Remotely operated shutoff valves (ROSOVs)

Page1of47

Health and Safety Executive

Remotely operated shutoff valves (ROSOVs)foremergencyisolationofhazardoussubstances

This is a free-to-download, web-friendly version of HSG244 (First edition, published 2004). This version has been adapted for online use from HSE’s current printed version.

Youcanbuythebookatwww.hsebooks.co.ukandmostgoodbookshops.

ISBN 978 0 7176 2803 2 Price £15.00

Theguidanceisaimedatoperatorsandmanagersofinstallationswhichhandle,storeorprocesshazardoussubstances,aswellasplantsupervisors,design,processandmaintenanceengineersandsafetyprofessionals.ItwillhelpyoutomakeariskassessmentonwhetheryouneedaROSOVanddetailsthestepsforimplementation.Theguidancewillalsoensureyoucomplywiththerelevanthealthandsafetylaw.

HSE Books

Page2of47


© Crown copyright 2004

Firstpublished2004

ISBN9780717628032

Allrightsreserved.Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmittedinanyformorbyanymeans(electronic,mechanical,photocopying,recordingorotherwise)withoutthepriorwrittenpermissionofthecopyrightowner.

Applicationsforreproductionshouldbemadeinwritingto:TheOfficeofPublicSectorInformation,InformationPolicyTeam,Kew,Richmond,SurreyTW94DUore-mail:[email protected]

ThisguidanceisissuedbytheHealthandSafetyExecutive.Followingtheguidanceisnotcompulsoryandyouarefreetotakeotheraction.Butifyoudofollowtheguidanceyouwillnormallybedoingenoughtocomplywiththelaw.Healthandsafetyinspectorsseektosecurecompliancewiththelawandmayrefertothisguidanceasillustratinggoodpractice.

Remotelyoperatedshutoffvalves(ROSOVs) Page3of47


ContentsIntroduction 4Whatisaremotelyoperatedshutoffvalve? 4Whoisthisguidancefor? 4Whyisthereaneedforguidance? 4 LessonsfromtheAssociatedOctelfire 5HSEresponse 5HowHSEusesgoodpracticeinassessingcompliance 5Howtousethisguidance 7Meetingthestandard 8ALARPdemonstration 8

Scope of the guidance 10Hazardoussubstancesincluded 10Activitiesincluded 11Topicsexcluded 11

Assessing your site 12Hierarchyofmeasures 12Newinstallations 12Existinginstallations 12Reasonablepracticability 13Precautionaryapproach 13WhentoconsiderfittingaROSOV 13BenefitsofROSOVs 14Personalprotectiveequipment 14Bunding 15Dualhazardsubstancesandmixtures 16

The selection criteria 17Howdotheselectioncriteriawork? 17Theprimaryselectioncriteria 18Thesecondaryselectioncriteria 18

Selection and operation of ROSOVs 19Activation 19Typesofvalves 19Actuators 19Failuremode 20Externalhazards 20Consequentialhazards 20Dualfunctionvalves 21Excessflowvalves 21Reliabilityandintegrity 22

Appendix 1 A case-specific assessment of the reasonable practicability of a ROSOV 23

Appendix 2 Summary of relevant legal requirements 44

References and useful addresses 45

Further information 47



IntroductionWhat is a remotely operated shutoff valve?

1 Inthisguidancearemotelyoperatedshutoffvalve(ROSOV)isdefinedas:

n Avalvedesigned,installedandmaintainedfortheprimarypurposeofachievingrapidisolationofplantitemscontaininghazardoussubstancesintheeventofafailureoftheprimarycontainmentsystem(including,butnotlimitedto,leaksfrompipework,flanges,andpumpseals).Closureofthevalvecanbeinitiatedfromapointremotefromthevalveitself.Thevalveshouldbecapableofclosingandmaintainingtightshutoffunderforeseeableconditionsfollowingsuchafailure(whichmayincludefire).

2 Valvesperformingthesameorsimilarfunctionmayalsobereferredtoas:emergencyisolationvalves(EIVs);remotely-operatedblockvalves(RBVs);oremergencyshutdownvalves(ESDVs).

3 ThisguidancewillhelpyouidentifytheneedforremoteisolationofhazardoussubstancesusingROSOVs,aspartofyouremergencyarrangementsforthesafeandcontrolledshutdownofplantandequipment.

Who is this guidance for?

4 ThisguidanceisissuedbytheHealthandSafetyExecutive(HSE)toassistdutyholdersincomplyingwithrelevanthealthandsafetylaw.Followingtheguidanceisnotcompulsoryandyouarefreetotakeotherequally effective action.

5 Theguidanceisforoperatorsandmanagersofhazardousinstallationshandling,storingorprocessingthehazardoussubstancesdetailedinthescope.Itwillalsobeofinteresttoplantsupervisors,design,process,andmaintenanceengineersandsafetyprofessionals.

6 ThroughoutthisguidancereferencestotheimplementationofaROSOVshouldbetakentomeanaROSOVorotherequallyeffectivemeasuresthatwillachieveanequivalentdegreeofriskreduction.AllpublishedmaterialislistedintheReferencesandusefuladdressessectionandtitlesappearinitalics.

Why is there a need for guidance?

7 Inanemergency,rapidisolationofvesselsorprocessplantisoneofthemosteffectivemeansofpreventinglossofcontainment,orlimitingitssize.

8 Thisguidegivesyousimplifiedcriteriafordecidingwhenyouneedtoprovideafacilityforremoteisolation.

9 Theappendicesincludeguidanceonhowtomakeacase-specificassessmentofthereasonablepracticabilityofretrofittingaROSOVtoanexistinginstallation.

10 TheprovisionofROSOVswashighlightedbytheHSEinvestigationintoanincidentattheAssociatedOctelCompanyLimitedatEllesmerePort



inFebruary1994.ThefindingsoftheinvestigationintothisincidentwerepublishedbyHSEin1996:The chemical release and fire at the Associated Octel Company Limited.1

11 AnotherincidentthathascontributedtothedriveforguidanceonROSOVswasthefireonthefluidisedbedcatalyticcrackingunitattheBPGrangemouthRefineryinJune2000.AreportontheincidentisavailableontheHSEwebsiteonwww.hse.gov.uk/comah/bpgrange/contents.htm

Lessons from the Associated Octel fire

12 OneoftheconclusionsoftheAssociatedOctelreportwasthattheincidentescalatedrapidlybecauseitwasnotpossibletostoptheinitialrelease.ThisproblemcouldhavebeenavoidedifROSOVshadbeeninstalled(astheywereelsewhereonthesite).Thereportdescribedanumberoflessonstobelearnedfromtheincidentincludingthefollowing,whichrelatedirectlytotheprovisionofROSOVs:

‘Lesson 5:Aspartoftheircomprehensiveriskassessments,companiesincontrolofchemicalprocessplantatmajorhazardssitesshouldcriticallyreviewtheprovisionofROSOVsatbothstorageandprocessvesselsinwhichsignificantinventoriesofdangeroussubstancesareheld.

Lesson 6:HSE,inconjunctionwithotherinterestedparties,shoulddevelopandpublishadditionalguidanceontheprovisionofROSOVsandothermethodsofmitigatingrisksonprocessplant.’

HSE response

13 InresponsetoLesson6,interimguidanceonthegeneralprinciplesofisolationofhazardoussubstanceswaspublishedbyHSE:ChemicalsInformationSheetNo2Emergency isolation of process plant in the chemical industry.2

How HSE uses good practice in assessing compliance

14 Thelawrequiresthatyouundertakeasuitableandsufficientriskassessmenttodeterminethemeasuresnecessarytoensurethatriskstohealthandsafetyareadequatelycontrolled.

15 HSEexpectssuitablecontrolstobeinplacetoaddresseverysignificanthazardandthatasaminimumthosecontrolsmustachievethestandardofrecognisedgoodpracticeprecautionsforyourindustry.

16 HSEinspectorsseektosecurecompliancewiththelawandmayrefertorelevantcodes,standardsandguidanceasillustratinggoodpractice.

17 HSE’spublicationReducing risks, protecting people(R2P2)3andthesupportingdocumentAssessing compliance with the law in individual cases and the use of good practice4discussHSE’spolicyontheroleofgoodpractice.Thelatterincludesadefinitionofgoodpracticeinthiscontext.BothareavailableontheHSEwebsiteatwww.hse.gov.uk

18 Adoptingrelevantgoodpracticeprecautionsforyourindustryisastraightforwardwaytodemonstratethatyouarecontrollingriskseffectively.It



freesyoufromtheneedtotakeexplicitaccountofthecostsandbenefitsofeachindividualriskcontrolmeasure(systemofwork,itemofhardwareetc).Thesewillhavebeenconsideredwhenthegoodpracticewasestablished.However,thisdoesnotmeanthatyouwillneverneedtodoanymoretosatisfythelaw.Youstillhaveadutytoconsiderifthereisanythingaboutyourcircumstancesthatmeansfurtheractionisnecessary.

19 HSEconsidersthatthisguidancerepresentsgoodpracticeforemergencyisolationwithinthelimitationsofthescope.However,theguidanceisundercontinuousreviewandadvancesintechnologyornewknowledgeofhazardsmayleadHSEinspectorstoseekahigherstandardinsomecases–thestandardsethereshould,therefore,beregardedastheminimum.



How to use this guidance

20 TheflowchartinFigure1summariseshowtoapplythisguidancetoidentifywhereROSOVsshouldbeprovided.

Figure 1HowtoapplyROSOVs



Meeting the standard

21 Youshouldcomparetheprovisionforemergencyisolationonyoursiteagainsttheselectioncriteriaandidentifyanyareaswheretheprecautionsinplacedonotmeetthestandarddescribedinthisguidance.

22 Unlesstheselectioncriteriaindicateotherwise,ROSOVsshouldbeincorporatedintothedesignofanewinstallation.

23 InthecaseofanexistinginstallationROSOVsshouldbeprovidedunlessyoucandemonstratethatretrofittingisnot‘reasonablypracticable’inthecircumstances(seeAppendix1).

24 Aphased,prioritisedprogrammeofupgradingmaybeappropriate.IfnecessaryyoucandiscusswiththeHSEproposedworkarisingfromyourassessments.Whereyouconsiderthatyouhaveidentifiedalternativebutequally(ormore)effectivemeanstocontroltheriskyoushoulddocumenttheseconclusionsaspartoftherecordofyourstatutoryriskassessment.

25 Thisriskassessmentneedstobekeptunderreview.Changesinunderstandingoftherisk,orreductionsinthecostsofimplementingthemeasure,mayshiftthebalanceofthecost/benefitequation.

26 Followingthisgoodpracticeguidancedoesnotmeanyouwillneedadditionaldocumenteddemonstrationsofsafety.IfyouuseotherequallyeffectivemeasuresinsteadofaROSOV,thereisnoneedtoperformaseparateassessment.Yourdemonstrationthatthemeasuresactuallyinplacemakerisksaslowasreasonablypracticable(ALARP)isallthatisneeded.

