CIMAH — where are we now

CIMAH - where are we now

K. Cassidy Health and Safety Executive, Technology Division, Magdalen House, Stanley Presinct, Bootle, U.K.

This paper, presented at Guildford in April 1989, outlines the UK control strategy for Major Chemical Hazards, in a European context. The current legislative background is described, followed by an indication of potential changes to reflect international initiatives. The paper is a presentation of current CIMAH issues

(Keywords: hazerd; risk; acceptable risk)

The UK has been a leading architect in the framing of legislative control for major industrial hazards. We have a system, based mainly on the advice of the Advisory Committee on Major Hazards ’ and confirming European requirementsl, which is centred in the following concepts3:

l identification - via the NIHHS regulations4 l assessment and control - via the CIMAH regul-

ations’ and, of course, HASAWA6 l mitigation - via the CIMAH regulations (involving

emergency planning and information to the public), and land-use planning contro17V8.

This approach is very much an interdependent package of controls and responses, appropriately tailored to the relevant risks .

There are some 1750 installations subject to NIHHS, and several hundred more now notified under CIMAH, many of the latter in particular presenting environmental, as well as human-damage risks. The very requirement for statutory identification has a number c.f effects. It prioritizes HSE attention; it permits identification of such sites to land-use and emergency planners, and to emergency services; and hopefully, it stimulates a greater on-site awareness of the hazards and risks.

Assessment and control The general requirements of the CIMAH regulations apply to sites that store or use hazardous substances which satisfy criteria related to toxicity, flammability, reactivity or explosibility. Several thousand such substances have been identified as being in regular use in industry. In such cases, the operator of the site must:

l notify the HSE of any major accident which has occurred on his site, with details of steps taken to prevent its recurrence; (note - a major accident need only have the potential for harm)

Received 14 June 1988

0950-423o/aalo40221-05s3.00 0 1988 Butterworth & Co. (Publishers) I-td

J. Loss Prev. Process lnd., 1988, Vol 1, October 221

0 be prepared to demonstrate to an Inspector, on request, (and produce documentary evidence as appropriate) that he has considered the potential for major accidents from his operations, and has taken all appropriate steps both to prevent their occurrence and to mitigate the consequences of any which may occur.

Further, more specific duties under the regulations apply to sites on which are stored or used named substances in excess of specified thresholds. These sites are known as large inventory top tier sites (LITTS), which store large quantities of flammable toxic or explosive materials, and small inventory top tier sites (SITTS) which store or use materials that are considered particularly toxic, and for which more lower thresholds (1 tonne or less) are prescribed. In the UK there are over 200 LITTS, and several hundred SITTS notified to HSE. (These numbers may increase substantially, if current initiatives in Europe are realised). The additional duties that fall to the occupiers of such sites are:

l the preparation of on and off-site emergency plans l the provision of appropriate information to the

public l the submission to HSE of a ‘safety case’

Mitigation The main elements of mitigation are location, emergency planning and information to the public:

Location Adequate mitigation of major hazard risks is best achieved by planning control of incompatible land uses. Such controls have been applied in the UK, on a formal basis, since 1972. We are, however, the inhabitants of a small island (where intensive land-use is at a premium), and the hazard ranges of some of our industrial processes may be very great. Additionally, there is an

CIMAH - where are we now: K Cassidy

existing legacy of previously permitted and continuing incompatible development. Many of our hazardous installations are less than ideally located in respect of adjacent developments. This most powerful tool of control is, therefore, only partially applicable to the existing situation, despite continuing developments in planning law 9, which will shortly introduce a ‘consent’ procedure for hazardous installations.

Emergency planning

CIMAH requires effective arrangements for on and off-site emergency plans, involving close co-operation between the site operator, the local authority, the county authority and the emergency services. General advice on emergency planning has been published by both the HSE” and industry1’*‘2. The recent SIESO booklet is an important addition to this corpus of advice13. The following principles are relevant in the production of emergency plans.

Manufacturers have to assess their activities to ensure that all that is reasonably practicable is being done to avoid or reduce danger. They should then assess what dangers could arise to people on and off-site as a result of foreseeable emergencies, and what the effects of an incident could be on the environment. They should consider how these could be mitigated by pre-planned remedial and rescue measures using, when necessary, the combined resources of the organization concerned and the public emergency services.

