Remotely operated

for emergency isolation of hazardous substances

shutoff valves (ROSOVs)

Remotely operatedshutoff valves (ROSOVs)for emergency isolation of hazardous substances

HSE BOOKS

© Crown copyright 2004First published 2004

ISBN 0 7176 2803 5

All rights reserved. No part of this publication may bereproduced, stored in a retrieval system, or transmittedin any form or by any means (electronic, mechanical,photocopying, recording or otherwise) without the priorwritten permission of the copyright owner.

Applications for reproduction should be made in writing to:Licensing Division, Her Majesty's Stationery Office,St Clements House, 2-16 Colegate, Norwich NR3 1BQor by e-mail to hmsolicensing@cabinet-office.x.gsi.gov.uk

Rem

otel

y op

erat

ed s

huto

ff va

lves

(R

OS

OV

s) f

or e

mer

genc

y is

olat

ion

of

haza

rdou

s su

bsta

nces

Contents

IntroductionWhat is a remotely operated shutoff valve?Who is this guidance for?Why is there a need for guidance?Lessons from the Associated Octel fireHSE responseHow HSE uses good practice in assessing complianceHow to use this guidanceMeeting the standardALARP demonstration

Con

tent

s

Scope of the guidanceHazardous substances includedActivities includedTopics excluded

Assessing your siteHierarchy of measuresNew installationsExisting installationsReasonable practicabilityPrecautionary approachWhen to consider fitting a ROSOVBenefits of ROSOVsPersonal protective equipmentBundingDual hazard substances and mixtures

The selection criteriaHow do the selection criteria work?The primary selection criteriaThe secondary selection criteria

Selection and operation of ROSOVsActivationTypes of valvesActuatorsFailure modeExternal hazardsConsequential hazardsDual function valvesExcess flow valvesReliability and integrity

Appendix 1 A case-specific assessment of the reasonablepracticability of a ROSOV

Appendix 2 Summary of relevant legal requirements

References and useful addresses

15

29

30

12121212121313131314

10101011

77777888899

5556

1111122344

Introduction

What is a remotelyoperated shutoff valve?

Why is there a needfor guidance?

Intr

oduc

tion

1. In this guidance a remotely operated shutoff valve(ROSOV) is defined as:

2. Valves performing the same or similar function mayalso be referred to as: emergency isolation valves(EIVs); remotely-operated block valves (RBVs); oremergency shutdown valves (ESDVs).

3. This guidance will help you identify the need for remoteisolation of hazardous substances using ROSOVs, aspart of your emergency arrangements for the safe andcontrolled shutdown of plant and equipment.

Who is this guidance for? Lessons from theAssociated Octel fire4. This guidance is issued by the Health and Safety

Executive (HSE) to assist duty holders in complyingwith relevant health and safety law. Following theguidance is not compulsory and you are free to takeother equally effective action.

5. The guidance is for operators and managers ofhazardous installations handling, storing or processingthe hazardous substances detailed in the scope. It willalso be of interest to plant supervisors, design, process,and maintenance engineers and safety professionals.

6. Throughout this guidance references to theimplementation of a ROSOV should be taken to meana ROSOV or other equally effective measures that willachieve an equivalent degree of risk reduction. Allpublished material is listed in the References anduseful addresses section and titles appear in italics.

12. One of the conclusions of the Associated Octel reportwas that the incident escalated rapidly because it wasnot possible to stop the initial release. This problemcould have been avoided if ROSOVs had beeninstalled (as they were elsewhere on the site). Thereport described a number of lessons to be learnedfrom the incident including the following, which relatedirectly to the provision of ROSOVs:

'Lesson 5: As part of their comprehensive riskassessments, companies in control of chemicalprocess plant at major hazards sites should criticallyreview the provision of ROSOVs at both storage andprocess vessels in which significant inventories ofdangerous substances are held.

7. In an emergency, rapid isolation of vessels or processplant is one of the most effective means of preventingloss of containment, or limiting its size.

8. This guide gives you simplified criteria for decidingwhen you need to provide a facility for remote isolation.

9. The appendices include guidance on how to make acase-specific assessment of the reasonable practicabilityof retrofitting a ROSOV to an existing installation.

10. The provision of ROSOVs was highlighted by the HSEinvestigation into an incident at the Associated OctelCompany Limited at Ellesmere Port in February 1994.The findings of the investigation into this incidentwere published by HSE in 1996: The chemical releaseand fire at the Associated Octel Company Limited.1

11. Another incident that has contributed to the drive forguidance on ROSOVs was the fire on the fluidisedbed catalytic cracking unit at the BP GrangemouthRefinery in June 2000. A report on the incident isavailable on the HSE website onwww.hse.gov.uk/comah/bpgrange/contents.htm

A valve designed, installed and maintained for theprimary purpose of achieving rapid isolation ofplant items containing hazardous substances in theevent of a failure of the primary containment system(including, but not limited to, leaks from pipework,flanges, and pump seals). Closure of the valve can beinitiated from a point remote from the valve itself. Thevalve should be capable of closing and maintainingtight shutoff under foreseeable conditions followingsuch a failure (which may include fire).

Lesson 6: HSE, in conjunction with other interestedparties, should develop and publish additionalguidance on the provision of ROSOVs and othermethods of mitigating risks on process plant.'

HSE response13. In response to Lesson 6, interim guidance on the

general principles of isolation of hazardoussubstances was published by HSE: ChemicalsInformation Sheet No 2 Emergency isolation ofprocess plant in the chemical industry.2

How HSE uses goodpractice in assessingcompliance14. The law requires that you undertake a suitable and

sufficient risk assessment to determine the measuresnecessary to ensure that risks to health and safety areadequately controlled.

15. HSE expects suitable controls to be in place to addressevery significant hazard and that as a minimum thosecontrols must achieve the standard of recognised goodpractice precautions for your industry.

16. HSE inspectors seek to secure compliance with thelaw and may refer to relevant codes, standards andguidance as illustrating good practice.

17. HSE's publication Reducing risks, protecting people(R2P2)3 and the supporting document Assessingcompliance with the law in individual cases and theuse of good practice4 discuss HSE's policy on therole of good practice. The latter includes a definitionof good practice in this context. Both areavailable on the HSE website at www.hse.gov.uk

18. Adopting relevant good practice precautions for yourindustry is a straightforward way to demonstrate thatyou are controlling risks effectively. It frees you fromthe need to take explicit account of the costs andbenefits of each individual risk control measure(system of work, item of hardware etc). These will havebeen considered when the good practice wasestablished. However, this does not mean that you willnever need to do any more to satisfy the law. You stillhave a duty to consider if there is anything about yourcircumstances that means further action is necessary.

19. HSE considers that this guidance represents goodpractice for emergency isolation within the limitations ofthe scope. However, the guidance is under continuousreview and advances in technology or new knowledgeof hazards may lead HSE inspectors to seek a higherstandard in some cases - the standard set here should,therefore, be regarded as the minimum.

Intr

oduc

tion

How to use this guidance20. The flowchart in Figure 1 summarises how to apply this guidance to identify where ROSOVs should be provided.

Intr

oduc

tion

Figure 1 How to apply ROSOVs

Familiarise yourself with the guidance including the Scope ofapplication, the relevant Legal duties and the advice on

Are your circumstances wholly within the Scope of thisguidance - as stated in paragraphs 34-51?

YES

NO

NO

YES

A

B

NO

Apply the Primary Selection Criteria - Paragraph 101.Are ALL of the primary criteria satisfied?

If ANY of the primary criteria are NOT satisfied then youshould follow EITHER Option A or Option B.

Refine the assessment by applying the SecondarySelection Criteria - Paragraph 102.

Do ANY (one or more) of these secondary criteria apply?

NEW

YES

EXISTING

Although you may find the general advice given on the factorsto be considered when deciding whether or not to provide aROSOV useful: eg for other substances not included in thescope, the selection criteria may not be entirely appropriate andyou should either refer to other relevant Good Practiceguidance where this exists or make a case-specific riskassessment to determine whether or not ROSOVs are required.

If ALL of the primary criteria are satisfied then this indicatesthat risks are sufficiently low that a ROSOV is unlikely to be areasonably practicable precaution. You should of coursesatisfy yourself that there is nothing clearly exceptional aboutyour circumstances that would invalidate this conclusion.

Adopt a precautionary approach and fit a ROSOV.

A ROSOV will provide a tangible improvement in safety.A more detailed analysis may be costly in itself and may stilllead to the conclusion that fitment is reasonably practicable.

If NONE of the secondary criteria apply then this indicatesthat risks are sufficiently low that a ROSOV is unlikely to be areasonably practicable precaution. You should of coursesatisfy yourself that there is nothing clearly exceptional aboutyour circumstances that would invalidate this conclusion.

If ANY of the secondary criteria apply then a ROSOV oranother equally effective measure should be implemented inthe design of a new installation in order to meet the minimumstandard required by Good Practice.

C

NO

D

For an EXISTING installation, when ANY of the secondarycriteria apply then you should follow EITHER Option C or

Option D.

Are you considering the inclusion of ROSOVs in a NEW orEXISTING installation?

Adopt a precautionary approach and fit a ROSOV.

