GUIDE FOR MAJOR HAZARD FACILITIES: SAFETY CASE: DEMONSTRATING THE ADEQUACY OF SAFETY MANAGEMENT AND CONTROL MEASURES

MARCH 2012

Safe Work Australia is an Australian Government statutory agency establishe in 200!" Safe Work Australia consists of re#resentatives of the Common$ealth% state an territory governments% the Australian Council of &ra e 'nions% the Australian Chamber of Commerce an (n ustry an the Australian (n ustry Grou#" Safe Work Australia $orks $ith the Common$ealth% state an territory governments to im#rove $ork health an safety an $orkers) com#ensation arrangements" Safe Work Australia is a national #olicy bo y% not a regulator of $ork health an safety" &he Common$ealth% states an territories have res#onsibility for regulating an enforcing $ork health an safety la$s in their *uris iction" (S+, !-./0/012/222../! 34567 (S+, !-./0/012/222.!/0 3R&67 Creative Commons

89ce#t for the Safe Work Australia logo this co#yright $ork is license un er a Creative Commons Attribution/,oncommercial 2"0 Australia licence" &o vie$ a co#y of this licence% visit htt#:;;creativecommons"org;licenses;by/nc;2"0;au; (n essence% you are free to co#y% communicate an a a#t the $ork for non commercial #ur#oses% as long as you attribute the $ork to Safe Work Australia an abi e by the other licence terms" Contact information Safe Work Australia Phone: +61 2 6121 5317 Email: info safe!orkaustralia"#ov"au We$site: !!!"safe!orkaustralia"#ov"au

4age 2 of 21

MARCH 2012

%a$le of Contents

INTRODUCTION....................................................................................................................4 DEMONSTRATIONS OF ADEQUACY.................................................................................5 PLANNING AND PREPARATION........................................................................................7 THE DEMONSTRATION PROCESS....................................................................................9 DEMONSTRATION OF CONTROL MEASURE ADEQUACY...........................................10 DEMONSTRATION OF COMPREHENSIVE AND INTEGRATED SMS............................17 OUTPUTS............................................................................................................................19 REVIE AND REVISION....................................................................................................!0 HS REGULATIONS...............................................................................!1 APPENDI" A #

APPENDI" $ # DEFINITIONS............................................................................................!4 APPENDI" C # RIS% CRITERIA........................................................................................!& APPENDI" D # FURTHER INFORMATION.......................................................................'1

4age 2 of 21

MARCH 2012

INTRODUCTION
&o obtain a licence to o#erate a ma*or ha<ar facility =MH6>% o#erators are re?uire to submit a safety case $hich emonstrates ho$ the facility $ill be o#erate safely" &he #ur#ose of this gui ance material is to assist o#erators of MH6s to emonstrate that the content of their safety case $ill achieve the safe o#eration of the MH6 through a satisfactory safety management system an a e?uate control measures" 'se of this gui ance material $ill enable MH6 o#erators to submit a safety case to the regulator that satisfactorily emonstrates: that the facility)s safety management system =SMS> $ill control risks arising from ma*or inci ents an ma*or inci ent ha<ar s the a e?uacy of the measures to be im#lemente by the o#erator to control risks associate $ith the occurrence an #otential occurrence of ma*or inci ents" &his Gui e forms #art of a set of gui ance material for MH6s that inclu es information on: ,otification an 5etermination Safety Assessment Safety Management Systems 5evelo#ing a Safety Case @utline 4re#aration of a Safety Case (nformation% &raining an (nstruction for Workers an @thers at the 6acility 4rovi ing (nformation to the Community 8mergency 4lans" What do the Regulations require? &he o#erator of a etermine MH6 must establish a safety management system for the o#eration of the ma*or ha<ar facility an #rovi e the regulator $ith a com#lete safety case for the MH6 $ithin t$o years after etermination of the MH6" &he safety case must inclu e a summary of the safety management system for the MH6" 6urther etails of the re?uirements un er the WHS regulations are set out in A##en i9 A" Relevant efinitions are set out in A##en i9 +"

4age 1 of 21

MARCH 2012

DEMONSTRATIONS OF ADEQUACY
5emonstrations in a safety case #rovi e all stakehol ers $ith assurance that the o#erator is achieving safe o#eration of the facility by using a e?uate control measures an satisfactory management systems" (n #articular% they #rovi e regulators $ith some of the evi ence necessary to su##ort the issuing of a licence to o#erate the MH6" &he regulator $ill usually verify some of the ata #rovi e in the safety case emonstrations to confirm the vali ity of the arguments ma e by the o#erator" 4erio ically% an follo$ing ma*or changes to the facility or its o#erations% the emonstrations must be revie$e to ensure safe o#eration is being maintaine " Such a revie$ may also be triggere by a ne$ state of kno$le ge e"g" follo$ing inci ents" &here are t$o sets of circumstances in $hich safety cases% an the emonstrations they contain% nee to be #re#are " &hese are: $hen the safety case is being #re#are for a ne$ MH6% for e9am#le: a Agreen fiel ) facility that $ill be a MH6 an e9isting facility that $ill become a MH6 after mo ifications that $ill increase the ?uantity of Sche ule 1B materials on site to above threshol ?uantities a facility that has been etermine to be a MH6 by the regulator un er regulation B11 $hen a safety case is revie$e an revise as #art of an a##lication for licence rene$al"

1"1

&eatures of successful 'emonstrations

&he follo$ing factors are critical for successful emonstrations in a safety case: a clear un erstan ing of the means an criteria the o#erator uses to eci e $hen risk has been re uce so far as is reasonably #racticable% or alternatively% ho$ the o#erator eci es that it is not #racticable to carry out further risk re uction ste#s access to information about% or #eo#le $ith kno$le ge of% ha<ar s an effective control measures that are available to eal $ith them historical ata an recor s that sho$ ho$ $ell s#ecific control measures function un erstan ing of the s#ecific safety management system =SMS> elements nee e to ensure ongoing effectiveness an reliability of each s#ecific control measure historical #erformance ata an recor s that sho$ ho$ $ell the su##orting SMS elements function"

1"2

Core conce(ts

&he safety case must inclu e information sufficient for the #ur#ose of emonstrating that the control measures a o#te at the facility are a e?uate% an that the SMS is com#rehensive an integrate for all as#ects of the a o#te control measures" &he information nee s to be trans#arent an etaile for it to be un erstoo by others% an for the regulator to eci e $hether it is satisfie $ith the a e?uacy of the control measures an the effectiveness of the SMS" A convincing case coul inclu e etaile e9am#les% as $ell as escribe the a##roach taken an the overall results" A o#te control measures must be sho$n to eliminate or re uce% so far as is reasonably #racticable% the risk to health an safety% an be effective an reliable across the range of circumstances an con itions likely to be encountere at the facility" &his $ill emonstrate that the control measures are a e?uate" &o emonstrate that the SMS is com#rehensive an integrate for all as#ects of the control measures% it nee s to be sho$n to fully su##ort an maintain the #erformance of the control measures $ithin an integrate management frame$ork" &he effort to make the emonstrations shoul be #ro#ortionate to the risk% $ith the ma*ority of the analysis an assessment on ha<ar s that contribute most to the risks of a ma*or inci ent an the #otential ma*or inci ents $hich have the highest conse?uences"

4age B of 21

MARCH 2012

(n eci ing to issue a MH6 licence% the regulator must be satisfie that: the a##lication has been ma e in accor ance $ith the Regulations the safety case for the facility has been #re#are in accor ance $ith 5ivision 2 of 4art !"2 of the Regulations the o#erator is able to o#erate the ma*or ha<ar facility safely an com#etently the o#erator is able to com#ly $ith any con itions that $ill a##ly to the licence" &he a##roach that each o#erator em#loys in making the re?uire emonstrations shoul reflect the nature of the facility% its culture an its risks" 5e#en ing on the circumstances% it may inclu e: com#arison $ith stan ar s% co es an in ustry #ractices =see Section 1"11 of this gui ance> analysis of the risks% benefits an costs of alternative control measures assessment of the a e?uacy of control measures an their #erformance in icators com#arison $ith benchmarks for risk an for management #erformance com#arison $ith best #ractice management system frame$orks *u gement by affecte grou#s such as $orkers an stakehol ers emonstration of #ast an #lanne im#rovements" A combination of a##roaches to emonstration is likely to be necessary"

