those which are either, 

• listed in Schedule 1 Part 2 of the Regulations, or 

• meet the criteria laid down in Schedule 1 Part 3. 

Those to be identified are: 

• all dangerous substances at or above lower tier 

and upper tier threshold quantities; 

• other dangerous substances below these 

quantities, if they are capable directly or indirectly 

of being involved in a major accident; 

Sources of the materials include: 

• raw materials, intermediates, finished products, 

by products and wastes;

• substances produced during process excursions,

or other unplanned but foreseeable events; 

• any other dangerous substances which may be 

anticipated to be present on the establishment 

(including substances present on road and rail 

vehicles). 

The following principles should be considered: 

• where certain dangerous substances have not 

been included in the inventory, the reason for 

20 
Descriptive Criteria Guidance 

their omission should be provided; 

• where an establishment has a large number of 

different dangerous substances present, it may 

be necessary to group them into representative 

categories (in line with Schedule 1 Part 3), for the 

purpose of quantification. In such cases the 

safety report should explain and justify the basis 

for the groupings chosen; 

• the maximum inventories calculated should take 

into account fluctuations in business activity and 

the established quantity under the Planning 

(Hazardous Substances) Regulations 1992,1

 as 

updated by the Town and Country Planning, 

England and Wales - The Planning (Control of 

Major Accident Hazards) Regulations 1999. 

There may be other legal authorisations which 

refer to quantities (e.g. IPPC or IPC); 

• where a number of different dangerous 

substances are present on an establishment at 

less than their qualifying quantity, the safety 

report should show how individual quantities have 

been aggregated. 

• to allow the assessors to establish if all 

substances arising from foreseeable excursions 

have been identified, then operators are advised

to give details of measures taken to identify such

substances.

Criterion 9.3 

For each dangerous 

substance identified, the 

safety report should 

describe its chemical 

name (including common 

use chemical name) and 

CAS number, according 

to IUPAC nomenclature 

[Schedule 4 Part 2 

para 3 (c) (iii)] 

The safety report should include, for each dangerous 

substance or class of dangerous substances (including 

those present as impurities or additives or constituents 

of preparations): 

• its chemical name (for example, propane, butane) 

and where appropriate, its common chemical 

name (for example, LPG); 

• identification of the substance (for example, 

chlorine) or class of substances (for example poly 

chloro-di-benz dioxines), according to the IUPAC 

system of nomenclature; 

• the CAS number for the substance or class 

of substances; 

• the concentration of any impurity or additive and 

proportion of each constituent in a preparation. 

The safety report should also provide any additional 

information useful to help identify the dangerous 

substance. For explosives, including stored process 

intermediates, the following additional information will 

 1

 Name of Scottish equivalent is the Town & Country Planning (Hazardous Substances)(Scotland) Regs

93 

21 
Descriptive Criteria Guidance 

normally be required: 

• the name and description corresponding to the 

UN Number assigned to the explosive on 

classification under the Classification and 

Labelling of Explosives Regulations 1983, where 

applicable; 

• which definition of an explosive in Part 3 of 

Schedule 1 to COMAH it falls within;

• its behaviour on accidental initiation described in

terms of Hazard Type as used in licences issued

by the Health and Safety Executive under the 

Explosives Act 1875. 

Criterion 9.4 

The safety report should 

describe the physical 

and chemical behaviour 

of each dangerous 

substance identified, 

relevant to normal 

operating conditions and 

foreseeable accident 

conditions 

[Schedule 4 part 2 para 3 

(c) (ii)] 

This may include, for example; flash points (by an 

identified method), ignition temperatures, flammable 

limits, vapour pressure, density, boiling point, data on 

reactions, rates of decomposition, and data on 

sensitiveness of explosives. 

The following principles should be considered: 

• only those physical and chemical properties 

relevant to the various demonstrations of safety 

contained in the safety report need to be 

presented; 

• information presented in the safety report should

be sufficient to describe the behaviour of the 

dangerous substances under all normal operating 

conditions, process upset conditions and 

foreseeable accident conditions. 

Criterion 9.5 

The safety report should 

describe the immediate 

and delayed harm to man 

and the environment for 

each dangerous 

substance identified 

[Schedule 4 part 2 

para 3 (c) (ii)]

The information presented should include the physical, 

chemical or toxicological characteristics of the 

dangerous substances that may cause harm and an 

indication of the hazards posed. The information 

presented should address both the short and long term 

effects and may include for example:

• health hazards such as irritation, asphyxiation, 

cancer or genetic damage; 

• lethal concentrations; 

• harm caused by fire or explosion; 

• effects on the environment, including building 

damage, the ecosystem and relevant sensitive 

species. 

• outlines of the routes to harm, (e.g. via airborne 

discharge, seepage into groundwater, formation 

of an explosive cloud, or accidental initiation of 

explosives giving rise to blast); 

• characteristics such as bio-accumulation, 

22 
Descriptive Criteria Guidance 

persistence, dispersal mechanisms and known 

antagonistic or synergistic effects. 

The following principles should be considered: 

• the information presented should consider 

acknowledged acceptable limits, in terms of 

concentration, distance from source, time of 

exposure, or any other relevant parameters; 

• references to scientific literature to justify the 

harmful effects, hazardous concentrations and 

acceptable limits are expected; 

• where information is not known, assessors 

should expect operators to evaluate the 

significance of that lack of knowledge and 

describe their policy for dealing with it. 

Environment 

Criterion 9.6 

The safety report should 

describe the 

environment of the 

establishment in 

sufficient detail to allow

the consequences of a 

major accident to be 

assessed 

[Schedule 4 part 2 

para 2 (a)]

The information to be provided fits into a number of 

categories as follows: 

General information is expected to include a map to a 

suitable scale (usually at least 1:10,000) showing the 

establishment and its surroundings. On such maps the 

land use pattern (ie industry, agriculture, urban 

settlements, environmentally sensitive locations etc) 

and the location of the most important buildings and 

infrastructures (i.e. hospitals, schools, other industrial 

sites, motorway and railway networks, stations and 

marshalling yards, airports, harbours etc) should be 

clearly indicated. Also on the maps, access routes to 

the establishment should be clearly indicated as well as 

the escape routes from the establishment and other 

traffic routes significant for rescue and emergency 

operations. 

Separate maps may be required to identify the 

surrounding population and the surrounding natural 

environment. It may be necessary to have different 

scale maps when the operator mentions long distance 

effects. 

Information on the surrounding population, is 

expected to include: 

• approximate numbers of residents; 

• estimated numbers of people who may use the

area (for example: present at workplaces, present 

as tourists, or to attend football matches or 

motorway services); and 

• groups of people who may be particularly 

vulnerable either on account of their sensitivity to

the hazards in question (e.g. schools and 

hospitals) or because of the population density. 

23 
Descriptive Criteria Guidance 

Consideration should also be given to allow 

assessment of the indirect impact of a major accident 

on the public. For example, as a result of contamination 

of drinking water. 

Information on the surrounding environment should 

that may influence the impact of a major accident. 

Examples may include: 

• the topography if it could have an effect on the 

dispersion of toxic or flammable gases or 

combustion products, (this should include 

buildings, underground workings or other 

structures where appropriate, e.g. a pedestrian 

subway); 

• historical local weather records, including: wind 

speed; wind direction; atmospheric stability and 

rainfall. The relevance of this information to the 

behaviour of releases of dangerous substances 

should be described; 

• a description of the underlying and surrounding 

geology and hydrogeology if it is appropriate to 

the consideration of a major accident; 

• a description of the surrounding water courses 

(under various flow conditions), underlying 

aquifers and any drinking water extraction points 

should be given in relation to the dispersion of 

liquid contaminants or leachate from solids 

deposited on the surrounding land; 

• description of surrounding water and land quality; 

• information on sewerage and rainwater systems if 

they could be involved in the dispersal of liquid

contaminants off-site; 

• information on tides and currents that might 

influence dispersion or accumulation if marine or 

estuarine habitats are at risk; 

• a description of features of the surroundings that

may hinder emergency response or mitigation 

measures. 

Information on the built environment is expected to 

include: 

• each listed building and monument;

• any sections of the infrastructure, such as major 

transport routes or utilities (e.g. electricity, gas, 

telephone, water sewers and treatment plant); 

that may be vulnerable to the effects of a major 

accident. 

Information on the natural environment is expected to 

include a description sufficiently detailed to allow the 

24 
Descriptive Criteria Guidance 

significance of the impact of major accidents to be

assessed. This should include details of any: 

• Sites of Special Scientific Interest (SSSI); 

whether they are Special areas of Conservation 

(SAC) or Special Protection Areas (SPA); or 

Ramsar sites; 

• marine nature reserves; 

• marine sensitive areas, under English Nature's 

marine strategy; 

• and the significance of these features in either a 

national or international context should be 

explained, for example the flora or fauna 

particularly at risk. 

Criterion 9.7 

The safety report should 

describe the 

environment of the 

establishment in 

sufficient detail to allow

the contribution of 

external factors to major 

accidents at the 

establishment to be 

assessed 

[Schedule 4 part 2 para 

2]

• The information itself is a requirement under 

Schedule 4 part 2 para 2 of the Regulations, and 

is an essential precursor to assessment of the 

major accident scenarios, provided under 

Schedule 4 part 2 para 4 (a) of the Regulations.

• The contribution of the external factor to the 

major accident could be as an initiating or 

exacerbating event. Factors for consideration 

under this criteria include: 

• the physical environment surrounding the 

establishment may have an effect on certain 

initiating events. For example, the underlying 

geology should be described to allow the 

consideration of seismic events and subsidence 

as accident initiators; 

• the history of the land on which the establishment 

is located, together with its surroundings, may be 

significant to the consideration of major accident 

initiating events. For example, history of mining, 

other mineral extraction activities or land 

reclamation, may lead to subsidence; previous 

land use, may be important in respect of 

contaminated land or water; 

• historical evidence of other external events that 

might act as accident initiators such as: seismic 

events; flooding; and extreme weather conditions 

including: temperature; rain; snow; wind; and 

lightning; 

• other major hazard installations and pipelines in 

the area capable of initiating or influencing a 

major accident; 

• current land use under the establishment, 

including current mining or mineral extraction 

25 
Descriptive Criteria Guidance 

activities; 

• air traffic movements over and around the 

establishment, including civilian and military, fixed 

wing and helicopters; 

• transport activities that may have an impact 

including shipping, major transport routes and 

dangerous substance movements; and 

• other human activities that might lead to major 

accidents such as arson, vandalism, theft, and 

criminal damage; 

• high voltage overhead electric power distribution 

lines; 

• radio transmission masts in the area that produce 

fields which could interfere with safety control 

systems or communication systems, or initiate 

electro explosive devices. 

• Establishment 

Criterion 9.8 

The safety report should 

identify installations and 

other activities of the 

establishment that are 

relevant to major 

accident hazards 

[Schedule 4 part 2 

para 4(b)]

• This information is expected to include 

identification of: 

• main storage facilities; 

• process installations; 

• location of relevant substances and their 

quantities; 

• relevant equipment (including vessels and pipes);

• utilities and services; 

• means of access and egress; 

• control rooms, offices and other occupied 

buildings which could be vulnerable in a major 

accident. 

26 
Descriptive Criteria Guidance 

Criterion 9.9 

The safety report should 

describe the process(es)

being carried out within 

every installation which 

could give rise to a major 

accident 

[Schedule 4 part 2 para 3 

(b)] 

The Safety Report should include descriptions of: 

• the purpose of the installation; 

• the conditions under which the dangerous 

substance is normally held; 

• what happens to the dangerous substance in 

terms of physical and chemical changes arising

from the designed purpose of the plant; 

• what happens to the dangerous substance in 

terms of physical and chemical changes arising

from foreseeable deviations from the designed 

purpose of the plant; 

• the discharge, retention, re-use and recycling or 

disposal of residues and waste liquids and solids,

or the discharge and treatment of waste gases.

Criterion 9.10 

The safety report should 

describe the area on 

each installation where a 

major accident scenario 

could happen 

[Schedule 4 part 2 

para 2(c)] 

The Safety Report should clearly identify plant and 

activities where a major accident could happen. It 

should: 

• include a plant diagram which unambiguously 

identifies key control systems, reaction vessels, 

storage vessels, pipework systems, valves and 

significant connections;

• contains a plan which unambiguously identifies 

the location of activities where a major accident

could happen (e.g. storage in packages, 

processing of explosives). 

Criterion 9.11 

The safety report should 

provide focused 

information about each 

installation, in sufficient 

detail to support the 

demonstration that major 

accident hazards will be

prevented or the effects 

mitigated 

[Schedule 4 part 2 

para 3 (a)]

The purpose of the focused information is to provide 

enough detail for assessors to understand the 

operator's demonstration of safety. Therefore, safety 

reports should provide descriptive information pertinent 

to the demonstration being made, and at a level of 

detail so that assessors can understand the arguments 

presented. 

The safety report should contain plan(s) or map(s) or 

diagram(s) plus descriptions, which clearly set out 

information about the installations with major accident 

potential. The description should allow determination of 

the purpose, location and function of equipment within 

the installation that has a bearing on major accident 

prevention and control. In particular, information about 

items of plant such as: 

• vessels (e.g. location, type, size, pressure, 

purpose, contents); 

• pipework systems (e.g. routes, types, size, 

pressure, purpose); 

• services (e.g. steam, air, electricity, fuel, 

27 
Descriptive Criteria Guidance 

hot water); 

• drainage (e.g. routes, purpose [e.g. foul water, 

fire fighting run-off water]); 

• stacks, flares and gas cleaners (e.g. location, 

purpose); 

• safety (or environment) critical valves, 

instruments, control loops and detection systems; 

• fire fighting and supply arrangements; 

• monitoring equipment, e.g. for toxic products in 

air, sewers, discharges to water; for fires or 

explosive atmospheres; 

• incorporators, rolling mills, manual and power 

presses, sieves, granulators, mixers. 

Safety reports should also include information about:

• the normal operating parameters of plant; 

• the designed maximum working capacities, 

temperatures, and pressures and maximum 

explosive inventories; 

• relevant qualitative and quantitative information 

on energy and mass transport in the process (i.e. 

material and energy balances) in: 

♦ normal running 

♦ start up or shut down periods 

♦ abnormal operations; 

♦ dangerous substance locations, and (at each 

location) an indication of the chemical and 

physical state and quantity of the dangerous 

substance. 

Criterion 9.12 

For sites that are part of 

a domino group, 

designated by the 

competent authority, the 

safety report should 

confirm whether there 

has been information 

exchange between the 

operator and other 

operators in the domino 

group 

[Regulation 16(3)] 

NB it is the duty of the CA designate and notify 

operators in domino groups.

• Where this duty applies, then the operator would 

be expected to include information on; 

• What information they have exchanged and to 

which other COMAH establishment operators; 

• What information they have received and what 

conclusions they have come to including whether 

they had to amend their MAPP, have or will have 

to amend the safety report and whether changes 

are required to the on site emergency plan. 

Criterion 9.13 

The safety report should 

include the names of any

relevant organisations 

Paragraph 6 of schedule 4 part 2 was added by 

regulation 17(3) of the COMAH Regulations 1999 (As 

Amended). 

28 
Descriptive Criteria Guidance 

involved in drawing up

the report 

[Schedule 4 part 2 para 

6] 

Simple clarification of the names of those organisations 

involved is all that is required to meet this criterion. 

Confirmation of where no other organisations were 

involved is required to explain to the CA any absence 

of information. 

29 
10 Predictive aspects

Introduction 30

Scope 30

Relevant requirements of the COMAH Regulations 30

General guidance for the assessment of the predictive aspects 30

All measures necessary 30

Risk assessment 31

Proportionality 33

Fitness for purpose 33

Early predictive assessment 34

Appendix 10.1 Predictive assessment criteria and guidance 35

Appendix 10.2 Predictive aspects - key information requirements 47

Introduction 

Scope 

1 This guidance is for assessors completing the predictive assessment and is 

relevant to all types of safety report. The criteria assess the fitness-for-purpose of 

the site operator's major accident risk assessment. The risk assessment may be 

qualitative, semi-quantitative, quantitative, or a combination of these. Operators will 

need to decide the scope and nature of their risk assessment so that it is fit-forpurpose in relation to their site-specific circumstances and the demonstration 

required. 

Relevant requirements of the COMAH Regulations 

2 The need for the operator to assess the risks stems from the requirement in 

Schedule 4, Part 1 paragraph 2 of the COMAH Regulations for the safety report to 

demonstrate that "major accident hazards have been identified and that the 

necessary measures have been taken to prevent such accidents and to limit their 

consequences for persons and the environment".

3 The criteria in this section assess whether the operator's risk assessment is 

both suitable and sufficient for the purposes of Schedule 4, Part 1 paragraph 2, and 

Part 2, paragraph 4, 'Identification and accidental risk analysis and prevention 

methods', particularly those under paragraphs 4(a) - accident scenarios, likelihoods 

etc; and 4(b) - assessment of consequences. Schedule 4, Part 2 defines the 

minimum information requirement. 

General guidance for the assessment of the predictive aspects 

All measures necessary

4 Dutyholders are required to take measures to reduce the likelihood of hazards 

and to mitigate their consequences until the associated risks are ALARP. Essential 

considerations are: 

• the scope for hazard elimination, 

• the adoption of inherently safer designs, 

• whether good practice has been, or is to be adopted, 

30 
• the application of risk-reducing measures where relevant good practice is 

not yet established. 

5 In general the Tolerability Of Risk (TOR) framework is applied: 

• The higher the scale of the hazard and the associated risks the more the 

balance should tilt in favour of adopting further measures to control risks 

unless Cost Benefit Analysis (CBA) suggests otherwise. 

• Most decisions on whether risks are ALARP are made by exercising 

professional judgement on whether the risks are reasonable when set 

subjectively against the cost of further risk reduction. Professional 

judgement is not an arbitrary process but is supported by appropriate 

education, training and experience, applied with specific analysis where 

necessary. 

6 The issue under COMAH is whether any necessary measures have been 

excluded. If all reasonably practicable measures are in place, and the risks are 

tolerable, then there is nothing more that needs to be done – Individual Risk and 

Societal Concern must be ALARP. 

7 The key is to be able to decide: 

• when any possible further measures are reasonably practicable (ie 

necessary), and 

• when any possible further measures are not reasonably practicable. 

8 A good demonstration in a Safety Report will provide: 

• an amount of evidence and 

• a depth of argument 

that are proportionate to the risk posed by the establishment.

9 The assessor needs to assess the demonstration, particularly the analysis of 

possible further risk reduction measures. All the information needed to assess an 

ALARP demonstration must be available (or referenced and summarised where 

appropriate) in the Safety Report. 

Risk assessment 

10 The Competent Authority (CA) uses the predictive criteria to assess the site 

operator's major accident risk assessment. 

• Risk Assessment is fundamental to the demonstration that all measures 

necessary have been taken to reduce and control risks. 

• Risk Assessment is a step towards demonstrating that risks are ALARP. 

11 Additional measures: 

• Whenever additional measures are identified as being reasonably 

practicable they should be implemented. 

• Whenever possible risk reduction measures are rejected the case needs 

to be well argued and supported with evidence. 

• Risk reduction cannot be looked at without first doing a risk analysis. 

31 
12 Operators therefore need to present their approach to risk assessment. The 

approach and the depth of the analysis will be influenced by site-specific 

circumstances and the level of risk attaching to the site. 

13 The risk assessment needs to address: 

• risks to people on-site individually and collectively, 

• risks to people off-site individually and collectively, 

• risks to the environment. 

14 The risk assessment needs to be: 

• a logical and systematic process – the Safety Report needs to identify the 

tools and competences the company is using to undertake the risk 

assessment. 

• Presented as an integrated whole. The steps in the risk assessment 

process have to be linked together. 

15 The risk assessment needs to identify: 

• a representative set of major accident scenarios, 

• the consequences and likelihood of major accident scenarios, 

• all the necessary measures taken to prevent major accidents, 

• all the necessary measures taken to limit consequences of major 

accidents, 

• domino effects where relevant. 

16 For new establishments and modifications to existing establishments the risk 

assessment needs to include: 

• consideration of the elimination of hazards, 

• inherently safe approaches to reduce the scale of hazards, 

• prevention, control and mitigation measures to limit risk. 

17 Risk assessment steps that should be demonstrated in the safety report are: 

• understand the site operations, the materials involved and the process 

conditions; 

• identify the hazards to people on-site and off-site and the environment; 

• analyse the different ways the hazards can be eliminated, reduced in 

scale, realised and controlled; 

• for the hazards that remain, predict the likelihood of the hazards being 

realised taking account of the chance of success and failure of possible 

preventive measures; 

• predict the corresponding consequences both when mitigation measures 

work and fail; 

• analyse the risks associated with the remaining hazards and the options 

for reducing them. 

32 
• decide which measures need to be implemented to make the risks to

people (individually and collectively) and the environment as low as 

reasonably practicable (ALARP); 

• present the results of the risk assessment to provide the evidence and 

arguments which demonstrate that all measures necessary have been 

taken to prevent and mitigate major accidents. 

18 The predictive criteria are structured in the same way as the above steps. They 

are designed to analyse: 

• how an operator identifies the major hazards on site, 

• how this information is used to make decisions on the necessary 

measures to prevent a major accident or limit its consequences. 

The end point of this group of criteria forms the starting point for the SMS, 

technical and emergency response criteria. 

19 New plant: 

• Analysis of the hierarchy of measures (para 14 above) of the risk 

assessment is particularly important. 

• The hazard analysis of the proposed design should pay particular 

attention to ways of eliminating hazards and inherently safer approaches 

to reducing the scale of the hazards that cannot be eliminated. 

• Ways for reducing the likelihood of realising hazards and for mitigating the 

consequences when these measures fail are then analysed. 

20 Existing plant: 

• As new plant but the scope for elimination and reduction in scale may be 

less. 

Proportionality

21 The depth of the analysis in the operator's risk assessment should be 

proportionate to the hazards and risks presented by the establishment. Further 

guidance on proportionality is included in Section 7 of the manual. 

22 Where explosives facilities and operations do not meet accepted quantitysafety distances (QD's), the safety report should:

• Provide a justification that all measures necessary to control the risks are

applied. 

• Normally include a quantified risk assessment. 

Fitness for purpose 

23 Fitness for purpose of the risk assessment depends on: 

• Expertise/competence of those identifying and analysing hazards (human 

factors issue). 

33 
• Methods used in the risk analysis. 

• Data and assumptions. 

• How the significance of the risk was assessed. 

Early predictive assessment 

24 During the early stages of the predictive assessment, the focus is on whether 

the report appears to contain the minimum key information required by Schedule 4 

Part 2 para 4(a) and 4(b) that shows: 

• a proportionate approach to hazard and risk analysis, 

• identification of the extent and severity of a representative set of 

scenarios, 

• proportionate consideration of risk reduction measures and the ALARP 

demonstration. 

25 Apparent large omission of key information in these areas is likely to have a 

major impact for further assessment of the safety report across all disciplines and 

therefore needs to be identified at an early stage. When the safety report is received 

the AM and Predictive Assessor will decide if it is necessary for the Predictive 

Assessor to conduct an initial assessment before the report is passed to other 

members of the team for assessment. Circumstances where this may be appropriate

include: 

• First safety reports for a particular site, particularly for sites that keep a 

range of dangerous substances, have very large quantities and/or a range 

of processes. 

• Where there are any indications from any source that the operator’s major 

accident risk assessment may be insufficient. 

26 In cases where an initial assessment is deemed appropriate, Appendix 10.2 

provides examples of the types of minimum key information that may be required. 

An Early Predictive Assessment Record (word template) is available for use if 

required. 

34 
Appendix 10.1 Predictive assessment criteria and guidance 

Predictive Criteria Guidance 

Criterion 10.1 

The safety report should 

clearly describe how the 

operator uses risk 

assessment to help make 

decisions about the 

measures necessary to

prevent major accidents 

and to mitigate their 

consequences. 

[Schedule 4 part 1 para 2; 

Regulation 4] 

 Risk assessment is sufficiently systematic and 

detailed for the operator to identify necessary 

measures. This criterion summarises the description

in the safety report of the company’s general 

approach to the use of risk assessment in the 

process of identifying necessary measures. The 

assessment of the application of this approach is 

covered by the remaining criteria (10.1.1. to 10.5.6). 

Criterion 10.6 draws summary conclusions on the 

assessed overall adequacy of the application of risk 

assessment described in the report for actual site

conditions. 

• Description of how a balance between 

qualitative, semi-quantitative and quantitative 

arguments, based on risk, is adopted. 

• Summary of the methods used to analyse risks. 

• Criteria used to judge the significance of the 

residual risks when control measures have been 

implemented. 

• Link between hazards identification, risk 

assessment and its use in the selection of risk 

reduction measures described (See Technical 

Assessment Criteria for further details on 

measures). 

♦ Eliminating and reducing the scale of 

hazards. 

♦ Reduce event likelihood and mitigate the 

associated consequences. 

• Use of current thinking on: 

♦ Inherently safer design options and the 

hierarchical approach to selection of 

measures. 

♦ Relevant good practice.

♦ Engineering and procedural standards. 

• Basis for making decisions about adoption or 

rejection of identified measures is provided. 

• Description of the role that risk assessment has 

in the demonstration that the risks are ALARP 

for on-site personnel, people off-site and the 

environment. 

• The depth and detail of the analysis is 

proportionate to and takes into account: 

♦ The scale and nature of the hazards. 

35 
Predictive Criteria Guidance 

♦ The associated risks. 

♦ The site-specific circumstances e.g. size and 

nature of installation. 

♦ The proximity of population or sensitive 

environments. 

• Approach to making the risk assessment a living 

document described. 

• Arrangements for periodic review described. 

• Description of how human actions or omissions 

affect risk and link to suitability of measures. 

Criterion 10.1.1 

It should be clear that 

human factors have been 

taken into account in the 

risk analysis

[Schedule 4 part 1 para 2; 

Schedule 4 part 2 para 

4(a), Schedule 2 Para 4(b)] 

How people can contribute to and mitigate the 

occurrence and impact of major accidents. 

• The safety report describes a process for 

identification of human failures, actions, or other 

involvement as contributor to major accident 

causation which is: 

♦ Systematic and integrated with the overall 

risk assessment. 

♦ Competently applied. 

♦ Showing how human failure contributes to 

major accident initiation or escalation. 

• The probabilities of human actions and 

omissions which contribute to major accidents 

and the reliability of measures dependent upon 

human action: 

♦ Are addressed and are realistic. 

♦ Recognise different categories of human 

failure including omissions, mistakes, 

decision failures, violations, sabotage and 

rule breaking. 

Criterion 10.1.2 

Any criteria for 

eliminating possible 

hazardous events from 

further consideration 

should be clearly justified 

[Schedule 4 part 1 para 2; 

Schedule 4 part 2 para 

4(a)] 

The intent of this criterion is to ensure no important 

hazardous events go unconsidered

• Risk dominating accidents are identified and 

include: 

♦ The worst case scenario. 

♦ Low probability events such as aircraft 

impact, lightning strike, cold catastrophic 

failure of a pressure vessel, guillotine rupture 

of pipework.

♦ Smaller releases which could trigger other 

events leading to event escalation. 

• Criteria for eliminating accident sequences from 

36 
Predictive Criteria Guidance 

further analysis are given such as: 

♦ Use of representative scenarios. 

♦ Use of equivalent hole sizes of releases. 

♦ Limited hazard ranges/cut-offs. 

♦ Frequency cut-off (frequencies for highly 

improbable accidents may not need to be as 

detailed as that for risk dominating 

sequences).

• Justification for eliminating possible hazardous 

events from further consideration: 

♦ are clearly presented and well argued. 

♦ Criteria have been applied (early) to limit the 

scope of the predictive aspects. 

Criterion 10.2 

The safety report should 

demonstrate that the 

operator has used 

information and data that 

are suitable and sufficient 

for risk analysis 

[Schedule 4 part 1 para 2; 

Schedule 4 part 2 para 

4(a)] 

Meteorological conditions that are appropriate for the 

site, including: 

• Process and location specific weather data: 

♦ from an appropriate Meteorological Office 

climatological weather station, 

♦ data obtained over a suitable recent period 

(e.g. at least five years.), 

♦ if modelling of the transmission of thermal 

radiation from fireballs and jet fires,use of 

likely minimum, likely maximum, and average 

humidity at a specified temperature. 

• Appropriate stability/wind speed combinations:

♦ a minimum of two combinations 

representative of daytime and night time 

conditions (eg, D5 and F2). 

♦ if buoyant plumes are modelled (eg

warehouse fires), high wind speeds are 

considered, e.g. D15. 

♦ on a directional basis for at least 12 sectors. 

[NB most flammable hazardous events are only 

marginally affected by meteorological conditions,

However there are two key exceptions, 1) unignited

drifting flammable clouds 2) thermal radiation from

fireballs and jet fires] 

• Assumptions made in tailoring data to site 

specific circumstances are realistic.

• If the data are sparse, any adjustments err on 

the side of safety i.e. ‘cautious best estimates’ in

line with the ‘precautionary approach’. 

• Consideration of a range of suitably applied 

harm levels (e.g. toxic, thermal, pressure effects)

37 
Predictive Criteria Guidance 

to people and the environment. 

• Use of current maps, off-site population data 

and surrounding environmental features. 

Criterion 10.3 

The safety report should 

identify all potential major 

accidents and define a 

representative and 

sufficient set for the 

purposes of risk analysis 

[Schedule 4 part 1 para 2; 

Schedule 4 part 2 para 

4(a)] 

• All potential major accidents (MAs) are 

identified, and 

• if these MAs are put into groups to make the risk 

analysis feasible, the coverage of the different 

types of MA hazards is suitable and sufficient for

risk assessment and emergency planning 

purposes, i.e.: 

♦ They dominate the on-site and off-site risk. 