The objectives of the emergency plans are to contain and control incidents, to safeguard employees and anyone nearby who might be affected and to minimize damage to property or the environment. The range of possible incidents may be very large. The smallest, if promptly detected and dealt with, may have virtually no ill effects. If allowed to escalate, however, any incident may have serious consequences on and off the site.

Emergency plans must be capable of dealing with the largest incidents that can reasonably be foreseen, but detailed planning should concentrate on those events which are more probable. Plans must also have sufficient flexibility built in so that the response is tailored to the severity of the incident. Flexibility will also allow the response to be extended and increased if extremely remote combinations of adverse events and circumstances lead to consequences larger or more severe than those that formed the basis for the emergency plans. For example, the risks of aircraft crashing onto an installation which is not within a few miles of an airfield are remote, and the consequences need not be considered in detail. If such a disaster occurred there is no doubt that, in practice, the existing peacetime emergency plans would form the basis of the response by the emergency services. Seismic effects are unlikely to be a major risk in the UK, in terms of emergency planning for major incidents.

Information to the public Any emergency planning depends for its success on an

appropriate response from those covered by the plan, and this necessitates adequate briefing of those liable to be affected. On-site personnel will receive this briefing (and training, as appropriate) as part of the preparation and realization of an emergency plan. Off-site, however, such detailed briefing and preparation will rarely be possible. For this reason, the CIMAH Regulations impose an additional duty to inform persons who are within the area which it is for the HSE define. (This area will normally be based on the land-use planning consul- tation distance). The minimum information to be given is:

l that the hazardous installation is notifiable, and has been notified to HSE

l a description of the operations on site, and the hazards and risks which might affect the recipient of the information

l of any emergency measures (including appropriate personal behaviour) to be taken in the event of an incident.

Methods of information giving will, of course, vary, as will frequency. Advance and regular information can be given to those resident or working in the area; those in control of public amenities can be similarly informed. Transients may well, however, only receive the information in an emergency situation.

Assessment and control

Emergency planning and information to the public are measures primarily designed to mitigate the consequences of any major incident, should it occur (the probability of that accident should, however, be remote) or, in the case of some aspects of emergency planning, to intervene in the escalation process. These aspects apart, however, such issues should be concerned with the residual risk after all appropriate, reasonably practicable precautions have been taken. This is, as stated above, a general requirement of the law6. In the case of CIMAH installations, however, it is reinforced by a specific requirement to present to HSE a written report which:

l describes the installation and places it in its geogra- phical and social context

l identifies any relevant major accident hazards (including type, relative likelihood, and consequences)

0 analyses the effectiveness of the safeguards (both hardware and software) that have been applied

0 reaches conclusions about the risks presented by the installation; and

l on the basis of the above analyses, effectively just- ifies the continuation of the operation, while identifying any remedial action I4

This is not a process of approval, or one of licensing. (See ACMH 2 Appendix for model conditions for a licensing scheme). Nor is it a once and for all exercise, as there are revision and updating requirements. The ana-

222 J. Loss Prev. Process lnd., 1988, Vol 1, October


Regulation 1 l(2). Similarly, the position with respect to some SITT sites remains unclear, particularly for environmental risks, where often relevant technical information for hazard and risk assessment is accessible only with difficulty, if at all. Between 15% and 20% of the safety cases HSE expects to receive have now been submitted. The contents and standards of these cases have been variable, and considerable debate has taken place between HSE, individual firms, and representative organizations: a debate which is continuing.

lysis is, however, a written demonstration of the application of good management techniques to major hazard control. It identifies the critical areas, which can then be addressed on a concentrated and continuing basis; and the hazard analysis carried out an early stage of the assessment process highlights, inter alia, the relevant areas for potential mitigation, (including that provided by adequate emergency planning).

