## THE SAFETY REPORT ASSESSMENT MANUAL

Sections 8 to 15

8 - HOW TO USE THE CRITERI A

.............................................................................. 2 9 - DESCRI PTIVE AS P E CTS

................................................................................... 19 10 - PREDI C TIVE AS P E CTS

.................................................................................... 30 11 - MAJOR ACCIDENT PREVE NTI O N P O LICY & SAFETY MANAGEMENT SYSTE M S ASPE CTS

............................................................................................... 49 12 - TECHNICAL ASPECTS

..................................................................................... 64 13 - GUIDA NCE F O R E N VIRONME N TAL ASS E SSMENT

.................................... 125 14 - EMERGENCY RE SPONSE A RRANGE M ENTS

............................................. 140 15 - GLOSSARY

..................................................................................................... 155

1

## 8. HOW T O USE THE CRITERIA
Scope 2 Principles of assessmen t criteria 2 Structure of the assessment criteria 3 Use of the criteria 3 Request for further infor m ation 4 Serious deficiency and other deficie ncies 6 Demonstration 7 ’Suitable’ an d ‘sufficient’ 8 Assessment of the demonstration of ALARP 8 Concluding an assessment 9 Revision plan 9 Intervention strategy 10 Human factors assessment 10 Figure 8.1 Links betwee n schedule 4 and assessment criteria 11 Figure 8.2 - Information required in a safety report 13 Appendix 8.1 Requests fo r information – Examples 14 Appendix 8.2 – Main questions to b e answered 17



### Scope

1 This section of the manual provides guidance on principle s a nd the approach to using the assessment cr iteria. The a ssessm ent criteria are co ntained in subsequent parts of the manual and are used by assessor s t o examine safety reports, submitted under the COMAH regul ations, to re ach conclusions on the e x tent to which reports meet their purposes und er the regulations. The conclusions are then use d to inform the intervention strategy for the estab lishment an d/or its in sta llations.



### Prin cip l es o f assessmen t criteria

2 For the purposes of a sa fety report, Schedule 4 Part 1 paras (1) to (4) of the regulations identifies 4 e l ements that need to be demonstrated by the operator. The extent of the information required for each demonstration to b e made depends on the type of safety report required by Regs. 7 or 8.

3 The differen t report types that may b e submitted for assessment include:

• the initial re port for each existing establishment,

• pre-construction reports

• pre-operation reports for new establishments,

• modification and periodic updated re ports for all establishme n ts throughout t heir life.

4 Assessment criteria provide a framew ork to promote consistent consideration of matters to be examined during assessment. The criteria do n o t constitute a mandatory p r ocess for a ssessment and assessors are not obligated to address every criterion, nor to the sa me depth of detail. Crite r ia are inten ded to be used with pr ofessional ju dgement and experience, based on their applica t ion to specific hazards and risk at establishm ents, and the demonstrations provided in reports. Th e aim is to a c hieve a co nsistent and proportiona te approach to assessment within a fra m ework.

25 The information required in a safety report, both f o r making the necessary demonstrations and for action by the competent authority and local auth o rity, is written in ter m s of goals to be achieved. In doing this, the ope rator should ensure the links to the r equired demonstrations are properly made and clear. The a ssessment criteria help assessor s g a ther information and un derstand ho w goals might be achieved.

6. The criteria are present ed in Sectio ns 9 to 14 of this manual. The links b e tween the assessment criteria, the purposes in Sched ule 4 Part 1of the regula t ions and th e type of information required as a minimum b y Sc hedule 4 Part 2 of the re gulations can be seen in Figure 8. 1.

7. The criteria are necessa rily quite ge neral. This r e flects the b r oad nature of the type of establishment which is covered by COMAH and the range of hazards to be encountered . The criteria apply when assessing information relating to all health, safety and environmenta l issue s

.

8. A diagram showing the information required in a safety report can be see n at Figure 8.2.



### Struct ure of the assessment criteria

9. The criteria are set out in 6 groups t hat are then divided into a number of “categories” as outlined in the following paragraphs. These “categories” a r e the main issues u pon which the a ssessment t eam should come to a common vie w

.

10 The criteria in SRAM are the primary guidance for assessors. These criter ia are support ed by expla natory text.

11 More detailed technica l guidance su pporting the topics covered by Sections 10, 12 and 13 of SRAM exists on the rele vant agency Website an d/or Intranet. This guidance is subject to re view and development a s part of the CA’s corporate knowledge base to addr ess techn i ca l issue s and practices.

12 Guidance to the criteria in SRAM appears in a 'tick list' style and should be interpreted as 'prompts' for an experienced assessor. The guidance is not a checklist for report writers and will not constrain asse ssors from consid ering or asking for other information if the circum stances d i ct ate.



### Use of the criteria

13 There are overlaps between a number of criteria in different chapters, b u t these reflect the fa ct that the same piece of information may be use d to help more than one demonstration. Howeve r, where assessment by an assessor leads to are a s that are likely to inter f ace with an other discipline assessor ’s principal scope of assessment,

assessor s will, where ap propriate, se ek to reach an agreement at an earl y stage on who will lea d on a topic or on issue s arising. Th i s is to avoid unnecessar y duplication of assessment. (Note: further guida nce to techn i cal discip lin e assessors is provided in Section 1 2 of the manual.)

14. As a general guide on a ssessing COMAH safety reports, the following o v erview of the assessment process may be helpful to assessors in for m ing their overview of the demonstrations in th e safety report.

Assessors should be able to:

3a) Gain a clear understanding of the pr ocesses, pla n t and environs of the establishme n t (or installation).

b) Consider th e hazards d e scribed, w hether they are appropriate and representative of the activities carrie d out and th e appropriat eness of the measures identified to control them, i.e. there sh ould be clea r links between the measures provided and the major accident scen arios identified.

c) Focus on sy stems and outcomes that show how the operator has reduced risks to ALA R P and how they achieve continuou s improvement in relatio n to preventing and limitin g major accidents.

d) Consider th e operator’s MAPP and SMS, and h o w it relates to the requirements of the COMAH regulat ions, taking into account the described a dequacy and reliability of the measures when assessing whether the MAPP and SMS will work in practi ce.

e) Immediately pursue and verify an y measures that , on reading, are suspected o f being serio u sly deficien t. These def iciencies sh ould be resolved independently of reaching assessment conclusions.

15 Reme mber t hat the asse ssment of a safety report is not a discrete activity but leads to furt her action u nder the inte rvention plan for the op erator at that establishme n t.

16 The individual assessment criteria ar e used in de tail to come to conclu sio n s about the measures pro v ided and whether the p u rposes req u ired of a sa fety report under COMAH have be en met. Assessors sh ou ld record det ails of the i r assessment s on the templates provided on CA internal computer systems.

17 The effort p u t into the a ssessment should be suf f icient solely for the CA to reach conclusions on th e safety report, based o n the questions in Appe ndix 8.2 (Overall Purpose).



### Re quest f o r further informati on
18 Assessment does not re sult in a pa ss or a failure for a safety report but the CA will ‘communicate’ it s co nclusion s to the operator.

19 Assessors may decide that there is insufficient information to conclude t hat the required purposes in Schedule 4 Part 1 of the re gulations ha ve been met

. In making requests for further infor m ation, it is assumed that such infor m ation should already exist (or be rapidly produced) if the company has conducted t he necessar y work in preparing th e demonstrations in the r eport. In this event, it is assumed that the operator ca n readily su pply such inf o rmation (typically within around 4 weeks, thou gh longer may be agreed provided this does not impact upon th e assessment schedule for completion).

20 An assessor may suspect with good reason that essential inf o rmation is missing because it is no t available a nd requires extra work to develop it. However, the operator must be given the oppo rtunity to provide the required information – it may be a v ailable, but ju st not includ ed for whatever reason, or they ma y be able to

4produce it q u ickly. It is f o r the operator to say that they cannot produce information when required, not for a ssessor s to assume they cannot provide it when required.

21 Information might be obtained in writing, or from a site visit, e

. g. from interviews or from documents held on site by t he operat or, or other means that best achieve the required out come in the time available. Information obtained following sit e visits, or other informal route sho u ld be formally requeste d or logged in writing with the company, vi a the Assessment Mana ger. This is because an y further information which is obt ained and contributes to the purpose s of the repo rt, such as t he demonstrations to be made, will be kept with th e safety report and placed on the Public Register (subject t o the determination of an applicat ion for perso nal or commercial confidentia lit y, or because of national security). In all cir c umstances,

assessor s will be obtain i ng information to supp ort or clarify the arguments in the safety report and not undertaking inspection to verify sta t ements made

. Additional in formation obtained by an assessor should be distributed to ot hers in the assessment team. (For further guida nce see also Procedures 5.1.)

22 If, following a request, th e operator is unable to pr oduce the re quired information without con ducting significant addi t i onal work, t hereby resulting in a delay in supplying the information such that the assessment cannot be completed within the required assessmen t timescales, the assessment should be conclud ed as furthe r outlined in ‘Concluding An Assessment’ below.

23 Requested information SHOULD:

a) be directed at reaching an assessment conclusion on the demonstrations in accor dance with t he requirements of the r egulations.

Requests fo r information SHOULD NOT be used to:

a) ask the oper ator to unde rtake additio nal work (i.e . such as wo uld extend response to more than 4 weeks).

b) obtain infor m ation to resolve issues that would be regarded as inspection (i.e. verification of demonstrations).

24 When making written requests for furt her information, assesso r s should en sure that:

a) The issue u nder consid eration is clearly explained, preferably with an outline of ho w the report fails to addr ess the issu e. Reference to the relevant assessment crit eria to which the deficie ncy relates and to the relevant COMAH regulat ion(s) and/o r schedule(s) should be made.

b) There is a clear link to h o w the further information relates to meeting the required de monstrations, with refer ence to the r egulations.

c) The nature of the requir ed information that is expected in or der to resolve the issue( s) is indicated.

d) An indicatio n of the importance of th e information to the demonstration is given, i.e. necessary to make, or to clarify understanding of, the demonstration (medium/ l ow); potential signif i cant deficien c y in the measures (major).

525 Assessors should avoid information requests tha t:

a) ask open en ded or vaguely worded questions.

b) do not have a clear lin k t o making a demonstration.

Failure to clearly define the require ments for further information is likely to result in inadequat e or wrong information being received.

[Note: See Appendix 8.1 for exampl es relating t o information requests.]


### Serious deficiency and ot her deficiencies

26 The report may describe measures that appear to be seriou sly deficient for preventing or controlling a major acci dent. The assessment te am will form a view about these measures and will balan ce them against the l i keli hood of the related major accid ent hazards and their co nsequences when considering serio u s deficiency as applica b le to Regulation 18.

27 The CA has a duty to prohibit that par t of the serio u sly deficien t operation t hat could lead t o a major accident. The CA will visit the site to check wheth e r the measures signposted by the report are act ually seriously deficient, before taking action under Regulation 18.

28 It is only the measures provided by t he operator that can be considered ‘seriously deficient’ u nde r COMAH a nd not the report itself

.

29 There is no legal preced ent in health and sa fety legislation as to what serious deficiency might mean. The dictionar y definition of ‘deficiency’ refers to ‘defect’, and ‘a lack o f co mpleteness’. The assessment team must form th e consensu s professional view that a major gap or defect exists in the measures provided, linked to prevention or limitatio n of a major accident, for serious def iciency to be determined.

30 Assessors should not co nsider a measure(s) to be seriously deficient just because it might be reasonably practicable to a c hieve high er standards of protectio n

. This would be a matter that should be addresse d during sub s equent inspection.

31 Deficiencie s in individual measures may be foun d, some of which might be considered significant, b u t not ‘ serio u sly defi c ien t ’ as describ ed in the guidance to Regulation 18. Action t o address measures that are conside r ed to be de ficient (but not ‘ seriou sly deficie nt ’) should form part of the in tervention strategy for the establishme n t, prioritise d on a risk b a sis. Consideration sho u ld normally be given to the totality of measures to prevent and limit major accident s b e fore proce eding to the issue of pro h ibition not ices under Regulation 18.

32 In the conte x t of the safety report, the assessment team ma y consider t hat the depth of info rmation contained is so low that a decision may be reached to return the safety report to the site o perator for resubmission , tied to an a g reed plan f o r resubm issio n :

a) An omission of information leading t o the return of a safety report would apply to sig n ificant or la rge-scale o m ission of in formation required to meet the demonstrations and not to smaller discrete o m issions.

6b) An example might includ e failure to p r ovide sufficient information on the process u s e d for identifying the liste d major hazards. In this example, there might be a failure t o describe who has ide n tified the h a zards, no description of the methods that were employed o r how suitab le methods were determined, and no information on how the identified ha zards were developed into represe n tative scen a rios for furt her analysis. This omission would be a larg e gap in a significant are a of the total risk assessment process an d has strong implications for the asse ssment of later stages in the risk a ssessment cycle, including select ion of measures.

c) Failure to id entify a possible major accident sce nario may n o t by itself b e so deficient as to warrant return of th e safety report as measures may exist that provide a level of protectio n that is not ‘ seriously de ficient ’. Similarly, failure to descr ibe risk a sse ssment team competen cies would not on its o w n be so deficient for ret u rn of the report if methodology for hazard ident ification and scenario se lection and prioritisat i on were broadly described.

d) There should be no action to prohibit an activity, following a substantial omission in t he information in the rep o rt leading t o the return of the report, unless a ‘se r ious deficie ncy’ in applied measures were also establishe d at a site visit.



### Dem o nstr ation

33 There are a number of demonstrations to be made. These a r e linked to t he criteria as o u tlined in F i gure 8.1. T he report sh ould demonstrate the lin k between the measures taken and the ‘major accid ent hazards’. Having exa m ined the information in the report

, the judgement about whether the report demonstrates that the necessary measures have been taken should be linked to the adequacy of the MAPP and SMS.

34 For the purposes of a sa fety report required by COMAH, ‘ d e monstrate ’ means

‘ sho w ’, ‘ j ust ify ’ or ‘ argu e the case ’ by the information given. It is NOT taken to mean ‘pursue by extensive in-depth scrutiny’ or ‘exhaustive examination to prove beyond reasonable doub t’ whether the relevant criteria have been made and the demonstrations achieve d

.

35 The safety report should :

a) Show the a pplication of due process for identif ication and a nalysis of hazards that is suff icient ly rigorous, systematic and proportio nate to risk.

b) Show how all measures necessary have been identified an d linked to specified major acciden t hazards, a nd impleme n ted to redu ce risks to ALARP.

c) Justify wh y identified m easures are not impleme n ted by arg u ment under ALARP prin ciples ( i .e. g r oss disprop o rtion of effo rt or cost lin k ed to risk benefit gain ed). ‘ Argument ’ can b e made using qualitative or quantitative statements appropriate to the level of risk.

d) Show that a n on-site emergency plan is in place, based on sound principle s a nd reflecting the major accident scen a rios identified.

7

### ’Suita ble’ and ‘s ufficient’

36 The assessment criteria make references to inf o rmation that is ‘su i table or ‘sufficient’. For the purposes of assessment these terms are taken to mean:

a) ‘Suitable’: Valid and ap propriate for the operato r's situatio n and circumstances as described in the safety report.

b) ‘Sufficient’: Supporting information and arguments are well developed and presente d , proportio nate to the d e scribed lev e l of risk based on th e circumsta n ces outline d in the safe ty report.



### As se ssm ent of t h e dem o nst r ation of ALAR P

37 The guidance to Regulation 4 (General Duty) describes the a pplication of all measures necessary to reduce risk of a major accident to A L ARP based on a hierarchica l approach (in herent safet y , preventio n, control, mitigation). T he assessment process se eks evidence of the application of th is princip l e t o the identified m a jor acciden t scenario s.

38 Important elements of the ALARP de monstration include:

a) Identification of all ma jor accidents and their probability of occurrence using appro p riate and p r oportionate systems of analysis.

b) Assessment of the consequences (extent and severity) of identified major accid ent scenario s using appr opriate and proportionat e systems and methods of analysis.

c) The linking of specif ied measures to specific major acciden t scenario s, not just a st atement, in isolation, of measures that exist at th e establishme n t. [Note: it is important that the safet y report does not simply state what measures exist, but that it also dem onstrates ho w the company has examined the link b e tween identified scenar ios and the identified measures that address t hose specific hazard scenarios. and the identifica t ion and implementation of f u rther reaso nably practicable measures to reduce risks to ALARP. ]

d) Identification of possib l e further measures that could be ap plied to lowe r the risk. [No t e: it is important that t he safety report demonstrates how the company ha s consid ere d what else might be done in the co ntext of further measures to address ide n tified hazar d scenario s. Hence, breadth and depth of assessment of reports also needs to focus proportio nately towards ‘what more me asures cou l d be applied ? ’.]

e) Justification for not implementing identified fu rther measures, based o n gross dispro portion between the ben efit gained in reduced risk and the cost and eff o rt required to implemen t the measures (reasona ble practicability).

39 Detailed guidance on the consideration of ALARP is provided on the HSE Website and HSE’s Intranet – see COMAH Ho me page

.

40 Conclusions on the demonstration of ALARP nee d to be reached by the assessment team at the end of the a ssessment process during the asse ssment

8closeout me eting. It is u n likely that a n y one assessor will be i n a position to form a complete opinion on the demonstration of ALARP in isolatio n without in put from the rest of the te am.



### Concl udi ng an as s e s s me nt

41 Assessment of a safety report may b e drawn to a conclusion, with issues arising from the assessment remain ing unresolved at the time of conclu sion.

42 The assessment process is only a p a rt of the COMAH regi me and exa m ines at face value the factual in formation and examines arguments and demonstrations contained in the report against the re quirements of the regula t ions. Criter ia are used as a framework for asse ssment. Conclusion s on the adequa cy of the report in meeting the purposes id entified in th e regulation s are reache d at the end of the assessment process. T hese conclu sions are u s ed by the CA to inform and prioritise further inter v ention with the company.

43 The assessment conclu sions reach ed by the assessment te am need to clearly describe wh y a demonst r ation has n o t been met and refer to the relevant SRAM criteria to w h ich the deficiency relat e s and to th e relevant COMAH regul ation or schedule. A ppendix 8.2 lists the main questions to be asked to help the a ssessment team to reach conclu sion s.

44 Assessors may make a request for further infor m ation during assessment, raised on th e assumptio n that such information should be rea d ily available. Upon receipt of this information, the assessor should d e cide wheth e r concerns have been adequately addressed o r if further in tervention is needed. A conclusion should be reached at t h is stage. If information is not readily available upon request (e.g. requiring fur t her work by the company), the assessment con c lusion s sho u ld be drawn on the basis of in formation supplied.

45 Drawing assessment to an end at this stage with written conclusions sets a baseline for future intervention strate gy for the site. This allo ws the work to be prioritised in context with any other work , not necessarily dire ctly linked to the assessment process, th at may need to be under taken with t he site. If th e ‘further

assurance s ’ sought by an assessor are simply about demonstration and do not have a likely outcome of further necessar y measures, then this might be priorit i sed ‘low’ on the risk scale. If however, further measures lin ked to preventing a major accident are suspected t o be a like l y outcome, then it would be prioritise d more highly, taking account of t he scale of t he consequ ence and risk.

46 Concluding assessment in this way reduces possible interf erence with pr ogress on potentially more i m po rtant intervention activity concerning other possib l e high risk issues a ffect ing the site. It allows the relative importance of o u tstanding a ssessment issues t o be programme d into the overall site int e rvention plan dealing with all outstanding matters for the site, not just asse ssment.


### Revision plan

47 Where the assessment t eam conclu des that sig n ificant furth e r information is required to make adequate demonstrations then a revision pl an will be re quired. The output from the plan is a revised saf e ty report in which the d e monstrations are made, or the assessors are sat i sfied that th ey hav e suff icient inf o rmation to decide whether there are se rious deficie ncies, or the assessors are content t hat there are no longer significant shortfalls in t he demonstrations made in the safet y report. Me asures that

9are found to be deficient at this sta g e will be incl uded in the i n tervention plan for the establishme n t.

48 The revision plan should specify the information required, the reasons wh y (e.g. In supp ort of what demonstration and why it is thought lacking) and when the information is required b y . The time for producing the require d information will depend on t he significan c e of the matters, any representation s that the op erator makes and the resource s available t o the CA in its asse ssment and intervention programme. The information can be supplied a s revised pages of the rep o rt or in a separate lett er. All requir ed information received will form part of the safet y report.


### Intervention strategy

49 As an outco me of the conclusion s of the assessment process the asse ssment team ma y make recommendations fo r inclusion in the intervention strategy for the establishme n t. Recommendations should ident ify topics for inspection or other intervention, estimate resources and indicate wh en such inte rvention should take place (priorit isation) over the followin g 5 year period until the next periodic resubmissio n of the safe ty report.



### Huma n fa ctors as s e s s me nt

50 The conside r ation of hu man factors potentially a ffects all discipline s . Th e criteria in Se ction 10, 11 and Section 12 of SRAM include out line guidance on areas where huma n factors may be an issu e relevant to specific discipline s . Ad ditionally, guidance on human factors is cover ed in a stan d-alone Appendix 4 in Section 12 in respect of te chnical mea s ures and is available fo r use by all assessor s d u ring

assessm ent

.

51 Not all safet y reports will necessari ly receive a dedicated assessment by a Human Factors specia list assessor (t o be agreed when settin g the target assessment agenda). This is be cau s e the most effective assessment of human factors issue s is often achieved by direct contact with the site as p a rt of the int e rvention strategy. It will also dep end upon th e nature and depth of h u man involvement in safety critical functions at the establishment or site.

52 Assessors o f all disciplin e s should th erefore take account of human factors as it affects t h e i r discipline, using the gu idance provided. This a pproach doe s not prevent assessors se eking the specialist sup port of the Human Factors t eam during assessment if deemed appropriate.

10

### F i gu re 8.1 L i n k s betw een schedu l e 4 and assessment cri t eria

The figure b e low shows the links bet ween the relevant Schedules of the COMAH Regulations in terms of the purposes contained in Schedule 4, Part 1 and the information required by Schedule 4, Part 2 and the primary blocks of assessment criteria. Par agraph numbers in colu mn 1 (Purpo se) and colu mn 3 (Information required) relate to parag raph numbers in the respective parts of Schedule 4.

PURP OSE ( S ch4 Pt 1) ASSES SME N T CRITE RIA INFORMATI O N REQUIRED (Sch4 Pt 2) Para1. Demonstrate MAPP and SMS put int o effect. MAN A GEMENT OF RI SK Description of MAPP an d SMS in place (Sch 2). Para1. Information on managemen t system and organisation re major accident pre v ention.

Provide knowledge to help CA with each of the demonstrations.

Basic under standing

Para 4. Supplyinginformation to enable offsite em ergency plan to be drawn up.

Para 5. Provide sufficien t inf o rmation to CA for land use plannin g purposes. DESC RIPTI O N A ND OTHE R INF O R M ATION Para 2. Presentation o f 'environmen t' of establishme n t (2a, b, c).

Para3. Description o f installat i on ( 3a, b, c(i), (ii), (iii)).

Para 2. (1st part). Demonstrat e major accident ha zards identified. MAJOR AC CIDENT SCENARI O S Para 4a. Probability or conditions u nder which they occur. Summary of initiating eve n t for each.

Para 4b. Consequence assessment - severity and extent.

11PURP OSE ( S ch4 Pt 1) ASSES SME N T CRITE RIA INFORMATI O N REQUIRED (Sch4 Pt 2) Para 2. (2nd part). Demonstrat e necessary measures taken to prevent

m a jor accid ents.

Para 3. Demonstrate adequate sa fety and reliability in corporated in to: (a) design and construction (b) operatio n and maintenance. PREV ENTI ON OF MAJOR AC CIDENT S Para 4c. Technical parameters and equipment used for safet y of installatio n

.

Para 5a. Equipment installed to li mit consequences.

Para 2. Demonstrate necessary measures taken to limit consequences of major accident (2n d part).

Para 3. Demonstrate adequate sa fety and reliability in corporated in to: (a) design and construction (b) operation a nd maintenance.

Para 4. Demonstrate onsite emergency plans drawn up. LIMIT CONSEQUENCES OF MAJOR ACCID E NT S Para 5b. Organisation o f alert and int e rvention.

Para 5c. Mobilisab le resources (internal and external).

Para 5d. Summary of 5(a), (b) and (c) for drawing up on-site plan.

12

### Figure 8. 2 - Informa t ion re qui red in a s a fety report

Sufficient information

All necessary measures to prevent MAs and limit

conse q uences ( Re g .4 )

MAK E DEMON S T RATIONS ( Sch.4 Pt.1 )

Identify MAHs Take necessary
measures

Emergency Plan Provide information for others to use ( Sch.4 Pt.2 )

Domino Effects Siting new activities

Offsite emergency Quantities Properties Dangerous Substances

Environmen t of site Adequate safety & reliability M A PP & SMS put into effe ct

Establishment Processes

13

### Appendix 8.1 Request s for information – Exam ples This append ix provides examples of requests fo r information (RFIs) that assessor s of safety reports may make to operators during the assessment process. T he expectation is that infor m ation requested should normally b e available and therefore can be readily supplied b y operators in support of their demonstrations.

Where possible, RFIs sh ould be clea rly stated, linked to the r equirements of the regulations and should state or imply the nature of required information that is needed to resolve the issue being ra ised.

Example 1
The followin g is an example of an RFI request based on on e that was made to, and on the respo n se receive d from, an Operator. Comments on how the aims of information requests are met are included as co mments wit h in bracket s

.

Issue raised to Oper ato r
’Pt 1, Management of Health & Safety, Section 3 , para7 in th e safety report – Isolation Pro c edures: It is stated in the safety report that any isolation not meeting minimu m recommended isolation sta ndards must be risk a s sessed befor e the isolation is a pproved. The dutyholder is request ed to clarify what practical steps and responsibilities are descr ibed in the isolation pro c edures (or related docu m ents) to initiate a fea s ibility review to upgrade isolation p r ovisions for future interventions.

Continued (i.e. repeated ) interventions using less than minimum standa rds of isolation, alb e it supporte d by a Level 2 risk a ssessment (as defined in the procedures)

, is not an a cceptable lo nger term strategy for isolation, with out reasonably practicable measures being ta ken t o achieve minimum (or b e tter) recommend ed standard s to meet foreseeable fut u re requirements (i.e. reduce the risk to ALARP of a major accident du e to loss of containment during maintenance)

[Basis: Reg. 4; Sch. 4 Pt2 (1); SRAM Criterion 12.2.5.1. Importance ‘Medium’.].’

[ Comment : The above example describes the a sse ssor ’ s co ncerns by explaining in the 2nd paragraph what the issue is, viz. that if t here is a def iciency in isolation arrangemen ts, it is not sufficient simply to repeatedly exercise a fall back isolation assessment procedure t o justify a su bstandard isolation every time the maintenance procedure n eeds to be carried out. I t may be justified to ado pt ‘exceptio nal’ arrangemen ts the first time. Howe ver, once the deficiency h a s been ide n tified, there should be fo llow up step s taken to improve the (isolation) ar rangements for the futur e if reasonably practicable (i.e. the A L ARP principle to take r easonably practicable measures to prevent maj o r accident s). This cou l d be planne d at a suitab le plant shutdown opportunity.

The first par agraph clear ly states what information is sought in the SMS t o address this con c ern

. Details sh ould be read ily available and can be supplied, e i t her as a statement in a letter fro m the Opera t or with reference to existing procedu res, or the entire proce dure could b e provided. The basis of the request within the re gulations and SRAM and an indication of the importance of the issue t o the demonstration is stated.]

14Opera t or’s S ubmitted Re spons e

A letter from the Operator explained:

’The Safe Isolation and Reinstatement of Plant Procedure (para 2.1) st ates: ‘Any isolation which does not meet the mi nimum reco mmended is olation stan dard ....... must be assessed using the Level 2 Risk Assessment...... Should any noncompliant isolation have to be repea tedly justifie d by risk assessment, co nsideration shall be give n to a permanently engineered solut i on.’

[ Comment : This short re sponse broa dly meets the concerns expressed in the

assessor ’ s r equest for fu rther information, with t he exception that there is no clear definition th at considera t ion of permanent solutions should be triggered following fir s t non-compliance and where similar f u ture intervention can be anticipated. The assessment of this issue can be dra w n to a cl ose at this point as there is no evidence to suggest a serious def iciency.

The text taken from the isolation pro c edures cou l d be read to imply that several nonconforming isolations co uld be applied before action is ta ken to review potential design modification to u pgrade the isolation to a t least meet minimu m required standards. ( R isk Assessment could be repeatedly implement ed to justify authorising the substan dard isolatio n. This in cr eases the risk of a failur e leading to loss of containment if the risk a ssessment is not fully ef fective on every occasion – a human factors issu e that can b e readily remedied by strengthening the procedu re to assign a clear respon sibility on the isolating a u thority.)]

Assessment Conclusion
An assessm ent conclu sion that can be drawn from the above is a recom m endation for improve m ent to the isolation pro c edures to p l ace a responsibility o n the appropriate isolation aut hority to initiate a design / modification review whenever a non-confor ming isolatio n is first pre s ented for th eir authorisa t ion. Action at this point should be ta ken to assur e risks are reduced to A L ARP at the earliest opp ortunity.

The implementation of t h is is a detail that can be noted for fu rther examin ation as post asse ssment interve n tion activity (inspectio n ).

Example 2
An assessor raised the f o llowing issues (shown in italics) following initial assessment of a safety report:

‘Criterion 3. 5.5 The worst case acciden t is stated to be a delayed ignition f i r eball following a catastrophi c failure of an aniline reactor. It appe ars that the f i reball ca lcul ations are based on a quantity of 2 x flash fract i on in the fir eball, althou gh the quant ity is not explicitly sta t ed.

Please provide your evid ence to sup port a “limited local flash immediately” following a reactor failure and the assumption of 2 x flash f r action (i.e. 34% at relief condition s) in the delayed ignition fireball. The information in CRR 277/ 2000, Review of RELEASE rainout model and the CCPS data (hse.gov.uk/research/crr pdf/2000/CRR00277.pdf) and particularly the De Vaull and King correlation, suggests that all the a n iline, rather than only 34%, could re main airborne

15[Basis: Sch. 4 Pt 2(4b); SRAM Crite r ion 10.5. I m portance – clarification issue - ‘Medium'.]‘

[ Comment: The assessor’s references disagree with the work done by the company and the request is looking to see what information they have to back up their assumption s. This could reasonably be put to the company as a further information request. Th e company should not n eed to cond uct further work to explain its assumption s used in th e assessment of this ev ent. The ba sis of the re quest within the regulatio ns and SRAM and an indication of t he importance of the issue to the demonstration is stated. ]

The assessor went on to request:

‘Please con s ider the eff e ct on the fir eball and to xic gas clou d calcula t ion s in the report of assuming that all the aniline remains airborne. What would be the impact on the hazar d/risk range s and numbers of people affected? ‘

[ Comment : the assessor wants to get an idea of the signif i cance of wh at he/she feels is an e rror in the re port. However this is act ually asking the company to do

some more work and this doesn't fit in with the aim of a further info requ est (readily available inf o rmation). The reality is that the company only n eed to do this work if they can't back up their assumption of 34% airb orne aniline. Therefore there should be no RFI at this stage, as presente d . If the co mpany can justify the assumption, the matter drops. If not, the n the assessment of this issue concludes on the basis that there is a fla w ed assumption and th at further work needs to be done via a revision plan to acco mpany the a ssessment t eam’s conclusions le tter

. The assessment conclusion a r e made and are not delayed while the assessor waits for th e company to do further consequen ce asse ssment work].

A further request from the assessor was:

‘Criterion 3. 5.5 The distance to LFL is u s ed in the re port for asse ssing flammable gas dispersion. In order to take account of pockets of gas being a bove the centreline or a v erage concentratio n and modelling uncertai n ty, the hazard range can be taken to be 0.5LFL. Please discuss your choice of LFL, and comment on whether a 0.5LFL criterion wo uld hav e any significant im pact on the asses s ed risks. ’

[Comment: The assessor wants to get an idea of the signif i cance of the change fro m LFL (Lower Flammable Limit) to 0.5LFL, before deciding ho w far to pursue the issue

. However, thi s may appe ar as something of an in formation fishing exercise, and may be seen as a request fo r further work rather tha n a request f o r readily available information. If the asse ssor can accept LFL, the n this is fine. If not the a ssessment team ma y conclude that a possib l e error is made and again reach conclusions on th is basis and re commend th at further work should be done linked to a revisio n plan.]

16

### Appendix 8.2 – Mai n ques tions to be ans w ered

The followin g questions should be considered, where relevant to the scope of the safety report and the assessment target agenda, by the assessment team when reaching the i r conclu sion s from the asse ssment of safety reports. Normally, for reports where assessment of all topics is requ ire d , all quest i ons should be considered prior to completion of th e Team Assessment Conclusion s Record in Appendix 4.5. For reports where only a sele ctive scope of assessment is undertaken, it is possible that not all questions ar e relevant (e.g. a revisio n report where only managemen t changes h a ve been made, and the r e are no material techn i cal chang es affecting major acciden t scenarios or technica l measures, may not require assessment by all discip lines).

MAIN QUE S TIONS T O BE CONSI D ERE D BY ASSE SSME N T TEAM

Q8.1 Does the report contain: (a) sufficien t information for the purposes of Sch edule 4 Part 1; (b) at least t he information required by Schedule 4 Part 2?

Q8.2 Is there: (a) a major accident prevention policy (MAPP) a nd (b) a safety managemen t system (SMS) for impl ementing it?

Q8.3 Does the report demonstrate that: (a) the MAPP and (b) the SMS have been put into effe ct, in accordan ce with the information set out in Sch edule 2?

Q8.4 Does the report demonstrate that th e major accident hazard s have been identified?

Q8.5 Does the report demonstrate that th e necessary measures have been taken to prevent and limit the con s equences of major accidents?

Q8.6 Does the sa fety report demonstr ate that a systematic and sufficiently comprehensive approach to the iden tification of r i sk reduct i o n measures has taken place?

Q8.7 In coming to conclusions on the measures nece s sary: (a) are there any assumptions, (b) are these clear, and (c) are the conclusion s valid, taking into a ccount any uncertaintie s in the data provided? Q8.8 Are conclusions drawn from the risk analysis wit h respect to emergency planning so undly based?

Q8.9 Does the report demonstrate that ad equate safet y & reliabilit y have been incorporated into: (a) the desig n, (b) construct i on, (c) operatio n, (d) maintenance, linked to the major accid ent hazards in the establishment?

17MAIN QUE S TIONS T O BE CONSI D ERE D BY ASSE SSME N T TEAM

Q8.10 Do the findings and con c lusion s in t he safety report show that the measures adopted to p r event and mitigate major accident s make the risks from a major accident AL ARP? [If the answ e r is NO, then at least o ne of the qu estions in Q8.4 to Q8.9 will also be answer NO].

Q8.11 Does the report demonstrate that an internal emergency plan has been drawn up?

Q8.12 Does the in formation supplied enable the local e m ergency pl anners to dr aw up an off-sit e emergency plan which will take the necessary measures in the event of a major accident?

Q8.13 Is there evidence that t here is a ser i ous deficien c y in the measures take n to prevent, limit and mitigate a major accident?

Q8.14 Does the report provide sufficien t inf o rmation to the competent authority (CA) to enable de cision s to be made in terms of siting of new activities and developments around existing establish m ents?

Q8.15 Does the report give sufficient in for m ation to enable the CA to identify establishme n ts or group s of establishm ents where the likelih ood or consequences of a major accident may be increased b y their proxi m ity because of the "do m ino effect?

18

## 9. DESCRIPTIVE ASPECTS

Introduction 19 Scope 1 9 General guidance for assessment of the descript i ve elements 19 Pre-construction and pr e-operation safety reports 1 9 Appendix 9.1 - Descriptive assessment criteria a nd guidance 20



### Introducti on

Scope
1 This guidan ce is for a s sessors co ncerned with the descript i on of the establishme n t; the dang erous subst ances and a c tivities on it , and the en vironment surrounding it. This de scriptive informat ion provi ded by the operator plays an essential pa rt in achieving the purposes of a sa fety report. Relevant Re quirements of the COMAH Regulations

2 The descript i ve information covered by this set o f criteria is n eeded to sat i sfy the demonstration of saf e ty required by Schedule 4 Part 1. The minimu m informatio n required is given in Schedule 4 Part 2, para 2 “Presentatio n of the environment of the establish m ent” and para 3 “Description of the installat i on”.

General gui dance for assessment of the descriptive elements
3 It is possible that the description of th e installa tion , the demonstration of safety and the major accident scenarios are not presen ted separate l y. The operator may decide to a m algamate i n formation relating to th e installa tion descriptio n and the demonstration of safety to better make the case, or aid the lo gical flow of the safety report. In this situation, assessment against this criterion wo uld need to be done in conjunctio n with any other criteria th at apply.

4 Some of the information required to assess the impact on the natural environment may alread y have been prepar ed for environme n tal impact assessment or other authorisation pr ocedures. It is permissib l e for the op erator to refer to this information. However, as sessment is made easier and more efficient if it is submitted as part of th e COMAH s a fety report, rather than by reference to authorisa t ions sent separately to the Agencies.

Pre-construction and pre-operati on safety reports
5 Pre-Construction Safety Reports (PCS Rs) and Pre-Operation Safety Repo rts (POSRs) should normally be able to provide det ails on all crit eria in this section, though some revision may be required in POSRs to reflect d e sign development since the PCSR.

6 Descriptions of the environment and surrounding populations should refle c t expected conditions on ce the site be comes operational. Wh ere commen c ement of operations is phased, re ports should describe cir c umstances (including t e mporary arrangemen ts such a s u s e of temporary offices a nd building s , inclusion of construction contractor p opulations, etc.) as they apply to each phase.

7 Overview de scription s of the establishment, particularly where relevant to major accident ha zards, emergency response, monitoring etc. sho u ld be descr ibed as far

19as information is availab l e at the time of submission of the r eport. Significant gaps in required info rmation should be just ified. Principles and design philosop h ies which will govern the eventual choice of eq uipment should be state d where detailed final arrangemen ts are not kn own.



### Appendix 9.1 - Descriptive asse ssment criteria and guidance

Descriptive Criteria Guidance
General
Criterion 9. 1 The safety report should give details to allo w communication w i th th e competent authority The safety report should include, a s a minimum:

• the name of the operator;

• if the operat or is a comp any, the address of the registered of fice;

• if the operat or is a tradin g partnership, the names and addresses of all trad ing partners, together with the name and address under which the partnership operates;

• the name and address of the establishment and if necessary t he installa tio n covered by the report;

• the name(s), address, te lephone & fax number and e mail address for contact(s) wit h in the operator's or ganisation f o r communi cation about the report.
Dangerous Substances
Criterion 9. 2 The safety report should identify the maximum quantities of every dangerous substance present, or potentiall y present, on the establishment [Schedule 4 Part 2, Pa ra 3 (c) (i)] Dangerous substance s are those which are eith er,

• listed in S c h edule 1 Part 2 of the Regulations, or

• meet the criteria laid do wn in Schedule 1 Part 3.

Those to be identified ar e:

• all dangerou s substan c e s at or above lower tier and upper tier threshold quantities;

• other dangerous substa nces below t hese quantities, if they are capable directly or indirectly of being involved in a major acciden t;

Sources of t he materials include:

• raw materials, intermediates, finishe d products, by products and wastes;

• substance s produced du ring process excursions, or other unplanned but f o reseeable events;

• any other dangerous sub s tances which may be anticipated t o be present on the esta blishment (including substances p r esent on ro ad and rail vehicles).

