COMAH Environmental Risk Assessment Guidance

Humber Major Hazards Group23rd July 2015, CATCH Facility

Janet Greenwood

2

“As we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know”.

But there are also unknown unknowns – the ones we don't know we don't know. And if one looks throughout the history of our country and other free countries, it is the latter category that tend to be the difficult ones”.

Donald Rumsfeld, 12th February 2002

3

Jargon Alert!

• MATTE – Major Accident To The Environment (can affect humans too) – reported to EU by country involved

• CDOIF - Chemical and Downstream Oil Industries Forum, an HSE/ industry committee

• SPR – Source Pathway Receptor• ALARP – As Low As Reasonably

Practicable

4

COMAH law, including MATTE definitions

• EU level - SEVESO III Directive, Annex VI (1 page of 37), http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32012L0018&from=EN

• UK level - COMAH 2015 Regulations (1 page of 44), http://www.legislation.gov.uk/all?title=control%20of%20major%20accident%20hazards

5

Current COMAH ERA guidance

• DETR - Guidance on the Interpretation of Major Accident to the Environment for the Purposes of the COMAH Regulations, 1999 (can’t find online, but still valid) (48 pages)

• CDOIF guidance, 2013/14 http://www.hse.gov.uk/aboutus/meetings/committees/cif/environmental-risk-assessment.pdf (88 pages)

6

ERA required at Top Tier sites…

CDOIF – “COMAH requires all Top Tier site operators to submit site safety reports to the Competent Authority (CA) that demonstrate that the environmental risk for the whole COMAH establishment has been reduced to a tolerable level”. - In our experience, this has always happened, ERA is part of Safety Report

7

… and at Lower Tier sites

CDOIF - “Lower Tier operators must prepare risk assessments making a demonstration proportionate and appropriate to the environmental risk, and whilst these are not required to be submitted to the CA these need to be available during CA inspection.” – historically often covered by EPR/PPC for sites under this regime, but may not have been sufficient

8

CDOIF guidance purpose

“The purpose of this guidance is to provide a common methodology by which this risk assessment can be carried out. The methodology can be used by both duty holders and the Competent Authority when preparing or reviewing risk assessments.” – in theory, seems perfectly reasonable – use for both LT and UT sites

9

Is CDOIF really working?

• How does it work• How is it different to what happened

earlier• Is it fit for purpose on both Upper and

Lower Tier sites• Where can it break down• What are the alternatives

10

ERA before CDOIF

• HAZID provides initiating incidents• Detailed environmental description and

SPR analysis to identify potential MATTEs • Consequence modelling – compare to

DETR guidelines to see if MATTE • Some frequency assessment, individual

risk criteria used by sites/ consultants• Recommendations (mainly infrastructure

improvements or procedures)

11

ERA problems pre-CDOIF (our experiences quoting for, and writing, reports)

1) Insufficient SPR analysis – missing out obvious pollutant linkages

2) Not taking pollution far enough from site either down-wind or downstream

3) Not taking worst-case quantities because “it can’t happen here”, consequently not modelling very large spills e.g. overland flow

4) People sticking in conceptual “comfort zone” – flammable risks on flammable sites, physical hazards at formulators, reaction hazards at chemical manufacturers

5) Different sites/ consultants using different risk matrices – inconsistency

6) No clear guidance for Lower Tier sites on ERA

12

ERA under CDOIF (1)

• HAZID provides initiating incidents• Detailed environmental description and

SPR analysis to identify potential MATTEs • Much more detailed consequence

modelling – compare to DETR guidelines and to CDOIF guidelines to see if MATTE, and what severity of MATTE (length/ area affected)

• New duration criteria (how long affected) – knowledge of ecosystem effects required

13

ERA under CDOIF (2)

• Full frequency assessment of all MATTE-initiating incidents

• Full frequency assessment of all MATTE outcomes (sub-set of initiating incidents)

• Frequencies combined together per receptor and MATTE level (not required for HHRA)

• Comparison of overall frequencies with CDOIF tolerability guidelines

14

ERA under CDOIF (3)

• Comparison needs to be carried out TWICE – once with “no mitigation”, and once with “current mitigation”

• Then, if frequencies on “current mitigation” are intolerable or TiF ALARP:– Describe improvements– Estimate changed frequency of incident and/or

outcome– Run the frequency assessment AGAIN to show

how tolerability is improved (3 times in total!)