27 IfyoucannotdemonstratethatyouhaveotherequallyeffectivemeasuresonsiteandyoudonothaveaROSOVwhereoneisindicatedbythisguidancethenyoushouldbeabletoshowthatfittingaROSOVisnotreasonablypracticable.

28 Appendix1ofthisguidancegivesadditionaladviceondemonstratingreasonablepracticability.Appendix2summarisessomeoftherelevantlegalrequirementsrelatingtotherecordingofriskassessmentfindingsingeneralandthemoredetailedrequirementsimposedonsomedutyholdersundertheControl of Major Accident Hazards Regulations 1999(COMAH).5

29 Ifadetailedriskassessmentshowsthatupgradingisnotreasonablypracticablethenthebasisforthisconclusionshouldbedocumentedaspartofyourassessmentrecord.

ALARP demonstration

30 Thisguidanceislimitedtoaconsiderationofasingleriskreductionmeasure–theprovisionforemergencyisolation.ThismaybeonlyoneofanumberofmeasuresnecessarytomaketheriskfromaparticularhazardALARP.

31 Whereitcanbeshownthatconformancewithgoodpracticeresultsinrisksbeingreducedtothe‘broadlyacceptable’level(seeR2P2)3thenthiswillnormallybeacceptedasdemonstratingcompliancewiththelaw.

32 Wheretheresidualriskremainshigher,inthe‘ALARPregion’(R2P2)3thenyoushouldcontinuetoseekfurtherreasonablypracticableriskreduction



measuresand,whereapplicable,toincludetheseaspartofyourALARPdemonstration.

33 Goodpracticethatcoversalltherisksfromyourworkactivitymaynotbeavailable,soifyouarerequiredtomakeanexplicitALARPdemonstration,amorerigorousanalysismaybeneededtodemonstratethatallmeasuresnecessaryhavebeenimplemented.



Scope of the guidanceHazardous substances included

34 Thisguidanceislimitedtooperationsinvolvingthestorage,transfer,orprocessingofsubstancesthatare:

n classifiedundertheChemicals (Hazard Information and Packaging for

Supply) Regulations 2002(CHIP)6asflammable,highlyflammable,extremelyflammable,toxicorverytoxic;and

n liquidsorgasesundertheconditionsofstorageand/orprocessing.

35 ThegeneraladviceonwhatyoushouldconsiderwhendecidingwhetherornottoprovideaROSOVmayalsobeusefulinthecontextofotherhazardoussubstances.However,theseothersubstanceswerenotconsideredinsettingthedecisioncriteriaandsothespecificresultmightnotbeappropriateineverycase.

36 WhendecidingifyouneedtoprovideROSOVsforsubstancesnotincludedinthescopeofthisguidance,youshouldeither:

n refertoothergoodpracticeguidancewrittenforthatsubstanceorcategory

ofsubstances;orn undertakeyourowncase-specificriskassessment.

37 Appendix1isausefulguideformakingacase-specificriskassessment.However,youwillneedtoconsiderexplicitlythehazardousproperties(physical,chemicalandtoxicological)ofthesubstancesyouuseiftheriskassessmentistobesuitableandsufficient.

38 SomehigherflashpointsubstancesnotclassifiedunderCHIPasflammablearestoredorprocessedattemperaturesabovetheirflashpoint,orunderelevatedpressures.Thesemaybecapableofformingaflammableatmospherefollowinglossofcontainment.Thisguidancewillalsobeusefulindecidingwhetherornottoprovideforremoteisolationofsubstancesinthiscategorywheremorespecificguidancedoesnotcurrentlyexist.

39 SomesubstanceswillnotbeincludedinthecurrentCHIPApproved supply list,7whichlistsdangerouschemicalsalongwiththeirEC-agreedclassifications.Thismayincludeintermediatesthatarenot‘supplied’and,therefore,wouldnotbesubjecttoCHIP.Toapplythisguidanceyouwillneedtoself-classifythesubstanceaccordingtothemethoddescribedintheCHIPApproved classification and labelling guide6asifitwereintendedforsupply.

40 Somesubstancesmayhavedualclassification.Forsubstanceswithbothflammableandtoxicpropertieseachhazardshouldbeassessedseparately.Ifdifferentstandardsareindicatedthenthehigherstandardshouldbeadopted.

41 ThisguidancemayleadyoutoconcludethataROSOVisnotareasonablypracticablemeasureforthecontrolofriskstohealthandsafety.However,theEnvironmentAgency(EA)ortheScottishEnvironmentProtectionAgency(SEPA)maystillrequireyoutoprovideforremoteisolationofdangeroussubstancestoprotecttheenvironment.FordetailsofhowtocontacttheEAandSEPAseeReferencesandusefuladdressessection.



Activities included

Onshore installations42 Thisguidanceisapplicableatonshoreinstallationsincludingchemical

manufacturingsites,petrochemicalfacilitiesandsitesengagedinthestorageanddistribution(excludinglongdistancepipelines)ofhazardoussubstances.

43 Theguidancemaybeappliedatallonshorefacilitieswherestorage,transferorprocessingofthespecifiedcategoriesofsubstancestakesplace,irrespectiveofwhetherthesiteissubjecttotherequirementsofCOMAH.

Petroleum dispensing44 Petroleumretailissubjecttoalicensingregimeandisoutsideofthescopeof

thisguidance.Theprovisionoftechnicalmeasuresincludingmeansofsafeisolationinanemergencyiscoveredbyspecificguidanceand,whereappropriate,bylicenceconditions.

45 However,thisguidanceisapplicablewherethenon-retaildispensingoffuelintovehiclestakesplace,egduringvehiclemanufacture.

Offshore installations and transmission pipelines (on or offshore)46 Thisguidancewasproducedspecificallyforusebytheonshoresector.Offshore

installations,andpipelinescoveredbythePipelines Safety Regulations 1996,8aresubjecttospecificlegislationthatincludesexplicitrequirementsforremoteoperationofplant,includingemergencyshutdownvalves.Forexample,theOffshore Installations(Prevention of Fire and Explosion, and Emergency Response) Regulations 1995(regulation12)9andthePipelines Safety Regulations 1996(regulation19).8

Topics excluded

47 Thisguidancedoesnotgivedetailedadviceonmeasuresforprocesscontrolorpressurereliefarrangements(includingreactordepressurisationandthe‘dumping’or‘quenching’ofrunawayreactions)andthefollowingissuesareexcluded.

Specification of valves48 Adviceonsuitabilityofvalvestoperformaparticularduty,includingappropriate

materialsofconstruction,shouldbesoughtfromyoursupplierormanufacturer.

Maintenance49 Itisfrequentlynecessarytoisolateplantcontaininghazardoussubstancesto

allowformaintenance.Therequirementsforsafeisolationforthesepurposesarenotcoveredhere.AdviceonthistopicmaybefoundinHSE’sThe safe isolation of plant and equipment.10

Detection systems50 Thisguidancedoesnotconsiderinanydetailthedetectionsystemsthatarea

necessarycomponentofasystemforautomaticactivationofROSOVs(automaticshutoffvalves,ASOVs).

Control of exothermic reactions51 Thereisaroleforremotelyoperatedvalvesinthecontrolandemergency

shutdownofexothermicreactionstoavoidrunaway.TheuseofROSOVsforthesepurposesisoutsideofthescopeofthisguidance,butadvicecanbefoundintheHSEpublicationDesigning and operating safe chemical reaction processes.11



Assessing your siteHierarchy of measures

52 Youshouldbeabletodemonstratethatyouhaveconsideredahierarchyofmeasures:

n Inherentlysaferoptions(suchassubstitutionofahazardoussubstance

byalesshazardousone,reducingthequantityofthesubstancestoredorprocessedetc).

n Optionsforpreventionandcontroloflossofcontainment(suchaspreventivemaintenance,inspection,testingetc).

n Mitigationmeasures(suchasROSOVsandbunding).

53 Forexistinginstallations,optionsforinherentlysaferprocesseswillbemorelimited.Youshouldstillgiveprioritytomeasuresthatpreventorlimitlossofthehazardoussubstancefromtheprimarycontainmentovermitigationmeasuressuchassecondarycontainment.

54 Theguidanceappliestobothnewandexistinginstallations.

New installations

55 Thedesignofanewinstallationshouldfullyconformtothegoodpracticesetoutinthisguidance.

Existing installations

56 Forexistinginstallationswherethecurrentprovisiondoesnotmeetthestandardsetoutinthisguidance,youshouldupgradetheinstallationsofarasisreasonablypracticable.Takeyourcurrentsituationasthestartingpoint,whenyouassesstherisktobereduced,forcomparisonwiththecostofachievingthatreduction.Youmaytakeaccountofanymeasuresthatarealreadyinplacewhenestablishingthepresentlevelofrisk(withoutaROSOV).However,themeasuresmustbeeffectiveagainstthesamecontainmentfailures,forexample:

n whereitemsofplantarebundedtheremaybelongrunsofinterconnectingpipeworkoutsidethebund;

n aROSOVclosetotheplantitemwillprovideprotectionwhereverapipeworkfailureoccursbutbundingwillonlymitigatereleasesthatoccurwithinthebundedarea.

57 Itisrecognisedthattheremaybeadditionalcostsassociatedwithretrofittingmeasurestoexistinginstallationsandthatitisappropriatetoconsidertheseextracostswhenreachingadecisiononreasonablepracticability.InR2P23Appendix3includesadiscussionoftherelevantcostandbenefitstobeconsidered.

58 Someoftheadditionalcostsassociatedwithretrofitting,suchasdowntimeandlossofproduction,canbeminimisedbyco-ordinatingtheretrofittingwithplannedmaintenance,refurbishmentorupgradingoftheinstallation.



Reasonable practicability

59 HSEconsidersthatdutiestoensurehealthandsafetysofarasisreasonablypracticable(SFAIRP)anddutiestoreducerisksaslowasisreasonablypracticable(ALARP)areequivalent.Eachcallsforthesamesetofteststobeapplied.

60 TherequirementunderCOMAHtotake‘allmeasuresnecessary’topreventmajoraccidentsandlimittheirconsequencesisinterpretedasmeaningthattherisksfrommajoraccidenthazardsshouldbereducedtoALARP.

61 Insomecircumstancestherisksfromaparticularhazardousactivitymaybesohighastobeunacceptableforallpracticalpurposes,whatevertheassociatedlevelofbenefits.Conversely,whenthelevelofriskisinherentlyveryloworhasbeenmadeverylowbytheapplicationofsuitablecontrols,thenformostpracticalpurposestheriskcanberegardedasinsignificant.HSEwouldnotnormallyseekfurtherriskreductionmeasures,astheresourcerequiredwouldbedisproportionatetotherisk.However,wherefurtherreasonablypracticableriskreductionmeasurescanbeidentifiedthenthelawrequiresthatthesebeimplemented.