The followin g principle s should be considered:

• where certain dangerous substance s have not been includ ed in the inventory, the reason for

20Descriptive Criteria Guidance
their omission should b e provided;

• where an establishment has a large number of different dan gerous substances present, it may be necessar y to group them into representative categories (in line with S c hedule 1 P a rt 3), for the purpose of q uantificat ion

. In such ca ses the safety report should explain and just ify the basis for the groupings cho s e n ;

• the maxi mu m inventorie s calcu l ated should take into account fluctuation s in busine ss activity and the established quantity under the Planning (Hazardous Substances) Regulations 1992, 1 as updated by the Town and Country Pl anning, England and Wales - T he Planning (Control of Major Accident Hazards) Regulations 1999. There may be other leg a l authorisat ions which refer to quantities (e.g. I PPC or IPC);

• where a number of different dangerous substance s are present on an establishment at less than th eir qualifyin g quantity, the safety report should show how individual qu antities hav e been aggregated.

• to allow the assessor s t o establish if all substance s arising from foreseeable excursions have been identified, th en operators are advise d to give details of measur es taken to identify such substance s

. Criterion 9. 3 For each dangerous substance identified, the safety repo rt should describe its chemical name (including common use chemical name) and CAS numb e r, according to IUPAC n o menclature [Schedule 4 Part 2 para 3 (c) (iii)] The safety report should include, for each danger ous substance o r class o f da ngerous sub s tances (including those prese n t as impurit ies or addit i ves or const i tuents of preparations):

• its chemical name (for example, pro pane, butan e) and where appropriate, it s common chemical name (for example, LPG);

• identifica t ion of the subst ance (for example, chlorine) or class of sub s tances (for example pol y chloro-di-be nz dioxines)

, according t o the IUPAC system of nomenclature;

• the CAS nu mber for the substance or class of substances;

• the concentr a tion of any impurity or a dditive and proportion o f each const i tuent in a pr eparation. The safety report should also provid e any additional information useful to help identify the dangerous substance. For explosives, inclu d ing stored process intermediates, the followi ng additiona l information will

1 Name of Scottish eq uiva le nt is the T o w n & Cou n tr y Pl ann i ng (Haz ardo us Substances)( Scotlan d ) Reg s 93

21Descriptive Criteria Guidance normally be required:

• the name and descriptio n correspon ding to the UN Nu mber assigned to the explosive on classificat i o n under the Classificatio n and Labelling of Explosives Regulations 1983, where applicable;

• which definit ion of an explosive in P a rt 3 of Schedule 1 t o COMAH i t falls within ;

• its behaviou r on acciden tal initiat i on described in terms of Hazard Type as used in licences issue d by the Health and Safety Executive under the Explosives Act 1875.

Criterion 9. 4 The safety report should describe the ph y s ical and chemical behaviour of each dangerous substance identified, relevant to normal operating conditions and foreseeable accident conditions [Schedule 4 part 2 para 3 (c) (ii)] This may include, for example; flash points (by an identified m e thod), ignition temperatures, flammable limits, vapour pressure, density, boiling point, dat a on reactions, ra tes of deco m position, a nd data on sensitiveness of explosives. The followin g principle s should be considered:

• only those physical and chemical pr operties relevant to the various demonstrations of safety contained in the safety report need t o be presented;

• information presented in the safety report should be sufficient to describe the behaviour of the dangerous substances u nder all nor mal operating conditions, process up set condition s and foreseeable accident co nditions.

Criterion 9. 5 The safety report should describe the immediate and dela y e d harm to man and the environment for each dangerous substance identified [Schedule 4 part 2 para 3 (c) (ii)] The information present ed should in clude the ph ysical, chemical or toxicological characterist ics of the dangerous substances t hat may cau s e harm and an indication of the hazards posed. The information presented should addre ss both the short and lo ng term effects and may include for example :

• health hazar ds such a s irritation, asp h yxiation, cancer or ge netic damage;

• lethal con c e n trations;

• harm caused by fire or explosion;

• effects on th e environme n t, includ ing building damage, the ecosystem and relevant sensitive species.

• outlines of t he routes to harm, (e.g. via airborne discharge, seepage into groundwater, formation of an explosive cloud, or accidenta l initiation of explosives giving rise to blast);

• characterist i cs such as b i o-accum u la tion,

22Descriptive Criteria Guidance persistence, dispersal m e chanisms and known antagonistic or synergist ic effect s.
The followin g principle s should be considered:

• the information presente d should co nsider acknowledg ed acceptab le limits, in t e rms of concentratio n , distance f r om source, time of exposure, or any other relevant parameters;

• references t o scientific literature to justify the harmful effects, hazardo us concentr a tions and acceptable limits are expected;

• where information is no t known, assessors should expect operators to evaluate the significance of that lack of knowledg e and describe the i r policy for dealing with it.

Environment
Criterion 9. 6 The safety report should describe the environment of the establishment in sufficient detail to allow the consequences of a major accident to be assessed [Schedule 4 part 2 para 2 (a)] The information to be pr ovided fits in to a number of categories a s follows: General information is expected to include a m ap to a suitable scale (usually at least 1:10,0 00) showing the establishme n t and its su rroundings. On such maps the land use pat tern (ie indu stry, agricult u re, urban settlements, environmen tally sensitiv e location s etc) and the loca tion of the most important buildings a nd infrastructur e s (i.e. hosp i tals, schools, other indu strial sites, motor w ay and railway network s, station s a nd marshalling yards, airports, harbours etc) should be clearly indicated. Also o n the maps, access ro ut es to the establishment should be clearly indicated a s well as the escape r outes from the establish m ent and other traffic routes significant f o r rescue an d emergency operations. Separate maps may be required to identify the surrounding population a nd the surro unding natur al environment . It may be n e cessary to have different scale maps when the operator mentions long distance effects. Information on the surrounding population, is expected to include:

• approximate numbers of residents;

• estimated numbers of people who may use the area (for example: present at workplaces, pre s e n t as tourist s , or to attend football matches or motorwa y services); and

• groups of pe ople who may be particularly vulnerable either on account of their sensitivity to the hazards in question ( e .g. schools and hospitals) or because of the population density.

23Descriptive Criteria Guidance Consideration should also be given to allow assessment of the indire ct impact of a major accident on the public. For example, as a result of conta m ination of drinking water. Information on the surrounding environment should that may influence the impact of a major accid ent. Exa m ples may include:

• the topography if it could have an effect on the dispersion o f toxic or fla mmable gas es or combustion products, (th i s should include buildings, u nderground workings or other structures w here appropriate, e.g. a pedestrian subway);

• historica l local weather records, in cluding: wind speed; wind direction; at mospheric stability and rainfall. The relevance of this informa t ion to the behaviour of releases of dangerous substances should be d e scribed;

• a descriptio n of the und erlying and surrounding geology and hydrogeology if it is app ropriate to the consider ation of a major acciden t;

• a descriptio n of the surr ounding water courses (under various flow cond itions), unde rlying aquifers and any drinkin g water extraction point s should be given in relation to the dispersion of liquid cont a m inants or leachate fro m solids deposited o n the surrou nding land;

• description of surrounding water and land qualit y;

• information on sewerage and rainwater systems if they could be involved in the dispersal of liquid contaminants off-site;

• information on tides and currents tha t might influence d i spersion or a ccumulation if marine or estuarine ha bitats are at risk;

• a descriptio n of features of the surro undings that may hinder emergency response or mitigation

measures.
Information on the built environment is expect ed to include:

• each list ed building and monument;

• any sections of the infrastructure, such as major transport ro utes or utilities (e.g. electricity, gas, telephone, water sewers and treatment plant); that may be vulnerable to the effects of a major accident. Information on the natural environment is expected to include a de scription suf f iciently deta iled to allow the

24Descriptive Criteria Guidance significance of the impact of major accidents to b e
assesse d. T h is should in clude details of any:

• Sites of Special Scient ific Interest (S SSI); whether they are Special areas of C onservation (SAC) or Sp ecial Protection Areas (SPA); or Ram s ar sites;

• marine nature reserves;

• marine sensitive areas, under English Nature's marine strategy;

• and the sign ificance of t hese feature s in either a national or international context should be explained, for example t he flora or f auna particularly at risk.

Criterion 9. 7 The safety report should describe the environment of the establishment in sufficient detail to allow the contribution of external factors to major accidents at the establishment to be assessed [Schedule 4 part 2 para 2] • The information itself is a requirement under Schedule 4 part 2 para 2 of the Regulations, an d is an essential precursor to assessment of the major accid ent scenario s, provided under Schedule 4 part 2 para 4 (a) of the Regulations.

• The contribu tion of the e x ternal factor to the major accid ent could be as an init iating or exacerbating event. Factors for consideration under this cr iteria includ e:

• the physical environment surrounding the establishme n t may ha ve an effect on certain initiating eve n ts. For example, the underlying geology should be descr ibed to allow the consideratio n of seismic events and subsidence as accid ent initiators;

• the history of the land on which the e s tablishmen t is locate d, t ogether with its surround ings, may be significant to the conside r ation of major accident initiating eve n ts. For example, history of mining, other mineral extraction activities or land reclamation, may lead to subsiden ce ; previous land use, may be import ant in respe c t of contaminated land or water;

• historica l evidence of oth e r external events that might act as accident init iators such as: seismic events; flooding; and extreme weath e r condition s including: te mperature; rain; snow; wind; and lightning;

• other major hazard insta llations an d pipelines in the area cap able of init ia ting or influe ncing a

m a jor accid ent;

• current land use under th e establish m ent, including cu rrent mining or mineral extraction

25Descriptive Criteria Guidance activities;

• air traffic mo vements over and around the establishme n t, includ ing civilian and military, fixe d wing and helicopters;

• transport act i vities that may have an i m pact including shipping, major transport ro utes and dangerous substance movements; a nd

• other human activities t hat might lead to major accident s su ch as arson, vandalism, theft, and criminal da mage;

• high voltage overhead electric power distributio n lines;

• radio transmission masts in the area t hat produce fields which could interfe r e with safet y control sy stem s or com m unication sy stem s, or initiate electro explosive devices.

• Establishment

Criterion 9. 8 The safety report should identify ins t allations and other activities of the establishment that are relevant to major accident hazards [Schedule 4 part 2 para 4(b)] • This information is expected to includ e identifica t ion of:

• main storage facilit ies;

• process in st allations;

• location of r e levant substances and their quantities;

• relevant equipment (including vessels and pipes) ;

• utilitie s and services;

• means of access and eg ress;

• control rooms, office s an d other occu pied buildings wh ich could be vulnerable in a major accident.

26Descriptive Criteria Guidance
Criterion 9. 9 The safety report should describe the process(es) being carrie d out within every installation which could give rise to a major accident [Schedule 4 part 2 para 3 (b)] The Safety Report should include d e scription s of:

• the purpose of the installation;

• the conditio n s under which the dang erous substance is normally he ld;

• what happens to the da ngerous sub s tance in terms of physical and ch emical chan ges arising from the designed purpo se of the pla n t;

• what happens to the da ngerous sub s tance in terms of physical and ch emical chan ges arising from foreseeable deviations from the designed purpose of t he plant;

• the discharg e , retention, re-use and r e cycling or disposal o f r e sidues and waste liquid s and solids, or the disch arge and treatment of waste gases.

Criterion 9. 10 The safety report should describe the area on each installation w here a major accident scenario could happen [Schedule 4 part 2 para 2(c)] The Safety Report should clearly ide n tify plant and activities wh ere a major accident co uld happen. It should:

• include a p l ant diagram which unambiguously identifies ke y control systems, reaction vessels, storage vessels, pip e work systems, valves and significant connections;

• contains a p l an which un ambiguously identifies the location of activities where a maj o r accident could happe n (e.g. stora ge in packa ges, processing of explosives).

Criterion 9. 11 The safety report should provide focused information about each installation, in sufficient detail to support the demonstration that major accident hazards w ill b e prevented or the effects mitigated [Schedule 4 part 2 para 3 (a)] The purpose of the focu sed information is to pro v ide enough deta il for asse ssors to under stand the operator's d e monstration of safety. Therefore, safety reports shou ld provide descriptive inf o rmation pertinent to the demonstration being made, and at a level of detail so tha t assessors can underst and the arguments presented. The safety report should contain pla n (s) or map(s) or diagram(s) plus descrip tions, which clearly set o u t information about the in stallation s with major accident potential. Th e descriptio n should allow determin a tion of the purpose, location an d function of equipment within the installation that has a bearing on major accid ent prevention and control. I n particular, information about items of pla n t such as:

• vessels (e.g . location, ty pe, size, pre ssure, purpose, co ntents);

• pipework systems (e.g. routes, types, size, pressure, pu rpose);

• services (e. g . steam, air, electricity, fuel,

27Descriptive Criteria Guidance hot water);

• drainage (e. g . routes, pu rpose [e.g. f oul water, fire fighting r un-off water]);

• stacks, flare s and gas cleaners (e.g. location, purpose);

• safety (or environment) c r itical valves, instruments, control loop s and detect i on systems;

• fire fighting and supply arrangemen ts;

• monitoring equipment, e.g. for toxic products in air, sewers, discharges t o water; for fires or explosive atmospheres;

• incorporator s, rolling mills, manual and power presses, sie v es, granulators, mixers. Safety reports should a l so include inf o rmation about:

• the normal operating par ameters of plant;

• the designe d maxi mum working cap a cities, temperatures, and pressures and maximu m explosive inventories;

• relevant qualitative and quantitative information on energy and mass transport in the process (i.e

. material and energy balances) in:

♦ normal running

♦ start up or shut down periods

♦ abnormal operations;

♦ dangerous substance lo cations, and (at each location) an indication of the chemical and physical stat e and quantity of the dangerous substance.

Criterion 9. 12 For sites that are part of a domino group, designated b y the competent authority , the safety repo rt should confirm w h ether there has been information exchange betw een the operator and other operators in the domino group [Regulation 16(3)] NB it is the duty of the CA designate and notify operators in domino groups.

• Where this duty applies, then the op erator would be expected to include information on;

• What information they have exchan ged and to which other COMAH est ablishment operators;

• What information they have received and what conclusions they have c o me to inclu d ing whether they had to amend their MAPP, have or will have to amend the safety report and whether changes are required to the on sit e emergency plan.

Criterion 9. 13 The safety report should include the names of an y relevant organisations Paragraph 6 of schedule 4 part 2 was added by regulation 1 7 (3) of the COMAH Reg u lations 199 9 (As Amended).

28Descriptive Criteria Guidance
involved in draw ing up the report [Schedule 4 part 2 para 6] Simple clarif ication of th e names of those organisations involved is all that is req u ired to meet this cri t erio n. Confirmation of where no other organisations were involved is required to e x plain to the CA any abs ence of information.

29

## 10 Predictive aspect s

Introduction 30 Scope 3 0 Relevant requirements of the COMAH Regulations 3 0 General guidance for th e assessment of the pre d ictive aspe cts 30 All measures necessary 30 Risk asse ss m ent 3 1 Proportionality 3 3 Fitness for p u rpose 3 3 Early predictive assessment 3 4 Appendix 10.1 Predictive assessmen t criteria and guidance 35 Appendix 10.2 Predictive aspects - key informati on requirements 47



### Introducti on

Scope

1 This guidan ce is for a s sessors com p leting the p r edictive assessment and is relevant to all types of sa fety report. The criteria assess the fitness-for-pu r pose of the site oper ator's major accident risk assessmen t. The risk a ssessment may be qualitative, semi-quantitative, quantitative, or a combination of these. Operators will need to decide the scop e and nature of their risk assessment so that it is fit-forpurpose in r e lation to th eir site-spe cific circumst ances and t he demonstration required.

Relevant requirements of the COMAH Regul ations
2 The need fo r the operator to assess the risks st ems from th e requirement in Schedule 4, Part 1 paragraph 2 of th e COMAH Regulations f o r the safety report to demonstrate that "major accident ha zards have been identified and that t he necessary measures have been taken to pr event such accidents and to limit their consequences for perso ns and the e n vironment".

3 The criteria in this se ctio n assess whether the op erator's risk assessment is both suitable and sufficient for the p u rposes of Schedule 4, Part 1 paragraph 2, and Part 2, paragraph 4, 'Ide ntificatio n a nd accident al risk ana lysis and prev ention methods', particularly th ose under p a ragraphs 4 ( a) - acciden t scenario s, likelihoods etc; and 4(b ) - assessm ent of conse quences. Schedule 4, Part 2 defines the minimu m information requirement.


### General guidance f o r the assessm ent of the predicti ve aspect s

All measures necessary
4 Dutyholders are require d to take measures to re duce the likelihood of h a zards and to mitigate their con s equences until the associated risks are ALARP. Essential consideratio ns are:

• the scope fo r hazard elimination,

• the adoption of inherently safer designs,

• whether good practice h a s been, or is to be adop ted,

30• the applicat ion of risk-re ducing measures where relevant good practice is not yet established.

5 In general th e Tolerabilit y Of Risk (TOR) fra m ework is appl ie d:

• The higher t he scale of t he hazard a nd the asso ciated risks t he more the balance sho u ld tilt in favour of adopti ng further measures to control risks unless Cost Benefit Analysis (CBA) suggests oth e rwise.

• Most decisio ns on whether risks are ALARP are made by exercising professional judgement on whether the risks are reasonable when set subjectively against the cost of furth e r risk reduction. Professional judgement is not an arbitrary process but is sup ported by appropriate education, tr aining and e x perience, applied with specific a nalysis where necessary.
6 The issue u nder COMAH is whether any necessary measure s have been excluded. If all reasonab ly practicable meas ures are in place, and the risks are tolerable, th en there is n o thing more that needs t o be done – Individual Risk and Societal Co ncern must be ALARP.

7 The key is t o be able to decide:

• when any p o ssible f u rth e r measures are reason ably practicable (ie necessary), and

• when any p o ssible f u rth e r measures are not reasonably practicable.

8 A good demonstration in a Safety Re port will pro v ide:

• an amount of evidence and

• a depth of a r gument that are proportionate to the risk po sed by the establishment.

9 The assessor needs to assess the demonstration, particula rly the analysis of possible furt her risk redu ction measu r es. All the information needed to assess an ALARP de monstration must be available (or refe renced and summarised where appropriate) in the Safet y Report.

Risk assessment
10 The Compet ent Authority (CA) uses the predictiv e criteria to assess the site operator's major acciden t risk assessment.

• Risk Assessment is fundamental to the demonstration that all measures necessary h a ve been taken to reduce and contro l risks.

• Risk Assessment is a st ep towards demonstrating that risks are ALARP.

11 Additional measures:

• Whenever additional measures are identified as being reaso nably practicable t hey should be impleme n ted.

• Whenever possible r i sk r eduction measures are r e jected the case needs to be well ar gued and su pported with evidence.

• Risk reduction cannot b e looked at without first doing a risk analysis.

3112 Operators therefore need to present their approa ch to risk assessment. T he approach an d the depth of the analysis will be in fluenced by site-specific circumstances and the level of risk attaching to the site.

13 The risk a s sessment needs to addre ss:

• risks to peo ple on-site i ndividually and collectively,

• risks to peo ple off-site i ndividually and collectively,

• risks to the env ironm ent.

14 The risk a s sessment needs to be:

• a logical a n d systematic process – t he Safety Report needs to identify the tools and co mpetences the company is using to undertake th e risk

assessm ent

.

• Presented as an integrat ed whole. The steps in t he risk asse ssment process hav e to be linke d together.

15 The risk a s sessment needs to identify:

• a represent ative set of major accid ent scenario s,

• the consequ ences and likelihood of major accid ent scenario s,

• all the nece ssary measures taken t o prevent major acciden ts,

• all the nece ssary measures taken t o limit conse quences of major accident s,

• domino effects where re levant.

16 For new establishments and modifications to existing estab l ishments the risk assessment needs to in clude:

• consideratio n of the elimination of ha zards,

• inherently safe approaches to reduce the scale of hazards,

• prevention, control and mitigation measures to limit risk.

17 Risk asse ssment steps that should b e demonstrated in the sa fety report are:

• understand t he site oper ations, the materials in volved and t he process conditions;

• identify the hazards to p eople on-sit e and off-sit e and the en vironment;

• analyse the different ways the hazards can be eliminated, reduced in scale, realised and contr o lled;

• for the haza r ds that remain, predict t he likelihood of the hazar ds being realised ta king account of the chance of succe ss and failure of possib l e preventive measures;

• predict the correspondin g conseque nces both w hen mitigation measures work and fail;

• analyse the risks a ssoci ated with the remaining hazards and the options for reducing them.

32• decide which measures need to be i m plemented to make the risks to people (individually and collect ively) and the environment as low as reasonably practicable (ALARP);

• present the results of th e risk assessment to provide the evidence and arguments which demonstrate that all measures necessary have been taken to pre v ent and mit i gate major accident s.
18 The predictive criteria are structured in the same way as the above steps. They are designe d to analyse:

• how an operator identifie s the major hazards on site,

• how this info rmation is used to make decision s o n the necessary measures to prevent a major acciden t or limit its consequence s

.

The end point of this gro up of criteria forms the starting point f o r the SMS, technical an d emergency response criteria.

19 New plant:

• Analysis of t he hierarchy of measures (para 14 a bove) of the risk assessment is particu lar l y important.

• The hazard analysis of t he proposed design sho u ld pay particular attention to ways of eliminating haza r ds and inhe rently safer approaches to reducing t he scale of t he hazards t hat cannot b e eliminated.

• Ways for reducing the likelihood of r ealising ha zards and for mitigating t he consequences when these measures fail are the n analysed.

20 Existing pla n t:

• As new plant but the sco pe for elimination and re duction in scale may be less.

Proportion ality
21 The depth o f the analysis in the oper ator's risk assessment should be proportionat e to the hazards and risks presente d by the establishment. Further guidance on proportionality is include d in Section 7 of the manual.

22 Where explosives facilit i es and oper ations do no t meet accepted quantit ysafety dista n ces (QD's), the safety report should :

• Provide a justificat ion th at all measu r es necessa ry to control the risks are applied.

• Normally include a quant ified risk assessment.

Fitness for purpose
23 Fitness for p u rpose of th e risk assessment depends on:

• Expertise/competence of those identifying and analysing haza r ds (human factors i ssu e).

33• Methods used in the risk analysis.

• Data and assumptions.

• How the significance of the risk was assesse d.

Earl y p r edi ctive assessment
24 During the early stages of the predictive assessment, the focus is o n whether the report appears to co ntain the minimum key i n formation required by Schedule 4 Part 2 para 4(a) and 4(b) that shows:

• a proportion ate approach to hazard and risk ana lysis,

• identifica t ion of the extent and severity of a representative set of scenarios,

• proportionat e considerat ion of risk re duction measures and th e ALARP demonstration.

25 Apparent large omission of key information in these areas is likely to have a major impact for further assessment of the safet y report across all d i sciplines and therefore needs to be id entified at a n early stage. When th e safety report is receiv ed the AM and Predictive Assessor will decide if it is necessary f o r the Predictive Assessor to conduct an initial assessment before the report is passed to o t her members of the team for assessmen t. Circumstances wher e this may be appropriat e include:

• First safety r eports for a particular sit e , particularly for sites th at keep a range of dangerous sub s tances, ha ve very larg e quantities and/or a range of processe s.

• Where there are any indications from any source that the ope rator’s major accident risk assessmen t may be insufficient.

26 In cases wh ere an initial assessmen t is deemed appropriate, Appendix 10.2 provides examples of the types of minimu m key i n formation that may be required. An Early Predictive Assessment Record (word template) is available for use if required.

34

### Appendix 10.1 Pr edictive asse ssm e n t criteria and gui da nc e
Predictive Criteria Guidance

Criterion 10 .1 The safety report should clearl y des cribe how t he operator uses risk assessment to help make decisions about the measures necessary to prevent major accidents and to mitigate their consequences.

[Schedule 4 part 1 para 2; Regulation 4] Risk asse ssment is suf f iciently syst ematic and detailed for t he operator to identify necessary measures. This criter ion summarises the description in the safety report of th e company’s general approach to the use of risk assessment in the process of identifying necessary measures. Th e
assessm ent of the appli cation of this approach is covered by t he remaining criteria (10

. 1.1. to 10.5. 6). Criterion 10.6 draws su mmary conclusions on t he

assesse d overall adequa cy of the application of risk assessment described in the report for actual sit e conditions.

• Description of how a balance between qualitative, semi-quantitative and quantitative arguments, based on risk, is adopte d

.

• Summary of the methods used to an alyse risks.

• Criteria use d to judge th e significance of the residual risks when cont rol measures have been implemente d

.

• Link betwee n hazards id entification, risk assessment and its use in the sele ction of risk reduction measures described (See Technical Assessment Criteria for f u rther details on measures).

♦ Eliminating and reducin g the scale of hazards.

♦ Reduce event likelihood and mitigate the associat ed consequence s

.

• Use of curre nt thinking o n :

♦ Inherently safer design options and the hierarchica l approach to selection of

measures.

♦ Relevant good practice.

♦ Engineering and proced ural standar ds.

• Basis for making decisio ns about ad option or rejection of identified measures is provided.

• Description of the role th at risk a ssessment has in the demonstration tha t the risks ar e ALARP for on-site p e rsonnel, pe ople off-site and the environment

.

• The depth a nd detail of t he analysis is proportionat e to and takes into acco unt:

♦ The scale a nd nature of the hazards.

35Predictive Criteria Guidance

♦ The associa t ed risks.

♦ The site-spe cific circumstances e.g. size and nature of installation.

♦ The proximit y of population or sensit ive environment s.

• Approach to making the risk assessment a living document described.

• Arrangemen ts for periodic review described.

• Description of how human actions o r omissions affect risk a nd link to sui t ability of measures.

Criterion 10 .1.1 It should be clear that human factors have been taken into account in the risk anal y s i s

[Schedule 4 part 1 para 2; Schedule 4 part 2 para 4(a), Schedule 2 Para 4(b)] How people can contribu te to and mitigate the

occurrence and impact of major accidents.

• The safety report describes a proce ss for identifica t ion of human failures, act i o n s, or other involvement as contribut or to major accident causation w h ich is:

♦ Systematic and integrat ed with the overall risk as sess m ent.

♦ Competently applied.

♦ Showing how human failure contribu tes to major accid ent initiat i on or escalat i o n

.

• The probabilities of hum an actions a nd omissions w h ich contrib u te to major accident s and the reli ability of measures depe ndent upon human action:

♦ Are addressed and are realistic.

♦ Recognise d i fferent cate gories of hu man failure inclu d ing omissio n s, mistakes, decision failures, violations, sabota ge and rule breakin g.

Criterion 10 .1.2 An y c r iteria for eliminating possible hazardous events from further con sideration should be clearl y justifi ed

[Schedule 4 part 1 para 2; Schedule 4 part 2 para 4(a)] The intent of this crit erio n is to ensur e no important hazardous e v ents go unconsidered

• Risk dominating acciden ts are identif ied and include:

♦ The worst case scenar io.

♦ Low probability events such as air c raft impact, light ning strike

, cold cata str ophic failure of a p r essure vessel, guillotin e rupture of pipework. S m a l l e r r e l e a ♦ s e s w h i c h could trigger other events leading to event escalation

.

• Criteria for eliminating accident sequ ences from

36Predictive Criteria Guidance

further analysis are give n such as:

♦ Use of representative scenarios.

♦ Use of equivalent hole sizes of relea s es.

♦ Limited hazard ranges/cut-offs.

♦ Frequency cut-off (frequencies for h i ghly improbable accident s may not need to be as detailed as t hat for risk d o minating sequences).

• Justification for eliminating possible hazardous events from further consideration:

♦ are clearly presented an d well argued.

♦ Criteria have been applied (early) to limit the scope of the predictive a s pects. Criterion 10 .2 The safety report should demonstrate that the operator has used information and data that are suitable and sufficient for risk anal y s is

[Schedule 4 part 1 para 2; Schedule 4 part 2 para 4(a)] Meteorological condition s that are ap propriate for the site, includin g :

• Process and location sp ecific weath e r data:

♦ from an appropriate Meteorological Office climatological weather station,

♦ data obtaine d over a suitable recent period (e.g. at least five years.),

♦ if modelling of the transmission of t hermal radiation fro m fireballs a nd jet fires,u s e of likely minimum, likely maximu m, an d average humidity at a specified t e mperature.

• Appropriate stability/win d speed co mbinations:

♦ a minimum of two combinations representative of daytime and night t i me conditions ( eg, D5 and F2). i f b u o y a n t p l u m e s a r e m o d e l ♦ l e d ( e g warehouse fires), high w i nd speeds are considered, e.g. D15. on a directio n a l b a s i s f o ♦ r at least 12 sectors.

[ NB most flammable haz ardous events are only marginally affected by meteorologica l condition s , However th e r e a r e t w o k e y e x c e p t i o n s , 1 ) u n i g n i t e d drifting flammable clouds 2) thermal radiation fro m fireballs and jet fires]

• Assumptions made in tailoring data t o site specific cir c umstances are realistic.

• If the data a r e sparse, a n y adjustments err on the side of safety i.e. ‘ca u tious best e s t i m a t e s ’ i n line with the ‘precautiona ry approach’.

• Consideration of a rang e of suitably applied h a r m l e v e l s ( e

. g

. t o x i c , t h e r m a l

, p r e s s u r e e f f e c t s )

37Predictive Criteria Guidance

to people an d the environment.

• Use of curre nt maps, off-site populat ion data and surroun ding environmental features.

Criterion 10 .3 The safety report should identify all potential major accidents and define a representative and sufficient set for the purposes of risk anal y s is

[Schedule 4 part 1 para 2; Schedule 4 part 2 para 4(a)] • All potential major accid ents (MAs) are identified, a nd

• if these MAs are put into groups to make the risk analysis fea s ible, the co verage of the different types of MA hazards is suitable and sufficien t for risk assessment and emergency pl anning purposes, i. e.:

♦ They domin ate the on-site and off-sit e risk.

♦ They encompass the co mplete spectrum of severity (i.e. include the worst case foreseeable scenario).

[See criteria 3.3.1 & 3.3.2] Criterion 10 .3.1 The safety report should demonstrate that a

s y stematic process has been used to identify al l foreseeable major accidents

[Schedule 4 part 1 para 2; Schedule 4 part 2 para 4(a); Schedule 2 para 4(b)] A systematic hazard ide n tificatio n pr ocess ha s b een used to iden tify all major accident scenarios, in cluding worst case and lesser e v ents. A comprehensive process sho u ld have considered loss of contain m ent derived from all reasona bly foreseeable on-site operations a nd also external events that may imp a ct upon site op erations. Th e report sho u ld outline h o w major accid ent hazards are identifie d and show that a suitable ran ge of events has been id entified for f u rther

assessm ent

.

• On-site Eve n ts where relevant may include:

♦ Loss of cont ainment accidents due t o equipment, vessel, pipe work and pipeline failures.

♦ Explosions.

♦ Condensed Phase Explosions rela ting to explosives.

♦ Large fires ( W arehouse s , pool fire s, jet fires, etc.).

♦ Events influenced by emergency a c tion or adverse operating condit i ons etc..

♦ Other types of major accident hazard or abnormal discharge.

• External Ev ents where relevant ma y include:

♦ Aircraft impact.

♦ S e i s m i c e v e n t ; l a n d s l i p s , s u b s i d e n ce.

♦ Extre m e environmental conditions ( e

. g

. a b n o r m a l r a i n , s n o w , t e m p e r a t u r e , w i n d

, floods, light ning). Vehicle/train i m p a c ♦ t o r o t h e r e x t e r n a l

38Predictive Criteria Guidance

m i ssiles.

• Scenarios r anked and a nalysis prop ortionate to the scale an d nature of t he hazards.

• The range of MA scenarios affecting people and the environment is sufficient for ide n tifying necessary measures and include s:

♦ Local incide nts: may seriously harm workers or escalate into a more serious incid ent.

♦ Major incide nts: harm is mainly confined to the site, but affects more than one ar ea of the site (e.g. an explosio n) - potential for killin g more than one worker - possib l y with limited off-site impact, no fatalitie s b u t possible h o spitalisat ion o f 1 or more people.

♦ Catastrophic inciden ts: potential for multiple on-site and/ or off-site fat a lities.

• The scenarios include e v ents where planned or installed me asures fail.

Criterion 10 .3.2 The hazard identification methods used should be appropriate for the scale and nature of the haza r ds

[Schedule 4 part 1 para 2; Schedule 4 part 2 para 4(a)] • Hazard identification methods appro p riate and proportionat e to the type of plant and circumstances and the scale and nat ure of hazards are identified an d described.

• The relevant expertise of the hazard identifica t ion team involved is described.

• Methods that might be used includ e:

♦ HAZOP (Ha z ard and Operability Studies).

♦ Safety revie w s and studies of the ca uses of past major accidents an d incident s.

♦ Industry standard or bespoke che c klists for hazard ident ification.

♦ FMEA (Failu re Mode and Effect Analysis).

♦ Job safety analysis (e.g. Task Analysis).

♦ Human erro r identifica t ion methods.

♦ HAZARD St udy 2 or PHA type assessments.

Criterion 10 .4 The safety report should contain estimates of the probability (qualitative or quantitative) of each major accident scenario or the conditions under

w h i ch they occur, including a summary o f the initiating events and event sequences (internal The likely fr equency or probability of major acci dents is considere d

.

• The likely fr equency or probability of major accident s is considered:

♦ Their proba bility, or the conditions u nder which they occur. A summary o f t h e e ♦ v e n t s w h i c h m a y t r i g g e r each of these scenario s (i.e. cause s - whether internal or external to the installat i on).

39Predictive Criteria Guidance

or external), w h ich ma y pla y a role i n triggering each scenario

[Schedule 4 part 1 para 2; Schedule 4 part 2 para 4(a)] Depth of the analysis of event likelih ood is

• o f o perational e x perience in analysis is

• s . The safet y report:

u s e d

.

Safety critical events. The safety report:

a s i s

♦ a t i c a l l y

.

. t c a n • proportionat e t o t h e s c a l e a n d n a t u r e o f t h e hazard.

T h e u s e described.

F a i l u r e r a t e

♦ Justifie s the f a i l u r e r a t e v a l u e s

♦ Includes ref e rences and methods of derivation (where appropriate).

•

♦ Defines ‘saf ety critical e v e n t ’ a n d t h e b for the choice of definitio n. Applies t h e d e f i n i t i o n s y s t e m

♦ Presents a list of safety critica l e v e n t s

♦ Includes ev e n t s t h a t m a y b e l o w r i s k

, b u escalate to a more serious event.

Criterion 10 .4.1 t s h o u l d

2 ; s e o f a

ined from the study of previous

• her industries which

• t s of failure o f plant and

•

t m i g h t The safety r e p o r demonstrate that a

s y stematic process has been used to identify events and event combinations w h ich c ould cause major accident h a z a r d s t o b e r e a l i s e d

c h e d u l e 4 p a r t 1 p a r a [ S Schedule 4 part 2 para 4(a)] U s y s t e m a t i c p r o c e s s f o r s c e n ario generation. Demonstration should show that the identificatio n of events or event combinations take a ppropriate account of:

Insights ga • accident s a nd incident s.
Causes of a ccidents in o t present societal risks.

Assessment o f t h e e f f e c equipment designed to p r event, detect, or mitigate the hazardous conditions.

Human erro r as an accident-initiatin g event.

• Human erro r in intervention activities.

• Escalation p a thways, the key steps t h a prevent them and time f o r actions to be taken.

Criterion 10 .4.2 l e v e n t s

p a r a 2 ; The identifie d Safety Crit ical Events or event

t h e

• l i h o od of the various MAH's and the

• t h e b e e n All safety c r i t i c a and the associated initiators should be clearl y iden tified

S c h e d u l e 4 p a r t 1 [ Schedule 4 part 2 para 4(a)] • sequences are those th at dominate the contribution to risk at d i ff erent distan c e s f r o m plant.

T h e l i k e associat ed consequence s has been used in determining safety critica l events.

A p p r o p r i a t e m e t h o d s f o r a s s e s s i n g probabilitie s of each major accident h a v e used.

40Predictive Criteria Guidance

• o n o f identified co ntrol measures for R e j e c t i safety critica l events is ju stified.

Criterion 10 .4.3

e a b o u t ,

; The quantita t ive or qualit ative arguments

• l e

.

e n t s

♦ d a t a

.

r d s f o r

a n d

N o t e : r e l i s o l a t ion when automatic E s t i m a t e s o f
, o r
a s s u m p t i o n s m a d the reliability of protec tive

s y stems an d the times for operators to respond andisolate loss-ofcontainment accidents etc. need to be realistic and adequatel y justifie d

S c h e d u l e 4 p a r t 1 p a r a 2 [ Schedule 4 part 2 para 4(a)] • presented in the safety report should : Be realistic, well reason ed and plau s i b

♦ Justify signif i cant depart u r e f r o m a r g u m currently accepted by risk asse ssment media. Be backed- u p b y c r e d i b l e p e r f o r m a n c e

• Qualitative arguments need to be:

♦ Based on accepted good s t a n d a engineering and safe systems of work.

♦ Supported by evidence on the like l y d e m on the various control m easures and systems and what the consequence s might be if these f a il.

l i a n c e o n m a n u a [ i s o l a t i o n fail s will require justifi c ation if less than 20 minutes is a ssumed for operator action to be implemente d .]

Criterion 10 .4.4

c e s

r a 2 ; t h a t f r e q uency and probability

( u s e d i n d i v i d u a l l y o r i n

• describe:

c t ually used.

ive to the

♦
e n t i f i c a t i o n a n d a nalysis) ado pted to

♦ k s

n appropriat e

. The methods used to g e n e r a t e e v e n t s e q u e n and estimates of the probabilities of potential

m a j o r a c c i d e n t s s h o u l d be appropriate and have been used correctl y

[ S c h e d u l e 4 p a r t 1 p a S c h e d u l e 4 p a r t 2 p a r a 4(a)] D e m o n s t r a t i o n
e s t i m a t e s a r e reasonable.

• A p p r o p r i a t e m e t h o d s combination) to generate event sequences and estimates of major accid ents probabilities include:

♦ R e l e v a n t o p e r a t i o n a l a n d historica l data.

♦ Fault tree a nalysis.

♦ Event tree a nalysis.

T h e s a f e t y r e p o r t s h o u l d

♦ The methods and assu m p t i o n s a

♦ Any failure rate data use d

. ♦ Justification for data in te rms of the sitespecific cir c umstances.

♦ Data suitabil i ty , unless s hown that risks analysis con c lusion s are not sensit data. The process and methods (includ i ng human

e r r o r i d generate any probabiliti e s or event sequences. Checks agai n s t c o m p a n y b e n c h m a r should be in cluded whe

41Predictive Criteria Guidance

♦ Sensitivity of the conclu sions to the assumption s where necessary.

Criterion 10 .4.5 The safety report should

e

r e n o t

c a l

r t 1 p a r a 2 ;
c h e d u l e 4 p a r t 2 p a r a • T h e d e q u a l i t y procedures, plant experience, or oth e r

[ N o t e

a b i l i t y e s t i m a t e s w i t h v a l u e s

o m m o n l y u s ed and accepted by experienced risk

m o s t i m p o r t ant parts of t he predictiv e
s p e c t s w h e r e the justif ication need s to be furth e r ] p r o v i d e a d e q u a t justification for event p r o b a b i l i t i e s t h a t a consistent w i th h i s t o r i or relevant generic industry da ta

[ S c h e d u l e 4 p a S 4(a)] o p e r a t o r ' s j u s t i f i c a t i o n m a y i n c l u

acceptable e v i d e n c e

. A c o n s e r v a t i v e a p p r o a c h should be e v ident for arguments used.