4age 0 of 21

MARCH 2012

PLANNING AND PREPARATION 1"3 What 'emonstrations are re)uire'*

&he safety case must emonstrate: that the ma*or ha<ar facility)s safety management system $ill% once im#lemente % control risks arising from ma*or inci ents an ma*or inci ent ha<ar s the a e?uacy of the measures to be im#lemente by the o#erator to control risks associate $ith the occurrence an #otential occurrence of ma*or inci ents" &hese t$o emonstrations are se#arate" Ho$ever% common to both emonstrations is the nee to make sure that all as#ects are covere an that there are no ga#s" 6or emonstrations to be convincing they nee to sho$ that control measures an the SMS function $ell i"e" can be relie on to consistently o the *ob they are meant to o" Control measures are usually selecte an a o#te at the en of a ha<ar i entification% safety assessment an control measure selection #rocess" &his emonstration a resses t$o as#ects of control measures% $hich are: sho$ing that control measures in #lace at the site $ere selecte correctly to a ress all the ha<ar s i entifie sho$ing that control measures can be relie u#on to o the *ob for $hich they $ere selecte " A facility)s SMS is usually evelo#e in #arallel $ith the ha<ar i entification% safety assessment an control measure selection #rocess" &he SMS is inten e to manage the safety of all as#ects of o#eration at the facility% not *ust ma*or inci ent #revention" Ho$ever% the SMS emonstration is limite to sho$ing that all as#ects that nee to be manage to ensure ongoing effectiveness an reliability of control measures are covere " &here is no #rescribe form for these emonstrations" @#erators shoul use a means that is a##ro#riate an meaningful to the facility an to the o#eratorCs safety culture" (n a ition% the emonstrations nee to be conveye in a $ay that the regulator can un erstan from an e9ternal #ers#ective"

1"+

Workforce re)uirements

Dey #ersons in the $ork#lace must be consulte before this com#onent of the safety case can be $ritten" &his is to ensure that a clear #icture of the actual #erformance of the SMS an control measures elements is obtaine " @#erators may choose to gain this by con ucting formal $orksho# sessions" +etter results $ill be obtaine from these $orksho#s if #ersons $ith a broa range of functions an skills =e"g" #lant o#erators% maintenance% technical an safety s#ecialists> are all involve an #artici#ants un erstan the metho ology an #rocess to be follo$e before the $orksho#s are hel " &he Regulations re?uire the o#erator of a MH6 to consult $ith $orkers in relation to the #re#aration of the safety case outline% the establishment an im#lementation of the SMS% an the #re#aration an revie$ of the safety case" Health an safety re#resentatives shoul also be consulte as they are entitle to re#resent $orkers in matters relating to $ork health an safety"

4age - of 21

MARCH 2012

1"5

,ealth an' Safet- .e(resentatives

Health an Safety Re#resentatives =HSRs> o not nee to be involve in $riting the emonstrations or #artici#ating in any $orksho#s that contribute to them" &hey shoul % ho$ever% be consulte about the #rocess that is to be follo$e an $ho $ill be involve in any $orksho#s that are to be hel "

1"6

Pro/ect an' technical issues

Control measure selection an SMS revie$ an ;or revision nee to be settle before the emonstration can be com#lete " &he metho ology to be use for the t$o emonstrations shoul be etermine early in the #rocess" ,e$ly etermine MH6s =i"e" those #re#aring the first safety case for the facility> are re?uire un er regulation BB1 to #re#are a safety case outline an submit it to the regulator for revie$ $ithin three months of the facility being etermine to be a MH6 =refer to the Guide for Major Hazard Facilities: Safety Case Outline>" &he general metho use to emonstrate ho$ the ob*ectives s#ecifie in regulation B01=1>=a> an =b> $ill be met is to be outline in the safety case outline" &he #ro*ect #lanning for safety case #re#aration at a ne$ MH6 shoul allo$ sufficient time for any $orksho#s an the subse?uent revie$ an $rite/u# of the outcomes" Generally% the $rite/u# $ill often involve etaile an significant iscussion of a number of re#resentative e9am#les an may take more time than initially e9#ecte " 6acilities revie$ing an revising their safety case for licence rene$al #ur#oses may choose to submit a revie$e an revise outline to the regulator" Any change to the emonstration #rocess shoul be note an a##ro#riate time shoul be allo$e for revie$ing an strengthening the emonstrations"

4age . of 21

MARCH 2012

THE DEMONSTRATION PROCESS

5emonstrations are connecte to control measures an the o#erator nee s to sho$ the follo$ing: the control measures in #lace at the facility are ca#able of re ucing the risk #ose by each ha<ar so far as is reasonably #racticable it is not reasonably #racticable to use more or better control measures to re uce risk further the control measures in #lace #erform their inten e function effectively an reliably the o#erator has a SMS in #lace that $orks to ensure that all control measures $ill continue to #erform effectively $henever nee e " &o a ress the first com#onent% the o#erator nee s to sho$ that it is using a vali an a##ro#riate means of evaluating risk an $hether risk re uction is achieve so far as is reasonably #racticable" &he Guide for Major Hazard Facilities: Safety Assessment iscusses a number of ifferent a##roaches o#erators can take for estimating risk an the e9tent of risk re uction achieve by selecte an #ossible alternative control measures" &he first emonstration in the safety case shoul sho$ that the a##roach taken by the o#erator =?ualitative or ?uantitative> to assess risk is a##ro#riate an robust" &he emonstration shoul then sho$ that the risk% $ith controls in #lace% has been re uce so far as is reasonably #racticable" An a##roach often use for this is to com#are the controlle risk $ith recognise risk criteria" &he emonstration also nee s to sho$% by e9am#le at least% that it is not reasonably #racticable to use more or better alternative control measures" An a##roach use by some is to com#are the control measures in #lace $ith those re?uire by in ustry co es or cor#orate stan ar s" Ho$ever% this assumes that the ecision as to reasonable #racticability reflects control measures a##lying $hen the co e or stan ar $as evelo#e an oes not take into consi eration ne$ or facility/ s#ecific kno$le ge" @nce it has been emonstrate that the controls are ca#able of re ucing risk so far as is reasonably #racticable% historical #erformance ata is usually nee e to sho$ in ivi ual control measures at a facility consistently o $hat they are su##ose to o" &his forms the basis of the secon emonstration% as consistent goo #erformance of control measures oes not ha##en by acci ent" A number of elements of the SMS nee to be functioning effectively to maintain the controls) #erformance" 6or e9am#le% instrumente an mechanical control systems nee to be regularly ins#ecte an teste % $hile training is nee e to ensure #roce ural control measures are al$ays carrie out correctly" &he secon emonstration nee s to sho$ that the necessary SMS com#onents are in #lace for every risk control measure an that these systems are also consistently effective an reliable"