62 Betweenthesetwoextremes,agivenlevelofriskfromahazardousactivitymaybejudgedtolerableforthebenefitsthattheactivitybrings,providedthattheriskismadeALARP.

63 Wheretherisksaretolerable, if ALARPyoushouldcompare:n thebenefitsarisingfromthereductioninriskachievedbyparticular

measures;andn thecostintime,moneyortroubleofimplementingthosemeasures.

64 Onlywherethereisa‘grossdisproportion’betweenthetwo,ietheriskreductionbeinginsignificantinrelationtothecost,canthemeasuresberuledoutasnotreasonablypracticable.

65 FurtherdiscussionofthetolerabilityofriskandtheprincipleofALARPcanbefoundintheHSEpublicationR2P2.3

Precautionary approach

66 WhenmakingdecisionsregardingtheprovisionofriskreductionmeasuresitisHSEpolicytoadoptmorecautiousestimates:

n wheneverthereisgoodreasontobelievethatseriousharmmightoccur,

evenifthelikelihoodisremote;orn whenuncertaintyregardingeithertheconsequencesorthelikelihood

underminesconfidenceintheconclusionsoftheriskassessment.

(Seriousharmisdefinedasdeathorseriouspersonalinjury,especiallywhenmultiplecasualtiesresultfromasingleevent.)

When to consider fitting a ROSOV

67 YoushouldassesstheneedtofitaROSOVwhereverthereisthepotentialforamajoraccidentasaresultoflossofcontainmentofahazardoussubstance,theconsequencesofwhichcouldbesignificantlyreducedbyrapidisolation.



68 Manualvalvesshouldneverbeusedinsituationswheretheemployeeeffectingtheisolationwouldbeplacedindanger.ThisisamajorconsiderationindecidingwhentouseROSOVs.Manualvalveisolationmaybeacceptableinsomecaseswhererapidisolationisnotrequiredtopreventamajoraccident.However,manualvalvesareoftenfittedmainlyformaintenanceworkandareunlikelytobethesafestormosteffectiveoptionforemergencyisolation.

69 Thepotentialforamajoraccidentwilldependonarangeoffactorsincluding:

n thenatureandpropertiesofthesubstance;n thequantityofsubstancereleased;n thesizeandnatureofpopulationsatriskandtheirproximitytotheplant;andn thepresenceofotherplantincludingconfiningstructuresandother

hazardousinventories(escalationpotential).

70 Ultimatelythedecisionwhetherornottoprovideremoteisolationisbasedonanassessmentof:

n thelikelihoodthatthemajoraccidentwilloccur;n theconsequences(intermsoftheextent and severityofharmtopeople).

71 Togetherthesefactorsrepresenttherisk.Thereductioninriskisthebenefitthatmustbebalancedagainstthecostofprovidingthefacility.

Benefits of ROSOVs

Toxic hazards72 FortoxichazardsROSOVscanhaveasignificantbenefitbyreducingtheextent

ofthehazardsothatfewerpeopleareexposed.However,sincetheROSOVmayfailondemand,theriskisreducedbutnoteliminated.

73 Also,peopleonsitemaybewithinthehazardrangeirrespectiveofwhetherthereleaseisterminatedrapidlybyaROSOVorismoreprolongedduetorelianceonmanualisolation.However,eveninthesecases,terminatingthereleasemorerapidlywillreducetheirexposure.

74 Providingaremote(orautomatic)activationfacilitywillavoidemployeeshavingtodeliberatelyenteratoxicatmospheretoeffectisolationmanually.

Flammable hazards75 Forflammablesubstances,employeesshouldnotberequiredtodeliberately

enteraflammableatmospheretoisolateplantmanually,especiallyaspersonalprotectiveequipment(PPE),isnotapracticablesolution.

76 Thepotentialforescalationismuchgreaterforflammablesubstances,particularlyincomplexplantwithsignificantareasofcongestionduetocloselyspacedplant,pipeworkandotherstructures.Whenignitionoccursinacongestedareathereisanincreasedriskofavapourcloudexplosion.Theoverpressurefromavapourcloudexplosionmaybecapableofcriticallydamagingotherplant,leadingtofurtherlossofcontainmentandpotentialcasualties.

Personal protective equipment

77 InaccordancewiththehierarchyofmeasuresdescribedintheControl of Substances Hazardous to HealthRegulations(COSHH),12provisionofpersonal



protectiveequipment(PPE)isnotconsideredanadequatealternativetoremoteisolationforanewinstallationforwhichfittingROSOVsisconsideredreasonablypracticable.

78 Forexistinginstallations,thepracticeofmanualisolationbyemployeeswearingPPEshouldonlybeadoptedifthecostofretrofittingROSOVsisgrosslydisproportionatetothereductioninrisk.

Bunding

79 Secondarycontainmentintheformofabundisameasuretomitigatetheconsequencesofaspillonceithasoccurred,andthereforecomeslowerinthehierarchyofcontrolsthanmeasuresthatlimitthelossofmaterialfromtheprimarycontainmentsystem.

80 AbundmayberequiredtocontainarangeofpotentialreleasesforwhichaROSOVwouldnotbecapable–including,forexample,overflowingofavesselandholesinthevesselitself.ROSOVsandsecondarycontainmentarenotmutuallyexclusiveandbothmayberequiredtoreducetherisksfromtherangeofpossiblehazardouseventstoALARP.

81 Foranewinstallation,priorityshouldbegiventoreasonablypracticablemeasurestopreventtheescapeofthehazardoussubstancefromtheprimarycontainmentsystem(vessel,pump,pipeworketc)overtheprovisionofsecondarycontainment.

82 Forexistinginstallationswheresecondarycontainmentisalreadyprovided,theconsequencesofareleasewithinthebundedareawillbemitigated.ThiscanbetakenintoaccountwhenmakingdecisionsaboutthereasonablepracticabilityofretrofittingaROSOV.

83 However,wherethepipeworkextendsbeyondthebundedarea,theprincipalbenefitsofferedbythebundwillbelostintheeventofafailureoutside.Thebundwallmaylimitencroachmentofthespillageonthevessel(s)withinthebund,buttheresultingpoolwillbepotentiallymuchlargerandmayspreadtoothervulnerablelocations.

84 Wherethehazardoussubstanceisunderpressure,egbeingpumped,thensomefailuresthattakeplacewithinthebundcouldresultinajetorsprayofthefluidbeingprojectedbeyondtheconfinesofthesecondarycontainment.Thisisparticularlytrueforsomepoorlydesignedorinadequatelymaintainedbunds.

85 Evenforreleasesintothebund,bundingdoesnothingtolimitthesizeofthereleasebutlimitsthesizeofthepoolandhencetheevaporationrate.Theevaporationratewillreachamaximumoncethequantityofmaterialreleasedissufficienttocovertheareaofthebund.Thisisirrespectiveofwhetherthereleaseisisolatedmanuallyorremotely.However,alongerreleasemeansmorematerialtransferredintothebund.Unlessstepsaretakentocontrolevaporationfromtheliquidinthebund,egbycoveringthesurfacewithaninertbarrier,theevaporationwillcontinueforalongerperiodwithpotentiallyadverseresults.Forexample,ifaflammablesubstanceisreleasedintothebundandignited,thelargerquantityoffuelislikelytoresultinamoreprolongedfire,increasingtheriskofescalation.



Dual hazard substances and mixtures

86 SomesubstancesmaybebothtoxicandflammableandwhiletheirCHIPclassificationusuallyreflectsthegreaterhazard,insomecircumstancesthesecondaryhazardmaydominate.Forsubstanceswithbothflammableandtoxicpropertiestheselectioncriteriashouldbeappliedforeachhazardseparatelyandifdifferentstandardsareindicatedthenthehigherstandardshouldbeadopted.

87 Inthecaseofsimplemixturesofsubstanceswithinthescopeofthisguidanceasimilarapproachmaybetaken,withthestandardadoptedbeingthehighestrequiredforeachofthecomponents.

88 Ifonecomponentisaminorconstituent,egasmallpercentageofatoxicsubstanceinaflammablesolvent,thenyoushouldrefertoSchedule3oftheCHIPRegulationsandtheApproved Classification and Labelling Guide6toarriveatanappropriatecategorisation.

89 Insomecasesthesubstancemayhaveasecondaryhazardcategorythatfallsoutsideofthescopeofthisguidance,egforoxidisersorsubstancesthatreactwithwater.Thesecondarypropertyshouldbeseparatelyassessed,byreferencetootherrelevantgoodpracticeorbymeansofacase-specificassessment,andagainthehigherstandardshouldbeadopted(seeAppendix1).



The selection criteriaHow do the selection criteria work?

90 TohelpyoudecidewhethertouseaROSOVinaparticularcase,anumberofselectioncriteriahavebeendevelopedbasedonjudgementsabouttheextentandseverityoftheconsequencesintheeventofamajoraccident.

91 Thecriteriaaredividedintotwogroupsofprimaryandsecondaryselectioncriteria.

92 Primaryselectioncriteriaservetoquicklyeliminatelow-riskcaseswherethehazardpotentialissufficientlylowthattheprovisionofremoteisolationisunlikelytobejustified.

93 Whereitcanbeshownthatalloftheprimaryselectioncriteriaaresatisfied,thenaROSOVwouldnotnormallyberequired.

94 WhenyouapplytheprimaryselectioncriteriaandtheydonoteliminatetheneedforaROSOV,youshouldchooseeithertoprovideaROSOVoralternativelytorefinetheassessmentbyapplyingthesecondarycriteria.

95 ThesecondaryselectioncriteriaidentifyaseriesofgenericcircumstancesinwhichthehazardsareconsideredtobesosignificantthatyoushouldnormallyfitROSOVswhenanyoneormoreofthesecriteriaapply.

96 Thissecondgroupofcriteriaaremoredetailedandrequireadeeperanalysisofthepotentialconsequencesofalossofcontainmentevent.IfyoucanshowthatnoneofthesecondaryselectioncriteriaareapplicablethenaROSOVisunlikelytobeareasonablypracticablemeasure.

97 IftheapplicationoftheselectioncriteriadoesnoteliminatetheneedforaROSOVthenprovisionofaROSOVisconsideredtobegoodpracticeforanewinstallation.

98 Foranexistinginstallation,aROSOVshouldnormallybefittedunlessasufficientlydetailedanalysisismadetoshowthatretrofittingisnotreasonablypracticableinthecircumstances.

99 Appendix1givesguidanceonthefactorsthatyouwillneedtoconsiderinacase-specificassessmentifitistobeacceptedasasuitableandsufficientdemonstration.