: t h e C A m a y:

Compare e v e n t p r o b

c analysts.

I d e n t i f y t h e
a
e v a l u a t e d

– p o s s i b l y b y u s e o f s e n s i t i v i t y a n a l y s i s

.

C r i t e r i o n 1 0 .5 The safety report should t o

a c c i d e n t

e

a 2 ;
c h e d u l e 4 p a r t 2 p a r a p p r o p r i a t e c o n s e q u e n c e assessment.

l i s a t i o n

.

g

antities d

.

♦

•

♦ References the pedigree and basis o f such

e r e t h e r e i s t h e

e

♦

. p r o v i d e d e t a i l s d e m o n s t r a t e t h a t s u i t a b l e and sufficient

c o n s e q u e n c e a s s e s s m e n t f o r e a c h m a j o r scenario has been carried

o u t w i t h r e s p e c t t o p e o p l and the environment

[ S c h e d u l e 4 p a r t 1 p a r S 4(b)] The intent of this crit erio n is to ensur e valid and

a

• The safety report describes:

♦ For people, harms that include fatality, serious in jur y a n d h o s p i t a

♦ A range of potential har ms to the environment

. ♦ A systematic process fo r a s s e s s i n
c o n s e q u e n c e s o f m a j o r a c c i d e n t s.

♦ A detailed consequence assessmen t for dangerous substances p r e s e n t i n q u sufficien t to cause a major accident h a z a r

♦ Assumptions stated and justified

. As appropriate, whole tank failure, BLEVE,

x p l o s i o n

. fireball. fla s h f i r e o r v a p o u r c l o u d e

♦ Outcomes developed using Event Tree Analysis.

♦ The worst-case scenar ios.

♦ The models that have been used and a justifi c a t i o n of their suita b ility.

♦ Well-validat e d m o d e l s f o r s i g n i f i c a n t hazards.

p r i e t a r y Models. P r o

models, esp e c i a l l y w h potential for large numbers of people to be killed or inju red in a sing le major accident because of t h e l o n g h a z a r d r a n g e o r t h proximity of a large popu lation. Proprietary models use d are up to d a t e a n d take accoun t of the curr ent physical knowledge about the ph e n o m e n a

42Predictive Criteria Guidance

♦ Are bench marked against available data or

o t h e r m o d e l s w h i c h w e r e k n o w n t o h been bench marked. a v e

♦ [Note. Assessors may also make use of the Gas D i s p e r s i o e f o r C O M A H s a fety report

a s s e s

e m o n s t r a t i o n o n t h e appropriate choice of
user, t o t h e s i g n ificance of t he

[ N o t e 1 : a) For a low proportionality site containing specific

u b s t a n c comparison with

o f t h e user are more

d e l o r t h e

u s e r a n d these should be

n

n i n g a n d duction measures. ♦ Have been written in a quality assu red process.

n G u i d a n c
s o r s

. ]

• Hazard ranges.

♦ A d the models, and the expertise of the proportionat e hazard bein g modelled.

A s s e s s o r s s h ou ld consider t h e f o l l o w i n g :

e s covered by t he SRAGs, s the appropriate SRAG g r aphs.

b) For low proportionalit y s i t e s n o t c o v e r e d b y S R A G s
a n d m e d i u m p r o p o r t i o n a l i t y s i t e s , i s s u e s s u c h a s

o d e l q u a l i t y a n d t h e e x p e r t i s e m important and some checking (Sampling) is recommend ed.

c) In high pr oportionality cases there s h o u l d b e n o doubt as to t h e v a l i d i t y a n d q u a l i t y o f t h e m o

x p e r t i s e o f t h e e demonstrated in the repo rt. Some an alysis of the sensitivity of the predicte d conseque nces to the key assumption s might be expected.

d) Use of professional ju d g m e n t a n d e x p e r i e n c e w h e deciding if consequence distance s a ppear

c o n s i s t e n t

. i n

Note 2: Ove r l y c o n s e r v a t i v e h a z a r d r a n g e s h a v e implications f o r b o t h o f f s i t e e m e r g e n c y p l a n

r p r i o r i t i s a t i on of risk re f o

Operators need to recalculate hazar d ranges if:

) t h i s s i g n ificantly affect s ALARP arguments and the a allocation of resources f o r risk reduction

) t h e o f f s i t e plan will be signifi cantly affected. b c) the CA is concerned a bout the training, experience and competence of the model user.]

43Predictive Criteria Guidance

Criterion 10 .5.1 Source term models used should be appropriate and

n u s e d

( b ) ] Loss of cont ainment accidents (relea s es) are correctly modelled.

n e e d t o h a v e b e e correctl y fo r e a c h r e l e v a n t major accident hazard

Schedule 4 part 1 para 2; Schedule 4 part 2 para 4 •

• The nature, size, and du ration of rele a s e s a r e identified.

• For releases to atmosphere, the influ ence of obstacle s o n jets and air entrainment is d e s c r i b e d

. [Note In the criterion, ‘Ap p ropriate’ means 'fit for p u r p o s e '

. ]

Criterion 10 .5.2

h e m T

m a t e r i a l t r a n s p o r t

o d e l s u s e d s h o u l d b e
n e e d t o l y

; p a r a ( b ) ] l s w h e r e r e l e v a n t f o r :

o l w h i c h r e a c ts with

. ♦ r i s e t o l a r g e h a z a r d

♦

♦ range of weather conditions. a p p r o p r i a t e a n d h a v e b e e n u s e d c o r r e c t for each relevant major accident hazard

S c h e d u l e 4 p a r t 1 p a r a 2 S c h e d u l e 4 p a r t 2 4 • The safety report shows appropriate u s e o f

m o d e

♦ Passive (neutrally buoyant) or a heavierthan-air clou ds.

♦ A cloud cont a i n i n g a e r o s ambient moi s ture entrain e d i n t o t h e c l o u d R e l e a s e s g i v i n g distance s

. Dispersing clouds intera cting with ob s t a c l e s or terrain fe atures. C o n s i d e r s a

♦ Sensitivity tests for sign ificant event s (in t e r m s o f a s s u m p t i o n s a b o u t t h e s o u r ce term). C r i t e r i o n 1 0 .5.3 Other cons equence assessment models (e.g.

s e f i r e •
c o n suitability. BLEVE, Wa r e h o u
e t c

. ) u s e d s h o u l d b e appropriate and need to have been used correctl y for each relevant major accident

S c h e d u l e 4 p a r t 1 p a r a 2 ; Schedule 4 part 2 para

( b ) ] 4 The safety report identifies and describes

s e q u e n c e m o d e l s a n d j u s t i f i e s th eir

Criterion 10 .5.4 The harm criteria or

u l n e v r a b i l i t y models u sed p a c t o f

a n d

; t o a s s e s s t h e i m each MAH o n p e o p l e the environment should b e a p p r o p r i a t e a n d h a v e been used correctl y fo r each relevant major accident

S c h e d u l e 4 p a r t 1 p a r a 2 • The safety report shows, where the scale and nature of th e hazard an d risks is s i g n ificant:

♦ The sensit ivity of results to the choice of

, h a r m c r i t e r i a o r m o d e l

, o r t h e w a y i t i s u s e d may be nee ded.

♦ Justification for the approach to environment al impact assessment a nd data used.

44Predictive Criteria Guidance

S c h e d u l e 4 p a r t 2 p a r a

( b ) ] 4

Criterion 10 .5.5 A s s u m p t i o n s u s e d a r e

s t i f i e d , r e a l i s t i c , a n d not

c

a r a ( b ) ] • The safety report shows the sensit ivity of the results to a s sumptions (particularly when the scale and n a ture of the hazard and risks are j u undul y opti m i s t i

Schedule 4 part 1 para 2; S c h e d u l e 4 p a r t 2 p 4 significant).

Criterion 10 .5.6 E s t i m a t e s o f t h e s e v e r i t y

n d e x t e n t o f e a c h m a j o r

u e n c e a r e

4 p a r t 2 p a r a ( b ) ] Extent and severity is concerned wit h who (people) or what (enviro n ment) migh t be harmed, how badly, and how man y (people) or h o w much (e nvironment) are

and with co mpany benchmarks.

h a r m c r i t e r i a , p r e d i c t e d h a zard d a t a for on/off site t h e l i k e l i h o o d o f t h e major

♦ itable

l i s a t i o n s

.

 Banding of events in terms of 20,

e s i t e and

u m b e r s , c e n t r e s a n d

 D d

o n s a nd location of on-site an d a
a c c i d e n t c o n s e q realistic

Schedule 4 part 1 para 2; S c h e d u l e 4 affected by major accid ents.

• Predictions are realistic by comparison with published a s s e s s m e n t s

• The safety report:

♦ C o m b i n e s ranges , spe c i f i c populations w i t h accident sce narios. Presents se v e r i t y i n f o r m a t i o n i n a s u form, e.g.:

 Numbers of fatalities, se rious injur i e s , h o s p i t a

consequence to people ( e g 1

- 5

, 5

- 20 – 100, et c).

 Effects dista n c e s o n m a p s o f t h surrounding area (with identified estimations o f n types of populations bot h on and off site). i s c u s s e s t he importance of typical c l o u widths, wind direction, at mospheric

c o n d i t i off-site personnel for eff e ct on extent and severity.

Criterion 10 .6 The risk assessment should be suitable and

; p a r t 2 p a r a This criter io n on the descr i b o m e s o f t h e r i s k

s s e s s m e n t process ap plied to actu a l site

e
s e o f

e a rs sufficient

S c h e d u l e 4 p a r t 1 p a r a 2 S c h e d u l e 4 s u m m a rises assessm ent c o n c l u s i o n s
e d actual o u t c
a circumstances and is an a s s e s s e d v i e w o f w h e t h e r t h application of the gener al approach e s t o t h e u risk assessment outlined in Criterio n 3

. 1 a p p suitable and sufficie n t. Conclusions on Criterion 3.6

4546 Predictive Criteria Guidance

4 ( a )
, 4 ( b ) ; S c h e d u l e 2 P a r a

• T h e p u l l s t o g e t h e r t h e i n f o r m a t i o n

l o w r i s k

♦ criteria,

e

♦

n

♦ 4 ( b ) ] c a n o n l y b e r e a c h e d a t t h e e n d o f a s s e s s m e n t

.

• The applied risk assessment metho dology:

♦ I s p r o p o r t i o n a t e t o t h e s c a l e a n d n a t u r e of t h e h a z a r d s

. ♦ I s p r o p o r t i o n a t e t o t h e e s t i m a t e d r i s k s

.

s a f e t y r e p o r t from t h e r i s k assessm en t such that it :

♦ D r a w s t o g e t h e r t h e l i k e l i h o o d a n d consequence assessments in an ap p r o p r i a t e

w a y t o m a k e e s t i m a t e s o f t h e r i s k s

. ♦ R e c o g n i s e s t h a t h i g h c o n s e q u e n c e events warrant attention for further risk

r e d u c t i o n o n a c a s e b y c a s e b a s i s

. ♦ C o n s i d e r s b o t h i n d i v i d u a l a n d ( w h e r e appropriate) societal risk. C o m p a r e s t h e r i s k s a g a i n s t s u i t a b l e
a n d t a k e s a c c o u n t o f a v e r s i o n t o l a r ge scale serious eve n ts where necessary, in t h

s e l e c t i o n o f n e c e s s a r y m e a s u r e s

. ♦ Draws conclusions abou t the tolerability of risks from th e site. Considers sensitivity and uncertaint y in the

r i s k a s s e s s m e n t

. ♦ Demonstrat es that risk a s s e s s m e n t h a s b e e

u s e d i n a n a p p r o p r i a t e w a y a s p a r t o f t h e process to r e d u c e r i s k s t o A L A R P

. ♦ I n c l u d e s c o n s i d e r a t i o n o f r i s k r e d u c t i o n options. Describes th e decision making process.47Appendix 10.2Predictive aspects - keyinformation requirementsCRITERIONKEY DATAPrinciples of risk assessment10.2 The safety report should demonstrate that theoperator has used information and data that aresuitable andsufficient for risk analysis.•Wind rose for at least 12directionsectors.•Representative day & night conditions for gas dispersion –D5; F2.•Conservative weather e.g.D15 for knock down ofbuoyant smoke plumesfromwarehouse fires involving toxic substances.•Current mapswith offsiteland & populations.•Detail of location and quantity of hazardous materials and storage conditions•Current information & maps showingsurroundingenvironment includingenvironmentally designated sites (SPA, SAC, SSSI etc.).Identification of major hazards & accidentscenarios10.3 The safety report should identifyall potentialmajor accidents and define a representative andsufficient setfor the purposes of riskanalysis.Examples include:•BLEVE fromabove ground LPG storage vessel.•Flash fire following catastrophic failure of refrigerated storagetank.•VCE following release offlammable liquids andgases at highP&T.•Catastrophic failure oflarge(st) storage tank orvessel containing toxics.•Catastrophic failure of areactor.Likelihood OR conditions under which a majoraccident can occur10.4 The safety report should containestimates oftheprobability (qualitative orquantitative) of each major•Range of ‘engineered’ (human initiated) failuresbeyond the control of theoperator, e.g. aircraft orother onsiteimpacts such as cranes,affecting utility48CRITERIONKEY DATAaccidentscenario or theconditions under which theyoccur, including a summary of the initiating eventsand event sequences (internal or external) which mayplay a role in triggeringeach scenario.failure suchas power loss.•Range of natural events, e.g. seismic, flooding, weather extremes.•Failures in engineered and human responses and accidentcontrol.•Consider effects of MAs on neighbouring establishments, e.g. missiles.Consequence assessment10.5 The safety report should provide details todemonstrate that suitable and sufficient consequenceassessmentfor each major accidentscenario hasbeen carriedout with respect to people and theenvironment.•Reference to methods and models for source terms.•Reference to methods and models for dispersion.•Reference to methods and models for hazard phenomena, e.g. BLEVE,VCE,fireball.•Harm criteria, e.g.♦Toxic doses (concentration and time of exposure) with effectson people andtheir significance.♦Thermal fluxes and duration of exposure likely to lead to harm to people,plant where the effectscould lead tofailure or escalation on/off site (Reg. 16Domino effects).Environmen♦tal harm in terms of dose and significance for receptors, withjustification/derivation as appropriate.Extent & severity – who•might get hurt, how badly, how many.

## 1 1

. MAJOR ACCIDENT PREVENTION POLICY & SAFETY MANAGEMENT SYSTEMS ASPECTS

Introduction 49 All measures necessary 4 9 Relevant requirements of the COMAH Regulations 4 9 General guidance for the assessment of the MAPP and SMS elements 49 Pre-construction and pr e-operation safety reports 5 0 Appendix 11.1 MAPP & SMS assessment criteria and guidance 51



### Introducti on

All measures necessary
1 The criteria and guidance presented in this chapt er are conce r ned with the operator's Major Acciden t Prevention Policy (MAPP) and the rest of the S a fety Managemen t System (SMS) for impl ementing it.

Relevant requirements of the COMAH Regul ations
2 COMAH Re gulation 7(7) requires the operator to produce a safety report. Schedule 4 Part 1 paragraph 1, indicates that on e of the pur poses of the safety report is for demonstrating that a major acciden t prevention policy and a safety managemen t system for implement ing it have been put into e ffect in acco rdance with the information set out at Schedule 2 of the Regulations.

3 Schedule 4 Part 2 of the Regulations specifie s th e minimum data and information to be covered in the safe ty report. Paragraph 1 of Schedule 4 Part 2 requires that information on the management system and the organisation should contain the elements given in Schedule 2. Sche dule 2 theref ore sets the framework for these assessment cr iteria.

General gui dance for the assessment of the MAPP and SMS eleme n ts
4 The elements of an SMS for impleme n ting the MAPP listed at Schedule 2 of the Regulations, are co mpatible with t he model given in the publication HS(G)65 “Successful health and safety manag ement”. The criteria and guidance w h ich follow are set out u nder headin g s which lin k to the HS(G)65 model, and the derivation given under each criteria provides a lin k b a ck to the elements of the SMS requi red by Schedule 2 of the Regulations.

5 It is importa nt to remember, howeve r , that there are alternative models describing t he interrelationship betw een the key elements of a succe ssful safety managemen t system. Operators may hav e chosen these alt e rnatives when describing t heir SMS in company do cuments. Although we may wish to encourage operators to present info rmation about their MAPP’s and SMS’s using th e HS(G)65 format, there is no lega l requirement for them to do so. The operator's a pproach to providing the MAPP an d presenting information about the associated SMS is likely to reflect the o v erall mana gement philosophy, system and culture and we should be careful to avoid the impression that we are seeking to impose a particula r managemen t model or framework. T h is means we may ha ve to search, sort and assemble in formation from the operator's safety report into t he HS(G)65 elements at the start of t he assessment process.

496 Under each of the criteria guidance is given which indicate s t he information expected to be provided in a safety report, to meet the criteria. Typically this is th e minimu m information expected. In circumst ances where the hazards and complexity of the establishment sug gest that a ri gorous demonstration is required, fu rther information or detail may be needed to meet the criteria (see section 1 for further information on proportio nality). Therefore the guidance should not be see n as exhaustive.

Pre-construction and pre-operati on safety reports
7 Pre-Construction Safety Reports (PCS Rs) and Pre-Operation Safety Repo rts (POSRs) should demonstrate adequ ate management of design, construction and commissioning processe s prior to the introduction of dangerous substan c es. Plant design often undergoes considerable development before a nd during th e construction period and effective m anagement and communi cations inter f aces between operator, contr a ctors and subcontractor s is required

. Particular issues affecting PCSRs or POSRs, as appr opriate, include:

• Key safety d e sign criter ia.

• Design process contro l and change managemen t (hazard ide n tificatio n and risk a s sessment, design management and change approval, document control, etc.) during const r uction and commissioning.

• Competency of designers, constru c t i on teams, contractor te ams, special i sts.

• Managemen t of temporary arrangements or constraints durin g design, construction and commi ssioning.

• Constructio n verificatio n systems and commissioning contro ls. Post commissioning checks.

• Identificat io n of key roles and respo n sibilities for manageme n t of major hazards.

• Communications betwe en operator, designers, construction personnel, commissioning personne l, CA and other affected parties.

• Design, con s truction an d commissioning plannin g controls.

• SMS re view and revisio n process pr ior to operation.

50

### Appendix 11.1 MAPP & SMS assessment crit eria and guidance

MAPP & SMS Criteria Guidance
MAJOR ACCIDENT PREVENTI ON POLICY ( M APP) The followin g criteria, an d guidance, refer to the MAPP. It should be remembered that operators of top tier sites are not required to pr oduce a MAPP which is a separate document, but that the major acciden t prevention policy is req u ired to be p a rt of the safety report.
Criterion 11 .1 The safety report should include a commitment to achieve a high standard of protection for people and the environment [Regulation 5(2)] A simple sta t ement, in the policy document or safety report, of co mmit m ent should be suf f icient to me et this criterion.

Criterion 11 .2 The safety report should show that t he MAPP sets out the operator's overall aims and principles of action w i th respect to the control of major accident hazards [Schedule 2 para 2] This is a hig h level requirement, more detail will be required for subsequent criteria, but f o r the purposes of this criter ion

, simple reflection of the aims of COMAH regulation 4 (take all measures nece ssary to prevent major accid ents and lim it their con s equences to persons and the environment) should be sufficient

.

Criterion 11 .3 The MAPP should include a commitment to provide and maintain a management s y stem

w h i ch addresses the follo w i ng is sues: a) organisation and personnel; b) identification and evaluation of major hazards; c) operational control; d) management of change; e) planning for emergencies; f) monitoring performanc e; and g) audit and review

. [Regulation 5(3), b y reference to schedule 2 paragraph 4] If operators include a sta t ement of commit m ent to achieving a high standar d of protection for people and the environment and support this broad a i m by including in the MAPP a ppropriate o b jectives un der each of t he elements list ed in criteria 4.3 (a) to (g), then their MAPP is likely to be a dequate. It is importa nt to note th at, for this cr iterion, we a r e only looking for t he policy sta t ements. Subsequent criteria look the detail un der each he ading to de monstrate that there is the SMS to support the MAPP. Under each heading the operator would be expected to cover the following, resp ectively;

• the roles an d responsibilities of personnel involved in the management of major hazards at all levels in the organisa tion, includin g contractor s where appropriate, and the pro v ision of training to meet identified tra i ning needs;

• the arrangements for systematically identifying major hazards arising from normal a nd abnormal operation an d the assessment of their likelihood and severity;

• the arrangements and procedures fo r safe operation, in cluding maintenance of plant,

51MAPP & SMS Criteria Guidance
processes, equipment and temporary stoppages;

• the arrangements for planning modifications to, or the design o f new installations, processes or storage facilities;

• the arrangements for identifying foreseeable emergencies by systematic analysis and to prep are, test and review emergen cy plans to r e spond to such emergencies;

• the arrangements for the ongoing a ssessment of compliance with the objectives set out in the MAPP and SMS an d the mechanisms for in vestigation and taking corre ctive action in the event of failing to achieve the stated objectives. These should include the operator's system for re porting major accident s a nd near misses, particularly those involving failure of protective measures, and their investigation and follow up on the ba sis of le sson s learnt, and;

• the arrangements for periodic syste m atic assessment of the MAPP and the effectiveness and suitability of the SMS, th e documented review of performance of the MAPP and SMS and their updating by senior management.

Criterion 11 .4 The MAPP should be set at a senior level in the operator's organisation The written statement of the operator's MAPP is signed and dated b y the appropriate director or senior executive would satisf y this criterion.

Criterion 11 .5 The safety report should show that t he MAPP has been established in

w r iting [Schedule 2 para 2] Inclusion in t he safety report of the o perator's cur r ent MAPP, noting that it doe s not have to be separat e document, would satisf y this criterion.

OR GANI SI NG HSE publication HS(G)6 5 categorise s the activities necessar y for successfully organising in health and safety into t he four elements (the 4Cs) of control, competence, cooperation and commu nication. Th ese categories have been used in pr oducing the s e criteria
Control
Criterion 11 .6 The safety report should include sufficient explanation of ho w the SMS fits into the overall organisational This criter io n recognise s that operat ors may have a SMS that does no t follow the HS(G)65 model, or even if it does, the S M S will have to fit into t he overall managemen t arrangements for t he site and company that follow other models. This criterion o f fers the opp ortunity for the operator to descr ibe the arra ngements for

52MAPP & SMS Criteria Guidance arrangements managemen t of safety and demonstrate that the operator's SMS fits in with the overall manageme n t sy stem

. There should be confirmation that sa fety manage ment (particularly the management of maj o r accident hazards) forms an integral part of the operato r ’s overall company managemen t and organisational arra ngements. In meeting this criter ion, the opportu nity exists for the operator to give an overview of their SMS and h o w it fits to overall organisationa l arrangements, to aid assessment of the safet y report.

Criterion 11 .7 The safety report should show that a ll necessary roles in the management of major hazards have been clearly allocated [schedule 2 para 4(a)] To meet this criterion the report should include:

• description within the sa fety report of what use has been made of allocat i on of roles, in t he managemen t of major accident hazar ds, illu strate d where appropriate with o r ganisation charts;

• information to confirm that the contro l of major accident ha zards is a management function;

• an explanation indicatin g that safety and environment al professio nals act in support of lin e managemen t;

• description of a structur ed attempt to identify all safety critica l and safety related human tasks, so that responsibiliti e s in th e measures for prevention, control and mitigation can be assig ned.

Criterion 11 .8 The safety report should show that t he responsibilities of every one in volved in the management of major hazards have been clearl y defined [schedule 2 para 4(a)] To meet this criterion the report should include;

• reference to job descript i ons, or othe r documents detailing in dividual responsibilities;

• identifica t ion of post hold e rs with key responsibiliti e s;

• references t o the way in which the o perator has set out how particular job s should be do ne e.g. by using perfor m ance standards (rules stating who does what, how, when and with what expected result).

Criterion 11 .9 The safety report should describe how the ope rator allocates resources to implement the MAPP [schedule 2 para 4(a) and regulation 4] To meet this criterion the report should include:

• description of a process to determine and maintain the minimu m staffing le vels required to deliver the necessary measures under all fore seeable operating co nditions;

• reference to the arrangements for filling key post s ;

• explanations of systems for identifying absence s of key personnel and arran g ing competent cover;

• brief explanation of the arrangemen ts for secur i ng

53MAPP & SMS Criteria Guidance financial re sources to meet the demands of any improve m en ts or upgrad es that may be identified by the risk man agement process.

Criterion 11 .10 The safety report should show that t he performanc e of people having a role to pla y in the management of major accident hazards is measured and that they are held accountable for their performance [schedule 2 para 4(a)] To meet this criterion the report should include:

• explanation of how the responsibilities are made clear to the jobholder e.g

. in job descriptions or other documents;

• reference to performance review and appraisal sy stem s;

• effective co mpliance ch ecking arran gements for safety critica l procedures.

Where more detailed an d rigorous d e monstrations are deemed necessary, the report should provide;

• information about proce dures for ide n tifying and taking act i o n on failures to achieve satisfactory performance;

• reference to discip linary procedures and incentiv e and reward schemes;

• summaries of arrangements for setting performance standards a nd targets fo r line managers.

Competence
Criterion 11 .11 The safety report should show that t he operator has in place a s y stem for providing and maintaining appropriate levels of management and emplo y ee c o mpetence [schedule 2 para 4(a)] To meet this criterion the report should include:

• outlines of t he arrangements for the selection, recruitment, training and placement of employees and managers at all levels includ ing, where relevant, contractors;

• indication s o f arrangements for provision, validation and evaluation of trainin g and instru ction;

• reference to the arrangements for providing specialist an d expert advice whether from in-house professionals or from ext e rnal source s;

• outlines of a rrangements for identify i ng personal developmen t needs includi ng needs for improvin g individual skills and t he arrangemen ts for meeting those needs. Where the more detailed and rigoro u s demonstrations are deemed necessary, the report should also include:

• description s of the relevant qualifica t ions, skills and experience required for post-holders and teams or groups having a signif i cant role to play in the managemen t of major accidents (at a ll levels);

• reference to the arrangements for identifying the training nee ds of all tho s e having a role to play in

54MAPP & SMS Criteria Guidance
the control o f major accident hazard s , includ ing their deputie s, from directors or senio r executives, down to operators and in cluding co nt ractors and their employees;

• details of tra i ning relevant to the individual's profession, discip line or trade and training in relation to e a ch relevant aspect of th e operator's systems for preventing and mitigatin g major accident s.

Co-operati on Criterion 11 .12 The safety report should show that t he operator has s y stem s for ensuring that those w o rking in the establishment are activel y involved in the control of major accident hazards [schedule 2 para 4(a)] To meet this criterion the report should include:



### • summaries of the work of consultat i ve bodies (e.g. committees) involving the workforce;



### • reference to the mechanisms that th e operator has in pla c e to secure th e involveme n t of those working in the est ablishment in;

♦ hazard studies (e.g. HAZOP) and risk

assessm ent s;

♦ setting stan dards relevant to the con t rol of major accident ha zards;

♦ devising, re viewing and revising operating and emergency systems, procedures an d instruction s for the contr o l of major accident hazards;

♦ the design a nd procure m ent of new equipment including t h e human ma chine interfa c e to ensure human factors a nd usability are taken into account ;

♦ performance measuring activities in cluding accident, incident and ne ar miss investigation s ;

♦ audit and re view activities.

• outline of th e arrangements for upward reportin g of information relevant to the control of major hazards. Where the more detailed and rigoro u s demonstrations are deemed necessary, the report should also include ;

• summaries explaining h o w the operator has set about developing a cult ure which e n courages t he active participation of the workforce, including contractors and their employees, in t he health, safety and environment effort.

Criterion 11 .13 The safety report should show that t he operator has in place arrangements for co-operating with, and securing the To meet this criterion the report should include ou tlines of the operator's arrangements for co-o perating wit h :

• operators of other establishments which might be affected by the major accident hazar ds;

• contractors and their employees;

55MAPP & SMS Criteria Guidance co-operation of, other organisations [schedule 2 para 4(a) and regulation 9(3)] • the emergency services;

• county and other authorities respo n s ible for preparation and maintenance of external emergency plans;

• local authorities for other matters e.g. hazardous substance s consent;

• enforcing au thorities;

• employers a ssociat ions;

• other relevant bodies.

Communications
Criterion 11 .14 The safety report should show that t he operator has arrangements for gathering intelligence needed for the control of major accident hazards from extern a l sources Operators cannot manage major accident hazar ds properly or achieve co mpliance with relevant legal requirements unless the y are able to obtain important intelligen ce about these issues from external sources. Also, Regulation 8(1) re quires the o perator to review the safety report when it is n e cessary to do so to take account of n e w technical knowledge and developments in knowledge concerning th e assessment of hazard s

. Descriptions of the oper ator's arrang ements for ensuring that important safety int e lligence su ch as chang es in legislat ion, d e velopment s in techn i ca l standards and managemen t practice s a nd information about incidents with major accident pote n tial occurring elsewhere in the world is obt ained from:

• enforcing au thorities;

• professional bodies;

• industry associations;

• emergency services;

• other companies;

• local authorities etc.

Criterion 11 .15 The safety report should show that t he operator has arrangements for communicating information important for the control of major accident hazards w i thi n the operator's organisation [schedule 2 para 4(a)] To meet this criterion the report should include description s of the use o f the followin g methods;

• written communications,

• visible beha viour, and

• face to face discussions,

to cover communication of the follo wing information;

• the meaning and the pur pose of the MAPP;

• the visions a nd beliefs w h ich underlie the MAPP;

• the commitment of senior management to the implementat ion of the MAPP;

56MAPP & SMS Criteria Guidance

• plans, stand ards, proced ures and risk control systems relating to implementation and

measureme n t of performance;

• comments, suggestion s and ideas f o r improve m ent from individuals and tea m s;

• performance monitoring and auditin g activities;

• lessons lear ned from accidents and other incide nts

• staff handover and other critica l communications.

Criterion 11 .16 The safety report should show that t he operator has arrangements for communicating information relevant to the control of major accident hazards to external organisations [regulations 9(3), 10(3)&(5), 14, 15 and 1 6 ] To meet this criterion the report should include ou tlines of the operator's arrangements for:

• communicating with oth e r establish m ents in the vicinity inclu d ing exchanging information about major accid ent hazards and emergency plans;

• communicating with the emergency services an d local authorities in rela tion to emergency plans;

• communicating with cou n ty and other local authorities r e sponsible f o r preparation and maintenance of off-site emergency plans;

• supplying th e information required u nder Regulation 14 to people

, and establishments ser v ing the public (such as schools and h o spitals), off

- site who are liable to be affected by a major accident;

• making the information mentioned at (d) available to the general public;

• communicating with rele vant enforcing authoritie s including H SE and EA/ SEPA.

PLANNI NG AND I M PLE M ENTI NG There are four elements of the SMS l i sted in Sch edule 2 (4) of the Regulations which address pla nning and implementin g issues. Th ese are all considered in this se ction.
Hazard Identification
Criterion 11 .17 The safety report should show that t he operator has arrangements for

s y stematic all y identifying major hazards, assessing the risks arising from normal and abnormal operations and determining necessary control measures [schedule 2 para 4(b)] To meet this criterion the report should include:

• explanation of the formal hazard iden tification an d risk assessment techniques (HAZOP, FMEA... etc.) actually use d at each st age of the lif e cycle of th e process pl a n t or storag e facility and applied to t he operator's a c tivities and from the substances and materials purchased, sto r ed, processed or produced;

• explanation of the formal hazard iden tification an d risk assessment techniques used t o provide continuing r e view (eg PHR, PHA etc);

• description s of how the operator's ar rangements for

57MAPP & SMS Criteria Guidance risk assessment take account of hu man factors including h u m an behavi our and relia bility and th e potential for human error in relation t o safety-critical activities;

• description s of how the outcomes of hazard identifica t ion and risk a s sessment h a ve been used to determine the physical control measures and managemen t risk co ntrol systems needed for the prevention and mitigatio n of major accidents.

Where more detailed an d rigorous d e monstrations are deemed necessary, the report should include;

• explanation of how the elements of a life cycle w e re considered, particularly abnormal conditions;

• reference to the techniq ues used to identify the hazards and assess the risks ar ising from ex ternal factors;

• outline of arr angements for determining the skills and knowle dge (practical and theor etical) requir ed by the hazard identification and risk assessment team me mb ers.

Criterion 11 .18 The safety report should show that t he operator has s y stem s for identify i ng areas for necessary i m provement in relation to the control of major accident haza r ds [schedule 2 para 4(b)] Following o n from the requirements of schedule 2 para 4(b), the assessor needs to be assured that systems for evaluating risks exte nd to identifi c ation of an y necessary improve m ent s. The report should inclu d e outlines of the operato r's arrangemen ts for improvement planning, includ in g methods for identifica t ion of necessar y measures. This should inclu de descript i on of how the operator makes decision s on what is rea s onably practicable. Reference to the operat or's current improve m ent plans may be usef ul.

Criterion 11 .19 The safety report should show that t he operator has s y stem s for determining priorities to achieve the objectives of the MAPP and scheduling necessary i m provement

w o rk in rela tion to the control of major accident hazards [schedule 2 para 4(b)] Following o n from the requirements of schedule 2 para 4(b), and criterion 4.18, we mu st accept t h at operators d o not have unlimited resources and cannot make all the improve m e n ts they ma y have ident ified immediately. The work needs to be p r ioritised an d scheduled a ccordingly. To meet this criteria we would expect to see the f o llowing;

• explanation of how priorities are decided e.g. based on consider ations of ha zard or risk.

Where more detailed an d rigorous d e monstrations are deemed necessary, we would also e x pect to see;

• explanations of how improvement work relevant to the control o f major accident hazard s is scheduled, how the work is resour ced, co-ordin ated, allocat ed to individuals or teams to carry out and how

58MAPP & SMS Criteria Guidance
tim e scales f o r com p letion are set;

• reference to any current backlogs of improve m ent work including overdue maintenance schedule s indicating h o w these are being tackled.

Ke y Risk Control Sy stems – Operational Control
Criterion 11 .20 The safety report should show that t he operator has adopted procedures and instructions for safe operation, including maintenance, of plant, processes, equipment and temporary stoppa ges [schedule 2 para 4(c)] To meet this criterion the report should include description s of the risk control syste m s which the operator has in place fo r controlling the risks which arise at each stag e of the life cycle of the plant, proce sses or storage facilities in q uest i on. These woul d include th e systems for controllin g the risks at each of th e following stages as ap propriate:

• construction and commi ssioning o f plant, processes, equipment and facilit ies;

• operation of plant and pr ocesses (including as appropriate, start-up, ste ady state running, normal shutdown, detection of d epartures fr om normal operating co nditions and responses t o them including e m ergency s hutdown and temporary and special op erations);

• safe operation under maintenance conditions (including carrying out risk asse ssment for decontamination and maintenance work, generating safe methods of working for maintenance and using perm i t-to-work sy stem s to control it);

• selection an d management of contra ctors;

• inspection , t e st and m a i n tenance of plant, equipment and facilit ies;

• decommissioning of pla n t, processe s, equipment and facilities.

Where more detailed an d rigorous d e monstrations are deemed necessary, the report should include;

• links betwee n the identification of saf e ty critical a nd key safety related tasks, and the de velopment o f procedures;

• description of a process for developing procedur es that are not only technically correct, but are useable, cle a r and unambiguous.

Ke y Risk Control Sy stems – Management of Change
Criterion 11 .21 The safety report should show that t he operator has adopted procedures for planning modifications To meet this criterion the report should include th e description of procedur es which co ver changes to the following (wherever they may be cap able of affecting the control of major acciden t hazards):

• organisation , including st affing levels, people

59MAPP & SMS Criteria Guidance to, or the design of new installations, processes or storage facilities [schedule 2 para 4(d)] methods of work;

• plant and eq uipment;

• processes, work metho d s and process variable s , such as mat e rials, proce dures, and p r ocess controls (in c luding softw are); cover the full range of po ssible types of change, including:

• permanent;

• temporary;

• urgent;

and include the basic e l ements of:

• defining cha nge;

• allocation of responsibilit y for authorising and initiating wor k on the pro posed chan ge;

• allocation of responsibilit y for authorising and initiating implementation of the actual change at t he establishme n t;

• identifica t ion and recording the chan ge;

• assessment of the implications of th e change by competent persons;

• identifica t ion and implementation of control measures deemed necessary as a r e sult of the change;

• pre commissioning, or p r e implemen tation, checks and reviews

• post change checks and reviews.

Ke y Risk Control Sy stems – Planning For Emergencies
Criterion 11 .22 The safety report should show that t he operator has arrangements in place to - identify fo reseeable emergencies b y
s y stematic anal y s is - prepare, test and review emergenc y plans, and - provide specific training for all persons w o rking in the establishment. [schedule 2 para 4(e)] To meet this criterion the report should include a description of the opera t ors procedu res for emergency planning which include t he following:

• arrangemen ts for identif ication of for e seeable emergencies;

• arrangemen ts to determine the plann ed response to such emergencies;

• arrangemen ts for testing of emergency plans;

• arrangemen ts for the review of emergency plans, based on inf o rmation gained through testing and other chang es which may influence t he plan.

• arrangemen ts to provide realistic training and preparation for all those likely to be involved in the response to an emergency;

60MAPP & SMS Criteria Guidance

• arrangemen ts to communicating pla n s to all tho s e who ma y be affected by an emergency.

MEA S URI N G PERF O R M AN CE
Active Mon i toring
Criterion 11 .23 The safety report should show that t he operator has devised proactive means of performance measurement, w h ich provide information on

w hether th e measures taken to guard against major accident scenarios are operating as intended. [schedule 2 para 4(f)] This criter io n recognise s that in the case of major accident ha zards, a low incident rat e is no guar antee that risks are be i ng effectiv el y controlled. To meet this criterion, th e report sho u ld include a description of a process for performance measurement, which includ es the follow i ng elements;

• identifica t ion of key risk control syste m s necessa ry for the contr o l of major accidents;

• developmen t of means by which the performance of key risk cont rol systems can be monitored;

• setting of le ading indica tors which p r ovide information on whether those key risk control systems are operating a s intended;

• tolerance le vels set against each ind i cator;

• reporting to senior management on a routine basis;

• involvement of senior management in the setting of performance indicator s and tolerance levels; It is not exp e cted that p e rformance indicators ar e set against all elements of all risk control systems on a complex installation, or t hat colle ctio n and analysis of data is reso urce intensive. This would lead to a n overload of indicator s . It is more important to have manag eable number of carefully sele cted and tar geted good quality indicators, t o provide assurance acr o ss the whole business.

Reactive Monitoring
Criterion 11 .24 The safety report should show that t he operator has adopted a s y stem for reporting incidents and near misses, particularl y those involving failure of the protective measures for control of major accident hazards [schedule 2 para 4(f)] To meet this criterion the report should include description s of arrangements to produce laggin g performance indicator s , ensuring th at the following are recognised and reported to management:

• major accid ents as defined in COMAH;

• other relevant injuries a nd cases of ill health;

• other signif i cant events leading to lo ss or environment al harm;

• incidents - including in dividual behaviour - with the potential for harm or loss or environmental damage, particularly t hose with th e potential f o r major accident s;

• hazardous conditions, in cluding process deviatio n

61MAPP & SMS Criteria Guidance or loss of co ntainment.