4age ! of 21

MARCH 2012

DEMONSTRATION OF CONTROL MEASURE ADEQUACY 1"7 What is reasona$l- (ractica$le*

Regulation BB0 s#ecifies that the o#erator of a MH6 must im#lement control measures to eliminate% so far as is reasonably #racticable% the risk of a ma*or inci ent occurring or% if that is not reasonably #racticable% minimise that risk so far as is reasonably #racticable" (n etermining $hat is Ereasonably #racticableF the o#erator is e9#ecte to e9ercise *u gement% taking into account the five factors s#ecifie in Section 1. of the Work Health and Safety Act% namely: the likelihoo of the ha<ar or risk concerne occurring the egree of harm that might result from the ha<ar or the risk e"g" fatality% multi#le in*uries% me ical or first ai treatment% long/ or short/term health effects $hat the #erson concerne kno$s% or ought reasonably to kno$% about the ha<ar or risk an any $ays of eliminating or minimising the risk the availability an suitability of $ays to eliminate or minimise the risk the cost associate $ith available $ays of eliminating or minimising the risk% inclu ing $hether the cost is grossly is#ro#ortionate to the risk =in other $or s% control measures shoul be im#lemente unless the risk is insignificant com#are $ith the cost of im#lementing the measures>" 'sing an ammonia #lant as an e9am#le% the i entification an assessment ste#s may have i entifie that the area $ith the highest #robability =likelihoo > of a loss of containment is the tanker loa ing area" (t is reasonable to e9#ect that the o#erator of this facility $oul have thought about the controls nee e for this area an that the safety case shoul be able to e9#lain this" &he o#erator an facility esigners may also have conclu e that the $orst case scenario =i"e" ma*or inci ent $ith the highest conse?uence> is catastro#hic failure of the large ammonia storage tank" &herefore it is reasonable to e9#ect that more effort is #ut into the esign an controls for this #art of the facility because of the high conse?uence shoul this failure occur" &he information in the safety case shoul emonstrate that this $orst case scenario has been a resse " &he massive e9#losion that occurre at the +uncefiel 6uels &erminal in the 'D in 5ecember 200B significantly change $hat that in ustry sector Akno$s% or ought reasonably to kno$) about the ha<ar s or risks at this ty#e of facility" As a result% it is no$ reasonable to e9#ect that control measures to #revent similar tank overflo$s $oul be more robust than before% an it is notable that many similar facilities% both overseas an in Australia% have res#on e accor ingly" &he final consi erationG$eighing u# the cost of a itional controls against the e9tent of risk re uction that coul actually be obtaine Gis similar to the #rocess many o#erators go through each year $hen eci ing $hich im#rovement #ro*ects to a to ne9t year)s investment #lan an $hich to efer" 6or many #ossible #ro*ects;im#rovements% ?ualitative com#arisons are sufficient" Ho$ever% more etaile ?uantitative com#arisons are often un ertaken for more im#ortant or high/ cost #ro*ects" Safety cases submitte by o#erators may contain e9am#les $here o#erators have ma e similar com#arisons of alternative control measures before eci ing on $hich to a o#t for s#ecific risk scenarios" &he safety assessment shoul #rovi e the information nee e to make these *u gements% an therefore much of the reasoning behin the o#erator)s selection of control measures may alrea y be #resente in the safety case i"e" in the summary of the safety assessment ocumentation re?uire un er regulation B01=2>=b>" &he e9tra information re?uire to make a convincing emonstration $ill e#en on the amount of etail inclu e in the summary"

1"0

1o controls minimise risk so far as is reasona$l- (ractica$le*

4age 10 of 21

MARCH 2012

&he first com#onent of a emonstration is to sho$ that each ha<ar an #otential ma*or inci ent has been a resse $ith s#ecific control measures" &he use of bo$/tie iagrams is one clear gra#hical means of oing this =see 6igure 1 for an e9am#le>" &his sho$s that there are control measures in #lace for each ha<ar that coul lea to a ma*or inci ent" (t is also #ossible to sho$ this in tabular form =e"g" atabase #rintout or s#rea sheet>" &able 1 is a mock/u# erive from 6igure 1 that sho$s s#ecific control measures liste for s#ecific ha<ar s" Ho$ever% safety cases submitte $ith tables sho$ing a list of ha<ar s in one column an a list of control measures in another column =such as the mock/u# in &able 2> o not hel# emonstrate that control measures re uce the risk of all i entifie ha<ar s% as it is not clear $hich controls act for $hich ha<ar s an $hether all ha<ar s have an i entifie control"

4age 11 of 21

MARCH 2012

000B 8?ui#ment corrosion

Maintenance error =e"g" fitting tightene too har % $rong com#onent / not fit for service>

,5& ins#ection #rogram

0012

0010
8?ui#ment s#ecification an esign to A+C stan ar s

,atural ventilation of storage area

Critical

0000 &ra e ?ualifie #ersonnel

8?ui#ment s#ecification an esign to A+C stan ar s

0012 Gas etection in storage area

'nignite ammonia release / inhalation of ammonia fumes

Keak from flange;seal / gasket failure

0010

Critical

000Lalve an flange fitting training 001. S#ee limits on site 002!

Relocate e?ui#ment re?uiring lifting

Com#onent failure

0020
8mergency Res#onse 4lan

448 =+reathing A##aratus> available

0022

(nhalation of ammonia fumes

0021
Me ical assistance available on/site

Critical @nsite vehicle colli es $ith storage tank 5ro##e ob*ect =lifting over storage tank> 001Storage area is #rotecte =chaine off ; vehicle barriers / restricte access

Ammonia release at storage Storage tank #uncture

0022 8mergency isolation valve 0001 Gas 5etection Ammonia mi9ing $ith nearby store of hy#ochlorite

0010
Kifting gear ins#ection% maintenance an testing

448 =+reathing A##aratus> available Me ical assistance available on/site

0021 0021

0022

Critical

Generation of chlorine

@verfilling of storage tank 89ternal heat source =e"g" sun>

0000
A+C @#erating #roce ures for filling tank

001! 4ressure relief valves Critical

@ver#ressure Hot $ork

002B Hot $ork #ermit

0021 (gnition Control 0021 6oam generation ca#abilities 002B Se#aration istance

0020
&ank esigne for B0JC service =as #er esign stan ar s>

6urnace

0020 Se#aration istance

Ammonia release an ignition

8scalation to other vessels

+o$/&ie Dey 0022 Ha<ar Control Ha<ar 4ath$ay Ma*or (nci ent

@utcome

&i#ure 1: 89am#le of bo$/tie gra#hic sho$ing an ammonia release at storage

4age 12 of 21

HA,'ARI 2012

2a/or inci'ent: Ammonia release at storage =A+C Chemical Com#any> Cause: ,a3ar' 8?ui#ment corrosion Com#onent failure Control measure ,5& ins#ection #rogram 8?ui#ment s#ecification an esign to A+C stan ar s Maintenance error =eg fitting tightene too far% $rong com#onent / not fit for service> Keak from flange;seal / gasket failure Cause: ,a3ar' @n/site vehicle colli es $ith storage tank &ra e ?ualifie #ersonnel Lalve an flange fitting training 8?ui#ment s#ecification an esign to A+C stan ar s Lalve an flange fitting training Storage tank #uncture Control measure Storage area is #rotecte =chaine off;vehicle barriers> / restricte access S#ee limits on site 5ro##e ob*ect =lifting over storage tank> Kifting gear ins#ection% maintenance an testing Relocate e?ui#ment re?uiring lifting Me ium High &unctionalitHigh Ko$ &unctionalitHigh Me ium Ko$ Me ium Me ium Me ium

%a$le 1: 89am#le of ha<ar ;control measure register

2a/or inci'ent: Ammonia release at storage =A+C Chemical Com#any> ,a3ar's 5ro##e ob*ect =lifting over storage tank> 8?ui#ment corrosion 89ternal heat source =eg sun> Keak from flange;seal / gasket failure Maintenance error =eg fitting tightene too far% $rong com#onent / not fit for service> @n/site vehicle colli es $ith storage tank @verfilling of storage tank Control measures A+C o#erating #roce ures for filling tank 8?ui#ment s#ecification an stan ar s ,5& ins#ection #rogram 4ressure relief valves Relocate e?ui#ment re?uiring lifting S#ee limits on site Storage area is #rotecte =chaine off;vehicle barriers> / restricte access &ank esigne for B0JC service =as #er esign s#ecification> &ra e ?ualifie #ersonnel Lalve an flange fitting training esign to A+C

Kifting gear ins#ection% maintenance an testing

%a$le 2: 89am#le of control measure register = oes ,@& hel# emonstration>

4age 12 of 21

HA,'ARI 2012

&he secon as#ect is the level of risk that remains after the o#erator has eci e that it is not reasonably #racticable to o any more" @ne means of gauging the vali ity of these ecisions is by com#aring the final risk $ith a suitable #ublishe benchmark such as the Lictorian Ainterim) off/site risk criteria or ,SW 5e#artment of 4lanning)s risk criteria for lan use safety #lanning =H(4A4 1>" H(4A4 1 a resses off/site risk" 6or on/site risks% the criterion for neighbouring in ustry in H(4A4 1 coul be use as an initial target" (t is $orth noting that community e9#ectations have a vance since the Lictorian criteria $ere #ro#ose in the 1!.0s an some 8uro#ean *uris ictions no$ a##ly tougher criteria" (n a ition% numerical evaluation of risk is only as goo as the ata use in the evaluation of likelihoo an conse?uences% both of $hich are sub*ect to much uncertainty" A##en i9 C #rovi es e9am#les of risk criteria that can be use in relation to ma*or inci ents" &hese are not e9haustive an o#erators may choose to use criteria ifferent to these e9am#les" Whatever criteria are use % the o#erator $ill have to *ustify the criteria as suitable an a##ro#riate to the s#ecific facility"