The safety case consists, therefore, of: facts about the site; reasoned arguments about the risks from the site; and conclusions (and perhaps proposals). It sdould be a self-contained summary, in sufficient detail to allow HSE to fulfil its statutory role to judge the adequacy of the manufacturers’ investigation of the risks and the controls. For a complex site, such an investigation will involve extensive documentation. The bulk of this supportive information should not be included in the safety case; it should, however, be referenced there. It is important that the safety case indicates clearly where the supporting documents (e.g. plant design specifications, inspection reports, permit to work systems etc) are to be found. Such supporting evidence should be regarded as part of the safety case (even though it may not be included in the document), and not as additional information to be obtained through the notice procedures described in CIMAH Regulation 9. The detail of the contents of the safety case itself, and of the supportive information, should reflect the size of the hazard, the likelihood of its occurrence, and the com- plexity of the systems involved.

Any analysis carried out on the above lines will serve either to identify areas of concern, leading to proposals for ameliorative action; or demonstrate that the control of hazards and risks is at an appropriate level and that any residual risks are trivial/acceptable. The benefits are two-fold-stemming partly from the insight which the analysis develops (and any remedial measures identified), but also from the reassurance which an adequate analysis provides both for the operators of any plant, and for its neighbours.

CIMAH - the current position

Introduction of the CIMAH requirements was doubly phased. For new plants, and for plants for which substantial modifications were proposed, all the requirements of the regulations had to be met in advance of commissioning; whereas for existing plants, introduction of the regulations was staged in respect of the specific requirements. For such plants, the requirements for on and off-site emergency planning, and for information to the public, are now in force; but the requirement to submit a ‘safety case’ has an operative date in July 1989.

With few exceptions, the public information exercise was carried through with little difficulty; and most LITT sites now have in place appropriate emergency plans. There have, however, been some problems in respect of the information which the manufacturers must provide for the emergency planners in compliance with CIMAH

Quantification

Regulation 1 l(2) of CIMAH requires the manufacturer to provide the emergency planning officer with certain information, including details of ‘the nature, extent, and likely effects of possible major accidents’. For emergency planning purposes, therefore, a consequence assessment is an apriori need. It is difficult to see how this assessment can be meaningful within the objectives of emergency planning without an appropriate degree of quantification of hazard. Some indication of risk (poss- ibly quantified) will also be a powerful aid to the emergency planner’s judgement.

There is no explicit requirement in CIMAH (or in the EC directive) for a quantified assessment in a safety case. HS(R) 21 (Ref. 14) says that:

‘Whilst it may be possible for manufacturers to write a safety case in qualitative terms, HSE may well find easier to accept conclusions which are supported by quantified arguments. A quantita- tive assessment is also a convenient way of limiting the scope of the safety case, by demonstrating either that an adverse event has a very remote probability of occurring, or that a particular consequence is relatively minor’.

It is noteworthy that in this extract, the quantification of consequences (hazard) is distinguished from that of the probability of that hazard being realised (risk). The guidance booket reinforces the view later:

‘Paragraph 5c (of CIMAH Schedule 6) by con- centrating on preventive measures, is intended to draw out discussion on the positive aspects of the safety case. However, because the sequence of cause, effect and consequence are closely entwined, it is not possible in practice to confine such a discussion to prevention, without mention- ing the potential consequences of the potential major accidents discussed in the safety case. Esti- mates of consequences will in any case be required in order to formulate adequate advice to the local authority responsible for drawing up off-site emergency plans’.

Quantifying has a number of advantages. It allows critical areas to be assessed; it can produce a ranking order of priority. Importantly, assumptions can be checked for sensitivity. It provides a convenient way of limiting the scope and/or depth of any investigation,

J. Loss Prev. Process fnd., 1988, Vol I, October 223


and it allows more convenient and clearer mutual understanding. Options can be objectively assessed, cost/benefit considerations are facilitated. It enforces greater rigour in investigations (for example by identifying interactions between systems, personnel, and plant parameters), it helps to reveal weaknesses in standards and codes. It allows assessment of residual risks, and appropriate wider comparisons.

There are, of course, disadvantages in, and problems associated with, quantification of risk (and of hazard to a lesser extent). There are many uncertainties involved (although sensitivity testing can assist here). Its techniques require the use of scarce, skilled manpower, with significant resource costs, On these grounds alone it must not be carried to excess.

To summarize, therefore, the current HSE view is that a certain amount of quantified risk assessment will be needed: first, to assist the CEPO in planning the scale and detail of his emergency responses; and second in safety cases, in critical areas, in which a (quantified) hazard assessment results in a manufacturer not being able to ‘live’ with the hazards. In other words, it meets the HS(R)21 criteria of low probability or low consequence quoted above.