Event frequencies100 Thereisconsiderabledifficultyanduncertaintyassociatedwithdeterminingthe

frequencyoflossofcontainmentevents.Thisguidanceemployssimplifieddecisioncriteriainwhichgreateremphasisisplacedonthescaleofthepotentialreleaseandtheseverityofthepotentialconsequencesthanonthefrequency.Ifyouchoosetoemployfrequency-basedargumentsyoushouldbepreparedtoprovidearobustjustificationforthefrequenciesused.



The primary selection criteria

101 Thefollowingaretheprimaryselectioncriteria:

n Themaximumforeseeablereleaseofahazardoussubstanceintheeventoffailuretoisolatemanuallyislessthan1%ofthecontrolledquantity(Q)specifiedinSchedule1,Column2ofthePlanning(ControlofMajorAccidentHazards)Regulations1995forthepurposesofHazardousSubstancesConsentforthenamedsubstance(PartA),orcategoryofsubstance(PartB).

n Manualisolationwouldnotrequireemployeestoenteraflammableatmosphereandexposethemtoriskofseriouspersonalinjuryordeathduringtheattempt.

n Manualisolationwouldnotrequireemployeestoenteranareainwhichtheconcentrationofatoxicsubstanceexceedsalevelatwhichanormalhealthyindividualcouldescapeunaidedandwouldnotputthematriskofseriouspersonalinjuryordeathwhileattemptingtheisolation.

n Therateanddurationofthereleaseissuchthatnopotentialforseriousdanger(deathorseriousinjury–ieinjuryrequiringanovernightstayinhospital)canbeforeseen.

The secondary selection criteria

102 IfyoufindthattheprimaryselectioncriteriadonotruleouttheneedforaROSOVthenthefollowingsecondarycriteriashouldbeusedandaROSOVfittedwhenoneormoreofthesecriteriaapply:

n AROSOVisrequiredbyotherrelevantandauthoritativeguidanceongood

practice,egsubstanceorprocessspecificguidancesuchasSafety advice for bulk chlorine installations13ortheLiquefiedPetroleumGasesAssociationCodesofPractice.

n ThehazardoussubstanceispresentasagasliquefiedunderpressureandthecircumstancesunderwhichROSOVsshouldbefittedarenotalreadydealtwithinexistingsubstanceorprocessspecificandauthoritativeguidanceongoodpractice.

n Thevalveservestoisolateaflexibleloadingarm,hoseorsimilarvulnerableitemofplantwheretherearefrequentconnectionsanddisconnections.

n Thelocationofthepotentiallossofcontainmentisoutsideofanybundedareaorothersecondarycontainment.

n Failuretoisolateareleaseofaflammablesubstance,thedirectconsequencesofwhich(egthermalradiationoroverpressure)areconfinedtothesite,couldresultinescalationinvolvingareleaseofanotherhazardoussubstancewithoff-siteconsequences.

n Theextendedreleasedurationassociatedwithmanualisolation(likelytobeatleast20minutes)resultsinanincreasednumberofpredictedoff-sitefatalitieswhencomparedtothecasewithaROSOV.



Selection and operation of ROSOVsActivation

103 ROSOVscanbemanuallyactivatedthroughpushbuttonslocatedadistancefromthevalve.Automaticshutoffvalves(ASOVs)activatedbyadetectionsystem,egatoxicorflammablegasdetector,canprovideamoreimmediateresponse.

Manual activation104 Oneadvantageofmanualactivationisthatanintelligentassessmentofthemost

appropriatemeasurefordealingwithareleasecanbemade.Claimsaresometimesmadethatmanualactivationisnecessarytoavoidspurioustripsassociatedwithautomaticsystems;however,therootcauseisoftenabadlydesignedsystemratherthananyinherentweaknessinanautomatedresponse.

105 Manualactivationmustbejustifiableandthelocationofpushbuttonsmustnotendangertheemployee.Theyshouldbeaccessibleandinasafeandsuitableplaceinrelationtothehazardouseventthatmayoccur.Thereshouldnormallybeatleasttwoalternateactivationpoints,whichshouldbereadilyidentifiablebothontheplant(eglabelling)andinallrelevantoperatinginstructions.

ASOVs106 AdvantagesofASOVsincludemorerapidisolationandareductioninthe

frequencyofsomemodesofhumanerror.

107 Facilitiesformanualactivation,onemergencyescaperoutesforexample,shouldbeprovidedasabackuptoautomaticactivationandcanresultinamorerapidresponseinsomecircumstances.

Types of valves

108 Thedetailedselectionofaparticularvalve,includingmaterialsofconstruction,isbeyondthescopeofthisguidanceandadviceshouldbesoughtfromyoursupplierormanufacturer.Akeyfeatureofanyvalveusedforemergencyisolationistheabilitytoachieveandmaintaintightshutoffwithinanappropriatetimescale.Commonlyusedvalvetypesincludegatevalvesandplugvalves.Butitisimportantthateachvalveischosentomeetthespecificrequirementsofyourinstallation.

Actuators

109 Aremotelyoperatedvalvecanbeoperatedbyavarietyofdifferentmethodssuchaspneumatic,hydraulicorelectricalenergysources.ROSOVsshouldcontinuetobecapableofperformingtheirfunctionintheeventoffailureoftheprimarypowersupply,egmechanicalspringsorpressurisedfluidreservoirs.

110 Itmaybepossibletoconvertexistingmanualisolationvalvestoremoteoperationbyincorporatinganactuatorandasuitablecontrolsystem.Thesuitabilityofsuchaconversionisbeyondthescopeofthisguidanceandadviceshouldbesoughtfromthemanufacturerofthevalveand/ortheactuator.



111 ThecorrectsizingoftheactuatoriscrucialtomeetingthesafetyrequirementsspecificationoftheROSOV.Undersizingmayresultinthevalvenotoperatingondemandwhileoversizingmayresultindamagetothevalveoractuatorassembly.Thedesignmustshowanunderstandingofthesafetyrequirementsandbebasedonthecompletesystemcharacteristics.Thiswouldincludetakingintoaccount:

n thestatic/dynamicforcesoftheassembly;n theeffectoftheprocessapplicationontheseforces;n thefrequencyofexercisingthesystem;n theminimum/maximumrangeofgas/hydraulicpressuresusedforactuation;

andn thefactthatactuatorsaremanufacturedindiscretesizes.

112 Thecompetencerequiredtocarryoutasuccessfulsystemdesignmaynotresideinasingleorganisation(egiftheactuatorandvalvecomefromdifferentsuppliers).However,overallresponsibilityforthecompletesystemmeetingitssafetyrequirementsspecificationshouldbeclearlyassigned.

Failure mode

113 MostROSOVsprovidedforemergencyisolationaregenerallyconfiguredtoclose,andsoisolatethehazardousinventory,onfailure.However,itshouldnotbeautomaticallyassumedthatthisresultsinasafeconditioninallcases.Iftheabilitytoreopentheisolationvalvefollowingtheinitialshutdown(egduetolossofutilities)iscriticaltosafety,thenbackupsuppliesshouldbeprovided.

External hazards

114 ROSOVsshouldbeprotectedagainstexternalhazardssuchasfiresorexplosionstoensurethat:

n theycanbeclosed;andn theywillcontinuetoprovidetightshutoff.

Consequential hazards

115 ThebenefitsofROSOVsareclear,butitisimportanttorecogniseandaddressanumberofnewhazardsthatmayariseasaconsequenceoftheirinstallation.SomeoftheriskreductionprovidedbytheROSOVmaybeoffsetbyrisksassociatedwiththeinstallationandongoingmaintenance.TheneedforadditionalmeasurestotackletheseconsequentialhazardsshouldnotbetakenasabartofittingROSOVs,butmayinfluencethereasonablepracticabilityofretrofittingROSOVstoanexistinginstallation.Examplesofsomeoftheseconsequentialhazardsarelistedbelow.

116 Oncomplexorinterconnectingplant,thelocationofROSOVsneedscareful

considerationduetothepotentialfor:n overpressurisationdueto‘blockingin’aliquidwithahighexpansion

coefficient;andn theeffectsofspuriousvalveoperation.

117 Otherpotentialhazardsassociatedwithisolation valvesinclude:



n thecreationofdamagingpressuresurges(‘hammer’)inlongpiperunsifvalvesclosetooquickly;

n introductionofanewpotentialleaksource;n hazardsassociatedwithinstallation,maintenanceandtesting;andn generalincreaseincomplexityofthesystem.

Dual function valves

118 Insomecases,thenormalprocesscontrolsystemincludesvalves,activatedbyprocessmeasurementsensorsandactingaspartofatriporshutdownsystem.

119 Emergencyisolationvalvesneedtobecapableofachievingandmaintainingtightshutoff.Sometypesofcontrolvalvesaredesignedtoprovidea‘throttling’actionandthistypedonotalwaysprovideasufficientlytightseal.Othertypesofvalveused,eginthecontrolofbatchtransfers,maybecapableofachievingatightseal.Failureofadualfunctionvalvemaycompromisebothfunctionsandapostulatedfailureofthecontrolvalvemayitselfleadtoarequirementforanemergencyisolationvalve.

120 Therefore,thefunctionsofprocesscontrolandemergencyisolationshouldnormallybekeptseparate.Ultimately,thetestwillbewhetherthecontrolsystemcandelivertherequiredsafetyintegritylevelwithadualfunctionvalve.

121 FurtheradviceoncontrolsystemintegritycanbefoundinBritishStandardsEN61508Functional safety of electrical/electronic/programmable electronic safety-related systems andIEC61511Functional safety: safety instrumented systems for the process industry sector.

Excess flow valves

122 Anexcessflowvalveisdesignedtoremainopeninnormaloperation,butiftheflowthroughthevalveexceedsapresetmaximum,thevalvecloses.Thesevalvesallowflowineitherdirection,butnormallyonlytriggerforexcessflowinthespecifiedflowdirection.Thevalvesettingmustexceedthemaximumflowrateforeseeableinnormaloperation.Dependingontheparticulardesignofvalveasettingsignificantlyhigher(perhapsasmuchas50%)mayberequiredtoavoid‘chatter’anddamagetothevalve.

123 Acatastrophicfailuredownstreamofthevalvewillresultinincreasedflowandapressuredropacrossthevalve,causingittoclose.Wherethedownstreamfailureismorelimited,egaholeoracrack,orthereiscrushingofthepipeworkthentherestrictedflowmaynotbesufficienttocausethevalvetoshutandthereleasewillcontinue.

124 Otherfactorsarerelevantwhenconsideringuseofanexcessflowvalve.Foreignmattercanlodgeinthevalveandpreventitfromclosing.Insomeapplicationsitcanbedifficulttosimulatetheexcessflowconditionforprooftesting.