1"4

Coul' more or $etter controls $e use'*

An alternative $ay of emonstrating that the control measures in #lace at the facility $ill minimise risk so far as is reasonably #racticable is to sho$ that a itional or alternative control measures are not *ustifie " @ne means of oing this is using Kayers of 4rotection Analysis =K@4A>" K@4A estimates the likelihoo of an initiating ha<ar lea ing to a ma*or inci ent after allo$ing for the #robability of failure on eman =465> of the various control measures that are in #lace to #revent that s#ecific ha<ar occurring" (f the conse?uence of the inci ent is kno$n =e"g" #otential number of fatalities>% the #ro uct of the conse?uence an the estimate likelihoo =allo$ing for the control measures> gives an estimate of the risk #ose by the initiating ha<ar =in units such as fatalities #er year>" ,ote that% for K@4A to $ork #ro#erly% the control measures nee to be in e#en ent" A relate techni?ue use for instrumente control measures =such as a lo$ tem#erature tri# system> is a safety integrity level =S(K> revie$" &here are t$o #arts to a S(K revie$" 6irst% a S(K analysis =similar to a K@4A> etermines ho$ lo$ the 465 of the instrumente control system nee s to be to reach a esire risk level" &hen a S(K verification of the #articular har $are com#onents that make u# the instrumente control system is con ucte to confirm that the re?uire 465 $ill be obtaine " @ne factor that can strongly affect the 465 of instrument systems is the fre?uency $ith $hich they are ins#ecte % teste an re/calibrate " A itional or alternative control measures can be inclu e in these analyses an their effect on the final risk estimate " &here are also techni?ues for estimating the 465 of #roce ural control measures% such as Human Reliability Analysis% an there is #ublishe ata available for the 465 of #roce ural tasks% e#en ing on their com#le9ity% fre?uency of use an environmental factors"1

1"15

6se of e7am(les in 'emonstration

&he MH6 regulations o not s#ecify any #articular techni?ue to evaluate the risk re uction achieve by control measures" What is s#ecifie is that: un er regulation BBB=2>% the o#erator must con uct a etaile assessment of all as#ects of risks to health an safety associate $ith all #otential ma*or inci ents% inclu ing the range of control measures consi ere an the control measures the o#erator eci es to im#lement un er regulation B01=1>=b>% the o#erator must emonstrate in the safety case the a e?uacy of the measures to be im#lemente by the o#erator to control risks associate $ith the occurrence an #otential occurrence of ma*or inci ents"
1

See Layers of rotection Analysis! Sim"lified rocess #isk Assessment % Center for Chemical 4rocess Safety% American (nstitute of Chemical 8ngineers% 2001"

4age 11 of 21

HA,'ARI 2012

&his usually involves an e9#lanation of the metho ology use by the o#erator an an a##ro#riate number of e9#laine e9am#les to illustrate that the metho ology le to re ucing the risk so far as is reasonably #racticable" &he e9am#les shoul cover a range of o#erations throughout the facility% inclu ing the highest likelihoo an highest conse?uence events" 6or a fuel terminal% the regulator may e9#ect the emonstration to inclu e the tanker loa ing facility an the tank overflo$ scenario that occurre at +uncefiel in 200B =see Section 1"->% as $ell as some other scenarios $here inci ents have been kno$n to occur% such as transfer line failures" 6or a more com#le9 manufacturing facility% e9am#les might be e9#ecte to inclu e any reactor areas% any se#aration #rocess such as istillation% ma*or storage areas =vessels or tanks> an any ma*or #ro uct or ra$ material han ling areas" &he key areas in a less com#le9 utilities facility% such as a $ater treatment #lant% may be the main chlorine storage area% unloa ing of chlorine an osing e?ui#ment =in*ectors an ;or eva#orators>" &he #hiloso#hy behin this a##roach is that: if fully e9#laine e9am#les sho$ that the o#erator has minimise the risk so far as is reasonably #racticable for those ha<ar s% an if the o#erator a##lie the same metho ology systematically throughout the facility an its full range of o#erations then the o#erator% regulator an stakehol ers can all be assure that the necessary risk re uction has been achieve throughout the facility"

1"11

6se of in'ustr- co'es an' stan'ar's

Some o#erators have use their com#liance $ith in ustry stan ar s or co es of #ractice as the #rime means of emonstrating a e?uacy of control measures" &hese ocuments may be Australian Stan ar s% e?uivalents from overseas organisations% international in ustry #ractices =such as those from the American 4etroleum (nstitute> or com#any/s#ecific stan ar s" &his a##roach assumes that those $ho evelo#e the co e or stan ar i all the necessary thinking to select the necessary control measures for the o#erator)s situation or% if a #ossible control measure is not s#ecifie in the co e or stan ar % it must not be #racticable to #ut it into #ractice" &hese assum#tions nee to be teste if stan ar s an co es are being consi ere for *ustification" &he follo$ing are e9am#les $here a itional control measures have been *ustifie in e9cess of those in co es or stan ar s: A 4rocess Safety Kea ershi# Grou# set u# in the 'D follo$ing the +uncefiel inci ent in 5ecember 200B ma e a number of recommen ations for esign an o#eration of fuel terminals that have not yet been incor#orate in AS $%&': (he stora)e and handlin) of flamma*le and com*usti*le li+uids" Many multinationals in this in ustry sector are also evelo#ing ne$ cor#orate stan ar s for their affiliates" Regulators may e9#ect facilities in this sector to consi er these in a ition to AS 1!10 or e?uivalent stan ar s" A facility using li?ui chlorine% situate on a hillsi e above a resi ential area% shoul carefully consi er the nee for a itional controls over an above the stan ar se#aration istances% etc" in AS,-.S /%/0: (he stora)e and handlin) of li+uefied chlorine )as" Some large K4G storage sites have *ustifie control measures that are a itional to those s#ecifie in AS,-.S $1%2: (he stora)e and handlin) of L Gas% such as #assive fire #rotection an automatic isolation" ,evertheless% co es an stan ar s are a valuable source of information for ha<ar s an control measures" Many o#erators have con ucte a ga# analysis bet$een their facility an relevant Australian an international co es or stan ar s as #art of their ha<ar i entification an control measure selection #rocesses" Any ga# is taken as a $arning that a ha<ar may have been misse or its significance un erestimate " Ho$ever% the absence of any ga#s oes not automatically mean that further risk re uction is not #racticable =using the full range of #racticability consi erations in Section B"1>"

4age 1B of 21

HA,'ARI 2012

&herefore% it is recommen e that any o#erator relying on com#liance $ith co es or stan ar s for the emonstration shoul : sho$ that a full ga# analysis has been one *ustify any ga#s% if foun e9#lain fully $hy it is not reasonably #racticable to further re uce the risk of: the highest conse?uence scenario the most likely =or most fre?uent> initiating ha<ar any other scenarios $here inci ents have been kno$n to occur% similar to the use of fully e9#laine e9am#les in Section B"2" (f this analysis sho$s that further risk re uction is not #racticable in those cases% it $oul then be a reasonable assum#tion that com#liance $ith the co e or stan ar $oul be e?ually satisfactory in other cases at the facility% an the emonstration $oul be consi ere soun "

1"12

Are control measures a'e)uate*

&he final re?uirement of the emonstration to meet regulation B01=1>=b> is that the control measures are a e?uate i"e" are meeting their #erformance targets" (f the o#erator is making this emonstration in a safety case to su##ort an a##lication for licence rene$al% the o#erator shoul have several years of actual #erformance monitoring ata to ra$ on" &he number of control measures on the ha<ar register $ill e#en on the si<e an com#le9ity of o#erations at the facility" 6or a sim#le facility it may be #ossible to inclu e the #erformance ata of all control measures" &his may be #resente in tabular or chart form" &he emonstration an the case for licence rene$al $oul be strengthene if the ata $ere to sho$ an im#roving tren over time" Some aggregation of the #erformance ata may be necessary for facilities $ith larger numbers of control measures =e"g" number of 4SL releases or Afail to anger) test results as a #ercentage of the total number of 4SLs on/site or in an area>" Ho$ever% for a convincing emonstration% high/ level #erformance ata shoul be backe u# by etaile ata of a sam#le of control measures" &he emonstration $oul be hel#e if the control measure sam#le corres#on e $ith the fully e9#laine e9am#les = iscusse in Section B"1>" (f the safety case is for a ne$ MH6% there may be little actual #erformance ata available at the time of #re#aring the safety case" (n this case% the argument for a e?uacy of controls may have to rely on #ublicly available ata such as 465 ata for similar har $are% or by analogy $ith affiliate facilities $ithin the o#erator)s organisation" &he emonstration $ill be more convincing if the information is linke to fully e9#laine e9am#les% $ith an e9#lanation of $hy the o#erator e9#ects the control measures to #erform a e?uately"