Investigation and Response
Criterion 11 .25 The safety report should show that t he operator has adopted mechanisms for investigation and taking corrective action: (a) in cases of the proactive performanc e measures showing a deterioration in risk control measures; and (b) in relation to an y incident or event w i th t he potential to cause a major accident. [schedule 2 para 4(f)] There should be a clear follow on fro m criteria 11.23.and 11.24 To meet this criterion the report should provide a description of arrangements for investigation, wh ich include the f o llowing:

• initiation which can be b a sed on of f a ilures identified thr ough either t he active or reactive performance monitoring systems;

• early evaluation to identi f y immediate risks;

• taking prom pt action on im m ediate risks;

• decision s made on the level and nature of investigation based on consideration s of potentia l rather than actual outco me;

• determining the immedia t e causes;

• determining the underlying human and managemen t-related cau s es;

• trending of information collected thro ugh investigation

, to highlight common or wider problems in the prevention and mitigation
measures;

• reporting to senior management.

AUDIT A N D REVIEW
Audit
Criterion 11 .26 The safety report should show that t he operator has adopted a procedure for s y stem atic assessment of the MAPP and the effectiveness and suitability o f the SMS [schedule 2 para 4(g)] It should be noted that h e re the term ‘auditing’ in volves fundamental assessmen t of the validity and relia bility of the SMS itself. It shou ld not be con f used with some operator's u s e the term "auditing" to refer to activities such as saf e ty tours, physical condit i ons inspe c tions and behaviour observation carried out by line managers as part of their active performance moni toring activities. To meet this criterion it is expected that descript i ons of the operators arrangements for audi t will contain the following;

• the resource s and perso nnel require d for each audit, bearin g in mind the need for e x pertise, operational independence and technical support;

• the audit pla n indicatin g how it has b een prioritised;

• the audit pro t ocols to be adopted (which might include the use of quest i onnaires, checklists, op en and structur ed interviews as well as checking

62MAPP & SMS Criteria Guidance documents and measurements and observations);

• the procedu res for repor ting the audit findings;

• the procedu res for follo wing up the recommend ations show n to be nece ssary by audits.

Review
Criterion 11 .27 The safety report should show that t he operator has adopted a review process w h ich uses information from performanc e measurement and audit [schedule 2 para 4(g)] To meet this criterion the report should include a description of arrangements for review, which include;

• involvement of senior management;

• consideratio n of the resu lts of perfor m ance
measureme n t and audit;

• consideratio n of the suit ability and a dequacy of the current arrangements for performan ce
measureme n t (including suitability of the performance indicator s used);

• consideratio n of the suit ability and a dequacy of the current arrangements for performan ce
measureme n t.

Criterion 11 .28 The safety report should show that results of review are documented [schedule 2 para 4(g)] To meet this criterion the report should include description s of the oper ator's arrang ements for publishing the results o f the review within the or ganisation.

Criterion 11 .29 The safety report should show that t he operator has adopted a s y stem under w h ic h the MAPP and SMS is updated by senior management [schedule 2 para 4(g)] To meet this criterion the report should include a description of how the review process (see crite r ia 4.27 & 4.28) is use d by senior managemen t to carry out necessary updates of the MAPP an d SMS.

63

## 12. T echnical aspect s

Introduction 64 Scope 6 4 Relevant requirements of the COMAH Regulations 6 4 General guidance for th e assessment of technical aspect s 65 The assessment approach 6 5 Proportionality 6 6 Summary of technica l measures de monstration requirements 66 Issues within and between technica l discip lines 66 Key philosophy for technical assessment 6 6 Process saf e ty assessm ent 67 Mechanical systems assessment 6 9 Control and instrumentation systems assessment 7 0 Human factors assessment 7 2 Demonstration requirements 73 Judgements 74 Pre-construction and pr e-operation safety reports 75 General 7 5 PCSR and POSR specific issues 7 5 Technical a ssessment criteria and g u idance 76 Appendix 12.1: Process Saf e ty Criteria and Guidance 78 Appendix 12.2: Mechanical criteria and guidance 90 Appendix 12.3: Control & instrumentation criteria an d guidance 101 Appendix 12.4: Human factors criteria a nd guidance 113



### Introducti on

Scope
1 This guidan ce is for a s sessors com p leting the t e chnical a s sessment and is relevant to all types of sa fety report. These criteria contribute to the assessment of the measures taken to pr event major accident s a nd to limit th eir consequ ences for people and t he environment. They also concern t he incorpora t ion of adeq uate safety and reliabilit y into the design, con s tr uction, oper ation and maintenance of the establishme n t and are p r esented in a way that identifies the different co ncerns durin g the life cycle of an establishment.

2 These criteria interface with those specific a s pe cts of the Sa fety Manage ment System which are direct ly relevant to t he technical measures taken; e.g. periodic examination of pressure systems, operat ing procedures, etc. They are the outcomes which are d e termined or influenced by the SMS. The criteria reflect both t he probability and consequ ences (i.e. r i sk) of major accident s. T he starting p o int for these criteria (12.1) is in fact the end point of the predictive cr iteria 10.6.

Relevant requirements of the COMAH Regul ations
3 Paragraph 3(a) of Part 1 of Schedule 4 requires a demonstration that adeq uate safety and reliability have been incor porated into the design a nd construct i on of the installat i on. Part 2 of Schedule 4 to t he Regulations specifie s the minimum information to be include d in a safety report and includes a d e scription of the technical pa rameters and equipment used for the safety of the installa tion s and a description of the equip m ent installed in the pla n t to limit th e conseque nces of major accident s.

64

### General guidance f o r the asses smen t o f tech n i cal aspects

The assessment approach
4 The CA’s approach to assessment is that it be:

• consiste nt

• proportionat e

• targeted

• transparent

• based on prima facie evidence.

5 The first ste p in the assessment approach is an examination of the risk assessment to see whether the Duty Holder understands the risks and h a s identif ied all m easures neces sary to lim it thos e risks. Dis c ipline speci a lists th en a ssess the demonstration of whether the measures describ ed provide appropriate safety and reliability giv en the risks.

The specia list discipline s covered by this manual are:

• Process Safety (PS)

• Mechanical (M)

• Control and Instrumentation (CI)

• Human Factors (HF)

6 All measures necessary means all t hos e measures intended for eliminating, reducing, co ntrolling and mitigating ri sk as requ ired by releva nt codes an d standards, PLUS any a dditional measures nece ssary to reduce risks to As Low As Reasonably Practicable ( A LARP) (i.e the sacrifice would not be disproportionately high for the achieved risk reduction).

7 The assessment process stops whe n the CA is satisfied on the basis of prima facie eviden ce that:

• there is suff icient eviden ce that risks have been reduced ALARP, supported b y signposts (to what can be verified on-site) or valid arguments that the measures are of suitable saf e ty and reliability to achi eve the risk reduction,

or

• requests for further infor m ation have been adequ ately responded to.

NOTE: Mea s ures that a c hieve larger risk reduct i ons should get more attention.

8 The information in the S a fety Report is examined at face value to determine whether these measures meet current well supp orted codes or standards AND

65whether the arguments for not adopting further measures de monstrate that the ALARP prin ciple have b een adequat ely justified and applied.

Generally it is not necessary to carry out a Cost Benefit Analysis in order to demonstrate ALARP but in some cases it may we ll be require d.

Proportion ality
9 The breadth and depth o f the assessment of the operator's risk asse ssment and the dete r mination of all necessar y measures should be pr oportionate t o the hazards and risks pre s e n ted by the establishme n t. Further general guid ance on proportionality is include d in Section 7 of the manual.

10 Rather than describing many individ ual measures the Safety Report can sometimes more efficiently refer to systems, with examples of their application to a sample of plants / proce sses. Wid e r application of these systems can then be verified on-site by in spection. T hese are systems which deliver mea s ures appro p riate to the hazards and risks thro ug hout the life cycle of:

• Design

• Constructio n

• Operations

• Maintenance, Inspectio n and testin g

• Modification s

• Decommissioning

Further infor m ation will be required when lif e cycl e systems of measures are not addressed in the Safety Report or described in sufficien t de tail to ident if y how they deliver mea s ures of suff icient sa fety and reliabilit y proportional to the risk to people and the environment.

11 The effects of Loss Of Containment (LOC) may b e more exte nsive and severe for some scenarios that for others. The safety and reliability of the safety critica l parts of the identified measures shou ld be targete d for a dept h and breadth of assessment that is prop ortionate to how extensive and seve re the conse quences of a release could be.

Summary o f technical measures demonstration requirements
12 The CA exp e cts the ju stification for why further measures are not necessary to be more detailed the gre a ter the extent and severity of the potential major accident hazard. Th e greater the extent and severity, the more the Duty Holder should be considering alternative measures.



### Issues wi thin and bet w een t e chni cal disci plines

Ke y philos oph y for te chnical assessment

13 The safety report should provide cle a r justificatio n of the applied measures for:

• Control of the processe s, taking account of foreseeable normal and abnormal operations (Process Safet y , Control and Instrumentation).

66• Prevention of Loss Of Containment (LOC) b y the adequacy of the initia l integrity and continuing integrity of the containment boundary. Direct causes of fa ilure include : Corrosion, Erosion, External Loadin g , Impact, Overpressure, High/Low Temperature, Low Pressure, Vibration, Wrong/Defective Equipment (Mech anical Engin eering) and Human Failings (a ll discip lines).

• Risk reduction using saf e ty instru mented systems and their r e liability (Control and Instrumentation and Process Safety).

• Hazardous Area Classif i cation and suitability of equipment within designated hazardous zones (Proce ss Safety and Control and Instrumentation).

• Adequate human integrity of the me asures for p r evention, control and mitigation of LOC and its effects. The se measures depend up on human reliability no matter how automated the plant. Human Factors include the workplace e n vironment, organisation al, job and individual ch aracteristics that influence understan ding and de cision makin g , rule follo wing and skilled beha viour (huma n factors).

Process safety assess ment
14 General approach to pro c ess sa fety assessment

. The assessor is looking for evidence of:

Identificat io n of the cred ible hazards. This will fo cus on the q uantities an d properties of hazardou s substan c e s and the co nsequence of LOC, the operating co nditions within the plant, control f unction and process ope rating philosophy, and the impact these have on-site and off-site to exposed populations.

• Determining whether me asures match the hazard s . This may focus on evidence on suitable ran ges of proce ss desig n, control, prote c tive systems and human measures to provide diversity.

• The derivation of appropriate perfor m ance standards linked to safety critica lity. It should be p o ssible t o se e the link be tween identified major accident s a nd the range of selecte d measures chosen to pr event and limit them.

• Whether there is correct identifica t ion of process and external loads and duties. This addresses t he process internal oper ating condit i ons under normal and abnormal operating state s and expected future d e mands.

• Potential for deviations and excursions from normal operating condition s.

• The external effect of the environmen t on the process and it s operation (e.g. temperature, hazar dous atmospheres, etc.) should be a ddressed.

• Effect of oth e r failures to initiate major accident scenarios.

• Whether the company h a s identif ied the demands on the saf e ty systems.

• Potential for knock-on ef fects.

15 Key technical issue s for process saf e ty assessm ent.

• Loss of cont ainment arising from a range of initiating events (such as process ope rating excursions from n o rmal / safe operation, u n controlled chemical re actions, ext e rnal events, etc.)

67♦ How these are systematically assessed.

♦ How these are prevented, controlled and mitigated against.

♦ Measures the duty holder relies on a s the main control to make the process saf e (e.g., venting, pressure relieving, in erting).

♦ Compatibility issues of t he materials involved.

♦ Scale up - a w areness of the hazards in scaling u p (eg, heat t r ansfer consideratio ns if incre a sing the volume).

♦ Separation and segrega tion.

♦ Safe operating envelopes and safety margins.

♦ Safe operations measures to prevent excursions/loads.

• Control system performance in relat i on to desire d function (n ot limited to hardware).

• Process con t rol philosop h y for mana gement of hazards:

♦ balance of r e liance on manual or automated control.

♦ control room operation in terface with the process.

♦ in normal and abnormal operating modes and e m e r g e n c i e s

. ♦ Fail to ‘sa f et y’ philosoph y for control and isolatio n devices.

• Installed pro c ess co ntrol measures and how they are designe d:

♦ Evidence of appropriate recognised standards.

♦ Coverage of safety funct i ons.

♦ Suitable alar m systems f o r d e v i a t i o n s

. n d s u f f i c i e n t

.

• System inte grity under identified ha zardous sce narios (inclu ding worst

• Redundancy, e r s i t y , availability.

e a s u r e s :

a z a r d

. t e m s )

, C o ntrol (shutdo wn/shutoff control,

• Managemen t issues:

♦ Systematic review processes.

e S M S a n d a s e l e ction of measures

♦ g s y s t e m s a n d a s s u r a n c e they are followed.

• Flammables and toxics:

p o ssible f l ammable atmospheres (consider static ♦ Determination that integ r i t y i s s u i t a b l e a

case scenar io).

d i v

• Hierarchical approach to selection o f m

♦ Inherent saf e ty.

♦ Reduction o f t h e h

♦ P r e v e n t i o n ( c o r r e c t i v e s y s venting and disposal), M i tigation (e.g . deluge systems, fire fig h ting sy stem s).

♦ Inherent saf e ty a princip l e o f t h philosophy. S a f e o p e r a t i n

♦ Change ma nagement.

♦ S o u r c e s o f i g n i t i o n i n and hot sour ces) – Haza rdous Area Classificatio n

. ♦ For toxics, consideration of ventilatio n and where material is stored.

68Mechanical s y stems a ssessment
16 General approach to mechanical systems assessment:

The assessor is looking for evidence of:

• Adequate initial mechanical integrity. The focus is on adhere n ce to suitable de sign principle s , often embodied in cod e s and stan dards.

• Suitable con t rols on manufacture and construct i o n for the delivery of design inten t.

• Adequate continuing int egrity through operating t he plant wit h in its normal operating en velope as well as throug h appropriat e maintenance and periodic examination regimes.

• Procedures to ensure modification s will not compromise integrity.

17 Key technical issue s for mechanical systems assessment:

• New plant and initial inte grity. In new plant init ial integrity is very importan t before the in spection cycle begins.

• Suitable design princip l e s , codes an d standards.

• Consideration of:

♦ Design details.

♦ Operating and fault con d itions.

♦ Materials properties.

♦ Potential failure modes.

♦ Provision, inspection an d maintenance of protect i ve systems.

♦ Design of e quipment secondary containment.

• Design crite r ia:

♦ Prevent and control of re leases

♦ LOC direct causes

♦ Adequate st ructural inte grity

♦ Operational and extreme loading

♦ Suitable materials

♦ E x c u r s i o n s b e y o n d d e s i g n c o n d i t i o n s

• Constructio n criteria

♦ Constructio n standards

♦ Verification of construct i o n s y s t e m s welding)

c onstruct i on (includ i n g safety

• In service in tegrity:

l i m i t s

. e a n d i n s p e c tion by co mpetent person(s).

• Maintenance/inspect i on criteria:

p e t ent workforce ♦ Controls on m a n u f a c t u r e ( p a r t i c u l a r l y

♦ Inspection a nd testing of initial integrity

♦ Managemen t o f d e s i g n c h a n g e s d u r i n g
assessm ent )

♦ O p e r a t i n g w i t h i n

♦ A p p r o p r i a t e m a i n t e n a n c

♦ Procedures for modificat i ons.

♦ A p p r o p r i a t e m a i n t e n a n c e b y c o m

69♦ Exa m ination by independent competent persons

♦ Assessment of examinat ion/maintenance result s

♦ Written Sch e mes of Exa m i n a t i o n l i n k e d t o p e r f o r m a n c e / m a i n t e n a n c e

• Ageing plant - As plants and equipment age ther e is an in cre a sing

s i o n ,

e c i f ie d design ba sis and the assessment that has be en made

♦

♦ r r y i n g

♦ A R P

♦

Control an d i n

C a ssessor is looking for evidence of:

t r o l t

a

• ( S I S )

. T h e r e p o r t s h o u l d

• i t i a l design of electrica l systems and utilitie s. This equipment

b l e

• l equipment is

• e n t a t i o n s y s t e m s e n s u r e d b y suitable maintenance/in spection/te sting regimes. history.

likelihood of t i m e r e l a t e d a g e i n g d a m a g e f r o m f a t i g u e , c o r r o s i o n , e r o creep and ot her degradation mechanisms. The safety report should describe:

♦ T h e s p of the impact for continu ed operation s , inspe c tion , testing and maintenance. E q u i p m e n t c o n d i t i o n d e r i v e d f r o m k n own inspection history e.g. the corrosion history; operational perfor m ance; how the plant ha s degraded. Processes t hat need to be gone through for det e r m i n i n g a n d c a out more detailed insp ections and to positively justify what is needed to keep the plant going ( a s opposed to rebuilding it). Reviews to compare the original design with up t o date desig n principle s a nd the consideration of measures to risk reduce d A L where appropriate. Any use of fitness-for-se r vice and remnant life assessment t e c h n i q u e s in re-evaluation of struct ural integrity.

s t r u m e n t a t i o n s y s t e m s a s s e s s m e n t
18 General approach to assessment:

h e o n t r o l a n d I n s t r u m e n t a t i o n S y s t e m s T

• Suitably designed proce ss control systems which will deliver t h e c o n philosophy of the proce ss in a relia b l e m a n n e r a n d m i n i m i s e i m p i n g e m e n on safety related protection systems such as Saf e ty Instrume nted Systems (SI S ). The report should al so clearly de scribe areas where human interaction is necessary and h o w r i s k a s s e s s m e n t h a s p l a y e d part in deter mining the overall control strategy.

S u i t a b l y d e s i g n e d S a f e t y I n s t r u m e n t e d S y s t e m s demonstrate that SIS have been designed to suit able standar ds and that requirements for the saf e ty syst em have been underpinned by suitable r i s k assessment processe s. For legacy systems the report should state how the Compan y are reviewing these sy stems again s t current st andards and how they intend demonstrating that t hey have su itable levels o f s a f e t y a n d reliability.

S u i t a b l e i n includes EX equipment, fixed electr ical systems (HV &LV), ea rthing systems, fire & gas det ection syste m s, and supply systems such as instrument air. With these systems the focus is o n a d h e r e n c e t o s u i t a design principles, often embodied in codes and standards.
Suitable pro c edures in p l ace to ensu r e that electr i c a l / c o n t r o operated within its de sig n requirements. Continuing integrity of control and in s t r u m

70• Suitable pro c edures in p l ace to ensu r e that modifications t o s y s t e m s a r e carried out in a controlle d manner and subject t o s u i t a b l e h a zard

19 K e y :

Design and implementati on of the pr ocess contr o l system should be h a z a r d a nalyses. Th e CI assessment should

a r e

d s y s t e m s e

. g

.

•

S linked to major accid ent scenario s rmation provided should be as indicated be low. For SIL rated systems, providing the identified

d i n

I n f o r m a t i o n

♦ Design and Standards used for achieving functional safety of SIS (e.g. 61511 or other).

♦ How safety Safety Requ irements Specificat ion can be traced to a

♦
n t

. v e d v i a

♦ e d b y i n i t i a l d e s i g n / in stallation an d by subsequent

♦

♦ Suitable modification s p r ocedures. identifica t ion / analyses a nd associat ed risk asse ssment tech niques.

t e c h n i c a l i s s u e s for control and i n s t r u m e n t a t i o n s y s t e m s a s s e s s m e n t

• Process Control Systems

based on su itable proce s s ensure that t he process control syst e m i n t e r m s o f h a r d w a r e a n d s o f t w is suitab le fo r delivering the requirements of the p r ocess in a r e liable fashion, thu s minimising demand rates on safety related prot ection systems. Information should be prov ided on key systems linked to major accident sce narios and should inclu d e the following:

♦ Procedures/ standards u s ed to ensur e hardware/software meets the requirements of the process

♦ Details of Pr ocess Contr o l Strategies (manual, on/off, PID, cascade, predictive et c.) R e q u i r e d h u m a n i n t e r a c t i o n w ♦ i t h t h e process

♦ Process based alarms/trips. S a f e t y r e l a t e d a l ♦ a r m s a n d t r i p s

. ( e

. g . SIL rated systems)

♦ Final protect i on systems (often not in s t r u m e n t e Pressure Relief Sy stem s)

S a f e t y I n s t r u m e n t e d S y s t e m s ( S I S )

Lifecycle Ap proach: A selection of S I should be pr ovided in the report. Inf o

information should be st raightforward, however, for legacy systems there will be gaps. The Compa n y should id e n t i f y t h e s e i n f o r m a t i o n g a p s a n state how they have re v i e w e d

, o r i n t e n d t o r e v i e w , t h e s e s y s t e m s accordance with current standards, a nd also to d e monstrate that risks have been reduced to A L ARP. For h i gher claims of risk redu ction (e.g. SIL2 or SIL3 rated systems) more d e tail should be provided.

a b o u t S I S s h o u l d i n c l u d e :

in house, B SEN 61508/

structured H a zard identif ication/Analyses process (e.g. HAZOP or similar).

♦ Clear specification of wh at the syste m is design ed to do. How target reliability has been determined from suitable risk

assessm e

♦ How the safety requirements specification has be e n a c h i e hardware and software from sensor to final elem ent. H o w i s i t a c h i e v proof testing

. Suitable maintenance of system.

71• U t i l i p o w e r s u p p l y

.

i b u t i o n s y s t e m s including

a s). p l a n t s t a b i l i t y

. t y o f i n s t rument air system

• E l e c

l y p r o t ected for de signated

zone. em in place

•

♦ l o g y d e s c r i p t i o n

♦ Reference to design sta ndards. d e t e c t o r s t e c t i n g d e t ectors again s t poison i ng

. s for systems.

•

p a r t o f t h e control

t e sting and maintenance personnel.

♦ Specific te chnical train i ng for maintenance (ele ctrical systems, control

♦ c e i n a n a l y s i n g effects of loss of powe r

.

Human factors assessment
20 G e n e

Looking for

p a r t s that people play in protection, prevention,

e r y f r o m major accid ents.

• Human perf o rmance requirements being addre ssed with th e same degree

o n a l l y e x p e c t e d f o r p r ocess and engineering issues.

K

• e allocatio n

• mitigation of major accident s: t i e s , e s p e c i a l l y

♦ Design basis.

♦ Continuing integrity of electrical d i s t r earthing, HV&LV (non hazardous are

♦ Load sheddi n g a n d e f f e c t s o n

♦ Lifecycle int e g r i

t r i c a l systems in ha zardous are a s.

♦ Suitable Hazardous Are a Classificat i on

♦ Electrical/ i n s t r u m e n t a t i o n e q u i p m e n t s u i t a b

♦ Suitable pro a c t i v e m a i n t e n a n c e s y s t

F i r e & G a s d e t e c t i o n s y stems.

T e c h n o

♦ Safety requirements specificat ion.

♦ Rationale fo r positioning o f

♦ Measures in place for pr o

♦ Maintenance and testin g p r o c e d u r e

M a n a g e m e n t issues:

♦ Competence in asse ssing the contr o l system.

♦ C o m p e t e n c e d e m o n s t r a t i o n ( w h e r e a n o p e r a t o r i s sy stem ).

♦ C o m p e t e n c e o f p r o o f

sy stem s).

♦ General Safety Manage ment Syste m for proof testing. C o m p e t e n

♦ Safety Man agement System for software design teams.

r a l i s s u e s f o r a s s e ssment:

evidence of:

• Identificat io n o f t h e potential in itiation, and re c o v

of rigour tra d i t i

21 e y t e c h n i c a l i s s u e s for human factors assessment:

Human syst ems (manua l measures) and the justification of th of safety crit ical function to humans.
key safety-related human Performanc e standards for all safety -critical and tasks in the m e a s u r e s f o r p r e v e n t i o n , c o n t r o l a n d

72♦ Human perf o rmance requirements identified e.g

. speed, accuracy, vigilance, co m m u n i c a t i o n s , d e t e c t i o n , diagnosis, physical actions,

t e d b y informatio n, controls a nd access f o r the operators, alarm

c s

♦ e s o f infrequent t a sks to mai n tain perfor m ance standards.

•

♦

♦

•

f e ty critical ta sks.

n d a c t i o n s a r e s u p p o r t ed by procedures:

♦

• Staff selection, training, refresher tra i ning and co mpetence assessment.

•

•



### Dem o n t s
22 A t r e a c hing con c lu sions on the demonstration. The onu s is on the Duty l ace. The de monstration requires:

l i n ks to the reductio n of major accident risks t h rough

e c t e d m easures.

i t h

• t i o n al to risks ar ising from

• Further risk reduction op tions are co nsidered an d arguments that are proportionat e to the hazard and risk are provided where options were not implemente d

. skill s.

♦ Performanc e requirements within th e limits of h u man capability.

♦ Performanc e requirements supporte d by workplace design, i.e.

s u p p o r systems design, ergono mics of process contro l interface, er g o n o m i of machinery and equipment. E x e r c i s

E v i d e n c e o f p h y s i c a l a n d mental fitness assura nce: Of safety critical sta ff Including co nsideration of fatigue fro m shiftwork and overtime.

M a n n i n g a n d s u p e r v i s i o n philosoph y:

♦ Roles and r e sponsibilities for autho risation, de cisions,

c o m m u n i c a t i o n s f o r s a

♦ Justification of demanning.

• Activities relying on human decisio n s a

♦ Procedure design. Task analysis.

• Reliability a nd monitoring of human performance.

S p e e d o f r e s p o n s e

. A v a i l a b i l i t y

.

• Workload.

• Consideration of demands in abnor mal conditio n s

.


### nstr ation requirem e

s s e s s m e n t i s a b o u Holder to ju stify the measures in p

• Justification of a particular design. E x p l a i n h o w t h i s
o ALARP, a nd how this is achieved t d i v e r s i t y a n d i n t e g r i t y o f s e l

• Description of in-service inspection and maintenance regime.

• Compliance with guidance. If the offsite risk is sm all then com p l i a n c e w guidance ca n be sufficie n t but if larg er populatio ns can be af fected then additional measures will need to be considered.
The depth o f protection m e a s u r e s a r e p r o p o r major accid ent scenario s.

73• Specificatio n of not just what but also why measures are pro v ided i.e. the link between measures and their role in major accident prevention or mitigation. T he arguments justifying a particular d e s i g n a r e i m p o r t a n t t o

• v e l o p m e n t history from conceptio n to the



### Judgem

23 If demonstration require i n f o r m n
c o n c l u s i o n

. I n f o r m a t i o n t h e p l a n n e e e s t a b l i s h m ent.

24 T r g

c i e n t evidence to justify not pr oviding an identified measure.

• Incorrect information.

n t o

idance or use of inappro p riate stand ards.

•

n d t i m e l y h u m a n r e s p o n s e s

.

g e o f t h e e s t a b l i s h m e n t a n d i t s o p e r a t i o n s

. the ALARP demonstration.
A descriptio n of the site d e present.



### ents ments are missing, t he a ssessor ma y ask for further

a t i o

. T h i s i n f o r m a t i o n w i l l b e deemed part of the repo rt at that sta ge and

s will be reach ed as to whether or not the demonstration has b e e n m a d e

n n o t

, o r i n a d e q u a t e l y , s u p p l i e d m a y b e c o m e a n i s s u e f o r r e s o l u t i o n w i t h i d i n t e r v e n t i o n s t r a t e g y f o r t h

i g e r s l e a d i n g t o r e q u ests for furth e r information might include:

• I n s u f f i

• Missing or vague information such t hat a judge ment cannot be made, including ina dequate definition of ter m s.

• Lack of a ph ilosophy or system such that it is n o t clear if the measure is systematically applied.

• Failure to co mply with rel e vant legisla t ion.

• Failure to co mply with gu idance or meet good ind u stry practice.

• Missing syst ems or majo r components of a syste m w h i c h c a n b e s h o w lead to a major acciden t hazard.

• No indicatio n of checkin g , testing, in specting, m onitoring of condition of

measures.

• Failure to co m p l y w i t h g u

• Unsuitable materials.

• Inadequate measures.

• Absence of maintenance priorities o r regime.
Inadequate inspection re gime.

• Incompatibilities betwee n data.

• Overconfidence in perfor m ance standards.

• Performanc e standards not given.

• Over-reliance on correct a

• Inconsistencies within th e safety report.

• Conflicts wit h t h e C A ’ s k n o w l e d

74

### Pre-c

G e n e r a 25 A e
o rts (POSRs)

r e p o r t s w i l l

, i n practice, limit the available information. The follo wing outline s some of the principal

n t focus elem ents relating to PCSRs a nd POSRs.

f

z a r d s i n r e aching the

e l e c t e d f i n a l design sh ould be described. Spe c ific de sign issues rela ting to the

posed key technical me asures is an important

a r t o f t h i s j u s t i f i c a t ion. Description of the chose n design, wit hout some indication of

n d e s i g n i s k to

p e c i f i c i s s u e s

c l u s i o n

. The followin g guidance should be a pplied to the PCSR or POSR as app ropriate to and the dept h of information containe d.

arrangemen ts affecting l a yout, utilitie s, etc. durin g construct i on and

•

u l d b e 

### o nst r uction a nd pre-operation s a fety reports

l
l l t c h n i c a l a s s e s s m e n t criteria are available for considerat ion of PreConstructio n Safety Re ports (PCSRs) and Pre-Operational Safety Rep in so far as i n formation is available. However, th e t i m i n g o f t h e s e

a s s e s s m e

26 Assessment of PCSRs should focus on the ‘front end’ design aspects in t he assessment criteria and, in particular, the approa ch to consid ering the ad o p t i o n o inherent saf e ty principle s in the prop osed design

. The conce p tual design option selection pr ocess and t he consider ation of pote n t i a l m a j o r h a
s prevention of accident s during the construction and commissioning pha se, considered prior to the introduction of dangerous substan c e s , should a l so be addressed.

27 Justification of the cho s en design and how it reduces risks to ALARP i s a n important element of the PCSR as th e options for necessary change and improve m en t are more easily addressed at this e a rly stage. The link bet w e e n identified m a jor hazards and the pro p key decision s (linking ha zards and measures) be hind the reje ction of othe r considered principal de sign feature s or options, only addresses the cho s e and fails to explain why other option s do not offe r b e t t e r o p p o r t u n i t y t o r e d u c e r ALARP. As sessment will necessaril y be limited to information that is rea s onably available at the time the report is sub m itted

28 Assessment of POSRs s hould focus on amendments made to the design a n d construction , and any additional inf o rmati on since the PCSR, and whether the plant meets the design intent. Commissio n ing control s will al so b e an important

assessm ent issue.

29 The combined information containe d i n t h e P C S R a n d P O S R r e p o r t s h o u l d b e equivalent to that contained in a saf e ty report for an existing establishment.

PCSR and P O S R s

30 The boundaries betwee n PCSRs an d POSRs an d the information they contain will depend upon the timing of submi ssion and th e information available f o r i n

the time of submission o f t h e r e p o r t

• The impact of features a nd integrity of the desig n, specif ic to meeting the needs of the construct i o n or commissioning process and the assessment of their impact for major accident ha zards shou ld be describ ed. (e.g. extraordinary loads imposed by water pressure t e s t i n g , t e m p o r a r y

commissioning phases.).
The impact for temporary isolation a nd connections to contribute to potential lo ss of contain m ent or other major hazard during o r after commissioning, and the arrangemen ts in pla c e f o r their cont r o l s h o

75described (e .g. planned managemen t controls for design, con s t r u c t i o commissioning; designe d n a n d i n t e g r i t y o f t e m p o r a r y s y stems.).

f h i g h f i c

•
n (e.g. use of

• s i o n t r o l i l l

r systems for

•

e is reaso n a b ly



### Te chnic

31 T h e f o r
e a c h o f t h c a l

, Control and Instrumentation, Human Factors). Guidance to t he criteria is provided in bullet point

n s i d e r a t i o n b y C A

i r p r o f e s s i o n a l e x p e r i e n c e a n d j u dgement.

A s s e s s s

33 T y t h e contents of all four t e c h n i c d t e d f o r a

i s c i p line ag ainst any particular cr iter ion, this doe s not infer th at the criterion has no

s a r e a d • Account taken of Huma n Factors co n t r o l s a s s o c i a t e d w i t h a p e r i o d o activity using a large bo dy of contracted person n e l m a y p o s e s p e c i issues t o be addressed by safety management arrangemen ts.

Planned maintenance ar rangements during the commissioning period may differ from those expected durin g n o r m a l p l a n t o p e r a t i o contractors, changed responsibility arrangements, etc.).
The level of detail desig n change du ring the con s truction an d c o m m i s period is pot entially significant and re quires effect i v e c h a n g e c o n managemen t systems. In normal operat ion, modification pro c e d u r e s w typically form part of the operator’s managemen t system. However, duri n g the design, construction and commi ssioning p h a s e s , o t h e change management ma y be applied (e.g. design contractor’s in-house systems, other contract or systems, etc.). The d o vetailing of temporary arrangemen ts prior to op eration and t he company’s own management systems should be descr ibed where appropriate.

The PCSR s hould identif y key activities that are yet to be und ertaken during the d e velopment of the desig n. Whilst de tails of the s e activities may not be well developed, the key areas of the design that a r e l i k e l y t o be affected and the pote n tial sen s i t i v i t y o f d e s c r i b e d a r r a n g e m e n t s t o t h planned futu re work should be descr ibed as far a s practicable

. It should be possible forthe assessor to readily crossreference ch anges between the PCSR and the POSR.



### a l ass es sm ent criteri a and gui da nc e

f o l l o w i n g appendice s contain ta bles of tech n i c a l a s s e s s m e n t c r i t e r i a
e primary tech nical discip l ines (Process Safety, Me c h a n i

format to provide a checklist of issu es that may r e q u i r e c o

s s e s s o r s

. a

32 Assessors should use th e guidance as appropria te in relation to:

• The site spe c ific circumstances described in the safety report.

• T h e

• The scope o f assessment in the agr eed Target Agenda.

o r a r e not oblige d t o a d d r e s s e v e r y c r i t e r i o n o r i t s g u i d a n c e i n f u l l

.

h e f u l l g u i d ance for technical assessment is for m e d b

a l i s c i p l i n e a p p e ndices. Wh ere no guida nce has bee n i n d i c a d relevance to that discipline, but means that the criterion is no t a primary f o c u
o r t h a t d i s c i p l i n e

. A s s e ssors are not obliged to a ddress solely the criteria a n f guidance in the Appendix relevant to their specific discipline as the boun daries of discip line int e rest in assessment crit eria may o v erlap. However, where assessment by a discipline assessor leads to are a s that interf ace with an other discipline

assessor ’ s p r incipal scop e of assessment, assessors should, where appropriate,

76seek to reach an agreement at an early st age on who will le ad on a topi c o r o n arising. This is to avoid unnecessar y duplication of assessment.

34 The guidance to the crite r ia provides a framework f o r a s s e s s m e n t a n d intended to provide detailed topic sp ecific te chnical guidan ce. Detailed topic technical guidance exists on the relevant Website and/or Intranet. This gu idance is available as part of the CA’s corporat e knowledg e base addr e s s i n g i s s u es

i s n o t

t e ch nical issues

n d p r a c t i c e s a

77

### Appendix 12.1: Process Safe ty Criteria and Guidance

Process Saf e ty Criteria Guidance

Criterion 12 .1 The safety report should show a clear link bet w e e n the measures taken and the major accident hazards described

[Schedule 4 Part 1 para 2; Schedule 4 Part 2 para 4(a), 4(c), 5] This is t he core of the Safety Report from the technical point of view and provides the link betw een identifica t ion and analysis of hazards and the selection of measures.

• The operator recognises the hazards/sce narios.

• Control mea s ures are li nked to spe c ific scenario(s).

• It is clear ho w decisions are made for reducing risks ALARP.

• The safety report explains decision criteria for selecting measures.

For a representative set of scenario s from the predictive a nalysis:

• The report demonstrates how risks h a ve been reduced to ALARP and are tolerable

.

• The report demonstrates adequate diversity and redundancy in the control measures (appropriate to the SIL).

• The report demonstrates there are no further reasonably practicable risk reduct i o n measures the operator could take.

Criterion 12 .2 The safety report should demonstrate how the me asures taken w ill p r event foreseeable failures

w h i ch coul d lead to major accidents This is e ffectively a summary of all the other crit eria, looking at th e overall picture.

The assessor should co me back to this when th e other criteria have been considered, and then consider:

• Whether all the assesse d criteria ha ve been met.

• How significant the failur e of one or more criteria is to the overall safety justification.

• Any failure to recognise appropriate standards.

• Full application of standa rds and any deviations from the standards.

Criterion 12 .2.1.1 The safety report The Safety Report specifies the sta ndards and codes of practice u s ed as the b a sis for the design of th e

78Process Saf e ty Criteria Guidance

should show that th e establishment and installations have been designed to an appropriate standard.

[Schedule 4 Part 1 para 3; Schedule 4 Part 2 para 4(c), 5(a)] plant and th e selection of appropria te risk contr o l

measures.

The Safety Report recognises that some of the design is ou twith the sta ndards and codes and describes th e process fo r managing deviations a nd exceptions t o ensure tha t safety and environment al protection is not compromised.

• The safety report specif ies:

• Potential de mands placed on systems such as:

♦ Trip sy stem s

♦ Operators responding t o alarms

• Performanc e standards for on-demand sy stem s:

♦ Accuracy and speed of r e sponse of operators.

• The Safety Report shows that the performance standards ar e adequate:

♦ That the measure has a sufficien tly high availability.

♦ That performance standards (reliab ility, availability, accuracy, speed of resp onse etc.) have been verified such that th e operator ca n demonstrate the measures work accord ing to the st andards.

Criterion 12 .2.1.2 The safety report should show that a hierarchical approach to the selection of measures has been used.

[Schedule 4 Part 1 para (3); Regulation 4] This is an important criterion which has a clo s ely defined 4 st age hierarch y: eliminate (inherent safety), prevent

, control

, mitigate , in that orde r of priority.

• The Safety Report considers reducing the quantities of hazardous substance s stored or used in the process:

♦ Consideration is given t o using alter native less hazard ous substan c es.

♦ A case is m ade for the amount and type of each hazard ous substan c es.

• Consideration of intensified processes, e.g. smaller semi continuou s processe s instead of large batch processes.

• Alternative inherently safer processe s have been consid ered, e.g. to eliminate or reduce the risk of a runaway rea c tion.

79Process Saf e ty Criteria Guidance

• o p e rational

•

, d i v e r s i t y a nd availabilit y of

c o n t r o l

l s y s t e m s , t h e S a f e t y

best

• Priority is given to passive measure s over active measures.

• ch to sele cting T h e S a f e t y R e p o r t i d e n t i f i e s t h e measures which prevent excursions/loads.
For preventive measure s t h e S a f e t y R e p o r t demonstrates:

♦ R e d u n d a n c y these measures

♦ A safety ma nagement sy stem

.

• W h e r e t h e r e a r e h a z a r d s t h e r e a r e systems (hardware) including:

♦ Correctiv e sy stem s.

♦ Shutdown/shutoff.

♦ V e n t i n g a n d d i s p o s a l

.

• Where there are no cont r o Report shows that there are adequate preventive measures:

♦ e.g. if a runa w a y r e a c t i o n c a n n o t b e controlled ar e there good (standard, practice) measures for p r evention of runaway?

It can be co n c l u d e d t h a t the Safety Report demonstrates an approa measures that is proporti onal to the ri sks.

Criterion 12 .2.1.3

k

a n d

a r t 1

a r t L a y o u conduct pro

r e l a t i v e l a y o u t o f process equipment, hazardous inventories and the

• t i e s (e.g.

•

o e s t o

• La y out of the plant

s h o u l d l i m i t t h e r i s during operations, inspection, testing, maintenance,

m o d i f i c a t i o n , r e p a i r replacement.

[ S c h e d u l e 4 P p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] t i s s u es for proce ss will l i nk to the ability t o
c ess operat ions during n o rmal and emergency situation s

.