A ROSOV will provide a tangible improvement in safety.A suitable and sufficient analysis of the costs and benefitsmay be costly in itself and may still lead to the conclusionthat fitment is reasonably practicable.

Where the Costs are NOT Grossly Disproportionate - Fit aROSOV.

Document your Conclusions & Review when Appropriate

Having applied this guidance to your installation you shouldinclude your conclusions regarding provision for emergencyisolation as part of your statutory risk assessment. Theassessment should be reviewed at appropriate intervals, andparticularly whenever there is reason to suspect that therehas been a change that may affect the conclusions.

Where the Costs ARE Grossly Disproportionate to theBenefits - then a ROSOV is not a reasonably practicable

measure.

YES

In some cases the additional costs associated with retrofittingmay shift the balance of the cost/benefit computation.

Complete a Case-Specific Demonstration (See Appendix 1).

Appendix 1 gives guidance on what HSE would expect to see ina demonstration that retrofitting is not reasonably practicable in aparticular case.

Are the Costs of providing a ROSOV (or other equally effectivemeasures...) grossly disproportionate to the Benefits achieved?

Assessing the need for ROSOVs.

Meeting the standard ALARP demonstration21. You should compare the provision for emergency

isolation on your site against the selection criteria andidentify any areas where the precautions in place donot meet the standard described in this guidance.

22. Unless the selection criteria indicate otherwise,ROSOVs should be incorporated into the design of anew installation.

23. In the case of an existing installation ROSOVs shouldbe provided unless you can demonstrate thatretrofitting is not 'reasonably practicable' in thecircumstances (see Appendix 1).

24. A phased, prioritised programme of upgrading may beappropriate. If necessary you can discuss with theHSE proposed work arising from your assessments.Where you consider that you have identified alternativebut equally (or more) effective means to control therisk you should document these conclusions as part ofthe record of your statutory risk assessment.

25. This risk assessment needs to be kept under review.Changes in understanding of the risk, or reductions inthe costs of implementing the measure, may shift thebalance of the cost/benefit equation.

26. Following this good practice guidance does not meanyou will need additional documented demonstrationsof safety. If you use other equally effective measuresinstead of a ROSOV, there is no need to perform aseparate assessment. Your demonstration that themeasures actually in place make risks as low asreasonably practicable (ALARP) is all that is needed.

27. If you cannot demonstrate that you have other equallyeffective measures on site and you do not have aROSOV where one is indicated by this guidance thenyou should be able to show that fitting a ROSOV is notreasonably practicable.

28. Appendix 1 of this guidance gives additional advice ondemonstrating reasonable practicability. Appendix 2summarises some of the relevant legal requirementsrelating to the recording of risk assessment findings ingeneral and the more detailed requirements imposedon some duty holders under the Control of MajorAccident Hazards Regulations 1999 (COMAH).5

29. If a detailed risk assessment shows that upgrading isnot reasonably practicable then the basis for thisconclusion should be documented as part of yourassessment record.

30. This guidance is limited to a consideration of a singlerisk reduction measure - the provision for emergencyisolation. This may be only one of a number ofmeasures necessary to make the risk from a particularhazard ALARP.

31. Where it can be shown that conformance with goodpractice results in risks being reduced to the'broadly acceptable' level (see R2P2)3 then this willnormally be accepted as demonstrating compliancewith the law.

32. Where the residual risk remains higher, in the'ALARP region' (R2P2)3 then you should continue toseek further reasonably practicable risk reductionmeasures and, where applicable, to include these aspart of your ALARP demonstration.

33. Good practice that covers all the risks from yourwork activity may not be available, so if you arerequired to make an explicit ALARP demonstration,a more rigorous analysis may be needed todemonstrate that all measures necessary havebeen implemented.

Introd

uctio

n

Scope of the guidance

Hazardous substancesincluded

Activities included

34. This guidance is limited to operations involving thestorage, transfer, or processing of substances that are:

classified under the Chemicals (HazardInformation and Packaging for Supply)Regulations 2002 (CHIP)6 as flammable, highlyflammable, extremely flammable, toxic or verytoxic; andliquids or gases under the conditions of storageand/or processing.

35. The general advice on what you should considerwhen deciding whether or not to provide a ROSOVmay also be useful in the context of otherhazardous substances. However, these othersubstances were not considered in setting thedecision criteria and so the specific result might notbe appropriate in every case.

36. When deciding if you need to provide ROSOVs forsubstances not included in the scope of thisguidance, you should either:

chemicals along with their EC-agreed classifications.This may include intermediates that are not 'supplied'and, therefore, would not be subject to CHIP. To applythis guidance you will need to self-classify thesubstance according to the method described in theCHIP Approved classification and labelling guide6 as if itwere intended for supply.

40. Some substances may have dual classification. Forsubstances with both flammable and toxic propertieseach hazard should be assessed separately. If differentstandards are indicated then the higher standard shouldbe adopted.

41. This guidance may lead you to conclude that a ROSOVis not a reasonably practicable measure for the controlof risks to health and safety. However, the EnvironmentAgency (EA) or the Scottish Environment ProtectionAgency (SEPA) may still require you to provide forremote isolation of dangerous substances to protect theenvironment. For details of how to contact the EA andSEPA see References and useful addresses section.

Sco

pe o

f the

gui

danc

e

Onshore installations

refer to other good practice guidance written forthat substance or category of substances; orundertake your own case-specific risk assessment.

37. Appendix 1 is a useful guide for making a case-specific risk assessment. However, you will need toconsider explicitly the hazardous properties (physical,chemical and toxicological) of the substances youuse if the risk assessment is to be suitable andsufficient.

38. Some higher flashpoint substances not classifiedunder CHIP as flammable are stored or processed attemperatures above their flashpoint, or underelevated pressures. These may be capable of forminga flammable atmosphere following loss ofcontainment. This guidance will also be useful indeciding whether or not to provide for remoteisolation of substances in this category where morespecific guidance does not currently exist.

39. Some substances will not be included in the currentCHIP Approved supply list,7 which lists dangerous

42. This guidance is applicable at onshore installationsincluding chemical manufacturing sites, petrochemicalfacilities and sites engaged in the storage anddistribution (excluding long distance pipelines) ofhazardous substances.

43. The guidance may be applied at all onshore facilitieswhere storage, transfer or processing of the specifiedcategories of substances takes place, irrespective ofwhether the site is subject to the requirements ofCOMAH.

Petroleum dispensing

44. Petroleum retail is subject to a licensing regime and isoutside of the scope of this guidance. The provision oftechnical measures including means of safe isolation inan emergency is covered by specific guidance and,where appropriate, by licence conditions.

45. However, this guidance is applicable where the non-retail dispensing of fuel into vehicles takes place, egduring vehicle manufacture.

Offshore installations and transmissionpipelines (on or offshore)

46. This guidance was produced specifically for use bythe onshore sector. Offshore installations, andpipelines covered by the Pipelines SafetyRegulations 1996,8 are subject to specificlegislation that includes explicit requirements forremote operation of plant, including emergencyshutdown valves. For example, the OffshoreInstallations (Prevention of Fire and Explosion, andEmergency Response) Regulations 1995(regulation 12)9 and the Pipelines SafetyRegulations 1996 (regulation 19).8

Topics excluded47. This guidance does not give detailed advice on

measures for process control or pressure reliefarrangements (including reactor depressurisation andthe 'dumping' or 'quenching' of runaway reactions)and the following issues are excluded.

Specification of valves

48. Advice on suitability of valves to perform a particularduty, including appropriate materials of construction,should be sought from your supplier or manufacturer.

Maintenance

49. It is frequently necessary to isolate plant containinghazardous substances to allow for maintenance. Therequirements for safe isolation for these purposes arenot covered here. Advice on this topic may be foundin HSE's The safe isolation of plant and equipment.10

Detection systems

50. This guidance does not consider in any detail thedetection systems that are a necessary component ofa system for automatic activation of ROSOVs(automatic shutoff valves, ASOVs).

Control of exothermic reactions

51. There is a role for remotely operated valves in the controland emergency shutdown of exothermic reactions toavoid runaway. The use of ROSOVs for these purposesis outside of the scope of this guidance, but advice canbe found in the HSE publication Designing and operatingsafe chemical reaction processes.11

Sco

pe o

f the

gui

danc

e

Assessing your site

Hierarchy of measures52. You should be able to demonstrate that you have

considered a hierarchy of measures:

Inherently safer options (such as substitution of ahazardous substance by a less hazardous one,reducing the quantity of the substance stored orprocessed etc).Options for prevention and control of loss ofcontainment (such as preventive maintenance,inspection, testing etc).Mitigation measures (such as ROSOVs and bunding).

53. For existing installations, options for inherentlysafer processes will be more limited. You shouldstill give priority to measures that prevent or limitloss of the hazardous substance from the primarycontainment over mitigation measures such assecondary containment.

54. The guidance applies to both new and existing installations.

New installations55. The design of a new installation should fully conform to

the good practice set out in this guidance.

Existing installations56. For existing installations where the current provision

does not meet the standard set out in this guidance,you should upgrade the installation so far as isreasonably practicable. Take your current situation asthe starting point, when you assess the risk to bereduced, for comparison with the cost of achieving thatreduction. You may take account of any measures thatare already in place when establishing the present levelof risk (without a ROSOV). However, the measuresmust be effective against the same containmentfailures, for example:

where items of plant are bunded there may be longruns of interconnecting pipework outside the bund;a ROSOV close to the plant item will provideprotection wherever a pipework failure occurs butbunding will only mitigate releases that occurwithin the bunded area.

the benefits arising from the reduction in riskachieved by particular measures; andthe cost in time, money or trouble ofimplementing those measures.