♦ They encompass the complete spectrum of 

severity (i.e. include the worst case 

foreseeable scenario). 

[See criteria 3.3.1 & 3.3.2] 

Criterion 10.3.1 

The safety report should 

demonstrate that a 

systematic process has 

been used to identify all 

foreseeable major 

accidents 

[Schedule 4 part 1 para 2; 

Schedule 4 part 2 para 

4(a); Schedule 2 para 4(b)] 

A systematic hazard identification process has been 

used to identify all major accident scenarios, including 

worst case and lesser events. A comprehensive 

process should have considered loss of containment 

derived from all reasonably foreseeable on-site 

operations and also external events that may impact 

upon site operations. The report should outline how 

major accident hazards are identified and show that a 

suitable range of events has been identified for further 

assessment. 

• On-site Events where relevant may include: 

♦ Loss of containment accidents due to

equipment, vessel, pipe work and pipeline 

failures. 

♦ Explosions.

♦ Condensed Phase Explosions relating to 

explosives. 

♦ Large fires (Warehouses, pool fires, jet fires, 

etc.). 

♦ Events influenced by emergency action or 

adverse operating conditions etc.. 

♦ Other types of major accident hazard or 

abnormal discharge. 

• External Events where relevant may include: 

♦ Aircraft impact. 

♦ Seismic event; land slips, subsidence. 

♦ Extreme environmental conditions (e.g.

abnormal rain, snow, temperature, wind,

floods, lightning). 

♦ Vehicle/train impact or other external

38 
Predictive Criteria Guidance 

missiles. 

• Scenarios ranked and analysis proportionate to 

the scale and nature of the hazards.

• The range of MA scenarios affecting people and 

the environment is sufficient for identifying 

necessary measures and includes:

♦ Local incidents: may seriously harm workers 

or escalate into a more serious incident. 

♦ Major incidents: harm is mainly confined to 

the site, but affects more than one area of 

the site (e.g. an explosion) - potential for 

killing more than one worker - possibly with 

limited off-site impact, no fatalities but 

possible hospitalisation of 1 or more people. 

♦ Catastrophic incidents: potential for multiple 

on-site and/or off-site fatalities. 

• The scenarios include events where planned or 

installed measures fail. 

Criterion 10.3.2 

The hazard identification 

methods used should be 

appropriate for the scale 

and nature of the hazards 

[Schedule 4 part 1 para 2; 

Schedule 4 part 2 para 

4(a)] 

• Hazard identification methods appropriate and 

proportionate to the type of plant and

circumstances and the scale and nature of 

hazards are identified and described. 

• The relevant expertise of the hazard 

identification team involved is described. 

• Methods that might be used include:

♦ HAZOP (Hazard and Operability Studies). 

♦ Safety reviews and studies of the causes of 

past major accidents and incidents.

♦ Industry standard or bespoke checklists for 

hazard identification. 

♦ FMEA (Failure Mode and Effect Analysis). 

♦ Job safety analysis (e.g. Task Analysis). 

♦ Human error identification methods. 

♦ HAZARD Study 2 or PHA type assessments. 

Criterion 10.4 

The safety report should 

contain estimates of the 

probability (qualitative or 

quantitative) of each 

major accident scenario 

or the conditions under 

which they occur, 

including a summary of

the initiating events and 

event sequences (internal 

The likely frequency or probability of major accidents 

is considered. 

• The likely frequency or probability of major 

accidents is considered:

♦ Their probability, or the conditions under 

which they occur. 

♦ A summary of the events which may trigger

each of these scenarios (i.e. causes - 

whether internal or external to the 

installation).

39 
Predictive Criteria Guidance 

or external), which may

play a role in triggering 

each scenario 

[Schedule 4 part 1 para 2; 

Schedule 4 part 2 para 

4(a)] 

Depth of the analysis of event likelihood is 

• of operational experience in analysis is 

• s. The safety report: 

used.

Safety critical events. The safety report: 

asis

♦ atically.

.

t can

•

proportionate to the scale and nature of the

hazard. 

The use

described. 

Failure rate

♦ Justifies the failure rate values

♦ Includes references and methods of 

derivation (where appropriate). 

•

♦ Defines ‘safety critical event’ and the b

for the choice of definition. 

Applies the definition system

♦ Presents a list of safety critical events

♦ Includes events that may be low risk, bu

escalate to a more serious event. 

Criterion 10.4.1 

t should

2;

se of a

ined from the study of previous 

• her industries which 

• ts of failure of plant and 

•

t might

The safety repor

demonstrate that a 

systematic process has 

been used to identify

events and event 

combinations which could 

cause major accident 

hazards to be realised

[Schedule 4 part 1 para

Schedule 4 part 2 para 

4(a)] 

U systematic process for scenario generation. 

Demonstration should show that the identification of 

events or event combinations take appropriate 

account of: 

• Insights ga

accidents and incidents. 

Causes of accidents in ot

present societal risks. 

Assessment of the effec

equipment designed to prevent, detect, or 

mitigate the hazardous conditions. 

Human error as an accident-initiating event. 

• Human error in intervention activities. 

• Escalation pathways, the key steps tha

prevent them and time for actions to be taken. 

Criterion 10.4.2 

l events

para 2;

The identified Safety Critical Events or event 

the

• lihood of the various MAH's and the 

• the 

been

All safety critica

and the associated 

initiators should be 

clearly identified 

[Schedule 4 part 1

Schedule 4 part 2 para 

4(a)] 

•

sequences are those that dominate the 

contribution to risk at different distances from

plant. 

The like

associated consequences has been used in 

determining safety critical events. 

Appropriate methods for assessing

probabilities of each major accident have

used. 

40 
Predictive Criteria Guidance 

• Rejection of identified control measures for 

safety critical events is justified. 

Criterion 10.4.3 

e about,

;

The quantitative or qualitative arguments 

• le.

ents

♦ data.

rds for 

and

Note: re l isolation when automatic 

Estimates of, or

assumptions mad

the reliability of protective 

systems and the times for 

operators to respond and 

isolate loss-ofcontainment accidents 

etc. need to be realistic 

and adequately justified

[Schedule 4 part 1 para 2

Schedule 4 part 2 para 

4(a)] 

•

presented in the safety report should:

Be realistic, well reasoned and plausib

♦ Justify significant departure from argum

currently accepted by risk assessment 

media. 

Be backed-up by credible performance

• Qualitative arguments need to be: 

♦ Based on accepted good standa

engineering and safe systems of work. 

♦ Supported by evidence on the likely dem

on the various control measures and

systems and what the consequences might 

be if these fail. 

[ liance on manua

isolation fails will require justification if less than 20 

minutes is assumed for operator action to be 

implemented.] 

Criterion 10.4.4 

ces

ra 2;

that frequency and probability 

(used individually or in

• describe: 

ctually used.

ive to the 

♦

entification and analysis) adopted to 

♦ ks

n appropriate. 

The methods used to 

generate event sequen

and estimates of the 

probabilities of potential 

major accidents should

be appropriate and have 

been used correctly

[Schedule 4 part 1 pa

Schedule 4 part 2 para

4(a)] 

Demonstration

estimates are reasonable. 

• Appropriate methods

combination) to generate event sequences and 

estimates of major accidents probabilities 

include: 

♦ Relevant operational and historical data. 

♦ Fault tree analysis. 

♦ Event tree analysis. 

The safety report should

♦ The methods and assumptions a

♦ Any failure rate data used. 

♦ Justification for data in terms of the sitespecific circumstances. 

♦ Data suitability, unless shown that risks 

analysis conclusions are not sensit

data. 

The process and methods (including human 

error id

generate any probabilities or event 

sequences.

Checks against company benchmar

should be included whe

41 
Predictive Criteria Guidance 

♦ Sensitivity of the conclusions to the 

assumptions where necessary. 

Criterion 10.4.5 

The safety report should 

e

re not

cal

rt 1 para 2;

chedule 4 part 2 para

• The de quality

procedures, plant experience, or other 

[Note

ability estimates with values

ommonly used and accepted by experienced risk 

most important parts of the predictive 

spects where the justification needs to be further 

]

provide adequat

justification for event 

probabilities that a

consistent with histori

or relevant generic 

industry data 

[Schedule 4 pa

S

4(a)] 

operator's justification may inclu

acceptable evidence. A conservative approach

should be evident for arguments used. 

: the CA may: 

Compare event prob

c

analysts. 

Identify the

a

evaluated – possibly by use of sensitivity analysis.

Criterion 10.5 

The safety report should 

to

accident

e

a 2;

chedule 4 part 2 para

ppropriate consequence assessment. 

lisation. 

g

antities 

d.

♦

•

♦ References the pedigree and basis of such 

ere there is the 

e

♦

.

provide details

demonstrate that suitable

and sufficient 

consequence assessment

for each major

scenario has been carried 

out with respect to peopl

and the environment 

[Schedule 4 part 1 par

S

4(b)] 

The intent of this criterion is to ensure valid and 

a

• The safety report describes: 

♦ For people, harms that include fatality, 

serious injury and hospita

♦ A range of potential harms to the 

environment. 

♦ A systematic process for assessin

consequences of major accidents. 

♦ A detailed consequence assessment for 

dangerous substances present in qu

sufficient to cause a major accident hazar

♦ Assumptions stated and justified.

As appropriate, whole tank failure, BLEVE, 

fireball. flash fire or vapour cloud explosion.

♦ Outcomes developed using Event Tree 

Analysis. 

♦ The worst-case scenarios. 

♦ The models that have been used and a 

justification of their suitability. 

♦ Well-validated models for significant hazards.

Proprietary Models. 

models, especially wh

potential for large numbers of people to be 

killed or injured in a single major accident 

because of the long hazard range or th

proximity of a large population. 

Proprietary models used are up to date and

take account of the current physical 

knowledge about the phenomena

42 
Predictive Criteria Guidance 

♦ Are bench marked against available data or 

other models which were known to h

been bench marked. 

ave

♦

[Note. Assessors may also make use of the Gas 

Dispersio e for COMAH safety report 

asses

emonstration on the appropriate choice of 

user, 

to the significance of the 

[Note 1:

a) For a low proportionality site containing specific 

ubstanc comparison with 

of the user are more 

del or the

user and these should be 

n

ning and

duction measures. 

♦ Have been written in a quality assured 

process. 

n Guidanc

sors.]

• Hazard ranges. 

♦ A d

the models, and the expertise of the 

proportionate

hazard being modelled. 

Assessors should consider the following:

s es covered by the SRAGs, 

the appropriate SRAG graphs. 

 

b) For low proportionality sites not covered by SRAGs

and medium proportionality sites, issues such as

model quality and the expertise

important and some checking (Sampling) is 

recommended. 

c) In high proportionality cases there should be no

doubt as to the validity and quality of the mo

expertise of the

demonstrated in the report. Some analysis of the 

sensitivity of the predicted consequences to the key 

assumptions might be expected. 

d) Use of professional judgment and experience whe

deciding if consequence distances appear 

inconsistent.

Note 2: Overly conservative hazard ranges have

implications for both offsite emergency plan

for prioritisation of risk re

Operators need to recalculate hazard ranges if: 

a) this significantly affects ALARP arguments and the 

allocation of resources for risk reduction 

b) the offsite plan will be significantly affected. 

c) the CA is concerned about the training, experience 

and competence of the model user.] 

43 
Predictive Criteria Guidance 

Criterion 10.5.1 

Source term models used 

should be appropriate and 

n used

(b)]

Loss of containment accidents (releases) are 

correctly modelled. 

need to have bee

correctly for each relevant

major accident hazard 

Schedule 4 part 1 para 2; 

Schedule 4 part 2 para 

4

•

• The nature, size, and duration of releases are

identified. 

• For releases to atmosphere, the influence of 

obstacles on jets and air entrainment is 

described.

[Note In the criterion, ‘Appropriate’ means 'fit for 

purpose'.]

Criterion 10.5.2 

The m

m

aterial transport

odels used should be

need to

ly

;

para

(b)]

ls where relevant for:

ol which reacts with 

.

♦ rise to large hazard

♦

♦ range of weather conditions. 

appropriate and

have been used correct

for each relevant major 

accident hazard 

Schedule 4 part 1 para 2

Schedule 4 part 2

4

• The safety report shows appropriate use of

mode

♦ Passive (neutrally buoyant) or a heavierthan-air clouds. 

♦ A cloud containing aeros

ambient moisture entrained into the cloud

Releases giving

distances. 

Dispersing clouds interacting with obstacles

or terrain features. 

Considers a

♦ Sensitivity tests for significant events (in 

terms of assumptions about the source 

term). 

Criterion 10.5.3 

Other consequence 

assessment models (e.g. 

se fire

•

con

suitability. 

BLEVE, Warehou

etc.) used should be

appropriate and need to 

have been used correctly

for each relevant major 

accident 

Schedule 4 part 1 para 2;

Schedule 4 part 2 para 

4(b)]

The safety report identifies and describes 

sequence models and justifies their 

Criterion 10.5.4 

The harm criteria or 

vulnerability models used 

pact of

and

;

to assess the im

each MAH on people

the environment should 

be appropriate and have

been used correctly for 

each relevant major 

accident 

Schedule 4 part 1 para 2

• The safety report shows, where the scale and 

nature of the hazard and risks is significant: 

♦ The sensitivity of results to the choice of 

harm criteria or model, or the way it is used,

may be needed. 

♦ Justification for the approach to 

environmental impact assessment and data 

used. 

44 
Predictive Criteria Guidance 

Schedule 4 part 2 para

4(b)]

Criterion 10.5.5 

Assumptions used are

stified, realistic, and not 

c

ara

(b)]

• The safety report shows the sensitivity of the 

results to assumptions (particularly when the 

ju scale and nature of the hazard and risks are 

unduly optimisti

Schedule 4 part 1 para 2; 

Schedule 4 part 2 p

4

significant).

Criterion 10.5.6 

Estimates of the severity

nd extent of each major

uence are

4 part 2 para

(b)]

Extent and severity is concerned with who (people) or 

what (environment) might be harmed, how badly, and 

how many (people) or how much (environment) are 

and with company 

benchmarks. 

harm criteria, predicted hazard 

data for on/off site 

the likelihood of the major 

♦ itable 

lisations.

 Banding of events in terms of 

20, 

e site and 

umbers, centres and

 D d

ons and location of on-site and 

a

accident conseq

realistic 

Schedule 4 part 1 para 2; 

Schedule

4

affected by major accidents. 

• Predictions are realistic by comparison with 

published assessments

• The safety report: 

♦ Combines

ranges , specific

populations with

accident scenarios. 

Presents severity information in a su

form, e.g.: 

 Numbers of fatalities, serious injuries, 

hospita

consequence to people (eg 1 - 5, 5 -

20 – 100, etc). 

 Effects distances on maps of th

surrounding area (with identified 

estimations of n

types of populations both on and off 

site). 

iscusses the importance of typical clou

widths, wind direction, atmospheric 

conditi

off-site personnel for effect on extent 

and severity. 

Criterion 10.6 

The risk assessment 

should be suitable and 

;

part 2 para

This criterion

on the describ omes of the risk

ssessment process applied to actual site 

e

se of

ears 

sufficient 

Schedule 4 part 1 para 2

Schedule 4

summarises assessment conclusions

ed actual outc

a

circumstances and is an assessed view of whether th

application of the general approaches to the u

risk assessment outlined in Criterion 3.1 app

suitable and sufficient. Conclusions on Criterion 3.6 

45 
46 

Predictive Criteria Guidance 

4(a), 4(b); Schedule 2 Para

• The pulls together the information

low risk

♦ criteria, 

e

♦

n

♦

4(b)]

can only be reached at the end of assessment.

• The applied risk assessment methodology: 

♦ Is proportionate to the scale and nature of 

the hazards.

♦ Is proportionate to the estimated risks.

safety report

from the risk assessment such that it: 

♦ Draws together the likelihood and

consequence assessments in an appropriate

way to make estimates of the risks.

♦ Recognises that high consequence

events warrant attention for further risk 

reduction on a case by case basis.

♦ Considers both individual and (where

appropriate) societal risk. 

Compares the risks against suitable

and takes account of aversion to large scale 

serious events where necessary, in th

selection of necessary measures.

♦ Draws conclusions about the tolerability of 

risks from the site. 

Considers sensitivity and uncertainty in the 

risk assessment.

♦ Demonstrates that risk assessment has bee

used in an appropriate way as part of the

process to reduce risks to ALARP.

♦ Includes consideration of risk reduction

options. 

Describes the decision making process. 
47 

Appendix 10.2 Predictive aspects - key information requirements 

CRITERION KEY DATA 

Principles of risk assessment 10.2 The safety report should demonstrate that the operator has used information and data that are suitable and sufficient for risk analysis. 

• Wind rose for at least 12 direction sectors. • Representative day & night conditions for gas • Conservative weather e.g.D15 for knock dow

warehouse fires involving toxic substances. 

• Current maps with offsite land & populations. • Detail of location and quantity of hazardous m• Current information & maps showing surround

environmentally designated sites (SPA, SAC, 

Identification of major hazards & accident scenarios 10.3 The safety report should identify all potential major accidents and define a representative and sufficient set for the purposes of risk analysis. 

Examples include: • BLEVE from above ground LPG storage vess• Flash fire following catastrophic failure of refri• VCE following release of flammable liquids an• Catastrophic failure of large(st) storage tank o• Catastrophic failure of a reactor. 

Likelihood OR conditions under which a major accident can occur 10.4 The safety report should contain estimates of the probability (qualitative or quantitative) of each major 

• Range of ‘engineered’ (human initiated) failur

operator, e.g. aircraft or other onsite impacts 
48 

CRITERION KEY DATA 

accident scenario or the conditions under which they occur, including a summary of the initiating events and event sequences (internal or external) which may play a role in triggering each scenario. 

failure such as power loss. 

• Range of natural events, e.g. seismic, floodin• Failures in engineered and human responses • Consider effects of MAs on neighbouring esta

Consequence assessment 10.5 The safety report should provide details to demonstrate that suitable and sufficient consequence assessment for each major accident scenario has been carried out with respect to people and the environment. 

• Reference to methods and models for source • Reference to methods and models for dispers• Reference to methods and models for hazard 

fireball. 

• Harm criteria, e.g. 

♦ Toxic doses (concentration and time of ex

their significance. 

♦ Thermal fluxes and duration of exposure l

plant where the effects could lead to failurDomino effects). 

♦ Environmental harm in terms of dose and 

justification/derivation as appropriate. 

• Extent & severity – who might get hurt, how b
11. MAJOR ACCIDENT PREVENTION POLICY & 

SAFETY MANAGEMENT SYSTEMS ASPECTS 

Introduction 49

All measures necessary 49

Relevant requirements of the COMAH Regulations 49

General guidance for the assessment of the MAPP and SMS elements 49

Pre-construction and pre-operation safety reports 50

Appendix 11.1 MAPP & SMS assessment criteria and guidance 51

Introduction 

All measures necessary

1 The criteria and guidance presented in this chapter are concerned with the 

operator's Major Accident Prevention Policy (MAPP) and the rest of the Safety 

Management System (SMS) for implementing it. 

Relevant requirements of the COMAH Regulations 

2 COMAH Regulation 7(7) requires the operator to produce a safety report. 

Schedule 4 Part 1 paragraph 1, indicates that one of the purposes of the safety 

report is for demonstrating that a major accident prevention policy and a safety 

management system for implementing it have been put into effect in accordance with 

the information set out at Schedule 2 of the Regulations. 

3 Schedule 4 Part 2 of the Regulations specifies the minimum data and 

information to be covered in the safety report. Paragraph 1 of Schedule 4 Part 2 

requires that information on the management system and the organisation should 

contain the elements given in Schedule 2. Schedule 2 therefore sets the framework 

for these assessment criteria. 

General guidance for the assessment of the MAPP and SMS elements 

4 The elements of an SMS for implementing the MAPP listed at Schedule 2 of 

the Regulations, are compatible with the model given in the publication HS(G)65 

“Successful health and safety management”. The criteria and guidance which follow 

are set out under headings which link to the HS(G)65 model, and the derivation given 

under each criteria provides a link back to the elements of the SMS required by 

Schedule 2 of the Regulations. 

5 It is important to remember, however, that there are alternative models 

describing the interrelationship between the key elements of a successful safety 

management system. Operators may have chosen these alternatives when 

describing their SMS in company documents. Although we may wish to encourage 

operators to present information about their MAPP’s and SMS’s using the HS(G)65 

format, there is no legal requirement for them to do so. The operator's approach to 

providing the MAPP and presenting information about the associated SMS is likely to 

reflect the overall management philosophy, system and culture and we should be 

careful to avoid the impression that we are seeking to impose a particular 

management model or framework. This means we may have to search, sort and 

assemble information from the operator's safety report into the HS(G)65 elements at 

the start of the assessment process.

49 
6 Under each of the criteria guidance is given which indicates the information 

expected to be provided in a safety report, to meet the criteria. Typically this is the 

minimum information expected. In circumstances where the hazards and complexity 

of the establishment suggest that a rigorous demonstration is required, further 

information or detail may be needed to meet the criteria (see section 1 for further 

information on proportionality). Therefore the guidance should not be seen as 

exhaustive. 

Pre-construction and pre-operation safety reports 

7 Pre-Construction Safety Reports (PCSRs) and Pre-Operation Safety Reports 

(POSRs) should demonstrate adequate management of design, construction and 

commissioning processes prior to the introduction of dangerous substances. Plant 

design often undergoes considerable development before and during the 

construction period and effective management and communications interfaces 

between operator, contractors and subcontractors is required. Particular issues 

affecting PCSRs or POSRs, as appropriate, include: 

• Key safety design criteria. 

• Design process control and change management (hazard identification

and risk assessment, design management and change approval, 

document control, etc.) during construction and commissioning. 

• Competency of designers, construction teams, contractor teams, 

specialists. 

• Management of temporary arrangements or constraints during design, 

construction and commissioning. 

• Construction verification systems and commissioning controls. Post 

commissioning checks. 

• Identification of key roles and responsibilities for management of major 

hazards. 

• Communications between operator, designers, construction personnel, 

commissioning personnel, CA and other affected parties. 

• Design, construction and commissioning planning controls. 

• SMS review and revision process prior to operation. 

50 
Appendix 11.1 MAPP & SMS assessment criteria and guidance 

MAPP & SMS Criteria Guidance 

MAJOR ACCIDENT PREVENTION POLICY (MAPP) 

The following criteria, and guidance, refer to the MAPP. It should be remembered that 

operators of top tier sites are not required to produce a MAPP which is a separate 

document, but that the major accident prevention policy is required to be part of the 

safety report. 

Criterion 11.1 

The safety report should 

include a commitment to 

achieve a high standard 

of protection for people 

and the environment 

[Regulation 5(2)] 

A simple statement, in the policy document or safety 

report, of commitment should be sufficient to meet this 

criterion. 

Criterion 11.2 

The safety report should 

show that the MAPP sets 

out the operator's overall 

aims and principles of 

action with respect to the 

control of major accident 

hazards 

[Schedule 2 para 2] 

This is a high level requirement, more detail will be 

required for subsequent criteria, but for the purposes of 

this criterion, simple reflection of the aims of COMAH 

regulation 4 (take all measures necessary to prevent 

major accidents and limit their consequences to persons 

and the environment) should be sufficient.

Criterion 11.3 

The MAPP should include 

a commitment to provide 

and maintain a 

management system 

which addresses the 

following issues: 

a) organisation and 

personnel; 

b) identification and 

evaluation of major 

hazards; 

c) operational control; 

d) management of 

change; 

e) planning for 

emergencies; 

f) monitoring 

performance; and 

g) audit and review. 

[Regulation 5(3), by

reference to schedule 2 

paragraph 4] 

If operators include a statement of commitment to 

achieving a high standard of protection for people and the 

environment and support this broad aim by including in 

the MAPP appropriate objectives under each of the 

elements listed in criteria 4.3 (a) to (g), then their MAPP is 

likely to be adequate. 

It is important to note that, for this criterion, we are only 

looking for the policy statements. Subsequent criteria look 

the detail under each heading to demonstrate that there 

is the SMS to support the MAPP. 

Under each heading the operator would be expected to 

cover the following, respectively; 

• the roles and responsibilities of personnel involved 

in the management of major hazards at all levels in 

the organisation, including contractors where 

appropriate, and the provision of training to meet 

identified training needs;

• the arrangements for systematically identifying 

major hazards arising from normal and abnormal 

operation and the assessment of their likelihood 

and severity; 

• the arrangements and procedures for safe 

operation, including maintenance of plant, 

51 
MAPP & SMS Criteria Guidance 

processes, equipment and temporary stoppages; 

• the arrangements for planning modifications to, or 

the design of new installations, processes or 

storage facilities; 

• the arrangements for identifying foreseeable 

emergencies by systematic analysis and to prepare, 

test and review emergency plans to respond to 

such emergencies; 

• the arrangements for the ongoing assessment of 

compliance with the objectives set out in the MAPP 

and SMS and the mechanisms for investigation and 

taking corrective action in the event of failing to 

achieve the stated objectives. These should 

include the operator's system for reporting major 

accidents and near misses, particularly those 

involving failure of protective measures, and their 

investigation and follow up on the basis of lessons

learnt, and; 

• the arrangements for periodic systematic 

assessment of the MAPP and the effectiveness and 

suitability of the SMS, the documented review of 

performance of the MAPP and SMS and their 

updating by senior management. 

Criterion 11.4 

The MAPP should be set 

at a senior level in the 

operator's organisation 

The written statement of the operator's MAPP is signed 

and dated by the appropriate director or senior executive 

would satisfy this criterion. 

Criterion 11.5 

The safety report should 

show that the MAPP has 

been established in 

writing 

[Schedule 2 para 2] 

Inclusion in the safety report of the operator's current 

MAPP, noting that it does not have to be separate 

document, would satisfy this criterion. 

ORGANISING 

HSE publication HS(G)65 categorises the activities necessary for successfully 

organising in health and safety into the four elements (the 4Cs) of control, competence, 

cooperation and communication. These categories have been used in producing these 

criteria 

Control 

Criterion 11.6 

The safety report should 

include sufficient 

explanation of how the 

SMS fits into the overall 

organisational 

This criterion recognises that operators may have a SMS 

that does not follow the HS(G)65 model, or even if it 

does, the SMS will have to fit into the overall 

management arrangements for the site and company that 

follow other models. This criterion offers the opportunity 

for the operator to describe the arrangements for 

52 
MAPP & SMS Criteria Guidance 

arrangements management of safety and demonstrate that the 

operator's SMS fits in with the overall management 

system. 

There should be confirmation that safety management 

(particularly the management of major accident hazards) 

forms an integral part of the operator’s overall company 

management and organisational arrangements. 

In meeting this criterion, the opportunity exists for the 

operator to give an overview of their SMS and how it fits 

to overall organisational arrangements, to aid 

assessment of the safety report. 

Criterion 11.7 

The safety report should 

show that all necessary

roles in the management 

of major hazards have 

been clearly allocated

[schedule 2 para 4(a)] 

To meet this criterion the report should include: 

• description within the safety report of what use has 

been made of allocation of roles, in the 

management of major accident hazards, illustrated 

where appropriate with organisation charts; 

• information to confirm that the control of major 

accident hazards is a management function; 

• an explanation indicating that safety and 

environmental professionals act in support of line 

management; 

• description of a structured attempt to identify all 

safety critical and safety related human tasks, so

that responsibilities in the measures for prevention, 

control and mitigation can be assigned. 

Criterion 11.8 

The safety report should 

show that the 

responsibilities of 

everyone involved in the 

management of major 

hazards have been clearly

defined 

[schedule 2 para 4(a)] 

To meet this criterion the report should include; 

• reference to job descriptions, or other documents 

detailing individual responsibilities; 

• identification of post holders with 

key responsibilities; 

• references to the way in which the operator has set 

out how particular jobs should be done e.g. by 

using performance standards (rules stating who 

does what, how, when and with what expected 

result). 

Criterion 11.9 

The safety report should 

describe how the operator 

allocates resources to 

implement the MAPP 

[schedule 2 para 4(a) and 

regulation 4] 

To meet this criterion the report should include: 

• description of a process to determine and maintain 

the minimum staffing levels required to deliver the 

necessary measures under all foreseeable 

operating conditions; 

• reference to the arrangements for filling key posts; 

• explanations of systems for identifying absences of 

key personnel and arranging competent cover; 

• brief explanation of the arrangements for securing 

53 
MAPP & SMS Criteria Guidance 

financial resources to meet the demands of any 

improvements or upgrades that may be identified by 

the risk management process. 

Criterion 11.10 

The safety report should 

show that the 

performance of people 

having a role to play in 

the management of major 

accident hazards is 

measured and that they

are held accountable for 

their performance 

[schedule 2 para 4(a)] 

To meet this criterion the report should include: 

• explanation of how the responsibilities are made 

clear to the jobholder e.g. in job descriptions or 

other documents; 

• reference to performance review and appraisal 

systems; 

• effective compliance checking arrangements for 

safety critical procedures. 

Where more detailed and rigorous demonstrations are 

deemed necessary, the report should provide; 

• information about procedures for identifying and 

taking action on failures to achieve satisfactory 

performance; 

• reference to disciplinary procedures and incentive 

and reward schemes; 

• summaries of arrangements for setting performance 

standards and targets for line managers. 

Competence 

Criterion 11.11 

The safety report should 

show that the operator 

has in place a system for 

providing and maintaining 

appropriate levels of 

management and 

employee competence 

[schedule 2 para 4(a)] 

To meet this criterion the report should include: 

• outlines of the arrangements for the selection, 

recruitment, training and placement of employees 

and managers at all levels including, where 

relevant, contractors; 

• indications of arrangements for provision, validation 

and evaluation of training and instruction; 

• reference to the arrangements for providing 

specialist and expert advice whether from in-house 

professionals or from external sources; 

• outlines of arrangements for identifying personal 

development needs including needs for improving 

individual skills and the arrangements for meeting 

those needs. 