• L a y o u t p l a n s s h o w

separation o f hazardous and less/no n operational hazardous a r eas.

Plans show location of e m e r g e n c y u t i l i firewater).

• L a y o u t c o n s i d e r s h a z a r d ous interact ion between released materials.

• L a y o u t c o n s i d e r s h u m a n e m e r g e n c y response to process e v ents (i.e. can operators do what they need to do in identif ied emergencies?), et c Where there is venting ( e .g. to mitigate exothermic runaway) the Safety Rep o rt d e m o n s t r a t e s t h a t a n y v e n t e d m a t e r i a l g a safe and suitable location.
Layout considers acce ss for process operator

80Process Saf e ty Criteria Guidance

functions, e. g. location o f k e y m a n u a l process

• each other b een conside r ed:

a

Note: t h n t rol systems for reducing isolation s

. The risks associated wit h equipment being

a d j a c e n t t o

♦ There is a ju stificat ion fo r n o t h a v i n g e x t r barriers or changing the layout.

♦ Segregation of reactive materials in s t o r a g e or transport.

for an operating plant, redesig n is much more

a n a d d i n g c o difficult

r i s k s A L A R P ( e

. g

. r o u t e i n g a n d l o c a tion cannot be easily retrofitted).

Criterion 12 .2.1.4 Utilities that are needed

1 l e 4 P a r t a n t ) d u r i n g normal and abnormal

.

ing.

a l utilit y (e.g. fuel / purge).

• e n t s a n e v a l u a t i o n o f

particular pr ocesses (eg cooling wat e r

• i s i n g
e n a r i o s

. to implement an y measure defined in the safety repo rt should h a v e s u i t a b l e r e l i a b i l i t y , availability and survivability

.
[ S c h e d u l e 4 P a r t p a r a 3 ; S c h e d u 2 p a r a 4 ( c )
, 5 ( a ) ] • The Safety Report presents an evaluation ( w h e r e r e l e v operation of:

♦ Loss of pow er.

♦ L o s s o f a i r

♦ Loss of nitro gen.

♦ Loss of coo l i n g

. ♦ L o s s o f h e a t

♦ F i r e w a t e r s u p p l y

. ♦ O t h e r s a f e t y c r i t i c

T h e S a f e t y R e p o r t p r e s the signif i ca nce of the di fferent utilit i e s to the

important for an exothermic process).
The Safety Report demonstrates ho w utilities have been designed in r e l a t i o n t o m i n i m the consequ ences of major acciden t s c

• Independent supplies ar e provided where necessary (eg mains water supply is avoided where water pressure an d reliability of supply is critica l ).

Criterion 12 .2.1.5 The safety report should show that

r e s

v e l y

e s

.

p a r a 4 ( c )
, 5 ( a ) ] W h e r adequately describes m easures su ch as bundin g or

t h e r f o r m s o f s e c o n d a r y containment and contr o lled

a d e q u a t e , e.g.:

r e d a p p r o p r i a t e m e a s u h a v e b e e n t a k e n t o p r e v e n t a n d e f f e c t i contain releases of d a n g e r o u s s u b s t a n c

[Schedule 4 Part 1 para3; Schedule 4 Part 2 e t h e r e c o u l d b e r e l e a s e s , t h e S a fety Report

o disposal systems such a s venting int o d u m p t a n k s (see also 5. 2.1.7).

• The safety report shows that the pro posed

m e a s u r e s a r e

♦ Overtopping of bunds ha s b e e n c o n s i d e through suit able sizing criteria and structural de sign.

♦ The conseq uences of o v e r t o p p i n g h a s b e e n

81Process Saf e ty Criteria Guidance

considered.

Criterion 12

. 2

. 1

. 6 T h e s a f e t y report should show that all

i n

u l e 4 P a r t p a r a 4 ( c ) ] D i r e c
c o n s i d e r e i g n. For proce ss safety

o n s i d e r a t i o ns, the repo rt should ad dress (where

i a l s f o r ipment and systems exp o sed to

v i r o n m e n t s ( i n t e r n a l a n d

♦

n t s i n t h e c o r r osion prevention

♦ i l o s o p h y

•

♦ b r a s ive flow s, etc.

•

♦ underpressu re (vacuum), e.g. high/lo w
e rfaces, failure of contr o l

♦ s u r e
s

.

•

♦ or low temp erature, e.g. fire, freezin g, loss

o f c o n t r o l devices, e x ternal

♦

u t

,

• V i b

♦ f i c a t io n of process driven vibra t ion sources with the potentia l to cause a major g. water hammer, recip r ocating f o r e s e e a b l e d i r e c t causes of major accidents have been t a k e n i n t o a c c o u n t t h e d e s i g n o f t h e installation.

[ S c h e d u l e 4 P a r t 1 p a r a 3 ; S c h e d 2 t c a u s e s of loss of containment should be d d u r i n g d e s
c applicable) t he following direct cau s e s :

• Corrosion:

♦ Sy stem s for selection of m a t e r p r o c e s s e q u
c o r r o s i v e e n external). Consideration of the eff e cts of foreseeable changed pro c ess co nditions or

c o n t a m i n a arrangemen ts. Special corr osion monit o r i n g p h and arrangements.

E r o s i o n :
D e s i g n f o r s o l i d s o r a conditions, cavitation, phase change

P r e s s u r e :
Identificat io n of sources of overpressure or

p r e s s u r e i n t devices, external fire, failure of safet y devices, rea c tions, ther mal expansion, utility failure, etc.. Designed systems to prevent overpre s described linked to reco gnised stan d a r d

T e m p e r a t u r e :
Identificat io n of sources of excessive high

of utility, fail u r e environment , rapid differ ential thermal effects, et c.. Designed systems to prevent temperature

ex cesses an d effects, e. g. insulat i on , tracing, delu ge, protective barriers, la y o etc..

r a t i o n :
I d e n t i

a c c i d e n t

, e

. systems, cavitation, phase changes, e t c

. and how this has been considered in

82Process Saf e ty Criteria Guidance

design.

m a n Erro r:
Identificat io n o f s o u r c e s o f h u m a n e r r o p r o c e s s • H u

♦ r i n
o p e rations, e.g. maloperation of p m e n t

, l a c k o f p r o c e ss
s s , m i s u nderstood

. . ♦ t ed

a l i t y i s

♦ e f f e ct of

♦
e r r o r

.

Note: I t i s u explanation of how the identificat

f L O C h v a l v e s a n d e q u i h a z a r d a w a r e n e commands, unrealistic d e mands, lack of specific train i ng or proce ss knowledg e , e t c Identificat io n of measures aimed at

m i n i m i s i n g h u m a n e r r o r , e

. g

. d e d i c a storage and transfer syst ems, coupling design to pr event cross connection, etc..

♦ Identificat io n o f e x t e n t o f s a f e t y c r i t i c attached to h u m a n a c t i o n s a n d h o w t h i s catered for in design. R ealistic performance standards for safety critical functions du ring normal and emergency conditions, etc.. Defence in d e p t h t o m i n i m i s e t h e human failure. Control of process de sig n functions t o

m i n i m i s e d e s i g n

n a c c e ptable for th e s a f e t y r e p o r t t o h a v e n o ion of direct ca uses
a s b e e n c o n d u cted. o

Criterion 12 .2.1.7 The safety report should show h o w structures important to

e

r t safety have been d e s i g n e d t o p r o v i d adequate integrity

.
[ S c h e d u l e 4 P a r t 1 p a r a 3 ; S c h e d u l e 4 P a 2 para 4(c)]

Criterion 12 .2.1.8 The safety r e p o r t

h o u l d s h o w s h o w the

o n t a i n m e n t s t r u c t u r e t o
s

l • Details of fo reseeable plant normal and abnormal operating cond itions, in clud ing internal and external conditions, start

- up, shutdown, turnaround, regeneration, deg radation,

• c h a s b e e n d e s i g n e d

w i thstan d t h e l o a d experienced during

n o r m a l o p e r a t i o n o f t h e plant and all f o r e s e e a b l e o p e r a t i o n a emergencies, etc..
Description of philosoph y f o r s e t t i n g d e s i g n margins ove r foreseeable operating c o n d i t i o n s

. Tight operating margins may require justification w h e r e t h e y are relevant to safety of

83Process Saf e ty Criteria Guidance

extremes during its expected life.

[Schedule 4 Part 1 p a r a 3 ; S c h e d u l e 4 P a 2 para 4(c)] r t operation.

Identificat io n of signif i ca nt high / low pressure interfaces or differential pressures af fecting design and overpressure protection

a r r a n g e m e n •

ts (there have been spectacular

•

b l e c o i n c i d e n t al extremes of pressure failures due to a failure t o appreciate this issue).
Recognition of high / low temperatures and impact on permitted operating pressures. Design cond itions sh ould take accou n t of f o r e s e e a and temperature. Recognition of th e p o s s i b i l i t y of low temperatures cre a ting a vacuum.

Criterion 12 .2.1.9 The safety report should show that materials of i n b l e

. c o n s t r u c t i o n u s e d t h e p l a n t a r e s u i t a f o r t h e a p p l i c a t i o n

[Schedule 4 Part 1 p a r a 3 ; S c h e d u l e 4 P a r t 2 para 4(c)]

Criterion 12 .2.1.10 The safety report

s h o u l d s h o w that

d e q u a t e s a f e g u a r d s t o

4 P a r t In general te rms, the safety report should:

• Give details of the physical parameters of possible con d itions: f l ows, temperatures and

worst case scenarios, et c..

l e s h ort-term ove r stress co nd itions

•

s

.

a i l u r e a h a v e b e e n p r o v i d e d protect the plant

a g a i n s t e x c u r s i o n be y ond des ign conditions

[Schedule 4 Part 1 p a r a 3 ; S c h e d u l e 2 p a r a 4 ( c ) ] pressures w i th respect t o excursion s , runaway,

• Demonstrat e that the de sign standar ds and other applie d codes of p r actice are a ppropriate to the condit i ons under which the d e sign must work.

• Show that hazard identif ication ha s c o v e r e d t h e possibility of beyond design conditio n s. For process syst ems, the use made of code

a l l o w a b should be id entified and justified and any links to the predictive analysis made where appropriate.

Describe th e evaluation of excursio ns in chemical re actions, pro c ess operat ions, etc. and justify t h e s u f f i c i e n c y o f t h e c o n t r o l

• Describe th e philosoph y f o r t h e r e q u i r e d f modes of va lves (i.e. fail to safety).

84Process Saf e ty Criteria Guidance

• n t

•

ntrol

r m s t o w a r n o p e r a t o r s

•

♦ d

e s i g n e d t o p r e v e n t o r w a r n o f

e t y o f t h e p l a n t i s based.

t i n g

♦
n ction

n
o u l d

♦

. Show that accident h i sto r y for a type o f p l a has been co nsidered where relevant.
Justify non- use of recog n ised safeg uards.

• Normal operating limits:

♦ A p p r o p r i a t e m a n u a l o r a u t o m a t i c c o systems to maintain normal operating conditions.

♦ A p p r o p r i a t e u s e o f a l a of operating excursions beyond normal ranges.

Safe operating limits:

Identificat io n of safety r e lated contr o l

s a n alarm s d excursion b e yond safe operating limits and upon which t h e s a f

♦ Integrity of safety related controls (functionali t y, reliability, vulnerability, survivability, dependence on other sy stem s).

♦ P r e s s u r e r e l i e f a n d e m e r g e n c y v e n arrangemen ts, dump systems. High integrit y p r e s s u r e p r o t e c t i o n s y stems ( H I P P s ) u s e d i n p l a c e o f , or in conju with, mechanical overpressure prote c t i o systems and other cont r o l m e a s u r e s s h be justified and shown to be of adeq uate integrity. Interfaces w i th other measures su ch as shut-off of systems, flushing, reactio n inhibitors, cooling syste m s, venting systems, etc. to limit excursions bey ond safe operating limits sho u ld be descr i b e d

Criterion 12 .2.1.11 The safety report should describe how safety

- related control

r t s y stems ha v e b e e n
e d e s i g n e d t o e n s u r safety and reliability

[Schedule 4 Part 1 p a r a 3 ; S c h e d u l e 4 P a 2 para 4(c)]

Criterion 12 .2.1.12 The safety report

s h o u l d s h o w h o w

y s t e m s w h i s c h r e q u i r e The Safety Report shows:

• Any safety c r itical operat ions carried out by operators.

85Process Saf e ty Criteria Guidance

h u m a n i n t e r a c t i o n h a v e
a k e
e d s

a r t

c ) ] w s w h e n t o i n tervene to carry out such an operat ion.

n d

e q u i r e d h u m a n r e s p o n s e during

l a r , t h a t important

• a v e
e t y

• b e e n d e s i g n e d t o t i n t o a c c o u n t t h e n e of the user and be reliable

[Schedule 4 Part 1 p a r a 3 ; S c h e d u l e 4 P 2 p a r a 4 ( • H o w t h e o p e r a t o r k n o

• That assumptions regar d i n g t h e a v a i l a b i l i t y a i n t e g r i t y o f r foreseeable normal and emergency operating states are ju stified. In p a r t i c u process saf e ty critical control action s will not be jeopardised by changes in staff arran gements, that time to achieve operations has b e e n t a k e n into account , or that the safety of the design is otherwise n o t critica lly compromised by failure of required operator response due t o foreseeable causes (e.g. lack of tra i n i ng, human response under high stress, exposure to hazards p r eventing required actio n , etc.).
That suitable performance standard s h b e e n d e v e l o p e d a n d a r e m o n i t o r e d f o r s a f critica l oper ator function s. An adequate and achie v a b l e r e s p o n s e w h e r e operator int e rvention is a safeguard e

. g

. f o r detection an d correction of deviations.

• c o n s i d e r ation of For batch plant operatio n s : possibility of steps being omitted / repeated / carried out in the wrong order.

a s s e s h a s e o f h a v i n g a n

u t o m a t e d s y s t e m a n d j u s t i f i e d t h e suitability of the Note: If human response is sa fety critica l , the

s o r sh ould seek e v idence that the company

x a m i n e d t h e c o s t s a n d b e n e f i t s
a adopted app roach.

Criterion 12 .2.1.13 The safety report should describe the

s y stems fo r identify i n g

c e s s a n d p o l i c i e s f o r ide n tifying

s h e d i s a w a r e

• g a skets and when equipment is

e

• locations where

n f l a m m a b l e s u b s t a
c o u l d b e p r e s e n t a n d how the eq uipment has been designed to take account of the risk.

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)] The Safety Report shows (ie, the Operator understands):

The proced u r e • hazardous a r e a s a r e b a s e d o n e s t a b l i codes and standards (ie t h e o p e r a t o r
o f t h e m )

. The proced ures and policies for ide n tifying hazardous a r eas are con s istently app lied.

Releases of flammables through vents, from l e a k s f r o m opened have been considered (i.e. w h e r e t h leaks are likely to occur and what are the release para m e t e r s a n d f l a m m a b l e p r o p e r t i e s of release materials are likely to be).
A diagram with hazardou s area cla ssification for the site.

86Process Saf e ty Criteria Guidance

•

c h e c k r d t o t h e p h

s s e s s o r s a r e looking at the electrical equipment.

r
s The hazard ous area cla ssification d a ta is used in the sele ction and locat i on of equip m e n t a n d its maintena nce and in considering p l ant and process cha nges.

• The relevance and unde rstanding of the Dangerous Substances and Explosive Atmospheres Regulations (DSEAR).

Note: Process Safety assessor s ar e m a inly i n g what the company is doing w i t h r e g a y s i c a l area. Control and Instru m e n t a t i o n
a Mechanical assessor s m a y a l s o h a v e i n p u t f o equipment with the potential to gen erate hot su r f a c e sufficien t to be a source of ignition).

Criterion 12 .2.2.1 The safety report should show that th e installations have been

r d s

e n t constructed to

a p p r o p r i a t e s t a n d a to prevent major accidents and reduce l o s s o f c o n t a i n m

[ S c h e d u l e 4 P a r t 1 para3(a)]

C r i t e r i o n 1 2 .2.2.2

s c r i b e h o w
e c o n s t r u c t i o n o f a l l i s i f i e d

e The safety report

s h o u l d d e t h plant and sy s t e m s
a s s e s s e d , a n d v e r
a g a i n s t t h e a p p r o p r i a t standards to ensure adequate safety

. [Schedule 4 Part 1 para3(a)]

C r i t e r i o n 1 2 .2.3.1

o w that safe p e r a t i n g p r o c e d u r e s h e d

e d f o r

. • There is suff icient de scription about t he safety managemen t aspects o f developing safe operating systems to avoid a major accident. The safety report

s h o u l d s h

o h a v e b e e n e s t a b l i s
a n d a r e d o c u m e n t all reasonabl y f o r e s e e a b l e c o n d i t i o n s • There is evidence of op erational pro c edures which cover all reasonab ly foreseeable situation s

.

• Procedures should be re adily available to operators a nd be curre nt.

87Process Saf e ty Criteria Guidance

[Schedule 4 Part 1 para3(b)] • l a n a t i o n o f h o w the operator

e s

.

• s t h e p r o c ess for

)

.

N o t e :
r e l a t i o p r o c e T h e r e i s e x p develops, maintains and r e v i e w s p r o c e d u r

T h e S a f e t y R e p o r t d e s c r i b e developmen t of procedu res. It is a te am exercise involving people with differ ent skills (ie, technica l input to the content to e n sure hazards are p r o p e r l y i d e n t i f i e d a n d c o n t r o l l e d

There is quite a big overlap with SMS in

n t o i n tegrating pr ocess safety knowledge into d u r e s

Criterion 12 .2.4.1 The safety report should show that an appropriate

e i s
n t

n t

n t s o r m a i n t e n a n c e s c h e m
e s t a b l i s h e d f o r p l a and s y stem s t o p r e v e
m a j o r a c c i d e reduce the loss of containment in the event of such accidents.

[Schedule 4 Part 1 para3(b)]

Criterion 12 .2.4.2 T h e s a f e t y report

h o u l d s h o w that th ere
r e a p p r o p r i a t e

a k e

t i o n s
n g s
a procedures for

m a i n t e n a n c e t h a t t account of an y h a z a r d o u s c o n d i

w i th in the w o r k i environment.

[Schedule 4 Part 1 para3(b)]

Criterion 12 .2.4.3 T h e s a f e t y report

h o u l d s h o w that y stems are in place to

n e d s
s ensure that safety critical plant and

s y s t e m s a r e e x a m i

88Process Saf e ty Criteria Guidance

at appropriate intervals b y a compe t e n t p e r

[Schedule 4 Part 1 para3(b)] s o n

.

Criterion 12 .2.4.4 T h e s a f e t y report

h o u l d s h o w that th ere

a s y stem in place to

e d s i s
e n s u r e t h e c o n t i n u safety of th e installations based on the results of periodic examinations and

m a i n t e n a n c e

. [Schedule 4 Part 1 para3(b)]

C r i t e r i o n 1 2 .2.5.1

s c r i b e t h e y stem in p l ace for i o n s

,

t 1

c h e d u l e 2 p a r a 4 ( d ) ] • The safety report demonstrates that there is a system for dealing with:

♦ Modification s which are changes in process

♦ P i t able techniq ue. other

a t i o n

.

• T h e d e t e r m i n i n g

go through a formal ma nagement of change process. The safety report

s h o u l d d e
s
e n s u r i n g m o d i f i c a t are adequatel y
c o n c e i v e d , d e s i g n e d i n s t a l l e d a n d t e s t e d

.
[ S c h e d u l e 4 P a r para3(a); Schedule 4 Part 2 para 4, 5(a); S parameters, i.e. a robust change managemen t system that looks at ha zard and risks.

♦ Modification s which are changes in supplier. Whether a process ch an ge needs a H A Z O

o r o t h e r s u

♦ Updating operating procedures and d o c u m e n t

s y s t e m i n c l u d e s crit eria f o r when a process change is sufficient t o n e e d t o

89

### Appendix 12.2: Mechani c al criteria and guidance

Mechanical Criteria Guidance

Criterion 12 .1 The safety report should show a clear link bet w e e n the measures taken and the major accident hazards described

[Schedule 4 Part 1 para 2; Schedule 4 Part 2 para 4(a), 4(c), 5] This is t he core of the Safety Report from the technical point of view and provides the link betw een identifica t ion and analysis of hazards and the selection of measures.

• The findings from the hazard identif ication process hav e been used to identify t he safety critica l equip m ent for both pressurise d and non-pressurised plant, in cluding:

♦ Vessels.

♦ Tanks.

♦ Pipework.

♦ Seals.

♦ Joints and f l anges.

♦ Protective systems e.g. relief device s , emergency i s olations.

♦ Secondary containment.

♦ Rotating machines in clu d ing pumps, compressors, turbines, agitators, conveyors, etc..

• The scenarios are repre s entative. They can be used for focussing on:

♦ Low probability high con s equence e v ents e.g. failure o f pressure vessels.

♦ Higher probability generally lower consequence events e.g. failure of small bore pipework. Direct cause s o f ♦ f a i l u r e e

. g., corrosio n , mechanical impact, overpressure, et c..

• Maintenance and inspe c tion:

♦ Maintenance system described is appropriate f o r t h e i d e n t i f i e d m e a s u r e s

. The operator has a suita b l e a n d s u f f i c i e n ♦ t inspection r egime.

Criterion 12 .2 The safety r e p o r t

s h o u l d d e m o n s t r a t e how the me asures taken w ill p r event f o r e s e e a b l e f a i l u r e s

w h i ch coul d lead to major accidents T h i s i s e ffectively a summary of all the other crit eria. The assessor should co me back to this when th e other criteria have been assesse d, a nd then conclude:

• Whether all the assesse d criteria ha ve been met.

•
o n

. How significant the failur e of one or more criteria i s /ar e t o t h e o v e r a l l s a f e t y j u s t i f i c a t i

90Mechanical Criteria Guidance

• Any failure to recognise appropriate standards.

• Full application of the sta ndards and any deviations.

Criterion 12 .2.1.1 The safety report should show that th e establishment and installations have been designed to an appropriate standard.

[Schedule 4 Part 1 para 3; Schedule 4 Part 2 para 4(c), 5(a)] The safety report should describe relevant codes and standards. Where these deviate from recognised codes or sta ndards, the f o llowing info rmation should be in the Sa fety Report.

• List of all de viations/exceptions.

• Justification why these have been adopted.

• Demonstration that the d e viation or exception provides a level of integrit y at least as h i g h as that pro v ided by the relevant code.

This criter io n is related t o criterion 1 2 .2.1.7

. Criterion 12 .2.1.2 The safety report should show that a hierarchical approach to the selection of measures has been used.

[Schedule 4 Part 1 para (3); Regulation 4] This is an important criterion which has a clo s ely defined 4 st age hierarch y: eliminate (inherent safety), prevent

, control

, mitigate , in that orde r of priority. For mechanical discip line a ssessment:

• The identification of suit able management system controls for maintenance and inspection schemes as prevention measures.

• The appropriate selection of equip m ent to minimise or prevent the likelihood or consequences of failure (e.g. use of sealless pumps, use of corrosion resistent ma terials, etc.).

Criterion 12 .2.1.3 La y out of the plant should limit the risk during operations, inspection, testing, maintenance, modification, repair and replacement.

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)] Good layout in design m a y be influenced by equipment features:

• Evidence that catastrop h ic failure of equipment has been co nsidered in setting equipment layouts, (e.g. what might fail, would it create missiles and where migh t they go? Could the fallout from equipment failure be red u ced by careful layo ut considera t ions (e.g. orientation)? )

• Consideration of dropped objects a r ising from construction and maintenance.

• Consideration of lifting r e striction s r e lating to equipment maintenance and the impact for layout desig n.

• Consideration of access limitations for maintenance and inspe c tion.

91Mechanical Criteria Guidance

Criterion 12 .2.1.4 Utilities that are needed to implement an y measure defined in the safety repo rt should have suitable reliability , availability and survivability

. [Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c), 5(a)] The utilitie s i ssues typica lly include fa ilure of servi c es which could lead to a major acciden t

• The impact that the failur e of utilit ies could have on the mechanical systems is a ssessed

, including pr ovision and integrity of back-up sy stem s

• Demonstration of the reli ability of back-up systems through monitoring, alarm and testing regimes.

Criterion 12 .2.1.5 The safety report should show that appropriate measures have been taken to prevent and effectively contain releases of dangerous substances.

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c), 5(a)] Initial int egri t y. Measures for prevention and containing releases.

• The Safety Report describes suita b le means for preventing loss of co ntainment through the identifica t ion of integrity (function, rel i ability, vulnerability, survivability) of mechanical equipment such as:

♦ ESDVs

♦ Manually op erated isolat ions in safet y critica l duty

♦ Excess flow valves and non-return valves

♦ Protection a rrangements for rotating equipment, (e.g. cavitation, dry running, deadhead conditions, seal protectio n .)

♦ Joint integr it y (flanged, screwed, cou p lings, etc.).

♦ Temporary repairs (e.g. clamps, wraps).

♦ Dry break couplings

♦ Bellows and flexible joint s

. ♦ Secondary containment.

Criterion 12 .2.1.6 The safety report should show that all foreseeable direct causes of major accidents have been taken into account in the design of the installation.

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)] Initial int egri t y

Direct cause s of loss of containment should be considered in the design of suitable measures. For mechanical consideratio ns, the repo rt should address (where applicab le) the follo wing direct causes of L O C:

• Corrosion:

♦ Sy stem s for selection of m a terials for process equ ipment and systems exp o sed to corrosive environments (internal and external). C o n s i d e r a t ♦ i o n o f t h e e f f e cts of foreseeable changed pro c ess co nditions or contaminants in the corr o s i o n p r e v e n t i o n

92Mechanical Criteria Guidance

arrangemen ts.

♦ Corrosion monitoring philosophy and arrangemen ts. Specific t h reats such as: Corrosion under insulation, deadleg s, buried or masked syste m s, soil/air interfaces et c.

• Erosion:

♦ Design for solids or abra s ive flow conditions, cavitation, phase change s, etc.

• External loading:

♦ Equipment loadings, e.g

. design of equipment and piping sy stem supports for use during construction and normal operation.

• Impact:

♦ Consideration in design for foresee able sources of impact dama ge, includin g missiles, dro pped object s and swinging loads during construct i o n and maintenance, blast loadin g s.

• Pressure:

♦ De sign ed sy stems to prevent overpressure or vacuum described lin ke d to recognised standards

.

• Temperature:

♦ Designed systems to prevent excess mechanically induced temperature excursions described linked to reco gnised standards.

♦ Design for low temperat ure effects ( e .g. brittle failure avoidance, freezing, etc.)

• Vibration:

♦ Machine induced vibration

♦ Consideration of small bore connections and their su pports.

♦ Consideration of process induced vibration, e.g. water hammer, reci procating sy stems, cavitation, p hase chang es, etc. and how this has bee n considere d in design.

• Wrong Equipment:

♦ Equipment supply standardisation a nd managemen t approache s to minimise LOC (e.g. small b o re fittings).

93Mechanical Criteria Guidance

Defective equipment.

e n a n c e and inspect i on
o

♦

,

o t e : It is u nacceptable for the safet y report to have •

• Human Erro r:

♦ C o n t r o l o f m a i n t activities to r educe human contributio n t LOC during system inva sive activitie s

. Training implication s for LOC, hazard
awareness, equipment specific tra i n i n g etc..

N no explanation of how the identification of direct causes of L O C has been conducted

.

Criterion 12 .2.1.7

n t t o

e

c h e d u l e 4 P a r t 1

a r t i t i a l i n t egri t y

h i s c r i t e r io n applies to all major vessels, p i pework,

There is de monstration of adequate initial

r e n c e t o i n t e r n a t i o n a l c o d e s and

♦ t o p r i n c i p a l design par ameters

♦

- h o u s e ndards shou ld be asse ssed

, or design

es fitness f o r

g o f The safety report should show h o w
s t r u c t u r e s i m p o r t a safety have been d e s i g n e d t o p r o v i d adequate integrity

.
[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] I n

T rotating machines (e.g. p u mps, compressors, et c. ) and valves if they feature in major accident scenarios.

• integrity:

♦ B y r e f e standards. B y r e f e r e n c e (e.g. design pressure an d temperature) and category of construction if applicable

. Relevance and applicab ility of codes a n d standards.

c o des and sta I n for their rele vance (a suitably robust description of how the company has validated them) based on prima facie evidence

.

When no st andards have been used • parameters are not kno w n:

♦ the company demonstra t purpose sho w ing how it has conduct e d d e s i g n r e v i e w s ( f o r n o v e l d e s i g n s , m i x i n standards, n on-standard approaches). The impact of su ch novel design approa ches on required systems for mo nitoring,

m a i n t e n a n c e , e t c

. s h o u l d a l s o b e d e scribed to depth con s istent with t he potential risk of adopting su ch design s

.

Criterion 12 .2.1.8 i t i a l i n t egri The safety report I n t y.

94Mechanical Criteria Guidance

should show h o w the containment structure has been designed to

w i thstan d t he loads experienced during

n o r m a l o p e r a t i o n o f plant and all f o r e s e e a b l e o extremes during its expected life. t h e

p e r a t i o n a l

c h e d u l e 4 P a r t 1

a r t i s c r i t e r io n is related t o criterion 5. 2.1.7

. Compare de sign conditio n s with expected

e s s

m a r g i n s a r e d e monstrated where

♦ x t r e m e c o nditions mig h t h e

♦ i s sufficien tly proportionate to the

o n t i n u i n g i n t e g r i t y :

Demonstration of how the operator monitors

n c e [ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] T h

• operating co nditions for e q u i p m e n t a n d a s s the margin:

♦ A d e q u a t e appropriate. Where more e
o c c u r t h e y h a v e b e e n a c c o u n t e d f o r i n t design. E v i d e n c e risk and co mplexity of t he process.

C

• and ensures the plant co ntinues to o perate within desig ned limits. Changed operating conditions may affect t he intended p e r f o r m a of some plant, introducing additiona l hazards or integrity ma nagement requirements.

Criterion 12 .2.1.9

i n

c h e d u l e 4 P a r t 1

a r t The Safety Report should demonstrate the

n d

v e

i o n

• e n t approach

• f P a r e n t M e t a l I n s p e c t i on (PMI)

a y b e

[Note: Detailed issue s a bout the suit ability of cer t ain

g The safety report should show that materials of

c o n s t r u c t i o n u s e d the plant are suitable for the application.

[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] • compatibility between operating cond i t i o n s a the material of the containment systems (eg, for known corrosive agents). (See Criterion 5.2.1.6.). T he report sh ould link the a g g r e s s i nature of th e operating environment and operating co nditions to t h e m a t e r i a l s e l e c t process for specified eq uipment.

T h e r e p o r t d e m o n s t r a t e s a c o n s i s t in the choice of materials rather tha n just a catalogue of material specificat ions f o r the whole plant.
Description o regime for verification of bought-in r a w
m a t e r i a l s o r e q u i p m e n t w h e r e a p p l i e d ( m important for pre-constr uction of modification reports).

materials may be carried forward to the inspect i on programme for existing sites, but m a y r e q u i r e r a i s i n directly for p r e-construction or modification report s during the a ssessment stage.]

Criterion 12 .2.1.10

d s i t i a l a n d in -service inte grity.

Mechanical measures in place to pre v ent The safety report should show that

a d e q u a t e s a f e g u a r h a v e b e e n p r o v i d e d t o I n

• excursion conditions ar e described.

95Mechanical Criteria Guidance

protect the plant

a g a i n s t e x c u r s i o n be y ond des ign conditions

c h e d u l e 4 P a r t 1

a r t Demonstration that appr opriate provision has

o t h e r

♦

♦

i t h i n

r y p a c k a g e d

a l l [ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] • been made for excursion relief, throu gh:

♦ Pressure or vacuum relief devices, o r pressure pr otection arra ngements.

♦ Description where the nature of the p r o c e s s fluid may compromise ef fective operation of the relief de vices (e.g. f ouling). Description of relief syst em testing regimes. Description of p o t e n t i a l e x c u r s i o ♦ n s ( e .g. overfill / und erfill, starvat i on, cavitatio n , deadheadin g of pumps, etc.) Reverse rot a tion / overspeed of compressors or turbines.

♦ Provision of suitable me a s u r e s w packaged u n i t s

. ( P r o p r i e t a equipment may not me et the same standards a dopted else w h e r e i n t h e o v e r design philo sophy for the site).

Criterion 12 .2.1.11 The safety report

w
r o l

a r t s h o u l d d e s c r i b e h o safety

- r e l a t e d c o n t

s y stems ha ve been designed to ensure safety and reliability

[Schedule 4 Part 1 p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)]

Criterion 12 .2.1.12 T h e s a f e t y report

u i r e

l e 4 P a r t 1

a r a 3 ; S c h e d u l e 4 P a r t should show h o w
s y s t e m s w h i c h r e q h u m a n i n t e r a c t i o n h a v e been designed to take into account the needs of the user and be reliable

[ S c h e d u p 2 para 4(c)]

Criterion 12 .2.1.13 T h e s a f e t y report

n g • The report identifies wh ere mechanical equipment may generat e an ignition source.
s h o u l d d e s c r i b e t h e
s y stems fo r i d e n t i f y i locations where flammable substances (e.g. equipment hot surfa c e generatio n potential, sp ark generation potential, etc.).

96Mechanical Criteria Guidance

c o u l d b e p r e s e n t how the eq u i p m e n t h a s b e e n d e s i g n e d t o t a k e account of the risk.

[Schedule 4 Part 1 a n d

a r a 3 ; S c h e d u l e 4 P a r t p 2 para 4(c)]

C r i t e r i o n 1 2 .2.2.1

h e s a f e t y report h e b e e n

r

n t

a r a 3 ( a ) ] Initial int egri t y

r e l e v a n t to construct i on of new and

c e n t ( e

. g

. as part of a modification ) plant so as to

h e y are less d ependent on the

f o r

n t

t t o m e c h a n i c a l

n g i n e e r i n g , the Design Code (e.g. BS PD5500 for

s ) will

initial integrity:

r d s

. i f

o f c o d e s a n d standards. T should show t h a t t i n s t a l l a t i o n s h a v e constructed to appropriate standards t o p r e v e n t m a j o accidents and reduce l o s s o f c o n t a i n m e

[Schedule 4 Part 1 p This criter io n i s

r e gain assura nce that the constructi on phase will b e effectively managed. This criter io n likely to ha ve a limited application f o r older plants b e c a u s e t initial integrit y issues. It is not unusu a l that construction or commissioning infor m ation is no t be available for the old plan t. Primary i n t e r e s t establishe d installation s is more likely to be associat ed with modifications involving new pla integrated with old syste m s.

F o r m o s t e q u i p m e n t o f i n t e r e s
e Pressure Vessels or BS 2 6 5 4 f o r S t o r a g e T a n k cover constr uction and inspection / t e st standard s a s well as desi gn. This cr it erion will the r efore generally be covered by assessment carried o u t against Criterion 5.2.1.7.

• There is de monstration of adequate

♦ By reference to international codes a n d

s t a n d a

♦ By reference to categor y o f c o n s t r u c t i o n applicable.

♦ By explainin g the relevance and

a p p l i c a b i l i t y

Criterion 12 .2.2.2 The safety report

w f a l l Initial int e

e e n p r o v i d e d t o s h o w t h a t :

i o n i n g o f the plant ha s been docu m ented and the

[ N o t e h o u l d b e p r o v i d e d s h o u l d d e s c r i b e h o t h e c o n s t r u c t i o n o plant and sy stems is

a s s e s s e d , a n d v e r i f i e d

a g a i n s t t h e a p p r o p r i a t e standards to ensure adequate safety

. g r i t y.

E v i d e n c e h a s b

• Initial in spection, testing a n d c o m m i s s

information is retrievable.

: D i s c u s s i o n o f t h is topic s

97Mechanical Criteria Guidance

[ S c h e d u l e 4 P a r t 1

a r a 3 ( a ) ] v e n f o r o l d e r p l a n t

, w h e r e i n f o r m a t i o n m a y n o t be p e available, to indicate ho w the company has considered t he implicatio ns for major accident s.]

C r i t e r i o n 1 2 .2.3.1 The safety report

r e s

r

a r a 3 ( b ) ] a n d O p e r a t i o n s s a f e t y reports should describe how it is assured tha t should show that safe

o p e r a t i n g p r o c e d u have been established

a n d a r e d o c u m e n t e d f o all reasonabl y foreseeable conditions.

[Schedule 4 Part 1 p Continuing integrity.

• P r e

- o p e r a t i o n s

mechanical plant and eq uipment are always operated within safe limits?

C r i t e r i o n 1 2 .2.4.1

h e s a f e t y report

i s
o r p l a n t

P a r t 1

a r a 3 ( b ) ] Continuing integrity.

o n s truction rep o rts

r , r e p a i r , p l a c e m e c h a n i c a l p l a n t and equip m ent).

v e m a i n t e n a n c e

i l i t y b a sed, etc.).

t i ng to

♦

•

em,

n o g r a m ,

♦ s

. ♦ T should show that an appropriate

m a i n t e n a n c e s c h e m e
e s t a b l i s h e d f and s y stem s to prevent major accidents or reduce the loss of containment in the event of such accidents.

[ S c h e d u l e 4 p Not applicab l e t o p r e

- c

Routine maintenance is a key issue ( m o n i t o

r e

• The Safety Report indicates:

♦ There is a r e l e v a n t p r o a c t i regime in place.

♦ There is a maintenance philosophy (e.g. t i m e

- b a s e d

, r e l i a b

♦ There a system of prioritisation of

m a i n t e n a n c e a c t i v i t y , e s p e c i a l l y r e l a safety critica l plant. Performanc e monitoring is in pla c e.

The Safety Report describes:

♦ The maintenance administration syst including a d e p a r t m e n t o r g a relevant job description s, roles and responsibilities. Overview of k e y m a i n t e n a n c e a c t i v i t i e T h e s a f e t y c r i t i c a l a c tivities where appropriate.

Criterion 12 .2.4.2 The safety report t h ere Usually only apply to the extent of identifying issues

r t h e i n s mme where specific should show t h a t are appropriate procedures for maintenance that take account of an y hazardous conditions

w i th in the w o rking f o p e c tion progra hazardous a c tivities are identified.

98Mechanical Criteria Guidance

environment.

[ S c h e d u l e 4 P a r t 1

a r a 3 ( b ) ] p

C r i t e r i o n 1 2 .2.4.3

h e s a f e t y report

c e t o

e d

r v a l s

a r a 3 ( b ) ] In-service in tegrity:

x a m i n a t i o n o f s a fety critical l a n t

. ]

a l l e q u i p m e n t c o n t a i n i n g h a zardous flu i ds.

the results o f maintenance and insp ection and

•

.

.

t h e

o n s t r a t e d

, e

. g

. by

a s

♦
e e m p l o y e d

.

• Where there is Risk Based Inspectio n (RBI), the Safety Report:

a r e what capacit y. T should show that

s y s t e m s a r e i n p l a ensure that safety critical plant and

s y s t e m s a r e e x a m i n
a t a p p r o p r i a t e i n t e b y a compe t e n t p e r s o n

. [Schedule 4 Part 1 p P e r i o d i c i n

- s e r v i c e e p [Note: Not applicable t o p r e

- c o n s t r u c t i o n r e p o r t s

. A p p l y t o

• There is a system which enables lea r n i n g f r o m

failure hist ory (for impact on inspect i on frequency).
Inspection r egime adequately descr i b e d

• Inspection fr equencies h a v e b e e n j u s t i f i e d

• Inspection system shows appropriat e prioritisat i on of safety critical equipm ent.