4age 10 of 21

HA,'ARI 2012

1E289S%.A%:89 8& C82P.E,E9S:;E A91 :9%E<.A%E1 S2S 1"13 1oes the S2S su((ort control measures*

&he other emonstration re?uire by regulation B01=1> is that the SMS manages all the things nee e for the control measures to control the risks arising from a ma*or inci ent or a ma*or inci ent ha<ar " As note in Section 1% consistent goo #erformance of control measures oes not ha##en by acci ent" A number of SMS elements nee to be functioning effectively to maintain the controls) #erformance" A first ste# in emonstrating that all necessary as#ects of control measure management are covere $oul be to list all the SMS elements that nee to function $ell to su##ort each control measure on the o#erator)s ha<ar register" While this may soun aunting% this task can be ma e manageable" 6or e9am#le% all instrument control systems nee to be regularly ins#ecte an teste % an therefore a common system =calle various names such as ACritical 6unction &esting)> $oul a##ly for all such instrument controls" Some other systems that $oul be im#ortant for instrument controls are: a management of change =MoC> system% for any changes to the controls such as alarm or tri# set #oint changes a system such as a A efeat of critical e?ui#ment) system% for $henever an im#ortant instrument control is tem#orarily taken off/line =an later returne to service>" &he same or similar safety management systems may a##ly to other im#ortant e?ui#ment or har $are such as #ressure relief valves or fire #rotection e?ui#ment" 4roce ural control measures =i"e" $hen safe o#eration re?uires that $orkers carry out s#ecific tasks in a s#ecifie manner an ;or se?uence> nee a ifferent set of su##ort systems" &he #roce ures nee to be ocumente in a formal o#erating #roce ures system =har co#y or electronic>" &he #ersonnel nee to be traine in $hat they are e9#ecte to o an not #ermitte to carry out the #roce ure=s> until certifie as com#etent" Changes to the o#erating #roce ures% or changes that might im#act on them% nee to be manage by a MoC system" &raining $ill #robably be #art of a $i er #ersonnel system that inclu es formal role escri#tions% recruitment an training #lans" &here shoul also be some other common systems such as #erformance% monitoring an au iting to #rovi e ongoing assurance that the control measures an su##ort systems are functioning $ell" &hese are ty#ical elements of any com#rehensive an integrate management system that has been establishe consistent $ith recognise systems such as AS &3'&: Occu"ational health and safety mana)ement systems 4 General )uidelines on "rinci"les% (S@ !000 M 5uality Mana)ement Systems% systems an su##orting techni?ues% or the system #ro uce by the Center for Chemical 4rocess Safety" Many SMS elements are nee e to su##ort the control measures at most MH6s" Ho$ever% because most of these a##ly in common to a lot of control measures% the total number of SMS elements that $oul be the sub*ect of regulation B01=1> is not e9cessive"

1"1+

1emonstratin# that the S2S su((orts control measures

&o emonstrate the matters re?uire by regulation B01=1>% the safety case nee s to sho$: all the necessary as#ects of control measures are being manage by SMS elements the elements are #art of a com#rehensive system that $orks together $ell the SMS elements are all functioning $ell i"e" $orking as they are su##ose to an meeting their #erformance stan ar s" As iscusse above in Section 0"1% it shoul not be ifficult to confirm an then sho$ in the safety case that all necessary as#ects of control measure management are covere in the facility)s SMS"

4age 1- of 21

HA,'ARI 2012

6or most o#erators% the secon as#ect =com#rehensiveness an integration> $oul be covere in the summary of the SMS in the safety case that is re?uire un er regulation B01=2>= >" Most o#erators inclu e a escri#tion of the overall system an ho$ it $as evelo#e % to sho$ an overall systematic a##roach rather than an amor#hous collection of ran omly relate #roce ures =refer to the Guide for Major Hazard Facilities: Safety Mana)ement Systems>" &he thir as#ect =functionality of the s#ecific SMS elements> is ealt $ith by a summary of SMS au iting results an other #erformance monitoring ata% as iscusse in Section 1"12" As for control measures% the emonstration =an the case for licence rene$al> $oul be strengthene if the ata $ere to sho$ an im#roving tren over time"

4age 1. of 21

HA,'ARI 2012

86%P6%S
&he format of emonstration information in the safety case can vary% e#en ing on the a##roach taken by the o#erator" 6or ease of future revision% safety cases may be $ritten $ith the metho ology for various safety uties =such as ha<ar i entification> an high/level results in the bo y of the safety case $ith etaile results in a##en ices" (t $oul therefore make sense for o#erators to e9#lain the metho ology for etermining a e?uacy of control measures in the bo y of the safety case% #robably as one as#ect of the safety assessment metho ology% an inclu e results of control measure assessment in an a##en i9" @#erators may inclu e etaile tables of control measure assessment =rate un er hea ings such as 8ffectiveness% Reliability% Survivability% Maintainability% etc"> in their a##en ices" @#erators that use fully e9#laine e9am#les to strengthen their emonstration normally inclu e the e9am#les as a stan /alone section of the safety case" &his section coul also contain other information use to su##ort the emonstration argument% such as an e9#lanation of $hy the o#erator believes com#liance $ith a #articular co e or stan ar e?uates $ith re ucing risk so far as is reasonably #racticable at their #articular facility" As mentione #reviously% #erformance monitoring results can also have an im#ortant role in emonstrating the effectiveness of control measures an SMS elements% es#ecially for licence rene$al a##lications" 5e#en ing on the amount of #erformance monitoring ata available% this ata can also be #resente in the safety case" Alternatively% for a large ?uantity of ata% a summary of the monitoring an ;or au iting #rocess an a summary of results an conclusions coul be #resente in the bo y of the safety case an etaile results in an a##en i9"

4age 1! of 21

HA,'ARI 2012

.E;:EW A91 .E;:S:89

&here are no revie$ an revision re?uirements for ne$ o#erators relating to emonstration" Ho$ever% revie$ an revision re?uirements relate to rene$al of a MH6 licence" Any changes i entifie as necessary in the ha<ar register an lists of control measures an su##orting SMS elements $ill make it necessary to revise the emonstration information" ,aturally if inci ent investigations or #erformance monitoring results #rovi e a ne$ state of kno$le ge% then the o#erator must reconsi er the effectiveness of a control measure or some as#ect of safety management% an any a e?uacy assessment must be revie$e an revise " &he o#erator)s assessment of control measures% an reasons for consi ering them to be reliable% are a valuable source of information to regulators $hen #re#aring for annual ins#ections at the site" @#erators coul ask similar ?uestions $hen con ucting internal au its e"g" What sort of reliability or 465 =or testing fre?uency to *ustify that 465> $as assume in the control measure assessmentN 5o inci ents% ins#ection an maintenance recor s vali ate these assum#tionsN (f not% the emonstration shoul e9#lain $hat action is being taken to reme y this situation"

4age 20 of 21

HA,'ARI 2012

APPENDI" A #
.e#ulation 550

HS REGULATIONS
.e)uirement

Safet- mana#ement s-stem =1> &he o#erator of a etermine ma*or ha<ar facility must establish a safety management system for the o#eration of the ma*or ha<ar facility% in accor ance $ith this regulation" =2> &he o#erator of a etermine ma*or ha<ar facility must im#lement the safety management system for the ma*or ha<ar facility% so far as is reasonably #racticable" =2> &he safety management system must: =a> #rovi e a com#rehensive an integrate system for the management of all as#ects of risk control in relation to the occurrence an #otential occurrence of ma*or inci ents at the ma*or ha<ar facilityO an =b> be esigne to be use by the o#erator as the #rimary means of ensuring the safe o#eration of the ma*or ha<ar facility" =1> &he safety management system must: =a> be ocumente O an =b> state the o#eratorCs safety #olicy% inclu ing the o#eratorCs broa aims in relation to the safe o#eration of the ma*or ha<ar facilityO an =c> state the o#eratorCs s#ecific safety ob*ectives an escribe the systems an #roce ures that $ill be use to achieve those ob*ectivesO an = > inclu e the matters s#ecifie in Sche ule 1-O an
=e> be rea ily accessible to #ersons $ho use it"