Where the more detailed and rigorous demonstrations 

are deemed necessary, the report should also include: 

• descriptions of the relevant qualifications, skills and 

experience required for post-holders and teams or 

groups having a significant role to play in the 

management of major accidents (at all levels); 

• reference to the arrangements for identifying the 

training needs of all those having a role to play in 

54 
MAPP & SMS Criteria Guidance 

the control of major accident hazards, including 

their deputies, from directors or senior executives, 

down to operators and including contractors and 

their employees; 

• details of training relevant to the individual's 

profession, discipline or trade and training in 

relation to each relevant aspect of the operator's 

systems for preventing and mitigating major 

accidents. 

Co-operation 

Criterion 11.12 

The safety report should 

show that the operator 

has systems for ensuring 

that those working in the 

establishment are actively

involved in the control of 

major accident hazards 

[schedule 2 para 4(a)] 

To meet this criterion the report should include: 

• summaries of the work of consultative bodies 

(e.g. committees) involving the workforce; 

• reference to the mechanisms that the operator 

has in place to secure the involvement of 

those working in the establishment in; 

♦ hazard studies (e.g. HAZOP) and risk 

assessments; 

♦ setting standards relevant to the control of major 

accident hazards; 

♦ devising, reviewing and revising operating and 

emergency systems, procedures and 

instructions for the control of major accident 

hazards; 

♦ the design and procurement of new equipment 

including the human machine interface to 

ensure human factors and usability are taken 

into account; 

♦ performance measuring activities including 

accident, incident and near miss investigations; 

♦ audit and review activities. 

• outline of the arrangements for upward reporting of 

information relevant to the control of major hazards. 

Where the more detailed and rigorous demonstrations are 

deemed necessary, the report should also include; 

• summaries explaining how the operator has set 

about developing a culture which encourages the 

active participation of the workforce, including 

contractors and their employees, in the health, 

safety and environment effort. 

Criterion 11.13 

The safety report should 

show that the operator 

has in place 

arrangements for 

co-operating with, and 

securing the 

To meet this criterion the report should include outlines of 

the operator's arrangements for co-operating with: 

• operators of other establishments which might be

affected by the major accident hazards; 

• contractors and their employees; 

55 
MAPP & SMS Criteria Guidance 

co-operation of, other 

organisations 

[schedule 2 para 4(a) and 

regulation 9(3)] 

• the emergency services; 

• county and other authorities responsible for 

preparation and maintenance of external 

emergency plans; 

• local authorities for other matters e.g. hazardous 

substances consent; 

• enforcing authorities; 

• employers associations;

• other relevant bodies. 

Communications 

Criterion 11.14 

The safety report should 

show that the operator 

has arrangements for 

gathering intelligence 

needed for the control of 

major accident hazards 

from external sources 

Operators cannot manage major accident hazards 

properly or achieve compliance with relevant legal 

requirements unless they are able to obtain important 

intelligence about these issues from external sources. 

Also, Regulation 8(1) requires the operator to review the 

safety report when it is necessary to do so to take 

account of new technical knowledge and developments in 

knowledge concerning the assessment of hazards. 

Descriptions of the operator's arrangements for ensuring 

that important safety intelligence such as changes in 

legislation, developments in technical standards and 

management practices and information about incidents 

with major accident potential occurring elsewhere in the 

world is obtained from: 

• enforcing authorities; 

• professional bodies; 

• industry associations; 

• emergency services; 

• other companies; 

• local authorities etc. 

Criterion 11.15 

The safety report should 

show that the operator 

has arrangements for 

communicating 

information important for 

the control of major 

accident hazards within

the operator's 

organisation 

[schedule 2 para 4(a)]

To meet this criterion the report should include 

descriptions of the use of the following methods; 

• written communications, 

• visible behaviour, and 

• face to face discussions,

to cover communication of the following information; 

• the meaning and the purpose of the MAPP; 

• the visions and beliefs which underlie the MAPP; 

• the commitment of senior management to the 

implementation of the MAPP; 

56 
MAPP & SMS Criteria Guidance 

• plans, standards, procedures and risk control 

systems relating to implementation and 

measurement of performance; 

• comments, suggestions and ideas for improvement 

from individuals and teams; 

• performance monitoring and auditing activities; 

• lessons learned from accidents and other incidents 

• staff handover and other critical communications. 

Criterion 11.16 

The safety report should 

show that the operator 

has arrangements for 

communicating 

information relevant to 

the control of major 

accident hazards to 

external organisations 

[regulations 9(3), 

10(3)&(5), 14, 15 and 16]

To meet this criterion the report should include outlines of 

the operator's arrangements for: 

• communicating with other establishments in the 

vicinity including exchanging information about 

major accident hazards and emergency plans; 

• communicating with the emergency services and 

local authorities in relation to emergency plans;

• communicating with county and other local 

authorities responsible for preparation and 

maintenance of off-site emergency plans; 

• supplying the information required under Regulation 

14 to people, and establishments serving the public 

(such as schools and hospitals), off-site who are 

liable to be affected by a major accident; 

• making the information mentioned at (d) available to 

the general public; 

• communicating with relevant enforcing authorities 

including HSE and EA/SEPA. 

PLANNING AND IMPLEMENTING 

There are four elements of the SMS listed in Schedule 2 (4) of the Regulations which

address planning and implementing issues. These are all considered in this section.

Hazard Identification 

Criterion 11.17 

The safety report should 

show that the operator 

has arrangements for 

systematically identifying 

major hazards, assessing 

the risks arising from 

normal and abnormal 

operations and 

determining necessary

control measures 

[schedule 2 para 4(b)] 

To meet this criterion the report should include: 

• explanation of the formal hazard identification and 

risk assessment techniques (HAZOP, FMEA... etc.) 

actually used at each stage of the life cycle of the 

process plant or storage facility and applied to the 

operator's activities and from the substances and

materials purchased, stored, processed or 

produced; 

• explanation of the formal hazard identification and 

risk assessment techniques used to provide 

continuing review (eg PHR, PHA etc); 

• descriptions of how the operator's arrangements for 

57 
MAPP & SMS Criteria Guidance 

risk assessment take account of human factors 

including human behaviour and reliability and the 

potential for human error in relation to safety-critical 

activities; 

• descriptions of how the outcomes of hazard 

identification and risk assessment have been used 

to determine the physical control measures and 

management risk control systems needed for the

prevention and mitigation of major accidents. 

Where more detailed and rigorous demonstrations are 

deemed necessary, the report should include; 

• explanation of how the elements of a life cycle were 

considered, particularly abnormal conditions; 

• reference to the techniques used to identify the 

hazards and assess the risks arising from external 

factors; 

• outline of arrangements for determining the skills 

and knowledge (practical and theoretical) required 

by the hazard identification and risk assessment

team members. 

Criterion 11.18 

The safety report should 

show that the operator 

has systems for 

identifying areas for 

necessary improvement 

in relation to the control 

of major accident hazards 

[schedule 2 para 4(b)]

Following on from the requirements of schedule 2 

para 4(b), the assessor needs to be assured that systems 

for evaluating risks extend to identification of any 

necessary improvements. 

The report should include outlines of the operator's 

arrangements for improvement planning, including 

methods for identification of necessary measures. This 

should include description of how the operator makes 

decisions on what is reasonably practicable. 

Reference to the operator's current improvement plans 

may be useful. 

Criterion 11.19 

The safety report should 

show that the operator 

has systems for 

determining priorities to 

achieve the objectives of 

the MAPP and scheduling 

necessary improvement 

work in relation to the 

control of major accident 

hazards 

[schedule 2 para 4(b)]

Following on from the requirements of schedule 2 

para 4(b), and criterion 4.18, we must accept that 

operators do not have unlimited resources and cannot 

make all the improvements they may have identified 

immediately. The work needs to be prioritised and 

scheduled accordingly. 

To meet this criteria we would expect to see the following;

• explanation of how priorities are decided e.g. based 

on considerations of hazard or risk.

Where more detailed and rigorous demonstrations are 

deemed necessary, we would also expect to see; 

• explanations of how improvement work relevant to 

the control of major accident hazards is scheduled, 

how the work is resourced, co-ordinated, allocated 

to individuals or teams to carry out and how 

58 
MAPP & SMS Criteria Guidance 

timescales for completion are set; 

• reference to any current backlogs of improvement

work including overdue maintenance schedules

indicating how these are being tackled. 

Key Risk Control Systems – Operational Control 

Criterion 11.20 

The safety report should 

show that the operator 

has adopted procedures 

and instructions for safe 

operation, including 

maintenance, of plant, 

processes, equipment 

and temporary stoppages 

[schedule 2 para 4(c)]

To meet this criterion the report should include 

descriptions of the risk control systems which the 

operator has in place for controlling the risks which arise 

at each stage of the life cycle of the plant, processes or 

storage facilities in question. 

These would include the systems for controlling the risks 

at each of the following stages as appropriate: 

• construction and commissioning of plant, 

processes, equipment and facilities;

• operation of plant and processes (including as 

appropriate, start-up, steady state running, normal 

shutdown, detection of departures from normal 

operating conditions and responses to them 

including emergency shutdown and temporary and 

special operations); 

• safe operation under maintenance conditions 

(including carrying out risk assessment for 

decontamination and maintenance work, generating 

safe methods of working for maintenance and using 

permit-to-work systems to control it);

• selection and management of contractors; 

• inspection, test and maintenance of plant, 

equipment and facilities;

• decommissioning of plant, processes, equipment 

and facilities. 

Where more detailed and rigorous demonstrations are 

deemed necessary, the report should include; 

• links between the identification of safety critical and 

key safety related tasks, and the development of

procedures;

• description of a process for developing procedures 

that are not only technically correct, but are 

useable, clear and unambiguous. 

Key Risk Control Systems – Management of Change 

Criterion 11.21 

The safety report should 

show that the operator 

has adopted procedures 

for planning modifications 

To meet this criterion the report should include the 

description of procedures which cover changes to the 

following (wherever they may be capable of affecting the 

control of major accident hazards): 

• organisation, including staffing levels, people 

59 
MAPP & SMS Criteria Guidance 

to, or the design of new

installations, processes 

or storage facilities 

[schedule 2 para 4(d)]

methods of work; 

• plant and equipment; 

• processes, work methods and process variables, 

such as materials, procedures, and process 

controls (including software); 

cover the full range of possible types of change, 

including: 

• permanent; 

• temporary; 

• urgent; 

and include the basic elements of: 

• defining change; 

• allocation of responsibility for authorising and 

initiating work on the proposed change; 

• allocation of responsibility for authorising and 

initiating implementation of the actual change at the 

establishment; 

• identification and recording the change; 

• assessment of the implications of the change by 

competent persons; 

• identification and implementation of control 

measures deemed necessary as a result of the 

change; 

• pre commissioning, or pre implementation, checks 

and reviews 

• post change checks and reviews. 

Key Risk Control Systems – Planning For Emergencies 

Criterion 11.22 

The safety report should 

show that the operator 

has arrangements in 

place to 

- identify foreseeable 

emergencies by

systematic analysis 

- prepare, test and review 

emergency plans, and 

- provide specific training 

for all persons working in 

the establishment. 

[schedule 2 para 4(e)] 

To meet this criterion the report should include a 

description of the operators procedures for emergency 

planning which include the following:

• arrangements for identification of foreseeable 

emergencies; 

• arrangements to determine the planned response to 

such emergencies; 

• arrangements for testing of emergency plans; 

• arrangements for the review of emergency plans, 

based on information gained through testing and 

other changes which may influence the plan. 

• arrangements to provide realistic training and 

preparation for all those likely to be involved in the 

response to an emergency; 

60 
MAPP & SMS Criteria Guidance 

• arrangements to communicating plans to all those 

who may be affected by an emergency. 

MEASURING PERFORMANCE 

Active Monitoring 

Criterion 11.23 

The safety report should 

show that the operator 

has devised proactive 

means of performance

measurement, which 

provide information on 

whether the measures 

taken to guard against 

major accident scenarios 

are operating as intended. 

[schedule 2 para 4(f)]

This criterion recognises that in the case of major 

accident hazards, a low incident rate is no guarantee that 

risks are being effectively controlled.

To meet this criterion, the report should include a 

description of a process for performance measurement, 

which includes the following elements; 

• identification of key risk control systems necessary 

for the control of major accidents; 

• development of means by which the performance of 

key risk control systems can be monitored; 

• setting of leading indicators which provide 

information on whether those key risk control 

systems are operating as intended; 

• tolerance levels set against each indicator; 

• reporting to senior management on a routine basis; 

• involvement of senior management in the setting of 

performance indicators and tolerance levels;

It is not expected that performance indicators are set 

against all elements of all risk control systems on a 

complex installation, or that collection and analysis of 

data is resource intensive. This would lead to an overload 

of indicators. It is more important to have manageable 

number of carefully selected and targeted good quality 

indicators, to provide assurance across the whole 

business. 

Reactive Monitoring 

Criterion 11.24 

The safety report should 

show that the operator 

has adopted a system for 

reporting incidents and 

near misses, particularly

those involving failure of 

the protective measures 

for control of major 

accident hazards 

[schedule 2 para 4(f)]

To meet this criterion the report should include 

descriptions of arrangements to produce lagging

performance indicators, ensuring that the following are 

recognised and reported to management: 

• major accidents as defined in COMAH; 

• other relevant injuries and cases of ill health; 

• other significant events leading to loss or 

environmental harm; 

• incidents - including individual behaviour - with the 

potential for harm or loss or environmental damage, 

particularly those with the potential for major 

accidents; 

• hazardous conditions, including process deviation

61 
MAPP & SMS Criteria Guidance 

or loss of containment. 

Investigation and Response 

Criterion 11.25 

The safety report should 

show that the operator 

has adopted mechanisms 

for investigation and 

taking corrective action: 

(a) in cases of the 

proactive performance 

measures showing a 

deterioration in risk 

control measures; and 

(b) in relation to any

incident or event with the 

potential to cause a major 

accident. 

[schedule 2 para 4(f)]

There should be a clear follow on from criteria 11.23.and 

11.24 

To meet this criterion the report should provide a 

description of arrangements for investigation, which 

include the following: 

• initiation which can be based on of failures 

identified through either the active or reactive 

performance monitoring systems; 

• early evaluation to identify immediate risks; 

• taking prompt action on immediate risks; 

• decisions made on the level and nature of 

investigation based on considerations of potential 

rather than actual outcome; 

• determining the immediate causes; 

• determining the underlying human and 

management-related causes; 

• trending of information collected through 

investigation, to highlight common or wider 

problems in the prevention and mitigation 

measures; 

• reporting to senior management. 

AUDIT AND REVIEW 

Audit 

Criterion 11.26 

The safety report should 

show that the operator 

has adopted a procedure 

for systematic 

assessment of the MAPP 

and the effectiveness and 

suitability of the SMS 

[schedule 2 para 4(g)]

It should be noted that here the term ‘auditing’ involves 

fundamental assessment of the validity and reliability of 

the SMS itself. It should not be confused with some 

operator's use the term "auditing" to refer to activities 

such as safety tours, physical conditions inspections and 

behaviour observation carried out by line managers as 

part of their active performance monitoring activities. 

To meet this criterion it is expected that descriptions of 

the operators arrangements for audit will contain the 

following; 

• the resources and personnel required for each 

audit, bearing in mind the need for expertise, 

operational independence and technical support;

• the audit plan indicating how it has been prioritised; 

• the audit protocols to be adopted (which might 

include the use of questionnaires, checklists, open 

and structured interviews as well as checking

62 
MAPP & SMS Criteria Guidance 

documents and measurements and observations); 

• the procedures for reporting the audit findings; 

• the procedures for following up the 

recommendations shown to be necessary by audits.

Review

Criterion 11.27 

The safety report should 

show that the operator 

has adopted a review 

process which uses 

information from 

performance 

measurement and audit 

[schedule 2 para 4(g)]

To meet this criterion the report should include a 

description of arrangements for review, which include; 

• involvement of senior management; 

• consideration of the results of performance 

measurement and audit;

• consideration of the suitability and adequacy of the 

current arrangements for performance 

measurement (including suitability of the 

performance indicators used); 

• consideration of the suitability and adequacy of the 

current arrangements for performance 

measurement. 

Criterion 11.28 

The safety report should 

show that results of 

review are documented 

[schedule 2 para 4(g)] 

To meet this criterion the report should include 

descriptions of the operator's arrangements for publishing 

the results of the review within the organisation. 

Criterion 11.29 

The safety report should 

show that the operator 

has adopted a system 

under which the MAPP 

and SMS is updated by

senior management 

[schedule 2 para 4(g)] 

To meet this criterion the report should include a 

description of how the review process (see criteria 4.27 & 

4.28) is used by senior management to carry out 

necessary updates of the MAPP and SMS. 

63 
12. Technical aspects

Introduction 64

Scope 64

Relevant requirements of the COMAH Regulations 64

General guidance for the assessment of technical aspects 65

The assessment approach 65

Proportionality 66

Summary of technical measures demonstration requirements 66

Issues within and between technical disciplines 66

Key philosophy for technical assessment 66

Process safety assessment 67

Mechanical systems assessment 69

Control and instrumentation systems assessment 70

Human factors assessment 72

Demonstration requirements 73

Judgements 74

Pre-construction and pre-operation safety reports 75

General 75

PCSR and POSR specific issues 75

Technical assessment criteria and guidance 76

Appendix 12.1: Process Safety Criteria and Guidance 78

Appendix 12.2: Mechanical criteria and guidance 90

Appendix 12.3: Control & instrumentation criteria and guidance 101

Appendix 12.4: Human factors criteria and guidance 113

Introduction 

Scope 

1 This guidance is for assessors completing the technical assessment and is 

relevant to all types of safety report. These criteria contribute to the assessment of 

the measures taken to prevent major accidents and to limit their consequences for 

people and the environment. They also concern the incorporation of adequate safety 

and reliability into the design, construction, operation and maintenance of the 

establishment and are presented in a way that identifies the different concerns during 

the life cycle of an establishment. 

2 These criteria interface with those specific aspects of the Safety Management 

System which are directly relevant to the technical measures taken; e.g. periodic 

examination of pressure systems, operating procedures, etc. They are the outcomes 

which are determined or influenced by the SMS. The criteria reflect both the 

probability and consequences (i.e. risk) of major accidents. The starting point for 

these criteria (12.1) is in fact the end point of the predictive criteria 10.6. 

Relevant requirements of the COMAH Regulations 

3 Paragraph 3(a) of Part 1 of Schedule 4 requires a demonstration that adequate 

safety and reliability have been incorporated into the design and construction of the 

installation. Part 2 of Schedule 4 to the Regulations specifies the minimum 

information to be included in a safety report and includes a description of the 

technical parameters and equipment used for the safety of the installations and a 

description of the equipment installed in the plant to limit the consequences of major 

accidents. 

64 
General guidance for the assessment of technical aspects 

The assessment approach 

4 The CA’s approach to assessment is that it be: 

• consistent 

• proportionate 

• targeted 

• transparent

• based on prima facie evidence. 

5 The first step in the assessment approach is an examination of the risk 

assessment to see whether the Duty Holder understands the risks and has identified

all measures necessary to limit those risks. Discipline specialists then assess the 

demonstration of whether the measures described provide appropriate safety and 

reliability given the risks.

The specialist disciplines covered by this manual are: 

• Process Safety (PS) 

• Mechanical (M) 

• Control and Instrumentation (CI) 

• Human Factors (HF) 

6 All measures necessary means all those measures intended for eliminating, 

reducing, controlling and mitigating risk as required by relevant codes and standards,

PLUS any additional measures necessary to reduce risks to As Low As Reasonably 

Practicable (ALARP) (i.e the sacrifice would not be disproportionately high for the 

achieved risk reduction).

7 The assessment process stops when the CA is satisfied on the basis of prima 

facie evidence that: 

• there is sufficient evidence that risks have been reduced ALARP, 

supported by signposts (to what can be verified on-site) or valid arguments 

that the measures are of suitable safety and reliability to achieve the risk 

reduction, 

or 

• requests for further information have been adequately responded to. 

NOTE: Measures that achieve larger risk reductions should get more attention. 

8 The information in the Safety Report is examined at face value to determine 

whether these measures meet current well supported codes or standards AND 

65 
whether the arguments for not adopting further measures demonstrate that the 

ALARP principle have been adequately justified and applied. 

Generally it is not necessary to carry out a Cost Benefit Analysis in order to 

demonstrate ALARP but in some cases it may well be required. 

Proportionality

9 The breadth and depth of the assessment of the operator's risk assessment 

and the determination of all necessary measures should be proportionate to the 

hazards and risks presented by the establishment. Further general guidance on 

proportionality is included in Section 7 of the manual. 

10 Rather than describing many individual measures the Safety Report can 

sometimes more efficiently refer to systems, with examples of their application to a 

sample of plants / processes. Wider application of these systems can then be verified 

on-site by inspection. These are systems which deliver measures appropriate to the 

hazards and risks throughout the life cycle of: 

• Design 

• Construction

• Operations 

• Maintenance, Inspection and testing 

• Modifications 

• Decommissioning 

Further information will be required when life cycle systems of measures are not 

addressed in the Safety Report or described in sufficient detail to identify how they 

deliver measures of sufficient safety and reliability proportional to the risk to people 

and the environment. 

11 The effects of Loss Of Containment (LOC) may be more extensive and severe 

for some scenarios that for others. The safety and reliability of the safety critical

parts of the identified measures should be targeted for a depth and breadth of 

assessment that is proportionate to how extensive and severe the consequences of a 

release could be. 

Summary of technical measures demonstration requirements 

12 The CA expects the justification for why further measures are not necessary to 

be more detailed the greater the extent and severity of the potential major accident 

hazard. The greater the extent and severity, the more the Duty Holder should be 

considering alternative measures. 

Issues within and between technical disciplines 

Key philosophy for technical assessment 

13 The safety report should provide clear justification of the applied measures for: 

• Control of the processes, taking account of foreseeable normal and 

abnormal operations (Process Safety, Control and Instrumentation). 

66 
• Prevention of Loss Of Containment (LOC) by the adequacy of the initial 

integrity and continuing integrity of the containment boundary. Direct 

causes of failure include: Corrosion, Erosion, External Loading, Impact, 

Overpressure, High/Low Temperature, Low Pressure, Vibration, 

Wrong/Defective Equipment (Mechanical Engineering) and Human 

Failings (all disciplines).

• Risk reduction using safety instrumented systems and their reliability 

(Control and Instrumentation and Process Safety). 

• Hazardous Area Classification and suitability of equipment within 

designated hazardous zones (Process Safety and Control and 

Instrumentation). 

• Adequate human integrity of the measures for prevention, control and 

mitigation of LOC and its effects. These measures depend upon human 

reliability no matter how automated the plant. Human Factors include the 

workplace environment, organisational, job and individual characteristics 

that influence understanding and decision making, rule following and 

skilled behaviour (human factors). 

Process safety assessment 

14 General approach to process safety assessment. 

The assessor is looking for evidence of: 

Identification of the credible hazards. This will focus on the quantities and properties 

of hazardous substances and the consequence of LOC, the operating conditions 

within the plant, control function and process operating philosophy, and the impact 

these have on-site and off-site to exposed populations. 

• Determining whether measures match the hazards. This may focus on 

evidence on suitable ranges of process design, control, protective systems 

and human measures to provide diversity. 

• The derivation of appropriate performance standards linked to safety 

criticality. It should be possible to see the link between identified major 

accidents and the range of selected measures chosen to prevent and limit 

them. 

• Whether there is correct identification of process and external loads and 

duties. This addresses the process internal operating conditions under 

normal and abnormal operating states and expected future demands. 

• Potential for deviations and excursions from normal operating conditions. 

• The external effect of the environment on the process and its operation 

(e.g. temperature, hazardous atmospheres, etc.) should be addressed. 

• Effect of other failures to initiate major accident scenarios. 

• Whether the company has identified the demands on the safety systems.

• Potential for knock-on effects. 

15 Key technical issues for process safety assessment. 

• Loss of containment arising from a range of initiating events (such as 

process operating excursions from normal / safe operation, uncontrolled 

chemical reactions, external events, etc.) 

67 
♦ How these are systematically assessed. 

♦ How these are prevented, controlled and mitigated against. 

♦ Measures the duty holder relies on as the main control to make the 

process safe (e.g., venting, pressure relieving, inerting). 

♦ Compatibility issues of the materials involved. 

♦ Scale up - awareness of the hazards in scaling up (eg, heat transfer 

considerations if increasing the volume). 

♦ Separation and segregation. 

♦ Safe operating envelopes and safety margins. 

♦ Safe operations measures to prevent excursions/loads. 

• Control system performance in relation to desired function (not limited to 

hardware). 

• Process control philosophy for management of hazards: 

♦ balance of reliance on manual or automated control. 

♦ control room operation interface with the process.

♦ in normal and abnormal operating modes and emergencies.

♦ Fail to ‘safety’ philosophy for control and isolation devices. 

• Installed process control measures and how they are designed: 

♦ Evidence of appropriate recognised standards. 

♦ Coverage of safety functions. 

♦ Suitable alarm systems for deviations.

nd sufficient.

• System integrity under identified hazardous scenarios (including worst 

• Redundancy, ersity, availability. 

easures:

azard.

tems), Control (shutdown/shutoff control, 

• Management issues: 

♦ Systematic review processes. 

e SMS and a selection of measures 

♦ g systems and assurance they are followed. 

• Flammables and toxics:

possible flammable atmospheres (consider static 

♦ Determination that integrity is suitable a

case scenario). 

div

• Hierarchical approach to selection of m

♦ Inherent safety. 

♦ Reduction of the h

♦ Prevention (corrective sys

venting and disposal), Mitigation (e.g. deluge systems, fire fighting 

systems). 

♦ Inherent safety a principle of th

philosophy.

Safe operatin

♦ Change management. 

♦ Sources of ignition in

and hot sources) – Hazardous Area Classification. 

♦ For toxics, consideration of ventilation and where material is stored. 

68 
Mechanical systems assessment 

16 General approach to mechanical systems assessment: 

The assessor is looking for evidence of: 

• Adequate initial mechanical integrity. The focus is on adherence to 

suitable design principles, often embodied in codes and standards. 

• Suitable controls on manufacture and construction for the delivery of 

design intent. 

• Adequate continuing integrity through operating the plant within its normal 

operating envelope as well as through appropriate maintenance and 

periodic examination regimes. 

• Procedures to ensure modifications will not compromise integrity. 

17 Key technical issues for mechanical systems assessment: 

• New plant and initial integrity. In new plant initial integrity is very important

before the inspection cycle begins. 

• Suitable design principles, codes and standards.

• Consideration of: 

♦ Design details. 

♦ Operating and fault conditions. 

♦ Materials properties. 

♦ Potential failure modes. 

♦ Provision, inspection and maintenance of protective systems. 

♦ Design of equipment secondary containment. 

• Design criteria: 

♦ Prevent and control of releases 

♦ LOC direct causes 

♦ Adequate structural integrity 

♦ Operational and extreme loading 

♦ Suitable materials 

♦ Excursions beyond design conditions 

• Construction criteria 

♦ Construction standards 

♦ Verification of construction systems

 welding) 

construction (including safety 

• In service integrity: 

limits.

e and inspection by competent person(s). 

• Maintenance/inspection criteria: 

petent workforce 

♦ Controls on manufacture (particularly

♦ Inspection and testing of initial integrity 

♦ Management of design changes during

assessment) 

♦ Operating within

♦ Appropriate maintenanc

♦ Procedures for modifications. 

♦ Appropriate maintenance by com

69 
♦ Examination by independent competent persons 

♦ Assessment of examination/maintenance results 

♦ Written Schemes of Examination linked to performance / maintenance

• Ageing plant - As plants and equipment age there is an increasing 

sion,

ecified design basis and the assessment that has been made 

♦

♦ rrying

♦

ARP

♦

Control and in

C assessor is looking for evidence of: 

trol

t

a

• (SIS). The report should

• itial design of electrical systems and utilities. This equipment 

ble

• l equipment is 

• entation systems ensured by

suitable maintenance/inspection/testing regimes. 

history. 

likelihood of time related ageing damage from fatigue, corrosion, ero

creep and other degradation mechanisms. The safety report should 

describe: 

♦ The sp

of the impact for continued operations, inspection, testing and

maintenance. 

Equipment condition derived from known inspection history e.g. the 

corrosion history; operational performance; how the plant has 

degraded. 

Processes that need to be gone through for determining and ca

out more detailed inspections and to positively justify what is needed 

to keep the plant going (as opposed to rebuilding it). 

Reviews to compare the original design with up to date design 

principles and the consideration of measures to risk reduced AL

where appropriate. 

Any use of fitness-for-service and remnant life assessment techniques

in re-evaluation of structural integrity. 

strumentation systems assessment

18 General approach to assessment: 

The ontrol and Instrumentation Systems

• Suitably designed process control systems which will deliver the con

philosophy of the process in a reliable manner and minimise impingemen

on safety related protection systems such as Safety Instrumented 

Systems (SIS). The report should also clearly describe areas where 

human interaction is necessary and how risk assessment has played

part in determining the overall control strategy. 

Suitably designed Safety Instrumented Systems

demonstrate that SIS have been designed to suitable standards and that 

requirements for the safety system have been underpinned by suitable risk

assessment processes. For legacy systems the report should state how 

the Company are reviewing these systems against current standards and

how they intend demonstrating that they have suitable levels of safety and

reliability. 