• Inspection a r r a n g e m e n t s a r e d e s c r i b e d i n Safety Repo rt such that:

♦ The indepen edence and competence of inspection st a f f i s d e m reference to UKAS accreditation or compliance with relevant standards s u c h BSEN 4500 4. Where 1 st , 2 nd or 3 rd party accredited organisation s a r

♦ Giv e s an overv i ew of system used (or reference).

♦ Indicates wh ether external consultan t s

u s e d a n d i n

♦ Indicates ho w changes in inspect i on f r e q u e n c y i n d i c a t e d b y t h e R B I p r o c e s s a r e managed (e.g. a cautiou s approach). Criterion 12 .2.4.4 The safety report h ere
e t o I n

- s e r v i e

idence of post inspe c tio n followfindings are analysed with judgements on should show t h a t t is a s y stem i n p l a c ensure the continued safety of th e i n s t a l l a t i o n s b a s e d o n t h e r e s u l t s o f p e r i o d i c examinations and c i n tegrity:

l l o w

- up to inspe c tions of T h i s c o n c e r n s t h e f o

r i t e r i o n 5

. 2

. 4

. 3

. C

• Check for e v up:

♦ Safety Repo rt indicate s t hat inspect i on

99Mechanical Criteria Guidance

maintenance.

[ S c h e d u l e 4 P a r t 1

a r a 3 ( b ) ] o n t i n u e d f i t ness for ser v ice.

p c

♦ The safety report indicat e s a s y s t e m f o r reviewing inspection f i n d ings and a m e a n s of managing follow-up a c tions.

♦ Liaison and dialogue wit h independe nt inspection a u thorities, p a r t i c u l a r l y w h e r e revisions of Written Sch e mes of Exa m ination are necessary.

Criterion 12 .2.5.1 The safety report should describe the

i o n s

,

) ] P r e

- c o n s

s y s d m a n a g i n g i l d

I n i t i a l

Change ma y inadverten t ly reduce safety of

p t has been properly

c h a n g e control process addresses

I n s e r v i c e

• The modifications proce dure integra t es the

t h e p o t e n tial impact o f new

• s y stem in p l a c e f o r
e n s u r i n g m o d i f i c a t are adequatel y
c o n c e i v e d , d e s i g n e d i n s t a l l e d a n d t e s t e d

. [Schedule 4 Part 1 para3(a); Schedule 4 Part 2 para 4, 5(a); S c h e d u l e 2 p a r a 4 ( d t r u c t i o n a n d p r e-operations report:

t e m i n p l a c e f o r i d e n t i f y i n g a n • modification s during the design and b u process

i n t egri t y:

• plant:

♦ The modification conce addressed f o r mechanical integrity.

♦ T h e changes tha t might be made during construction that could a ffect mechanical integrity.

i n tegrity:

integrity ma nagement of new mechanical plant

a n d a d d r e s s e s equipment on existing systems.
The modification proced ure includes changes to existing plant.

100

### Appendix 12.3: Control & instru m e ntation cr iteria and gui da nc e

Control & Instrumentation Criteria Guidance

Criterion 12 .1 The safety report should show a clear link bet w e e n the measures taken and the major accident hazards described

[Schedule 4 Part 1 para 2; Schedule 4 Part 2 para 4(a), 4(c), 5] • The report should provide links b e tween the Major Accident Scenarios (MAS) an d the risk reduction measures in cluding, SIS. The level of demonstration should b e proportion ate to the consequence/severity of the MAS.

• The choice of represent ative MAS s hould have been influen ced by the requirement for the Compan y to demonstrate that risk re duction measures, including SI S, have suitable safety and reliabilit y through design, and th at this is maintained throughout the lifecycle of the sy stem

.

• Where Safety Instrument ed Systems are linked to reducing r i sk of MAS the report sh ould clearly demonstrate ho w the reliability of those systems has been determined, and how this is commensurate with the risk analyse s techniques used in the S.R for demonstration that risks ha ve been reduced to ALARP.

• For SIS designed to curr ent recognised industry standards, such as BSEN6 1508/61511 it should be demonstrated that the risk assessment method used to determine Safety Integrity Levels (SIL) ha s been calib r ated to take accoun t of consequ ence/severit y of major accident sce narios, and also that tar gets for acceptable r e sidual levels of risk are at least as rigorous as t hose promoted in HSE guidance “Reducing Risks Prote c ti ng People”.

• For legacy systems (designed pre 61508/61511) it is often the case tha t initial requirements for SIS in t e rms of functionality and reliabilit y have been determined from historica l ha zard identif ication proce sses, e.g HAZOPs. However, ofte n the reliability of the SIS has not been determined from a risk assessment , or the risk assessment used at the time ma y not be suitable for COMAH purposes. T he Compan y should cle a rly state what the current status is and any reviews they plan to carry out.

• The assessor should no te areas where there may be ob vious SIS omissions. This should be discussed with appropria te members of assessment team and a decision ma de if it could be a credible furth e r measure that the

101Control & Instrumentation Criteria Guidance

Compan y should be implementing. In extreme cases th is o m ission may be regarded as a serious def iciency.

The risk a s sessment process sh ould result in consideratio n of further measures for MAS. This should not b e confined t o the representative set.

Criterion 12 .2 The safety report should demonstrate how the me asures taken w ill p r event foreseeable failures

w h i ch coul d lead to major accidents See 12.1

Criterion 12 .2.1.1 The safety report should show that th e establishment and installations have been designed to an appropriate standard.

[Schedule 4 Part 1 para 3; Schedule 4 Part 2 para 4(c), 5(a)] • The S.R should include information on the standards u s ed for:

♦ Safety Instrumented Systems

♦ Process Control Systems

♦ Hazardous Area Classif i cation

♦ Standards used for design, maintenance/testing of EX equipme n t

♦ Design/maintenance/test ing of: Fixed electrica l systems H.V and L.V.

♦ Earthing systems

♦ Lightning pr otection syst ems

♦ Fire & gas d e tection syst ems

The duty holder should identify and justify cases where the design of their installat i on fails to mee t the establishe d standards.

Criterion 12 .2.1.2 The safety report should show that a hierarchical approach to the selection of measures has been used.

[Schedule 4 Part 1 para (3); Regulation 4] This is an important criterion which has a clo s ely defined 4 st age hierarch y: eliminate (inherent saf e ty), prevent, control, mitigate

, in that orde r of priority. For electrica l an d control discipline a sse ssment:

• The report should describe the application of suitable laye rs of protection. A typical approach could be:

♦ Robust process contro l ( i ncluding h u m an interaction) A l a r m s t o i n d ♦ i c a t e e x c u r s ions from n o rmal operating en velope. Designated S a f e t y I n ♦ s t r u m e n t e d S y s t e m s

. ♦ Final protect i on system (often mechanical, i.e. pressure relief syste m s, howeve r , c o u l d be a high int egrity SIS).

102Control & Instrumentation Criteria Guidance

♦

h e n u m b e r o f l a y e r s a n d t h e a m o u n t o f r i s k t h e Mitigation systems

T reduction for each layer should be re l e v a n t t o consequence/severity of the range o f potential hazardous e v ents.

Criterion 12 .2.1.3 t

e p a i r a n d

c h e d u l e 4 P a r t 1

a r t h e r e p o r t s h o u l d p r o v i d e a n o v e r v i e w of how the

How the layout of contro l, instrument and

d

• of control centres within the plant

d i ng

• t r o l r o o m e q u i p m e n t t o t a k e

• p o t e n t i a l for

e s t o La y o u t o f t h e p l a n
s h o u l d l i m i t t h e r i s k during operations, i n s p e c t i o n , t e s t i n g , maintenance,

m o d i f i c a t i o n , r replacement.

[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] T following ha s been considered.

• electrica l eq uipment has taken acco u n t t h e needs of nor m a l o p e r a t i o n s , m a i n t e n a n c e a n testing requirements, and emergency operations.

The location and their vulnerability to potential major accident ev ents. This s h o u l d h a v e b e e n subject to suitable risk assessment s ( i n c l u Occupied Buildings Assessments where applicable).

L a y o u t o f c o n account of n o rmal and emergency c o n t r o l conditions ( e .g. ergonomics of nor mal and emergency control pane ls).
Minimised vulnerability, a n d

common ca use failure, of essentia l s e r v i c safety critica l instrumented systems and key process con t rol applica t ions.

Criterion 12 .2.1.4

e d e d

t h e

t y ,

c h e d u l e 4 P a r t 1

a r t A descriptio n of each utility and its b a ck-up

• a t t he effect

s s

. T h e

•
e n t

• r i p i s a p o t ential init iato r. Suitable U t i l i t i e s t h a t a r e n e to implement an y
m e a s u r e d e f i n e d i n safety repo rt should h a v e s u i t a b l e r e l i a b i l i availability and survivability

.
[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c), 5(a)] • systems should be provided. It should be identified wh ich utilities a r e essentia l for operation of key safety systems.

T h e r e p o r t s h o u l d d e m o n s t r a t e t h of loss of ke y utilities ha s been considered as part of a str u ctured hazard identifica t ion / analyses pr o c e assessment should have ensured th at control systems and safety systems fail to a s a f e s t a t e and that the consequence of a utilit ie s failure does not act as a major accident initiator.

Effects of lo ss of ele c trical supply on o t h e r utilitie s such as fire wate r provision, i n s t r u m and compressed air, n i tr ogen supplies should all have been considere d in such an

assessm ent

. E v e r y p o w e r t diversity and redundancy should be inherent

103Control & Instrumentation Criteria Guidance

within systems to reduce the risk of common mode or common caus e failures. P r o b l e m s l i k e l y t o b e e n c o u n t e r e d i of internal g eneration, lo ss of hydraulic pressure to ESD valves, loss of a i r i n a i r reservoirs on valves.

C o n s i d e r a t i o n o f t h e e f n clude loss

• f e cts of dip s in power

• i a l utilit ies

• e l ectrica l sup p ly and

b l e

t e

• s / U P S s y s t e m s s h o u l d b e subject to

•

o r m a l l y E S D s y s t e m s s h o u l d f a i l t o a safe state.

r o v i s i o n s supplies a s well as full p o wer loss.

Measures to detect failur e o f e s s e n t should be d e scribed.

D e m o n s t r a t i o n t h a t t h e associat ed protection systems have been designed an d are being m a i n t a i n e d t o s u i t a industry sta ndards. Electrical distrib u tion systems should be desig ned to discr i m i n a faults to pre v ent cascading the failur e a c r o s s the site.

G e n e r a t o r suitable periodic mainte nance/testin g regimes.
Instrument air system should be described and quality specification sho u ld be inclu ded

N However, sa fety related systems which rely on a positive power supply sh ould be iden tified. Demonstrations should s h o w t h a t s u i t a b l e p are in place to ensure th at these systems achieve their require d function u nder all fore seeable shutdown conditions.

Criterion 12 .2.1.5

r e s

l y

e s

.

c h e d u l e 4 P a r t 1

a r t Process failures to dang er, including how

c a n

Demonstration that fire & gas detect i on b e

l o g y d e s c r i p t i o n i f i c a t ion. – i.e.

♦ a r d s

. t o r s t o r s The safety report should show that

a p p r o p r i a t e m e a s u have been taken to p r e v e n t a n d e f f e c t i v e contain releases of d a n g e r o u s s u b s t a n c

[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c), 5(a)] • instrumentation and cont r o l b a s e d f a i l u r e s lead to loss of containment, should have been considered by suitable hazard ident i f i c a t i o n a n d analysis techniques.

• systems are suitable for purpose sho u l d

m a d e

. I n f o r m a t i o n s h o u l d b e p r o v i d e d o n t h e following:

♦ T e c h n o

♦ S a f e t y r e q u i r e m e n t s s p e c what is it in stalled to do? Reference to design sta n d

♦ Rationale fo r positioning o f d e t e c

♦ Measures in place for pr otecting det e c against poisoning.

♦ M a i n t e n a n c e a n d t e s t i n g procedure s for

104Control & Instrumentation Criteria Guidance

sy stem s.

Criterion 12 .2.1.6

e e n

c h e d u l e 4 P a r t 1

a r t h e r e p o r t c o n s i d e r s c o ntrol, instru mentation and f

s

Corrosion

e l e c t i c a l an d control sy stems

e

Erosion

f i n ternal instru ment compo nents

External Loading

p o t e n t i a l risks to plan t from

s t o

Wrong Equipment

s i n strumentation as a

.

Human Erro

r i v e d f r o m mi suse of safe ty

n The safety report should show that all foreseeable direct causes of major

a c c i d e n t s h a v e b t a k e n i n t o a c c o u n t i n the design of the installation.

[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] T electrica l systems and their use as a direct cau s e o failure, and discusses h o w this has influenced th e selection of m e a s u r e s

. P o t e n t i a l f a i l u r e m e c h a n i s m for consider ation inclu d e :

•

♦ C o r r o s i o n o f which could lead to a dir e ct failure, blockage of instruments by c o r r o s i o n products. Materials se le ction shou ld b suited to the process

•

♦ E r o s i o n o due to solid s, abrasive f l ow conditio n s, cavitation, p hase chang e , h i g h p r e s s u r e drop, etc.

•

♦ Assessm ent o f lightning. Su itable protection systems to prevent/miti gate fire/sho ck and to pr o v i d e surge protection systems should be installed wh ere necessa r y

. R e f e r e n c e suitable in d u stry standards should b e made.

•

♦ T h e r e p o r t a d d r e s s e direct cau s e of failure, e. g.use of wrong type of equipment such as transmitt e r s , e t c

r •

♦ F a i l u r e s d e system overrides during n o r m a l o p e r a t i o or after maintenance, u nder temporary operating arrangem ents, e t c.

Criterion 12 .2.1.7

n t t o The safety report should show h o w
s t r u c t u r e s i m p o r t a safety have been d e s i g n e d t o p r o v i d e adequate integrity

.

c h e d u l e 4 P a r t 1 [ S

105Control & Instrumentation Criteria Guidance

p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] a r t

C r i t e r i o n 1 2 .2.1.8

t h e

p e r a t i o n a l

c h e d u l e 4 P a r t 1

a r t The safety report should show h o w the containment structure has been designed to

w i thstan d t he loads experienced during

n o r m a l o p e r a t i o n o f plant and all f o r e s e e a b l e o extremes during its expected life.

[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)]

C r i t e r i o n 1 2 .2.1.9

u s e d i n

c h e d u l e 4 P a r t 1

a r t Corrosion and the products of corro sion can impact

Corrosion/erosion potent ial has been taken into

• r o s i o n may be

o t e s e e a l s o C r i t e r i o n 12.2.1.6] The safety report should show that materials of

c o n s t r u c t i o n the plant are suitable for the application.

[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] on the reliab ility of safety instrumented systems:

• account in material selection and a ffected the selection of equipment (e.g. Hi/Lo pressure letdown; entrained solid s; use of pro t ective barriers for t r ansmitters, etc.).

A w a r e n e s s t h a t p r o d u c t s o f c o r sourced remote from the location of affected instrumentation (i.e. syst em awarene ss is required in selecting me asures)

[ N

Criterion 12 .2.1.10

d s

c h e d u l e 4 P a r t 1

a r t There is an appropriate overall process contro l

i v e d

t r o l

,

• a s y s t e m f o r i s t o r y

• e n a n c e The safety report should show that

a d e q u a t e s a f e g u a r h a v e b e e n p r o v i d e d t o protect the plant

a g a i n s t e x c u r s i o n be y ond des ign conditions

[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] • strategy based on an un derstanding of the hazards associated with t h e p r o c e s s e s , d e r from structured identification and an alysis of those hazar d s

. T h e r e s h o u l d b e a s y s t e m f o r determining, recording a nd reviewing safe operating limits and how these rela t e t o c o n alarm and trip settings:

T h e r e s h o u l d b e i n p l a c e reviewing settings based on operatin g h and account ing for any modification s.

T h e s a f e t y r e p o r t d e s c r i b e s h o w m a i n t activities are prevented from overco ming

106Control & Instrumentation Criteria Guidance

safeguards such as inte rlocks and t h e i n t e of safety related control systems. g r i t y

Criterion 12 .2.1.11

o w

c h e d u l e 4 P a r t 1

a r t If the Safety Instrumented System (SIS) was

t i v e ,

R

If the syste m has been designed prior to this

r e n t

• r l y t h e intention

r d s

• e t y a n d r e l i a b i l i t y

s y s t e m

♦ d a r d s the system was

♦ y w h i c h t h e r e q u i r e d r i s k

♦ r es that the relevant The safety report

s h o u l d d e s c r i b e h safety

- related control

s y stems ha ve been designed to ensure safety and reliability

[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] • designed aft e r BSEN615 08 standard was released (20 00) it, or so me suitable a l t e r n a should have been used t o design the system.

O

• date then evidence shou l d b e p r o v i d e d

, w h i c h demonstrates that suitab l e l e v e l s o f s a f e t y a n d reliability ha ve been incorporated in the design of the syste m . The duty holder should also state the principles o f d e sign that w e r e i n h e within the le gacy standard and were later incorporated in BSEN61 508.

The SR should also stat e c l e a of the Comp any with regard to carrying out reviews of legacy systems to current s t a n d a such as BS EN61508/61511.

D e m o n s t r a t i o n o f s u i t a b l e s a f may be achieved through use of examples of SIS linked t o major accident scenarios. The information provided should includ e :

♦ A descriptio n of the safe t y r e l a t e d and its funct i ons. Details of th e s t a n designed to. T h e p r o c e s s b reduction an d safety integrity for the function was identified. How the Co mpany ensu safety integrity is achieved through design of the syste m , and is co ntinued thro ughout its life c ycle by suitable proof testing and maintenance.

Criterion 12 .2.1.12

u i r e

l e 4 P a r t 1 The safety report shows that over reliance on

• a r e h i ghly

u l d

g h The safety report should show h o w
s y s t e m s w h i c h r e q h u m a n i n t e r a c t i o n h a v e been designed to take i n t o a c c o u n t t h e n e e d s of the user and be reliable

c h e d u [ S • operators to prevent, control or mitigate hazardous e v ents is avoided.

Process con t r o l s y s t e m s w h i c h reliant on op erator intervention to ke e p t h e process with in safe oper a t i n g e n v e l o p e s s h o have suitable independe nt safety layers of protection to prevent, mit i gate hazard ous events. In arrangements such as the s e t h e
assessor sh ould examin e t h e p o t e n t i a l f o r h i

107Control & Instrumentation Criteria Guidance

p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] a r t

• p e r a t o r i s p a rt of a safety related

w h i c h

• a t i o n t o

d o w n

• demand rates on the sa fety related layers of protection.

W h e r e t h e o control loop, and so has a performance function, the duty holder should have realistically assesse d th e r e l i a b i l i t y w i t h the operator performs the function.
The Compa n y s h o u l d p r o v i d e i n f o r m describe ho w they have assessed e ffects of alarms expe rienced by operators in n o rmal operation. T h is should also consider the potential for alarm flood situation s in s h u t situation s . ( N ote: EEMUA guidance is a widely recognised baseline sta ndard.)

Criterion 12 .2.1.13

e g

n c e s

s

c h e d u l e 4 P a r t 1

a r t ples of hazardous area assessments t h e

o

[Note: overlap with Process Safety]

i g n i t i o n sources should also h a ve been

)

, n t

• The safety report

s h o u l d d e s c r i b e t h

s y stems fo r identify i n locations where f l a m m a b l e s u b s t a could be present and how the eq u i p m e n t h a been designed to take account of the risk.

[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)] • Exa m
r e l a t e d t o M A S a r e a s s h o u l d b e i n c l u d e d i n report. This should have been carrie d out to current industry standards (DSEAR, BSEN 60079-10). Assessment for dusts sh o u l d a l s be provided.

•

• O t h e r considered. Look for mention of – lig htning protection, r adio frequen cy ignition, static electrica l discharges (int e r n a l a n d e x t e r n a l vehicles and fork lift tru c ks, portable e q u i p m e (particularly v i sitor’s).

Criterion 12 .2.2.1

h e

d a r d s

u c e

c h e d u l e 4 P a r t 1 i n s t r u m e n t a t i o n a n d e l e c t r ical systems,

Demonstrat es appropria te construct i on controls

• es competency of const r uction

• nstruction

• a g e , a s s e ss and The safety report should show t h a t t i n s t a l l a t i o n s h a v e b e e n constructed to

a p p r o p r i a t e s t a n to prevent major

a c c i d e n t s a n d r e d loss of containment

[ S para3(a)] F o r c o n t r o l

, the safety report:

• to ensure plant is built in accordance with design and t o appropriat e construct i on standards.

Demonstrat personnel.

Considers t he impact of planned co activity on existing facilit i es and their safe operation where relevant.

D e s c r i b e s s y s t e m s t o m a n record chan ges arising during const r uction.

Criterion 12 .2.2.2 o r c o n t r o l

, i n s t r u m e n t a t i o n a n d e l e c t r ical systems, F

108Control & Instrumentation Criteria Guidance

The safety report

s h o u l d d e s c r i b e h t h e c o n s t r u c t i o n o f a l l plant and sy stems is

a s s e s s e d , a n d v e r i f i e d

a g a i n s t t h e a p p r o p r i a t e standards to ensure adequate safety

. o w

c h e d u l e 4 P a r t 1 o

o r P r e

- C o n s truction an d Pre Opera t ions reports:

Description of the verification processes

s

• m m i s s i o n i n g

• n g ements for [ S para3(a)] the safety report should demonstrate that initia l commissioning information regardin g inspect i on and testing of th e plant is do cumented, and that the i n f o r m a t i o n i s r e t r i e v a b l e

. S u b s e q u e n t c h a n g e s t settings et c. should be r e corded and part of suita b le modification s procedure s . (See section 12.2.5.1)

.

F

• applied during construct i on phase a c t i v i t i e associat ed with relevant systems.
Description o f a r r a n g e m e n t s f o r c o trials to conf irm required performance, limits of operation an d safety provisions.
Description o f d o c u m e n t a t i o n a r r a recording of verification activities an d results associat ed with constru c tion.

Criterion 12 .2.3.1

d i t i o n s

.

c h e d u l e 4 P a r t 1 l l s a f e t y r e p o r t s s h o u l d describe ho w it is assured The safety report should show that safe operating procedures h a v e b e e n e s t a b l i s h e d

a n d a r e d o c u m e n t e d f o r all reasonabl y f o r e s e e a b l e c o n

[ S para3(b)] A that electrical, control a nd instrumentation syst ems and equipment are always operated within safe limits.

C r i t e r i o n 1 2 .2.4.1

s c h e m e i s

n t

c h e d u l e 4 P a r t 1 For control, instrumentation and elect r ical systems:

The Safety Report should provide relevant

:

♦

♦ e d o u t i n a

♦ r i o r i t i s a t i o n o f w o rk. i e d

♦ r i c a l & e a r t h i n g systems are The safety report should show that an appropriate

m a i n t e n a n c e established for plant and s y stem s t o p r e v e major accidents or reduce the loss of

c o n t a i n m e n t i n t h e event of such accidents.

[ S para3(b)] • information and exampl e s t h a t d e m o n s t r a t e

♦ There are suitable proa c t i v e m a i n t e n a n c e / testing / in spection regimes in place based on relevant industry standards. There is a suitable maintenance administration system. Planning of w o r k i s c a r r i structured fa shion. T h e r e a s y s t e m o f p

♦ Safety critical activities a r e c l e a r l y i d e n t i f

♦ There is pro o f testing of safety instru m e n t e d sy stem s. F i x e d e l e c t subject to suitable perio dic inspection / m a i n t e n a n c e a n d t e s t i n g.

109Control & Instrumentation Criteria Guidance

♦
n

♦ m o n i t o r i n g i s i n p l a c e

The duty holder should d e monstrate that

a r e

a i n i n g a r e used.

i s e d

e s t E q u i p m ent and Tools:

Suitable pro c edures sho u ld be in pla c e to

m ents and too l s are suit ab le for

♦ Process inst rumentation should also b e subject to s u i t a b l e m a i n t e n a n c e / c a l i b r a t i o and testing. Performanc e

• persons carr ying out maintenance/te s t i n g competent to do so and that:

♦ Recognised schemes for t r

♦ There is ong oing refresh e r training.

♦ In accordan ce with basic engineerin g standards, t he duty holder uses reco g n schemes for training in a r eas of specialised maintenance, inspect i o n and testin g.

T

• ensure that:

♦ t e s t i n s t r u purpose. C a l i b r a t i o n of test equip m ent is carried out on a regular basis by co mpetent persons.

♦ Accredited t e st houses are used to c a l i b r a t e key test equipment.

Criterion 12 .2.4.2

h ere

t t a k e

a r t 1 Demonstration should b e made that suitable

i n a s a f e

• t y

u s

• e t o f E l e c t r i c a l S a f e t y The safety report should show t h a t t are appropriate procedures for

m a i n t e n a n c e t h a account of an y h a z a r d o u s c o n d i t i o n s

w i th in the w o rking environment.

c h e d u l e 4 P [ S para3(b)] • procedures are in place to ensure th at maintenance /testing of electrica l an d instrumentation systems is carried ou t fashion. It is essentia l th at the Comp any have considered t he risks for both person a l safety and for the potential ha zardous effe c t t h e w o r k may ha ve in terms of init iators on the plant.
For potentially hazardous work suita b l e s a f e managemen t procedures should be in place. This should be based on suitable risk assessment s , o r i n t h e c a s e o f m o r e h a z a r d o situation s b e carried out under a suit able Permit To Work system. Compan y s h o u l d h a v e a s rules based on current in dustry standards. (e.g. current editions of HSG85, Memora ndum of Guidance, Electricity at Work Regulations should be u s ed as benchmark).

Criterion 12 .2.4.3

c e t o S e e a

m ples of The safety report should show that

s y s t e m s a r e i n p l a ensure that safety l s o 1 2

. 2.4.1 and 12 .2.4.2

The safety report should provide exa • how proof testing for Saf e ty Instrume nted Systems (SI S ) is carried out and ho w test

110Control & Instrumentation Criteria Guidance

critical plant and

s y s t e m s a r e e x a m i n
a t a p p r o p r i a t e i n t e b y a compe t e n t p e r s o n

. [Schedule 4 Part 1 e d

r v a l s

a r a 3 ( b ) ] i n g

p intervals are determined and reviewe d ( t a k account of p e rformance).

C r i t e r i o n 1 2 .2.4.4

h e s a f e t y report h ere
e t o

p e r i o d i c

r t 1

a r a 3 ( b ) ] Addressed in 12.2.4.1 T should show t h a t t is a s y stem i n p l a c ensure the continued safety of th e i n s t a l l a t i o n s b a s e d o n t h e r e s u l t s o f examinations and maintenance.

[ S c h e d u l e 4 P a p

C r i t e r i o n 1 2 .2.5.1

h e s a f e t y report

e
r
n s

t e d

.

a r a 3 ( a ) ; S c h e d u l e 4 The site sho u ld have a procedure for the modification of safety instrumented systems.

h a t s t r u c t u r e d hazard ident ification/ analyses process and t t o

g e s f r o m i n c e p t i o n

♦ a n c e
s a f e t y critical

♦ p e r i o d

. i l a b i l i t y , o f

T h e r e q u

e C I a s p e c t s o f m o d i f i c a t i o n i s b a s e d o n t h e T

s h o u l d d e s c r i b e t h

s y stem in p l a c e f o
e n s u r i n g m o d i f i c a t i o are adequatel y conceived, designed, i n s t a l l e d a n d t e s

[Schedule 4 Part 1 p Part 2 para 4, 5(a); S c h e d u l e 2 p a r a 4 ( d ) ] • T h e r e s h o u l d b e e v i d e n c e t

associat ed r i sk assessm e n t a r e c a r r i e d o u
assess the impact of the changes fro m a C I modification , or to CI systems from a process modification . Important areas which should have been considered ar e:

♦ The require ment for the modificatio n process to look at all st a through to final operatio n f r o m t h e C I perspective, not just the later test an d verification stages. S u i t a b l e m e t h o d s f o r r e v i e w o f p e r f o r m standards af f e c t i n g instrumented systems and interrelat ed systems, both during the p e r i o d o f modification and thereaf ter. Use of overrides through out the modification implementa t i o n

♦ Temporary l o ss, or chan g e o f a v a other safety control funct i ons during modification

.

i r e m e n t s f o r a s u c c e s s f u l d e monstration of t h provisions o f clause 17 of BS IEC 6 1511. If a Compan y c l a i m t h a t t h e y a r e c o n f o r m i n g t o t h e

111Control & Instrumentation Criteria Guidance

standard, an d can includ e d o c u m e n t a r y e v i d e n support this, then the de m o n s t r a t i o n w i l l h a v e b e made. c e t o
e n

112

### Appe ndix 12.4: Huma n fa ctor s criteria and guidance

Human Factors Criteria Guidance

Criterion 12 .1 The safety report should show a clear link bet w e e n the measures taken and the major accident hazards described

[Schedule 4 Part 1 para 2; Schedule 4 Part 2 para 4(a), 4(c), 5] • It is clear where human action or ina c tion is critica l to th e measures taken and h o w the reliability of t he human action or ina c tion is assured.

Criterion 12 .2 The safety report should demonstrate how the me asures taken w ill p r event foreseeable failures

w h i ch coul d lead to major accidents • It is clear th at the desig n of the safe ty critical tasks i s matched to the human resource.

Criterion 12 .2.1.1 The safety report should show that th e establishment and installations have been designed to an appropriate standard.

[Schedule 4 Part 1 para 3; Schedule 4 Part 2 para 4(c), 5(a)]

Criterion 12 .2.1.2 The safety report should show that a hierarchical approach to the selection of measures has been used.

[Schedule 4 Part 1 para (3); Regulation 4] • There is a clear policy a nd/or proce dure to ensure application of inh e rent safety principle s in new desig n and modifications.

• Any critical high-hazard system that depends on manual intervention (for example manual emergency shutdown of a high-haza r d continuous process):

♦ is robustly ju stified, or

♦ there is a time bound action plan to address this

•
Criterion 12 .2.1.3 La y out of the plant should limit the risk during operations,

113Human Factors Criteria Guidance

inspection, testing, maintenance, modification, repair and replacement.

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)]

Criterion 12 .2.1.4 Utilities that are needed to implement an y measure defined in the safety repo rt should have suitable reliability , availability and survivability

. [Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c), 5(a)]

Criterion 12 .2.1.5 The safety report should show that appropriate measures have been taken to prevent and effectively contain releases of dangerous substances.

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c), 5(a)]

Criterion 12 .2.1.6 The safety report should show that all foreseeable direct causes of major accidents have been taken into account in the design of the installation.

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)] • The safety report identifies any case s where operator error could be a direct cau s e of LOC without stru ctural failure of the primary containment boundary, e.g.

♦ Identificat io n of sources of human error in process ope rations, e.g. maloperation of plant, lack o f hazard awareness, po or communication, unrealistic demands, lack of specif ic tr aining or kn owledge, etc..

♦ Identificat io n of measures aimed at minimising human error, e.g. dedicat ed operating systems, etc..

♦ Safety criticality attache d to human actions and how this is ca tered for in design

. Realistic per formance standards for safety critica l functions during n o rmal and

114Human Factors Criteria Guidance

emergency conditions, etc..

♦ Defence in depth to minimise the eff e ct of human failure.

♦ Control of design funct i ons to minimise

error.

♦ Control of maintenance and inspect i on activities to r educe human contributio n to LOC during system inva sive activitie s

. ♦ Activity training, equipment specif ic t r aining, etc..

Criterion 12 .2.1.7 The safety report should show h o w structures important to safety have been designed to provide adequate integrity

. [Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)]

Criterion 12 .2.1.8 The safety report should show h o w the containment structure has been designed to

w i thstan d t he loads experienced during normal operation of the plant and all foreseeable operational extremes during its expected life.

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)]

Criterion 12 .2.1.9 The safety report should show that materials of construction used in the plant are suitable for the application.

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)]

115Human Factors Criteria Guidance

Criterion 12 .2.1.10 The safety report should show that adequate safeguards have been provided to protect the plant against excursion be y ond des ign conditions

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)]

Criterion 12 .2.1.11 The safety report should describe how safety

- related control

s y stems ha ve been designed to ensure safety and reliability

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)]

Criterion 12 .2.1.12 The safety report should show h o w
s y stems which require human interaction have been designed to take into account the needs of the user and be reliable

[Schedule 4 Part 1 para3; Schedule 4 Part 2 para 4(c)] • Where relia bility of human action i s critica l

, there is/are:

♦ References to design st andards.

♦ Usability assessments.

♦ Indication s of operator involve m ent in setting reli a b ility criteria.

♦ Compatibiliti e s with othe r systems.

♦ Consideration of improvement teams.

♦ Appropriate standards fo r ergonomic design that include control and alarm displa y interfaces.

♦ Workspace design con s iderations (such as heat, light, n o ise, interfa c e, physical access).

♦ Alarm handling design a nd procedur es (form, numb e rs, prioritie s , action s re quired, managemen t of overrides).

♦ Evidence of correct allo cation of function, especially of new plant and for emergency shutdown arrangements . Avoidance of undue relia n c ♦ e o n s p e c i a l o r rarely used automation or procedur es or unusual or r a re judgement.

• The design process for manually op erated

116Human Factors Criteria Guidance

equipment and controls ensures that t h e n e of users are fully taken in to account, including usability and maintainability assessm ents and operator participation fro m an early stage.
The design process in cludes identif i c a t i o n o e d s

• f

• e s p o n s e t o a l a r m s f o r m s p a r t

o t e : Some sub-optimal alarm systems can give

The safety report shows that the usa b ility and

s

d k e n t o minimise potential

There is a p r ocess for d e veloping procedures

g

• u lar review of documented safetytraining nee ds.

Where relia b l e r of the demonstration, th e safety report shows that the duty holder has t a ken effective action to ensure usability and compatibility with suitable sta ndards.

[ N the operator too much unhelpful info rmation and alarm flood during plant upsets.]

• error potential of existing s a f e t y

- c r i t i c a l m a n u a l tasks or inte rv entions (for ex am ple critical connection s or disconne ctions, c r i t i c a l a l a r m and controls) are:

♦ U n d e r s t o o d

, a n

♦ Action has b e e n t a hazards that may arise.

• that ensures that they are technica lly correct, useable, cle a r and unambiguous, and includin user input.

T h e r e i s r e g critica l and safety-related procedures.

Criterion 12 .2.1.13

e g

n c e s

s

c h e d u l e 4 P a r t 1

a r t The safety report

s h o u l d d e s c r i b e t h

s y stems fo r identify i n locations where f l a m m a b l e s u b s t a could be present and how the eq u i p m e n t h a been designed to take account of the risk.

[ S p a r a 3 ; S c h e d u l e 4 P 2 para 4(c)]

117Human Factors Criteria Guidance

C r i t e r i o n 1 2 .2.2.1

h e

d a r d s

u c e

c h e d u l e 4 P a r t 1 The safety report should show t h a t t i n s t a l l a t i o n s h a v e b e e n constructed to

a p p r o p r i a t e s t a n to prevent major

a c c i d e n t s a n d r e d loss of containment

[ S para3(a)]

C r i t e r i o n 1 2 .2.2.2

o w

c h e d u l e 4 P a r t 1 The safety report

s h o u l d d e s c r i b e h t h e c o n s t r u c t i o n o f a l l plant and sy stems is

a s s e s s e d , a n d v e r i f i e d

a g a i n s t t h e a p p r o p r i a t e standards to ensure adequate safety

.
[ S para3(a)]

C r i t e r i o n 1 2 .2.3.1

d i t i o n s

.

c h e d u l e 4 P a r t 1 Managing procedures

h e s a f e t y r e p o r t p r e s e n ts a structu r ed approach to

The safety report describes the follo wing

♦ A process to determine which tasks need

♦ p r o c e s s f o r procedure s

.

t )

. ♦

♦

There is a system in place to ensure

b y The safety report should show that safe operating procedures h a v e b e e n e s t a b l i s h e d

a n d a r e d o c u m e n t e d f o r all reasonabl y f o r e s e e a b l e c o n

[ S para3(b)] T developing, producing a nd maintaining procedur es.

• aspects:

procedures. A n a p p r o v a l s

♦ The development of procedures (their usability, in addition to t e chnical con t e n A process fo r ensuring th at procedur e s a r e valid and remain up-to-date.

♦ End users in volve m e n t i n t h e d e v e l o p m e n t of procedur es.

♦ A process to e n s u r e t h a t procedures are appropriate to the natur e of the task, its critica lity and the users’ experience. A formal process to en sure that staff are trained in ne w/updated procedures.

that all • foreseeable circumstances are covered by procedures (e.g. high le v e l s t a t e m e n t s , s t e p

118Human Factors Criteria Guidance

step instru ct ions for safe ty critical job s , emergency response events, etc).
The safety report describes how co m p l i a with critica l procedures is assured. • n c e

o llowed.

[ N o t e

l w a y s f o l l o w p r o c e d u r e s o r w o r k i n structions. for a

.

o m p e t e n c e m a y b e provided

s u m m a r y , and references made to other

e t y r e p o r t s h o w s a f o c u s o n major accident ha zards / process safety r a ther than

t i f i e d

, i n cluding the

n ces.

♦ e d

cl uding for

♦

♦ n c y t j u s t f r o n t l i n e

t i o n to

• T h e d

r e s

[ N o t e n

u n d e r • The safety report describes how the duty holder checks that procedures are f

: It is often a s sumed that employees will

a However, procedures ar e n o t a l w a y s a d h e r e d t o variety of re asons (i.e. p r o c e d u r a l v i o l a t i o n s ) e

. g because the y ma y be inaccurate, do not describ e best practice, are out of date, too co m p l e x o r t i m e consuming t o access.]

Competence of staff.

[Note: I n f o r m a t i o n o n c i n documents.]

• T h e s a f

personal saf e ty:

♦ T h e c o m p e t e n c y r e q u i r e m e n t s f o r p r o c e s s
s a f e t y a r e i d e n underpinnin g knowledg e of equipment, processes, hazards and c o n s e q u e T h e c o m p e t e n c y r e q u i r e m e n t s a r e i n f o r m by the hazard and risk a nalyses.

♦ Safety critical roles, responsibilities and tasks at a ll l e v e ls are id e n t i f i e d

, i n managemen t and contra ctors. The safety report addresses: O p e r a t i o n a l p e r s o n n e l c o m p e t e

♦ managemen t c o m p e t e n c y ( n o personnel).

♦ Emergency response co mpetency.

♦ C o n t r a c t o r c o m p e t e n c y

. ♦ ‘Soft’ competencies such as team t i o n s , e v e n managemen t

, c o m m u n i c a recognition, delegation e t c

. i n a d d i t task spe c ifi c / technica l c o m p e t e n c i e s

.

s a f e t y r e p o r t i d e n t i f i e s responsi b ilitie s a n
o u r c e s f o r the process of competence

assessm ent

.

: Training / co mpetency a s s e s s m e n t i s o f t e

- r e s o u r c e d ]

119Human Factors Criteria Guidance

Selection and training

• The safety report shows:

n o f k e y personnel ensures t o t h e r e q u i r e d levels

♦ u r a n c e systems do not rest

. e e n a d j u s t e d t o

♦

♦ s s e s s o r s a r e ‘trained train e rs’

e

♦

i e d

.

A u d i t

T h e
n d t h e c o mpetency a ssurance
a r e r e v i e w e d

. B T

o r g a n

r e s t r u t r a ctors, multim

:

g e m e n t s f o r s a f e t y c r i t i c a l communications address the potential for ( s u c h a s ♦ H o w t h e s e l e c t i o their ability t o p e r f o r m of competence.