15

Standardised ERA risk tolerability criteria (new)

• Analogous to human health risk assessment

• More detailed, as based on new MATTE levels A to D

• Also requires all MATTEs to be considered to an individual receptor (unlike human health risk assessment)

16

MATTE matrix (new)

  

Severity of Harm

 4 catastrophic

 

Sub-MATTE duration

 C

 D

 D

 3 major  

B C

 D

 2 severe

 A

 B

 C

 1 significant

 

Sub-MATTE Harm

  

1 short term

 2

medium term

 3

long term

 4

very long term

 Harm Duration Category

17

Severity criteria example (in CDOIF, taken from DETR)

    

ReceptorType

 

Severity of Harm

 Significant

 While this level of harm might be significant pollution, it is not considered a MATTE.

 Severe

 DETR Criteria - the lowest level of harm that might be considered MATTE.

 Major

 Catastrophic

Severity Level → 1 2 3 4

     Soil or sediment (i.e. as receptor rather than purely a pathway)

    Contamination not leading to environmentaldamage (as per ELD), or not significantly affecting overlyingwater quality.

  Contamination of 10-100ha of land etc. as per WidespreadHabitat; Contaminationsufficient to be deemed environmentaldamage (Environmental Liability Directive)

 Contamination of100-1000ha of land, as per Widespread Habitat; Contamination rendering the soil immediately hazardous to humans (e.g. skin contact) orthe living environment, but remediationavailable.

 Contamination of>1000ha of land, as per Widespread Habitat; Contamination rendering the soil immediately hazardous to humans (e.g. skin contact) orthe living environment and remediationdifficult or impossible.

18

Duration criteria (new in CDOIF, not in DETR)

19

Straightforward duration criteria:

• built environment – essentially whether repairable or not, and in specific timescales

• groundwater (note - process water abstraction is non-MATTE unless going into food processes or other human consumption)

20

Trickier duration criteria:

• Land• Surface water

CDOIF - “These criteria are based on estimating the likely time for the habitat (or species, etc.) has substantially recovered (unaided) from the damage caused. Complete recovery is difficult to judge for the environment, and hence it is suggested that this should be clarified as >80% of the damage.” Ecological knowledge is expected/ essential - NEW

21

MATTE matrix – 4 MATTEs  

Severity of Harm

 4 catastrophic

 

Sub-MATTE duration

 C

 D

 D

 3 major  

B C

 D

 2 severe

 A

 B

 C

 1 significant

 

Sub-MATTE Harm

  

1 short term

 2

medium term

 3

long term

 4

very long term

 Harm Duration Category• A – lowest level MATTE

• B – second level MATTE• C – third level MATTE• D – worst level MATTE

22

Summation of MATTE frequencies

Prob. of D MATTEs = D MATTE prob. only

Prob. of C MATTEs = C MATTE prob. + D MATTE prob.

Prob. of B MATTEs = B MATTE prob. + C MATTE prob. + D MATTE prob.

 Prob. of A MATTEs = A MATTE prob. + B MATTE prob. + C MATTE prob. + D MATTE prob.

23

MATTE tolerability levels per receptor per annum

MATTE level Intolerable Tolerable if ALARP (Tif ALARP)

Broadly Acceptable

A > 1.0 E-02 From 1.0 E-04 to 1.0 E-02 < 1.0 E-04

B > 1.0 E-03 From 1.0 E-05 to 1.0 E-03 < 1.0 E-05

C > 1.0 E-04 From 1.0 E-06 to 1.0 E-04 < 1.0 E-06

D > 1.0 E-05 From 1.0 E-07 to 1.0 E-05 < 1.0 E-07

One of my consultant friends considers environmental tolerability frequencies to be 10 x more stringent than Human Health – optimist!

24

What do frequencies per annum relate to?

• All initiating incident frequencies which can cause a MATTE

• Excluding those incidents where a MATTE could not develop

• For example – a tank failure could cause a MATTE; but if the bund holds, it won’t. So the overall probability of tank failure needs to be reduced to take into account

25

How do you find the frequency of outcome?

• Start with HAZID – identify MAs• Bow Tie Diagrams are essential

Fault tree

Event treeIncident

26

Sources of information, incident frequency

• Site information, e.g. maintenance and accident/ incident records

• Published industry data, including:– Failure Rate and Event Data for use within Risk

Assessments (28/06/2012) HSE http://www.hse.gov.uk/landuseplanning/failure-rates.pdf

– For flammables, OGP documents – ignition probabilities http://www.ogp.org.uk/pubs/434-06.pdf ; incident frequencies http://www.ogp.org.uk/pubs/434-03.pdf

– Books – Lees’ Loss Prevention in the Process Industries, 2012

27

Beware - multiple frequency of outcome in the environment

• Jetting loss from tank – 3 outcomes

River

Open land

Bund

How do you assign the probability of outcome from a single incident?Open land incident is to aquifer and then river, “potential for double counting”

28

ERA under CDOIF (1)

• Is more consistent in terms of tolerability of risk

• Is still dependent on valid SPR modelling

• Requires a lot more work on consequence modelling, to assess severity of MATTEs

• Requires new work on consequence timescales for duration of MATTEs

29

ERA under CDOIF (2)

• Requires a lot more work on incident frequency and frequency of outcome

• Then requires extra work to summarise and calculate overall frequencies by receptor

• Has a more precise outcome of tolerability

• But is not necessarily more accurate

30

Benefits of CDOIF

• If it works– Identifies worst case environmental

impacts and their frequencies– Identifies initiating incidents for those

impacts– Ensures improvements are targeting the

worst/ most likely risks – Can move away from purely

infrastructure risks (traditional ERA) into other prevention

31

Will CDOIF method always get reliable results?