Suitable in

includes EX equipment, fixed electrical systems (HV &LV), earthing 

systems, fire & gas detection systems, and supply systems such as 

instrument air. With these systems the focus is on adherence to suita

design principles, often embodied in codes and standards. 

Suitable procedures in place to ensure that electrical/contro

operated within its design requirements. 

Continuing integrity of control and instrum

70 
• Suitable procedures in place to ensure that modifications to systems are

carried out in a controlled manner and subject to suitable hazard 

19 Key : 

Design and implementation of the process control system should be 

hazard analyses. The CI assessment should 

are

d systems e.g.

•

S linked to major accident scenarios 

rmation provided should be as 

indicated below. For SIL rated systems, providing the identified 

d

in

Information

♦ Design and Standards used for achieving functional safety of SIS (e.g. 

61511 or other). 

♦ How safety Safety Requirements Specification can be traced to a 

♦

nt. 

ved via

♦ ed by initial design/installation and by subsequent 

♦

♦ Suitable modifications procedures. 

identification/analyses and associated risk assessment techniques. 

technical issues for control and instrumentation systems assessment

• Process Control Systems 

based on suitable process

ensure that the process control system in terms of hardware and softw

is suitable for delivering the requirements of the process in a reliable 

fashion, thus minimising demand rates on safety related protection 

systems. Information should be provided on key systems linked to major 

accident scenarios and should include the following: 

♦ Procedures/ standards used to ensure hardware/software meets the 

requirements of the process 

♦ Details of Process Control Strategies (manual, on/off, PID, cascade, 

predictive etc.) 

♦ Required human interaction with the process 

♦ Process based alarms/trips. 

♦ Safety related alarms and trips. (e.g. SIL rated systems) 

♦ Final protection systems (often not instrumente

Pressure Relief Systems) 

Safety Instrumented Systems (SIS)

Lifecycle Approach: A selection of SI

should be provided in the report. Info

information should be straightforward, however, for legacy systems there 

will be gaps. The Company should identify these information gaps an

state how they have reviewed, or intend to review, these systems

accordance with current standards, and also to demonstrate that risks 

have been reduced to ALARP. For higher claims of risk reduction (e.g. 

SIL2 or SIL3 rated systems) more detail should be provided. 

about SIS should include: 

in house, BSEN 61508/

structured Hazard identification/Analyses process (e.g. HAZOP or 

similar). 

♦ Clear specification of what the system is designed to do. 

How target reliability has been determined from suitable risk 

assessme

♦ How the safety requirements specification has been achie

hardware and software from sensor to final element. 

How is it achiev

proof testing.

Suitable maintenance of system. 

71 
• Utili power supply.

ibution systems including

as). 

plant stability.

ty of instrument air system 

• Elec

ly protected for designated 

zone. 

em in place

•

♦ logy description

♦ Reference to design standards. 

detectors

tecting detectors against poisoning. 

s for systems. 

•

part of the control 

testing and maintenance personnel. 

♦ Specific technical training for maintenance (electrical systems, control 

♦ ce in analysing effects of loss of power. 

Human factors assessment 

20 Gene

Looking for 

parts that people play in protection, prevention, 

ery from major accidents. 

• Human performance requirements being addressed with the same degree 

onally expected for process and engineering issues. 

K

• e allocation

•

mitigation of major 

accidents: 

ties, especially

♦ Design basis. 

♦ Continuing integrity of electrical distr

earthing, HV&LV (non hazardous are

♦ Load shedding and effects on

♦ Lifecycle integri

trical systems in hazardous areas. 

♦ Suitable Hazardous Area Classification 

♦ Electrical/instrumentation equipment suitab

♦ Suitable proactive maintenance syst

Fire & Gas detection systems. 

Techno

♦ Safety requirements specification. 

♦ Rationale for positioning of

♦ Measures in place for pro

♦ Maintenance and testing procedure

Management issues: 

♦ Competence in assessing the control system. 

♦ Competence demonstration (where an operator is

system). 

♦ Competence of proof

systems). 

♦ General Safety Management System for proof testing. 

Competen

♦ Safety Management System for software design teams. 

ral issues for assessment: 

evidence of: 

• Identification of the

potential initiation, and recov

of rigour traditi

21 ey technical issues for human factors assessment: 

Human systems (manual measures) and the justification of th

of safety critical function to humans. 

Performance standards for all safety-critical and key safety-related human 

tasks in the measures for prevention, control and

72 
♦ Human performance requirements identified e.g. speed, accuracy, 

vigilance, communications, detection, diagnosis, physical actions, 

ted by information, controls and access for the operators, alarm 

cs

♦ es of infrequent tasks to maintain performance standards. 

•

♦

♦

•

fety critical tasks. 

nd actions are supported by 

procedures:

♦

• Staff selection, training, refresher training and competence assessment.

•

•

Demo nts

22 A t reaching conclusions on the demonstration. The onus is 

on the Duty lace. The demonstration requires: 

links to the reduction

of major accident risks t hrough 

ected measures. 

ith

• tional to risks arising from 

• Further risk reduction options are considered and arguments that are 

proportionate to the hazard and risk are provided where options were not 

implemented. 

skills. 

♦ Performance requirements within the limits of human capability. 

♦ Performance requirements supported by workplace design, i.e. 

suppor

systems design, ergonomics of process control interface, ergonomi

of machinery and equipment. 

Exercis

Evidence of physical and mental fitness assurance: 

Of safety critical staff 

Including consideration of fatigue from shiftwork and overtime. 

Manning and supervision philosophy: 

♦ Roles and responsibilities for authorisation, decisions, 

communications for sa

♦ Justification of demanning. 

• Activities relying on human decisions a

♦ Procedure design. 

Task analysis. 

• Reliability and monitoring of human performance. 

Speed of response.

Availability.

• Workload. 

• Consideration of demands in abnormal conditions.

nstration requireme

ssessment is abou

Holder to justify the measures in p

• Justification of a particular design. Explain how this

o ALARP, and how this is achieved t

diversity and integrity of sel

• Description of in-service inspection and maintenance regime. 

• Compliance with guidance. If the offsite risk is small then compliance w

guidance can be sufficient but if larger populations can be affected then 

additional measures will need to be considered. 

The depth of protection measures are propor

major accident scenarios. 

73 
• Specification of not just what but also why measures are provided i.e. the 

link between measures and their role in major accident prevention or 

mitigation. The arguments justifying a particular design are important to

• velopment history from conception to the 

Judgem

23 If demonstration require

inform n

conclusion .

Informatio n

the planne e establishment. 

24 Tr g

cient evidence to justify not providing an identified measure. 

• Incorrect information. 

n to

idance or use of inappropriate standards. 

•

nd timely human responses.

ge of the establishment and its operations.

the ALARP demonstration. 

A description of the site de

present. 

ents 

ments are missing, the assessor may ask for further 

atio . This information will be deemed part of the report at that stage and 

s will be reached as to whether or not the demonstration has been made

n not, or inadequately, supplied may become an issue for resolution withi

d intervention strategy for th

ig ers leading to requests for further information might include: 

• Insuffi

• Missing or vague information such that a judgement cannot be made, 

including inadequate definition of terms. 

• Lack of a philosophy or system such that it is not clear if the measure is 

systematically applied. 

• Failure to comply with relevant legislation. 

• Failure to comply with guidance or meet good industry practice. 

• Missing systems or major components of a system which can be show

lead to a major accident hazard. 

• No indication of checking, testing, inspecting, monitoring of condition of 

measures. 

• Failure to comply with gu

• Unsuitable materials. 

• Inadequate measures. 

• Absence of maintenance priorities or regime. 

Inadequate inspection regime. 

• Incompatibilities between data. 

• Overconfidence in performance standards. 

• Performance standards not given. 

• Over-reliance on correct a

• Inconsistencies within the safety report. 

• Conflicts with the CA’s knowled

74 
Pre-c

Genera

25 A e

orts (POSRs) 

reports will, in

practice, limit the available information. The following outlines some of the principal 

nt focus elements relating to PCSRs and POSRs. 

f

zards in reaching the 

elected final design should be described. Specific design issues relating to the 

posed key technical measures is an important 

art of this justification. Description of the chosen design, without some indication of 

n design

isk to 

pecific issues

clusion. 

The following guidance should be applied to the PCSR or POSR as appropriate to 

and the depth of information contained. 

arrangements affecting layout, utilities, etc. during construction and 

•

uld be

onstruction and pre-operation safety reports 

l

ll t chnical assessment criteria are available for consideration of PreConstruction Safety Reports (PCSRs) and Pre-Operational Safety Rep

in so far as information is available. However, the timing of these

assessme

26 Assessment of PCSRs should focus on the ‘front end’ design aspects in the 

assessment criteria and, in particular, the approach to considering the adoption o

inherent safety principles in the proposed design. The conceptual design option 

selection process and the consideration of potential major ha

s

prevention of accidents during the construction and commissioning phase, 

considered prior to the introduction of dangerous substances, should also be 

addressed. 

27 Justification of the chosen design and how it reduces risks to ALARP is an

important element of the PCSR as the options for necessary change and 

improvement are more easily addressed at this early stage. The link between

identified major hazards and the pro

p

key decisions (linking hazards and measures) behind the rejection of other 

considered principal design features or options, only addresses the chose

and fails to explain why other options do not offer better opportunity to reduce r

ALARP. Assessment will necessarily be limited to information that is reasonably 

available at the time the report is submitted 

28 Assessment of POSRs should focus on amendments made to the design and

construction, and any additional information since the PCSR, and whether the plant 

meets the design intent. Commissioning controls will also be an important 

assessment issue. 

29 The combined information contained in the PCSR and POSR report should be

equivalent to that contained in a safety report for an existing establishment. 

PCSR and POSR s

30 The boundaries between PCSRs and POSRs and the information they contain 

will depend upon the timing of submission and the information available for in

the time of submission of the report

• The impact of features and integrity of the design, specific to meeting the 

needs of the construction or commissioning process and the assessment

of their impact for major accident hazards should be described. (e.g. 

extraordinary loads imposed by water pressure testing, temporary

commissioning phases.).

The impact for temporary isolation and connections to contribute to 

potential loss of containment or other major hazard during or after 

commissioning, and the arrangements in place for their control sho

75 
described (e.g. planned management controls for design, constructio

commissioning; designed

n and 

integrity of temporary systems.). 

f high

fic

•

n (e.g. use of 

• sion

trol

ill

r systems for 

•

e

 is reasonably 

Technic

31 The for

each of th cal, Control and 

Instrumentation, Human Factors). Guidance to the criteria is provided in bullet point 

nsideration by CA

ir professional experience and judgement. 

Assess s

33 T y the contents of all four 

technic d ted for a 

iscipline against any particular criterion, this does not infer that the criterion has no 

s area

d

• Account taken of Human Factors controls associated with a period o

activity using a large body of contracted personnel may pose speci

issues to be addressed by safety management arrangements. 

Planned maintenance arrangements during the commissioning period 

may differ from those expected during normal plant operatio

contractors, changed responsibility arrangements, etc.). 

The level of detail design change during the construction and commis

period is potentially significant and requires effective change con

management systems. In normal operation, modification procedures w

typically form part of the operator’s management system. However, during

the design, construction and commissioning phases, othe

change management may be applied (e.g. design contractor’s in-house 

systems, other contractor systems, etc.). The dovetailing of temporary 

arrangements prior to operation and the company’s own management 

systems should be described where appropriate.

The PCSR should identify key activities that are yet to be undertaken 

during the development of the design. Whilst details of these activities 

may not be well developed, the key areas of the design that are likely to

be affected and the potential sensitivity of described arrangements to th

planned future work should be described as far as

practicable. It should be possible for the assessor to readily crossreference changes between the PCSR and the POSR. 

al assessment criteria and guidance 

following appendices contain tables of technical assessment criteria

e primary technical disciplines (Process Safety, Mechani

format to provide a checklist of issues that may require co

assessors. 

32 Assessors should use the guidance as appropriate in relation to: 

• The site specific circumstances described in the safety report. 

• The

• The scope of assessment in the agreed Target Agenda. 

or are not obliged to address every criterion or its guidance in full.

he full guidance for technical assessment is formed b

al iscipline appendices. Where no guidance has been indica

d

relevance to that discipline, but means that the criterion is not a primary focu

for that discipline. Assessors are not obliged to address solely the criteria an

guidance in the Appendix relevant to their specific discipline as the boundaries of 

discipline interest in assessment criteria may overlap. However, where assessment

by a discipline assessor leads to areas that interface with another discipline 

assessor’s principal scope of assessment, assessors should, where appropriate, 

76 
seek to reach an agreement at an early stage on who will lead on a topic or on

arising. This is to avoid unnecessary duplication of assessment. 

34 The guidance to the criteria provides a framework for assessment and

intended to provide detailed topic specific technical guidance. Detailed topic 

technical guidance exists on the relevant Website and/or Intranet. This guidance is 

available as part of the CA’s corporate knowledge base addressing

issues 

is not

technical issues 

and practices 

77 
Appendix 12.1: Process Safety Criteria and Guidance 

Process Safety Criteria Guidance 

Criterion 12.1 

The safety report 

should show a clear 

link between the 

measures taken and the 

major accident hazards 

described 

[Schedule 4 Part 1 para 

2; Schedule 4 Part 2 

para 4(a), 4(c), 5] 

This is the core of the Safety Report from the 

technical point of view and provides the link between 

identification and analysis of hazards and the 

selection of measures. 

• The operator recognises the 

hazards/scenarios. 

• Control measures are linked to specific 

scenario(s).

• It is clear how decisions are made for reducing 

risks ALARP. 

• The safety report explains decision criteria for 

selecting measures. 

For a representative set of scenarios from the 

predictive analysis: 

• The report demonstrates how risks have been 

reduced to ALARP and are tolerable.

• The report demonstrates adequate diversity 

and redundancy in the control measures 

(appropriate to the SIL). 

• The report demonstrates there are no further 

reasonably practicable risk reduction measures 

the operator could take.

Criterion 12.2 

The safety report 

should demonstrate 

how the measures 

taken will prevent 

foreseeable failures 

which could lead to 

major accidents 

This is effectively a summary of all the other criteria, 

looking at the overall picture. 

The assessor should come back to this when the 

other criteria have been considered, and then 

consider: 

• Whether all the assessed criteria have been 

met. 

• How significant the failure of one or more 

criteria is to the overall safety justification. 

• Any failure to recognise appropriate standards.

• Full application of standards and any deviations 

from the standards.

Criterion 12.2.1.1 

The safety report 

The Safety Report specifies the standards and codes 

of practice used as the basis for the design of the 

78 
Process Safety Criteria Guidance 

should show that the 

establishment and 

installations have been 

designed to an 

appropriate standard. 

[Schedule 4 Part 1 para 

3; Schedule 4 Part 2 

para 4(c), 5(a)] 

plant and the selection of appropriate risk control 

measures. 

The Safety Report recognises that some of the 

design is outwith the standards and codes and 

describes the process for managing deviations and 

exceptions to ensure that safety and environmental 

protection is not compromised. 

• The safety report specifies: 

• Potential demands placed on systems such as:

♦ Trip systems 

♦ Operators responding to alarms 

• Performance standards for on-demand 

systems: 

♦ Accuracy and speed of response of 

operators. 

• The Safety Report shows that the performance 

standards are adequate:

♦ That the measure has a sufficiently high 

availability. 

♦ That performance standards (reliability, 

availability, accuracy, speed of response 

etc.) have been verified such that the 

operator can demonstrate the measures 

work according to the standards. 

Criterion 12.2.1.2 

The safety report 

should show that a 

hierarchical approach 

to the selection of 

measures has been 

used. 

[Schedule 4 Part 1 para 

(3); Regulation 4] 

This is an important criterion which has a closely 

defined 4 stage hierarchy: eliminate (inherent 

safety), prevent, control, mitigate, in that order of 

priority. 

• The Safety Report considers reducing the 

quantities of hazardous substances stored or 

used in the process: 

♦ Consideration is given to using alternative 

less hazardous substances. 

♦ A case is made for the amount and type of 

each hazardous substances. 

• Consideration of intensified processes, e.g. 

smaller semi continuous processes instead of 

large batch processes. 

• Alternative inherently safer processes have 

been considered, e.g. to eliminate or reduce 

the risk of a runaway reaction. 

79 
Process Safety Criteria Guidance 

• operational 

•

, diversity and availability of 

control

l systems, the Safety

 best 

• Priority is given to passive measures over 

active measures. 

•

ch to selecting 

The Safety Report identifies the

measures which prevent excursions/loads. 

For preventive measures the Safety Report

demonstrates: 

♦ Redundancy

these measures 

♦ A safety management system. 

• Where there are hazards there are

systems (hardware) including: 

♦ Corrective systems. 

♦ Shutdown/shutoff. 

♦ Venting and disposal.

• Where there are no contro

Report shows that there are adequate 

preventive measures: 

♦ e.g. if a runaway reaction cannot be

controlled are there good (standard,

practice) measures for prevention of 

runaway? 

It can be concluded that the Safety Report 

demonstrates an approa

measures that is proportional to the risks. 

Criterion 12.2.1.3 

k

and

art 1

art

Layou

conduct pro

relative layout of process 

equipment, hazardous inventories and the 

• ties (e.g. 

•

oes to

•

Layout of the plant 

should limit the ris

during operations, 

inspection, testing, 

maintenance, 

modification, repair

replacement. 

[Schedule 4 P

para3; Schedule 4 P

2 para 4(c)] 

t issues for process will link to the ability to

cess operations during normal and 

emergency situations. 

• Layout plans show

separation of hazardous and less/non 

operational hazardous areas. 

Plans show location of emergency utili

firewater). 

• Layout considers hazardous interaction 

between released materials. 

• Layout considers human emergency response 

to process events (i.e. can operators do what 

they need to do in identified emergencies?), etc

Where there is venting (e.g. to mitigate 

exothermic runaway) the Safety Report 

demonstrates that any vented material g

a safe and suitable location. 

Layout considers access for process operator 

80 
Process Safety Criteria Guidance 

functions, e.g. location of key manual process 

•

each other been considered: 

a

Note:

th ntrol systems for reducing 

isolations. 

The risks associated with equipment being 

adjacent to

♦ There is a justification for not having extr

barriers or changing the layout. 

♦ Segregation of reactive materials in storage

or transport.

 for an operating plant, redesign is much more 

difficult an adding co

risks ALARP (e.g. routeing and location cannot be 

easily retrofitted). 

Criterion 12.2.1.4 

Utilities that are needed 

1

le 4 Part

ant) during normal and abnormal 

.

ing. 

al utility (e.g. fuel / purge). 

• ents an evaluation of

particular processes (eg cooling water 

•

ising

enarios.

to implement any

measure defined in the 

safety report should 

have suitable reliability,

availability and 

survivability.

[Schedule 4 Part

para3; Schedu

2 para 4(c), 5(a)]

• The Safety Report presents an evaluation 

(where relev

operation of:

♦ Loss of power. 

♦ Loss of air

♦ Loss of nitrogen. 

♦ Loss of cooling.

♦ Loss of heat

♦ Fire water supply.

♦ Other safety critic

The Safety Report pres

the significance of the different utilities to the 

important for an exothermic process). 

The Safety Report demonstrates how utilities 

have been designed in relation to minim

the consequences of major accident sc

• Independent supplies are provided where 

necessary (eg mains water supply is avoided 

where water pressure and reliability of supply is 

critical). 

Criterion 12.2.1.5 

The safety report 

should show that 

res

vely

es.

para 4(c), 5(a)]

Wher

adequately describes measures such as bunding or 

ther forms of secondary containment and controlled 

adequate, e.g.: 

red

appropriate measu

have been taken to

prevent and effecti

contain releases of 

dangerous substanc

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2

e there could be releases, the Safety Report

o

disposal systems such as venting into dump tanks

(see also 5.2.1.7). 

• The safety report shows that the proposed 

measures are

♦ Overtopping of bunds has been conside

through suitable sizing criteria and 

structural design. 

♦ The consequences of overtopping has been

81 
Process Safety Criteria Guidance 

considered.

Criterion 12.2.1.6

The safety report 

should show that all 

in

ule 4 Part

para 4(c)]

Direc

considere ign. For process safety 

onsiderations, the report should address (where 

ials for

ipment and systems exposed to 

vironments (internal and

♦

nts in the corrosion prevention 

♦ ilosophy

•

♦ brasive flow 

s, etc. 

•

♦

underpressure (vacuum), e.g. high/low 

erfaces, failure of control 

♦ sure

s.

•

♦

or low temperature, e.g. fire, freezing, loss 

of control devices, external 

♦

ut,

• Vib

♦ fication of process driven vibration 

sources with the potential to cause a major 

g. water hammer, reciprocating 

foreseeable direct

causes of major 

accidents have been 

taken into account

the design of the

installation. 

[Schedule 4 Part 1

para3; Sched

2

t causes of loss of containment should be 

d during des

c

applicable) the following direct causes: 

• Corrosion: 

♦ Systems for selection of mater

process equ

corrosive en

external). 

Consideration of the effects of foreseeable 

changed process conditions or 

contamina

arrangements. 

Special corrosion monitoring ph

and arrangements. 

Erosion:

Design for solids or a

conditions, cavitation, phase change

Pressure:

Identification of sources of overpressure or 

pressure int

devices, external fire, failure of safety

devices, reactions, thermal expansion, 

utility failure, etc.. 

Designed systems to prevent overpres

described linked to recognised standard

Temperature:

Identification of sources of excessive high 

of utility, failure

environment, rapid differential thermal 

effects, etc..

Designed systems to prevent temperature 

excesses and effects, e.g. insulation, 

tracing, deluge, protective barriers, layo

etc.. 

ration:

Identi

accident, e.

systems, cavitation, phase changes, etc.

and how this has been considered in 

82 
Process Safety Criteria Guidance 

design. 

man Error: 

Identification of sources of human erro

process

• Hu

♦ r in

operations, e.g. maloperation of 

pment, lack of process 

ss, misunderstood 

..

♦

ted 

ality

is

♦ effect of 

♦

error.

Note: 

It is u

explanation of how the identificat

f LOC h

valves and equi

hazard awarene

commands, unrealistic demands, lack of 

specific training or process knowledge, etc

Identification of measures aimed at 

minimising human error, e.g. dedica

storage and transfer systems, coupling 

design to prevent cross connection, etc.. 

♦ Identification of extent of safety critic

attached to human actions and how this

catered for in design. Realistic 

performance standards for safety critical 

functions during normal and emergency 

conditions, etc.. 

Defence in depth to minimise the

human failure. 

Control of process design functions to

minimise design

nacceptable for the safety report to have no

ion of direct causes 

o as been conducted. 

Criterion 12.2.1.7 

The safety report 

should show how

structures important to 

e

rt

safety have been 

designed to provid

adequate integrity.

[Schedule 4 Part 1

para3; Schedule 4 Pa

2 para 4(c)] 

Criterion 12.2.1.8 

The safety report

should show how the 

ontainment structure

to

s

l

• Details of foreseeable plant normal and 

abnormal operating conditions, including 

internal and external conditions, start-up, shutdown, turnaround, regeneration, degradation, 

•

c

has been designed

withstand the load

experienced during 

normal operation of the

plant and all 

foreseeable operationa

emergencies, etc.. 

Description of philosophy for setting design

margins over foreseeable operating conditions.

Tight operating margins may require 

justification where they are relevant to safety of 

83 
Process Safety Criteria Guidance 

extremes during its 

expected life. 

[Schedule 4 Part 1 

para3; Schedule 4 Pa

2 para 4(c)] 

rt

operation. 

Identification of significant high / low pressure 

interfaces or differential pressures affecting 

design and overpressure protection 

arrangemen

•

ts (there have been spectacular 

•

ble coincidental extremes of pressure 

failures due to a failure to appreciate this 

issue). 

Recognition of high / low temperatures and 

impact on permitted operating pressures. 

Design conditions should take account of 

foreseea

and temperature. Recognition of the possibility

of low temperatures creating a vacuum. 

Criterion 12.2.1.9 

The safety report 

should show that 

materials of 

in

ble

.

construction used

the plant are suita

for the application

[Schedule 4 Part 1 

para3; Schedule 4 Part

2 para 4(c)] 

Criterion 12.2.1.10 

The safety report 

should show that 

dequate safeguards

to

4 Part

In general terms, the safety report should: 

• Give details of the physical parameters of 

possible conditions: flows, temperatures and 

worst case scenarios, etc.. 

le short-term overstress conditions 

•

s.

ailure

a

have been provided

protect the plant 

against excursion

beyond design 

conditions 

[Schedule 4 Part 1 

para3; Schedule

2 para 4(c)]

pressures with respect to excursions, runaway, 

• Demonstrate that the design standards and 

other applied codes of practice are appropriate 

to the conditions under which the design must 

work. 

• Show that hazard identification has covered the

possibility of beyond design conditions. For 

process systems, the use made of code 

allowab

should be identified and justified and any links 

to the predictive analysis made where 

appropriate.

Describe the evaluation of excursions in 

chemical reactions, process operations, etc. 

and justify the sufficiency of the control

• Describe the philosophy for the required f

modes of valves (i.e. fail to safety). 

84 
Process Safety Criteria Guidance 

• nt

•

ntrol 

rms to warn operators

•

♦ d

esigned to prevent or warn of

ety of the plant is based. 

ting

♦

nction 

n

ould

♦

.

Show that accident history for a type of pla

has been considered where relevant. 

Justify non-use of recognised safeguards. 

• Normal operating limits: 

♦ Appropriate manual or automatic co

systems to maintain normal operating 

conditions. 

♦ Appropriate use of ala

of operating excursions beyond normal 

ranges. 

Safe operating limits: 

Identification of safety related controls an

alarms d

excursion beyond safe operating limits and 

upon which the saf

♦ Integrity of safety related controls 

(functionality, reliability, vulnerability, 

survivability, dependence on other 

systems). 

♦ Pressure relief and emergency ven

arrangements, dump systems. 

High integrity pressure protection systems 

(HIPPs) used in place of, or in conju

with, mechanical overpressure protectio

systems and other control measures sh

be justified and shown to be of adequate 

integrity. 

Interfaces with other measures such as 

shut-off of systems, flushing, reaction

inhibitors, cooling systems, venting 

systems, etc. to limit excursions beyond 

safe operating limits should be described

Criterion 12.2.1.11 

The safety report 

should describe how

safety-related control 

rt

systems have been

designed to ensure

safety and reliability

[Schedule 4 Part 1 

para3; Schedule 4 Pa

2 para 4(c)] 

Criterion 12.2.1.12 

The safety report 

should show how

systems which require

The Safety Report shows: 

 

• Any safety critical operations carried out by 

operators. 

85 
Process Safety Criteria Guidance 

human interaction have

ake

eds

art

c)]

ws when to intervene to 

carry out such an operation. 

nd

equired human response during 

lar, that important 

• ave

ety

•

been designed to t

into account the ne

of the user and be 

reliable 

[Schedule 4 Part 1 

para3; Schedule 4 P

2 para 4(

• How the operator kno

• That assumptions regarding the availability a

integrity of r

foreseeable normal and emergency operating 

states are justified. In particu

process safety critical control actions will not be 

jeopardised by changes in staff arrangements, 

that time to achieve operations has been taken

into account, or that the safety of the design is 

otherwise not critically compromised by failure 

of required operator response due to

foreseeable causes (e.g. lack of training, 

human response under high stress, exposure 

to hazards preventing required action, etc.). 

That suitable performance standards h

been developed and are monitored for saf

critical operator functions. 

An adequate and achievable response where

operator intervention is a safeguard e.g. for

detection and correction of deviations. 

• For batch plant operations: consideration of 

possibility of steps being omitted / repeated / 

carried out in the wrong order. 

asses

has e of having an

utomated system and justified the suitability of the 

Note: If human response is safety critical, the 

sor should seek evidence that the company 

xamined the costs and benefits

a

adopted approach. 

Criterion 12.2.1.13 

The safety report 

should describe the 

systems for identifying

ces

s and policies for identifying 

shed

is aware

•

gaskets and when equipment is 

e

•

locations where 

flammable substan

could be present and

how the equipment has 

been designed to take 

account of the risk. 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

The Safety Report shows (ie, the Operator 

understands): 

• The procedure

hazardous areas are based on establi

codes and standards (ie the operator

of them).

The procedures and policies for identifying 

hazardous areas are consistently applied. 

Releases of flammables through vents, from 

leaks from

opened have been considered (i.e. where th

leaks are likely to occur and what are the 

release parameters and flammable properties

of release materials are likely to be).

A diagram with hazardous area classification 

for the site. 

86 
Process Safety Criteria Guidance 

•

check rd to

the ph

ssessors are looking at the electrical equipment. 

r

s

The hazardous area classification data is used 

in the selection and location of equipment and

its maintenance and in considering plant and 

process changes. 

• The relevance and understanding of the 

Dangerous Substances and Explosive 

Atmospheres Regulations (DSEAR). 

Note: Process Safety assessors are mainly

ing what the company is doing with rega

ysical area. Control and Instrumentation

a

Mechanical assessors may also have input fo

equipment with the potential to generate hot surface

sufficient to be a source of ignition).

Criterion 12.2.2.1 

The safety report 

should show that the 

installations have been 

rds

ent

constructed to 

appropriate standa

to prevent major 

accidents and reduce 

loss of containm

[Schedule 4 Part 1

para3(a)] 

Criterion 12.2.2.2 

scribe how

e construction of all

is

ified

e

The safety report 

should de

th

plant and systems

assessed, and ver

against the appropriat

standards to ensure 

adequate safety.

[Schedule 4 Part 1 

para3(a)] 

Criterion 12.2.3.1 

ow that safe 

perating procedures

hed

ed for

.

• There is sufficient description about the safety 

management aspects of developing safe 

operating systems to avoid a major accident. 