Reasonable practicability

57. It is recognised that there may be additional costsassociated with retrofitting measures to existinginstallations and that it is appropriate to consider theseextra costs when reaching a decision on reasonablepracticability. In R2P23 Appendix 3 includes a discussionof the relevant cost and benefits to be considered.

58. Some of the additional costs associated with retrofitting,such as downtime and loss of production, can be minimisedby co-ordinating the retrofitting with planned maintenance,refurbishment or upgrading of the installation.

59. HSE considers that duties to ensure health and safetyso far as is reasonably practicable (SFAIRP) and dutiesto reduce risks as low as is reasonably practicable(ALARP) are equivalent. Each calls for the same set oftests to be applied.

60. The requirement under COMAH to take 'all measuresnecessary' to prevent major accidents and limit theirconsequences is interpreted as meaning that the risksfrom major accident hazards should be reduced to ALARP.

61. In some circumstances the risks from a particularhazardous activity may be so high as to be unacceptablefor all practical purposes, whatever the associated levelof benefits. Conversely, when the level of risk isinherently very low or has been made very low by theapplication of suitable controls, then for most practicalpurposes the risk can be regarded as insignificant. HSEwould not normally seek further risk reduction measures,as the resource required would be disproportionate tothe risk. However, where further reasonably practicablerisk reduction measures can be identified then the lawrequires that these be implemented.

62. Between these two extremes, a given level of risk from ahazardous activity may be judged tolerable for thebenefits that the activity brings, provided that the risk ismade ALARP.

63. Where the risks are tolerable, if ALARP you shouldcompare:

Ass

essi

ng y

our

site

64. Only where there is a 'gross disproportion' between thetwo, ie the risk reduction being insignificant in relation tothe cost, can the measures be ruled out as notreasonably practicable.

65. Further discussion of the tolerability of risk and the principleof ALARP can be found in the HSE publication R2P2.3

71. Together these factors represent the risk. The reductionin risk is the benefit that must be balanced against thecost of providing the facility.

Benefits of ROSOVsToxic hazards

72. For toxic hazards ROSOVs can have a significantbenefit by reducing the extent of the hazard so thatfewer people are exposed. However, since theROSOV may fail on demand, the risk is reduced butnot eliminated.

73. Also, people on site may be within the hazard rangeirrespective of whether the release is terminatedrapidly by a ROSOV or is more prolonged due toreliance on manual isolation. However, even in thesecases, terminating the release more rapidly willreduce their exposure.

74. Providing a remote (or automatic) activation facility willavoid employees having to deliberately enter a toxicatmosphere to effect isolation manually.

Flammable hazards

75. For flammable substances, employees should not berequired to deliberately enter a flammable atmosphere toisolate plant manually, especially as personal protectiveequipment (PPE), is not a practicable solution.

76. The potential for escalation is much greater forflammable substances, particularly in complex plantwith significant areas of congestion due to closelyspaced plant, pipework and other structures. Whenignition occurs in a congested area there is anincreased risk of a vapour cloud explosion. Theoverpressure from a vapour cloud explosion may becapable of critically damaging other plant, leading tofurther loss of containment and potential casualties.

Personal protectiveequipment77. In accordance with the hierarchy of measures

described in the Control of Substances Hazardous toHealth Regulations (COSHH),12 provision of personalprotective equipment (PPE) is not considered anadequate alternative to remote isolation for a newinstallation for which fitting ROSOVs is consideredreasonably practicable.

78. For existing installations, the practice of manual isolationby employees wearing PPE should only be adopted ifthe cost of retrofitting ROSOVs is grosslydisproportionate to the reduction in risk.

Precautionary approach66. When making decisions regarding the provision of risk

reduction measures it is HSE policy to adopt morecautious estimates:

whenever there is good reason to believe thatserious harm might occur, even if the likelihood isremote; orwhen uncertainty regarding either theconsequences or the likelihood underminesconfidence in the conclusions of the risk assessment.

(Serious harm is defined as death or seriouspersonal injury, especially when multiple casualtiesresult from a single event.)

When to considerfitting a ROSOV67. You should assess the need to fit a ROSOV wherever there

is the potential for a major accident as a result of loss ofcontainment of a hazardous substance, the consequencesof which could be significantly reduced by rapid isolation.

68. Manual valves should never be used in situations where theemployee effecting the isolation would be placed in danger.This is a major consideration in deciding when to useROSOVs. Manual valve isolation may be acceptable insome cases where rapid isolation is not required to preventa major accident. However, manual valves are often fittedmainly for maintenance work and are unlikely to be thesafest or most effective option for emergency isolation.

69. The potential for a major accident will depend on arange of factors including:

the nature and properties of the substance;the quantity of substance released;the size and nature of populations at risk and theirproximity to the plant; andthe presence of other plant including confiningstructures and other hazardous inventories(escalation potential).

70. Ultimately the decision whether or not to provide remoteisolation is based on an assessment of:

the likelihood that the major accident will occur;the consequences (in terms of the extent andseverity of harm to people).

Ass

essi

ng y

our

site

Bunding79. Secondary containment in the form of a bund is a

measure to mitigate the consequences of a spill once ithas occurred, and therefore comes lower in thehierarchy of controls than measures that limit the loss ofmaterial from the primary containment system.

80. A bund may be required to contain a range of potentialreleases for which a ROSOV would not be capable -including, for example, overflowing of a vessel and holesin the vessel itself. ROSOVs and secondary containmentare not mutually exclusive and both may be required toreduce the risks from the range of possible hazardousevents to ALARP.

81. For a new installation, priority should be given toreasonably practicable measures to prevent the escapeof the hazardous substance from the primarycontainment system (vessel, pump, pipework etc) overthe provision of secondary containment.

82. For existing installations where secondary containmentis already provided, the consequences of a releasewithin the bunded area will be mitigated. This can betaken into account when making decisions about thereasonable practicability of retrofitting a ROSOV.

83. However, where the pipework extends beyond thebunded area, the principal benefits offered by the bundwill be lost in the event of a failure outside. The bundwall may limit encroachment of the spillage on thevessel(s) within the bund, but the resulting pool will bepotentially much larger and may spread to othervulnerable locations.

84. Where the hazardous substance is under pressure, egbeing pumped, then some failures that take place withinthe bund could result in a jet or spray of the fluid beingprojected beyond the confines of the secondarycontainment. This is particularly true for some poorlydesigned or inadequately maintained bunds.

85. Even for releases into the bund, bunding does nothingto limit the size of the release but limits the size of thepool and hence the evaporation rate. The evaporationrate will reach a maximum once the quantity of materialreleased is sufficient to cover the area of the bund. Thisis irrespective of whether the release is isolated manuallyor remotely. However, a longer release means morematerial transferred into the bund. Unless steps aretaken to control evaporation from theliquid in the bund, eg by coveringthe surface with an inert barrier, theevaporation will continue for alonger period with potentially adverseresults. For example, if a flammablesubstance is released into the bund andignited, the larger quantity of fuel is likelyto result in a more prolonged fire,increasing the risk of escalation.

86. Some substances may be both toxic and flammable andwhile their CHIP classification usually reflects the greaterhazard, in some circumstances the secondary hazardmay dominate. For substances with both flammable andtoxic properties the selection criteria should be appliedfor each hazard separately and if different standards areindicated then the higher standard should be adopted.

87. In the case of simple mixtures of substances within thescope of this guidance a similar approach may be taken,with the standard adopted being the highest required foreach of the components.

88. If one component is a minor constituent, eg a smallpercentage of a toxic substance in a flammable solvent,then you should refer to Schedule 3 of the CHIPRegulations and the Approved Classification andLabelling Guide6 to arrive at an appropriatecategorisation.

89. In some cases the substance may have a secondaryhazard category that falls outside of the scope of thisguidance, eg for oxidisers or substances that react withwater. The secondary property should be separatelyassessed, by reference to other relevant good practiceor by means of a case-specific assessment, and againthe higher standard should be adopted (see Appendix 1).

Dual hazardsubstances andmixtures

Ass

essi

ng y

our

site

The selection criteria

How do the selectioncriteria work?

Event frequencies

100. There is considerable difficulty and uncertaintyassociated with determining the frequency of loss ofcontainment events. This guidance employs simplifieddecision criteria in which greater emphasis is placed onthe scale of the potential release and the severity of thepotential consequences than on the frequency. If youchoose to employ frequency-based arguments youshould be prepared to provide a robust justification forthe frequencies used.

The primaryselection criteria101. The following are the primary selection criteria:

The maximum foreseeable release of ahazardous substance in the event of failure toisolate manually is less than 1 % of thecontrolled quantity (Q) specified in Schedule 1,Column 2 of the Planning (Control of MajorAccident Hazards) Regulations 1995 for thepurposes of Hazardous Substances Consent forthe named substance (Part A), or category ofsubstance (Part B).Manual isolation would not require employees toenter a flammable atmosphere and expose themto risk of serious personal injury or death duringthe attempt.Manual isolation would not require employees toenter an area in which the concentration of a toxicsubstance exceeds a level at which a normalhealthy individual could escape unaided andwould not put them at risk of serious personalinjury or death while attempting the isolation.The rate and duration of the release is such thatno potential for serious danger (death or seriousinjury - ie injury requiring an overnight stay inhospital) can be foreseen.