• CDOIF only “works” where you have “complete knowledge”

• Known unknowns can drive a horse and cart through the frequencies

• Unknown unknowns will make it completely useless

• Unfortunately, environmental work is often more about unknowns than knowns

32

Some known unknowns

Drains

Biodegradation in soil, aquifer, surface waters

Chemical reactions in environment

Consequences from modelling

33

Drainage systems

• Drainage systems on site: effluent; foul sewer; surface water; historic/ disused/ forgotten about

• Do you know where your drains run to? Do you know how many different drain systems you have on site?

• Are they in good condition? Would they leak out contamination? Could contamination leak into them, or travel round the outside, or in the permeable fill?

34

Forgotten re-routed drainage system traps NaOH spill

Gravel overlying old drain acting as sink for caustic from bund leak, travelling along outside of drain

35

Chemical reactions in the environment

• Is there any historic contamination on/ under your site?

• Would it react with materials you could spill and end up in open land?

• Would any degraded materials react with the contamination?

• Do you know what the reactions might be? What quantity of new material could be made? How that would travel in the groundwater?

36

What happens to degradable substances

• Aerobic degradation?• Anaerobic degradation?• Is it continuous or stop-start?• Formation of gases (Asphyxiant?

Flammable? Toxic? Odourous?)• Formation of liquids (Water soluble?

Insoluble? Able to further degrade? Stop degradation proceeding?)

• Formation of solids (precipitated?)

37

Very simplified anaerobic ethanol degradation pathways

38

Biodegradation also happens in slow moving surface waters

• May 2000 - Wild Turkey Distillery fire, 200,000 US gall (757 m3) maturing spirit released to Kentucky River

• Wiped out all life in the Kentucky River from around 10 miles downstream of spill

• Dead zone 5 – 6 miles long travelled at around 5 miles per hour – unaffected by passing through weirs

• Only stopped from affecting Ohio River through oxygenation barges

• This is fresh water, we don’t know effects in salt water

39

A spill of ethanol to open land may have different outcomes:

• Either causes no harm at all and is dispersed naturally, and does not even get into nearby river

• Or causes an explosion risk in low lying buildings• And/or creates new hazardous substances in

groundwater• And/or solubilises or reacts with historic

contamination• And/or creates an aquatic toxicity incident in the

river (and downstream waters) lasting decades• And/or creates a deoxygenation incident in the

river lasting a short time or decades

40

So – do you feel like you understand degradation in soil and groundwater?• Do you feel confident to put frequencies on the

outcomes?• Do you feel confident to make investment

decisions on the basis of your risk modelling?• Would you be happy to balance safety and

environmental risks properly? (e.g. jetting risks vs risks of vapour cloud confinement)

“D’ya feel lucky, punk?”

I’m a trained soil scientist, and frankly I don’t have a clue

41

Consequence modelling

• R&D P95 for groundwater (free model from EA)– Steady state – amount in is the same– End point is aquifer contamination, deep

aquifer/ regional scale– Not so good for shallow aquifer release to

nearby watercourse (most of our sites are old mills next to water…)

– Contains method for biodegradation (guesstimate)

– Needs specific parameters to be inputted in sequence for unsteady-state conditions (i.e. a spill)

42

Surface water consequence modelling

• River Mass Flow Model from EA – Only works with small streams/ rivers

where complete dilution/ dispersion can be assumed

– Not appropriate for fuels, LNAPLs, DNAPLs

– Not appropriate for estuary environment (either channel or wider “classic” estuary environment)

43

Visual Plumes model from US EPA

• Only one sub-model valid for release via surface channel (e.g from river), others are all for diffusers at depth and will overestimate dilution significantly (PDS model)

• Visual Plumes requires MS XP• PSW model runs in an old variant of

Fortran – requires Windows NT (our IT guys threw in the towel at that point)

44

So we end up making models in Excel from 1st principles

• Are these accurate?• They are worst-case• However, inputs are often calculated

from previous models (could only be measured during an incident)

• Capacity for error is large• Note – even commercial models are

not always very accurate

45

Unknown unknowns - Buncefield Aquifer

“Cherry Tree Lane has a number of road drains connected to deep chambers, one of which contains a borehole at least 40 metres deep that penetrates the chalk aquifer. The on-site drains and road drains provided pathways for fuel and contaminated firewater to pollute the groundwater.” Bunding at Buncefield, Successes, Failures and Lessons Learned, ICHEME Hazards XX, 2008 https://www.icheme.org/communities/subject_groups/safety%20and%20loss%20prevention/resources/hazards%20archive/~/media/Documents/Subject%20Groups/Safety_Loss_Prevention/Hazards%20Archive/XX/XX-Paper-11.pdf

46

How was this borehole unknown?