QRA, selectively applied, is therefore a tool, some- times an essential tool, in the application of informed judgement; it is not an end in itself. It goes further than targetting, however; in identifying critical areas of risk, it then assists the examination/assessment of reliability. (For example if an analysis identifies the importance of deluge systems, or relief or shut-off valves, as being critical, more thorough investigation is warranted and facilitated). It follows that it is not possible to be prescriptive in the application of QRA-each case needs to be considered on its own merit, in the light of all the circumstances. Each application will be context specific.

CIMAH-the future

Clearly, a number of current issues remain to be resol- ved. The majority of safety cases remain to be submitted to and assessed by HSE. There are extensive discussions in progress about future submissions, as well as any submitted cases. Cases themselves may well form one of the inputs to structured inspection. Such work is, however, a continuation of present commit- ments, as is further investigation into environmental risks.

Major accidents continue to occur, and in occurring, affect perceptions of hazard and risk, and views as to the adequacy of current controls. The UK controls exist in a European and wider international context, in which arena further changes may be imminent, or under discussion. What might these changes involve?

One amendment to the Directive has already been adopted I5 and drafting of regulations amending CIMAH consequentially is already under way in the UK (there may also be implications for the Hazardous Substances ‘Consent’ Regulations). The changes intro- duced by this amendment:

tidy up the situation with reference to ammonium nitrate reduce the threshold quantities for certain substances (e.g. chlorine, phosgene and methyl isocyanate) increase the threshold quantities for certain substances (e.g. cobalt and nickel metal, oxides, carbonates, sulphides, as powders) and add certain substances (e.g. liquid oxygen, sulphur trioxide).

Probably the most important changes are to clarify that the definition of industrial undertaking in Article 1 of the Directive (Schedule 4 of CIMAH) is inclusive, not exclusive, and to add ‘treatment’ to the production and processing of energy gases. A second amendment is under consideration clarifying the Directive article dealing with information to the public. It may well be that future European requirements will be modelled closely on current UK advice on this subject. If so, information requirements may include: name and address of site; name and position of informant; confirmation that the site is notifiable and has been so notified; a simple explanation of the site activities; the common names (where possible) of the ‘major accident’ substances on site, with an indication of their principal harmful characteristics; details of how the population will be informed in the event of an accident; general advice on the actions and behaviour appropriate to warning situations; an assurance that adequate arrangements (including liaison with the emergency services) exist to deal with foreseeable accidents and to minimize their effects; a reference to the off-site emergency plan, including advice on cooperation with emergency services; details of sources of further information.

A much more fundamental short term review of the Directive is currently in progress. The Basle incident in 1986 amply demonstrated that previously voiced doubts about the validity of the distinction between isolated storage and process risks were well founded, particularly in emergency situations, and especially in the context of environmental hazards. A far reaching amendment to the Directive is therefore proposed. Details of this proposed amendment are still, at the date of writing, under discussion although the impetus is such that any relevant amendment may well be in place by the time of publication of this paper. On the assumption that the thrust, if not the detail of the current proposals are adopted, the following principles may well need to be carried forward into amendment of UK legislation:

the substantial extension of the list of named substances held in ‘isolated storage’ or in process; the reduction in thresholds of certain named substances held in ‘isolated storage’ or in process; the application of generic categories of substances and preparations to both ‘isolated storage’ and process (the categorization based perhaps on the so called ‘Sixth Amendment’ (Ref. 16); the aggregation of partial fractions of generic categories

224 J. Loss Prev. Process tnd., 1988, Vol I, October

The EC has already commissioned numerous investigations into various aspects of the ‘Seveso Directive’ both on the content of the Directive, and its implemen- tation and effects, generally and locally, in terms of emergency planning, information to the public, and safety reports. A number of concepts are being debated, including hazard equivalence, research into major tech- nological risks, information to the public, pipeline risks, transportation, and non-acute risks, including car- cinogenicity and teratogenicity from major accident hazard incidents. Problems associated with criteria are also being investigated. It is perhaps too early to anticipate the effects these and other reviews will have on the future content and form of any fundamentally revised Directive.