The safety report 

should sh

o

have been establis

and are document

all reasonably

foreseeable conditions

• There is evidence of operational procedures 

which cover all reasonably foreseeable 

situations. 

• Procedures should be readily available to 

operators and be current. 

87 
Process Safety Criteria Guidance 

[Schedule 4 Part 1 

para3(b)] 

• lanation of how the operator 

es.

• s the process for 

).

Note:

relatio

proce

There is exp

develops, maintains and reviews procedur

The Safety Report describe

development of procedures. It is a team 

exercise involving people with different skills 

(ie, technical input to the content to ensure 

hazards are properly identified and controlled

There is quite a big overlap with SMS in 

n to integrating process safety knowledge into 

dures

Criterion 12.2.4.1 

The safety report 

should show that an 

appropriate 

e is

nt

nt

nts or

maintenance schem

established for pla

and systems to preve

major accide

reduce the loss of 

containment in the 

event of such 

accidents. 

[Schedule 4 Part 1 

para3(b)] 

Criterion 12.2.4.2 

The safety report 

hould show that there 

re appropriate

ake

tions

ng

s

a

procedures for 

maintenance that t

account of any

hazardous condi

within the worki

environment. 

[Schedule 4 Part 1 

para3(b)] 

Criterion 12.2.4.3 

The safety report 

hould show that 

ystems are in place to 

ned

s

s

ensure that safety

critical plant and 

systems are exami

88 
Process Safety Criteria Guidance 

at appropriate intervals 

by a competent per

[Schedule 4 Part 1 

para3(b)] 

son.

Criterion 12.2.4.4 

The safety report 

hould show that there 

a system in place to 

ed

s

is

ensure the continu

safety of the 

installations based on 

the results of periodic 

examinations and 

maintenance.

[Schedule 4 Part 1 

para3(b)] 

Criterion 12.2.5.1 

scribe the

ystem in place for 

ions

,

t 1

chedule 2 para 4(d)]

• The safety report demonstrates that there is a 

system for dealing with: 

♦ Modifications which are changes in process 

♦ P

itable technique. 

other 

ation.

• The determining

go through a formal management of change 

process. 

The safety report 

should de

s

ensuring modificat

are adequately

conceived, designed

installed and tested.

[Schedule 4 Par

para3(a); Schedule 4 

Part 2 para 4, 5(a); 

S

parameters, i.e. a robust change 

management system that looks at hazard 

and risks. 

♦ Modifications which are changes in 

supplier. 

Whether a process change needs a HAZO

or other su

♦ Updating operating procedures and 

document

system includes criteria for

when a process change is sufficient to need to

89 
Appendix 12.2: Mechanical criteria and guidance 

Mechanical Criteria Guidance 

Criterion 12.1 

The safety report 

should show a clear 

link between the 

measures taken and the 

major accident hazards 

described 

[Schedule 4 Part 1 para 

2; Schedule 4 Part 2 

para 4(a), 4(c), 5] 

This is the core of the Safety Report from the 

technical point of view and provides the link between 

identification and analysis of hazards and the 

selection of measures. 

• The findings from the hazard identification 

process have been used to identify the safety 

critical equipment for both pressurised and 

non-pressurised plant, including: 

♦ Vessels. 

♦ Tanks. 

♦ Pipework. 

♦ Seals. 

♦ Joints and flanges. 

♦ Protective systems e.g. relief devices, 

emergency isolations. 

♦ Secondary containment. 

♦ Rotating machines including pumps, 

compressors, turbines, agitators, 

conveyors, etc.. 

• The scenarios are representative. They can be 

used for focussing on: 

♦ Low probability high consequence events 

e.g. failure of pressure vessels. 

♦ Higher probability generally lower 

consequence events e.g. failure of small 

bore pipework. 

♦ Direct causes of failure e.g., corrosion, 

mechanical impact, overpressure, etc.. 

• Maintenance and inspection: 

♦ Maintenance system described is 

appropriate for the identified measures.

♦ The operator has a suitable and sufficient

inspection regime. 

Criterion 12.2 

The safety report

should demonstrate

how the measures 

taken will prevent 

foreseeable failures

which could lead to 

major accidents 

This is effectively a summary of all the other criteria. 

The assessor should come back to this when the 

other criteria have been assessed, and then 

conclude: 

• Whether all the assessed criteria have been 

met. 

•

on.

How significant the failure of one or more 

criteria is/are to the overall safety justificati

90 
Mechanical Criteria Guidance 

• Any failure to recognise appropriate standards. 

• Full application of the standards and any 

deviations. 

Criterion 12.2.1.1 

The safety report 

should show that the 

establishment and 

installations have been 

designed to an 

appropriate standard. 

[Schedule 4 Part 1 para 

3; Schedule 4 Part 2 

para 4(c), 5(a)] 

The safety report should describe relevant codes and 

standards. Where these deviate from recognised 

codes or standards, the following information should 

be in the Safety Report.

• List of all deviations/exceptions. 

• Justification why these have been 

adopted. 

• Demonstration that the deviation or 

exception provides a level of integrity at 

least as high as that provided by the

relevant code. 

This criterion is related to criterion 12.2.1.7.

Criterion 12.2.1.2 

The safety report 

should show that a 

hierarchical approach 

to the selection of 

measures has been 

used. 

[Schedule 4 Part 1 para 

(3); Regulation 4] 

This is an important criterion which has a closely 

defined 4 stage hierarchy: eliminate (inherent 

safety), prevent, control, mitigate, in that order of 

priority. For mechanical discipline assessment:

• The identification of suitable management 

system controls for maintenance and

inspection schemes as prevention measures.

• The appropriate selection of equipment to 

minimise or prevent the likelihood or 

consequences of failure (e.g. use of sealless 

pumps, use of corrosion resistent materials, 

etc.). 

Criterion 12.2.1.3 

Layout of the plant 

should limit the risk 

during operations, 

inspection, testing, 

maintenance, 

modification, repair and 

replacement. 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

Good layout in design may be influenced by 

equipment features: 

• Evidence that catastrophic failure of equipment 

has been considered in setting equipment 

layouts, (e.g. what might fail, would it create 

missiles and where might they go? Could the 

fallout from equipment failure be reduced by 

careful layout considerations (e.g. 

orientation)?)

• Consideration of dropped objects arising from 

construction and maintenance. 

• Consideration of lifting restrictions relating to 

equipment maintenance and the impact for 

layout design. 

• Consideration of access limitations for 

maintenance and inspection. 

91 
Mechanical Criteria Guidance 

Criterion 12.2.1.4 

Utilities that are needed 

to implement any

measure defined in the 

safety report should 

have suitable reliability,

availability and 

survivability.

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c), 5(a)] 

The utilities issues typically include failure of services 

which could lead to a major accident

• The impact that the failure of utilities could 

have on the mechanical systems is assessed,

including provision and integrity of back-up 

systems 

• Demonstration of the reliability of back-up 

systems through monitoring, alarm and testing 

regimes. 

Criterion 12.2.1.5 

The safety report 

should show that 

appropriate measures 

have been taken to 

prevent and effectively

contain releases of 

dangerous substances. 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c), 5(a)] 

Initial integrity. 

Measures for prevention and containing releases.

• The Safety Report describes suitable means 

for preventing loss of containment through the 

identification of integrity (function, reliability, 

vulnerability, survivability) of mechanical 

equipment such as: 

♦ ESDVs 

♦ Manually operated isolations in safety

critical duty 

♦ Excess flow valves and non-return valves 

♦ Protection arrangements for rotating

equipment, (e.g. cavitation, dry running, 

deadhead conditions, seal protection.) 

♦ Joint integrity (flanged, screwed, couplings, 

etc.). 

♦ Temporary repairs (e.g. clamps, wraps). 

♦ Dry break couplings 

♦ Bellows and flexible joints. 

♦ Secondary containment. 

Criterion 12.2.1.6 

The safety report 

should show that all 

foreseeable direct 

causes of major 

accidents have been 

taken into account in 

the design of the 

installation. 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

Initial integrity 

Direct causes of loss of containment should be 

considered in the design of suitable measures. For 

mechanical considerations, the report should 

address (where applicable) the following direct 

causes of LOC: 

• Corrosion: 

♦ Systems for selection of materials for 

process equipment and systems exposed to 

corrosive environments (internal and 

external). 

♦ Consideration of the effects of foreseeable 

changed process conditions or 

contaminants in the corrosion prevention

92 
Mechanical Criteria Guidance 

arrangements. 

♦ Corrosion monitoring philosophy and 

arrangements. Specific threats such as: 

Corrosion under insulation, deadlegs, 

buried or masked systems, soil/air 

interfaces etc. 

• Erosion: 

♦ Design for solids or abrasive flow 

conditions, cavitation, phase changes, etc. 

• External loading: 

♦ Equipment loadings, e.g. design of 

equipment and piping system supports for 

use during construction and normal 

operation. 

• Impact: 

♦ Consideration in design for foreseeable 

sources of impact damage, including

missiles, dropped objects and swinging 

loads during construction and maintenance, 

blast loadings. 

• Pressure: 

♦ Designed systems to prevent overpressure or 

vacuum described linked to recognised 

standards. 

• Temperature: 

♦ Designed systems to prevent excess 

mechanically induced temperature 

excursions described linked to recognised 

standards. 

♦ Design for low temperature effects (e.g. 

brittle failure avoidance, freezing, etc.) 

• Vibration: 

♦ Machine induced vibration 

♦ Consideration of small bore connections 

and their supports. 

♦ Consideration of process induced vibration, 

e.g. water hammer, reciprocating systems, 

cavitation, phase changes, etc. and how 

this has been considered in design.

• Wrong Equipment: 

♦ Equipment supply standardisation and 

management approaches to minimise LOC 

(e.g. small bore fittings).

93 
Mechanical Criteria Guidance 

 Defective equipment. 

enance and inspection 

o

♦

,

ote: It is unacceptable for the safety report to have 

•

• Human Error: 

♦ Control of maint

activities to reduce human contribution t

LOC during system invasive activities. 

Training implications for LOC, hazard 

awareness, equipment specific training

etc.. 

N

no explanation of how the identification of direct 

causes of LOC has been conducted.

Criterion 12.2.1.7 

nt to

e

chedule 4 Part 1

art

itial integrity 

his criterion applies to all major vessels, pipework, 

There is demonstration of adequate initial 

rence to international codes and 

♦ to principal design parameters 

♦

-house ndards should be assessed 

, or design 

es fitness for 

g of

The safety report 

should show how

structures importa

safety have been 

designed to provid

adequate integrity.

[S

para3; Schedule 4 P

2 para 4(c)] 

In

T

rotating machines (e.g. pumps, compressors, etc.) 

and valves if they feature in major accident 

scenarios. 

•

integrity: 

♦ By refe

standards. 

By reference

(e.g. design pressure and temperature) and 

category of construction if applicable.

Relevance and applicability of codes and

standards. 

In codes and sta

for their relevance (a suitably robust description of 

how the company has validated them) based on 

prima facie evidence. 

• When no standards have been used

parameters are not known: 

♦ the company demonstrat

purpose showing how it has conducted

design reviews (for novel designs, mixin

standards, non-standard approaches). The 

impact of such novel design approaches on 

required systems for monitoring, 

maintenance, etc. should also be described 

to depth consistent with the potential risk of 

adopting such designs.

Criterion 12.2.1.8 itial integri

The safety report 

In ty. 

 

94 
Mechanical Criteria Guidance 

should show how the 

containment structure

has been designed to 

withstand the loads 

experienced during 

normal operation of

plant and all 

foreseeable o

extremes during its 

expected life. 

the

perational

chedule 4 Part 1

art

is criterion is related to criterion 5.2.1.7. 

Compare design conditions with expected 

ess

margins are demonstrated where 

♦ xtreme conditions might 

he

♦ is sufficiently proportionate to the 

ontinuing integrity:

Demonstration of how the operator monitors 

nce

[S

para3; Schedule 4 P

2 para 4(c)] 

Th

•

operating conditions for equipment and ass

the margin: 

♦ Adequate

appropriate.

Where more e

occur they have been accounted for in t

design. 

Evidence

risk and complexity of the process.

C

•

and ensures the plant continues to operate 

within designed limits. Changed operating 

conditions may affect the intended performa

of some plant, introducing additional hazards or 

integrity management requirements. 

Criterion 12.2.1.9 

in

chedule 4 Part 1

art

The Safety Report should demonstrate the 

nd

ve

ion

• ent approach 

• f Parent Metal Inspection (PMI) 

ay be

[Note: Detailed issues about the suitability of certain 

g

The safety report 

should show that 

materials of 

construction used

the plant are suitable 

for the application. 

[S

para3; Schedule 4 P

2 para 4(c)] 

•

compatibility between operating conditions a

the material of the containment systems (eg, 

for known corrosive agents). (See Criterion 

5.2.1.6.). The report should link the aggressi

nature of the operating environment and 

operating conditions to the material select

process for specified equipment. 

The report demonstrates a consist

in the choice of materials rather than just a 

catalogue of material specifications for the 

whole plant.

Description o

regime for verification of bought-in raw 

materials or equipment where applied (m

important for pre-construction of modification

reports). 

materials may be carried forward to the inspection 

programme for existing sites, but may require raisin

directly for pre-construction or modification reports

during the assessment stage.] 

Criterion 12.2.1.10 

ds

itial and in-service integrity. 

Mechanical measures in place to prevent 

The safety report 

should show that 

adequate safeguar

have been provided to

In

•

excursion conditions are described.

95 
Mechanical Criteria Guidance 

protect the plant 

against excursion

beyond design 

conditions 

chedule 4 Part 1

art

Demonstration that appropriate provision has 

other

♦

♦

ithin

ry packaged

all

[S

para3; Schedule 4 P

2 para 4(c)] 

•

been made for excursion relief, through: 

♦ Pressure or vacuum relief devices, or

pressure protection arrangements. 

♦ Description where the nature of the process

fluid may compromise effective operation of 

the relief devices (e.g. fouling). 

Description of relief system testing regimes. 

♦ Description of potential excursions (e.g. 

overfill / underfill, starvation, cavitation, 

deadheading of pumps, etc.) 

Reverse rotation / overspeed of 

compressors or turbines. 

♦ Provision of suitable measures w

packaged units. (Proprieta

equipment may not meet the same 

standards adopted elsewhere in the over

design philosophy for the site). 

Criterion 12.2.1.11 

The safety report 

w

rol

art

should describe ho

safety-related cont

systems have been 

designed to ensure 

safety and reliability

[Schedule 4 Part 1 

para3; Schedule 4 P

2 para 4(c)] 

Criterion 12.2.1.12 

The safety report 

uire

le 4 Part 1

ara3; Schedule 4 Part

should show how

systems which req

human interaction have

been designed to take 

into account the needs 

of the user and be 

reliable 

[Schedu

p

2 para 4(c)] 

Criterion 12.2.1.13 

The safety report 

ng

• The report identifies where mechanical 

equipment may generate an ignition source. 

should describe the

systems for identifyi

locations where 

flammable substances 

(e.g. equipment hot surface generation 

potential, spark generation potential, etc.). 

96 
Mechanical Criteria Guidance 

could be present

how the equipment has

been designed to take

account of the risk. 

[Schedule 4 Part 1 

and

para3; Schedule 4 Part

2 para 4(c)] 

Criterion 12.2.2.1 

he safety report 

he 

been

r

nt

ara3(a)]

Initial integrity 

relevant to construction of new and 

cent (e.g. as part of a modification) plant so as to 

hey are less dependent on the 

for

nt 

t to mechanical

ngineering, the Design Code (e.g. BS PD5500 for 

s) will 

initial 

integrity: 

rds.

if

of codes and standards.

T

should show that t

installations have

constructed to 

appropriate standards 

to prevent majo

accidents and reduce 

loss of containme

[Schedule 4 Part 1 

p

This criterion is

re

gain assurance that the construction phase will be

effectively managed. 

This criterion likely to have a limited application for 

older plants because t

initial integrity issues. It is not unusual that 

construction or commissioning information is not be 

available for the old plant. Primary interest

established installations is more likely to be 

associated with modifications involving new pla

integrated with old systems. 

For most equipment of interes

e

Pressure Vessels or BS2654 for Storage Tank

cover construction and inspection / test standards as

well as design. This criterion will therefore generally 

be covered by assessment carried out against 

Criterion 5.2.1.7. 

• There is demonstration of adequate 

♦ By reference to international codes and

standa

♦ By reference to category of construction

applicable. 

♦ By explaining the relevance and 

applicability

Criterion 12.2.2.2 

The safety report 

w

f all

Initial inte

een provided to show that:

ioning of

the plant has been documented and the 

[Note hould be provided

should describe ho

the construction o

plant and systems is 

assessed, and verified

against the appropriate

standards to ensure 

adequate safety.

grity. 

Evidence has b

• Initial inspection, testing and commiss

information is retrievable. 

: Discussion of this topic s

97 
Mechanical Criteria Guidance 

[Schedule 4 Part 1

ara3(a)]

ven for older plant, where information may not be 

p

e

available, to indicate how the company has 

considered the implications for major accidents.] 

Criterion 12.2.3.1 

The safety report 

res

r

ara3(b)]

and Operations safety reports 

should describe how it is assured that

should show that safe 

operating procedu

have been established 

and are documented fo

all reasonably

foreseeable conditions. 

[Schedule 4 Part 1 

p

Continuing integrity. 

• Pre-operations

mechanical plant and equipment are always 

operated within safe limits? 

Criterion 12.2.4.1 

he safety report 

is

or plant

Part 1

ara3(b)]

Continuing integrity. 

onstruction reports 

r, repair,

place mechanical plant and equipment). 

ve maintenance

ility based, etc.). 

ting to 

♦

•

em, 

nogram,

♦ s.

♦

T

should show that an 

appropriate 

maintenance scheme

established f

and systems to prevent 

major accidents or 

reduce the loss of 

containment in the 

event of such 

accidents. 

[Schedule 4

p

Not applicable to pre-c

Routine maintenance is a key issue (monito

re

• The Safety Report indicates: 

♦ There is a relevant proacti

regime in place. 

♦ There is a maintenance philosophy (e.g. 

time-based, reliab

♦ There a system of prioritisation of 

maintenance activity, especially rela

safety critical plant. 

Performance monitoring is in place. 

The Safety Report describes: 

♦ The maintenance administration syst

including a department orga

relevant job descriptions, roles and 

responsibilities. 

Overview of key maintenance activitie

The safety critical activities where 

appropriate.

Criterion 12.2.4.2 

The safety report 

there 

Usually only apply to the extent of identifying issues 

r the ins mme where specific 

should show that

are appropriate 

procedures for 

maintenance that take 

account of any

hazardous conditions 

within the working 

fo pection progra

hazardous activities are identified. 

98 
Mechanical Criteria Guidance 

environment. 

[Schedule 4 Part 1

para3(b)]

Criterion 12.2.4.3 

he safety report 

ce to

ed

rvals

ara3(b)]

In-service integrity: 

xamination of safety critical 

lant.

]

all equipment containing hazardous fluids. 

the results of maintenance and inspection and 

• .

.

the

onstrated, e.g. by 

as

♦

e employed.

• Where there is Risk Based Inspection (RBI), 

the Safety Report: 

are

what capacity.

T

should show that 

systems are in pla

ensure that safety

critical plant and 

systems are examin

at appropriate inte

by a competent person.

[Schedule 4 Part 1 

p

Periodic in-service e

p

[Note: Not applicable to pre-construction reports.

Apply to

• There is a system which enables learning from

failure history (for impact on inspection 

frequency). 

Inspection regime adequately described

• Inspection frequencies have been justified

• Inspection system shows appropriate

prioritisation of safety critical equipment. 

• Inspection arrangements are described in

Safety Report such that:

♦ The indepenedence and competence of 

inspection staff is dem

reference to UKAS accreditation or 

compliance with relevant standards such

BSEN 45004. 

Where 1st, 2nd or 3rd party accredited

organisations ar

♦ Gives an overview of system used (or 

reference). 

♦ Indicates whether external consultants

used and in

♦ Indicates how changes in inspection

frequency indicated by the RBI process are

managed (e.g. a cautious approach).

Criterion 12.2.4.4 

The safety report 

here 

e to

In-servi e

idence of post inspection followfindings are analysed with judgements on 

should show that t

is a system in plac

ensure the continued 

safety of the 

installations based on

the results of periodic

examinations and 

c integrity: 

This concerns the follow-up to inspections of 

Criterion 5.2.4.3.

• Check for ev

up: 

♦ Safety Report indicates that inspection 

99 
Mechanical Criteria Guidance 

maintenance. 

[Schedule 4 Part 1

ara3(b)]

ontinued fitness for service. 

p

c

♦ The safety report indicates a system for

reviewing inspection findings and a means

of managing follow-up actions. 

♦ Liaison and dialogue with independent 

inspection authorities, particularly where

revisions of Written Schemes of 

Examination are necessary. 

Criterion 12.2.5.1 

The safety report 

should describe the 

ions

,

)]

Pre-cons

sys d managing

ild

Initial

Change may inadvertently reduce safety of 

pt has been properly 

change control process addresses 

In service

• The modifications procedure integrates the 

the potential impact of new 

•

system in place for

ensuring modificat

are adequately

conceived, designed

installed and tested.

[Schedule 4 Part 1 

para3(a); Schedule 4 

Part 2 para 4, 5(a); 

Schedule 2 para 4(d

truction and pre-operations report: 

• tem in place for identifying an

modifications during the design and bu

process

integrity: 

•

plant: 

♦ The modification conce

addressed for mechanical integrity. 

♦ The

changes that might be made during 

construction that could affect mechanical 

integrity. 

integrity: 

integrity management of new mechanical plant

and addresses

equipment on existing systems. 

The modification procedure includes changes 

to existing plant. 

100 
Appendix 12.3: Control & instrumentation criteria and guidance

Control & Instrumentation 

Criteria 

Guidance 

Criterion 12.1 

The safety report 

should show a clear 

link between the 

measures taken and the 

major accident hazards 

described 

[Schedule 4 Part 1 para 

2; Schedule 4 Part 2 

para 4(a), 4(c), 5] 

• The report should provide links between the 

Major Accident Scenarios (MAS) and the risk 

reduction measures including, SIS. The level of 

demonstration should be proportionate to the 

consequence/severity of the MAS. 

• The choice of representative MAS should have 

been influenced by the requirement for the 

Company to demonstrate that risk reduction 

measures, including SIS, have suitable safety 

and reliability through design, and that this is 

maintained throughout the lifecycle of the 

system. 

• Where Safety Instrumented Systems are linked 

to reducing risk of MAS the report should 

clearly demonstrate how the reliability of those 

systems has been determined, and how this is 

commensurate with the risk analyses

techniques used in the S.R for demonstration 

that risks have been reduced to ALARP. 

• For SIS designed to current recognised 

industry standards, such as BSEN61508/61511 

it should be demonstrated that the risk 

assessment method used to determine Safety 

Integrity Levels (SIL) has been calibrated to 

take account of consequence/severity of major 

accident scenarios, and also that targets for 

acceptable residual levels of risk are at least as 

rigorous as those promoted in HSE guidance 

“Reducing Risks Protecting People”. 

• For legacy systems (designed pre 

61508/61511) it is often the case that initial 

requirements for SIS in terms of functionality 

and reliability have been determined from 

historical hazard identification processes, e.g 

HAZOPs. However, often the reliability of the 

SIS has not been determined from a risk 

assessment, or the risk assessment used at 

the time may not be suitable for COMAH 

purposes. The Company should clearly state 

what the current status is and any reviews they 

plan to carry out. 

• The assessor should note areas where there 

may be obvious SIS omissions. This should be 

discussed with appropriate members of 

assessment team and a decision made if it 

could be a credible further measure that the 

101 
Control & Instrumentation 

Criteria 

Guidance 

Company should be implementing. In extreme 

cases this omission may be regarded as a 

serious deficiency. 

The risk assessment process should result in 

consideration of further measures for MAS. This 

should not be confined to the representative set. 

Criterion 12.2 

The safety report 

should demonstrate 

how the measures 

taken will prevent 

foreseeable failures 

which could lead to 

major accidents 

See 12.1 

Criterion 12.2.1.1 

The safety report 

should show that the 

establishment and 

installations have been 

designed to an 

appropriate standard. 

[Schedule 4 Part 1 para 

3; Schedule 4 Part 2 

para 4(c), 5(a)] 

• The S.R should include information on the 

standards used for: 

♦ Safety Instrumented Systems 

♦ Process Control Systems 

♦ Hazardous Area Classification 

♦ Standards used for design, 

maintenance/testing of EX equipment

♦ Design/maintenance/testing of: Fixed 

electrical systems H.V and L.V. 

♦ Earthing systems 

♦ Lightning protection systems 

♦ Fire & gas detection systems 

The duty holder should identify and justify cases 

where the design of their installation fails to meet the 

established standards. 

Criterion 12.2.1.2 

The safety report 

should show that a 

hierarchical approach 

to the selection of 

measures has been 

used. 

[Schedule 4 Part 1 para 

(3); Regulation 4] 

This is an important criterion which has a closely 

defined 4 stage hierarchy: eliminate (inherent safety), 

prevent, control, mitigate, in that order of priority. For 

electrical and control discipline assessment: 

• The report should describe the application of 

suitable layers of protection. A typical approach 

could be: 

♦ Robust process control (including human 

interaction) 

♦ Alarms to indicate excursions from normal 

operating envelope. 

♦ Designated Safety Instrumented Systems.

♦ Final protection system (often mechanical, 

i.e. pressure relief systems, however, could

be a high integrity SIS). 

102 
Control & Instrumentation 

Criteria 

Guidance 

♦

he number of layers and the amount of risk

the

Mitigation systems 

T

reduction for each layer should be relevant to

consequence/severity of the range of potential 

hazardous events. 

Criterion 12.2.1.3 

t

epair and

chedule 4 Part 1

art

he report should provide an overview of how the 

How the layout of control, instrument and 

d

• of control centres within the plant 

ding 

• trol room equipment to take

• potential for 

es to

Layout of the plan

should limit the risk

during operations, 

inspection, testing,

maintenance, 

modification, r

replacement. 

[S

para3; Schedule 4 P

2 para 4(c)] 

T

following has been considered. 

•

electrical equipment has taken account the

needs of normal operations, maintenance an

testing requirements, and emergency 

operations. 

The location

and their vulnerability to potential major 

accident events. This should have been

subject to suitable risk assessments (inclu

Occupied Buildings Assessments where 

applicable).

Layout of con

account of normal and emergency control

conditions (e.g. ergonomics of normal and 

emergency control panels). 

Minimised vulnerability, and

common cause failure, of essential servic

safety critical instrumented systems and key 

process control applications. 

Criterion 12.2.1.4 

eded

the

ty,

chedule 4 Part 1

art

A description of each utility and its back-up 

• at the effect 

ss. The

•

ent

• rip is a potential initiator. Suitable 

Utilities that are ne

to implement any

measure defined in

safety report should 

have suitable reliabili

availability and 

survivability.

[S

para3; Schedule 4 P

2 para 4(c), 5(a)] 

•

systems should be provided. It should be 

identified which utilities are essential for 

operation of key safety systems. 

The report should demonstrate th

of loss of key utilities has been considered as 

part of a structured hazard 

identification/analyses proce

assessment should have ensured that control 

systems and safety systems fail to a safe state

and that the consequence of a utilities failure 

does not act as a major accident initiator. 

Effects of loss of electrical supply on other

utilities such as fire water provision, instrum

and compressed air, nitrogen supplies should 

all have been considered in such an

assessment. 

Every power t

diversity and redundancy should be inherent 

103 
Control & Instrumentation 

Criteria 

Guidance 

within systems to reduce the risk of common 

mode or common cause failures. 

Problems likely to be encountered i

of internal generation, loss of hydraulic 

pressure to ESD valves, loss of air in air

reservoirs on valves. 

Consideration of the ef

nclude loss 

• fects of dips in power 

• ial utilities 

• electrical supply and 

ble

te

• s/UPS systems should be subject to 

•

ormally ESD systems should fail to a safe state. 

rovisions

supplies as well as full power loss. 

Measures to detect failure of essent

should be described. 

Demonstration that the

associated protection systems have been 

designed and are being maintained to suita

industry standards. Electrical distribution 

systems should be designed to discrimina

faults to prevent cascading the failure across

the site. 

Generator

suitable periodic maintenance/testing regimes. 

Instrument air system should be described and 

quality specification should be included 

N

However, safety related systems which rely on a 

positive power supply should be identified. 

Demonstrations should show that suitable p

are in place to ensure that these systems achieve 

their required function under all foreseeable 

shutdown conditions. 

Criterion 12.2.1.5 

res

ly

es.

chedule 4 Part 1

art

Process failures to danger, including how 

can

Demonstration that fire & gas detection 

be

logy description

ification. – i.e. 

♦ ards.

tors

tors

The safety report 

should show that 

appropriate measu

have been taken to 

prevent and effective

contain releases of 

dangerous substanc

[S

para3; Schedule 4 P

2 para 4(c), 5(a)] 

•

instrumentation and control based failures

lead to loss of containment, should have been 

considered by suitable hazard identification and

analysis techniques. 

•

systems are suitable for purpose should

made. Information should be provided on the

following: 

♦ Techno

♦ Safety requirements spec

what is it installed to do?

Reference to design stand

♦ Rationale for positioning of detec

♦ Measures in place for protecting detec

against poisoning.

♦ Maintenance and testing procedures for 

104 
Control & Instrumentation 

Criteria 

Guidance 

systems.

Criterion 12.2.1.6 

een

chedule 4 Part 1

art

he report considers control, instrumentation and 

f

s

 Corrosion 

electical and control systems 

e

 Erosion 

f internal instrument components 

External Loading 

potential risks to plant from

s to

 Wrong Equipment 

s instrumentation as a 

.