90. To help you decide whether to use a ROSOV in a particularcase, a number of selection criteria have been developedbased on judgements about the extent and severity of theconsequences in the event of a major accident.

91. The criteria are divided into two groups of primary andsecondary selection criteria.

92. Primary selection criteria serve to quickly eliminatelow-risk cases where the hazard potential is sufficientlylow that the provision of remote isolation is unlikely tobe justified.

93. Where it can be shown that all of the primary selectioncriteria are satisfied, then a ROSOV would not normallybe required.

94. When you apply the primary selection criteria and theydo not eliminate the need for a ROSOV, you shouldchoose either to provide a ROSOV or alternatively torefine the assessment by applying the secondary criteria.

95. The secondary selection criteria identify a series ofgeneric circumstances in which the hazards areconsidered to be so significant that you should normallyfit ROSOVs when any one or more of these criteria apply.

96. This second group of criteria are more detailed and requirea deeper analysis of the potential consequences of a lossof containment event. If you can show that none of thesecondary selection criteria are applicable then a ROSOVis unlikely to be a reasonably practicable measure.

97. If the application of the selection criteria does not eliminatethe need for a ROSOV then provision of a ROSOV isconsidered to be good practice for a new installation.

98. For an existing installation, a ROSOV should normallybe fitted unless a sufficiently detailed analysis is madeto show that retrofitting is not reasonably practicable inthe circumstances.

99. Appendix 1 gives guidance on the factors that you willneed to consider in a case-specific assessment if it isto be accepted as a suitable and sufficientdemonstration.

The

sel

ectio

n cr

iteria

The secondaryselection criteria102. If you find that the primary selection criteria do not rule

out the need for a ROSOV then the following secondarycriteria should be used and a ROSOV fitted when one ormore of these criteria apply:

A ROSOV is required by other relevant andauthoritative guidance on good practice, egsubstance or process specific guidance such asSafety advice for bulk chlorine installations13 orthe Liquefied Petroleum Gases Association Codesof Practice.The hazardous substance is present as a gasliquefied under pressure and the circumstancesunder which ROSOVs should be fitted are notalready dealt with in existing substance orprocess specific and authoritative guidance ongood practice.The valve serves to isolate a flexible loading arm,hose or similar vulnerable item of plant wherethere are frequent connections and disconnections.The location of the potential loss of containmentis outside of any bunded area or other secondarycontainment.Failure to isolate a release of a flammablesubstance, the direct consequences of which (egthermal radiation or overpressure) are confined tothe site, could result in escalation involving arelease of another hazardous substance with off-site consequences.The extended release duration associated withmanual isolation (likely to be at least 20minutes) results in an increased number ofpredicted off-site fatalities when compared tothe case with a ROSOV.

The

sel

ectio

n c

riter

ia

Selection and operationof ROSOVs

Activation Actuators103. ROSOVs can be manually activated through push buttons

located a distance from the valve. Automatic shutoff valves(ASOVs) activated by a detection system, eg a toxic orflammable gas detector, can provide a more immediateresponse.

Manual activation

104. One advantage of manual activation is that an intelligentassessment of the most appropriate measure for dealingwith a release can be made. Claims are sometimesmade that manual activation is necessary to avoidspurious trips associated with automatic systems;however, the root cause is often a badly designedsystem rather than any inherent weakness in anautomated response.

105. Manual activation must be justifiable and the location ofpush buttons must not endanger the employee. Theyshould be accessible and in a safe and suitable place inrelation to the hazardous event that may occur. Thereshould normally be at least two alternate activation points,which should be readily identifiable both on the plant (eglabelling) and in all relevant operating instructions.

ASOVs

106. Advantages of ASOVs include more rapid isolation and areduction in the frequency of some modes of human error.

107. Facilities for manual activation, on emergency escaperoutes for example, should be provided as a backup toautomatic activation and can result in a more rapidresponse in some circumstances.

Types of valves108. The detailed selection of a particular valve, including

materials of construction, is beyond the scope of thisguidance and advice should be sought from your supplieror manufacturer. A key feature of any valve used foremergency isolation is the ability to achieve and maintaintight shutoff within an appropriate timescale. Commonlyused valve types include gate valves and plug valves. Butit is important that each valve is chosen to meet thespecific requirements of your installation.

109. A remotely operated valve can be operated by a varietyof different methods such as pneumatic, hydraulic orelectrical energy sources. ROSOVs should continue tobe capable of performing their function in the event offailure of the primary power supply, eg mechanicalsprings or pressurised fluid reservoirs.

110. It may be possible to convert existing manual isolationvalves to remote operation by incorporating an actuatorand a suitable control system. The suitability of such aconversion is beyond the scope of this guidance andadvice should be sought from the manufacturer of thevalve and/or the actuator.

111. The correct sizing of the actuator is crucial to meetingthe safety requirements specification of the ROSOV.Undersizing may result in the valve not operating ondemand while oversizing may result in damage to thevalve or actuator assembly. The design must show anunderstanding of the safety requirements and be basedon the complete system characteristics. This wouldinclude taking into account:

the static/dynamic forces of the assembly;the effect of the process application on these forces;the frequency of exercising the system;the minimum/maximum range of gas/hydraulicpressures used for actuation; andthe fact that actuators are manufactured indiscrete sizes.

112. The competence required to carry out a successfulsystem design may not reside in a single organisation(eg if the actuator and valve come from differentsuppliers). However, overall responsibility for thecomplete system meeting its safety requirementsspecification should be clearly assigned.

Failure mode113. Most ROSOVs provided for emergency isolation are

generally configured to close, and so isolate the hazardousinventory, on failure. However, it should not beautomatically assumed that this results in a safe conditionin all cases. If the ability to reopen the isolation valvefollowing the initial shutdown (eg due to loss of utilities) iscritical to safety, then backup supplies should be provided.

Sel

ectio

n a

nd o

pera

tion

of

RO

SO

Vs

External hazards114. ROSOVs should be protected against external hazards

such as fires or explosions to ensure that:

they can be closed; andthey will continue to provide tight shutoff.

Consequential hazardsExcess flow valves

121. Further advice on control system integrity can befound in British Standards EN61508 Functional safetyof electrical/electronic/programmable electronicsafety-related systems and IEC61511 Functionalsafety: safety instrumented systems for the processindustry sector.

115. The benefits of ROSOVs are clear, but it is important torecognise and address a number of new hazards that mayarise as a consequence of their installation. Some of therisk reduction provided by the ROSOV may be offset byrisks associated with the installation and ongoingmaintenance. The need for additional measures to tacklethese consequential hazards should not be taken as a barto fitting ROSOVs, but may influence the reasonablepracticability of retrofitting ROSOVs to an existinginstallation. Examples of some of these consequentialhazards are listed below.

116. On complex or interconnecting plant, the location ofROSOVs needs careful consideration due to thepotential for:

over pressunsation due to 'blocking in' a liquidwith a high expansion coefficient; andthe effects of spurious valve operation.

117. Other potential hazards associated with isolationvalves include:

the creation of damaging pressure surges ('hammer')in long pipe runs if valves close too quickly;introduction of a new potential leak source;hazards associated with installation, maintenanceand testing; andgeneral increase in complexity of the system.

Dual function valves118. In some cases, the normal process control system

includes valves, activated by process measurementsensors and acting as part of a trip or shutdown system.

119. Emergency isolation valves need to be capable ofachieving and maintaining tight shutoff. Some types ofcontrol valves are designed to provide a 'throttling' actionand this type do not always provide a sufficiently tightseal. Other types of valve used, eg in the control of batchtransfers, may be capable of achieving a tight seal. Failureof a dual function valve may compromise both functionsand a postulated failure of the control valve may itself leadto a requirement for an emergency isolation valve.

120. Therefore, the functions of process control andemergency isolation should normally be kept separate.Ultimately, the test will be whether the control systemcan deliver the required safety integrity level with a dualfunction valve.

122. An excess flow valve is designed to remain open innormal operation, but if the flow through the valveexceeds a preset maximum, the valve closes. Thesevalves allow flow in either direction, but normally onlytrigger for excess flow in the specified flow direction.The valve setting must exceed the maximum flow rateforeseeable in normal operation. Depending on theparticular design of valve a setting significantly higher(perhaps as much as 50%) may be required to avoid'chatter' and damage to the valve.

123. A catastrophic failure downstream of the valve willresult in increased flow and a pressure drop across thevalve, causing it to close. Where the downstream failureis more limited, eg a hole or a crack, or there iscrushing of the pipework then the restricted flow maynot be sufficient to cause the valve to shut and therelease will continue.

124. Other factors are relevant when considering use of anexcess flow valve. Foreign matter can lodge in the valveand prevent it from closing. In some applications it canbe difficult to simulate the excess flow condition forproof testing.