125 Advantagesclaimedforexcessflowvalvesincludetherelativesimplicityofamechanicalsystemandtheirautomaticaction–eliminatingsomepotentialhumanerrors.InthecontextofthisguidanceexcessflowvalveswouldnotnormallybeconsideredequivalenttoROSOVsforemergencyisolation.Manyofthesameissuessurroundingretrofittingapply,butinsomecaseslowercostsoverallmaymeanthatanexcessflowvalveisreasonablypracticabletoretrofitwhenaROSOVisnot.



Vulnerable vessel fittings 126 Processequipmentmayincludesmall-boreconnectionsforitemssuchas

controlsystemcomponents.Someofthese,egforlevelinstrumentation,mayenterbelowtheliquidlevelinthevessel.Failurecould,therefore,resultinlossofthevesselcontents.Fittingsofthistypemaybemostvulnerabletoguillotinefailure(beingshearedoff).Anexcessflowvalve,preferablylocatedintheoutlet,butinanycaseasclosetothevesselaspracticable,maybeanacceptablealternativetoaROSOVforthistypeofapplication.

127 Detailedadviceontheselection,installationandmaintenanceofexcessflowvalvesisbeyondthescopeofthisguidance.Adviceshouldbesoughtfromyoursupplierormanufacturer.

Reliability and integrity

128 Anycontrolsystemcanfail.Propermaintenanceandregularprooftestingofvalvesmakeamajorcontributiontomaintainingvalveintegrity.

129 Examplesofpotentialfailuremodesareconsideredbelow.Ifyouestablishhowsystemscanfailitprovidesusefulinformationforinclusionintestingandmaintenancearrangements.Commonfactorsidentifiedinpreviousindustrialincidentswhereisolationsystemsfailedinclude:

n failuretocloseondemandduetoinadequatemaintenance/prooftesting;n failuretoshuttightleadingtoleakageinternallyduetoincorrectspecification

ofthevalveorinadequatemaintenance/prooftesting;n failureofemployeestoactivateaserviceablevalveduetoinadequatetraining

and/orunclearinstructions;n largevolumesreleasedafter‘successful’isolationduetoinappropriate

spacingbetweenisolationvalves;n valvesrenderedunserviceablebytheincident,egdamagedbyfireor

explosion;andn failure-to-dangerofvalveonlossofmotivepower.

Inspection and proof testing130 Youshouldputinplaceappropriatearrangementsforinspectionandproof

testingtoreducethelikelihoodoftheROSOVtofailtooperateeffectivelyondemand,toALARP.

131 Thefrequencyofinspectionandtestingrequiredwilldependtoagreatextentontheconfidenceheldinthecompatibilityofthevalvewiththeprocessfluidsandconditions.Thisconfidencemaybeobtainedthroughpreviousoperationalexperience,testing,knowledgeofbasicmaterialscompatibilityoracombinationofthese.

132. Thelowerthelevelofconfidencethemorefrequentshouldbetheinspection

andtestingofthevalve.Recordsoftheseearlyinspectionsandtestswillprovidethebasisofajustificationforincreasedtestandinspectionintervalsasoperationalexperienceisaccrued.



Appendix 1 A case-specific assessment of the reasonable practicability of a ROSOVIntroduction

ThisappendixgivesguidanceonhowtodeterminewhetheraROSOVisareasonablypracticablemeasuretomitigatetheconsequencesofalossofcontainmentofahazardoussubstance.Itislimitedtoaconsiderationofthepotentialforharmtohumanhealth.

Shouldalossofcontainmentoccurthenatureofthehazardoussubstanceandtheprocessingconditionswouldhaveamajorbearingontheconsequences,andsostronglyinfluencethedecisiontoincorporateremoteisolationfacilities.

Acase-specificassessmentofreasonablepracticabilityrequiresthateachinstallationbeassessedindividually,takingaccountofitsspecificdesignfeatures,safetysystemsandoperatingprocedures.



Process

The flowchart above illustrates the process of assessment in the context of ROSOVs



Stage 1: Look for the hazardsIntroduction

Thefirststageoftheassessmentistoidentifyandunderstandthehazardouspropertiesofthesubstancesunderreview.Informationonthehazardsofaparticularsubstancemaybeobtainedfromavarietyofsources.TheforemostoftheseistheMaterialSafetyDataSheet,whichshouldbeissuedbythesupplierofthesubstanceinaccordancewiththeChemicals (Hazard Information and Packaging for Supply) Regulations 2002(SI1689).6AnindicationoftheprimaryhazardofasubstancecanbeobtainedfromtheCHIPclassification.

Dual hazard substances

Somesubstancesmaybebothtoxicandflammable.WhiletheCHIPclassificationusuallyreflectsthegreaterhazard,insomecircumstancesthesecondaryhazardmaydominate.Forsubstanceswithbothflammableandtoxicpropertiesyoushouldapplythecriteriaforeachhazardseparately.Ifdifferentstandardsareindicatedthenthehigherstandardshouldbeadopted.

Inthecaseofsimplemixturesofsubstanceswithinthescopeofthisguidance,asimilarapproachmaybetaken.Thestandardadoptedshouldbethehighestrequiredforeachofthecomponents.

Ifonecomponentisaminorconstituent,egasmallpercentageofatoxicsubstanceinaflammablesolvent,thenyoucanusetheCHIPmethodologytoarriveatanappropriatecategorisation.

Insomecasesthesubstancemayhaveasecondaryhazardoutsideofthescopeofthisguidance,egforoxidisersorsubstancesthatreactwithwater.Youshouldassessthesecondarypropertyseparately,byreferencetootherrelevantgoodpracticeorbymeansofacase-specificassessment,andagainadoptthehigherstandard.

Toxic substances

Toxicsubstancestendtohavelongerhazardrangesandgreaterpotentialtoaffectlarger,moreremotepopulationsbeyondthesiteboundary.Thermalradiationandoverpressureeffectsfollowingignitedreleasesofflammablesubstancesaremorelikelytoresultindamagetootherplant,andhencetoescalation,thanaretoxicreleases.

However,thereisthepotentialforpersonnelexposedtoatoxicsubstancetoberenderedincapableofcontrollingorshuttingdownplantsafely.Thiscanleadtofurtherincidentsandescalation.VulnerableoccupiedbuildingsincludingControlRoomsshouldbeidentifiedaspartofanOccupiedBuildingsAssessmentfortheestablishment.TheChemicalIndustriesAssociationpublicationGuidance for the Location and Design of Occupied Buildings on Chemical Manufacturing Sites,15containsusefuladviceonthistopic.

AROSOVmayreduceboththeriskofharmduetodirectexposuretothetoxicsubstanceandthelikelihoodofescalationoftheeventasaresultofemployeesbeingunabletoperformessentialduties.Routesintothehumanbodyincludeinhalation,ingestionandviacontactwiththeskin.Theprimaryrouteofharmfollowingalossof



containmenteventisinhalation.Buttherewillalsobethepossibilityofexposureviaotherroutesduringclean-upoperations.

Flammable substances

Thehazardrangesassociatedwithfiresandexplosionsfollowingthereleaseandignitionofaflammablesubstancetendtobeshorterthanfortoxicsubstances,andmaybeconfinedtothesite.However,withflammablesubstancesthereisgreaterpotentialforescalationduetotheeffectsofthermalradiationand/oroverpressureonotheritemsofplantcausingfurtherlossofcontainment.

Other properties

Otherpropertiesofsubstancesinadditiontotoxicityandflammabilitycanhaveasignificantimpactontherisk.Atoxicsubstancewithahighervapourpressure,forexample,willdispersemorereadilyandtoagreaterhazardrangefromthepointofrelease.

Processing or storage conditions

Theconditionsunderwhichthesubstanceisstoredand/orprocessedcanalsobeasignificantfactor.

LiquidsclassifiedasFlammable,butwithflashpointsaboveambienttemperature,generallypresentalowerhazardthanthoseclassifiedasHighlyFlammableliquids.However,storageorprocessingatelevatedtemperaturescanresultinthesesubstancesbeingreleasedabovetheirflashpointsoreventheirauto-ignitiontemperatures.

Substancesthataregasesatambienttemperaturearefrequentlystoredasliquidsunderpressure.Releasesfrompressurisedstoragearemoreenergetic.Foragivenholesize,agreatermassofsubstancewillbereleasedperunittime,particularlyifthesubstanceisreleasedintheliquidphase.

Inventory and scale of release

Processplanttypicallyconsistsofaseriesoflargercontainmentssuchasvessels,columnsetcjoinedbypipework,flanges,pumps,heatexchangersetc.Failuresaremostlikelytooccurinandaroundtheseinterconnectingitems,whichoften(thoughnotalways)containrelativelysmallquantitiesofsubstancesthemselves.But,ifthereisnoeffective(safe)meanstoisolatealeakfromsayapump,thenthecontentsofthelargercontainmentitemmaybelost.

Itisimportant,therefore,toconsidercontainmentsystemsasawholeandnotjustasindividualvessels.Boundariesneedtobesetbetweenunitsofinventory.Appropriatemeansofisolation,whichmayincludeROSOVs,shouldbeprovidedbetweenindividualinventoryunitstolimitthequantityofsubstancethatcanbereleasedfromanysinglefailure.IncidentshaveoccurredinwhichROSOVswereprovidedandfunctionedcorrectly;howeverthequantityofsubstancebetweenisolationswastoolargeandasignificantreleasestilltookplace.

Thenatureandscaleofanemergencyisoftendeterminedbytherateatwhichahazardoussubstanceisreleasedratherthansimplythebulkinventory.Itisthisrateofreleasethatdeterminesthesizeoftheliquidpoolortheflammablegascloud



formed,orthelengthanddiameterofajetflame.Factorsinfluencingtherateofreleaseincludethepressureandtheareaofthebreach–allotherthingsbeingequal,thegreaterthepressureand/orthelargertheboreofthepipework,thegreaterthereleaserate.Thatsaid,largerborepipeworktendstobelessvulnerabletosomeofthepossiblefailuremodes,egimpact.Toanextent,theconsequencesandfrequencymaybalanceeachotherout.



Stage 2: Assess the risksIntroduction

Ariskassessmentconsidersarangeofpossibleadverseeventsandevaluatesboththelikelihoodoftheeventandthemagnitudeofthepotentialconsequences.Inthiscontext,thefrequencyandtheconsequencesoftheevent,takentogether,describetheriskassociatedwiththatevent.

Ajudgementisthenmaderegardingthetolerabilityoftherisk,andthereasonablepracticabilityofriskreductionoptions,bycomparisonwithsuitablecriteria.

Degree of quantification

Riskassessmentsmaybemadewithvaryingdegreesofrigourorquantification,andeachoftheelementsofariskassessmentissubjecttovaryingdegreesofuncertainty.

Insomecases,professionaljudgementalonemaybeusedtoassigneventfrequenciesonaqualitativebasis.Inothers,amoredetailedanalysisofthepossiblecausesofafailureusingtechniquesincludingfaulttreesmaybemadetoquantifythefailureratemoreprecisely.

