BEST PRACTICE FOR THE DESIGN AND OPERATION OF HIGH HAZARD SITES

Transcription

1 BEST PRACTICE FOR THE DESIGN AND OPERATION OF HIGH HAZARD SITES Lyn Fernie and Jo Fearnley AK EHS & Risk, Aker Kvaerner Engineering Services Ltd, Ashmore House, Stockton on Tees, TS18 3RE. The idea of best practice or good practice for high hazard sites is often discussed, but what does it mean in practice? When designing a new manufacturing site, relevant good practice can be adopted at relatively low cost. However when dealing with older assets, the costs associated with demonstrating that the site was designed, built and operated in accordance with relevant good practice can be significant, especially where a review indicates that equipment upgrades are required. The speaker will discuss the issues associated with the adoption of relevant good practice for high hazard sites. In particular a case study will be utilised to outline the difficulty with defining relevant good practice and the potential costs that can be associated with a good practice improvement program. Keywords: Good Practice; Best Practice; High Hazard; Retrofit; Cost Benefit Analysis; CBA WHAT IS GOOD PRACTICE OR BEST PRACTICE? The concept of good practice is fundamental to the approach to the regulation of health and safety within the Health and Safety Executive (HSE) in the UK, and yet an industry study, (HSE, 2002), showed there is significant inconsistency in the understanding of the phrase across industry groups. Further, the differences between the meanings of good practice and best practice are not consistently understood, and people frequently use the two terms interchangeably, whereas, in relation to high hazard sites in the UK, there are specific definitions used by the HSE for both of these terms. The HSE definitions can be found in an internal HSE document, Assessing compliance with the law in individual cases and the use of good practice (HSE, 2003a). In this paper, good practice is defined as the generic term for those standards for controlling risk which have been judged and recognised by HSE as satisfying the law when applied to a particular relevant case in an appropriate manner. The term best practice is distinguished as being a standard of risk control above the legal minimum.

2 The HSE industry study (2002) also concluded that many industry respondents did not know where to find relevant good practice, and that only a minority of companies make use of cost benefit analysis when determining good practice. REGULATORY FRAMEWORK The HSE expects relevant application of good practice in order for a company to demonstrate that they have reduced risk so far as is reasonably practicable (SFAIRP). There is an hierarchy of health and safety law and this reflects the sources of data (HSE, 2003a). The duty of care requirements are detailed in the Health and Safety at Work Act (HSW Act) 1974, and this is only limited by the SFAIRP principle. This is supported by other legislation such as the Management of Health and Safety at Work Regulations Beneath this are a series of mandatory regulations, which fall into the categories of process, goal-setting and standard-setting, and then there are approved codes of practice (ACoPs), and guidance literature, including Health and Safety guidance (HS(G)). The use of European standards supports the trend towards goal-setting rather than prescriptive regulation. European directives establish broad requirements and identify appropriate standards to achieve their aims. UK national regulations typically adopt these broad requirements within the existing legislative framework but also permit organisations to meet the aims in their own way. However, organisations will need to demonstrate that their methods are as effective as those given in the guidance or ACoP, which can be considered as a best practice document. For high hazard sites, in particular those subject to the Seveso II Directive (EC, 1996), implemented in the UK as the Control of Major Accident Hazards (COMAH) Regulations 1999 (SI, 1999), it is expected that the operator has a complete understanding of all the relevant good practice (RGP) related to the site, activities and chemicals concerned. To help this process the Safety Report Assessment Guides, including the Technical Aspects - Level 3 Guidance (HSE, 2004a) have a cross reference listing of documentation, including ACoPs, HS(G)s and European and British standards. Regulation 4 of the COMAH Regulations requires operators to take all measures necessary (AMN) to prevent major accidents. This is interpreted as the equivalent of reducing risks as low as reasonably practicable (ALARP). Reasonably practicable means that everything must be done to reduce a risk to its lowest possible level, except where the cost of the risk reduction is excessive compared to the size of the risk reduction (HSE, 2004b). The term excessive is usually refered to as grossly disproportionate. TOLERABILITY OF RISK Three regions of risk are defined, delineated by an unacceptable region and a broadly acceptable region; the region in between defining a region of tolerable risk, but only when those risks are ALARP.