125. Advantages claimed for excess flow valves include therelative simplicity of a mechanical system and theirautomatic action - eliminating some potential humanerrors. In the context of this guidance excess flowvalves would not normally be considered equivalent toROSOVs for emergency isolation. Many of the sameissues surrounding retrofitting apply, but in some caseslower costs overall may mean that an excess flowvalve is reasonably practicable to retrofit when aROSOV is not.

Vulnerable vessel fittings

126. Process equipment may include small-boreconnections for items such as control systemcomponents. Some of these, eg for levelinstrumentation, may enter below the liquid level in thevessel. Failure could, therefore, result in loss of thevessel contents. Fittings of this type may be mostvulnerable to guillotine failure (being sheared off). Anexcess flow valve, preferably located in the outlet, butin any case as close to the vessel as practicable, maybe an acceptable alternative to a ROSOV for this typeof application.

127. Detailed advice on the selection, installation andmaintenance of excess flow valves is beyond the scopeof this guidance. Advice should be sought from yoursupplier or manufacturer.

Sel

ectio

n a

nd o

pera

tion o

f R

OS

OV

s

Reliability and integrity Inspection and proof testing

130. You should put in place appropriate arrangements forinspection and proof testing to reduce the likelihood of theROSOV to fail to operate effectively on demand, to ALARP.

131. The frequency of inspection and testing required willdepend to a great extent on the confidence held in thecompatibility of the valve with the process fluids andconditions. This confidence may be obtained throughprevious operational experience, testing, knowledge ofbasic materials compatibility or a combination of these.

132. The lower the level of confidence the more frequent shouldbe the inspection and testing of the valve. Records ofthese early inspections and tests will provide the basis ofa justification for increased test and inspection intervalsas operational experience is accrued.

failure to close on demand due to inadequatemaintenance/proof testing;failure to shut tight leading to leakage internallydue to incorrect specification of the valve orinadequate maintenance/proof testing;failure of employees to activate a serviceablevalve due to inadequate training and/or unclearinstructions;large volumes released after 'successful' isolationdue to inappropriate spacing between isolationvalves;valves rendered unserviceable by the incident, egdamaged by fire or explosion; andfailure-to-danger of valve on loss of motive power.

128. Any control system can fail. Proper maintenance andregular proof testing of valves make a major contributionto maintaining valve integrity.

129. Examples of potential failure modes are consideredbelow. If you establish how systems can fail it providesuseful information for inclusion in testing andmaintenance arrangements. Common factors identifiedin previous industrial incidents where isolation systemsfailed include:

Sel

ectio

n a

nd o

pera

tion

of

RO

SO

Vs

Appendix 1 A case-specificassessment of the reasonablepracticability of a ROSOV

IntroductionThis appendix gives guidance on how to determine whether aROSOV is a reasonably practicable measure to mitigate theconsequences of a loss of containment of a hazardoussubstance. It is limited to a consideration of the potential forharm to human health.

Should a loss of containment occur the nature of thehazardous substance and the processing conditions would

have a major bearing on the consequences, and sostrongly influence the decision to incorporate remoteisolation facilities.

A case-specific assessment of reasonable practicabilityrequires that each installation be assessed individually,taking account of its specific design features, safetysystems and operating procedures.

Appendix

1 A

ca

se-s

peci

fic

asse

ssm

ent o

f the

reas

onab

le p

ract

icab

ility

of a

RO

SO

V

Process

The flowchart above illustrates the process of assessment in the context of ROSOVs.

Look for the hazards Gather and use data on substance properties: Toxicity, Flammability (or both)?

What if? Identify 'initiating events' that could lead to a loss of containment (LOC)Natural events - flooding, earthquakeMan-made - vehicle impact, mal-operation, lack of maintenance

What then? Identify the corresponding hazardous (LOC) eventsEstimate the frequencies of the hazardous events

Assess the risks

Then what?

Evaluate the consequences for people and the environmentDefine level of harm, eg death or some defined lesser harmDetermine hazard range to defined level of harmIdentify the populations within the hazard rangeEstimate the severity (eg no. killed/injured) of the consequencesEstimate the frequency of the hazardous event

So what?Compare risk (consequence/frequency) of the LOC event with and without ROSOVCompare the benefit in reduction in risk (consequence/frequency) with the costof implementationDecide if the cost is grossly disproportionate to the reduction in risk

Record AssessmentFindings

Implement ROSOV ifCosts are Not GrosslyDisproportionate

Review Findings and

Revise when necessary

However, there is the potential for personnel exposed to atoxic substance to be rendered incapable of controlling orshutting down plant safely. This can lead to further incidentsand escalation. Vulnerable occupied buildings includingControl Rooms should be identified as part of an OccupiedBuildings Assessment for the establishment. The ChemicalIndustries Association publication Guidance for the Locationand Design of Occupied Buildings on Chemical ManufacturingSites,15 contains useful advice on this topic.

A ROSOV may reduce both the risk of harm due to directexposure to the toxic substance and the likelihood ofescalation of the event as a result of employees being unableto perform essential duties.

Routes into the human body include inhalation, ingestion andvia contact with the skin. The primary route of harm followinga loss of containment event is inhalation. But there will alsobe the possibility of exposure via other routes during clean-upoperations.

The first stage of the assessment is to identify andunderstand the hazardous properties of the substancesunder review. Information on the hazards of a particularsubstance may be obtained from a variety of sources. Theforemost of these is the Material Safety Data Sheet, whichshould be issued by the supplier of the substance inaccordance with the Chemicals (Hazard Information andPackaging for Supply) Regulations 2002 (SI1689).6 Anindication of the primary hazard of a substance can beobtained from the CHIP classification.

Some substances may be both toxic and flammable. While theCHIP classification usually reflects the greater hazard, in somecircumstances the secondary hazard may dominate. Forsubstances with both flammable and toxic properties you shouldapply the criteria for each hazard separately. If different standardsare indicated then the higher standard should be adopted.

In the case of simple mixtures of substances within the scopeof this guidance, a similar approach may be taken. Thestandard adopted should be the highest required for each ofthe components.

If one component is a minor constituent, eg a smallpercentage of a toxic substance in a flammable solvent, thenyou can use the CHIP methodology to arrive at anappropriate categorisation.

In some cases the substance may have a secondary hazardoutside of the scope of this guidance, eg for oxidisers orsubstances that react with water. You should assess thesecondary property separately, by reference to other relevantgood practice or by means of a case-specific assessment,and again adopt the higher standard.

The hazard ranges associated with fires and explosionsfollowing the release and ignition of a flammable substancetend to be shorter than for toxic substances, and may beconfined to the site. However, with flammable substancesthere is greater potential for escalation due to the effects ofthermal radiation and/or overpressure on other items of plantcausing further loss of containment.

Other properties of substances in addition to toxicity andflammability can have a significant impact on the risk. A toxicsubstance with a higher vapour pressure, for example, willdisperse more readily and to a greater hazard range fromthe point of release.

Toxic substances tend to have longer hazard ranges andgreater potential to affect larger, more remote populationsbeyond the site boundary. Thermal radiation and overpressureeffects following ignited releases of flammable substances aremore likely to result in damage to other plant, and hence toescalation, than are toxic releases.

The conditions under which the substance is stored and/orprocessed can also be a significant factor.

Liquids classified as Flammable, but with flashpoints aboveambient temperature, generally present a lower hazard thanthose classified as Highly Flammable liquids. However,storage or processing at elevated temperatures can result inthese substances being released above their flashpoints oreven their auto-ignition temperatures.

Substances that are gases at ambient temperature arefrequently stored as liquids under pressure. Releases frompressurised storage are more energetic. For a given hole size,a greater mass of substance will be released per unit time,particularly if the substance is released in the liquid phase.

It is important, therefore, to consider containment systems asa whole and not just as individual vessels. Boundaries need tobe set between units of inventory. Appropriate means ofisolation, which may include ROSOVs, should be providedbetween individual inventory units to limit the quantity ofsubstance that can be released from any single failure.Incidents have occurred in which ROSOVs were provided andfunctioned correctly; however the quantity of substancebetween isolations was too large and a significant release stilltook place.

The nature and scale of an emergency is often determined bythe rate at which a hazardous substance is released ratherthan simply the bulk inventory. It is this rate of release thatdetermines the size of the liquid pool or the flammable gascloud formed, or the length and diameter of a jet flame.Factors influencing the rate of release include the pressureand the area of the breach - all other things being equal, thegreater the pressure and/or the larger the bore of thepipework, the greater the release rate. That said, larger borepipework tends to be less vulnerable to some of the possiblefailure modes, eg impact. To an extent, the consequencesand frequency may balance each other out.

Process plant typically consists of a series of largercontainments such as vessels, columns etc joined bypipework, flanges, pumps, heat exchangers etc.Failures are most likely to occur in and around theseinterconnecting items, which often (though not always)contain relatively small quantities of substancesthemselves. But, if there is no effective (safe)means to isolate a leak from say a pump,then the contents of the largercontainment item may be lost.

Stage 2:Assess the risks

Introduction

Degree ofquantification

Definition: quantifiedrisk assessment

A risk assessment considers a range of possible adverseevents and evaluates both the likelihood of the event and themagnitude of the potential consequences. In this context, thefrequency and the consequences of the event, taken together,describe the risk associated with that event.

A judgement is then made regarding the tolerability of the risk,and the reasonable practicability of risk reduction options, bycomparison with suitable criteria.