Theconsequencesofaneventarefrequentlybettercharacterisedthanthefrequency.Itiscommontoquantifytheconsequencesofagiveneventandpairtheresultwithaqualitativejudgementastothelikelihood.

Ifaclearandunambiguousdecisioncanbemadethenthislevelofquantificationislikelytobeadequate.If,duetouncertaintiesinthedataortheassumptionsmadeintheanalysis,itisnotclearwhetherornotfittingaROSOVisareasonablypracticableoption,thenfurtherquantificationmayberequired.

Inallcases,thedegreeofquantificationrequiredwillbethatnecessarytojustifythedecisiontaken.Youshouldtestthesensitivityofyouranalysistoanyassumptionsmade,egabouteventfrequencyoraboutsimilarfactorsintheconsequenceassessment.

Definition: quantified risk assessment

Ultimately,theconsequencesandfrequenciesoftherangeofpossibleeventsmaybefullyquantifiedandcombinedintoasingleriskvalueorrelationship.

Iso-contoursofindividualriskcanbeusedtodetermineatwhatdistanceandinwhichdirectionathresholdriskisreachedforthepurposesofcomparisonwithtolerabilitycriteria.

Inmakingjudgementsaboutthereasonablepracticabilityofaparticularsafetymeasure,itisalsonecessarytoconsider‘societal’or‘group’risk–whichisessentiallytheriskofharmtomultipleindividualsastheresultofthesamehazardousevent.



TheuseofnumericalriskestimatesinthismanneriscommonlyreferredtoasaQuantifiedRiskAssessment(QRA).Itwillnotalwaysbenecessary,orevenhelpful,toperformafullQRA.Inmanycasestheresultsofaqualitativeassessmentwillbesufficientlycleartoallowadecisiontobemade.



Steps in risk assessment

Theseparatestepsinariskassessmenthavebeendescribedmorememorablyas

What if..., What then..., Then what..., and So what...

STEP ONE What if...

Introduction

Thefirststepistoidentifythepotentialcausesor‘initiatingevents’ofalossofcontainmentevent.Thesecanbesplitintotwobroadcategoriesofevent:thosearisingfromexternaleventssuchasseismicactivityorflooding,andon-siteeventsincludingfailuresduetocorrosion,vehicularimpactormal-operation.

Equipment failures

Allplantitemshaveasetofuniquefailuremodes,someofwhichcanleadtoalossofcontainment.Areviewofeachfailurewillservetoidentifyifaseriousriskispresent.

Itisimportanttoestablishthosesite-specificfailuremodeswhoseconsequenceswouldrequireisolation.Someequipmentfailuresmayhavenosignificanteffect,warrantingonlyminormaintenanceattentionsuchasadjustmentorresetting.Others,suchassealfailuresorequipmentfailingtooperate,mayhavemuchmoreseriousconsequences.Identificationofthecriticalfailuremodesoftheplantequipmentisbestachievedthroughdirectoperatingknowledgeandexperience.

Plantmaintenancerecordscanbeusedtoidentifyequipmentthatmaygiverisetoalossofcontainmentincident.Genericinformation,frompublishedsourcesorheldcentrallywithinacompany,canbeusefulbutwillnottakeaccountoflocalconditionswhichwillaffecttheperformanceofequipment.OthersourcesofinformationincludereportsfromHazardandOperability(HAZOP)studiesandreviewsofPipeworkandInstrumentationDiagrams(PID).

Table1givessomeexamplesoftypicalequipmentfailures.



Table 1Typicalequipmentfailures

Equipment Principal Failure Modes Principal Failure Causes

Pipework Holesandruptures Corrosion,erosion,cavitation,impact,vibration,‘hammer’

Pipework,grants,flangedconnections

Leaks Deteriorationofmaterial,wronggasketused,incorrectassemblyofjoint

Instrumentationconnection(smallbasetube)

Rupturesanddisconnections Impact,vibration,incorrectfitting,incorrectmakeup

Flexiblehoses Holes,ruptures,disconnections Fatigue,impactdamage,misuse,poorconnection,mechanicalfailures

Valves Externalleak Glandseal,jointedfaces

Pumps Externalleak Driveshaft,apping,flangedfaces,chainlocks

Compressors Leaks,seals,flangedfaces,soiledconnections,drains

Vibration,perishedjointmaterial,operatorerror,leakpastseat

Drainandsimplepoints Leaksatsealsandflangedfaces,valveleftopen,fullboreruptures

Perishedjointmaterial,operatorerror,impact



Initiating event frequencies

Itmaybenecessarytoestimatethefrequencyoftheinitiatingeventsifthesearetobeusedtoestimatetheoverallfrequencyofthehazardousevent(lossofcontainment).Alternatively,frequenciesofhazardouseventsmaybeassignedbasedonhistoricaldataprovidedthisisavailableandrelevant.

Definition: external events

Anexternaleventisonethathasnodirectrelationshipwiththeequipment,butwhichiscapableofactingontheequipmentcausingittofail.

Thisincludesallnaturalphenomenasuchasearthquakes,highwinds,floodingetc.Interferencebythirdpartiesengagedinvandalismortheftmayberelevant.Itincludesthoseactivitiesthatmaybegoingonaroundtheplantsuchasthemovementofroadvehiclesorliftingoperations,iethepotentialforimpactdamage.Alsoincludedareincidentsonadjacentplantthatcouldescalate,affectingtheplantunderconsideration,iethe‘dominoeffect’.

Definition: human factors

Inmanycases,accidentsandincidentsareattributedtohumanfailure.Thesecanincludeunintentionalerrorssuchasmistakenlystartingapump,openingthewrongvalve,orfailingtoreplaceaseal.Sometimescustomandpracticeproceduralshortcutscancontributetohumanfailures.

FurtherguidanceisavailableinthepublicationReducing error and influencing behaviour.16

Influences on human failure

Thetablebelowgivessomeinfluencesthatincreasethelikelihoodofhumanfailure.

Table 2Influencesonhumanfailure

JobFactors

Illogicaldesignofequipmentandinstruments

Constantinterruptions

Informationhardtofindorassimilate

Missingorunclearinstructions

Poorlymaintainedorunreliableequipment

Highworkload,timepressure

Noisyandunpleasantworkingconditions

IndividualFactors

Lowskillandcompetence

Tiredstaff

Boredordisheartenedstaff

Individualmedicalproblems

OrganisationalFactors

Poorworkplanningleadingtohighworkpressure

Poorcommunications

Uncertaintiesinrolesandresponsibilities

Poormanagementofhealthandsafety

Inadequatestaffinglevel

Inadequatetraining–routineemergencyoperations

Inadequatesupervision



What if analysis for human factors

TheWhatif…analysisshouldidentifythosetaskswherehumanfailurescouldarise.Analysisisusuallydonebystructuredtaskanderroranalysismethods.Involvementofoperatorsintheanalysisisessentialtoprovidea‘realitycheck’ofwhatisactuallydoneontheplantandwhatstepsarefeasible.Suchanalysisispreferabletojustrelyingonwhatiswrittenintheoperatingprocedure.

Key tasks

Keytaskstoconsiderinclude:

n normaloperatingduties;n samplingtasks;n venting/draining;n connecting/disconnecting;n startup/shutdown;n cleaningandmaintenance;n emergencyresponse.

Probability estimates

Methodsareavailabletoallowtheestimationofhumanerrorprobabilities.However,thisshouldbedonewithextremecautiontoensurethatestimatesareappropriateforthenatureofthetaskandthesite-specificconditions.

Response times

Particularcareisneededwhenestimatingthelikelytimeforoperatorstorespondtoanincident.Considerationshouldbegiventothedetection,diagnosisandactionstagesofresponse.

DetectionHowanoperatorwillbecomeawarethataproblemexists.Assessmentofalarmprioritiesandfrequencies,thecharacteristicsoftheoperatorconsoledisplays,aswellasoperators’pastexperienceofsimilarproblemsonsitesareallusefulaspectstoreview.Plantproblemsthatappearoveraperiodoftime,andwheretheinformationavailabletotheoperatorscanbeuncertain,areparticularlydifficulttodetect.WhenControlRoomsarenotcontinuallystaffedyouneedtobeabletoshowthatplantproblemscanstillbedetectedquicklyandreliably.

DiagnosisHowanoperatorwilldeterminewhataction,ifany,isrequiredtorespondtotheproblem.Trainingandcompetenceassurance,theavailabilityofclearoperatingproceduresandotherjobaids,andthelevelofsupervisionareallrelevantfactorstothinkabout.Theexistenceofmorethanoneproblemcanmakediagnosismoredifficult.



ActionThisstagecovershowatimelyresponseiscarriedout.Keyaspectshereinclude:

n areliablemeansofcommunicatingwithotherplantoperators;n timetolocateandoperatethecorrectisolationvalve;n formanualisolationvalves,considertheneedtodonPPEandthe

potentialdifficultyinoperatingthevalvewhilstwearingPPE;n forremotelyoperatedvalves,feedbackneedstobegiventooperators

thatthevalvehasoperatedcorrectly;n considerthatoperatorsmayhesitateifoperatingthevalveleadsto

criticismlater.

A‘walk-through’ofthephysicalaspectsofthetaskwithoperatorscanprovideveryusefulinformationontheminimumtimeneededtooperateanisolationvalve.However,anallowanceforadditionaldelaysduetouncertainty,hesitation,communicationsproblemsandsoonshouldbeaddedforarealisticestimateoftheresponsetime.

Additionalguidanceisavailableinthesepublications(availableontheHSEwebsiteatwww.hse.gov.uk):

Better alarm handlingHSEInformationSheet

Human factors aspects of remote operation in process plants

Assessing the safety of staffing arrangements for process operations in the chemical and allied industries

Human factors integration: implementation in the onshore and offshore industries



STEP TWO What then...

Introduction

Thesecondstepistoidentifythoseinitiatingeventsthatcontributetothehazardouseventunderconsideration–theeventthatwouldbemitigatedbyisolation.

Hazardous events

Agivenhazardouseventmighthaveseveralpotentialinitiators.Forexample,bothcorrosionandimpactmightbecausesofapipeworkfailure.Similarly,eachinitiatingeventcouldleadtoseveralhazardousevents.SomeofthesemaybeeffectivelymitigatedbyaROSOV,egfailureofpipeworkduetocorrosion,whilstotherswillnot,egacorrosion-inducedholeinastoragetank.

Frequency of hazardous event

Theprocedurefortracinginitiatingeventsthroughtohazardouseventscanbemadeeasierbytheuseoflogictrees.Thisformofanalysiscanbeusedtogeneratefrequenciesforthehazardousevents.

However,therecanbeconsiderabledifficultiesinpracticeanditiseasytooverlookinitiatingeventsandhenceunderestimatethefrequencyofthehazardousevent.Thisiswhyitiscommontoturntoananalysisofhistoricaldata.