3 The HSE s decision making process Reducing Risks, Protecting People (HSE, 2001a) makes some important statements of principle: Principle 1 HSE starts with the expectation that suitable controls must be in place to address all significant hazards and that those controls, as a minimum, must implement authoritative good practice irrespective of situation based risk estimates. Principle 2 The zone between the unacceptable and broadly acceptable regions is the tolerable region. Risks in that region are typical of the risks from activities that people are prepared to tolerate in order to secure benefits in the expectation that: The nature and levels of the risks are properly assessed and the results used properly to determine control measures; The residual risks are not unduly high and kept as low as reasonably practicable (the ALARP principle); and The risks are periodically examined to ensure that they still meet the ALARP criteria, for example, by ascertaining whether further or new controls need to be introduced to take into account changes over time, such as new knowledge about the risk or the availability of new techniques for reducing or eliminating risks. Any risk assessed as unacceptable must be reduced, and cost considerations are not relevant. If the risk has been shown to be in the broadly acceptable region, then the ALARP demonstration may be based on the adherence to codes, standards and established good practice. However these must be shown to be up-to-date and relevant to the operations in question. If the risk has been shown to be in the tolerable region, then the ALARP demonstration needs to be based on the adherence to codes, standards and established good practice, but also on the concept that more can be done to reduce risk. Where further measures can be identified that may reduce the risk, and if the measure is determined to be prima facie reasonable based on engineering considerations, and it cannot be shown that the cost of the measure is grossly disproportionate to the benefit gained, then the operator is duty bound to implement that measure. RELEVANT GOOD PRACTICE When identifying relevant good practice (RGP) for a site it is necessary to establish how the legislation and regulations relate to the site. Further, all relevant ACoPs and HS(G)s need to be identified, and then all other documentation such as European, government, industry, trade and engineering standards. The level of written detail on

4 good practice available reflects the nature of the hazards and risks concerned and the complexity of the process or activity. Some good practice may be unwritten, such as well established standard practices adopted in an industry sector, although common custom and practice should not be assumed to be good practice. Good practice is expected to maximise the use of inherent safety, to eliminate or avoid risks where possible, and to control the risk at source physically if possible. It should also minimise the need for procedural controls and personal protective equipment. Good practice may change over time as a result of experience, changes in management practices, cost base improvements, or technological advances, which could all change the expectation of what is established good practice (HSE, 2003a). Therefore it should not be assumed that what was once good practice remains so indefinitely. If an operator wishes to use a different approach to controlling the risk to that in the relevant good practice then they must demonstrate that the residual risk is no greater than that if the good practice had been implemented. Good practice is relevant to risks across the entire site, and each plant section is typically assessed separately, and then a composite view of the site risks compiled, which includes general site risks. As a result there may be a wide variety of good practice that needs to be considered. EXPECTATIONS FOR HIGH HAZARD SITES For a high hazard situation, for example where there is a potential for a large number of people to be harmed in a single event, then meeting good practice alone may be insufficient and additional risk reduction measures may be necessary to reduce the risks ALARP (HSE, 2003a). These should be assessed using cost benefit analysis to identify those which are proportionate, and those which are grossly disproportionate. Where there is a requirement for environmental protection this may constrain the options available for controlling the health and safety risks, and drive the selection of relevant good practice. Where risks arise from uncontrollable external events, such as natural phenomena, then it is the mitigation of the consequences arising that needs to be considered. The process for determining reasonably practicable is: Identify accident scenarios and the relevant measures to prevent, control and mitigate the risks arising for the site. It is not expected that all minor scenarios are considered individually in detail, but only those that have a reasonably foreseeable cause of harm. Those with both on- and off-site consequences need to be identified. When considering societal and individual risks for a site, all