The Organisation for Economic Co-operation and Development (and in particular the Environmental Directorate) has recently become significantly more involved in industrial major accident hazard issues, and it may well be that OECD initiatives could be combined with current internal European consideration in any fundamental review or changes in the EC Major Hazards Directive.

Topics currently under considerations include: har- monization of regulatory controls and procedures for approval of new installations; common principles of accident response; siting policies; arrangements for handling transfrontier emergencies, and for mutual assistance; exchange of technical information; harmon- ized methods of assessment in terms of standards for the safe operation installations; exchange of data on past accidents; setting up of a major accident database; information to the public; chemicals safety testing; comprehensive risk management; enforcement harmon- ization; public participation in risk decisions; licensing and/or approval regimes.

There is already a substantial corpus of international regulation of the transportation of harmful substances (generally converted into national legislation) by sea, air, road, and rail. Most are based on UN standards modified to take account of transportation mode. All such regulation is based on the principles of: classifi- cation of hazard (ie identification); identification of dangerous substances (ie labelling); containment (ie avoidance/prevention); emergency response (ie mitigation).

Many major hazard incidents involving hazardous substances have occurred in the transport mode and one of the valedictory recommendations of the Advisory Committee on Major Hazards involved the assessment of the hazards and risks associated with the transportation (including interchange and marshalling) of major hazard quantities of dangerous substances. This task has been taken up, in the UK, by a sub-committee of the Advisory Committee on Dangerous Substances, which in turn has formed Technical Working Groups, whose task is to appraise, and if necessary derive relevant assessment methodology and criteria, for both individual and societal risk, for each major transportation mode. When this task is completed, the ACDS


sub-committee will be able to reach informed judge- ments on the levels of risk(s) and to make appropriate recommendations for further controls (if needed) to government. Members of the sub-committee and working groups are aware of the major internationally-based effort which is continuing on this subject, and are in contact with many of the workers in the field. It would not be appropriate to anticipate the conclusions of either group, but clearly any necessary controls will relate to quantities, transport mode direction, routeing and mode prohibition, as well as conventional controls, including siting of interchange and concentration points, and developments in their vicinity.

In the longer term, other issues currently being debated, investigated, or even identified, may need resolution. It is not within the scope of this paper to consider these issues. It is clear, however, that issues such as risk criteria, quantification of risk, and risk equivalence, perceived and real will need to be addressed in due course. Inevitably this will introduce consideration of processes or operations (e.g. handling or pathogens, genetic engineering, etc) which may be perceived to present similar hazards.

Conclusions

A fairly comprehensive framework of control for ‘static’ major accident hazards exists at the UK and European level, which is being extended to other parts of the industrialized world, and, with appropriate modifications, to developing countries. Substantial effort is being deployed in the revision and updating of these controls. Risks from transportation, currently being assessed, may warrant similar controls. The extension of such controls to other hazards and risks remains a matter for future debate.

Note: the views in this paper are those of the author; and except where the context indicates otherwise. not necessarily definitive HSE views

References

I

2 3

4

5

6 7

8

9 10

11

12

13 14 IS 16

Advisory Committee on Major Hazards. Three Reports 1976. 1979, 1984, HMSO Directive No 82/5OI/EEC, OJEC Cassidy, K. Hazardous Installations and the Law. Durochem ‘86 IChemE. Notification of Installations Handling Hazardous Substances Regulations 1982, HMSO Control of Industrial Major Accident Hazard Regulations. 1984, HMSO Health and Safety at Work etc Act, 1974 Town and Country Planning (General Development) (Amend- ment) Order, 1984 Town and Country Planning (Use Classes) (Amendment) Order, 1984 Housing and Planning Act, 1986 CIMAH Regulations 1984. Further guidance on emergency plans HS(G)25, HSMO Recommended procedure for handling major emergencies 1977 (and supplement) CIA General guidance on emergency planning within the CIMAH Regulations for chlorine installations 1986 CIA Guide to Emergency Planning SIESO 1986 A guide IO CIMAH Regulations 1984 HS(R)21, HMSO Directive 87/216/EEC. 28.3.87, OJEC Directive 67/584/EEC as amended (particularly by 79/83l/EEC)

J. Loss Rev. Process Ind., 1988, Vol 7, October 225

Documents

CIMAH — where are we now