If a clear and unambiguous decision can be made then this levelof quantification is likely to be adequate. If, due to uncertaintiesin the data or the assumptions made in the analysis, it is notclear whether or not fitting a ROSOV is a reasonably practicableoption, then further quantification may be required.

In all cases, the degree of quantification required will be thatnecessary to justify the decision taken. You should test thesensitivity of your analysis to any assumptions made, egabout event frequency or about similar factors in theconsequence assessment.

Risk assessments may be made with varying degrees ofrigour or quantification, and each of the elements of a riskassessment is subject to varying degrees of uncertainty.

In some cases, professional judgement alone may be used toassign event frequencies on a qualitative basis. In others, amore detailed analysis of the possible causes of a failureusing techniques including fault trees may be made toquantify the failure rate more precisely.

The consequences of an event are frequently bettercharacterised than the frequency. It is common to quantify theconsequences of a given event and pair the result with aqualitative judgement as to the likelihood.

Ultimately, the consequences and frequencies of the range ofpossible events may be fully quantified and combined into asingle risk value or relationship.

Iso-contours of individual risk can be used to determine at whatdistance and in which direction a threshold risk is reached forthe purposes of comparison with tolerability criteria.

In making judgements about the reasonable practicability of aparticular safety measure, it is also necessary to consider'societal' or 'group' risk - which is essentially the risk of harm tomultiple individuals as the result of the same hazardous event.

The use of numerical risk estimates in this manner is commonlyreferred to as a Quantified Risk Assessment (QRA). It will notalways be necessary, or even helpful, to perform a full QRA. Inmany cases the results of a qualitative assessment will besufficiently clear to allow a decision to be made.

Sta

ge 2

: A

sses

s th

e ris

ks

Steps in risk assessmentThe separate steps in a risk assessment have been described more memorably as

What if..., What then..., Then what... and So what...

What if...Introduction

Equipment failures

Some equipment failures may have no significant effect,warranting only minor maintenance attention such asadjustment or resetting. Others, such as seal failures orequipment failing to operate, may have much moreserious consequences. Identification of the critical failuremodes of the plant equipment is best achieved throughdirect operating knowledge and experience.

Plant maintenance records can be used to identifyequipment that may give rise to a loss of containmentincident. Generic information, from published sources orheld centrally within a company, can be useful but will nottake account of local conditions which will affect theperformance of equipment. Other sources of informationinclude reports from Hazard and Operability (HAZOP)studies and reviews of Pipework and InstrumentationDiagrams (PID).

Table 1 gives some examples of typicalequipment failures.

The first step is to identify the potential causes or'initiating events' of a loss of containment event. Thesecan be split into two broad categories of event: thosearising from external events such as seismic activity orflooding, and on-site events including failures due tocorrosion, vehicular impact or mal-operation.

All plant items have a set of unique failure modes, some ofwhich can lead to a loss of containment. A review of eachfailure will serve to identify if a serious risk is present.

It is important to establish those site-specific failuremodes whose consequences would require isolation.

Table 1 Typical Equipment FailuresEquipment

Pipework

Pipework, grants, flanged connections

Instrumentation connection(small base tube)

Flexible hoses

Valves

Pumps

Holes and ruptures

Principal Failure Modes Principal Failure Causes

Corrosion, erosion, cavitation, impact,vibration, 'hammer'

Deterioration of material, wrong gasketused, incorrect assembly of joint

Impact, vibration, incorrect fitting,incorrect make up

Fatigue, impact damage, misuse,poor connection, mechanical failures

Ruptures and disconnections

Leaks

Holes, ruptures, disconnections

External leak Gland seal, jointed faces

External leakDrive shaft, apping, flanged faces,chainlocks

Compressors

Drain and simple points

Leaks, seals, flanged faces, soiledconnections, drains

Leaks at seals and flanged faces, valveleft open, full bore ruptures

Vibration, perished joint material,operator error, leak past seat

Perished joint material, operatorerror, impact

Sta

ge 2

: Ass

ess

the

risks

What if...Initiating eventfrequenciesIt may be necessary to estimate the frequency of theinitiating events if these are to be used to estimate theoverall frequency of the hazardous event (loss ofcontainment). Alternatively, frequencies of hazardousevents may be assigned based on historical dataprovided this is available and relevant.

Definition:external eventsAn external event is one that has no direct relationshipwith the equipment, but which is capable of acting on theequipment causing it to fail.

This includes all natural phenomena such as earthquakes,high winds, flooding etc. Interference by third partiesengaged in vandalism or theft may be relevant. It includesthose activities that may be going on around the plantsuch as the movement of road vehicles or lifting

Influences onhuman failureThe table below gives some influences that increase thelikelihood of human failure.

In many cases, accidents and incidents are attributed tohuman failure. These can include unintentional errors suchas mistakenly starting a pump, opening the wrong valve, orfailing to replace a seal. Sometimes custom and practiceprocedural shortcuts can contribute to human failures.

Further guidance is available in the publication Reducingerror and influencing behaviour.16

Definition:human factors

operations, ie the potential for impact damage. Alsoincluded are incidents on adjacent plant that couldescalate, affecting the plant under consideration, ie the'domino effect'.

Table 2 Influences on Human Failure

Job Factors

Individual Factors

Organisational Factors

Illogical design of equipment and instruments

Constant interruptions

Information hard to find or assimilate

Missing or unclear instructions

Poorly maintained or unreliable equipment

High workload, time pressure

Noisy and unpleasant working conditions

Low skill and competence

Tired staff

Bored or disheartened staff

Individual medical problems

Poor work planning leading to high work pressure

Poor communications

Uncertainties in roles and responsibilities

Poor management of health and safety

Inadequate staffing level

Inadequate training - routine emergency operations

Inadequate supervision

Sta

ge 2

: A

sse

ss t

he r

isks

What if...What if analysis forhuman factorsThe What if... analysis should identify those tasks wherehuman failures could arise. Analysis is usually done bystructured task and error analysis methods. Involvementof operators in the analysis is essential to provide a'reality check' of what is actually done on the plant andwhat steps are feasible. Such analysis is preferable to justrelying on what is written in the operating procedure.

Key tasksKey tasks to consider include:

normal operating duties;sampling tasks;venting/draining;connecting/disconnecting;start up/shut down;cleaning and maintenance;emergency response.

Probability estimatesMethods are available to allow the estimation of humanerror probabilities. However, this should be done withextreme caution to ensure that estimates are appropriatefor the nature of the task and the site-specific conditions.

Response timesParticular care is needed when estimating the likely timefor operators to respond to an incident. Considerationshould be given to the detection, diagnosis and actionstages of response.

Detection

How an operator will become aware that a problemexists. Assessment of alarm priorities and frequencies, thecharacteristics of the operator console displays, as wellas operators' past experience of similar problems on sitesare all useful aspects to review. Plant problems thatappear over a period of time, and where the informationavailable to the operators can be uncertain, areparticularly difficult to detect. When Control Rooms arenot continually staffed you need to be able to show thatplant problems can still be detected quickly and reliably.

Diagnosis

How an operator will determine what action, if any, isrequired to respond to the problem. Training andcompetence assurance, the availability of clearoperating procedures and other job aids, and the levelof supervision are all relevant factors to think about. Theexistence of more than one problem can makediagnosis more difficult.

Action

This stage covers how a timely response is carried out.Key aspects here include:

a reliable means of communicating with otherplant operators;time to locate and operate the correctisolation valve;for manual isolation valves, consider the needto don PPE and the potential difficulty inoperating the valve whilst wearing PPE;for remotely operated valves, feedback needsto be given to operators that the valve hasoperated correctly;consider that operators may hesitate ifoperating the valve leads to criticism later.

A 'walk-through' of the physical aspects of the task withoperators can provide very useful information on theminimum time needed to operate an isolation valve.However, an allowance for additional delays due touncertainty, hesitation, communications problems and soon should be added for a realistic estimate of theresponse time.

Additional guidance is available in these publications(available on the HSE website at www.hse.gov.uk):

Better alarm handling HSE Information Sheet

Human factors aspects of remote operation inprocess plants

Assessing the safety of staffing arrangements for processoperations in the chemical and allied industries

Human factors integration: implementation in the onshoreand offshore industries

Sta

ge 2

: Ass

ess

the

risks

What then...Introduction Frequency of

hazardous eventThe procedure for tracing initiating events through tohazardous events can be made easier by the use oflogic trees. This form of analysis can be used togenerate frequencies for the hazardous events.

However, there can be considerable difficulties inpractice and it is easy to overlook initiating events andhence underestimate the frequency of the hazardousevent. This is why it is common to turn to an analysisof historical data.

Then what...

The second step is to identify those initiating events thatcontribute to the hazardous event under consideration -the event that would be mitigated by isolation.

Hazardous eventsA given hazardous event might have several potentialinitiators. For example, both corrosion and impact mightbe causes of a pipework failure. Similarly, each initiatingevent could lead to several hazardous events. Some ofthese may be effectively mitigated by a ROSOV, egfailure of pipework due to corrosion, whilst others willnot, eg a corrosion-induced hole in a storage tank.