565

Safet- case must $e (rovi'e' &he o#erator of a etermine MH6 must #rovi e the regulator $ith a com#lete safety case for the MH6 $ithin 21 months after the facility $as etermine to be an MH6" Content =of safet- case> =1> &he o#erator must #re#are the safety case in accor ance $ith the safety case outline #re#are or altere un er this 5ivision" =2> A safety case must contain the follo$ing: =a> a summary of the i entification con ucte un er regulation BB1% inclu ing a list of all ma*or inci ents i entifie O =b> a summary of the safety assessment con ucte un er regulation BBBO =c> a summary of the ma*or ha<ar facilityCs emergency #lanO = > a summary of the ma*or ha<ar facilityCs safety management systemO =e> a escri#tion of any arrangements ma e in relation to the security of the ma*or ha<ar facilityO =f> a escri#tion of the consultation $ith $orkers that took #lace un er regulation B-B in the #re#aration of the safety caseO

561

4age 21 of 21

HA,'ARI 2012

=g> the a

itional matters s#ecifie in Sche ule 1."

=2> &he safety case must inclu e any further information that is necessary to ensure that all information containe in the safety case is accurate an u# to ate" =1> A safety case must emonstrate: =a> that the ma*or ha<ar facilityCs safety management system $ill% once im#lemente % control risks arising from ma*or inci ents an ma*or inci ent ha<ar sO an =b> the a e?uacy of the measures to be im#lemente by the o#erator to control risks associate $ith the occurrence an #otential occurrence of ma*or inci ents" =B> &he o#erator must inclu e in the safety case a signe statement that: =a> the information #rovi e un er subregulations =1> an =2> is accurate an u# to ateO an =b> as a conse?uence of con ucting the safety assessment% the o#erator has a etaile un erstan ing of all as#ects of risk to health an safety associate $ith ma*or inci ents that may occurO an &he o#erator must #re#are the safety case in accor ance $ith the safety case outline #re#are or altere un er the regulations" =c> the control measures to be im#lemente by the o#erator: =i> $ill eliminate the risk of a ma*or inci ent occurring% so far as is reasonably #racticableO an =ii> if it is not reasonably #racticable to eliminate the risk of a ma*or inci ent occurringG$ill minimise the risk so far as is reasonably #racticableO an =iii> in the event of a ma*or inci ent occurringG$ill minimise its magnitu e an the severity of its health an safety conse?uences so far as is reasonably #racticableO an = > all #ersons to be involve in the im#lementation of the safety management system have the kno$le ge an skills necessary to enable them to carry out their role safely an com#etently" =0> (f the o#erator is a bo y cor#orate% the safety case must be signe by the most senior e9ecutive officer of the bo y cor#orate $ho resi es in 3this *uris iction7" .evie! &he o#erator of a etermine ma*or ha<ar facility must revie$ an as necessary revise the ma*or ha<ar facility)s safety case after any revie$ is con ucte un er regulation BB!" Safet- case ? revie! &he o#erator of a license MH6 must revie$ an as necessary revise the safety case after any revie$ is con ucte un er regulation B0!" 8(erator of 2,& must consult !ith !orkers =1> 6or the #ur#oses of section 1!=f> of the Act% the o#erator of a etermine ma*or ha<ar facility must consult $ith $orkers at the ma*or ha<ar facility in relation to the follo$ing: =a> the #re#aration of the safety case outline for the ma*or ha<ar facilityO =b> the #re#aration% testing an im#lementation of the ma*or ha<ar facilityCs

563

575

575

4age 22 of 21

HA,'ARI 2012

emergency #lanO =c> the establishment an im#lementation of the ma*or ha<ar facilityCs safety management systemO = > the con uct of a revie$ un er regulation BB!O =e> the im#lementation of the $orkersC safety role un er regulation B-1=1>O =f> the #re#aration an revie$ of the ma*or ha<ar facilityCs safety case" =2> 6or the #ur#oses of section 1!=f> of the Act% the o#erator of a license ma*or ha<ar facility must consult $ith $orkers at the ma*or ha<ar facility in relation to the follo$ing: =a> the testing an im#lementation of the ma*or ha<ar facilityCs emergency #lanO =b> the im#lementation of the ma*or ha<ar facilityCs safety management systemO =c> the con uct of a revie$ un er regulation B0!O = > the im#lementation of the $orkersC safety role un er regulation B-1=2>O =e> a revie$ of the ma*or ha<ar facilityCs safety case" &he o#erator of a etermine MH6 or a license MH6 must consult $ith $orkers at the MH6 in relation to matters concerning the safety case an the SMS"

4age 22 of 21

HA,'ARI 2012

APPENDI" $ # DEFINITIONS
A'e)uac-% for the #ur#oses of Cha#ter ! of the WHS Regulations% means suitable for achieving the ob*ective of eliminating or re ucing the likelihoo of a ma*or inci ent occurring or the magnitu e an severity of conse?uences of a ma*or inci ent if it i occur" Control measure% in relation to a risk to health an safety% means a measure to eliminate or minimise the risk" 1emonstration means a logical% coherent case or argument to sho$ convincingly that the re?uirements of regulation B01=1>=a> an =b> are being achieve at the MH6" &his $ill usually involve some te9t to state the case% backe u# by some evi ence to su##ort the case such as ocumentation from technical analyses% inci ent; ata tren s% observation of the #erformance of e?ui#ment% management systems an control measures% recor s of tests an rills% real/time information% electronic me ia an other ata" &acilit- means a $ork#lace at $hich Sche ule 1B chemicals are #resent or likely to be #resent" 2a/or ha3ar' facilit- =2,&> means a facility: at $hich Sche ule 1B chemicals are #resent or likely to be #resent in a ?uantity that e9cee s their threshol ?uantity that is etermine by the regulator un er 4art !"2 to be a ma*or ha<ar facility" 2a/or inci'ent at a ma*or ha<ar facility is an occurrence that: results from an uncontrolle event at the ma*or ha<ar facility involving% or #otentially involving% Sche ule 1B chemicals e9#oses a #erson to a serious risk to health an safety emanating from an imme iate or imminent e9#osure to the occurrence" An occurrence inclu es any of the follo$ing an esca#e% s#illage or leakage an im#losion% e9#losion or fire" 2a/or inci'ent ha3ar' means a ha<ar that coul cause% or contribute to causing% a ma*or inci ent" =&his may inclu e any activity% #roce ure% #lant% #rocess% substance% situation or other circumstance>" 8(erator in relation to a facility% means the #erson con ucting the business or un ertaking of o#erating the facility% $ho has: management or control of the facility the #o$er to irect that the $hole facility be shut o$n in relation to a #ro#ose facility% means: the o#erator of a #ro#ose facility that is an e9isting $ork#lace the #erson $ho is to be the o#erator of a #ro#ose facility that is being esigne or constructe " Safet- assessment is the #rocess by $hich the o#erator of a ma*or ha<ar facility systematically an com#rehensively investigates an analyses all as#ects of risks to health an safety associate $ith all ma*or inci ents that coul occur in the course of the o#eration of the ma*or ha<ar facility" Sche'ule 15 chemical means a ha<ar ous chemical that: is s#ecifie in Sche ule 1B% table 1B"1 of the WHS Regulations belongs to a class% ty#e or category of ha<ar ous chemicals s#ecifie in Sche ule 1B% table 1B"2 of the Regulations" %hreshol' )uantit-% in relation to a Sche ule 1B chemical% means:

4age 21 of 21

HA,'ARI 2012

the threshol ?uantity of a s#ecific ha<ar ous chemical as etermine un er clause 2 of Sche ule 1B the aggregate threshol ?uantity of 2 or more ha<ar ous chemicals as etermine un er clause 1 of Sche ule 1B =regulation B>"