5 contributing plant areas need to be considered together, rather than considering individual hazards. Identify relevant good practice for the whole site, for example relating to the chemicals, the processes and the activities. Implement good practice, unless another equally effective means of risk reduction can be identified. Determine if there are any additional risk reduction measures for the risks identified. Determine whether these additional risk reduction measures are reasonably practicable, i.e. that the associated costs are not grossly disproportionate. Implement those which are reasonably practicable 1. INCORPORATING GOOD PRACTICE INTO NEW PLANT DESIGN When assessing compliance, the HSE expects operators to apply relevant good practice as a minimum for new plant / installations or modification to existing sites (HSE, 2003a). In addition, other potential options for further risk reduction should be considered if they are reasonably practicable, i.e. not grossly disproportionate. Further, it is expected that the design should consider any higher standards that are already being achieved in a similar field elsewhere, which is the current best practice. This reflects the expectation for improvement in standards over time (HSE, 2003b). The consideration of best practice, rather than good practice, is therefore the requirement during the design phase. The design stage of a process is expected to consider inherent safety, such as elimination, reduction and prevention of hazards and risk scenarios, in preference to the need to control and mitigate the consequences. Design encompasses various aspects, from concept selection through to detailed specification, and best practice is expected to consider not just the items of plant equipment, but also all buildings and facilities, the process route selected, the safe limits of operation, man-machine interfaces and other human factor aspects. Consideration of best practice at design stage is also expected for the management system, including roles and responsibilites, procedures for operation and maintainence, training, record keeping, quality assurance and quality control. It is necessary to consider the whole life-cycle for the proposed installation including construction, commissioning, operation, maintenance and decommissioning (HSE, 2003b). There is also the requirement for risk assessment for a high hazard plant. Where a variety of options or techniques exist for assessing risk, then a range of techniques should be used to test the sensitivity of the results. For a new plant it is often not easy to differentiate the costs of good and best practice. Where it is necessary to justify an additional risk reduction measure by a cost benefit analysis then each option should be 1 Note that some risk reduction may be reasonably practicable when applied to specific plant areas rather than across whole the site.

6 assessed by difference compared to the initial cost basis, to determine if any are reasonably practicable to achieve. It is important that the overall risk from the whole site is considered, especially for a high hazard complex, rather than each area being assessed independently (HSE, 2001b). One reason for this is that there is a potential that a risk reduction measure implemented to address one hazard could affect a different hazard elsewhere or an associated risk control measure. Another reason is that risks could be increased by escalation on-site or domino effects off-site. Opportunities for integrated risk reduction measures therefore need to be considered. ASSESSING EXISTING PLANT AGAINST GOOD PRACTICE For an existing plant or installation the HSE maintain the same base standard as for new plant, i.e. that the relevant good practice should be applied. This applies also to retrofits, modifications, upgrades, when completing safety reviews, and when a code or standard is upgraded to a higher level of safety. In judging compliance for existing plant the HSE will be looking for the application of current good practice to the extent necessary to satisfy the relevant legislation and regulations. It is accepted that it might not be reasonably practicable for all good practices or upgrades to good practices to be applied retrospectively to existing plant, however each should be considered, either in full, or as a partial solution, or by considering an alternative risk reduction measure. For an existing facility the existing measures should be compared to the relevant good practice, and any deficiencies identified. To enable a decision as to whether a retrofit is reasonably practicable in order to meet the good practice, it is necessary to complete the accident scenario risk assessment and assess the reduction in risk from the retrofit of the identified good practice measure. The decision is based on a comparison with the current situation, and various options are compared to the same base case. When considering whether a plant meets the ALARP criteria the HSE will prioritise the compliance with good practice by how tolerable the current situation is. Hence any risk assessed as unacceptable must be reduced, and cost considerations are not relevant. Risks in the tolerable region are acceptable if they can be proved to be ALARP, i.e. the cost of implementation of additional risk reduction measures is grossly disproportionate to the reduction in risk achieved. Where a risk is assessed as broadly acceptable there is less driving force to implement further risk reduction measures, if the likelihood of reducing the risk further is small. The cost benefit analysis for determining whether an improvement is reasonably practicable is a comparison between the reduction in risk achieved and the cost involved (in money, time and effort) (HSE, 2001b). The value above which the cost becomes grossly disproportionate will differ for each site, dependant on the level of total risk