Human Erro

rived from misuse of safety 

n

The safety report 

should show that all 

foreseeable direct 

causes of major 

accidents have b

taken into account in

the design of the 

installation. 

[S

para3; Schedule 4 P

2 para 4(c)] 

T

electrical systems and their use as a direct cause o

failure, and discusses how this has influenced the 

selection of measures. Potential failure mechanism

for consideration include: 

•

♦ Corrosion of

which could lead to a direct failure, 

blockage of instruments by corrosion

products. Materials selection should b

suited to the process 

•

♦ Erosion o

due to solids, abrasive flow conditions, 

cavitation, phase change, high pressure

drop, etc. 

•

♦ Assessment of

lightning. Suitable protection systems to 

prevent/mitigate fire/shock and to provide

surge protection systems should be 

installed where necessary. Reference

suitable industry standards should be

made. 

•

♦ The report addresse

direct cause of failure, e.g.use of wrong 

type of equipment such as transmitters, etc

• r

♦ Failures de

system overrides during normal operatio

or after maintenance, under temporary 

operating arrangements, etc. 

Criterion 12.2.1.7 

nt to

The safety report 

should show how

structures importa

safety have been 

designed to provide

adequate integrity.

[Schedule 4 Part 1

105 
Control & Instrumentation 

Criteria 

Guidance 

para3; Schedule 4 P

2 para 4(c)] 

art

Criterion 12.2.1.8 

the

perational

chedule 4 Part 1

art

The safety report 

should show how the 

containment structure

has been designed to 

withstand the loads 

experienced during 

normal operation of

plant and all 

foreseeable o

extremes during its 

expected life. 

[S

para3; Schedule 4 P

2 para 4(c)] 

Criterion 12.2.1.9 

used in

chedule 4 Part 1

art

Corrosion and the products of corrosion can impact 

Corrosion/erosion potential has been taken into 

• rosion may be 

ote see also Criterion 12.2.1.6] 

The safety report 

should show that 

materials of 

construction

the plant are suitable 

for the application. 

[S

para3; Schedule 4 P

2 para 4(c)] 

on the reliability of safety instrumented systems: 

•

account in material selection and affected the 

selection of equipment (e.g. Hi/Lo pressure 

letdown; entrained solids; use of protective 

barriers for transmitters, etc.). 

Awareness that products of cor

sourced remote from the location of affected 

instrumentation (i.e. system awareness is 

required in selecting measures) 

[N

Criterion 12.2.1.10 

ds

chedule 4 Part 1

art

There is an appropriate overall process control 

ived

trol,

• a system for

istory

• enance

The safety report 

should show that 

adequate safeguar

have been provided to

protect the plant 

against excursion

beyond design 

conditions 

[S

para3; Schedule 4 P

2 para 4(c)] 

•

strategy based on an understanding of the 

hazards associated with the processes, der

from structured identification and analysis of 

those hazards. There should be a system for

determining, recording and reviewing safe 

operating limits and how these relate to con

alarm and trip settings: 

There should be in place

reviewing settings based on operating h

and accounting for any modifications. 

The safety report describes how maint

activities are prevented from overcoming 

106 
Control & Instrumentation 

Criteria 

Guidance 

safeguards such as interlocks and the inte

of safety related control systems. 

grity

Criterion 12.2.1.11 

ow

chedule 4 Part 1

art

If the Safety Instrumented System (SIS) was 

tive,

R

If the system has been designed prior to this 

rent

• rly the intention 

rds

• ety and reliability

system

♦ dards the system was 

♦ y which the required risk

♦ res that the relevant 

The safety report 

should describe h

safety-related control 

systems have been 

designed to ensure 

safety and reliability

[S

para3; Schedule 4 P

2 para 4(c)] 

•

designed after BSEN61508 standard was 

released (2000) it, or some suitable alterna

should have been used to design the system. 

O

•

date then evidence should be provided, which

demonstrates that suitable levels of safety and

reliability have been incorporated in the design 

of the system. The duty holder should also 

state the principles of design that were inhe

within the legacy standard and were later 

incorporated in BSEN61508. 

The SR should also state clea

of the Company with regard to carrying out 

reviews of legacy systems to current standa

such as BSEN61508/61511. 

Demonstration of suitable saf

may be achieved through use of examples of 

SIS linked to major accident scenarios. The 

information provided should include:

♦ A description of the safety related

and its functions. 

Details of the stan

designed to.

The process b

reduction and safety integrity for the 

function was identified. 

How the Company ensu

safety integrity is achieved through design 

of the system, and is continued throughout 

its lifecycle by suitable proof testing and 

maintenance. 

Criterion 12.2.1.12 

uire

le 4 Part 1

The safety report shows that over reliance on 

• are highly 

uld

gh

The safety report 

should show how

systems which req

human interaction have

been designed to take 

into account the needs

of the user and be 

reliable 

[Schedu

•

operators to prevent, control or mitigate 

hazardous events is avoided. 

Process control systems which

reliant on operator intervention to keep the

process within safe operating envelopes sho

have suitable independent safety layers of 

protection to prevent, mitigate hazardous 

events. In arrangements such as these the

assessor should examine the potential for hi

107 
Control & Instrumentation 

Criteria 

Guidance 

para3; Schedule 4 P

2 para 4(c)] 

art

• perator is part of a safety related 

which

• ation to

down

•

demand rates on the safety related layers of 

protection. 

Where the o

control loop, and so has a performance 

function, the duty holder should have 

realistically assessed the reliability with

the operator performs the function. 

The Company should provide inform

describe how they have assessed effects of 

alarms experienced by operators in normal 

operation. This should also consider the 

potential for alarm flood situations in shut

situations. (Note: EEMUA guidance is a widely 

recognised baseline standard.) 

Criterion 12.2.1.13 

e

g

nces

s

chedule 4 Part 1

art

ples of hazardous area assessments 

the

o

[Note: overlap with Process Safety] 

ignition sources should also have been 

),

nt

•

The safety report 

should describe th

systems for identifyin

locations where 

flammable substa

could be present and 

how the equipment ha

been designed to take 

account of the risk. 

[S

para3; Schedule 4 P

2 para 4(c)] 

• Exam

related to MAS areas should be included in

report. This should have been carried out to 

current industry standards (DSEAR, BSEN 

60079-10). Assessment for dusts should als

be provided. 

• 

• Other

considered. Look for mention of – lightning 

protection, radio frequency ignition, static 

electrical discharges (internal and external

vehicles and fork lift trucks, portable equipme

(particularly visitor’s). 

Criterion 12.2.2.1 

he 

dards

uce

chedule 4 Part 1

instrumentation and electrical systems, 

Demonstrates appropriate construction controls 

• es competency of construction 

• nstruction 

• age, assess and 

The safety report 

should show that t

installations have been

constructed to 

appropriate stan

to prevent major 

accidents and red

loss of containment 

[S

para3(a)] 

For control,

the safety report: 

•

to ensure plant is built in accordance with 

design and to appropriate construction 

standards. 

Demonstrat

personnel. 

Considers the impact of planned co

activity on existing facilities and their safe 

operation where relevant. 

Describes systems to man

record changes arising during construction. 

Criterion 12.2.2.2 For control, instrumentation and electrical systems, 

108 
Control & Instrumentation 

Criteria 

Guidance 

The safety report 

should describe h

the construction of all

plant and systems is 

assessed, and verified

against the appropriate

standards to ensure 

adequate safety.

ow

chedule 4 Part 1

o

or Pre-Construction and Pre Operations reports: 

Description of the verification processes 

s

• mmissioning

• ngements for 

[S

para3(a)] 

the safety report should demonstrate that initial 

commissioning information regarding inspection and 

testing of the plant is documented, and that the 

information is retrievable. Subsequent changes t

settings etc. should be recorded and part of suitable 

modifications procedures. (See section 12.2.5.1). 

F

•

applied during construction phase activitie

associated with relevant systems. 

Description of arrangements for co

trials to confirm required performance, limits of 

operation and safety provisions. 

Description of documentation arra

recording of verification activities and results 

associated with construction. 

Criterion 12.2.3.1 

ditions.

chedule 4 Part 1

ll safety reports should describe how it is assured 

The safety report 

should show that safe 

operating procedures 

have been established

and are documented for

all reasonably

foreseeable con

[S

para3(b)] 

A

that electrical, control and instrumentation systems 

and equipment are always operated within safe 

limits. 

Criterion 12.2.4.1 

scheme is

nt

chedule 4 Part 1

For control, instrumentation and electrical systems: 

The Safety Report should provide relevant 

:

♦

♦ ed out in a

♦ rioritisation of work. 

ied

♦ rical & earthing systems are 

The safety report 

should show that an 

appropriate 

maintenance

established for plant 

and systems to preve

major accidents or 

reduce the loss of 

containment in the

event of such 

accidents. 

[S

para3(b)] 

•

information and examples that demonstrate

♦ There are suitable proactive maintenance/

testing / inspection regimes in place based 

on relevant industry standards. 

There is a suitable maintenance 

administration system. 

Planning of work is carri

structured fashion. 

There a system of p

♦ Safety critical activities are clearly identif

♦ There is proof testing of safety instrumented

systems. 

Fixed elect

subject to suitable periodic 

inspection/maintenance and testing. 

109 
Control & Instrumentation 

Criteria 

Guidance 

♦

n

♦ monitoring is in place

The duty holder should demonstrate that 

are

aining are used. 

ised

est Equipment and Tools: 

Suitable procedures should be in place to 

ments and tools are suitable for 

♦

Process instrumentation should also be

subject to suitable maintenance/calibratio

and testing.

Performance

•

persons carrying out maintenance/testing

competent to do so and that: 

♦ Recognised schemes for tr

♦ There is ongoing refresher training. 

♦ In accordance with basic engineering 

standards, the duty holder uses recogn

schemes for training in areas of specialised 

maintenance, inspection and testing. 

T

•

ensure that:

♦ test instru

purpose. 

Calibration of test equipment is carried out 

on a regular basis by competent persons. 

♦ Accredited test houses are used to calibrate

key test equipment. 

Criterion 12.2.4.2 

here 

t take

art 1

Demonstration should be made that suitable 

in a safe

• ty

us

• et of Electrical Safety

The safety report 

should show that t

are appropriate 

procedures for 

maintenance tha

account of any

hazardous conditions

within the working 

environment. 

[Schedule 4 P

para3(b)] 

•

procedures are in place to ensure that 

maintenance /testing of electrical and 

instrumentation systems is carried out

fashion. It is essential that the Company have 

considered the risks for both personal safety

and for the potential hazardous effect the work

may have in terms of initiators on the plant. 

For potentially hazardous work suitable safe

management procedures should be in place. 

This should be based on suitable risk 

assessments, or in the case of more hazardo

situations be carried out under a suitable 

Permit To Work system. 

Company should have a s

rules based on current industry standards. (e.g. 

current editions of HSG85, Memorandum of 

Guidance, Electricity at Work Regulations 

should be used as benchmark). 

Criterion 12.2.4.3 

ce to

See a

mples of 

The safety report 

should show that 

systems are in pla

ensure that safety

lso 12.2.4.1 and 12.2.4.2 

• The safety report should provide exa

how proof testing for Safety Instrumented 

Systems (SIS) is carried out and how test 

110 
Control & Instrumentation 

Criteria 

Guidance 

critical plant and 

systems are examin

at appropriate inte

by a competent person.

[Schedule 4 Part 1 

ed

rvals

ara3(b)]

ing

p

intervals are determined and reviewed (tak

account of performance). 

Criterion 12.2.4.4 

he safety report 

here 

e to

periodic

rt 1

ara3(b)]

Addressed in 12.2.4.1 

T

should show that t

is a system in plac

ensure the continued 

safety of the 

installations based on

the results of

examinations and 

maintenance. 

[Schedule 4 Pa

p

Criterion 12.2.5.1 

he safety report 

e

r

ns

ted.

ara3(a); Schedule 4

The site should have a procedure for the modification 

of safety instrumented systems. 

hat structured

hazard identification/analyses process and 

t to

ges from inception

♦ ance

safety critical 

♦

period.

ilability, of

The requ

e CI aspects of modification is based on the

T

should describe th

system in place fo

ensuring modificatio

are adequately

conceived, designed, 

installed and tes

[Schedule 4 Part 1 

p

Part 2 para 4, 5(a); 

Schedule 2 para 4(d)]

• There should be evidence t

associated risk assessment are carried ou

assess the impact of the changes from a CI

modification, or to CI systems from a process 

modification. Important areas which should 

have been considered are: 

♦ The requirement for the modification

process to look at all sta

through to final operation from the CI

perspective, not just the later test and 

verification stages. 

Suitable methods for review of perform

standards affecting

instrumented systems and interrelated 

systems, both during the period of

modification and thereafter. 

Use of overrides throughout the 

modification implementation

♦ Temporary loss, or change of ava

other safety control functions during 

modification. 

irements for a successful demonstration of 

th

provisions of clause 17 of BS IEC 61511. If a 

Company claim that they are conforming to the

111 
Control & Instrumentation 

Criteria 

Guidance 

standard, and can include documentary eviden

support this, then the demonstration will have be

made. 

ce to

en

112 
Appendix 12.4: Human factors criteria and guidance 

Human Factors Criteria Guidance 

Criterion 12.1 

The safety report 

should show a clear 

link between the 

measures taken and the 

major accident hazards 

described 

[Schedule 4 Part 1 para 

2; Schedule 4 Part 2 

para 4(a), 4(c), 5] 

• It is clear where human action or inaction is 

critical to the measures taken and how the 

reliability of the human action or inaction is 

assured. 

Criterion 12.2 

The safety report 

should demonstrate 

how the measures 

taken will prevent 

foreseeable failures 

which could lead to 

major accidents 

• It is clear that the design of the safety critical 

tasks is matched to the human resource. 

Criterion 12.2.1.1 

The safety report 

should show that the 

establishment and 

installations have been 

designed to an 

appropriate standard. 

[Schedule 4 Part 1 para 

3; Schedule 4 Part 2 

para 4(c), 5(a)] 

Criterion 12.2.1.2 

The safety report 

should show that a 

hierarchical approach 

to the selection of 

measures has been 

used. 

[Schedule 4 Part 1 para 

(3); Regulation 4] 

• There is a clear policy and/or procedure to 

ensure application of inherent safety principles

in new design and modifications. 

• Any critical high-hazard system that depends 

on manual intervention (for example manual 

emergency shutdown of a high-hazard 

continuous process): 

♦ is robustly justified, or

♦ there is a time bound action plan to address 

this

• 

Criterion 12.2.1.3 

Layout of the plant 

should limit the risk 

during operations, 

113 
Human Factors Criteria Guidance 

inspection, testing, 

maintenance, 

modification, repair and 

replacement. 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

Criterion 12.2.1.4 

Utilities that are needed 

to implement any

measure defined in the 

safety report should 

have suitable reliability,

availability and 

survivability.

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c), 5(a)] 

Criterion 12.2.1.5 

The safety report 

should show that 

appropriate measures 

have been taken to 

prevent and effectively

contain releases of 

dangerous substances. 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c), 5(a)] 

Criterion 12.2.1.6 

The safety report 

should show that all 

foreseeable direct 

causes of major 

accidents have been 

taken into account in 

the design of the 

installation. 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

• The safety report identifies any cases where 

operator error could be a direct cause of LOC 

without structural failure of the primary 

containment boundary, e.g. 

♦ Identification of sources of human error in 

process operations, e.g. maloperation of 

plant, lack of hazard awareness, poor 

communication, unrealistic demands, lack 

of specific training or knowledge, etc.. 

♦ Identification of measures aimed at 

minimising human error, e.g. dedicated 

operating systems, etc..

♦ Safety criticality attached to human actions 

and how this is catered for in design. 

Realistic performance standards for safety 

critical functions during normal and 

114 
Human Factors Criteria Guidance 

emergency conditions, etc.. 

♦ Defence in depth to minimise the effect of 

human failure.

♦ Control of design functions to minimise 

error. 

♦ Control of maintenance and inspection 

activities to reduce human contribution to 

LOC during system invasive activities. 

♦ Activity training, equipment specific training, 

etc.. 

Criterion 12.2.1.7 

The safety report 

should show how

structures important to 

safety have been 

designed to provide 

adequate integrity.

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

Criterion 12.2.1.8 

The safety report 

should show how the 

containment structure

has been designed to 

withstand the loads 

experienced during 

normal operation of the 

plant and all 

foreseeable operational 

extremes during its 

expected life. 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

Criterion 12.2.1.9 

The safety report 

should show that 

materials of 

construction used in 

the plant are suitable 

for the application. 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

115 
Human Factors Criteria Guidance 

Criterion 12.2.1.10 

The safety report 

should show that 

adequate safeguards 

have been provided to 

protect the plant 

against excursion 

beyond design 

conditions 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

Criterion 12.2.1.11 

The safety report 

should describe how

safety-related control 

systems have been 

designed to ensure 

safety and reliability

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

Criterion 12.2.1.12 

The safety report 

should show how

systems which require 

human interaction have 

been designed to take 

into account the needs 

of the user and be 

reliable 

[Schedule 4 Part 1 

para3; Schedule 4 Part 

2 para 4(c)] 

• Where reliability of human action is critical, 

there is/are:

♦ References to design standards. 

♦ Usability assessments.

♦ Indications of operator involvement in 

setting reliability criteria.

♦ Compatibilities with other systems. 

♦ Consideration of improvement teams. 

♦ Appropriate standards for ergonomic design 

that include control and alarm display 

interfaces. 

♦ Workspace design considerations (such as 

heat, light, noise, interface, physical 

access). 

♦ Alarm handling design and procedures 

(form, numbers, priorities, actions required, 

management of overrides). 

♦ Evidence of correct allocation of function, 

especially of new plant and for emergency 

shutdown arrangements . 

♦ Avoidance of undue reliance on special or

rarely used automation or procedures or 

unusual or rare judgement. 

• The design process for manually operated 

116 
Human Factors Criteria Guidance 

equipment and controls ensures that the ne

of users are fully taken into account, including 

usability and maintainability assessments and 

operator participation from an early stage. 

The design process includes identification o

eds

• f

• esponse to alarms forms part

ote: Some sub-optimal alarm systems can give 

The safety report shows that the usability and 

s

d

ken to minimise potential 

There is a process for developing procedures 

g

• ular review of documented safetytraining needs. 

Where reliable r

of the demonstration, the safety report shows 

that the duty holder has taken effective action 

to ensure usability and compatibility with 

suitable standards. 

[N

the operator too much unhelpful information and 

alarm flood during plant upsets.] 

•

error potential of existing safety-critical manual

tasks or interventions (for example critical 

connections or disconnections, critical alarm

and controls) are: 

♦ Understood, an

♦ Action has been ta

hazards that may arise. 

•

that ensures that they are technically correct, 

useable, clear and unambiguous, and includin

user input. 

There is reg

critical and safety-related procedures.

Criterion 12.2.1.13 

e

g

nces

s

chedule 4 Part 1

art

The safety report 

should describe th

systems for identifyin

locations where 

flammable substa

could be present and 

how the equipment ha

been designed to take 

account of the risk. 

[S

para3; Schedule 4 P

2 para 4(c)] 

117 
Human Factors Criteria Guidance 

Criterion 12.2.2.1 

he 

dards

uce

chedule 4 Part 1

The safety report 

should show that t

installations have been

constructed to 

appropriate stan

to prevent major 

accidents and red

loss of containment 

[S

para3(a)] 

Criterion 12.2.2.2 

ow

chedule 4 Part 1

The safety report 

should describe h

the construction of all

plant and systems is 

assessed, and verified

against the appropriate

standards to ensure 

adequate safety.

[S

para3(a)] 

Criterion 12.2.3.1 

ditions.

chedule 4 Part 1

Managing procedures 

he safety report presents a structured approach to 

The safety report describes the following 

♦ A process to determine which tasks need 

♦ process for procedures. 

t).

♦

♦

There is a system in place to ensure

by

The safety report 

should show that safe 

operating procedures 

have been established

and are documented for

all reasonably

foreseeable con

[S

para3(b)] 

T

developing, producing and maintaining procedures. 

•

aspects: 

procedures.

An approvals

♦ The development of procedures (their 

usability, in addition to technical conten

A process for ensuring that procedures are

valid and remain up-to-date. 

♦ End users involvement in the development

of procedures. 

♦ A process to ensure that procedures are 

appropriate to the nature of the task, its 

criticality and the users’ experience. 

A formal process to ensure that staff are 

trained in new/updated procedures. 

• that all 

foreseeable circumstances are covered by 

procedures (e.g. high level statements, step

118 
Human Factors Criteria Guidance 

step instructions for safety critical jobs, 

emergency response events, etc). 

The safety report describes how complia

with critical procedures is assured. 

• nce

ollowed. 

[Note

lways follow procedures or work instructions. 

for a 

.

ompetence may be provided 

summary, and references made to other 

ety report shows a focus on major 

accident hazards / process safety rather than 

tified, including the 

nces. 

♦ ed

cluding for 

♦

♦ ncy

t just front line

t

ion to 

• The d

res

[Note n

under

• The safety report describes how the duty 

holder checks that procedures are f

: It is often assumed that employees will 

a

However, procedures are not always adhered to

variety of reasons (i.e. procedural violations) e.g

because they may be inaccurate, do not describe 

best practice, are out of date, too complex or time

consuming to access.] 

Competence of staff. 

[Note: Information on c

in

documents.] 

• The saf

personal safety: 

♦ The competency requirements for process

safety are iden

underpinning knowledge of equipment, 

processes, hazards and conseque

The competency requirements are inform

by the hazard and risk analyses. 

♦ Safety critical roles, responsibilities and 

tasks at all levels are identified, in

management and contractors. 

The safety report addresses: 

Operational personnel compete

♦ management competency (no

personnel). 

♦ Emergency response competency. 

♦ Contractor competency.

♦ ‘Soft’ competencies such as team 

management, communications, even

recognition, delegation etc. in addit

task specific / technical competencies.

safety report identifies responsibilities an

ources for the process of competence 

assessment. 

: Training / competency assessment is ofte

-resourced]

119 
Human Factors Criteria Guidance 

Selection and training 

• The safety report shows: 

n of key personnel ensures 

to the required levels 

♦ urance systems do not rest 

.

een adjusted to

♦

♦ ssessors are ‘trained trainers’ 

e

♦

ied.

Audit

The

nd the competency assurance 

are reviewed.

B T

organ

restru tractors, multim

:

gements for safety critical

communications address the potential for 

(such as

♦ How the selectio

their ability to perform

of competence. 

♦ Staff are recruited and selected against 

defined criteria for the job. 

Competency ass

solely on generic national standards (e.g

NVQs) unless these have b

match the duty holder’s specific operations 

and risks. 

On the job training is well-structured with 

specific training/learning objectives. 

Trainers / a

and have relevant experience to undertak

these duties. 

♦ There is a clear link between competency

and safety critical procedures. 

Staff are assessed (and re-assessed at 

suitable intervals) against the criteria. 

♦ The skills, knowledge, behaviours and

working practices against which 

performance is judged have been identif

and review

• safety report describes how individual

competency a

process itself

N his is particularly important during any 

isational change process, such as business 

cturing, increased use of con

skilling, or demanning. 

The safety report describes a suitable record syste

that can demonstrate competency, which includes

records for each person

evidence of appropriate validation

evidence of training & assessment

Communications 

• The safety report shows: 

♦ That arran

communication failures

misunderstandings or incomplete / 

inaccurate / unnecessary). 

120 
Human Factors Criteria Guidance 

♦ dressed 

emergencies. 

rly

 dios. 

 ion of changes to 

• Fail s d in

the event of an emergency or abnormal 

situ

ormation required.

mmunication mode (e.g. voice, 

lphabet). 

Availab nt

staff 

The safety report

operator ensures that there is adequate 

availability of competent personnel 

actors) for safe operation 

[NB this

holder ha

the right y report

hould re t

Safety critical communications ad

include: 

 Communications during

 Any form of remote communication 

between control room and outside 

operators e.g. during shutdowns. 

 Permit-to-work procedures, particula

if the work continues over a shift 

change. 

 Communication of hazards and risks to 

contractors.

Use of ra

 Plant labelling and identification. 

Communicat

procedures.

ure in communications are considere

ation.

• Communication needs are considered, for 

example: 

♦ The inf

♦ From and by what means information is

obtained. 

♦ The co

text/email, pager). 

♦ The format of communication (use of 

phonetic a

ility of adequate numbers of compete

• : 

♦ Describes the process by which the 

(including contr

and for the provision of an effective 

emergency response service. 

relates to determining whether the duty 

s the right numbers of the right personnel in 

place and at the right time. The safet

s fer to the arrangements for ensuring tha

this is the case, rather than detailing the actual 

numbers of personnel.] 

• Focuses on safe management of critical events

/ tasks / roles / responsibilities and emergency 

121 
Human Factors Criteria Guidance 

response. 

• Demonstrates the arrangements are informed 

•

e numbers of adequate personnel. 

by the risk assessment.

Describes the arrangements for monitoring and

review of th

Criterion 12.2.4.1 

The safety report 

should show that an 

appropriate 

maintenance scheme is 

nt

event

ss of

• lace to detect, monitor 

•

♦

♦ W

interesting, 

 e programme is 

ng shifts and between shifts.

s and 



• The saf

♦ How the ease of maintaining systems and 

♦ How early signs of problems are mo

(e.g. a large jobs; excessive 

ack from staff.

established for pla

and systems to pr

major accidents or 

reduce the lo

containment in the 

event of such 

accidents. 

[Schedule 4 Part 1 

para3(b)] 

There are measures in p

or avoid maintenance error. 

The safety report describes /demonstrates: 

♦ What maintenance work can lead to a major

hazard accident. 

♦ Robust defences to make sure these

accidents are very unlikely, including: 

 Physical barriers and guards. 

 ‘Administrative’ controls (permits, 

procedures, checklists). 

 Management controls (supervision and 

checking of tasks). 

Competent maintenance teams. 

ell designed maintenance tasks (eg, 

no time pressure, comfortable 

conditions).

How the maintenanc

based on major accident risk 

assessment. 

 How communications are controlled 

well duri

 Special arrangements for the care of

temporary or inexperienced

maintenance technician

contractors.

Inspections of maintenance tasks in 

progress. 

ety report describes:

continual improvement is achieved.

nitored 

 backlog of 

repair times; adverse feedb

♦ How the investigation of near misses and 

accidents is used to learn from human

failure in maintenance and to improve the 

systems.

122 
Human Factors Criteria Guidance 

Criterion 12.2.4.2 

The safety report 

should show that there 

are appropriate 

procedures for 

take

g

t 1

maintenance that

account of any

hazardous conditions 

within the workin

environment. 

[Schedule 4 Par

para3(b)] 

Criterion 12.2.4.3

he safety report 

re in place to

nsure that safety

ined

rvals

T

should show that 

systems a

e

critical plant and 

systems are exam

at appropriate inte

by a competent person. 

[Schedule 4 Part 1

para3(b)] 

Criterion 12.2.4.4 

ow that there 

a system in place to 

nsure the continued

on

The safety report 

should sh

is

e

safety of the 

installations based

the results of periodic 

examinations and 

maintenance. 

[Schedule 4 Part 1 

para3(b)] 

Criterion 12.2.5.1

he safety report 

place for 

nsuring modifications

ed,

• There is a structured process for involving 

operators in the raising, design and 

implementation of modifications 

• Organisational change and transition 

•

l change with:

♦ With clear leadership /accountability (senior 

T

should describe the

system in

e

are adequately

conceived, design

installed and tested. 

[Schedule 4 Part 1 

management. 

The safety report describes a robust procedure 

for management of organisationa

♦ With clear objectives. 

123 
Human Factors Criteria Guidance 

para3(a); Sched

Part 2 para 4, 5(a); 

Schedule 2 para 4(d)]

ule 4 nt). 

•

pro

atter how

nt of the facility being assessed. 

• The y

imp

inc :

♦

♦ Work priorities. 

• fety report provides

sets, escalating incidents 

Where required, the safety report describes a 

hazards/process safety. 

ions, and 

re

♦

manageme

♦ Which is structured, to a prescribed, 

consistent process, thorough and well 

documented / communicated. 

The safety report describes an assessment 

cess that: 

♦ Identifies and maps all changes to both

tasks and personnel that could have an

impact on MH prevention, no m

small the change. 

♦ Is facilitated by well-trained persons 

independe

safety report describes how changes ma

act on human reliability as assessed, 

luding as necessary

♦ Workload (including non-productive work).

Competence. 

♦ Team work and communication. 

Where applicable, the sa

realistic assessments of the organisation’s 

handling of a range of crisis scenarios postchange, including up

and emergencies. 

•

competence assurance process to ensure 

adequate transition arrangements. 

♦ Which includes identification of training 

needs for changed or additional roles in 

relation to major

♦ Adequate planning for competent cover 

during the training period. 

♦ A mechanism for reviewing decis

to ensure that all necessary measures a

in place before ‘go-live’.

A process to monitor performance after 

change. 

124 
13 - GUIDANCE FOR ENVIRONMENTAL ASSESSMENT 

Introduction 125

General guidance for assessment of environmental criteria 125

Appendix 13.1 - Environmental Assessment Criteria and Guidance 127

Appendix 13.2 - Other criteria to be taken into account for environmental 

assessment 134

Introduction 

1 The environmental assessor has a multi-functional role in the assessment 

process. They complete an initial read of the safety report with the assessment 

manager to jointly determine whether the minimum information has been provided 

and assist the assessment manager in determining the make up of the assessment 

team. 

2 Where predictive assessment is required, HSE and Agency assessors should 

work together to agree: 

a. whether or not the major accident scenarios are described adequately; 

b. that the key information relating to hazard identification and risk analysis 

is present; 

c. identify the areas where the hazards are either predominantly or solely 

human safety or environmental; 

d. identify the areas where the hazards overlap; 

e. agree roles and responsibilities where this overlap exists. 