♦ Staff are recruited and selected against defined crite r ia for the jo b. C o m p e t e n c y a s s solely on ge neric nation a l s t a n d a r d s ( e

. g NVQs) unle ss these ha v e b match the duty holder’s specific ope rations and risks. On the job training is well-structured with specific train i ng/learning objectives. T r a i n e r s / a and have relevant experi ence to und e r t a k these duties.

♦ There is a clear link bet w e e n c o m p e t e n c y and safety critical pro c e dures. S t a f f a r e a s s e s s e d ( a n d re-assesse d at suitable in te rvals) against the criter ia.

♦ T h e s k i l l s , k n o w l e d g e , b e h a v i o u r s a n d working practices a gain s t which performance is judged h a v e b e e n i d e n t i f

a n d r e v i e w

s a f e t y r e p o r t d e s c r i b e s h o w i n d i v i d u a l •
c o m p e t e n c y a process it s e l f

N h i s i s particularly important during any i s a t i o n al change pr ocess, such as busine ss
c t u r i n g , increased u s e o f c o n skilling, or d e manning.

The safety report describes a suitab l e r e c o r d s y s t e that can de monstrate competency, which includ e s
e c o r d s f o r e a c h p e r s o n r evidence of appropriate validation evidence of training & assessment

Communications

The safety report shows: •

♦ T h a t a r r a n

c o m m u n i c a t i o n f a i l u r e s misunderstandings or in complete / inaccurate / unnecessar y ).

120Human Factors Criteria Guidance

♦ d r essed

emergencies.

r l y

 d i o s

.

 i o n o f c h a n ges to

• F a i l s d i n the event of an emergency or abnormal

s i t u

o r m a t i o n r e q u i r e d

.

m m u nication mo de (e.g. voice,

l p habet).

A v a i l a b n t staff

The safety report

operator ensures that th ere is adequ ate availability of competent personnel

a c t o r s ) f o r safe oper ation

[NB t h i s h o l d e r h a t h e r i g h t y r e p o r t

h o u l d r e t S a f e t y c r i t i c a l c o m m u n i c a t i o n s a d include:

 Communications d u r i n g

 Any form of remote communication between control room and outside

o p e r a t o r s e

. g. during sh utdowns.

 Permit-to-work procedu r e s , p a r t i c u l a if the work continues over a shift change.

 Communication of hazar ds and risks to contractors.

U s e o f r a

 Plant labelling and ident ification.

C o m m u n i c a t procedures.

u r e i n communications are con s i d e r e

a t i o n

.

• Communication needs a r e considere d , for example:

♦ T h e i n f

♦ From and by what mea n s i n f o r m a t i o n i s obtained.

♦ T h e c o text/email, pager).

♦ The format of communi cation (use of p h o n e t i c a

i l i t y o f a d e q u a t e n u m b e r s o f c o m p e t e

• :

♦ Describes th e process b y which the

(including c o n t r and for the provision of an effective emergency response ser v ice.

r e l a t e s t o determining whether the duty

s t h e r i g h t n u m b e r s o f t h e r i g h t p e r s o n n el in p l a c e and at th e r i g h t t i m e

. T h e s a f e t f e r to the arrangements for ensuring tha s this is the ca se, rather th an detailing the actual numbers of personnel.]

• Focuses on s a f e m a n a g e m e n t o f c r i t i c a l e v e n t s / tasks / ro le s / responsi b ilitie s and e m ergency

121Human Factors Criteria Guidance

response.

Demonstrat e s t h e • a r r a n gements are informed

•
e n u m b e r s o f a d e q u a t e p e rsonnel. by the risk a ssessm ent.

Describes th e a r r a n g e m e n t s f o r m o n i t o r i n g a n d

r e v i e w o f t h

Criterion 12 .2.4.1 The safety report should show that an appropriate maintenance scheme is

n t

e v e n t

s s o f • l ace to dete c t, monitor

•

♦

♦ W interesting,

 e p r ogramme is

n g s h i f t s a n d b e t ween shifts.

s and



• T h e s a f

♦ How the ease of maintaining systems and

♦ How early signs of problems are mo (e.g. a large jobs; excessive

a c k f r o m s t a f f

. e s t a b l i s h e d f o r p l a and s y stem s t o p r major accidents or

r e d u c e t h e l o containment in the event of such accidents.

[Schedule 4 Part 1 para3(b)] There are measures in p or avoid mai n tenance er ror. The safety report describes /demonstrates:

♦ What maintenance work can lead t o a m a j o r hazard accident.

♦ Robust defences to make sure these accident s ar e very unlikely, includin g :

 Physical barriers and gu ards.

 ‘ A d m i n i s t r a t i v e ’ controls (permits, procedures, checklists).

 Managemen t controls ( s upervision and checking of tasks).

C o m p e t e n t m a i n t e n a n c e teams.

e l l d e s i g n e d m a i n t e n a n c e t a s k s ( e g, no time pressure, comfortable

c o n d i t i o n s )

. How the mai n t e n a n c based on major acciden t risk

assessm ent

.

 How commu n ications ar e controlled

w e l l d u r i

 Special arra n g e m e n t s f o r t h e c a r e o f temporary o r i n e x p e r i e n c e d maintenance technician contractors. Inspection s of maintenance tasks in progress.

e t y r e p o r t d e s c r i b e s :

c o n t i n u a l i m provement i s achieved. nitored backlog of

r e p a i r t i m e s ; a d v e r s e f e e d b

♦ How the investigation of near misses and accident s is used to lear n f r o m h u m a n failure in maintenance a nd to improve the sy stem s.

122Human Factors Criteria Guidance

Criterion 12 .2.4.2 The safety report should show that th ere are appropriate procedures for t a k e

g

t 1 m a i n t e n a n c e t h a t account of an y hazardous conditions

w i th in the w o r k i n environment.

[ S c h e d u l e 4 P a r para3(b)]

Criterion 12

. 2

. 4

. 3

h e s a f e t y report

r e i n p l a c e t o
n s u r e t h a t s a f e t y

i n e d

r v a l s T should show that

s y s t e m s a
e critical plant and

s y s t e m s a r e e x a m
a t a p p r o p r i a t e i n t e b y a compe tent person.

[ S c h e d u l e 4 P a r t 1 para3(b)]

C r i t e r i o n 1 2 .2.4.4

o w that th ere
a s y stem in place to

n s u r e t h e c o n t i n u e d

o n The safety report

s h o u l d s h i s
e safety of th e i n s t a l l a t i o n s b a s e d the results of periodic examinations and maintenance.

[Schedule 4 Part 1 para3(b)]

Criterion 12

. 2

. 5

. 1

h e s a f e t y report

p l ace for

n s u r i n g m o d i f i c a t i o n s

e d , • There is a st ructured pro c ess for involving operators in the raising, design and implementat ion of modifications

• Organisatio nal change and transitio n

• l c h a n g e w i t h :

♦ With clear le adership /accountability (senior T

s h o u l d d e s c r i b e t h e
s y s t e m i n
e are adequatel y
c o n c e i v e d , d e s i g n installed and tested.

[Schedule 4 Part 1 managemen t. The safety report describes a robust procedure f o r m a n a g e m e n t o f o r g a n i s a t i o n a

♦ With clear o b jectives.

123Human Factors Criteria Guidance

p a r a 3 ( a ) ; S c h e d Part 2 para 4, 5(a); S c h e d u l e 2 p a r a 4 ( d ) ] u l e 4 n t).

• p r o

a t t e r h o w

n t of the facilit y being assessed.

• T h e y i m p i n c :

♦

♦ Work priorities.

• f e t y r e p o r t p r o v i d e s

s e t s, escalating incident s

Where required, the safe ty report describes a

h a z a r d s / p r o c e s s saf e ty.

i o n s , and

r e

♦ m a n a g e m e

♦ Which is str u ctured, to a prescribed, consiste nt p r ocess, thor ough and well documented / communicated.

The safety report describes an asse ssment

c e s s t h a t :

♦ Identifies an d maps all changes to b o t h tasks and p e rsonnel tha t c o u l d h a v e a n i m p a c t o n M H p r e v e n t i o n , n o m small the ch ange.

♦ Is facilitated by well-trained persons i n d e p e n d e

s a f e t y r e p o r t d e s c r i b e s h o w c h a n g e s m a
a c t o n h u m a n r e l i a b i l i t y a s a s s e ssed, l u d i n g a s n e c e s s a r y

♦ Workload (including no n

- p r o d u c t i v e w o r k )

. Competence.

♦ Team work and commu nication.

W h e r e a p p l i c a b l e , t h e s a realistic assessments of the organisation’s

o f c r i s i s scenarios posthandling of a r a n g e
c h a n g e , i n c l u d i n g u p and emergencies.

• competence assurance process to e n sure adequate transition arra ngements.

♦ Which inclu des identif ication of train i ng needs for ch anged or additional role s in

r e l a t i o n t o m a j o r

♦ Adequate planning for competent cover during the tr aining perio d.

♦ A m e c h a n i s m f o r r e v i e w i n g d e c i s to ensure th at all nece s sary measure s a in place bef ore ‘go-live’. A process to monitor performance after change.

124

## 13 - GUIDANCE FOR ENVIRONMENT A L ASSESSMENT

Introduction 125 General guidance for assessment of environmen tal criteria 125 Appendix 13.1 - Environmental Assessment Criteria and Guidance 127 Appendix 13.2 - Other criteria to be ta ken into account for environmental

assessm ent 134



### Introducti on

1 The environmental asse ssor has a multi-functio nal role in th e assessment process. Th ey complete an initial re ad of the saf e ty report with the assessment manager to jointly determine whether the minimum informati on has been provided and assist t he assessment manager in determining the make up of the a ssessment team. 2 Where predictive assessment is required, HSE and Agency assessor s sh ould work together to agree:

a. whether or not the major accident sce narios are d e scribed ad equately; b. that the key information relating to ha zard identif ication and risk analysis is present;

c. identify the areas where the hazards are either p r edominantly or solely human safety or environ mental; d. identify the areas where the hazards overlap;

e. agree roles and responsibiliti e s wher e this overla p exists.

3 Where the major accid ent hazards on a site are predominantly or solely environmental the agency will lead the assess ment process. HSE will provide the Environmen t Assessor s with addition al specia list support where required.


### General guidance f o r assessment of environm ental criter ia

4 The underlying factors of a Major Accident lie in a s pects common to “human safety” and the “environment”, be these mec hanical, ele c trical and contr o l, process safety or human factors. In the cont ext of major accident s a nd their prevention ‘environmen t’ is not treat ed as a sep a ra te discipline to ‘health and safety’.

5 While the re ceptor has n o bearing on the causes or the prevention of an accident, so me events carry a significan t, predo minant or solely environmental hazard and risk. The se must be addressed in th e environme n tal asse ssment process. Unl e ss there i s good reason , only new and / or revised information will be

assesse d a gainst the n e w environ mental criteria. Further guidance on reassessment is provided in “Selection of Topics fo r Inspection” in the Overview Section.

6 The key crit eria to be met for environmental risk assessmen t are stated in the tables below . Three components nee d to be present before a risk can be manifest, namely:

a) Source (of hazard). b) Pathway (be t ween source and recept or). c) Receptor (of the hazard)

.

1257 The criteria and guidance in the follo wing tables overlap in some areas with the requirements for asse ssment relating to other disciplines det ailed in Sect ions 9 to 12 of the manual. This doe s not mean that duplicat ed assessment is propo sed, but recognises t hat much of the information that is ne eded for assessment of health and safety m a y also be nec essary for assessm ent of the environment. Attention of

assessor s is drawn to the guidance contained in Section 8 of this manual - ‘How to use the Crit eria’ under t he heading of ‘Use of th e Criteria’ concerning a v oidance of duplicated a ssessment.

8 The assessor should also ensure th at other crite r ia with rele vance to the environment are include d in the environment al assessment. Appendix 13.2 provides a checklist o f the key issues to provide more focus. Where t here have been minimal changes tha t impact on the environmental cons id erations it should not be necessary to complete re assessm ent.

9 Some of the information required to assess the impact on the environme n t may already have been prepared for environment al impact asse ssment or other authorisatio n procedure s . It is permissible for th e operator to refer to this information. However, as sessment is made easier and more efficient if it is submitted as part of the COMAH safety report, rather tha n by reference to authorisations sent separately to the Agencies.

126

### Appendix 13.1 - Environmental As sessmen t Criteria and Gu id an ce
Environmental Criteria Guidance
Criterion 13 .1 The safety report should identify all vulnerable environmental receptors and describe the sensitivity of these environmental receptors. [Schedule 2 para 4(b); Schedule 4 Part 2 para 2] These should include:

• The presence of Red Book species

• Designated Areas (SAC, SPA, SSSI, AONB, Ramsar sites, Local Aut hority nature classificat i o n schemes, etc.)

• Surface waters and their classificat i o n

• Groundwate r and aquife rs and their class i ficat i o n

• Drinking an d industrial water abstraction points (grou nd and surfa c e)

• Amenity are a s

• Sites of arch itectural and historica l importance

• Soil and sed i ment

• Agricultural resources (including market gardens and allotments)

• Grade 1 list ed building s

• Pathways a nd receptors for any releases include tho s e to air (dep osition effe cts), water and land.

• The area over which the receptors should be identified de pends on th e potential f o r major accident s. I t would be expected that a range of 10 km would be reaso nable.

• Factors that could affect the behaviour of accidental r e leases in t he environment should be d e scribed. T hese may include hydrology, meteorology, hydrogeology, geography and climate.

• Surve y s ma y be needed to determine the nature of local ecosyste ms.

• Activities be yond the site boundary that may interact with the site sho u ld be identified.

♦ These may include neig hbouring industrial f a ciliti e s, wate r treatment plants connected b y rivers or sewer systems, and upstrea m processes.

♦ Exa m ples of interaction s which should be considered include spills from the site causing da mage to connected facilit ies, combinations of release d substance s which may react to prod uce an

127Environmental Criteria Guidance
environment al hazard, a nd upstream processes tr ansferring of f-spec material leading to u p sets on the installat i on.

Criterion 13 .2 The safety report should include a description of the aspects of the installation that could be a factor in the potential for releases to the environment [Schedule 2 para 4(b); Schedule 4 Part 2 para 3] These should include:

• Location, in ventory and conditions o f substance s dangerous t o environme n t (including th ose non COMAH substances which may b e released in the event of a major accid ent)

• Secondary containment design, position, capacity, co ndition

• Surface gradients.

• Managemen t factors su ch as operato r response, control proce dures

• Distances b e tween sources and pat hways

• Site layout and drainage, capacity an d condition of drains, etc.

• Layout and segregation of entire drainage sy stem , barriers, v a lv es etc. sum p s.

• Location an d capacity o f sumps, penstocks, fire-water lagoons and a n y other barriers to off-site transport of liquid s

.

• Geographical/geological/hydro-geological features that may i m pede/facilita t e p o llutant escape

• Effect of varying weather condition s (e.g. storm

- water)

• Treatment plants (on or off-site)

• Detection, shutdown

• Location of pumps, valves, pipewor k, penstocks a nd firewater lagoons.

• Suitability, capacity of treatment plant.

• The location of discharg e points to watercourses/foul sewer / effluent trea tment plants;

• Maps and plans of the e s tablishmen t features indicating wher e runoff of spilled substance s and firewater could take place.

Criterion 13 .3 The safety report should include a description of the This should include:

• Toxicity data (e.g. dose -response

128Environmental Criteria Guidance dangerous substances w h ich have potential environmental impact [Schedule 2 para 4(b); Schedule 4 Part 2 para 3] relationship s ).

• Environmen tal harm criteria (e.g. LC50 data, critica l loads).

• Negligible ef fect criteria ( e .g. No Observed Effect Levels, Suggeste d No Advers e Response L e vels).

• If harm criteria are used then the rele vant receptors must be clear ly identified.

• Other potentially harmful properties, f o r example, BOD/COD, bl anketing/sm othering or effects on potable water supplies may need to be considered. Other information that may be required includes persist ence, bioconcentr a tion factor, bioaccumulation potential, so lubility, and density.

Criterion 13 .4 The safety report should identify all Major Acci dent Scenarios w h i ch have potential environmental impact [Schedule 2 para 4(b); Schedule 4 Part 2 para 4] • The operator should describe the methodolog y used to identify release scenarios.

• Three main factors are n eeded to demonstrate understanding of events:

♦ Behaviour of released substances

♦ Onsite pathway analysi s

♦ Domino or e scalation eff e cts

• Potential releases should be identified, which should include a consideratio n of worst case failure s (inventory and process and the sensitivity of the receivin g environme n t (number and types of sensitive site s)

• Pathw a y s b y which the substance r eaches the environment should be identifie d.

• Substance b ehaviour upon release should be identified, e. g. reactions with air/water/other substance s , changes of phase, disp ersion characterist ics (dense or buoyant behaviour), etc. Substan c e behaviour must be characterise d before the types of pathway can be evaluated.

• Behaviour under normal condition s and foreseeable abnormal conditions sho u ld be considered.

• The potentia l for a release to be asso ciated with firewater should be considered. This could be a d i rect result o f firewater applied to the release or indirectly firewater run-off from another part of the site (i.e. a domino effect).

129Environmental Criteria Guidance

• Screening o n the basis of a dilute (e .g. through applying firewater) and disp erse risk managemen t option is n o t an accept able practice.

• Consideration should b e given to the probability of flooding as a causation or escalation f a ctor.

Criterion 13 .5 The safety report should include an assessment of the extent and severity of the environmental consequences of major accidents [Schedule 2 para 4(b); Schedule 4 Part 2 para 4(b)] • Source details shou ld be defined for each accident sce nario and sh ould includ e the following:

♦ Substance r e leased, size/release rate/duratio n of release

♦ Conditions o f release (pr e ssure, temperature, phase)

♦ Location, elevation, direction of rele ase

♦ Factors that may determi ne the extent of environment al impact (e. g . ignition, detection, secondary containment failure, drains, emergency procedures, etc.)

• The operator should in clude the methods used to calculate release rates and t he specific values of any va riables.

It is not ne cessary that the release r a te and resultant en vironmental concentratio n of every scenario is considered. I t is accepta b le if a representative set of releases is cho s en to cover the range of releases po ssible.

• The models/methods used to determine the environment al concentra tion should be detailed. Th e specific values of any variables sh ould be given.

• The resultan t environme n tal concent rations for each member of the set of releases should be given

• The effects in the environment should be determined from the predicted envir onmental concentratio n s and the t o xicity data. The length, area or volume of the environment affected sho u ld also be given. The approach used should be describe d fully. In general the following may be use d in combin ation or separately, for evaluating impacts:

♦ Toxicity relationships (e. g . dose-resp onse relationship s ).

♦ Environmen tal harm criteria (e.g. LC50

130Environmental Criteria Guidance data, critical loads).

♦ Negligible ef fect criteri a ( e .g. No Observed Ef fect Levels, Suggested No Adverse Re sponse Levels).

♦ Past accide nt experience.

♦ Population d y namics mo delling.

• If harm criteria are used then the rele vant receptors must be clear ly identified.
[It should be noted that t he LC50 threshold represents a n impact of the severest nature. For risk assessment purposes a thresho l d of LC/2 or LC/3 provides a suitab le indicative environment al harm threshold.] Effects may be to individ ual specie s, a range of species (b io diversity), the communit y structure and the overall habitat or eco s ystem. Very little information exists on co mmunit y level response s to damage. In defining the expected level of change, natural variability needs t o be consid ered as this can result in significant changes in re ceptors. If recovery is assesse d th en a distin ction may nee d to be drawn between natural unassisted recovery and artificial recovery, p a rticularly if contingency plans includ e cleanup a nd restoratio n that may affect the rat e of recovery.

• Immediate a nd delayed effects shou ld be considered in the approach to asse ssing impacts.

• The key uncertainties in the approach should be identified

.

• The operator should con c lude if the effects might constitute a MATT E.

Criterion 13 .6 The safety report should include conclusions on the probability of the major hazards or the conditions under w h ic h the y occu r [Schedule 2 para 4(b), Schedule 4 Part 1 para 2] • The operator should giv e an indicat i on of the likelihood of any MATTE identified. This may be by:

♦ Qualitative description s ( e .g. low/medium/high risk).

♦ Simple relative scoring systems (e.g. 1-5, 1-100).

♦ Quantitative modelling parameters (e.g. Environmen tal Harm Index).

♦ The operator should explain the method used to dete r mine the likelihood’s a n d any assumptions or prin ciples und erlying the method

♦ Risk result s may be summed over all events and scenarios to give the total environment al risk and b r eakdown in terms of the significant risk contrib u t o rs.

131Environmental Criteria Guidance

♦ Uncertaintie s associated with any risk conclusions should also be presente d

.

Criterion 13 .7

r t s h o u l d

e

a r a 4 ( b ) ; 2] For each scenario that can result in a h e

• b e en used The safety r e p o i n c l u d e a d e s c r i p t i o n o f t h arrangements to prevent major accidents to environment [ S c h e d u l e 2 p S c h e d u l e 4 P a r t 1 p a r a • MATTE the operator sh ould describ e t preventative measures in place.

Where a scr eening appr o a c h h a s the operator should use the results o f the examination of the representative se t of releases to determine which of all of the releases do result in a M A TTE and then ensure that f o r each event the specif ic precautions are detailed.

Criterion 13 .8

r t s h o u l d

i s e d

f l o s s o f

u s

e 4 P a r t 2 , p a r a 5 c ) ] To meet this criterion the report should

• u ce a spillag e at

• s t o c o n f i n e t h e spillage, the i n e e r e d

• t r e a t t h e spillage The safety r e p o provide evidence that

s u i t a b l e a n d s u f f i c i e n t

r e s o u r c e s c a n b e m o b i l to minimise the

c o n s e q u e n c e s o
c o n t a i n m e n t o f a d a n g e r o substance(s) to ground or

w a ter (inclu d i n g C o n t r o l l e d Waters) [ S c h e d u l • consider the following:

m e a s u r e s t o s t o p o r r e d
source;

m e a s u r e preference being for pe rmanently e n g secondary containment systems fitted with an isolatio n device but other mobilisable resources may be considered (e.g. sandbags, d r ain seals et c)

m e a s u r e s t o r e c o v e r a n d / o r (eg pumps, chemicals fo r neutralisin g or absorbing th e spillage).

Criterion 13 .9

r t s h o u l d

a d e

e n t o m e e t t h i s c r i t e r i a w e would expect to see

the potential need for restoration an d clean

Other points to consider, where necessary,

the envisaged timescale over which

• h

•

a m i n c l u d e :

equipment to contain to xic substances; The safety r e p o provide evidence that

s u i t a b l e a n d s u f f i c i e n t p r o v i s i o n s h a v e b e e n m f o r t h e r e s t o r a t i o n a n d c l e a n up of the environment follo w i ng a m a j o r a c c i d [ S c h e d u l e 5 P a r t 1 , p a r a 4 ) ] T identifica t ion of:

• up measures

include:

• temporary c ontainment may be requ ired;
the arrangements made to ensure th a t s u c facilit ies wo uld not pose an unaccep t able threat to he alth and the environment ; suitable disp osal arrange ments.

E x ples of measures to be taken m a y

•

• agents to so ak up and/or neutralise contaminants;

132Environmental Criteria Guidance

• u i p m e n t f o r t h e r e m o v a l o f

• t e r ; earth movin g e q contaminated soil and ot her material;
booms and skimmers for spillage s t o w a

• temporary st orage arrangements e.g. portable stor age tanks, f o r the conta m inated material.

133

### Appendix 13.2 - Ot her criteria to be taken in to account for environm ent a l assessment

Section and Criterion Environment Component and Relevant Environmental Criteri on Descriptive Criterion 9. 5 The safety report should describe the immediate and dela y ed harm to man and the environment for each dangerous substance identified • The information present ed should in clude the physical, ch emical or toxicological characterist ics of the da ngerous sub s tances that may ca use harm and an indicat i on of the hazards posed. The info rmation presented should addr ess both the short and lo ng term effects and may include for example :

♦ effects on th e environme n t, includ ing building da mage, the ecosystem and relevant sensitive specie s, ( Environment criterion 13.3 ) Descriptive Criterion 9. 6 The safety report should describe the environment of the establishment in sufficient detail to allow the consequences of a major accident to be assessed • Land use pa ttern (i.e. ind u stry, agricu l ture, urban settle m ents, environmentally sensitive locations etc.).

• Consideration should also be given to allow assessment of the indire ct impact of a major accident on the public. F o r example, as a result of con t amination of drinking w a ter.

♦ a descriptio n of the und erlying and surrounding geology and hydrogeology if it is appropriate to the co nsideration of a

m a jor accid ent;

♦ a descriptio n of the surr ounding water courses (un der various flow conditio n s), underlying aquifers and any drinking water extraction points should be given in relation to th e dispersion of liquid contaminants or leachat e from solids deposited o n the surrou nding land;

♦ description of surrounding water and land quality;

♦ information on sewerage and rainwater systems if they could be involved in the dispersal o f liquid cont a m inants off-site;

♦ information on tides and currents tha t might influe nce disper sion or accumulatio n if marine or estuarine habitats are at risk;

• Information on the built environment is expected to include:

• each list ed building and monument t hat may be vulnerable to the effe cts of a major accident.

• Information on the natural environment is expected to include a de scription suf f iciently detailed to a llow the sign ificance of t he

134Section and Criterion Environment Component and Relevant Environmental Criteri on impact of major acciden t s t o b e a s s e s s e This should include deta ils of any:

♦ Sites of Special Scient i f i c I n t e r e d

.

s t ( S SSI);

t ection

♦
n d e r E n g l i s h

♦ s e f e a t u r e s in

a

( E n v i r o n whether they are Special areas of Conservation (SAC) or S p e c i a l P r o Areas (SPA) ; or Ramsar sites; marine nature reserves;

♦ marine sensitive areas, u Nature's ma rine strategy; and the sign ificance of t h e either a national or inter national con t ext should be e x plained, for example th e f l o r or fauna particularly at risk.

m e n t C r i t e r i o n 13.1 ) Descriptive

o r t s h o u l d

o f h e r external iators

( E n v i r o n 4 ) Criterion 9. 7 The safety r e p d e s c r i b e t h e e n v i r o n m e n t the establishment in

s u f f i c i e n t d e t a i l t o a l l o w the contribution of external f a c t o r s t o m a j o r a c c i d e n t s a t the establishment to be assessed • The contribu tion of the e x ternal factor to the major accid ent could be as an init iating or

e x a c e r b a t i n g e v e n t

. F a c t o r s f o r c o n s i d e r a t i o n under this cr iteria includ e:

♦ historica l e v i d e n c e o f o t events that might act as accident init such as f l oo ding;

m e n t C r i t e r i o n 1 3

.

D e s c r i p t i v e

r t s h o u l d

o n

r • The safety report should contain pla n (s), h i c h

tial.

o f

s

• t e s , p u rpose [e.g. f oul g

• e n t ) c r itical valves,

• e q u i p m e n t

, e

. g

. f o r t o x i c p r o d u c t s

( E n v i Criterion 9. 1 1 The safety r e p o p r o v i d e f o c u s e d i n f o r m a t i about each installation, in

s u f f i c i e n t d e t a i l t o s u p p o r t t h e d e m o n s t r a t i o n t h a t m a j o accident hazards w ill b e prevented or the effects mitigated map(s) or diagram(s) plus descrip t i o n s , w clearly set o u t information about the installat i ons with major accident pote n The descript i on should a l l o w d e t e r m i n a t i o n the purpose, location an d function of equipment within the in stallation th a t h a s a bearing on major accid ent prevention and control. In p a rticular, inf o r m a t i o n a b o u t i t e m of plant such as: drainage (e. g

. r o u water, fire fighting run-o f f w a t e r ] ) i n c l u d i n details rela ting to;

s a f e t y ( o r e n v i r o n m instruments, control loop s and detect i o n sy stem s;

m o n i t o r i n g in air, sewer s , disch arge s t o w a t e r ; f o r f i r e s o r explosive atmospheres;

r o n m e n t C r i t e r i o n 13.2 )
Predictive
.1

u m m a r i s e s t r i s k a ssessment Criterion 10
T h i s c r i t e r i o n s t h e d e s c r i p t i o n i n t h e s a f e t y • Description of the role th a has in the d e monstration that the risks are ALARP for o n -site perso nnel, people o f f

- s i t e and the environment.

135Section and Criterion Environment Component and Relevant Environmental Criteri on report of th e compan y ’ s g e n e r a l a p p r o a c h t o t h e u of risk assessment in the process of identify i ng necessary measures. s e ( Environment criterion 13.6 )

Predictive Criterion 10 .1.2 l i m i n a t i n g The intent of this crit erio n is to ensur e no important

n o r y o f t h e

( E n v i An y c r iteria f o r e possible hazardous events from furthe r consideration should be clearl y justifi ed hazardous e v ents go unconsidered.

• Periodic review consider s k n o w foreseeable changes to t he sensit i v i t surrounding environment

.

r o n m e n t C r i t e r i o n 13.1 )
Predictive Criterion 10 .2

r t s h o u l d

a t h a t a r e f s u i t a b l y applied

• a t a

( E n v i The safety r e p o demonstrate that the operator has used i n f o r m a t i o n a n d d a t suitable and sufficient for risk anal y s i s • Consideration of a rang e o harm levels (e.g. toxic, thermal, pressure effects) to p eople and th e environme n t.

Use of curre nt maps, off-site populat i o n d and surroun ding environmental features.

r o n m e n t A s s e s s m e n t c r i t e r i o n 1 3

. 6 )

Predictive Criterion 10 .3.1

a r d h a s

, • External events where relevant ma y include:

The range of MA scenarios affecting people

( E n v i r o n A s y s t e m a t i c h a z i d e n t i f i c a t i o n p r o c e s s been used to identify al l

m a j o r a c c i d e n t s c e n a r i o s including worst case and lesser events. ♦ Extre m e environmental conditions ( e .g.
a b n o r m a l r a i n , s n o w , t e m p e r a t u r e , w i n d

, floods (both as a causat ion or escala tion factor), light ning).

• and the environment is sufficient for identifying n e cessary measures and includes:

♦ The scenarios include e v ents where planned or installed me asures fail.

m e n t C r i t e r i o n 13.4)
Predictive .5

r t s h o u l d

u i t a b l e
e

t n s u r e valid and d

t C r i t e r i o n 13.5) Criterion 10 The safety r e p o provide details to d e m o n s t r a t e t h a t s
a n d s u f f i c i e n t c o n s e q u e n c assessment for each major accident scenario has been carried out w i th respect to p e o p l e a n d t h e e n v i r o n m e n The intent of this crit erio n i s t o e appropriate c o n s e q u e n c e a s s e s s m e n t a n d s h o u l include a ra nge of poten tial harms to the environment ( E n v i r o n m e n

Predictive Criterion 10 .5.4

o r

u sed to • The safety report shows, where the scale and

t a nd

( Environment Criterion 13.3 ) T h e h a r m c r i t e r i a vulnerability m o d e l s assess the impact of each MAH on pe ople and the environment should be nature of th e hazard an d risks is s i g n ificant:

♦ Justification for the approach to environment a l i m p a c t a s s e s s m e n data used.

136Section and Criterion Environment Component and Relevant Environmental Criteri on

a p p r o p r i a t e a n d h a v e b e used correctl y for eac h relevant major accident e n

Predictive Criterion 10 .5.6

s e v e r i t y and

e a r e Extent and severity is concerned wit h who (people)

r i o n 1 3

. 5 ) E s t i m a t e s o f t h e extent of each major

a c c i d e n t c o n s e q u e n c realistic or what (environment) mi g h t b e h a r m e d

, h o w b a d l y , and how ma ny (people) or how muc h (environment) are affected by major ac cidents. ( E n v i r o n m e n t A s s e s s m e n t c r i t e

T e c h n i c a l Relevant criteria affectin g assessment of

a l l o c a t ed environment al aspect s is dependant u p o n responsibilities within the Assessmen t team. Emergenc y Response

r t s h o u l d

o f a t i o n of any pollution

t o r a t i o n ;

Where relevant, or where more rigorous or

s p o n s e
e s , i n

e ,

r m l

c e s Criterion 14 .2 The safety r e p o d e s c r i b e t h e o r g a n i s a t i o n the alert and intervention in t h e e v e n t o f a m a j o r a c c i d e n t to provide evidence that the necessary measures have been taken on-site • Arrangemen ts for intervention in an emergency situation

♦ the nature a n d l o c control devices and materials, and t he arrangemen ts for subse quent environment al clean up a n d r e s

• detailed de monstrations are requir ed, consideratio n of the follo wing:

♦ the effects o f e m e r g e n c y r e actions, including fire fig h t i n g a c t i v i t i order to minimise the overall impact on people and t h e e n v i r o n m e n t ( f o r e x a m p l due to conta m inated firewater); this should inclu de short ter m a n d l o n g t e effects and a l t e r n a t i v e o p t i o n s f o r d i s p o s a or discharge together with the least damage solutions and t he circumst a n in which the y apply. Emergenc y Response

r t s h o u l d f f

r O f r e l e v a i f i c d e scribed Criterion 14 .3 The safety r e p o d e s c r i b e t h e o n - s i t e a n d o site resources w h ich can be mobilised by the opera t or to provide evidence that the necessary measures h a v e been taken to limit the

c o n s e q u e n c e s o f a m a j o
a c c i d e n t t o p e o p l e a n d t h e environment n c e b u t n o t h i n g s p e c

Emergenc y R e s p o n s e

t s h o u l d Of relevance but nothin g specific de scribed. Criterion 14 .3.2 The safety r e p o r provide evidence that

s u i t a b l e a n d s u f f i c i e n t

137Section and Criterion Environment Component and Relevant Environmental Criteri on

a r r a n g e m e n t s a r e i n p l a ensure that the equipment to be mobilised for mitigating the consequences of reasonabl y f o r e s e e a b l major accidents w ill be f i purpose when called upon for use c e t o

e t f o r

E m e r g e n c y Response

t s h o u l d

o n b e

d That adequate consider ation has be en given to the Criterion 14 .3.4 The safety r e p o r provide evidence that

s u i t a b l e a n d s u f f i c i e n t site fire fighting and fire p r o t e c t i o n p r o v i s i o n s c a n mobilised in the event of a major accident, taking account of resources

a v a i l a b l e f r o m l o c a l a n other fire brigades possible e n vironmental impact of contaminated firewater on watercourses and groun dwater.

Emergenc y R e s p o n s e

t s h o u l d

a d e

e n t To meet this criterion the report should include

l n e e d f o r r e s t o r a t i o n a n d clean

• c o n s i d e r , where necessary,

v i s a g e d t i m e s c a l e o v e r w h i c h

♦

t h e

♦ a l a r r a n g e ments.

Exa m ples of measures to be taken may

m e n t t o c o n t a i n t o xic substances;

♦ v a l o f Criterion 14 .3.8 The safety r e p o r provide evidence that

s u i t a b l e a n d s u f f i c i e n t p r o v i s i o n s h a v e b e e n m f o r t h e r e s t o r a t i o n a n d c l e a n up of the environment follo w i ng a m a j o r a c c i d identifica t ion of:

• t h e p o t e n t i a up measures.
O t h e r p o i n t s t o include:

♦ t h e e n temporary c ontainment may be requ ired; the arrangements made to ensure th at such facilitie s would not pose an unacceptable threat to h e a l t h a n d environment ; suitable disp o s

• include:

♦ e q u i p

♦ agents to so ak up and/or neutralise contaminants; earth movin g e q u i p m e n t f o r t h e r e m o contaminated soil and ot her material;

♦ booms and skimmers for spillage s t o water;

♦ temporary st o r a g e a r r a n g e m e n t s e

. g

. portable stor age tanks, f o r the contaminated material. Emergenc y Response

The safety report should • T h e r e l e v a n t :

threat to the environmen t and the Criterion 14 .5 t r a i n i n g should inclu d e w h e r e

♦ the nature o f major accidents posin g a

138Section and Criterion Environment Component and Relevant Environmental Criteri on p r o v i d e e v i d e n c e t h a t

v e y

- s u i t a b l e a r r a n g e m e n t s h a b e e n m a d e i n t h e s a f e t management s y stem for t r a i n i n g o f i n d i v i d u a l s o n site in the emergenc y response particular st eps to take in the event of such ac cide nts;

Emergenc y R e s p o n s e C r i t e r i o n 1 4 .7

t i o n t o e n a b l e
n • The minimu m informatio n to be inclu ded in the safety report include s:

i d e n t e

. g

. m a p s i t i v e

♦

v e r e d by the COMAH Regulations

e o ple The safety r e p o r t s h o u l d suppl y info r m a the off-site emergenc y p l a to be drawn up ♦ Details of th e off-site are a likely to be

a f f e c t e d b y a m a j o r a c c with sectors a n d e n v i r o n m e n t a l l y s e n s areas and a drainage map to help determine where spillag e s could lea v e the site. Details of th e dangerous substance s ons i t e c o and similar information for other hazardous materials held on site, including: q uantities; ha z a r d o u s p r o perties and the natu r e of their ef f e c t s o n p and the environment.

139

## 14. EMERGENCY RESPONSE ARRANGEMENTS

Introduction 140 Scope 1 4 0 Relevant requirements of the COMAH Regulations 1 4 0 General guidance for th e assessment of the emergency response elements 141 Pre-construction and pr e-operation safety reports 141 Exe m ption from producing an off-sit e emergency plan 1 4 1 Appendix 14.1 Emergency response assessment cr iteria and gu idance 143



### Introducti on

Scope
1 This set of criteria is con c erned with the on-site a rrangements to respond to a major accid ent, the inter f ace of these arrangements with th e off-site emergency plan, and the reso urces that can be mobilised by the operator to take mitigatory action to minimise the conseque nces of a major acciden t.

Relevant requirements of the COMAH Regul ations
2 Schedule 4 Part 1, para 2 requires th at one of the purposes of a safety report is to demonstrate that the necessary measures have been taken to limit t he consequences of major accident ha zards to peo ple and the environment . Additional purposes ar e set down in Schedule 4 Part 1, para 4 which re quires the safety report to demonstrate that on-site emergency plans have been drawn up and to supply information to enable the off-site plan to be drawn up.

3 Schedule 4 Part 2, paras 5(a-d) set down the minimum data to be consid ered in the safety report with respect to emergency response: para 5( a) requires a description of equipment installe d fo r limiting the consequen ces of major accident s, 5(b) is concerned with the organisat i on of the alert and inter v ention, 5(c) requires a description of the mobilisable resour ces, 5( d) re quires a su mmary of information from sections 5(a ) to 5(c) necessary for drawing up the on-site emergency plan. The emergency response cr it eria cover paras 5(b-d) with para 5(a) addresse d by the Technical A s pects criter ia presented in Section 1 2

.

4 Aspects of t he Safety Management Syst em dire ctly relevant to emergency response ar rangements are specifie d in the follo wing section s of Schedule 2: 4(a) which addresses train i n g needs; 4(c) which covers arrangements for maintenance of plant and eq uipment; 4(e) which requires t he safe ty manage ment system to address the adoption and implementation of p r ocedures to test and review emerge ncy plans. General assessment crit eria for Safety Manage ment Systems are present ed in Section 11.

5 Regulation 10(7) recog n ises that sit uations may apply where the CA deems it appropriate to exempt a local authority from the requirement to produce a n off-site emergency plan in resp ect of an est ablishment. This is furth e r addresse d in this section.

6 The layout of the criteria is intended t o reflect the layout of the Regulations.

140General gui dance for the assessment of the emergenc y response elements
7 The assessment criteria listed be low, together with their explanatory text, are representative of the typ e of necessary measure s that the C o mpetent Authority would expect the operat or to take to limit the con s equences of major accident hazards to p eople and th e environme n t. It is reco gnised that t he assessment criteria may not all be relevant to a particula r establishm ent, howeve r the onus is on the operator to demonstrate that the nece ssary mea s ures which have been made are adequate in the context of the major accident ha zards that could occur a t the site concerned. They should be related ( and preferably cross ref e renced) to the major accident sce narios described elsewh ere in the sa fety report.