STEP THREE Then what...

Introduction

Thethirdstepistoevaluatetheconsequencesoftheidentifiedhazardouseventorlossofcontainment.Thisprocessinvolvespredictingthebehaviourofthehazardousmaterialoncereleasedfromcontainment,inordertodeterminehowtheconcentrationofthesubstancewillvarywithdistancefromthereleasepoint.

Tobecapableofcausingamajoraccident,toxicsubstancesmustbepresentinaphysicalformsuchthatdispersionispossibleintheconditionsthatexistatthetimeoftheaccident.

Forflammablesubstances,ignition(withconsequentthermaland/oroverpressureeffects)canoccurclosetothesourceofthereleaseafterminimaldispersion.Butinsomecasesacloudofflammablevapourmaydriftsomedistanceawayfromthereleasepoint(whereignitionsourcesmaybestrictlycontrolled)beforefindingasourceofignition.

Inthecontextofthisguidance,wearegenerallyconcernedwithreleasesofgaseousorvolatileliquidsubstances,whichcanbecomeairborne,andbetransportedsomedistancefromthepointofrelease.However,evensubstanceswithrelativelylowvapourpressurescanformaflammableortoxiccloud,ifforexampletheyarereleasedunderpressure,formingasprayormist.

Fortoxicsubstances,theextentofthehazardisrelatedtotheconcentrationofthesubstancetowhichthoseaffectedareexposed.Criticalfactorsindetermining



thedegreeofharmincludetheconcentrationandtheexposuretime–collectivelyknownas‘thedose’.

Forflammablesubstances,thehazardisagainrelatedtotheconcentration.Butthehazardwillonlyberealisediftheconcentrationiswithincertaincriticallimitsandthereisasourceofignition.Someinitiatingeventsmaysimultaneouslyprovideasourceofignition,egintheeventofareleaseduetovehicularimpacttherearealsolikelytobesparksand/orhotvehiclecomponentspresent.

Definition: source term

Asourcetermdescribestheconditions(egtemperatureandpressure)andothercriticalparameters,includingreleaserateandthephysicalpropertiesofthesubstancethattogetherdefinetherelease.

Take,forexample,agasliquefiedunderpressure.Foragivensizedholeinthecontainmentbarrier,thesourcetermdependsonwhetherthesubstanceisreleasedasaliquid,egfrompipeworkcarryingliquid,orasvapourifthefailureoccursinpipeworkconnectedtothevapourspace.

Extent of the hazard

Fromthesourceterm,knowledgeofthewaysubstancesbehavewhendispersedintotheatmosphere,andtheharmcriteria,theextentoftheharmfuleffectorthe‘hazardrange’canbeestimated.Thehazardrange,inconjunctionwithdataonthepopulationatrisk,isusedtodeterminetheseverityoftheconsequences.Adetailedconsiderationofthetechniquesformodellingthedispersionofhazardoussubstancesisbeyondthescopeofthisguidance.Atthetimethisguidancewasbeingprepared,planswereatanadvancedstagetomakethefollowingHTML-basedtoolavailableonHSE’swebsite:‘GuidanceondispersionmodelsfortheassessmentofCOMAHsafetycases’.

Thisworkincludesgeneralguidanceondispersionmodelling,plusreviewsofsomeofthemodelsmorefrequentlyemployedbydutyholdersinpreparingsafetyreportssubmittedundertheCOMAHRegulations.

AnotherusefulsourceistheDutchTNOpublication,(the‘YellowBook’),Methods for the calculation of the physical effects of the escape of dangerous materials(seeparticularlyPart2,Chapter7‘Dispersion’).CJPvanBuijtenen.1979.3/L.

Harm criteria

Harmcriteriadescribethedegreeofharm,whichcouldbedeathorsomespecifiedlesserharmresultingfromexposuretothehazard.

Fortoxicsubstances,theharmcriteriaarecommonlyexpressedintheformofa‘dose’,orconcentration/timerelationship,thoughotherrelationshipsarepossible.

Forflammablesubstances,theharmcriteriaarecommonlyrelatedtoeithertheeffectsofexposuretothermalradiationfrom,forexample,poolfires,jetfiresorfireballsor,intheeventofanexplosion,totheoverpressuregenerated.

Harmcriteriaforoverpressuremayberelatedtothedirecteffectsonthehumanbodyor,moreusually,beindirectlyrelatedtotheeffectsofoverpressureonstructureswhichmaycollapse,ortotheimpactofmissilesgeneratedbythe



explosion.Itismoreusualtousetheindirectrelationshiptotheeffectsonstructuresbecausethesecanresultinharmatsignificantlyloweroverpressures.

Secondary containment

Itisgoodpracticewhendesigninganewinstallationtoapplyahierarchicalapproachtotheselectionofriskreductionmeasures.ROSOVs(whichservetolimitthequantityofsubstancereleasedfromtheprimarycontainment)shouldbeinstalled,ifreasonablypracticable,inpreferencetobunding,whichservestominimisetheconsequencesoncethematerialhasescaped.

WhenconsideringthereasonablepracticabilityofretrofittingROSOVstoanexistinginstallation,existingmeasures,includingbunding,maybetakenintoaccountwhenestablishingthecurrentriskforcomparisonpurposes.

AbundmayberequiredtocontainandmitigatearangeofpotentialreleasesagainstwhichaROSOVwouldnotbeeffective–including,forexample,overflowingofavesselandholesinthevesselitself.ROSOVsandsecondarycontainmentarenotmutuallyexclusiveandbothmayberequiredtoreducetherisksfromtherangeofpossiblehazardouseventstoALARP.

Toxic releasesForun-bundedreleasesofatoxicliquidatambienttemperature,ignoringcoolingeffectsofevaporation,thesourcetermisproportionaltotheevaporationratefromthepool.Thisisdependentonthepoolsize,whichincreasesasmorematerialisaddedtothepool.Themorerapidlythereleaseisisolated,thelessmaterialwillbereleasedandthesmallerthepoolformed.Asmallerpoolwillmeanareducedhazardrange.

Forabundedrelease,theevaporationratewillreachamaximumoncethequantityofmaterialreleasedissufficienttocovertheareaofthebund.Thisisirrespectiveofwhetherthereleaseisisolatedmanuallyorremotely.However,alongerreleasemeansmorematerialtransferredintothebund.Unlessstepsaretakentocontrolevaporationfromtheliquidinthebund,egbycoveringthesurfacewithaninertbarrier,theevaporationwillcontinueforalongerperiod.Peoplewhoareintheplumeandunabletoescapefromit,willbeexposedtoagivenconcentrationoftoxicsubstanceforlongerandsoaccumulateahigherdose.

Flammable releases Forbundedreleasesofflammableliquids,thegreaterquantityoffuelaccumulatedinthebundislikelytoresultinamoreprolongedfireifignited.Adjacentplantwillbeexposedtothermalradiationforalongerperiod,increasingthepotentialforescalation.Wherevesselsholdingflammablesubstancesshareacommonbund,‘dwarfwalls’orsimilarshouldbeincorporatedtolimitthespreadofsmallerreleases.

Alongcontinuousreleaseofvapourfromanevaporatingpoolcanleadtotheformationofalargercloudofvapourabovethelowerflammablelimit.Thisincreasestheextentoftheflashfirehazard.

Escalation

Forflammablesubstances,animportantconsiderationisthepotentialforescalationor‘dominoeffects’.Forexample,arelativelysmallfire/explosioncouldhavedirecteffectsthatareconfinedtothesite.Butthefire/explosioncouldresult



inlossofcontainmentofamorehazardoussubstancewiththepotentialforsubstantialoff-siteconsequences.

Inthesecases,thetrueextentofthehazardwillberelatedtotheescalationevent,whichmayhavealowereventfrequencybutsubstantiallymoreseriousconsequences.

Response time

Theresponsetimebetweentheinitiatingeventandthereleasebeingisolatedcanhaveasignificantimpactontheextentofthehazard.Evenwhenitispossibletoeffectasafemanualisolation,theadditionaltimetakentodosocansignificantlyincreasethereleasedurationandthehazardrange.

ASOVs

Afurtherreductioninresponsetime,withapotentialreductioninhazardrange,maybeachievediftheisolationvalveisautomaticallyactivatedinresponseto,forexample,adetector.SuchanarrangementisreferredtoasanAutomaticShutoffValve(ASOV).

SimilarconsiderationsapplywhenjudgingthereasonablepracticabilityofanASOV.Althoughitisimportanttoconsiderthelikelihoodandconsequenceofspurioustrips,thesearenotbythemselvesajustificationfornotfittinganASOV.Spurioustripscanbecontrolledby,forexample,theappropriateuseofdiverseredundantsensorsoperatingona‘voting’system.

Severity of consequences

Inthecontextofharmtohumanhealth,theseverityoftheconsequencesisdirectlyrelatedtothenumberofpeoplewhomaybekilledorinjured.Casualtiescanresultfromdirectexposuretothehazardoussubstance,ortotheeffectsofthermalradiation/overpressureinthecaseofflammablehazards.

Dataonthepopulationsatriskwithinthespecifiedhazardrangeisusedtoestimatetheseverityoftheconsequences,egthenumberofpersonssufferingthespecifiedlevelofharm.

Directional effects

Forsomeevents,particularlytoxicreleases,theextentoftheharmandhencetheriskwillvaryaccordingtodirection.Someflammableevents,includingflashfires,canalsobeinfluencedbyweather,whilstothers,egexplosions,tendtobeomni-directionalintheireffects.

STEP FOUR So what...

Introduction

Thefinalstepistocomparetherisk(frequencyxconsequence)ofthehazardouseventwithsuitablecriteriatodeterminethetolerabilityofthatrisk.

Reducing risks, protecting people: HSE’s decision-making process,3alsoavailable



onlineatwww.hse.gov.ukincludesadiscussionoftherisktolerabilitycriteriadevelopedbyHSE(astheregulator).

Inthecontextofthisguidance,forrisksthatfallintothe‘Tolerable,IfALARP’regionoftheriskspectrum(seeSFAIRP/ALARP/AMNintheSummaryofrelevantlegalrequirements),aROSOVshouldbeconsideredasameasuretoreducetherisktoALARP.

Risk reduction

Inthiscontext,aROSOVisameasurethatmitigatestheconsequencesofahazardouseventratherthaninfluencingthefrequencyofthatevent.However,itisalsotruethatbylimitingtheconsequencesoftheprimaryhazardousevent,thepresenceofaROSOVmayreducetheprobabilityofanyassociatedescalationevent(s).

Cost-benefit analysis

Informingjudgementsaboutthereasonablepracticabilityofaparticularsafetymeasure,itisnormaltousedeathasthecriterionforharm.Thenumberof‘statisticalfatalities’averted,forwhichthereareacceptedmonetaryequivalents,areconsideredwhenevaluatingthebenefitssideofthecost-benefitcomputation.