3 Where the major accident hazards on a site are predominantly or solely 

environmental the agency will lead the assessment process. HSE will provide the 

Environment Assessors with additional specialist support where required.

General guidance for assessment of environmental criteria 

4 The underlying factors of a Major Accident lie in aspects common to “human 

safety” and the “environment”, be these mechanical, electrical and control, process 

safety or human factors. In the context of major accidents and their prevention 

‘environment’ is not treated as a separate discipline to ‘health and safety’. 

5 While the receptor has no bearing on the causes or the prevention of an 

accident, some events carry a significant, predominant or solely environmental 

hazard and risk. These must be addressed in the environmental assessment 

process. Unless there is good reason, only new and / or revised information will be 

assessed against the new environmental criteria. Further guidance on reassessment is provided in “Selection of Topics for Inspection” in the Overview 

Section. 

6 The key criteria to be met for environmental risk assessment are stated in the 

tables below. Three components need to be present before a risk can be manifest, 

namely: 

a) Source (of hazard). 

b) Pathway (between source and receptor). 

c) Receptor (of the hazard). 

125 
7 The criteria and guidance in the following tables overlap in some areas with the 

requirements for assessment relating to other disciplines detailed in Sections 9 to 12 

of the manual. This does not mean that duplicated assessment is proposed, but 

recognises that much of the information that is needed for assessment of health and 

safety may also be necessary for assessment of the environment. Attention of 

assessors is drawn to the guidance contained in Section 8 of this manual - ‘How to 

use the Criteria’ under the heading of ‘Use of the Criteria’ concerning avoidance of 

duplicated assessment. 

8 The assessor should also ensure that other criteria with relevance to the 

environment are included in the environmental assessment. Appendix 13.2 provides 

a checklist of the key issues to provide more focus. Where there have been minimal 

changes that impact on the environmental considerations it should not be necessary 

to complete re assessment. 

9 Some of the information required to assess the impact on the environment may 

already have been prepared for environmental impact assessment or other 

authorisation procedures. It is permissible for the operator to refer to this information. 

However, assessment is made easier and more efficient if it is submitted as part of 

the COMAH safety report, rather than by reference to authorisations sent separately 

to the Agencies. 

126 
Appendix 13.1 - Environmental Assessment Criteria and Guidance 

Environmental Criteria Guidance

Criterion 13.1 

The safety report should 

identify all vulnerable 

environmental receptors and 

describe the sensitivity of 

these environmental 

receptors. 

[Schedule 2 para 4(b); 

Schedule 4 Part 2 para 2] 

These should include: 

• The presence of Red Book species 

• Designated Areas (SAC, SPA, SSSI, AONB, 

Ramsar sites, Local Authority nature 

classification schemes, etc.) 

• Surface waters and their classification

• Groundwater and aquifers and their 

classification

• Drinking and industrial water abstraction 

points (ground and surface) 

• Amenity areas 

• Sites of architectural and historical

importance 

• Soil and sediment 

• Agricultural resources (including market 

gardens and allotments) 

• Grade 1 listed buildings

• Pathways and receptors for any releases 

include those to air (deposition effects), 

water and land. 

• The area over which the receptors should be 

identified depends on the potential for major 

accidents. It would be expected that a range 

of 10 km would be reasonable. 

• Factors that could affect the behaviour of 

accidental releases in the environment 

should be described. These may include 

hydrology, meteorology, hydrogeology, 

geography and climate. 

• Surveys may be needed to determine the 

nature of local ecosystems. 

• Activities beyond the site boundary that may 

interact with the site should be identified. 

♦ These may include neighbouring 

industrial facilities, water treatment plants 

connected by rivers or sewer systems, 

and upstream processes. 

♦ Examples of interactions which should be 

considered include spills from the site 

causing damage to connected facilities, 

combinations of released substances

which may react to produce an 

127 
Environmental Criteria Guidance

environmental hazard, and upstream 

processes transferring off-spec material 

leading to upsets on the installation.

Criterion 13.2

The safety report should 

include a description of the 

aspects of the installation

that could be a factor in the 

potential for releases to the 

environment 

[Schedule 2 para 4(b); 

Schedule 4 Part 2 para 3] 

These should include: 

• Location, inventory and conditions of

substances dangerous to environment 

(including those non COMAH substances 

which may be released in the event of a 

major accident) 

• Secondary containment design, position, 

capacity, condition 

• Surface gradients. 

• Management factors such as operator

response, control procedures 

• Distances between sources and pathways 

• Site layout and drainage, capacity and 

condition of drains, etc. 

• Layout and segregation of entire drainage 

system, barriers, valves etc. sumps.

• Location and capacity of sumps, penstocks, 

fire-water lagoons and any other barriers to 

off-site transport of liquids. 

• Geographical/geological/hydro-geological 

features that may impede/facilitate pollutant 

escape 

• Effect of varying weather conditions (e.g. 

storm-water) 

• Treatment plants (on or off-site) 

• Detection, shutdown 

• Location of pumps, valves, pipework, 

penstocks and firewater lagoons. 

• Suitability, capacity of treatment plant. 

• The location of discharge points to 

watercourses/foul sewer/effluent treatment 

plants; 

• Maps and plans of the establishment 

features indicating where runoff of spilled 

substances and firewater could take place. 

Criterion 13.3 

The safety report should 

include a description of the 

This should include: 

• Toxicity data (e.g. dose-response 

128 
Environmental Criteria Guidance

dangerous substances which 

have potential environmental 

impact 

[Schedule 2 para 4(b); 

Schedule 4 Part 2 para 3] 

relationships). 

• Environmental harm criteria (e.g. LC50 data, 

critical loads). 

• Negligible effect criteria (e.g. No Observed 

Effect Levels, Suggested No Adverse 

Response Levels). 

• If harm criteria are used then the relevant 

receptors must be clearly identified.

• Other potentially harmful properties, for 

example, BOD/COD, blanketing/smothering 

or effects on potable water supplies may 

need to be considered. Other information 

that may be required includes persistence, 

bioconcentration factor, bioaccumulation 

potential, solubility, and density. 

Criterion 13.4 

The safety report should 

identify all Major Accident 

Scenarios which have

potential environmental 

impact 

[Schedule 2 para 4(b); 

Schedule 4 Part 2 para 4] 

• The operator should describe the 

methodology used to identify release 

scenarios. 

• Three main factors are needed to 

demonstrate understanding of events: 

♦ Behaviour of released substances 

♦ Onsite pathway analysis

♦ Domino or escalation effects 

• Potential releases should be identified, 

which should include a consideration of worst

case failures (inventory and process and the 

sensitivity of the receiving environment 

(number and types of sensitive sites) 

• Pathways by which the substance reaches 

the environment should be identified. 

• Substance behaviour upon release should be

identified, e.g. reactions with air/water/other 

substances, changes of phase, dispersion 

characteristics (dense or buoyant behaviour), 

etc. Substance behaviour must be 

characterised before the types of pathway 

can be evaluated. 

• Behaviour under normal conditions and 

foreseeable abnormal conditions should be 

considered.

• The potential for a release to be associated 

with firewater should be considered. This 

could be a direct result of firewater applied to 

the release or indirectly firewater run-off from 

another part of the site (i.e. a domino effect). 

129 
Environmental Criteria Guidance

• Screening on the basis of a dilute (e.g. 

through applying firewater) and disperse risk 

management option is not an acceptable 

practice. 

• Consideration should be given to the 

probability of flooding as a causation or 

escalation factor. 

Criterion 13.5 

The safety report should 

include an assessment of the 

extent and severity of the 

environmental consequences 

of major accidents 

[Schedule 2 para 4(b); 

Schedule 4 Part 2 para 4(b)] 

• Source details should be defined for each 

accident scenario and should include the 

following: 

♦ Substance released, size/release 

rate/duration of release

♦ Conditions of release (pressure, 

temperature, phase) 

♦ Location, elevation, direction of release 

♦ Factors that may determine the extent of 

environmental impact (e.g. ignition, 

detection, secondary containment failure, 

drains, emergency procedures, etc.) 

• The operator should include the methods 

used to calculate release rates and the 

specific values of any variables. 

It is not necessary that the release rate and 

resultant environmental concentration of every 

scenario is considered. It is acceptable if a 

representative set of releases is chosen to cover 

the range of releases possible. 

• The models/methods used to determine the 

environmental concentration should be 

detailed. The specific values of any 

variables should be given. 

• The resultant environmental concentrations 

for each member of the set of releases 

should be given 

• The effects in the environment should be 

determined from the predicted environmental 

concentrations and the toxicity data. The 

length, area or volume of the environment 

affected should also be given. The approach 

used should be described fully. In general 

the following may be used in combination or 

separately, for evaluating impacts: 

♦ Toxicity relationships (e.g. dose-response 

relationships). 

♦ Environmental harm criteria (e.g. LC50 

130 
Environmental Criteria Guidance

data, critical loads). 

♦ Negligible effect criteria (e.g. No 

Observed Effect Levels, Suggested No 

Adverse Response Levels). 

♦ Past accident experience. 

♦ Population dynamics modelling. 

• If harm criteria are used then the relevant 

receptors must be clearly identified.

[It should be noted that the LC50 threshold 

represents an impact of the severest nature. For 

risk assessment purposes a threshold of LC/2 or 

LC/3 provides a suitable indicative environmental 

harm threshold.] 

Effects may be to individual species, a range of 

species (biodiversity), the community structure and 

the overall habitat or ecosystem. Very little 

information exists on community level responses to 

damage. In defining the expected level of change, 

natural variability needs to be considered as this 

can result in significant changes in receptors. If 

recovery is assessed then a distinction may need 

to be drawn between natural unassisted recovery 

and artificial recovery, particularly if contingency

plans include cleanup and restoration that may 

affect the rate of recovery. 

• Immediate and delayed effects should be 

considered in the approach to assessing 

impacts. 

• The key uncertainties in the approach should 

be identified.

• The operator should conclude if the effects 

might constitute a MATTE. 

Criterion 13.6 

The safety report should 

include conclusions on the 

probability of the major 

hazards or the conditions 

under which they occur 

[Schedule 2 para 4(b), 

Schedule 4 Part 1 para 2] 

• The operator should give an indication of the 

likelihood of any MATTE identified. 

This may be by: 

♦ Qualitative descriptions (e.g. 

low/medium/high risk). 

♦ Simple relative scoring systems (e.g. 1-5, 

1-100). 

♦ Quantitative modelling parameters (e.g. 

Environmental Harm Index). 

♦ The operator should explain the method 

used to determine the likelihood’s and

any assumptions or principles underlying 

the method 

♦ Risk results may be summed over all

events and scenarios to give the total 

environmental risk and breakdown in 

terms of the significant risk contributors. 

131 
Environmental Criteria Guidance

♦ Uncertainties associated with any risk 

conclusions should also be presented.

Criterion 13.7 

rt should

e

ara 4(b);

2] 

For each scenario that can result in a 

he

• been used 

The safety repo

include a description of th

arrangements to prevent 

major accidents to 

environment 

[Schedule 2 p

Schedule 4 Part 1 para

•

MATTE the operator should describe t

preventative measures in place. 

Where a screening approach has

the operator should use the results of the 

examination of the representative set of 

releases to determine which of all of the 

releases do result in a MATTE and then 

ensure that for each event the specific 

precautions are detailed.

Criterion 13.8 

rt should

ised

f loss of

us

e 4 Part 2, para 5c)]

To meet this criterion the report should 

• uce a spillage at 

• s to confine the spillage, the

ineered

• treat the spillage 

The safety repo

provide evidence that 

suitable and sufficient

resources can be mobil

to minimise the 

consequences o

containment of a dangero

substance(s) to ground or 

water (including Controlled

Waters) 

[Schedul

•

consider the following: 

measures to stop or red

source; 

measure

preference being for permanently eng

secondary containment systems fitted with 

an isolation device but other mobilisable 

resources may be considered (e.g. 

sandbags, drain seals etc) 

measures to recover and/or

(eg pumps, chemicals for neutralising or 

absorbing the spillage). 

Criterion 13.9 

rt should

ade

ent

o meet this criteria we would expect to see 

the potential need for restoration and clean 

Other points to consider, where necessary, 

the envisaged timescale over which 

• h

•

am include:

equipment to contain toxic substances; 

The safety repo

provide evidence that 

suitable and sufficient

provisions have been m

for the restoration and clean

up of the environment 

following a major accid

[Schedule 5 Part 1, para 4)]

T

identification of: 

•

up measures 

include: 

•

temporary containment may be required; 

the arrangements made to ensure that suc

facilities would not pose an unacceptable 

threat to health and the environment; 

suitable disposal arrangements. 

Ex ples of measures to be taken may

•

• agents to soak up and/or neutralise 

contaminants; 

132 
Environmental Criteria Guidance

• uipment for the removal of

• ter;

earth moving eq

contaminated soil and other material; 

booms and skimmers for spillages to wa

• temporary storage arrangements e.g. 

portable storage tanks, for the contaminated 

material. 

133 
Appendix 13.2 - Other criteria to be taken into account for 

environmental assessment 

Section and Criterion Environment Component and Relevant 

Environmental Criterion 

Descriptive 

Criterion 9.5 

The safety report should 

describe the immediate and 

delayed harm to man and the 

environment for each 

dangerous substance 

identified 

• The information presented should include the 

physical, chemical or toxicological 

characteristics of the dangerous substances 

that may cause harm and an indication of the 

hazards posed. The information presented 

should address both the short and long term 

effects and may include for example:

♦ effects on the environment, including

building damage, the ecosystem and 

relevant sensitive species, 

(Environment criterion 13.3) 

Descriptive 

Criterion 9.6 

The safety report should 

describe the environment of 

the establishment in 

sufficient detail to allow the

consequences of a major 

accident to be assessed 

• Land use pattern (i.e. industry, agriculture, 

urban settlements, environmentally sensitive 

locations etc.). 

• Consideration should also be given to allow 

assessment of the indirect impact of a major 

accident on the public. For example, as a 

result of contamination of drinking water. 

♦ a description of the underlying and 

surrounding geology and hydrogeology if 

it is appropriate to the consideration of a 

major accident; 

♦ a description of the surrounding water 

courses (under various flow conditions), 

underlying aquifers and any drinking 

water extraction points should be given in 

relation to the dispersion of liquid 

contaminants or leachate from solids 

deposited on the surrounding land; 

♦ description of surrounding water and land 

quality; 

♦ information on sewerage and rainwater 

systems if they could be involved in the 

dispersal of liquid contaminants off-site; 

♦ information on tides and currents that

might influence dispersion or 

accumulation if marine or estuarine 

habitats are at risk; 

• Information on the built environment is 

expected to include: 

• each listed building and monument that may 

be vulnerable to the effects of a major 

accident. 

• Information on the natural environment is 

expected to include a description sufficiently 

detailed to allow the significance of the 

134 
Section and Criterion Environment Component and Relevant 

Environmental Criterion 

impact of major accidents to be assesse

This should include details of any: 

♦ Sites of Special Scientific Intere

d.

st (SSSI); 

tection 

♦

nder English

♦ se features in 

a

(Environ

whether they are Special areas of 

Conservation (SAC) or Special Pro

Areas (SPA); or Ramsar sites; 

marine nature reserves; 

♦ marine sensitive areas, u

Nature's marine strategy; 

and the significance of the

either a national or international context 

should be explained, for example the flor

or fauna particularly at risk. 

ment Criterion 13.1) 

Descriptive 

ort should

of

her external 

iators 

(Environ 4) 

Criterion 9. 7

The safety rep

describe the environment

the establishment in 

sufficient detail to allow the

contribution of external 

factors to major accidents at

the establishment to be 

assessed 

• The contribution of the external factor to the 

major accident could be as an initiating or 

exacerbating event. Factors for consideration

under this criteria include: 

♦ historical evidence of ot

events that might act as accident init

such as flooding; 

ment Criterion 13.

Descriptive

rt should

on

r

• The safety report should contain plan(s), 

hich

tial. 

of

s

• tes, purpose [e.g. foul 

g

• ent) critical valves, 

• equipment, e.g. for toxic products

(Envi

Criterion 9.11

The safety repo

provide focused informati

about each installation, in 

sufficient detail to support

the demonstration that majo

accident hazards will be

prevented or the effects 

mitigated 

map(s) or diagram(s) plus descriptions, w

clearly set out information about the 

installations with major accident poten

The description should allow determination

the purpose, location and function of

equipment within the installation that has a

bearing on major accident prevention and 

control. In particular, information about item

of plant such as: 

drainage (e.g. rou

water, fire fighting run-off water]) includin

details relating to; 

safety (or environm

instruments, control loops and detection

systems; 

monitoring

in air, sewers, discharges to water; for fires or

explosive atmospheres; 

ronment Criterion 13.2)

Predictive 

.1 

ummarises

t risk assessment 

Criterion 10

This criterion s

the description in the safety

• Description of the role tha

has in the demonstration that the risks are 

ALARP for on-site personnel, people off-site

and the environment. 

135 
Section and Criterion Environment Component and Relevant 

Environmental Criterion 

report of the company’s 

general approach to the u

of risk assessment in the 

process of identifying 

necessary measures. 

se

(Environment criterion 13.6) 

Predictive 

Criterion 10.1.2 

liminating

The intent of this criterion is to ensure no important 

n or

y of the

(Envi

Any criteria for e

possible hazardous events 

from further consideration 

should be clearly justified 

hazardous events go unconsidered.

• Periodic review considers know

foreseeable changes to the sensitivit

surrounding environment. 

ronment Criterion 13.1) 

Predictive 

Criterion 10.2 

rt should

a that are

f suitably applied 

• ata

(Envi

The safety repo

demonstrate that the 

operator has used 

information and dat

suitable and sufficient for 

risk analysis

• Consideration of a range o

harm levels (e.g. toxic, thermal, pressure 

effects) to people and the environment. 

Use of current maps, off-site population d

and surrounding environmental features. 

ronment Assessment criterion 13.6) 

Predictive 

Criterion 10.3.1 

ard

has

,

• External events where relevant may include: 

The range of MA scenarios affecting people 

(Environ

A systematic haz

identification process

been used to identify all 

major accident scenarios

including worst case and 

lesser events. 

♦ Extreme environmental conditions (e.g. 

abnormal rain, snow, temperature, wind,

floods (both as a causation or escalation 

factor), lightning). 

•

and the environment is sufficient for 

identifying necessary measures and includes: 

♦ The scenarios include events where 

planned or installed measures fail. 

ment Criterion 13.4)

Predictive 

.5 

rt should

uitable

e

t

nsure valid and 

d

t Criterion 13.5)

Criterion 10

The safety repo

provide details to 

demonstrate that s

and sufficient consequenc

assessment for each major 

accident scenario has been 

carried out with respect to 

people and the environmen

The intent of this criterion is to e

appropriate consequence assessment and shoul

include a range of potential harms to the 

environment

(Environmen

Predictive 

Criterion 10.5.4 

or

used to 

• The safety report shows, where the scale and 

t and 

(Environment Criterion 13.3) 

The harm criteria

vulnerability models

assess the impact of each 

MAH on people and the 

environment should be 

nature of the hazard and risks is significant: 

♦ Justification for the approach to 

environmental impact assessmen

data used. 

136 
Section and Criterion Environment Component and Relevant 

Environmental Criterion 

appropriate and have be

used correctly for each 

relevant major accident 

en

Predictive 

Criterion 10.5.6 

severity and 

e are

Extent and severity is concerned with who (people) 

rion 13.5) 

Estimates of the

extent of each major 

accident consequenc

realistic 

or what (environment) might be harmed, how badly,

and how many (people) or how much (environment) 

are affected by major accidents. 

(Environment Assessment crite

Technical Relevant criteria affecting assessment of 

environmental aspects is dependant upon allocated 

responsibilities within the Assessment team. 

Emergency Response 

rt should

of

ation of any pollution 

toration;

Where relevant, or where more rigorous or 

sponse

es, in

e,

rm

l

ces

Criterion 14.2 

The safety repo

describe the organisation

the alert and intervention in 

the event of a major accident

to provide evidence that the 

necessary measures have 

been taken on-site 

• Arrangements for intervention in an 

emergency situation 

♦ the nature and loc

control devices and materials, and the 

arrangements for subsequent 

environmental clean up and res

•

detailed demonstrations are required, 

consideration of the following: 

♦ the effects of emergency re

actions, including fire fighting activiti

order to minimise the overall impact on 

people and the environment (for exampl

due to contaminated firewater); this 

should include short term and long te

effects and alternative options for disposa

or discharge together with the least 

damage solutions and the circumstan

in which they apply. 

Emergency Response 

rt should

ffr

Of releva ific described 

Criterion 14.3 

The safety repo

describe the on-site and o

site resources which can be 

mobilised by the operator to 

provide evidence that the 

necessary measures have

been taken to limit the 

consequences of a majo

accident to people and the

environment 

nce but nothing spec

Emergency Response

t should

Of relevance but nothing specific described. 

Criterion 14.3.2 

The safety repor

provide evidence that 

suitable and sufficient

137 
Section and Criterion Environment Component and Relevant 

Environmental Criterion 

arrangements are in pla

ensure that the equipment to 

be mobilised for mitigating 

the consequences of 

reasonably foreseeabl

major accidents will be fi

purpose when called upon 

for use 

ce to

e

t for

Emergency Response 

t should

onbe

d

That adequate consideration has been given to the 

Criterion 14.3.4 

The safety repor

provide evidence that 

suitable and sufficient

site fire fighting and fire 

protection provisions can

mobilised in the event of a 

major accident, taking 

account of resources 

available from local an

other fire brigades 

possible environmental impact of contaminated 

firewater on watercourses and groundwater. 

Emergency Response

t should

ade

ent

To meet this criterion the report should include 

l need for restoration and clean 

• consider, where necessary, 

visaged timescale over which

♦

the 

♦ al arrangements. 

Examples of measures to be taken may 

ment to contain toxic substances; 

♦ val of

Criterion 14.3.8 

The safety repor

provide evidence that 

suitable and sufficient

provisions have been m

for the restoration and clean

up of the environment 

following a major accid

identification of: 

• the potentia

up measures. 

Other points to

include: 

♦ the en

temporary containment may be required; 

the arrangements made to ensure that 

such facilities would not pose an 

unacceptable threat to health and

environment; 

suitable dispos

•

include: 

♦ equip

♦ agents to soak up and/or neutralise 

contaminants; 

earth moving equipment for the remo

contaminated soil and other material; 

♦ booms and skimmers for spillages to

water; 

♦ temporary storage arrangements e.g.

portable storage tanks, for the 

contaminated material. 

Emergency Response 

The safety report should 

• The relevant:

threat to the environment and the 

Criterion 14.5 

training should include where

♦ the nature of major accidents posing a 

138 
Section and Criterion Environment Component and Relevant 

Environmental Criterion 

provide evidence that

ve

y

-

suitable arrangements ha

been made in the safet

management system for 

training of individuals on

site in the emergency

response 

particular steps to take in the event of 

such accidents; 

Emergency Response

Criterion 14.7 

tion to enable

n

• The minimum information to be included in 

the safety report includes: 

ident e.g. maps

itive

♦

vered by the COMAH Regulations 

eople 

The safety report should

supply informa

the off-site emergency pla

to be drawn up 

♦ Details of the off-site area likely to be

affected by a major acc

with sectors and environmentally sens

areas and a drainage map to help 

determine where spillages could leave the 

site. 

Details of the dangerous substances onsite co

and similar information for other 

hazardous materials held on site, 

including: quantities; hazardous properties 

and the nature of their effects on p

and the environment. 

139 
14. EMERGENCY RESPONSE ARRANGEMENTS 

Introduction 140

Scope 140

Relevant requirements of the COMAH Regulations 140

General guidance for the assessment of the emergency response elements 141

Pre-construction and pre-operation safety reports 141

Exemption from producing an off-site emergency plan 141

Appendix 14.1 Emergency response assessment criteria and guidance 143

Introduction 

Scope 

1 This set of criteria is concerned with the on-site arrangements to respond to a 

major accident, the interface of these arrangements with the off-site emergency plan, 

and the resources that can be mobilised by the operator to take mitigatory action to 

minimise the consequences of a major accident. 

Relevant requirements of the COMAH Regulations 

2 Schedule 4 Part 1, para 2 requires that one of the purposes of a safety report is 

to demonstrate that the necessary measures have been taken to limit the 

consequences of major accident hazards to people and the environment. Additional 

purposes are set down in Schedule 4 Part 1, para 4 which requires the safety report 

to demonstrate that on-site emergency plans have been drawn up and to supply 

information to enable the off-site plan to be drawn up. 

3 Schedule 4 Part 2, paras 5(a-d) set down the minimum data to be considered in 

the safety report with respect to emergency response: para 5(a) requires a 

description of equipment installed for limiting the consequences of major accidents, 

5(b) is concerned with the organisation of the alert and intervention, 5(c) requires a 

description of the mobilisable resources, 5(d) requires a summary of information from 

sections 5(a) to 5(c) necessary for drawing up the on-site emergency plan. The 

emergency response criteria cover paras 5(b-d) with para 5(a) addressed by the 

Technical Aspects criteria presented in Section 12. 

4 Aspects of the Safety Management System directly relevant to emergency 

response arrangements are specified in the following sections of Schedule 2: 4(a) 

which addresses training needs; 4(c) which covers arrangements for maintenance of 

plant and equipment; 4(e) which requires the safety management system to address 

the adoption and implementation of procedures to test and review emergency plans. 

General assessment criteria for Safety Management Systems are presented in 

Section 11. 

5 Regulation 10(7) recognises that situations may apply where the CA deems it 

appropriate to exempt a local authority from the requirement to produce an off-site 

emergency plan in respect of an establishment. This is further addressed in this 

section. 

6 The layout of the criteria is intended to reflect the layout of the Regulations. 

140 
General guidance for the assessment of the emergency response elements 

7 The assessment criteria listed below, together with their explanatory text, are 

representative of the type of necessary measures that the Competent Authority 

would expect the operator to take to limit the consequences of major accident 

hazards to people and the environment. It is recognised that the assessment criteria 

may not all be relevant to a particular establishment, however the onus is on the 

operator to demonstrate that the necessary measures which have been made are 

adequate in the context of the major accident hazards that could occur at the site 

concerned. They should be related (and preferably cross referenced) to the major 

accident scenarios described elsewhere in the safety report. 

8 Where the term evidence is used in the criteria then a statement of confirming 

that specific measures have been taken may be sufficient to satisfy the requirement. 

For example, a statement confirming that equipment is included in plant maintenance 

schedules, maintenance records, maintenance procedures and instructions etc. It is 

not expected that examples of these documents are included in the safety report. 

Such documents may be subject to post assessment inspection. 

Pre-construction and pre-operation safety reports 

9 For Pre-Construction Safety Reports (PCSRs) and Pre-Operational Safety 

Reports (POSRs) the organisation of alert and intervention arrangements should be 

described to the extent that information is available and in relation to the hazards that

apply. For PCSRs, relevant information may include: 

• Control and limitation of escalation of major accidents, including isolation 

and removal of inventories. 

• Communication during emergency response. 

• Emergency control centres. 

• Access routes 

• Design and construction of mobilisable resources, particularly nearer preoperation stage. 

• Arrangements during phased commissioning of plant. 

10 Training in emergency response, testing of emergency plans, information for 

the offsite emergency plan has principal relevance to POSRs. 

Exemption from producing an off-site emergency plan 

11 Regulation 10(7) deals with exempting a local authority from the need to 

produce an off-site emergency plan. Where this is deemed appropriate, the CA is 

required to notify the local authority in writing of the exemption and the reasons for 

granting it. Members of the assessment team will need to agree the basis of such an 

exemption and record it as an outcome of the assessment conclusions meeting. 

12 In reaching a decision that an exemption to producing an off-site emergency 

plan in respect of an establishment is appropriate, the assessment team should be in

agreement that, based on the evidence in the safety report, the consequences of a 

major accident affecting health and safety or the environment will not extend beyond 

the establishment boundary. Where team agreement cannot clearly be reached, an

exemption should not be granted (i.e. a cautious approach should be adopted). 

141 
13 Consideration of consequences extending beyond the establishment boundary 

for matters relating to health and safety will be based primarily on the consequence 

ranges provided in the report and will also need to take account of the proximity and 

extent of populations beyond the site boundary. Assessors need to consider if 

uncertainty in the consequence analyses and assumptions is such that a clear 

exemption decision cannot be reached, 

14 Consequences to the environment may be more difficult to determine if 

uncertainty over pathways beyond the establishment boundary exist (e.g. 

underground pathways to water supplies, streams, etc.). 

15 The AM will be responsible, in the first instance, for identifying whether a 

possible exemption situation exists as an outcome of the initial read. Attention to this 

possibility should be raised in the Stage 1 Assessment Plan. The predictive 

assessor (for health and safety consequences) and the environmental assessor (for 

environmental consequences) should consider the possibility of an exemption during 

their initial read prior to the assessment planning meeting. It the assessment 

planning meeting reaches the view that an exemption remains possible, this should 

be identified as an assessment scope item for further consideration during the 

assessment. The assessment should seek to establish that sufficient evidence exists 

in the report to conclude that an exemption is appropriate. 

16 Historically, few exemptions from producing an offsite emergency plan have 

been granted. Procedure 4.2 will normally apply for prompt notification to the local 

authority when it is determined that the minimum information required by the 

regulations exists to prepare a plan. The framework letter 6 in Appendix 4.6 informs 

the local authority that the report has been read, but not fully assessed. This letter, 

prepared early in the assessment process, allows progress to be made by the local 

authority in preparing a plan. Exemption from producing a plan, however, places an 

increased obligation on the CA to be as sure it is reasonable to be so that no plan is 

necessary. It is for this reason that the decision to grant an exemption is left until a 

complete assessment of the safety report has been made and conclusions reached 

(see Procedure 6.1). 