8 Where the term evidenc e is used in the criteria t hen a state m ent of confirming that specif ic measures have been taken may be sufficien t to satisfy the r equirement. For example

, a statement confirming that equipment is in clud ed in plant maintenance schedules, maintenance records, maintenance procedures and instruct ions etc. It is not expected that examples of these doc uments are inclu d ed in the saf e ty report. Such documents may be subject to p o st asse ssment inspect i on.



### Pre-c o nst r uction a nd pre-operation s a fety reports

9 For Pre-Con s truction Saf e ty Reports (PCSRs) an d Pre-Opera t ional Safety Reports (POSRs) the organisation o f alert and in tervention arrangements should be described to the extent that information is availab l e and in relation to the hazards that apply. For PCSRs, rele vant informa t ion may include:

• Control and limitation of escalation o f major accidents, inclu d ing isolat io n and removal of inventories.

• Communication during e m ergency re sponse.

• Emergency control centr e s.

• Access rout es

• Design and constructi on of mobilisa b le resource s, particul a rl y nearer preoperation st age.

• Arrangemen ts during ph ased commissioning o f plant.

10 Training in e m ergency re sponse, test ing of emergency plans, information for the offsite e m ergency pl an has principal relevance to POSRs.


### Exemption from pr oducing an off-site emer gency plan

11 Regulation 10(7) deals with exempti ng a local a u thority from the need to produce an off-site emergency plan. Where this is deemed appropriate, t he CA is required to notify the local authority in writing of the exempti on and the r easons for granting it. Members of the assessment team will need to agree the basis of such an exemption a nd record it as an outco me of the assessment conclusion s meeting.

12 In reaching a decision t hat an exemption to prod ucing an off- site emergency plan in resp ect of an est ablishment is appropriat e , the assessment team should be in agreement that, based o n the evidence in the saf e ty report, the consequ ences of a major accid ent affecting health and safety or the environmen t will not extend beyond the establishment boundary. Where team agreement cannot clearly be reached, an exemption should not be granted (i.e . a cautious approach sh ould be ado pted).

14113 Consideration of conse quences extending beyond the estab lishment bo undary for matters relating to he alth and saf e ty will be based primarily on the consequence ranges provided in the re port and will also need t o take acco unt of the pr oximity and extent of populations be yond the site boundary. Assessor s need to con s ider if uncertainty in the conse quence analyses and assumptions is such that a clear exemption d e cision cann ot be reache d,

14 Consequences to the e n vironment may be more difficult to determine if uncertainty over pathwa y s beyond t he establish m ent boundary exist (e.g. underground pathways to water supplies, stre a m s, etc.).

15 The AM will be responsi b le, in the fir s t instan ce, for identifyin g whether a possible exe m ption situa t ion exists a s an outcome of the initial read. Att ention to this possibility should be raised in the St age 1 Assessment Plan. The predictive assessor ( f o r health and safety consequences) a nd the environmental assessor (for environment al conseque nces) shou ld consider t he possibilit y of an exe m ption during their initia l r ead prior to the assessment planning meeting. It the asse ssment planning meeting reache s the view that an exemp t ion remains possible

, this should be identified as an asse ssment sco pe item for further consideration during the assessment . The assessment should seek to establish that sufficien t evidence exists in the report to conclude that an exemption is ap propriate.

16 Historically, few exe m ptions from producing an offsite emergency plan have been granted. Procedure 4.2 will no rmally apply for prompt notificati on t o the local authority when it is deter mined that the minimum information required by the regulations exists to pre pare a plan. The framework letter 6 in Appendix 4.6 informs the local aut hority that the report has been read, but not fully assesse d. This letter, prepared early in the assessment pr ocess, a llows progress t o be made by the local authority in preparing a plan. Exemption from producing a p l an, however, places an increased o b ligation on the CA to be as sure it is reasonable to be so that no plan is necessary. It is for this r eason that t he decisio n to grant an exemption is left until a complete assessment of the safety report has be en made and conclu sion s reached (see Proced ure 6.1).

142

### Appendix 14.1 Emer gency resp onse assessm ent criteria and gui da nc e Emergency Response Criteria Guidance

Consultation

Criterion 14 .1 The safety report should confirm that the operator has consulted the follo w i ng in the preparation of the on site emergenc y plan: those

w o rking in the establishment; the Agenc y ; th e emergency services; the health authority ; the local authority

[Regulation 9(3) and (4)] Simple confirmation of the compliance with the regulation should be suf f icient to me et this cr iterion. However, it would be preferable for the report to give details of th e means and nature of t he consultat i on, and any imp a ct that this has had on t he emergency planning arr angements.

Organisatio n of Alert and Intervention Criterion 14 .2 The safety report should describe the organisation of the alert and intervention in the event of a major accident to provide evidence that the necessary measures have been taken on-site

(Schedule 4 Part 2, para 5b) To meet this criterion, th e safety report should describe:

• Basic organisational issu es necessar y for emergency response:

♦ identifica t ion of key post s , and group s, with duties in the emergency response (a nd the arrangemen ts for deputies);

♦ description of the functions of key posts with duties in em ergency response;

♦ description of provision s for establishing and maintaining communications during t he emergency response;

♦ the nature a nd location of: emergency control centres; fir s t aid centres; emergency refuges; muster points; pre-define d forward control points, etc;

• Arrangemen ts for raising the alert to t he hazardous situation:

♦ to cover individuals on site, the gene ral public and, where relevant, neighbo uring establishme n ts and downstream water abstractors

♦ description of the natur e of the alar ms and the plant co nditions req u ired to activate them;

♦ the roll call and search and rescue arrangemen ts;

143Emergency Response Criteria Guidance

Arrangemen ts for intervention in an e m ergency

i a l a c t i ons require d both on-sit e and

♦ i n g

a nd other

♦ a t i o n of any pollution

e n t a l

♦ f o r m o n i t o r i n g w i n d

Where relevant, or where more rigorous or p o rt

,

♦

w i t h

♦

♦ c y

♦

♦ • situation:

♦ t h e i n i t off-site in re sponse to alarms/warnings; the arrangements for controlling and l i m i t the escalat i on of accide nts on-site, i n c l u d i n g : the isolat ion of hazardou s inventorie s and the removal of inventories (where appropriate); the use of f i r e f i g h t i n g mitigatory measures; an d the prevention of domino effects; the nature a n d l o c control devices and materials, and t he arrangemen ts for subse q u e n t e n v i r o n m clean up an d restoration ; p r o v i s i o n h a s b e e n m a d e speed and d i rection, and other environmental conditions, in the event of a major accident.

• detailed de monstrations are requir e d

, t h e r e should inclu de consider ation of the f o llowing:

♦ the effects o f emergency response a c t i o n s including f i r e fighting activities, in or der to minimise the overall impact on peo p l e a n d the environment (for example, due to contaminated firewater); this shou l d i n c l u d e short term and long term effects and alternative options for disposal or d i s c h a r g e together with the least d a m a g e s o l u t i o n s a n d the circumst ances in which they apply; the nature o f, and arrangements for

n t s maintaining, any mutual a i d a g r e e m e nearby establishments the nature a nd location of any installations which may require special protection , or rescue inter v ention; the location of: access r o u t e s f o r e m e r g e n services; re scue routes; escape rout es; and any restricte d areas; the arrangements for unmanned sites and sites that ar e not contin u o u s l y m a n n e d

, a n d sites with va rying manni ng levels at different times; the arrangements and conditions for alerting and mobilisi ng: individu als or group s with defined resp onsibilities u n d e r t h e e m e r g e n c y plans including essentia l personnel o n -site and off-site; the emergency services (including ar rangements for briefing t he

144Emergency Response Criteria Guidance

emergency services of t he nature of the incident and o f a n y s p e c i a l p r o b l e m s t h e y might face); neighbourin g establish m ents (where mutu al aid agree ments exist); and off-site agen cies; t h e e v a c u a t i o n a r r ♦ a n g e m e n t s a n d a n y transport re quirements.

Description of Mobilisable Resources Criterion 14 .3

r t s h o u l d

e s have

r

c h e d u l e 4 P a r t 2 , p a r a o n c l u s i v e c o m m e n t

when conside r ing the sub criteria belo w , the

The descript i ons should be referenced to the

n

• p r e s e n t e x tensive

n

d

• r e s e n t e d b e low are

s a r y

t s f

, hence the The safety r e p o describe the on-site and off-site resources w h i ch can be mobilised b y th e operator to provide evidence that the necessary m e a s u r been taken to limit the

c o n s e q u e n c e s o f a m a j o accident to people and the environment

( S 5c) This criter io n is used to m a k e a c on the emergency response aspect s which come below it. H o w e v e r , following issues should be consider ed:

• major hazard scenario s d e s c r i b e d e l s e w h e r e i the report and it should cover both human

resources a nd hardware

There is no r e q u i r e m e n t t o technical de tails about t hese resour ces in the safety report, however th e e v i d e n c e p r e s e n t e d should be sufficient to g i ve confiden ce that the necessary measures have been taken in relat i o to the type and magnitude of the fore seeable consequences, and that t h e e q u i p m e n t p r o v i d e is fit for its in tended use.

T h e a s s e s s m e n t c r i t e r i a p deliberately in non-prescriptive terms in recognition of the fact th at on-site "n e c e s measures" will depend upon: the type and magnitude of the foresee a b l e m a j o r a c c i d e n which will vary widely ac cording to th e n a t u r e o the establishment involved. Howe ver, the onus is on the op erator to demonstrate in the safety report that t he necessar y m e a s u r e s h a v e b e e n taken, in the context of the specif ic circumstances at the sit e c o n c e r n e d need for reference to th e identified major accident sce narios.

Criterion 14 .3.1 t s h o u l d

n h e s a f e t y r e p o r t s h o u l d be able to g i ve confiden ce

the various functions req u ired to implement the

• l l s The safety r e p o r provide evidence that

s u f f i c i e n t p e r s o n n e l c a be made available w i th in

a p p r o p r i a t e t i m e s c a l e s t o carry ou t the mitigatory actions required b y th e on-site emergenc y pla n s T that the follo wing factors have been taken into account:

• on site emergency plan have been identified;
the numbers of personne l, with appro p r i a t e s k i or competencies, require d to implement the on site emergency plan have been determined;

145Emergency Response Criteria Guidance

( S c h e d u l e 4 P a r t 2 , p a r a • h e

•

• i a l f o r i n c a p a c i t y o f k e y o p e r a t o r s h a s 5c) these numbers of staff can be asse m b l e d i n t required response time;
the mitigatory actions ca n be achieved in practice;

t h e p o t e n t been taken into account.

Criterion 14 .3.2 t s h o u l d

c e

a t i n g

i t

a r t 2 , p a r a o b e f i t f o r purpose the equipment should be:

• i o n s ( e g

• l e n v i r o n m e n t a l

• t h e

• r e s e e a b l e
n t r o d u c e

T o e n

u a n t i t ies of

• which bot h the equip m ent will be

• f t h e equipment, to ensure it is both

O t h e r

e rvices (such

• e The safety r e p o r provide evidence that suitable and sufficient

a r r a n g e m e n t s a r e i n p l a to ensure that the equipment to be

m o b i l i s e d f o r m i t i g the consequences of reasonabl y foreseeable major accidents w ill be f for purpose w h en calle d upon for use

S c h e d u l e 4 P ( 5c) T

appropriately specified t o meet the needs of the • identified m a jor acciden t scenario s; able to oper ate in the a m b i e n t c o n d i t weather/frost protection);
able to oper ate in the lo c a conditions e x pected in an emergency;

able to sust ain the mitig a t o r y a c t i o n f o r necessary length of time;
suitably prot ected for the f o environment al conditio n s so as not to i additional h a zards (eg e l ectrica l equipment).

s u r e t hat the equi pment can be mobilised consideratio n needs to b e given to:

determination of the req u i r e d q • equipment;

timescales i n needed, and in which it can be made available for use;

s t o r a g e o accessible, and protecte d from the consequences of a major accident.

f a c t o r s t o b e c o n s i d e r e d i n c l u de:

the possib ilit y of loss of essential s • as power, water, and co mmunications) and othe r facilit ies has been taken into account and alternatives provided wh ere necessa ry; the compatibility, where necessary, o f t h emergency equipment with that of t he emergency services an d that provided by organisation s with which a mutual aid agreement exists.

Criterion 14 .3.3 t s h o u l d t h a t o u l d i n c l u d e equipment such as, bu t not restrict ed to: The safety r e p o r p r o v i d e e v i d e n c e C

146Emergency Response Criteria Guidance

suitable and sufficient personal protective equipment w i ll be available in t h e e v e n major accident

( S c h e d u l e 4 P a r t o f a

t 2 , p a r a
c ) respirators a nd/or breathing air set s ;

t e r , o r

T o e n m e n t c o n s i d e r a t ion

identifica t ion of the specification of P PE i r e d ;

• o

• lies require d to meet

• n t

, t o e n s u r e i t is both

r o u p s w h i c h m a y r e q u i r e PPE ma y i n clude:

members of the emergency response team

r i t

. 5 •

• protective clothing for ra diant heat, w a specific che m ical hazar ds.

s u r e a v a i l a b i l i t y o f t h e e q u i p should be given to:

• appropriate to the mitigatory actions r e q u
identifica t ion of those ind i viduals, or g r o u p s , w h may require use of PPE;
determination of the sup p the potential demand;
storage of th e e q u i p m e accessible, and protecte d from the consequences of a major accident.

G

•

• those with d u ties under t h e e m e r g e n c y p l a n

• o t h e r i n d i v i d u a l s w h o m a y b e r e q u i r e d t o w e a e.g. emergency escape respirators f o r site personnel in the event of a toxic gas r e l e a s e

Criterion 14 .3.4 t s h o u l d

o n f r o m

c h e d u l e 4 P a r t 2 , p a r a h e s a f e t y r e p o r t s h o u l d provide sufficient eviden ce to

e

h e r e c i r c u m stances ar e foreseeable that make the

n safe

c e s and

h e e v i d e n c e m a y i n c l u d e s o m e o r a l l o f t h e f o l l o w i n g :

that the fire f i ghting roles of the on-sit e d e , r i n g The safety r e p o r provide evidence that

s u i t a b l e a n d s u f f i c i e n t site fire fighting and fire p r o t e c t i o n p r o v i s i o n s c a n be mobilised in the event of a major accident, taking account of

r e s o u r c e s a v a i l a b l e local and other fire brigades

( S 5c) T show that the quantity and specif icat ions of the o n -site fire fighting provisions t hat can be mobilised, with due consideratio n of off-site r e sources av ailable from local and other fir e brigades, are adequate for the major accident sce narios that a r e identified e l s e w h e r e i n t h safety report.

W use of fire fighting or oth e r mitigatory measures impracticable or unsafe (for example

, i t m a y b e u to fight certa i n fires involving explosives), the arrangemen ts should id e n t i f y s u c h c i r c u m s t a n the addition al arrangements necessary to limit the consequences of a major accident.

T

• personnel (e .g. full time on-site fire b r i g a auxiliary fire fighters, oth e r site perso n n e l ) d u an emergency have bee n defined an d are appropriate;

147Emergency Response Criteria Guidance

• ghting roles of the on-sit e
e o f t h e

• t ion of on-site fire

• i r e f i ghting and

• f f i c i e n t portable a nd mobile

,

t o

• n t stocks of foam

• t e considerat ion has bee n given in

• e n t o

• t o that the fire f i personnel ar e compleme n t a r y t o t h e r o l off-site emergency services;
that the qua n t i t y a n d s p e c i f i c a fighting equipment is suf f icient;

t h a t t h e w a t e r r e q u i r e m e n t s f o r f fire protectio n (e.g. cooling) have been predetermined and that the capacity an d reliability of the water supply are adequate taking into account the various sources which may be available, a nd the time required to e s tablish back up sup p lies;

that suitable a n d s u fire fighting equipment (such as mo b i l e m o n i t o r s mobile pumps, hand/por table extinguishers, foam generation equip m ent, hoses), and hydrants have been located at appr opriate points throu ghout the in stallation a c c o r d i n g the hazard;

that suitable and sufficie compound are available when and where necessary;

t h a t a d e q u a the design ( e .g. the positioning of w a lls, fire screens), to assist the p o sitioning a nd protectio n of fire fightin g equipment and person nel, and that the reach of fire prot ection and extinguishin g equipment is appropria te;
that adequat e considerat ion has bee n g i v flammable substances b e ing carried with fire water and spreading the fire to other areas; that adequat e considerat ion has bee n g i v e n the possib l e environmen tal impact of contaminated firewater on watercourses and groundwater.

Criterion 14 .3.5 t s h o u l d

h e

i n o m e e t t h i s c r i t e r i o n t h e report should consider t he

u r e s t o t e r m i n a t e o r r e d u c e t h e leak at

•
e n

• a i rborne The safety r e p o r provide evidence that suitable and sufficient provisions can be

m o b i l i s e d t o m i n i m i s e t release of, and mitigate the consequences of, airborne toxic and/or f l a m m a b l e s u b s t a n c e s the event of a major accident T following:

m e a s • source (e.g. patching or p l u g g i n g o f l e a k s , o r isolation by valve closure or other means);

measures to reduce the evolution of fumes where hazardous materials have alr e a d y b e spilt (e.g. fo am cover or cooling);

measures to reduce the e f f e c t s o f substances (e.g water sprays)

148Emergency Response Criteria Guidance

( S c h e d u l e 4 P a r t 2 , p a r a h e s a f e t y r e p o r t s h o u l d also show h o w consider ation

ying out these tasks in

• t w i ll be 5c) T has been given to:

the practica bility of carr • foreseeable accident co nditions;

t h e e q u i p m e n t

, t o o l s a n d P P E t h a required to carry out these tasks.

Criterion 14 .3.6 t s h o u l d

h e

e 4 P a r t 2 , p a r a o m e e t t h i s c r i t e r i o n t h e report should consider:

r c e ;

• ( e g The safety r e p o r provide evidence that suitable and sufficient resources can be

m o b i l i s e d t o m i n i m i s e t consequences of loss of containment of a dangerous substance(s) to ground or w a ter (including Controlled Waters)

S c h e d u l ( 5c) T

measures to stop or red u ce a spillag e a t s o u •

• measures to confine the spillage, the preference being for pe rmanently e ngineered secondary containment systems fitted with an isolation d e v i c e b u t o t h e r m o b i l i s a b l e r e s o u r c e s m a y b e considered ( e .g. sandba gs, drain se als etc))

measures to recover and/or treat the s p i l l a g e pumps, chemicals for n eutralising o r absorbing the spillag e )

C r i t e r i o n 1 4 .3.7 t s h o u l d

g

t 2 , p a r a To meet this criterion the report should include:

r g e n c y r e s p o n s e

• o f h o w t h e r e s u l t s o f

c e decision s

• r i n g

m e n t

, The safety r e p o r provide evidence that suitable and sufficient p r o v i s i o n s f o r m o n i t o r i n and/or sampling can be

m o b i l i s e d i n t h e e v e n t o f a major accident

S c h e d u l e 4 P a r ( 5c) consideratio n of the ben efits of •
m o n i t o r i n g / s a m p l i n g d u r i n g e m e (this may be based on th e hazardous substance involved, the rate at which it disperses to safe levels and t he speed at which the re s u l t s m a y b e obtained);

e x p l a n a t i o n
m o n i t o r i n g / s a m p l i n g m i g h t i n f l u e n made during emergency response;
identifica t ion o f a n y s a m p l i n g / m o n i t o measures to be carried o u t, and the e q u i p methods and specialist expertise that may be required.

Criterion 14 .3.8 t s h o u l d o m e e t t h i s c r i t e r i o n t h e report should identify:

u p

Other points to consider, where necessary, includ e: The safety r e p o r provide evidence that suitable and sufficient provisions have been

m a d e f o r t h e r e s t o r a t i o n and clean up of the environment follo w i n g a major accident T

the potential need for restoration an d c l e a n •
measures.

t h e e n v i s a g e d t i m e s c a l e o v e r w h i c h t e m p o r a r y • containment may be req u ired;

149Emergency Response Criteria Guidance

( S c h e d u l e 5 P a r t 1 , p a r a 4 ) • u r e t h at such

a t

•

x a m ples of measures to be taken may include:

• u i p m e n t f o r t h e r e m o v a l o f

• t e r ; the arrangements made t o e n s facilit ies wo uld not pose an unaccep t a b l e t h r e to health an d the environment;
suitable disp osal arrange m e n t s

.

E

equipment to contain to xic substances; •

• agents to so ak up and/or neutralise contaminants;

earth movin g e q contaminated soil and ot her material;
booms and skimmers for spillage s t o w a

• temporary st o r a g e a r r a n g e m e n t s e

. g

. p o r t a b l e storage tanks, for the co ntaminated material.

Criterion 14 .3.9 t s h o u l d

4 P a r t 2 , p a r a h e s a f e t y r e p o r t s h o u l d demonstrate that suitab le l The safety r e p o r provide evidence that suitable and sufficient provisions have been made to mobilise first aid/medical treatment during the emergenc y response

S c h e d u l e ( 5c) T consideratio n has been given to the first aid/med i c a provisions r equired in th e event of a major accid ent and show how the on-site provision s d o v e t a i l w i t h t h e provisions in the off-site emergency plan.

C r i t e r i o n 1 4 .3.10

s h o u l d

ich Ancillary equipment is d e fined in thi s context as those

, The safety r e p o r t provide evidence that suitable and sufficient provisions have been made to mobilise an y ancillary eq uipment w h

ma y be req u ired during the emergenc y respon se

S c h e d u l e 4 P a r t 2 , p a r a ( 5c) miscellaneo us provision s that may b e required t o enable the e m ergency re sponse to b e carried out

. Such equip m ent could include vehicles to transp o rt emergency equipment to and from the site of th e accident, he a v y l i f t i n g g e a r , e a r t h m o v i n g e q u i p m e n t emergency l i ghting, and special t ools, parts etc. required to carry out emergency repairs and act i ons.

Maintenance, etc. of Emergenc y Response Equipment C r i t e r i o n 1 4

.

, t h a t 4

o r t s h o u l d The safety report should p r o v i d e e v i d e n c e The safety r e p provide evidence that suitable arrangements h a v e b e e n m a d e f o r t h e
m a i n t e n a n c e , i n s p e c t i o n suitable arra ngements have been made for the:

maintenance (planned a nd breakdo wn), •

• inspection

, examination and

150Emergency Response Criteria Guidance

e x a m i n a t i o n a n d t e s t i n g of the mobilisable resources and other

e q u i p m e n t t o b e u s during the emergenc y
r e s p o n s e

. ( T h i s c r i t e r i o onl y applie s to mobilisable resources

a n d o t h e r e q u i p

w h i ch the o p e r a t o r h a s responsibility )

( S c h e d u l e 2 , p a e d

n

m e n t f o r

r a 4 c ) o n s e e q u i p m e n t a n d p r o v i s i o n s

.

a t o r y f u n c t i o n s u ch

• f u n c t i o n , such as

h e e v i d e n c e m a y t a k e t he form of statement of

, • testing,

o f e m e r g e n c y r e s p

h e a r r a n g e m e n t s s h o u l d c o v e r : T

equipment with a direct m i t i g • as fire fight ing equipment;
other equip m e n t w i t h a k e y alarms to warn personn el of the accident.

T confirmation that specif ic equipment is included i n plant maintenance sche dules, maint enance reco r d s maintenance procedure s and instru ctions et c.

T r a i n i n g I n T h e E m e r g e n c y Resp onse Criterion 14 .5

r t s h o

e

e ) v i d e n c e t o g i v e
s

i s

f f with a specif ic role in t h e

• a t i o n n e e d s o f o t h e r

• to the site.

h e t r a i n i n g should inclu de where relevant:

a r i o s

• r a c c i d e n t s p o s i n g a threat to

• a n d t h e

• d ing to

• a y b e m o b i l i s e d

•

. r e s p i r a t o r s , breathing air

, clothing et c.), and any limitations The safety r e p o u l d The safety report should p r o v i d e e

provide evidence that suitable arrangements have been made in the safety man agement

s y stem for training of individuals o n - s i t e i n t h emergenc y response

S c h e d u l e 2 , p a r a 4 a & ( confidence t hat the safet y manage m e n t s y s t e m h a taken accou n t of the nee d to train ind i viduals in th e emergency response, an d to ensure t h a t t h e t r a i n i n g kept up to d a te (e.g. by refresher tra i ning).

h e t r a i n i n g should cove r: T

those memb e r s o f s t a • event of a major acciden t;

as well as th e training/inf o r m employees,

contractors and visitors

T

• information on the major accident s c e n which may t r igger the o n -site and of f-site emergency plans;

the nature o f m a j o the environment and the particular steps to ta ke in the event of such accidents;
knowledge o f t h e a l a r m s y s t e m s required response to ea ch alarm;
the procedu res for repor t i n g / r e s p o n incidents on site which h a v e t h e p o t e n t i a l t o escalate int o a major accident;

the use of th e resources w h i c h m in the event of a major accident e.g. fire fighting equipment, special che m icals, etc;
the use of pr o t e c t i v e e q u i p m e n t ( e

. g

151Emergency Response Criteria Guidance

on their use;
the evacuation and mustering proced ures; •

n t h e
a n s

• w i t h

u a l a i d a g r e e ment exists. • the actions r e q u i r e d b y s t a f f w i t h k e y r o l e s i implementat ion of the on

- s i t e e m e r g e n c y p l e.g. the site main controller or site in cident controller;
the training o f i n d i v i d u a l s f r o m o r g a n i s a t i o n s

w h i c h a m u t

T e s t i n g o f E m e r g e n c y Plans Criterion 14 .6 The safety report should

c e t h a t

s t

t s

e 2 , p a r a 4 e ) h e s a f e t y r e p o r t s h o u l d provide sufficient eviden ce to l e p r o g r amme of

s e i t h t h e offp r o v i d e e v i d e n procedures have been

m a d e a n d a d o p t e d t o t e and review emergenc y plans, and to revise the emergenc y a r r a n g e m e n i n t h e l i g h t o f t h e l e s s o n s learned

( S c h e d u l T give confide n c e t h a t a s u i t a b emergency exercises h a s been dra w n up, and has been implemented, to test the emergency arrangemen ts at all levels (i.e. the lo cal plant re s p o n the site-wid e response, and the inter f a c e w site respon se) and that a procedure exists to en sure that the lessons learned from these exercises are reviewed an d the emergency arrangements revi sed where necessary.

I n f o r m a t i o n R e q u i r e d f o r t h e O f f s i t e Emergenc y Plan C r i t e r i o n 1 4 .7 The safety r e t i o n t o

4 , p a r t 1 p a r a 4 ) The minimu m informatio n to be inclu ded in the safety

i n cluding its lo catio n , nearby roads, and site acce ss. (This topic is consid ere d

•
e n t r e s, location of g

• d e n t e

. g

. m a p s w i t h s e c t o r s a n d

i o n
e n s i t y ,

e s i t e

. n

• e he COMAH Regulations and similar p o r t s h o u l d report is list ed below: suppl y info r m a enable the off-site emergenc y plan to be draw n up

( S c h e d u l e • details of th e s i t e

in more detail in Sectio n 9) ; site plan sh owing locati on of key faciliti e s su ch as control c e n t r e s , m e d i c a l c main process plant and stores. Deta i l s o f s t a f f i n levels. (This topic is con s i d e r e d i n m o r e d e t a i l i n Section 9) ;
details of th e off-site are a likely to be affected by

a m a j o r a c c i environment ally sensitiv e areas (e.g . Sites of Special Scientific Interest (SSSI’s), Special Areas of Conservation (SAC’s), Special Protected Areas (SPA’s)) indicated, i n f o r m a t on the types of building, t h e p o p u l a t i o n d roads, sensitive building s (e.g. scho o ls, hospitals), a nd a drainag e map to help determine where spillag e s could lea v e t h (This topic is consid ere d i n m o r e d e t a i l i Section 9);

details of th e dangerous substance s o n

- s i t

c o v e r e d b y t

152Emergency Response Criteria Guidance

i n f o r m a t i o n f o r o t h e r h a z a r d o u s m a t e r i a l s h e l on site, in clu d ing: quantit ies; hazardo us properties a nd the natur e of their eff e cts on people and t h e e n v i r o n m e n t ; a n o u t l i n e o use and stor age of the materials on s i t e ; a n d outline of th e major accident hazard s . (These topics are covered in more detail in Sections 9 and 10);

details of th e technica l a d v i c e t h a t c o m p a n y c a n p r o v i d e t o d

f t h e
a n

•
a s s i s t t he emergency response

• ( a n d

s chemicals) which may

s ) ;

•

e d d

• i n i t e e m ergency pl ans, to be ta ken by ond (criterion 14.2 refers);

relevant technical deta i l s o f t h e e q u i p m e n t other resour c e s s u c h a be normally available on site and which may be available to assist the of f-site emergency services dur ing an emergency response, including re sources sup p lied from other establishme n ts with which a mutual aid agreement may e x ist (criterion 14.3 r e f e r
the function s of key posts with dutie s in the emergency response, th eir location a n d h o w they can be identified: e. g. the posts a u t h o r i s to set the e m ergency procedures in m o t i o n a n the conditio n s for doing so; the post responsible for the co-o rdination of t he on-site mitigatory action; the p o st responsible for liaisin g with the off-site emergency services (criterion 14.2 refers);

outline of th e initial a c tio n s , a n d p r o c e d u r e s t h e o n

- s site staff o n c e t h e e m e r g e n c y h a s b e e n d e c l a r e e.g. the warning of the p ublic and ad j a c e n t s i t e s , the setting u p of emergency facilitie s such as the emergency control room, and the response expected from on-site personnel (e.g. sheltering) (criterion 14.8 refers).

Elements in the Safety Repo r t N h e On-site Emergenc y Plans e c e s s a r y to Draw U p t

C The safety report should

s e

h ich

s

d ) drawing up the on-site e m ergency pl ans should be

t h e p l a n t t o limit the consequences of a major accident; r i t e r i o n 1 4 .8 The information that has been used as the basis for

s u m m a r i s e t h o measures of protection and intervention w have been used as the basis for drawing up th e on-site emergenc y pla n

(Schedule 4 Part 2, para 5 brought together in the f o rm of a summary in th e safety report and should cover:

• t h e e q u i p m e n t i n s t a l l e d i n

• the organisa tion of the alert and inter v ention;

• the on-site a nd off-site re sources that m a y b e

153Emergency Response Criteria Guidance

mobilised.

C r i t e r i o n 1 4 .9 h o u l d

e n t s

l , Operators should explain the arrangements that they

a

e applicable u n til the lo cal

p o r t s s h o u l d include conf irmation of the T h e o p e r a t o r s
c o n f i r m t h e a r r a n g e m that have been made to give information to the public, and every hospi t a school or other establishment serving the public, in the area around the site, so designated b y the competent authority

R e g u l a t i o n 1 4 ) ( have made and when the details we re sent out. This information should be sent out at int e rvals not exceeding 5 years or where changes are require d a s result of the reviews discussed below . They should also conf irm that the info rmation required by Schedule 6 has been included.

h i s c r i t e r io n w i l l n o t b T authority has prepared an off-site plan required b y COMAH.

p d a t e d r e U review arran gements for the information provided required by Regulation 14(6) every 3 y e a r s o r w h e r e there are ch anges on sit e requiring a review.

154

## 15. GLOSSAR Y
Terms defined in COMAH Regulation 2(1) and elsewhere in the regulatio ns carry the same definit ion within S R AM where used. These definition s are not repeated below.

Activities Events in the establish m ent under the control o f the occupier but not necessarily directly involved wi th the installat i ons where dangerous substance s are located. These will in clude vehicl e move ments, transport an d transfer o perations. ALARP Stands for `as low as re asonably practicable' . T he concept implies that ultimately there is a trad e-off between the costs of risk redu ction and the benefits obtained. Most deci s ion s on whether risks are A L ARP should be made by exercising prof e ssional judg ement on whether the risks are rea s onable wh en set subje c tively against the cost o f further risk reduct i o n . In some cases, a formal cost-bene fit analysis can be used which can be seen to give a more objectiv e analysis of costs against the benefits of risk reduction . The ALARP concept is sometimes referred to as BATNEEC (best availa ble technolo g y not entailing excessive cost), which is often applied in environmental contexts. Appropriate Fit-for-purpose in the par ticular con t e x t. Assessm ent In this conte x t, the process of readin g a safety report and reaching a conclusion a s to the ade quacy of the demonstration that all necessary measures have been taken to prevent major accidents or minimise their effects. Assessm ent Manager (AM) The field in spector respo n sible for co -ordinating t he various assessment tasks and ensuring tha t the conclu s ions are
com m unicated to the op erator

. Assessors The various people who will be completing the as sessment process to the satisfa c tion of the as sessment manager

. These will in clude representatives from the various disciplines with in HSE and t he Environmen t Agencies. CAS Nu mbe r A unique numbering system used to identify che m icals accor d ing to the Chemical Abstracts System scheme. Competent Authority (CA) In relation to an establishment in England and Wales, the Health and Safety Executive and Environment Agency actin g jointly. In r e lationship to an establishment in Scotland, the Health and Safety Executive and Scottish Environment Protection Age n cy acting jo intly (Regulation 2(1) refers). Conclusions The judgemental view reached by assessor s on the adequa cy of the arguments and demonstrations made in the safet y report based on prima facie assessment of a safety report. The written conclusions of the assessment team a r e sent to th e operator in accordance with COMAH reg u lation 17. Conclusions may include an agreed plan for additional a c tion by the operator. Control

measures The means for controllin g the realisa t ion of haza r ds (i.e. limiting their

occurrence probability / likeli hood) a nd for mitigating the associated consequences (e.g. a water spray system for mi tigating rele ases of anhydrous hydrogen fluoride). Controlled Waters As defined in paragraph 104 of Part III of the Wa ter Resources Act 1991. Criteria Defined sta ndards of pe rformance against which actual or pr edicted performance can be assessed.

155Demonstration of safety The process by which the operator provides information to show that all necessary measures to prevent maj o r accident s, or mitigate their effects have been taken. Enforcement The range of tools availa ble to the re gulator from advice and guidance through to le gal action. Environmen t The surroun dings aroun d, over and under an est ablishment including the flora, fau na, building s and infrast r ucture. Harm The severity of the consequences of any potential major accident for people or th e environme n t. Harm criteria Essentially dose-respon se relation ships for con v erting hazardous phenomena (spatial and temporal variations in co ntamination concentratio n , overpressure, thermal radiation) in to harm for people and the env ironment

. Hazard A physical situation with the potential for human injury, dama ge to property, damage to the environment or some combination of these. Hazard analysis The process of identifyin g undesired events that lead to a hazard being realised, the analysis of t he mechanisms by which these und esired events could occur and the estimation of their likelihood an d the magnitude of any harmfu l effects. Individual risk The frequency at which an individual may be e x p e cted to sustain a given level of harm from the realisat ion of specif ied hazards

. Inherent saf e ty The principle whereby a hazard is a v oided at source rather t han by employing measures to prevent its realisation or reduce the consequences of that re alisation a f t e r the event. Key Risk Control Sy stem s Those risk control sy st e m s which are of key importance for the prevention and mitigatio n of major accidents.

Managemen t arrangemen ts In the conte x t of health and safety at work in ge neral, the te rm applies to an employer's arrangements fo r health and sa fety manage ment and covers the elements of "policy", "organising", "planning and implementing", "measuring performance" and "a udit and review". The concept is e x plained in HS(G)65 an d the HID Inspection Ma nual. In the context of major hazards, the term applies to the operator's arrangemen ts for managing major hazards and covers the same elements but as they relate to the pr evention and mitigation of major accident i.e. "Major Accident Preven tion Policy", "organising.. .. etc". Mitigation The process of reducing the scale of the consequ ences of a major accident. Process Any operation by which dangerous substances a r e stored, tr ansferred, handled, or changed in some way. Protective sy stem An active or passive means of prote c ting plant fr om dangerous conditions either from within (e.g. overpressure) o r without (e.g. fire). Prevention The means for eliminatin g hazards or reducing th eir like lihood and for mitigating th e associate d conseque nces. This includes app roaches to inherent safety and identificatio n of suitable co ntrol measures

. Qualifying inventory or quantity The quantity of a danger ous substan c e as define d in Schedule 1 of the Regulations and used to determine the applicatio n of the various provisions o f COMAH. Residual risk The risk remaining after all proposed control measures for the establishme n t have been properly implemented

. Risk The likeliho od of a specified undesired event occurring within a specified pe riod or in sp ecified circu m stances.

156Risk analysis The process of hazard anal y s is , and the estimation of asso ciated levels of risk to people, p r operty, the environment or a combination of these. Risk

assessm ent The process of risk analy s is and the evaluation of the signif i cance of the results. Risk Control System ( R CS) A part of the overall safe ty manage ment arrangements that sets out how the SMS is applied to a specif ic task or act i vity. Risk reduction The process of risk assessment co upled to a systematic consideration of possib l e control measures and a judgement on whether they are reasonably practicable t o implement . Essentially the process for demonstrating that the a dopted contr o ls make th e risk to peo ple and the environment A L ARP

. Safety-critical An item of plant or human action is safety-critical if either it s f a ilure could cau s e or contribut e substantia lly to a major accident, o r its purpose is t o prevent or limit the eff e ct of, a major accident. An event is safety critica l if its occurr ence could lead to a sig n ificant rele ase of a dangerous substance wit h major consequences t o people or t he environment

. Safety-integrity The probability of a safet y related system satisfa c torily performing the required saf e ty functions under the stated condition within a stated period of time. Safety-related control sy st em A system which is inten ded to implement the required safet y functions needed to maintain a saf e state, and achieve, in conjunction w i th other risk reduct i o n measures, the necessary safety i n tegrity

. Safety Managemen t System (SMS) In the conte x t of major ha za r d s , the term applies to the oper ator's managemen t arrangements and key risk control s y stems re quired for the prevention and mitigation of major acciden ts, and in scope encompasses the issue s describe d in Schedule 2 of the Regulations. Scale of the hazard The severity of the worst-case sce na rio associat ed with a hazard

. Usually determined by th e loss of co ntainment of the maximu m inventory of the substan c e presentin g the hazard

. Serious deficiency When the measures for prevention and mitigatio n of a major accident are sufficien tly lacking to require pro h ibition of th e use of an establishme n t, installatio n or part thereof, as described in Re gulation 18. Societal risk The relation ship betwee n frequency and the number of people suffering from a specified level of harm in a given population from the realisation of the specif ied hazards

. Trip sy stem A means of actively ensuring that co nditions with in plant remain within safe lim its. Trip sy stem s work in as sociation with alarm systems and operate by detecting excursions bey ond alarm conditions an d controlling t he process or equipment to a define d (safe) stat e. Used correctly Suitable pro c edures or models have been applied without mistakes, including validity checks e.g. the derived estimates of event likelihood, consequences etc. (whe ther qualitative semi-qua ntitative, or quantitative) are realistic and com patible with co mpany or ot her recognised benchmarks. Verification Used in SRAM in the context of test ing the accur a cy of any a s pect of the safety report. This will be part of the in spection pro c ess after th e desk top assessment of the safet y report is complete. Worst case scenario Usually associated with the loss of containment of the maxi mum inventory of the hazardo us substan c e and the su bsequent scenario that produces th e worst outcome for people or the en vironment.

157158