• Off site – not their responsibility• Not on BGS borehole register, and

uncapped – no seal or top.• Is it within the remit of a site to work

out where their overland flow could go to and ask permission to look down/ CCTV other peoples drains? (and would a CCTV survey have found it anyway?)

47

2 CDOIF COMAH ERAs for Lower Tier sites later (whisky!)

• We have become experts in:– Ethanol biodegradation in soil– Ethanol biodegradation in surface waters (we

still don’t know about salt water effects)– Re-using existing models to suit, writing new

ones (not reverse engineering, that’s illegal!)• Is it sensible to have a standard method

which, done thoroughly, takes the authors to the edge of current knowledge (and beyond)?

48

Why have we got into this state?

• The CDOIF document is a classic example of good old-fashioned British “gold-plating”

• Not inflicted by legislation or bureaucrats, but mainly inflicted by industry and HSE on industry

• By BIG industry on everybody else …. but they can afford to do it….

49

There is NO requirement from EU:

• To have sub-sets of different MATTE types• To use such detailed frequencies as part of

an ERA• To do anything like the CDOIF method• So why are we spending so much time and

effort on report writing when we could be upgrading our infrastructure, or putting in fire prevention, or better lightning protection, or other things which will actually mitigate incidents?

50

CDOIF seems to have been written from this perspective:

• “We know everything about a site’s environment”

• “We know everything which can happen to a hazardous substance within the soil, groundwater and surface water”

• “We can put realistic frequencies on the probabilities of various incidents happening”

51

This works for releases of energy, or to atmosphere:

• Explosions• Fires• Toxic release of gas

• But CDOIF assumes that we know far more about the natural world than we actually do!

52

Is CDOIF fit for purpose?

• In certain Upper Tier circumstances, ye-e-es: simple sites, well characterised, simple receiving environments, no or little degradation (e.g. oil and gas sites)

• For more typical chemical or process Upper Tier sites, barely fit to unfit

• For Lower Tier sites, unfit

53

All these problems add up to one thing:

• Too much effort and investment is being spent on the ERA

• When it should be being spent where it actually counts, which is on the improvements to the plant, processes, people, and protecting people and the environment to the best of our understanding and abilities.

54

Does CDOIF help with the main COMAH ERA problems?

1) Insufficient SPR analysis - no2) Not taking pollution far enough from site either down-wind

or downstream - no3) Not taking worst-case quantities because “it can’t happen

here” - no4) People sticking in conceptual “comfort zone” – flammable

risks on flammable sites, physical hazards at formulators, reaction hazards at chemical manufacturers - no

5) Different sites/ consultants using different risk matrices – inconsistency – yes

6) Lack of guidance for Lower Tier sites - yes

55

So CDOIF:

• Only works in a few cases• Only solves two out of what we

consider to be the six main problems with COMAH ERA (the ones which most affect regulators, funnily enough)

• Adds to workload and expense considerably without improving technical quality

56

The COMAH ERA method:

• Needs to be simplified – too many calculations, too much error

• Needs to include uncertainty in a sensible way

• Needs to help people with basic conceptualisation of site and potential risks – this will improve ERA quality more than anything

57

SPR method for COMAH

• Does not rely on frequencies of incident• Less open to “gaming”• Relies more on practical skills -

infrastructure inspection and investment• May not always pick up on larger initiating

incidents properly, and still requires good SPR, but can be improved with better guidance and support

• Can also be improved for overall consistency of approach

58

To everyone involved in writing or understanding a CDOIF COMAH ERA (whether site staff,

managers, consultants or even regulators):

GOOD LUCKYou’ll need it!

59

Thank you very much

• Any questions?• We have a copy of DETR 1999 if anyone needs it,

email me on janet@ttenvironmental.co.uk• Presentation available at

www.ttenvironmental.co.uk/downloads• Contact tel 01422 24 22 22

Linkedin: https://uk.linkedin.com/pub/janet-greenwood/7/166/700 Twitter: www.twitter.com/ttenvironmentalFacebook: www.facebook.com/ttenvironmental