Seriousinjuriesavertedshouldalsobeconsideredwhenassessingthebenefitsofthemeasurebeingconsidered.However,althoughattemptshavebeenmadetoestablishequivalencefactors,egtenmajorinjuriesequalonefatality,thereareasyetnogenerallyacceptedmonetaryequivalentsfornon-lethalinjuries.

WhendecidingwhetherornottofitaROSOV,acomparisonismadebetweentheriskwithandwithouttheROSOV,andthereductioninriskiscomparedtothecostofprovidingtheROSOV.

Gross disproportion

TheimplementationofariskreductionmeasuresuchasaROSOVwillinvolveacosttothedutyholder.Equally,aROSOVisintendedtoreduceriskfromanoperationandthisreductionwillbringaboutabenefit(intermsoflivessavedetc),whichcanbeexpressedinmonetaryterms.Theratioofthecoststothebenefitscanbedescribedasaproportionfactor(PF).Thegenerallyacceptedvalueofavoidingastatisticalfatalityisapproximately£1millionatthetimeofwriting.

Itshouldalsobenoted,however,thatthebenefitsmightalsoincludetheavoidanceofsuchthingsasenvironmentalclean-upcosts,increasedinsurancepremiums,lossofassetvalue,thecostsofincreasedregulatoryinterferenceetc.Themeasuretoreducetherisk,inthiscasetheROSOV,shouldbeimplementedunlessthecostisgrosslydisproportionatetothereductioninrisk(oranequallyeffectivealternativeisadopted).

Providingtheriskanalysisisbasedoncautiousbestestimatesandthecostsarerealistic(notneedlesslyinflatedbeyondtheprovisionofafitforpurposesolution)then,inthecontextofmajorhazards,HSEwillusethefollowingasthebasisforexercisingjudgement:



n Theproportionfactorisatleast1(andpossiblyatleast2)forriskswhichareclosetobeingbroadlyacceptablerisks.

n Theproportionfactorisatleast10atthetolerable/unacceptableriskboundary.

n Forrisksbetweentheselevelstheproportionfactorisamatterofprofessionaljudgement,butthedisproportionbetweenthecostsofpreventingafatality(CPF)andthevalueofapreventedfatality(VPF)mustalwaysbegrossforameasurenottobereasonablypractical.



Stage 3:Record the assessment findingsRationale

Thefinalstageoftheassessmentprocessistodocumentthefindingsoftheassessmentandthereasoningbehindthedecisionstaken.ThereisalegalrequirementundertheManagementofHealthandSafetyatWorkRegulationstodocumentthefindingsofariskassessment.Inthecontextofthisguidance,itisparticularlyimportantthatthefindingsaredocumentedthoroughlywhentheyareusedtojustifynotimplementingaROSOV,whereoneisidentifiedasgoodpracticebythedecisioncriteriapresentedinthisdocument.



Stage 4:Implement ROSOV where reasonably practicableComment

WheretheconclusionoftheassessmentisthataROSOV(or,whereapplicable,anotherequallyeffectivemeasure)isreasonablypracticable,thenimplementationshouldfollowasalogicalconsequence.



Stage 5:Review the assessment periodicallyIntroduction

Assessmentisnotaonce-and-for-allactivity.Withthepassageoftime,changesinlocalcircumstancesandadvancesintechnologyetcmayaltertheconclusionsoftheriskassessment.Forexample,anincreaseinthesizeofthelocalpopulationoradecreaseinthecostofprovidingremoteisolationmaymakefitmentofaROSOVareasonablypracticableoptionwherepreviouslyitwasnot.

Significant change

InaccordancewiththeManagementofHealthandSafetyatWorkRegulations,dutyholdersshouldreviewand,ifnecessary,modifytheirassessmentifthereisreasontobelievethatitisnolongervalidorifthereisasignificantchange(eganincreaseinthepopulationatrisk)inthematterstowhichitrelates.

Itisprudentinmostcasestoplantoreviewriskassessmentsatregularintervals.Thereisanexplicitrequirement(regulation8)fortheOperatorsofinstallationssubjecttotheTopTierrequirementsofCOMAHtoreviewtheirsafetyreportatleastonceeveryfiveyears,orwhenevernecessary,totakeintoaccountnewfactsorknowledgethatbecomesavailable.ThisshouldbeconsideredindicativeofGoodPracticeforOperatorsofotherestablishmentshandlinghazardoussubstances.



Appendix 2 Summary of relevant legal requirementsHealth and Safety at Work etc Act

1 The Health and Safety at Work etc Act 1974placesadutyonemployerstoensure‘sofarasisreasonablypracticable’(SFAIRP)thehealth,safetyandwelfareatworkoftheiremployees,andadutyonemployersandtheself-employedtoensurethatpersonsotherthantheiremployees(including,inthecaseoftheself-employed,themselves)areprotectedfromriskstotheirhealthorsafetyarisingfromtheworkactivities.

Management of Health and Safety at Work Regulations

2 The Management of Health and Safety at Work Regulations 1999(SI3242)requireemployers(andwhererelevanttheself-employed)tomakeasuitableandsufficientassessmentoftheriskstotheiremployeesandtopersonswhoarenottheiremployeesbutwhomaybesubjecttorisksarisingfromtheworkactivities.

Control of Major Accident Hazards Regulations

3 Regulation 4 of the Control of Major Accident Hazards Regulations 1999 (COMAH)(SI743)placesadutyontheoperatorsofestablishmentstowhichtheregulationsapplytotake‘allmeasuresnecessary’(AMN)topreventmajoraccidentsandlimittheirconsequencestopersonsandtheenvironment.

4 GuidanceontheseregulationscanbefoundintheHSEpublicationA guide to the Control of Major Accident Hazard Regulations 1999.5

5 OperatorsofCOMAHestablishments(whether‘lowertier’(LT)or‘toptier’(TT))haveadutytoprepareaMajorAccidentPreventionPolicy(MAPP).OperatorsofCOMAHTTsiteshaveanadditionaldutytosubmitasafetyreporttotheCompetentAuthority(CA).TheCOMAHsafetyreportshoulddemonstratethattheOperatorhastakenallmeasuresnecessaryandthatthemajoraccidentriskshavebeenreducedtoALARP.Oneofthekeydemonstrationswillbetoshowthatappropriatemeasureshavebeentakentopreventandeffectivelycontainreleasesofdangeroussubstances.

Dangerous Substances and Explosive Atmospheres Regulations

6 The Dangerous Substances and Explosive Atmospheres Regulations 2002(DSEAR)(SI2776)implementtwoEuropeanDirectives:theChemicalAgentsDirective(CAD)andtheExplosiveAtmospheresDirective(ATEX).

7 Theseregulationsdealwithfires,explosionsandsimilarenergy-releasingevents(egexothermicchemicalreactions)arisingfromdangeroussubstances(chemicalagents)andtheexplosiveatmospherescreatedbythosedangeroussubstances.

8 DSEARmodernisesandrepealsover20piecesofoldsafetylegislationonflammablesubstances,dustsandliquids.



References and useful addresses1 The chemical release and fire at the Associated Octel Company Limited: A report

of the investigation by the Health and Safety Executive into the chemical release and fire at the Associated Octel Company, Ellesmere Port on 1 and 2 February 1994ReportHSEBooks1996ISBN0717608301

2 Emergency isolation of process plant in the chemical industryChemicalInformationSheetCHIS2HSEBooks1999

3 Reducing risks, protecting people: HSE’s decision-making processReportHSEBooks2001ISBN0717621510

4 Assessing compliance with the law in individual cases and the use of good practice.AvailableontheHSEwebsite:http://www.hse.gov.uk/dst/sctdir.htm#riskassessment

5 A guide to the Control of Major Accident Hazard Regulations1999HSEBooks1999ISBN0717616045

6 Approved classification and labelling guide. Chemicals (Hazard Information and Packaging for Supply) Regulations 2002.Guidance on RegulationsL131(Fifthedition)HSEBooks2002ISBN0717623696

7 Approved supply list. Information approved for the classification and labelling of substances and preparations dangerous for supply. Chemicals (Hazard Information and Packaging for Supply) Regulations 2002. Approved listL129(Seventhedition)HSEBooks2002ISBN0717623688

8 A guide to the Pipelines Safety Regulations 1996L82HSEBooksISBN0717611825

9 The Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995TheStationeryOfficeSI1995No743

10 The safe isolation of plant and equipmentHSEBooks1997ISBN0717608719

11 Designing and operating safe chemical reaction processes HSG143HSEBooks2000ISBN0717610519

12 Control of substances hazardous to health. The Control of Substances Hazardous to Health Regulations 2002. Approved Code of Practice and guidanceL5(Fourthedition)HSEBooks2002ISBN0717625346

13 Safety advice for bulk chlorine installationsHSG28(Secondedition)HSEBooks1999ISBN0717616452

14 The Management of Health and Safety at Work Regulations 1999TheStationeryOfficeSI3242

15 Guidance for the location and design of occupied buildings on chemical manufacturing sites(Secondedition)RC21/03ChemicalIndustriesAssociation2003ISBN1858971144DetailsontheCIAwebsiteat:http://www.cia.org.uk/bookshop/system/index.html

16 Reducing error and influencing behaviourHSG48(Secondedition)HSEBooks1999ISBN0717624528



The Environment Agency

TheEnvironmentAgency(EnglandandWales)hasageneralenquirylineon08459333111orvisitwww.environment-agency.gov.uk

The Scottish Environment Protection Agency

ForScotland,thePublicAffairsDepartmentoftheScottishEnvironmentProtectionAgency,on01786457700,handlesgeneralenquiriesorvisitwww.sepa.org.ukWhileeveryefforthasbeenmadetoensuretheaccuracyofthereferenceslistedinthispublication,theirfutureavailabilitycannotbeguaranteed.

Further informationForinformationabouthealthandsafetyringHSE’sInfolineTel:08453450055Fax:08454089566Textphone:08454089577e-mail:[email protected],CaerphillyBusinessPark,CaerphillyCF833GG.

HSEpricedandfreepublicationscanbeviewedonlineororderedfromwww.hse.gov.ukorcontactHSEBooks,POBox1999,Sudbury,SuffolkCO102WATel:01787881165Fax:01787313995.HSEpricedpublicationsarealsoavailablefrombookshops.

TheStationeryOfficepublicationsareavailablefromTheStationeryOffice,POBox29,NorwichNR31GNTel:08706005522Fax:08706005533e-mail:[email protected]:www.tso.co.uk(Theyarealsoavailablefrombookshops.)StatutoryInstrumentscanbeviewedfreeofchargeatwww.opsi.gov.uk.

PublishedbyHSE02/10 Page47of47


Documents

Remotely operated shutoff valves (ROSOVs)