7 from the site. The higher the risk from the site, in particular, in terms of the maximum number of potential fatalities from an accident scenario, the higher this value will be. CASE STUDY FOR AN EXISTING INSTALLATION In order to complete the COMAH Safety Report for an existing site, information was required to enable an assessment of the compliance with the current relevant good practice to be carried out. As detailed information was sparse for the ageing and neglected assets, it was necessary to start with some fundamental reviews. There were no recent records of hazard and operability studies, therefore for each asset on the site a process hazard identification and review (PHIR ) was carried out. This enabled a fundamental assessment to be made of the potential accident scenarios associated with the chemicals handled, the process used and the equipment employed in the process. The site handles a variety of chemicals with several processing routes, so when the PHIR documentation was compiled there was a very diverse range of potential scenarios. Of these, one material was identified as giving rise to the most severe consequences due to the hazardous nature of the material and the processing conditions. As a result this plant area was risk assessed as a priority as it would give the worst case accident scenario. This is turn would provide the data to enable the societal risk for the site to be assessed, and hence the benchmark could be set for the proportionality of the site and the level of gross disproportionation used in the cost benefit analysis established. For each plant area, the PHIR enabled the identification of the accident scenarios for that plant. A representative set of accident scenarios was selected, and a full risk assessment carried out, including consequence modelling for fire, explosion and toxic hazards, severity assessment (number of fatalities), frequency assessment and risk summation to asses the individual and societal risks. Once the level of risk and therefore the proportionality for the site had been determined, the representative set of accident scenarios could be further assessed considering ALARP principles. After all processes and activities were fully understood it was possible to review whether all the RGP for the site had been identified. This required that all plant areas, all chemicals handled and all the activities carried out on the site were considered. The sources of RGP consulted included ACoPs, HS(G)s, and Chemical Industry Association (CIA) and American Petroleum Institute (API) guidance. In addition a variety of standards were consulted, such as British (BS), International Standards Organisation (ISO), European Norm (EN) standards. Additional information was sourced from trade and industry bodies, HSE guidance, manufacturer guidelines, and other operators established practice. The next step was to identify the shortfalls against relevant good practice through the use of a series of technical audits leading to production of a gap analysis against the identified RGP benchmarks. It was then necessary to consider how the implementation

8 of improvement measures to address each of the identified gaps versus good practice would reduce risk for one or more of the representative set of accident scenarios. Once all the potential risk reduction elements of good practice that had been identified had been assessed, the residual risk levels were noted. In order to justify whether these risks were ALARP they needed to be reviewed in the light of the residual level of tolerability and any other potential risk reduction measures, such that AMN had been considered. To do this a site meeting with a multidisciplinary team of key personnel used a systematic methodology to determine any other potential risk reduction measures for each of the representative accident scenarios. Risks remaining in the unacceptable region were assessed specifically as a reduction in risk was required regardless of cost. For the other scenarios the achievable risk reduction was compared to the cost of implementation to determine if the measure was proportionate or grossly disproportionate. The outcome of these assessments was a list of recommendations and improvement actions for the site to implement good practice, or implement other risk reduction measures, and so achieve a site where the risks are ALARP. The costs of implementation were based on +/- 50% cost estimates. As each project was progressed through design, the final costs were clarified, and where these were significantly higher than the value used in the process, the assessment was repeated to validate the viability of progressing at an increased cost. For one area of the site, the level of unacceptability of risk from the current operating process was such that it was viable to completely review the process route being used, in the light of current best practice as opposed to good practice. Comparative solutions were identified based on upgrading the existing process route to good practice and retrofitting a completely different process route that was considered best practice. This fundamental process route review outcome is very unusual, but it does indicate how the complications of retrofitting good practice to an existing plant can be so expensive that radical options are worth considering.