4age 2B of 21

HA,'ARI 2012

APPENDI" C # RIS% CRITERIA

Risk criteria Com#arison of estimate risk levels against set criteria may be useful as #art of an overall emonstration of a e?uacy of control measures% although it is unlikely that a e?uacy can be emonstrate solely by this means" &his a##en i9 #rovi es a brief iscussion of the ty#es of risk criteria that have been a o#te nationally an internationally" &hese a##roaches may be useful for a##lication to in ivi ual MH6s% to s#ecific as#ects of ma*or inci ent risk at MH6s =e"g" the off/site risk>% or to #articular sections of in ivi ual MH6s =e"g" if a #urely ?ualitative a##roach #roves insufficient in #articular areas>" General basis Risk criteria can #rovi e a basis for *u ging the tolerability of risks that have been assesse % an for eci ing the urgency or #riority $ith $hich any i entifie ha<ar or risk shoul be a resse " Ho$ever% all risk assessment is sub*ect to uncertainty% an hence use of rigi risk criteria may be ina##ro#riate" A #ossible alternate a##roach is #rovi e by the 'D Health an Safety 89ecutive)s =HS8> frame$ork for the tolerability of risk an its AAs lo$ as reasonably #racticable) =AKAR4> conce#t" &his is base on broa ranges of risk% rather than on s#ecific criteria" &he HS8)s #olicy ocument #educin) #isks! rotectin) eo"le M HS67s decision8makin) "rocess =2001> #resents the risk tolerability frame$ork" &his re#resents risk on an inverte triangle as increasing from a broa ly acce#table region% through a tolerable region% to an unacce#table region =see 6igure 2>" &his broa frame$ork is use in HS8)s #ermissioning gui ance% Guidance on 9as lo: as reasona*ly "ractica*le7 ;ALA# < decisions in control of major accident hazards ;COMAH< an #rovi es for the follo$ing broa risk ranges: an u##er region $here AKAR4 has not been emonstrate an risk is unacce#table a mi le region $here risk is tolerable if AKAR4 is emonstrate through arguments base on relevant goo #ractice% a itional risk re uction metho s an grossly is#ro#ortionate costs for further risk re uction a lo$er region $here risk is broa ly acce#table an oes not nee further re uction because relevant goo #ractice is a##lie " Although the broa risk ranges a##ear com#atible $ith the Work Health and Safety Act #erformance stan ar of Aso far as is reasonably #racticable)% the inter#retation oes not incor#orate the continuous im#rovement as#ects containe $ithin the Regulations" &his means that at the lo$est risk ban % some risks may remain not re uce % even $here it may be reasonably #racticable to further re uce the risk" An inter#retation of the broa risk ranges% $hich manages or re uces all risks an inclu es consi eration of continuous im#rovement% is sho$n in &able 2 an escribe in more etail belo$"

4age 20 of 21

HA,'ARI 2012

&i#ure 2: &he broa risk regions

6nacce(ta$le re#ion

Risk must be re uce regar less of cost unless e9traor inary circumstances a##ly

Risk tolerable only if re uction cost is grossly is#ro#ortionate to gain achieve

%olera$le re#ion
Risk tolerable if all reasonably #racticable ste#s to re uce it are un ertaken Risk tolerable if re uction cost e9cee s im#rovement achieve

@roa'l- acce(ta$le re#ion

Must ensure that the risk is manage to remain at this level% an ;or re uce further if reasonably #racticable

'##er region

'nacce#table risk

Mi

le region

&olerable risk

Ko$er region

+roa ly acce#table risk

4rom#t action must be taken to re uce risk regar less of cost% unless e9traor inary circumstances a##ly Risk re uction measures must be im#lemente so far as is reasonably #racticable% taking into account the available measures% relevant goo #ractice% cost etc Risks must be manage an % so far as reasonably #racticable% continuously re uce

%a$le 3: An inter#retation of the risk ranges =refer to 6igure 2>8rror: Reference source not foun 8rror: Reference source not foun &he overall emonstrations the o#erator has to make through the safety case nee to consi er ha<ar s an risks in all regions% an may nee to s#ecifically sho$ that: there are no ha<ar s or risks currently in the u##er region% an any ha<ar s or risks that may arise in the u##er region in the future $ill be imme iately an effectively ealt $ith all ha<ar s an risks in the mi le an lo$er regions have ha all reasonably #racticable risk re uction measures a##lie there are suitable an reliable #rocesses for continuing to manage ha<ar s an risks at all levels an for achieving continual im#rovement"

4age 2- of 21

HA,'ARI 2012

Risk matrices A risk matri9 categorises the risk of in ivi ual ma*or inci ents% base u#on the *u gement of an assessment team about the or er of magnitu e of the likelihoo an conse?uence of the inci ent occurring" &y#ical risk matrices for ha<ar ous in ustrial facilities range in si<e from 2 9 2 to B 9 B" &y#ically% this has likelihoo on the I a9is an conse?uence on the P a9is of the matri9" (t is recommen e that the fre?uency or likelihoo scale shoul be one or er of magnitu e #er ro$ or column" Risk increases iagonally across the matri9 an ban s of broa risk levels can be establishe on the matri9% #er#en icular to the irection of risk increase" &hese ban s can be seen to broa ly relate to the risk ban s in 6igure 2% an therefore can be use to sho$ areas $here risk is intolerable;unacce#table an $here risk is tolerable% sub*ect to all #racticable measures being taken an sub*ect to continuous im#rovement" &he broa risk ban s can also be relate to the urgency of action re?uire " (n general% #reventative control measures =left han si e of the bo$/tie iagram in 6igure 1> lea to a ecrease in the likelihoo of an inci ent occurring% $hich usually means a ecrease in the I coor inate on the matri9" Mitigative control measures =right han si e of the bo$/tie iagram in 6igure 1> lea to a ecrease in the conse?uence of an inci ent if it occurs% $hich usually means a ecrease in the P coor inate on the matri9" Ho$ever% o#erators shoul note that the risk matri9 a##roachG$hilst it may be useful in ranking risks an to su##ort a emonstration of a e?uacyGis unlikely to be sufficient on its o$n for many facilities" 6or e9am#le% se#arate an a itional analysis of the effects of alternate control measures is likely to be nee e % as a risk matri9 is often too coarse a tool to istinguish bet$een o#tions" (t may also be ifficult to fully a ress the re?uirement for cumulative consi eration of ha<ar s using risk matrices alone" @#erators $ho use risk matrices shoul give clear efinitions for the matri9 an any categorisation use $ithin it% an shoul sho$ $hat action or significance is attribute to each #osition on the matri9" @#erators shoul check that their risk matrices% an any risk criteria im#lie through their use% are consistent $ith commonly a o#te risk criteria% such as the =?uantitative> interim Lictorian risk criteria =see the ne9t section>" QRA and quantitative criteria Quantitative a##roaches to risk assessment have ifferent strengths an $eaknesses" &hey allo$ a more #recise an consistent a##roach to efining the likelihoo % conse?uence an severity of a ma*or inci ent but the results can vary significantly e#en ing on assum#tions ma e for the calculations" &hey can also be resource/intensive% may lack trans#arency% may be ifficult for a non/s#ecialist to un erstan an may give a mislea ing sense of accuracy of risk estimates" (f an o#erator chooses to con uct a Quantitative Risk Assessment =QRA>% then the results may be use by com#arison $ith #re/ etermine criteria or for com#aring ifferent o#tions as #art of the overall emonstration of a e?uacy" &here are t$o main ty#es of ?uantitative risk measure that may be use to efine risk criteria: Individual risk is the fre?uency at $hich an in ivi ual may be e9#ecte to sustain a given level of harm from the realisation of s#ecifie ha<ar s" &he #ur#ose of criteria base on this risk measure is to ensure that no single #erson is overe9#ose to risk" Risk assessment results using this measure are often base on risk Acontour) #lots" Societal risk is the relationshi# bet$een the fre?uency of occurrence of ma*or inci ents an the number of #eo#le suffering from a s#ecifie level of harm in a given #o#ulation from those inci ents" &he #ur#ose of criteria base on this risk measure is to control risk to society as a $hole" Risk assessment results using this measure are often base on fre?uency/conse?uence =6,> gra#hs"