IntroductionThe third step is to evaluate the consequences of theidentified hazardous event or loss of containment. Thisprocess involves predicting the behaviour of thehazardous material once released from containment, inorder to determine how the concentration of thesubstance will vary with distance from the release point.

To be capable of causing a major accident, toxicsubstances must be present in a physical form such thatdispersion is possible in the conditions that exist at thetime of the accident.

For flammable substances, ignition (with consequentthermal and/or overpressure effects) can occur close to thesource of the release after minimal dispersion. But in somecases a cloud of flammable vapour may drift some distanceaway from the release point (where ignition sources may bestrictly controlled) before finding a source of ignition.

In the context of this guidance, we are generallyconcerned with releases of gaseous or volatile liquidsubstances, which can become airborne, and betransported some distance from the point of release.However, even substances with relatively low vapourpressures can form a flammable or toxic cloud, if forexample they are released under pressure, forming aspray or mist.

For toxic substances, the extent of the hazard is related tothe concentration of the substance to which thoseaffected are exposed. Critical factors in determining thedegree of harm include the concentration and theexposure time - collectively known as 'the dose'.

For flammable substances, the hazard is again related tothe concentration. But the hazard will only be realised ifthe concentration is within certain critical limits and there isa source of ignition. Some initiating events maysimultaneously provide a source of ignition, eg in the eventof a release due to vehicular impact there are also likely tobe sparks and/or hot vehicle components present.

Definition: sourcetermA source term describes the conditions (eg temperatureand pressure) and other critical parameters, includingrelease rate and the physical properties of the substancethat together define the release.

Take, for example, a gas liquefied under pressure. For agiven sized hole in the containment barrier, the source termdepends on whether the substance is released as a liquid,eg from pipework carrying liquid, or as vapour if the failureoccurs in pipework connected to the vapour space.

Sta

ge 2

: Ass

ess

the

risks

Then what...Extent of the hazard Secondary containment

Sta

ge 2

: Ass

ess

the

risks

From the source term, knowledge of the waysubstances behave when dispersed into theatmosphere, and the harm criteria, the extent of theharmful effect or the 'hazard range' can be estimated.The hazard range, in conjunction with data on thepopulation at risk, is used to determine the severity ofthe consequences.

A detailed consideration of the techniques for modellingthe dispersion of hazardous substances is beyond thescope of this guidance. At the time this guidance wasbeing prepared, plans were at an advanced stage tomake the following HTML-based tool available on HSE'swebsite: 'Guidance on dispersion models for theassessment of COMAH safety cases'.

This work includes general guidance on dispersionmodelling, plus reviews of some of the models morefrequently employed by duty holders in preparing safetyreports submitted under the COMAH Regulations.

Another useful source is the Dutch TNO publication,(the 'Yellow Book'), Methods for the calculation of thephysical effects of the escape of dangerous materials(see particularly Part 2, Chapter 7 'Dispersion'). C J Pvan Buijtenen. 1979. 3/L

Harm criteriaHarm criteria describe the degree of harm, which couldbe death or some specified lesser harm resulting fromexposure to the hazard.

For toxic substances, the harm criteria are commonlyexpressed in the form of a 'dose', orconcentration/time relationship, though otherrelationships are possible.

For flammable substances, the harm criteria arecommonly related to either the effects of exposure tothermal radiation from, for example, pool fires, jet firesor fireballs or, in the event of an explosion, to theoverpressure generated.

Harm criteria for overpressure may be related to thedirect effects on the human body or, more usually, beindirectly related to the effects of overpressure onstructures which may collapse, or to the impact ofmissiles generated by the explosion. It is more usual touse the indirect relationship to the effects on structuresbecause these can result in harm at significantly loweroverpressures.

It is good practice when designing a new installation to applya hierarchical approach to the selection of risk reductionmeasures. ROSOVs (which serve to limit the quantity ofsubstance released from the primary containment) should beinstalled, if reasonably practicable, in preference to bunding,which serves to minimise the consequences once thematerial has escaped.

When considering the reasonable practicability of retrofittingROSOVs to an existing installation, existing measures,including bunding, may be taken into account whenestablishing the current risk for comparison purposes.

A bund may be required to contain and mitigate a range ofpotential releases against which a ROSOV would not beeffective - including, for example, overflowing of a vesseland holes in the vessel itself. ROSOVs and secondarycontainment are not mutually exclusive and both may berequired to reduce the risks from the range of possiblehazardous events to ALARP.

Toxic releasesFor un-bunded releases of a toxic liquid at ambienttemperature, ignoring cooling effects of evaporation, thesource term is proportional to the evaporation rate from thepool. This is dependent on the pool size, which increases asmore material is added to the pool. The more rapidly therelease is isolated, the less material will be released and thesmaller the pool formed. A smaller pool will mean a reducedhazard range.

For a bunded release, the evaporation rate will reach amaximum once the quantity of material released is sufficientto cover the area of the bund. This is irrespective of whetherthe release is isolated manually or remotely. However, alonger release means more material transferred into thebund. Unless steps are taken to control evaporation fromthe liquid in the bund, eg by covering the surface with aninert barrier, the evaporation will continue for a longerperiod. People who are in the plume and unable to escapefrom it, will be exposed to a given concentration of toxicsubstance for longer and so accumulate a higher dose.

Flammable releasesFor bunded releases of flammable liquids, the greaterquantity of fuel accumulated in the bund is likely to resultin a more prolonged fire if ignited. Adjacent plant will beexposed to thermal radiation for a longer period,increasing the potential for escalation. Where vesselsholding flammable substances share a common bund,'dwarf walls' or similar should be incorporated to limit thespread of smaller releases.

Then what...A long continuous release of vapour from an evaporatingpool can lead to the formation of a larger cloud of vapourabove the lower flammable limit. This increases the extentof the flash fire hazard.

EscalationFor flammable substances, an important consideration isthe potential for escalation or 'domino effects'. Forexample, a relatively small fire/explosion could havedirect effects that are confined to the site. But thefire/explosion could result in loss of containment of amore hazardous substance with the potential forsubstantial off-site consequences.

In these cases, the true extent of the hazard will berelated to the escalation event, which may have a lowerevent frequency but substantially more seriousconsequences.

Response timeThe response time between the initiating event and therelease being isolated can have a significant impact onthe extent of the hazard. Even when it is possible toeffect a safe manual isolation, the additional time takento do so can significantly increase the release durationand the hazard range.

ASOVsA further reduction in response time, with a potentialreduction in hazard range, may be achieved if the isolationvalve is automatically activated in response to, for

IntroductionThe final step is to compare the risk (frequency xconsequence) of the hazardous event with suitable criteriato determine the tolerability of that risk.

Reducing risks, protecting people: HSE's decision-makingprocess,3 also available online at www.hse.gov.ukincludes a discussion of the risk tolerability criteriadeveloped by HSE (as the regulator).

Risk reduction

So what...

In this context, a ROSOV is a measure that mitigates theconsequences of a hazardous event rather than

For some events, particularly toxic releases, theextent of the harm and hence the risk will varyaccording to direction. Some flammable events,including flash fires, can also be influenced byweather, whilst others, eg explosions, tend to beomni-directional in their effects.

Directional effects

In the context of harm to human health, the severity of theconsequences is directly related to the number of peoplewho may be killed or injured. Casualties can result fromdirect exposure to the hazardous substance, or to theeffects of thermal radiation/overpressure in the case offlammable hazards.

Data on the populations at risk within the specifiedhazard range is used to estimate the severity of theconsequences, eg the number of persons suffering thespecified level of harm.

Severity ofconsequences

example, a detector. Such an arrangement is referred toas an Automatic Shutoff Valve (ASOV).

Similar considerations apply when judging the reasonablepracticability of an ASOV. Although it is important toconsider the likelihood and consequence of spurioustrips, these are not by themselves a justification for notfitting an ASOV. Spurious trips can be controlled by, forexample, the appropriate use of diverse redundantsensors operating on a 'voting' system.

Sta

ge

2: A

sses

s th

e r

isks

In the context of this guidance, for risks that fall into the'Tolerable, If ALARP' region of the risk spectrum (seeSFAIRP/ALARP/AMN in the Summary of relevant legalrequirements), a ROSOV should be considered as ameasure to reduce the risk to ALARP.

So what...influencing the frequency of that event. However, it isalso true that by limiting the consequences of the primaryhazardous event, the presence of a ROSOV may reducethe probability of any associated escalation event(s).

Cost-benefit analysisIn forming judgements about the reasonablepracticability of a particular safety measure, it isnormal to use death as the criterion for harm. Thenumber of 'statistical fatalities' averted, for whichthere are accepted monetary equivalents, areconsidered when evaluating the benefits side of thecost-benefit computation.

Serious injuries averted should also be consideredwhen assessing the benefits of the measure beingconsidered. However, although attempts have beenmade to establish equivalence factors, eg ten majorinjuries equal one fatality, there are as yet no generallyaccepted monetary equivalents for non-lethal injuries.

When deciding whether or not to fit a ROSOV, acomparison is made between the risk with and withoutthe ROSOV, and the reduction in risk is compared to thecost of providing the ROSOV.