142 
Appendix 14.1 Emergency response assessment criteria and 

guidance

Emergency Response 

Criteria 

Guidance 

Consultation

Criterion 14.1 

The safety report should 

confirm that the operator 

has consulted the 

following in the 

preparation of the on site 

emergency plan: those 

working in the 

establishment; the 

Agency; the emergency

services; the health 

authority; the local 

authority

[Regulation 9(3) and (4)] 

Simple confirmation of the compliance with the 

regulation should be sufficient to meet this criterion. 

However, it would be preferable for the report to give 

details of the means and nature of the consultation, 

and any impact that this has had on the emergency 

planning arrangements. 

Organisation of Alert and Intervention 

Criterion 14.2 

The safety report should 

describe the organisation 

of the alert and 

intervention in the event 

of a major accident to 

provide evidence that the 

necessary measures have 

been taken on-site 

(Schedule 4 Part 2, para 

5b) 

To meet this criterion, the safety report should 

describe: 

• Basic organisational issues necessary for 

emergency response: 

♦ identification of key posts, and groups, with 

duties in the emergency response (and the 

arrangements for deputies); 

♦ description of the functions of key posts with 

duties in emergency response; 

♦ description of provisions for establishing and 

maintaining communications during the 

emergency response; 

♦ the nature and location of: emergency control 

centres; first aid centres; emergency refuges; 

muster points; pre-defined forward control 

points, etc; 

• Arrangements for raising the alert to the 

hazardous situation: 

♦ to cover individuals on site, the general 

public and, where relevant, neighbouring 

establishments and downstream water 

abstractors 

♦ description of the nature of the alarms and 

the plant conditions required to activate 

them; 

♦ the roll call and search and rescue 

arrangements; 

143 
Emergency Response 

Criteria 

Guidance 

Arrangements for intervention in an emergency 

ial actions required both on-site and 

♦ ing

and other 

♦ ation of any pollution 

ental

♦ for monitoring wind

Where relevant, or where more rigorous or 

port 

,

♦

with

♦

♦ cy

♦

♦

•

situation: 

♦ the init

off-site in response to alarms/warnings; 

the arrangements for controlling and limit

the escalation of accidents on-site, including:

the isolation of hazardous inventories and 

the removal of inventories (where 

appropriate); the use of fire fighting

mitigatory measures; and the prevention of 

domino effects; 

the nature and loc

control devices and materials, and the 

arrangements for subsequent environm

clean up and restoration;

provision has been made

speed and direction, and other environmental 

conditions, in the event of a major accident. 

•

detailed demonstrations are required, the re

should include consideration of the following: 

♦ the effects of emergency response actions

including fire fighting activities, in order to 

minimise the overall impact on people and

the environment (for example, due to 

contaminated firewater); this should include

short term and long term effects and 

alternative options for disposal or discharge

together with the least damage solutions and

the circumstances in which they apply; 

the nature of, and arrangements for 

maintaining, any mutual aid agreements

nearby establishments 

the nature and location of any installations 

which may require special protection, or 

rescue intervention; 

the location of: access routes for emergen

services; rescue routes; escape routes; and 

any restricted areas; 

the arrangements for unmanned sites and 

sites that are not continuously manned, and

sites with varying manning levels at different 

times; 

the arrangements and conditions for alerting 

and mobilising: individuals or groups with 

defined responsibilities under the emergency

plans including essential personnel on-site 

and off-site; the emergency services 

(including arrangements for briefing the 

144 
Emergency Response 

Criteria 

Guidance 

emergency services of the nature of the 

incident and of any special problems they

might face); neighbouring establishments 

(where mutual aid agreements exist); and 

off-site agencies; 

♦ the evacuation arrangements and any

transport requirements. 

Description of Mobilisable Resources

Criterion 14.3 

rt should

es have 

r

chedule 4 Part 2, para

onclusive comment

when considering the sub criteria below, the 

The descriptions should be referenced to the 

n

• present extensive 

n

d

• resented below are 

sary

ts

f

, hence the 

The safety repo

describe the on-site and 

off-site resources which 

can be mobilised by the 

operator to provide 

evidence that the 

necessary measur

been taken to limit the 

consequences of a majo

accident to people and 

the environment 

(S

5c) 

This criterion is used to make a c

on the emergency response aspects which come 

below it. 

However,

following issues should be considered: 

•

major hazard scenarios described elsewhere i

the report and it should cover both human 

resources and hardware 

There is no requirement to

technical details about these resources in the 

safety report, however the evidence presented

should be sufficient to give confidence that the 

necessary measures have been taken in relatio

to the type and magnitude of the foreseeable 

consequences, and that the equipment provide

is fit for its intended use.

The assessment criteria p

deliberately in non-prescriptive terms in 

recognition of the fact that on-site "neces

measures" will depend upon: the type and 

magnitude of the foreseeable major acciden

which will vary widely according to the nature o

the establishment involved. However, the onus 

is on the operator to demonstrate in the safety 

report that the necessary measures have been

taken, in the context of the specific 

circumstances at the site concerned

need for reference to the identified major 

accident scenarios. 

Criterion 14.3.1 

t should

n

he safety report should be able to give confidence 

the various functions required to implement the 

• lls

The safety repor

provide evidence that 

sufficient personnel ca

be made available within 

appropriate timescales to

carry out the mitigatory

actions required by the 

on-site emergency plans

T

that the following factors have been taken into 

account: 

•

on site emergency plan have been identified; 

the numbers of personnel, with appropriate ski

or competencies, required to implement the on 

site emergency plan have been determined; 

145 
Emergency Response 

Criteria 

Guidance 

(Schedule 4 Part 2, para • he

•

• ial for incapacity of key operators has

5c) 

these numbers of staff can be assembled in t

required response time; 

the mitigatory actions can be achieved in 

practice; 

the potent

been taken into account.

Criterion 14.3.2 

t should

ce

ating

it

art 2, para

o be fit for purpose the equipment should be: 

• ions (eg

• l environmental

• the

• reseeable

ntroduce

To en

uantities of 

• which both the equipment will be 

• f the equipment, to ensure it is both 

Other

ervices (such

• e

The safety repor

provide evidence that 

suitable and sufficient 

arrangements are in pla

to ensure that the 

equipment to be 

mobilised for mitig

the consequences of 

reasonably foreseeable 

major accidents will be f

for purpose when called 

upon for use 

(Schedule 4 P

5c) 

T

• appropriately specified to meet the needs of the 

identified major accident scenarios;

able to operate in the ambient condit

weather/frost protection);

able to operate in the loca

conditions expected in an emergency; 

able to sustain the mitigatory action for

necessary length of time; 

suitably protected for the fo

environmental conditions so as not to i

additional hazards (eg electrical equipment). 

sure that the equipment can be mobilised 

consideration needs to be given to: 

• determination of the required q

equipment; 

timescales in

needed, and in which it can be made available 

for use; 

storage o

accessible, and protected from the 

consequences of a major accident. 

factors to be considered include: 

• the possibility of loss of essential s

as power, water, and communications) and other

facilities has been taken into account and 

alternatives provided where necessary; 

the compatibility, where necessary, of th

emergency equipment with that of the 

emergency services and that provided by 

organisations with which a mutual aid 

agreement exists. 

Criterion 14.3.3 

t should

that

ould include equipment such as, but not restricted to: 

The safety repor

provide evidence

C

146 
Emergency Response 

Criteria 

Guidance 

suitable and sufficient 

personal protective 

equipment will be 

available in the even

major accident 

(Schedule 4 Par

t of a

t 2, para

c)

respirators and/or breathing air sets;

ter, or

To en ment consideration 

identification of the specification of PPE 

ired;

• o

• lies required to meet 

• nt, to ensure it is both 

roups which may require PPE may include: 

members of the emergency response team 

r it

.

5

•

• protective clothing for radiant heat, wa

specific chemical hazards. 

sure availability of the equip

should be given to: 

•

appropriate to the mitigatory actions requ

identification of those individuals, or groups, wh

may require use of PPE; 

determination of the supp

the potential demand; 

storage of the equipme

accessible, and protected from the 

consequences of a major accident. 

G

•

• those with duties under the emergency plan

• other individuals who may be required to wea

e.g. emergency escape respirators for site 

personnel in the event of a toxic gas release

Criterion 14.3.4 

t should

onfrom

chedule 4 Part 2, para

he safety report should provide sufficient evidence to 

e

here circumstances are foreseeable that make the 

nsafe 

ces and 

he evidence may include some or all of the following:

that the fire fighting roles of the on-site

de,

ring

The safety repor

provide evidence that 

suitable and sufficient

site fire fighting and fire 

protection provisions can

be mobilised in the event 

of a major accident, 

taking account of 

resources available

local and other 

fire brigades 

(S

5c) 

T

show that the quantity and specifications of the on-site 

fire fighting provisions that can be mobilised, with due 

consideration of off-site resources available from local 

and other fire brigades, are adequate for the major 

accident scenarios that are identified elsewhere in th

safety report. 

W

use of fire fighting or other mitigatory measures 

impracticable or unsafe (for example, it may be u

to fight certain fires involving explosives), the 

arrangements should identify such circumstan

the additional arrangements necessary to limit the 

consequences of a major accident. 

T

•

personnel (e.g. full time on-site fire briga

auxiliary fire fighters, other site personnel) du

an emergency have been defined and are 

appropriate;

147 
Emergency Response 

Criteria 

Guidance 

• ghting roles of the on-site

e of the

• tion of on-site fire 

• ire fighting and 

• fficient portable and mobile 

,

to

• nt stocks of foam 

• te consideration has been given in 

• en to

• to

that the fire fi

personnel are complementary to the rol

off-site emergency services; 

that the quantity and specifica

fighting equipment is sufficient; 

that the water requirements for f

fire protection (e.g. cooling) have been predetermined and that the capacity and reliability 

of the water supply are adequate taking into 

account the various sources which may be 

available, and the time required to establish 

back up supplies; 

that suitable and su

fire fighting equipment (such as mobile monitors

mobile pumps, hand/portable extinguishers, 

foam generation equipment, hoses), and 

hydrants have been located at appropriate 

points throughout the installation according

the hazard; 

that suitable and sufficie

compound are available when and where 

necessary; 

that adequa

the design (e.g. the positioning of walls, fire 

screens), to assist the positioning and protection

of fire fighting equipment and personnel, and 

that the reach of fire protection and 

extinguishing equipment is appropriate; 

that adequate consideration has been giv

flammable substances being carried with fire 

water and spreading the fire to other areas; 

that adequate consideration has been given

the possible environmental impact of

contaminated firewater on watercourses and 

groundwater. 

Criterion 14.3.5 

t should

he

in

o meet this criterion the report should consider the 

ures to terminate or reduce the leak at 

•

en

• airborne 

The safety repor

provide evidence that 

suitable and sufficient 

provisions can be 

mobilised to minimise t

release of, and mitigate 

the consequences of, 

airborne toxic and/or 

flammable substances

the event of a major 

accident 

T

following: 

• meas

source (e.g. patching or plugging of leaks, or

isolation by valve closure or other means); 

measures to reduce the evolution of fumes 

where hazardous materials have already be

spilt (e.g. foam cover or cooling); 

measures to reduce the effects of

substances (e.g water sprays) 

148 
Emergency Response 

Criteria 

Guidance 

(Schedule 4 Part 2, para he safety report should also show how consideration 

ying out these tasks in 

• t will be 

5c) 

T

has been given to: 

• the practicability of carr

foreseeable accident conditions; 

the equipment, tools and PPE tha

required to carry out these tasks. 

Criterion 14.3.6 

t should

he

e 4 Part 2, para

o meet this criterion the report should consider: 

rce;

• (eg

The safety repor

provide evidence that 

suitable and sufficient 

resources can be 

mobilised to minimise t

consequences of loss of 

containment of a 

dangerous substance(s) 

to ground or water 

(including Controlled 

Waters) 

(Schedul

5c) 

T

• measures to stop or reduce a spillage at sou

• measures to confine the spillage, the preference 

being for permanently engineered secondary 

containment systems fitted with an isolation 

device but other mobilisable resources may be

considered (e.g. sandbags, drain seals etc)) 

measures to recover and/or treat the spillage

pumps, chemicals for neutralising or absorbing 

the spillage) 

Criterion 14.3.7 

t should

g

t 2, para

To meet this criterion the report should include: 

rgency response

• of how the results of

ce decisions

• ring

ment,

The safety repor

provide evidence that 

suitable and sufficient 

provisions for monitorin

and/or sampling can be 

mobilised in the event of a

major accident 

(Schedule 4 Par

5c) 

• consideration of the benefits of 

monitoring/sampling during eme

(this may be based on the hazardous substance 

involved, the rate at which it disperses to safe 

levels and the speed at which the results may be

obtained); 

explanation

monitoring/sampling might influen

made during emergency response; 

identification of any sampling/monito

measures to be carried out, and the equip

methods and specialist expertise that may be 

required. 

Criterion 14.3.8 

t should

o meet this criterion the report should identify: 

up

Other points to consider, where necessary, include: 

The safety repor

provide evidence that 

suitable and sufficient 

provisions have been 

made for the restoration

and clean up of the 

environment following a 

major accident 

T

• the potential need for restoration and clean

measures. 

• the envisaged timescale over which temporary

containment may be required; 

149 
Emergency Response 

Criteria 

Guidance 

(Schedule 5 Part 1, para 4)

• ure that such 

at

•

xamples of measures to be taken may include: 

• uipment for the removal of

• ter;

 the arrangements made to ens

facilities would not pose an unacceptable thre

to health and the environment; 

suitable disposal arrangements.

E

• equipment to contain toxic substances; 

• agents to soak up and/or neutralise 

contaminants; 

earth moving eq

contaminated soil and other material; 

booms and skimmers for spillages to wa

• temporary storage arrangements e.g. portable

storage tanks, for the contaminated material. 

Criterion 14.3.9 

t should

4 Part 2, para

he safety report should demonstrate that suitable 

The safety repor l

provide evidence that 

suitable and sufficient 

provisions have been 

made to mobilise first 

aid/medical treatment 

during the emergency

response 

(Schedule

5c) 

T

consideration has been given to the first aid/medica

provisions required in the event of a major accident 

and show how the on-site provisions dovetail with the

provisions in the off-site emergency plan. 

Criterion 14.3.10 

should

ich 

Ancillary equipment is defined in this context as those 

,

The safety report

provide evidence that 

suitable and sufficient 

provisions have been 

made to mobilise any

ancillary equipment wh

may be required during 

the emergency response 

(Schedule 4 Part 2, para

5c) 

miscellaneous provisions that may be required to

enable the emergency response to be carried out. 

Such equipment could include vehicles to transport 

emergency equipment to and from the site of the 

accident, heavy lifting gear, earth moving equipment

emergency lighting, and special tools, parts etc. 

required to carry out emergency repairs and actions. 

Maintenance, etc. of Emergency Response Equipment 

Criterion 14.

,

4 that

ort should

The safety report should provide evidence

The safety rep

provide evidence that 

suitable arrangements 

have been made for the

maintenance, inspection

suitable arrangements have been made for the:

• maintenance (planned and breakdown), 

• inspection, examination and 

150 
Emergency Response 

Criteria 

Guidance 

examination and testing

of the mobilisable 

resources and other 

equipment to be us

during the emergency

response. (This criterio

only applies to 

mobilisable resources 

and other equip

which the operator has

responsibility)

(Schedule 2, pa

ed

n

ment for

ra 4c)

onse equipment and provisions.

atory function such 

• function, such as 

he evidence may take the form of statement of 

,

• testing, 

of emergency resp

The arrangements should cover:

• equipment with a direct mitig

as fire fighting equipment; 

other equipment with a key

alarms to warn personnel of the accident. 

T

confirmation that specific equipment is included in

plant maintenance schedules, maintenance records

maintenance procedures and instructions etc. 

Training In The Emergency Response

Criterion 14.5 

rt sho

e

e)

vidence to give

s

is

ff with a specific role in the

• ation needs of other

• to the site. 

he training should include where relevant: 

arios

• r accidents posing a threat to

• and the

• ding to 

• ay be mobilised

• . respirators,

breathing air, clothing etc.), and any limitations 

The safety repo uld

The safety report should provide e

provide evidence that 

suitable arrangements 

have been made in the 

safety management 

system for training of 

individuals on-site in th

emergency response 

(Schedule 2, para 4a &

confidence that the safety management system ha

taken account of the need to train individuals in the 

emergency response, and to ensure that the training

kept up to date (e.g. by refresher training). 

The training should cover: 

• those members of sta

event of a major accident; 

as well as the training/inform

employees, 

contractors and visitors 

T

• information on the major accident scen

which may trigger the on-site and off-site 

emergency plans; 

the nature of majo

the environment and the particular steps to take 

in the event of such accidents; 

knowledge of the alarm systems

required response to each alarm; 

the procedures for reporting/respon

incidents on site which have the potential to

escalate into a major accident; 

the use of the resources which m

in the event of a major accident e.g. fire fighting 

equipment, special chemicals, etc; 

the use of protective equipment (e.g

151 
Emergency Response 

Criteria 

Guidance 

on their use;

• the evacuation and mustering procedures; 

n the

ans

• with

ual aid agreement exists. 

• the actions required by staff with key roles i

implementation of the on-site emergency pl

e.g. the site main controller or site incident 

controller; 

the training of individuals from organisations

which a mut

Testing of Emergency Plans 

Criterion 14.6 

The safety report should 

ce that

st

ts

e 2, para 4e)

he safety report should provide sufficient evidence to 

le programme of 

se

ith the offprovide eviden

procedures have been 

made and adopted to te

and review emergency

plans, and to revise the 

emergency arrangemen

in the light of the lessons

learned 

(Schedul

T

give confidence that a suitab

emergency exercises has been drawn up, and has 

been implemented, to test the emergency 

arrangements at all levels (i.e. the local plant respon

the site-wide response, and the interface w

site response) and that a procedure exists to ensure 

that the lessons learned from these exercises are

reviewed and the emergency arrangements revised 

where necessary. 

Information Required for the Offsite Emergency Plan 

Criterion 14.7 

The safety re

tion to

4, part 1 para 4)

The minimum information to be included in the safety 

including its location, nearby 

roads, and site access. (This topic is considered

•

entres, location of 

g

•

dent e.g. maps with sectors and

ion

ensity,

e site.

n

• e

he COMAH Regulations and similar 

port should report is listed below: 

supply informa

enable the off-site 

emergency plan to be 

drawn up 

(Schedule

• details of the site

in more detail in Section 9);

site plan showing location of key facilities such 

as control centres, medical c

main process plant and stores. Details of staffin

levels. (This topic is considered in more detail in

Section 9);

details of the off-site area likely to be affected by 

a major acci

environmentally sensitive areas (e.g. Sites of 

Special Scientific Interest (SSSI’s), Special 

Areas of Conservation (SAC’s), Special 

Protected Areas (SPA’s)) indicated, informat

on the types of building, the population d

roads, sensitive buildings (e.g. schools, 

hospitals), and a drainage map to help 

determine where spillages could leave th

(This topic is considered in more detail i

Section 9); 

details of the dangerous substances on-sit

covered by t

152 
Emergency Response 

Criteria 

Guidance 

information for other hazardous materials hel

on site, including: quantities; hazardous 

properties and the nature of their effects on 

people and the environment; an outline o

use and storage of the materials on site; and

outline of the major accident hazards. (These 

topics are covered in more detail in Sections 9 

and 10); 

details of the technical advice that company can

provide to

d

f the

an

•

assist the emergency response 

• (and

s chemicals) which may 

s);

•

ed

d

• in

ite emergency plans, to be taken by ond 

(criterion 14.2 refers); 

relevant technical details of the equipment

other resources such a

be normally available on site and which may be 

available to assist the off-site emergency 

services during an emergency response, 

including resources supplied from other 

establishments with which a mutual aid 

agreement may exist (criterion 14.3 refer

the functions of key posts with duties in the 

emergency response, their location and how

they can be identified: e.g. the posts authoris

to set the emergency procedures in motion an

the conditions for doing so; the post responsible 

for the co-ordination of the on-site mitigatory 

action; the post responsible for liaising with the 

off-site emergency services (criterion 14.2 

refers); 

outline of the initial actions, and procedures

the on-s

site staff once the emergency has been declare

e.g. the warning of the public and adjacent sites,

the setting up of emergency facilities such as the

emergency control room, and the response 

expected from on-site personnel (e.g. sheltering) 

(criterion 14.8 refers). 

Elements in the Safety Report N he On-site Emergency

Plans 

ecessary to Draw Up t

C

The safety report should 

se

hich

s

d)

drawing up the on-site emergency plans should be 

the plant to limit the 

consequences of a major accident; 

riterion 14.8 The information that has been used as the basis for 

summarise tho

measures of protection 

and intervention w

have been used as the 

basis for drawing up the

on-site emergency plan

(Schedule 4 Part 2, para 

5

brought together in the form of a summary in the 

safety report and should cover: 

• the equipment installed in

• the organisation of the alert and intervention; 

• the on-site and off-site resources that may be

153 
Emergency Response 

Criteria 

Guidance 

mobilised. 

Criterion 14.9 

hould

ents

l,

Operators should explain the arrangements that they 

a

e applicable until the local 

ports should include confirmation of the 

The operator s

confirm the arrangem

that have been made to 

give information to the 

public, and every hospita

school or other 

establishment serving the 

public, in the area around 

the site, so designated by

the competent authority

(Regulation 14)

have made and when the details were sent out. This 

information should be sent out at intervals not 

exceeding 5 years or where changes are required as

result of the reviews discussed below. They should 

also confirm that the information required by Schedule 

6 has been included. 

This criterion will not b

authority has prepared an off-site plan required by

COMAH. 

Updated re

review arrangements for the information provided 

required by Regulation 14(6) every 3 years or where

there are changes on site requiring a review. 

154 
15. GLOSSARY

Terms defined in COMAH Regulation 2(1) and elsewhere in the regulations carry the 

same definition within SRAM where used. These definitions are not repeated below. 

Activities Events in the establishment under the control of the occupier but not 

necessarily directly involved with the installations where dangerous

substances are located. These will include vehicle movements, 

transport and transfer operations. 

ALARP Stands for `as low as reasonably practicable'. The concept implies that 

ultimately there is a trade-off between the costs of risk reduction and 

the benefits obtained. Most decisions on whether risks are ALARP 

should be made by exercising professional judgement on whether the 

risks are reasonable when set subjectively against the cost of further 

risk reduction. In some cases, a formal cost-benefit analysis can be 

used which can be seen to give a more objective analysis of costs 

against the benefits of risk reduction. The ALARP concept is sometimes 

referred to as BATNEEC (best available technology not entailing 

excessive cost), which is often applied in environmental contexts. 

Appropriate Fit-for-purpose in the particular context. 

Assessment In this context, the process of reading a safety report and reaching a 

conclusion as to the adequacy of the demonstration that all necessary 

measures have been taken to prevent major accidents or minimise their 

effects. 

Assessment

Manager (AM) 

The field inspector responsible for co-ordinating the various 

assessment tasks and ensuring that the conclusions are 

communicated to the operator.

Assessors The various people who will be completing the assessment process to 

the satisfaction of the assessment manager. These will include 

representatives from the various disciplines within HSE and the 

Environment Agencies. 

CAS Number A unique numbering system used to identify chemicals according to the 

Chemical Abstracts System scheme. 

Competent 

Authority (CA) 

In relation to an establishment in England and Wales, the Health and 

Safety Executive and Environment Agency acting jointly. In relationship

to an establishment in Scotland, the Health and Safety Executive and 

Scottish Environment Protection Agency acting jointly (Regulation 2(1) 

refers). 

Conclusions The judgemental view reached by assessors on the adequacy of the 

arguments and demonstrations made in the safety report based on 

prima facie assessment of a safety report. The written conclusions of 

the assessment team are sent to the operator in accordance with 

COMAH regulation 17. Conclusions may include an agreed plan for 

additional action by the operator. 

Control 

measures 

The means for controlling the realisation of hazards (i.e. limiting their 

occurrence probability / likelihood) and for mitigating the associated 

consequences (e.g. a water spray system for mitigating releases of 

anhydrous hydrogen fluoride). 

Controlled 

Waters 

As defined in paragraph 104 of Part III of the Water Resources Act 

1991. 

Criteria Defined standards of performance against which actual or predicted 

performance can be assessed. 

155 
Demonstration 

of safety 

The process by which the operator provides information to show that all

necessary measures to prevent major accidents, or mitigate their 

effects have been taken.

Enforcement The range of tools available to the regulator from advice and guidance 

through to legal action. 

Environment The surroundings around, over and under an establishment including 

the flora, fauna, buildings and infrastructure. 

Harm The severity of the consequences of any potential major accident for 

people or the environment. 

Harm criteria Essentially dose-response relationships for converting hazardous 

phenomena (spatial and temporal variations in contamination 

concentration, overpressure, thermal radiation) into harm for people 

and the environment. 

Hazard A physical situation with the potential for human injury, damage to 

property, damage to the environment or some combination of these. 

Hazard 

analysis 

The process of identifying undesired events that lead to a hazard being 

realised, the analysis of the mechanisms by which these undesired 

events could occur and the estimation of their likelihood and the 

magnitude of any harmful effects. 

Individual risk The frequency at which an individual may be expected to sustain a 

given level of harm from the realisation of specified hazards. 

Inherent safety The principle whereby a hazard is avoided at source rather than by 

employing measures to prevent its realisation or reduce the 

consequences of that realisation after the event. 

Key Risk 

Control 

Systems 

Those risk control systems which are of key importance for the 

prevention and mitigation of major accidents. 

Management 

arrangements 

In the context of health and safety at work in general, the term applies 

to an employer's arrangements for health and safety management and 

covers the elements of "policy", "organising", "planning and 

implementing", "measuring performance" and "audit and review". The 

concept is explained in HS(G)65 and the HID Inspection Manual. In the 

context of major hazards, the term applies to the operator's 

arrangements for managing major hazards and covers the same 

elements but as they relate to the prevention and mitigation of major 

accident i.e. "Major Accident Prevention Policy", "organising.... etc". 

Mitigation The process of reducing the scale of the consequences of a major

accident. 

Process Any operation by which dangerous substances are stored, transferred, 

handled, or changed in some way. 

Protective 

system

An active or passive means of protecting plant from dangerous 

conditions either from within (e.g. overpressure) or without (e.g. fire). 

Prevention The means for eliminating hazards or reducing their likelihood and for 

mitigating the associated consequences. This includes approaches to 

inherent safety and identification of suitable control measures. 

Qualifying 

inventory or 

quantity 

The quantity of a dangerous substance as defined in Schedule 1 of the 

Regulations and used to determine the application of the various 

provisions of COMAH. 

Residual risk The risk remaining after all proposed control measures for the 

establishment have been properly implemented. 

Risk The likelihood of a specified undesired event occurring within a 

specified period or in specified circumstances. 

156 
Risk analysis The process of hazard analysis, and the estimation of associated 

levels of risk to people, property, the environment or a combination of 

these. 

Risk 

assessment

The process of risk analysis and the evaluation of the significance of 

the results. 

Risk Control

System (RCS) 

A part of the overall safety management arrangements that sets out 

how the SMS is applied to a specific task or activity. 

Risk reduction The process of risk assessment coupled to a systematic consideration 

of possible control measures and a judgement on whether they are 

reasonably practicable to implement. Essentially the process for 

demonstrating that the adopted controls make the risk to people and 

the environment ALARP. 

Safety-critical An item of plant or human action is safety-critical if either its failure 

could cause or contribute substantially to a major accident, or its 

purpose is to prevent or limit the effect of, a major accident. An event is 

safety critical if its occurrence could lead to a significant release of a 

dangerous substance with major consequences to people or the 

environment. 

Safety-integrity The probability of a safety related system satisfactorily performing the 

required safety functions under the stated condition within a stated 

period of time. 

Safety-related 

control system

A system which is intended to implement the required safety functions 

needed to maintain a safe state, and achieve, in conjunction with other 

risk reduction measures, the necessary safety integrity. 

Safety 

Management 

System (SMS) 

In the context of major hazards, the term applies to the operator's 

management arrangements and key risk control systems required for 

the prevention and mitigation of major accidents, and in scope 

encompasses the issues described in Schedule 2 of the Regulations. 

Scale of the 

hazard 

The severity of the worst-case scenario associated with a hazard. 

Usually determined by the loss of containment of the maximum 

inventory of the substance presenting the hazard. 

Serious 

deficiency 

When the measures for prevention and mitigation of a major accident 

are sufficiently lacking to require prohibition of the use of an 

establishment, installation or part thereof, as described in Regulation 

18. 

Societal risk The relationship between frequency and the number of people suffering 

from a specified level of harm in a given population from the realisation 

of the specified hazards. 

Trip system A means of actively ensuring that conditions within plant remain within 

safe limits. Trip systems work in association with alarm systems and 

operate by detecting excursions beyond alarm conditions and 

controlling the process or equipment to a defined (safe) state. 

Used correctly Suitable procedures or models have been applied without mistakes, 

including validity checks e.g. the derived estimates of event likelihood, 

consequences etc. (whether qualitative semi-quantitative, or 

quantitative) are realistic and compatible with company or other 

recognised benchmarks. 

Verification Used in SRAM in the context of testing the accuracy of any aspect of 

the safety report. 

This will be part of the inspection process after the desk top 

assessment of the safety report is complete. 

Worst case 

scenario 

Usually associated with the loss of containment of the maximum 

inventory of the hazardous substance and the subsequent scenario that 

produces the worst outcome for people or the environment. 

157 
158