4age 2. of 21

HA,'ARI 2012

&hese criteria may in #rinci#le be a##lie to any e9#ose #o#ulation% on/site or off/site% although for a variety of reasons the actual levels of risk tolerability may vary bet$een the ifferent e9#ose grou#s" Risk tolerability values for in ivi uals e9#ose to ma*or inci ent ha<ar s shoul relate in a sensible manner to levels of risk from other in ustrial an non/in ustrial activities" (n the case of off/site risk to the general #o#ulation% a set of Ainterim) criteria has been use in a number of cases in Lictoria e"g" in relation to lan use #lanning ==nterim >ictorian #isk Criteria 4 #isk Assessment Guidelines% #re#are for the Altona Chemical Com#le9 an the Lictorian Government% by 5,L &echnica% @ctober 1!..>" &he criteria o not have legal status but #rovi e gui ance on values" &hese values are as follo$s: Risk must not e9cee 10 #er million #er year at the boun ary of any ne$ facility" (f risk e9cee s 10 #er million #er year at the boun ary of an e9isting facility% risk re uction measures must be taken" (f risk off/site is bet$een 0"1 an 10 #er million #er year% all #racticable risk re uction measures are to be taken an resi ential evelo#ments are to be restricte " Risk levels belo$ 0"1 #er million #er year are broa ly tolerable" A #lot of cumulative number of fatalities% from all #otential inci ents% against fre?uency remains in the lo$ or me ium region"

1"008R00

1"008/01

1"008/02

1"008/02 &re)uencPer Aear 1"008/01

MEDIUM HIGH

1"008/0B
LOW

1"008/00

1"008/01 10 9um$er of &atalities LOW: Risk acceptable and tolerable. Must be managed. MEDIUM: Risk tolerable not necessaril! acceptable. Must be reduced "#$%. HIGH: Risk unacceptable and intolerable. Must be reduced immediatel!. 100 1000

Kegen : Societal Risk 6, = ashe line>O Lictorian A(nterim) Risk Criteria =soli lines>

&i#ure 3: 89am#le societal risk 6, gra#h $ith Lictorian (nterim Risk Criteria

4age 2! of 21

HA,'ARI 2012

Com#arison $ith a benchmark such as the Lictorian risk criteria is a straightfor$ar e9ercise $hen an o#erator uses QRA in its formal safety assessment" Ho$ever% QRA is not man atory un er the Regulations an most o#erators use alternative ?ualitative assessment techni?ues such as risk matrices" Since most matrices sho$ a conse?uence ban of one fatality on one a9is% an some form of numerical fre?uency =or likelihoo > estimate on the other a9is% it is usually #ossible to etermine $hat sort of fatality rate the o#erator consi ers to be AHigh)% AMe ium) or AKo$) on/site risk" While there are no e?uivalent Lictorian on/site risk criteria% in the #ast a fatality risk of 10/2 #er year has been consi ere as the limit of tolerability for the high ha<ar environment of a congeste off/shore oil #latform" &he risk for a less congeste on/shore facility shoul be much lo$er than this" (t is likely that the regulator $oul challenge an o#erator if it a##eare from the risk matri9 that a risk of 10/2 #er year or higher $as consi ere lo$ risk% or in the lo$er en of me ium risk" &hese criteria are offere for reference #ur#oses only% so it is not man atory that they be met" Ho$ever% if o#erators choose to meet ifferent criteria% it is im#ortant that $hatever criteria are a o#te is *ustifie as a##ro#riate" Potential loss of life and cost benefit of control measures Societal risk can also be e9#resse as a A4otential Koss of Kife) =4KK>% $hich is the number of fatalities that may be e9#ecte to occur each year% average over a long #erio " &he number shoul be small: if 100 #eo#le are each e9#ose to a risk level of 10 in a million #er year% the 4KK is 0"001" &he 4KK is a useful basis for cost/benefit analyses of risk re uction measures% via the A(m#lie Cost of Averting 6atality) =(CA6>: (CA6 S cost of measure;=initial 4KK M re uce 4KK> Such calculations are often controversial as they a##ear to re?uire a value to be #lace on life% but these calculations are commonly use internationally an may ai ecision making in regar to a o#ting control measures for ma*or ha<ar s" 6or e9am#le% a lo$ (CA6 for a #ro#ose risk re uction measure im#lies that the measure is highly effective because the cost is lo$ com#are to the risk re uction achieve " Conversely% a high (CA6 im#lies a relatively ineffective risk re uction measure% in icating that the money shoul be iverte to an alternative" Other issues @ther issues to consi er in relation to risk criteria inclu e the follo$ing: Quantitative criteria for risk to #ersons on/site have not been establishe for Lictorian in ustry an $oul nee to be set an *ustifie by any o#erator #ro#osing to use QRA metho s" Ha<ar s =an therefore #ossibly risks> must be assesse both in ivi ually an cumulatively% an hence the a o#te criteria $ill nee to be a##licable to ha<ar s both in ivi ually an cumulatively" &he risk matri9 a##roach consi ers ha<ar s an risks in ivi ually% $hilst the Lictorian interim risk criteria a##ly to all ha<ar s cumulatively" &herefore% a combination of criteria may be nee e " Most establishe criteria relate s#ecifically to fatality rates but the MH6 regulations o not re?uire any s#ecific form of criteria" (t may be a##ro#riate to consi er measures of risk relate to lo$er levels of harm e"g" serious in*ury"

4age 20 of 21

HA,'ARI 2012

APPENDI" D # FURTHER INFORMATION

References Layers of rotection Analysis! Sim"lified rocess #isk Assessment7% Centre for Chemical 4rocess Safety% American (nstitute of Chemical 8ngineers% 2001" Australian Stan ar % AS 1!10:2001 M (he stora)e and handlin) of flamma*le and com*usti*le li+uids" Australian Stan ar ;,e$ Tealan Stan ar % AS;,TS 2!2-:2001 M (he stora)e and handlin) of li+uefied chlorine )as" Australian Stan ar ;,e$ Tealan Stan ar % AS;,TS 1B!0:200. M (he stora)e and handlin) of L Gas" Australian Stan ar ;,e$ Tealan Stan ar % AS;,TS 1.01:2001 M Occu"ational health and safety mana)ement systems 4 General )uidelines on "rinci"les! systems and su""ortin) techni+ues" Australian Stan ar ;,e$ Tealan Stan ar % AS;,TS (S@ !000:2000 M 5uality mana)ement systems 4 Fundamentals and ?oca*ulary" Australian Stan ar % AS (8C 01B11"1 to 2:2001 M Functional safety 4 Safety instrumented systems for the "rocess industry sector@ Australian Stan ar % AS 1021"1:2000 M Safety of machinery@ General COMAH Safety #e"ort Assessment Manual" 'D HS8 M Ha<ar ous (nstallations 5irectorate% Hanuary 2002" #educin) #isks! rotectin) eo"le 4 HS67s decision8makin) "rocess% 'D HS8% HS8 +ooks% 2001" H=A7s a""roach to 9As lo: as reasona*ly "ractica*le7 ;ALA# < decisions" 'D HS8 M Ha<ar ous (nstallations 5irectorate% S4C;4ermissioning;0!" Guidance on 9As lo: as reasona*ly "ractica*le7 ;ALA# < decisions in control of major accident hazards =C@MAH>" 'D HS8 M Ha<ar ous (nstallations 5irectorate% S4C;4ermissioning;12" S ecific to ics #isk criteria for land use "lannin) in the ?icinity of major industrial hazards % 'D HS8% 1!.!" Fire! 6B"losion and #isk Assessment (o"ic Guidance% 'D HS8 M Ha<ar ous (nstallations 5irectorate M @ffshore 5ivision% 6ebruary 2002" Good "ractice and "itfalls in risk assessment" 'D HS8 M Health U Safety Kaboratory% Research Re#ort 1B1% 2002" Hazardous industry "lannin) ad?isory "a"er -o@& 4 #isk Criteria for Land Cse Safety lannin) ;H= A &< =Hanuary 2011> 6ormer ,SW 5e#artment of 4lanning"" 6n?ironmental #isk Assessment: An Australian ers"ecti?e% Su#ervising Scientist Re#ort 102% & +eer U 6 Tiolko$ski% Canberra% 1!!B"

4age 21 of 21

HA,'ARI 2012