Gross disproportionThe implementation of a risk reduction measure such as aROSOV will involve a cost to the duty holder. Equally, aROSOV is intended to reduce risk from an operation and

The proportion factor is at least 1 (andpossibly at least 2) for risks which are closeto being broadly acceptable risks.The proportion factor is at least 10 at thetolerable/unacceptable risk boundary.For risks between these levels the proportionfactor is a matter of professional judgement, butthe disproportion between the costs of preventinga fatality (CPF) and the value of a prevented fatality(VPF) must always be gross for a measure not tobe reasonably practical.

this reduction will bring about a benefit (in terms of livessaved etc), which can be expressed in monetary terms.The ratio of the costs to the benefits can be described asa proportion factor (PF). The generally accepted value ofavoiding a statistical fatality is approximately £1 million atthe time of writing.

It should also be noted, however, that the benefits mightalso include the avoidance of such things asenvironmental clean-up costs, increased insurancepremiums, loss of asset value, the costs of increasedregulatory interference etc.

The measure to reduce the risk, in this case the ROSOV,should be implemented unless the cost is grosslydisproportionate to the reduction in risk (or an equallyeffective alternative is adopted).

Providing the risk analysis is based on cautious bestestimates and the costs are realistic (not needlesslyinflated beyond the provision of a fit for purpose solution)then, in the context of major hazards, HSE will use thefollowing as the basis for exercising judgement:

Sta

ge

2: A

ssess

the

ris

ks

Stage 3Record theassessment findings

RationaleThe final stage of the assessment process is to document thefindings of the assessment and the reasoning behind thedecisions taken. There is a legal requirement under theManagement of Health and Safety at Work Regulations todocument the findings of a risk assessment. In the context ofthis guidance, it is particularly important that the findings aredocumented thoroughly when they are used to justify notimplementing a ROSOV, where one is identified as goodpractice by the decision criteria presented in this document.

Sta

ge

3: R

eco

rd t

he a

sse

ssm

en

t fin

din

gs

Stage 4:Implement ROSVO wherereasonably practicable

Comment

Where the conclusion of the assessment is that a ROSOV (or,where applicable, another equally effective measure) isreasonably practicable, then implementation should follow asa logical consequence.

Sta

ge

4: Im

ple

me

nt

RO

SV

O w

he

re r

ea

son

ab

ly p

ract

ica

ble

Stage 5:Review theassement periodically

Introduction Significant changeAssessment is not a once-and-for-all activity. With thepassage of time, changes in local circumstances andadvances in technology etc may alter the conclusions of therisk assessment. For example, an increase in the size of thelocal population or a decrease in the cost of providing remoteisolation may make fitment of a ROSOV a reasonablypracticable option where previously it was not.

In accordance with the Management of Health and Safety atWork Regulations, duty holders should review and, ifnecessary, modify their assessment if there is reason tobelieve that it is no longer valid or if there is a significantchange (eg an increase in the population at risk) in thematters to which it relates.

It is prudent in most cases to plan to review risk assessmentsat regular intervals. There is an explicit requirement (regulation8) for the Operators of installations subject to the Top Tierrequirements of COMAH to review their safety report at leastonce every five years, or whenever necessary, to take intoaccount new facts or knowledge that becomes available. Thisshould be considered indicative of Good Practice for Operatorsof other establishments handling hazardous substances.

Sta

ge 5

: Rev

iew

the

asse

ssm

ent p

erio

dica

lly

Appendix 2Summary of relevantlegal requirements

Health and Safety atWork etc Act1. The Health and Safety at Work etc Act 1974 places

a duty on employers to ensure 'so far as isreasonably practicable' (SFAIRP) the health, safetyand welfare at work of their employees, and a dutyon employers and the self-employed to ensure thatpersons other than their employees (including, inthe case of the self-employed, themselves) areprotected from risks to their health or safety arisingfrom the work activities.

Management of Healthand Safety at WorkRegulations2. The Management of Health and Safety at Work

Regulations 1999 (SI 3242) require employers (andwhere relevant the self-employed) to make a suitableand sufficient assessment of the risks to theiremployees and to persons who are not theiremployees but who may be subject to risks arisingfrom the work activities.

Control of MajorAccident HazardsRegulations3. Regulation 4 of the Control of Major Accident Hazards

Regulations 1999 (COMAH) (SI 743) places a duty onthe operators of establishments to which theregulations apply to take 'all measures necessary'(AMN) to prevent major accidents and limit theirconsequences to persons and the environment.

DangerousSubstances andExplosive AtmospheresRegulations

4. Guidance on these regulations can be found in theHSE publication A guide to the Control of MajorAccident Hazard Regulations 1999. 5

5. Operators of COMAH establishments (whether'lower tier' (LT) or 'top tier' (TT)) have a duty toprepare a Major Accident Prevention Policy (MAPP).Operators of COMAH TT sites have an additionalduty to submit a safety report to the CompetentAuthority (CA). The COMAH safety report shoulddemonstrate that the Operator has taken allmeasures necessary and that the major accidentrisks have been reduced to ALARR One of the keydemonstrations will be to show that appropriatemeasures have been taken to prevent and effectivelycontain releases of dangerous substances.

6. The Dangerous Substances and ExplosiveAtmospheres Regulations 2002 (DSEAR) (SI 2776)implement two European Directives: the ChemicalAgents Directive (CAD) and the ExplosiveAtmospheres Directive (ATEX).

7. These regulations deal with fires, explosions andsimilar energy-releasing events (eg exothermicchemical reactions) arising from dangeroussubstances (chemical agents) and the explosiveatmospheres created by those dangeroussubstances.

8. DSEAR modernises and repeals over 20 pieces ofold safety legislation on flammable substances,dusts and liquids.

App

endi

x 2

Sum

mar

y of

rel

evan

t le

gal

requ

irem

ents

Referencesand useful addresses

Ref

eren

ces

and u

sefu

l ad

dres

ses

1. The chemical release and fire at the Associated OctetCompany Limited: A report of the investigation by theHealth and Safety Executive into the chemical releaseand fire at the Associated Octel Company, EllesmerePort on 1 and 2 February 1994 ReportHSE Books 1996 ISBN 0 7176 0830 1

2. Emergency isolation of process plant in the chemicalindustry Chemical Information Sheet CHIS2HSE Books 1999

3. Reducing risks, protecting people: HSE's decision-making process Report HSE Books 2001ISBN 0 7176 2151 0

4. Assessing compliance with the law in individual cases andthe use of good practice. Available on the HSE website:http://www.hse.gov.uk/dst/sctdir.htmttriskassessrnent

5. A guide to the Control of Major Accident HazardRegulations 1999 HSE Books 1999 ISBN 0 7176 1604 5

6. Approved classification and labelling guide. Chemicals(Hazard Information and Packaging for Supply)Regulations 2002. Guidance on Regulations L131 (Fifthedition) HSE Books 2002 ISBN 0 7176 2369 6

7. Approved supply list. Information approved for theclassification and labelling of substances andpreparations dangerous for supply. Chemicals (HazardInformation and Packaging for Supply) Regulations2002. Approved list L129 (Seventh edition)HSE Books 2002 ISBN 0 7176 2368 8

8. A guide to the Pipelines Safety Regulations 1996 L82HSE Books ISBN 0 7176 1182 5

9. The Offshore Installations (Prevention of Fire andExplosion, and Emergency Response) Regulations1995 The Stationery Office SI 1995 No 743

10. The safe isolation of plant and equipment HSE Books1997 ISBN 0 7176 0871 9

11. Designing and operating safe chemical reactionprocesses HSG143 HSE Books 2000ISBN 0 7176 1051 9

12. Control of substances hazardous to health. TheControl of Substances Hazardous to HealthRegulations 2002. Approved Code of Practice andguidance L5 (Fourth edition) HSE Books 2002ISBN 0 7176 2534 6

13. Safety advice for bulk chlorine installations HSG28(Second edition) HSE Books 1999 ISBN 0 7176 1645 2

14. The Management of Health and Safety at WorkRegulations 1999 The Stationery Office SI 3242

15. Guidance for the location and design of occupiedbuildings on chemical manufacturing sites (Secondedition) RC21/03 Chemical Industries Association2003 ISBN 1 85897 114 4 Details on the CIA websiteat: http://www.cia.org.uk/bookshop/system/index.html

16. Reducing error and influencing behaviour HSG48(Second edition) HSE Books 1999 ISBN 0 7176 2452 8

The EnvironmentAgencyThe Environment Agency (England and Wales) has ageneral enquiry line on 08459 333111 or visitwww.environment-agency.gov.uk

The ScottishEnvironment ProtectionAgencyFor Scotland, the Public Affairs Department of the ScottishEnvironment Protection Agency, on 01786 457700, handlesgeneral enquiries or visit www.sepa.org.uk

While every effort has been made to ensure the accuracy ofthe references listed in this publication, their future availabilitycannot be guaranteed.

Previous pageis blank

Rem

otel

y op

erat

ed s

huto

ff va

lves

(R

OS

OV

s) f

or

emer

genc

y is

olat

ion

of h

azar

dous

sub

stan

ces

Printed and published by the Health and Safety Executive C15 08/04

The guidance is aimed at operators and managers of installations which handle,storeor process hazardous substances, as well as plant supervisors, design, process andmaintenance engineers and safety professionals. It will help you to make a riskassessment on whether you need a ROSOV and details the steps for implementation.The guidance will also ensure you comply with the relevant health and safety law.

About this guidance