9 CONCLUSIONS The concept of good practice is fundamental to the approach to the regulation of health and safety management yet there is significant inconsistency in the understanding of the phrase across industry groups. Further, the differences between the meanings of good practice and best practice are not consistently understood, and people frequently use the two terms interchangeably. The HSE defines good practice as the generic term for those standards for controlling risk which have been judged and recognised by HSE as satisfying the law when applied to a particular relevant case in an appropriate manner, and best practice is distinguished as being a standard of risk control above the legal minimum. The relevant application of good practice is expected by the HSE for a company to demonstrate that they have reduced risk so far as is reasonably practicable (SFAIRP). The HSE starts with the expectation that suitable controls must be in place to address all significant hazards and that those controls, as a minimum, must implement authoritative good practice irrespective of situation based risk estimates. Any risk assessed as unacceptable must be reduced, and cost considerations are not relevant. If the risk has been shown to be in the broadly acceptable region, then the ALARP demonstration may be based on the adherence to codes, standards and established good practice. However these must be shown to be up-to-date and relevant to the operations in question. If the risk has been shown to be in the tolerable region, then the ALARP demonstration needs to be based on the adherence to codes, standards and established good practice, but also what more can be done to reduce risk. The level of written detail on good practice available reflects the nature of the hazards and risks concerned and the complexity of the process or activity. Some good practice may be unwritten, such as well established standard practices adopted in an industry sector, although custom and practice should not be assumed to be good practice. Good practice may change over time therefore it should not be assumed that what was once good practice remains so indefinitely. There may be a wide variety of good practice that needs to be considered. For a high hazard situation meeting good practice alone may be insufficient and additional risk reduction measures may be necessary to reduce the risks ALARP. These should be assessed using cost benefit analysis to identify those which are proportionate, and those which are grossly disproportionate. It is expected that new designs should consider any standards beyond good practice that are already being achieved elsewhere, which is the current best practice in a similar field. The consideration of best practice, rather than good practice, is therefore the requirement during the design phase. In judging compliance for existing plant, the HSE will be looking for the application of current good practice to the extent necessary to satisfy the relevant law. It is accepted that it might not be reasonably practicable for all good practices or upgrades to good

10 practices to be applied retrospectively to existing plant, however each should be considered, and justification is required for not implementing a measure. For each site, dependant on the level of total risk from the site, the value above which the cost becomes grossly disproportionate will change. The higher the risk from the site, in particular, in terms of the maximum number of potential fatalities from an accident scenario, the higher this value will be. If the current operating process has unacceptable residual risk level then it may be viable to completely review the process route being used in the light of current best practice, as opposed to good practice. The complications of retrofitting good practice to an existing plant can be so expensive that radical options are worth considering. REFERENCES EC, Council Directive on the control of major-accident hazards (OJ No L 10 of 14 January 1997( Seveso II Directive) 96/82/EC. SI, The Control of Major Accident Hazards Regulations 1999 Statutory Instrument 1999 No Norwich: HMSO HSE, 2001a. Reducing risks, protecting people HSE s decision making process. Norwich: HMSO HSE, 2001b. Principles and guidelines to assist HSE in its judgements that duty-holders have reduced risk as low as reasonably practicable [online]. Available from: [Accessed 24 November 2004]. HSE, A survey of UK approaches to sharing good practice in health and safety management CRR412. Norwich: HMSO HSE, 2003a. Assessing compliance with the law in individual cases and the use of good practice [online]. Available from: [Accessed 24 November 2004]. HSE, 2003b. Policy and guidance on reducing risks as low as reasonably practicable in Design [online]. Available from: [Accessed 24 November 2004]. HSE, 2004a. Safety report assessment guidance (Technical Guidance) [online]. Available from: [Accessed 24 November 2004]. HSE, 2004b. Frequently asked questions [online]. Available from: [Accessed 24 November 2004].