remotely operated shutoff valves (rosovs)
Post on 12-Feb-2017
251 Views
Preview:
TRANSCRIPT
Page1of47
Health and Safety Executive
Remotely operated shutoff valves (ROSOVs)foremergencyisolationofhazardoussubstances
This is a free-to-download, web-friendly version of HSG244 (First edition, published 2004). This version has been adapted for online use from HSE’s current printed version.
Youcanbuythebookatwww.hsebooks.co.ukandmostgoodbookshops.
ISBN 978 0 7176 2803 2 Price £15.00
Theguidanceisaimedatoperatorsandmanagersofinstallationswhichhandle,storeorprocesshazardoussubstances,aswellasplantsupervisors,design,processandmaintenanceengineersandsafetyprofessionals.ItwillhelpyoutomakeariskassessmentonwhetheryouneedaROSOVanddetailsthestepsforimplementation.Theguidancewillalsoensureyoucomplywiththerelevanthealthandsafetylaw.
HSE Books
Page2of47
Health and Safety Executive
© Crown copyright 2004
Firstpublished2004
ISBN9780717628032
Allrightsreserved.Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmittedinanyformorbyanymeans(electronic,mechanical,photocopying,recordingorotherwise)withoutthepriorwrittenpermissionofthecopyrightowner.
Applicationsforreproductionshouldbemadeinwritingto:TheOfficeofPublicSectorInformation,InformationPolicyTeam,Kew,Richmond,SurreyTW94DUore-mail:licensing@opsi.gov.uk
ThisguidanceisissuedbytheHealthandSafetyExecutive.Followingtheguidanceisnotcompulsoryandyouarefreetotakeotheraction.Butifyoudofollowtheguidanceyouwillnormallybedoingenoughtocomplywiththelaw.Healthandsafetyinspectorsseektosecurecompliancewiththelawandmayrefertothisguidanceasillustratinggoodpractice.
Remotelyoperatedshutoffvalves(ROSOVs) Page3of47
Health and Safety Executive
ContentsIntroduction 4Whatisaremotelyoperatedshutoffvalve? 4Whoisthisguidancefor? 4Whyisthereaneedforguidance? 4 LessonsfromtheAssociatedOctelfire 5HSEresponse 5HowHSEusesgoodpracticeinassessingcompliance 5Howtousethisguidance 7Meetingthestandard 8ALARPdemonstration 8
Scope of the guidance 10Hazardoussubstancesincluded 10Activitiesincluded 11Topicsexcluded 11
Assessing your site 12Hierarchyofmeasures 12Newinstallations 12Existinginstallations 12Reasonablepracticability 13Precautionaryapproach 13WhentoconsiderfittingaROSOV 13BenefitsofROSOVs 14Personalprotectiveequipment 14Bunding 15Dualhazardsubstancesandmixtures 16
The selection criteria 17Howdotheselectioncriteriawork? 17Theprimaryselectioncriteria 18Thesecondaryselectioncriteria 18
Selection and operation of ROSOVs 19Activation 19Typesofvalves 19Actuators 19Failuremode 20Externalhazards 20Consequentialhazards 20Dualfunctionvalves 21Excessflowvalves 21Reliabilityandintegrity 22
Appendix 1 A case-specific assessment of the reasonable practicability of a ROSOV 23
Appendix 2 Summary of relevant legal requirements 44
References and useful addresses 45
Further information 47
Remotelyoperatedshutoffvalves(ROSOVs) Page4of47
Health and Safety Executive
IntroductionWhat is a remotely operated shutoff valve?
1 Inthisguidancearemotelyoperatedshutoffvalve(ROSOV)isdefinedas:
n Avalvedesigned,installedandmaintainedfortheprimarypurposeofachievingrapidisolationofplantitemscontaininghazardoussubstancesintheeventofafailureoftheprimarycontainmentsystem(including,butnotlimitedto,leaksfrompipework,flanges,andpumpseals).Closureofthevalvecanbeinitiatedfromapointremotefromthevalveitself.Thevalveshouldbecapableofclosingandmaintainingtightshutoffunderforeseeableconditionsfollowingsuchafailure(whichmayincludefire).
2 Valvesperformingthesameorsimilarfunctionmayalsobereferredtoas:emergencyisolationvalves(EIVs);remotely-operatedblockvalves(RBVs);oremergencyshutdownvalves(ESDVs).
3 ThisguidancewillhelpyouidentifytheneedforremoteisolationofhazardoussubstancesusingROSOVs,aspartofyouremergencyarrangementsforthesafeandcontrolledshutdownofplantandequipment.
Who is this guidance for?
4 ThisguidanceisissuedbytheHealthandSafetyExecutive(HSE)toassistdutyholdersincomplyingwithrelevanthealthandsafetylaw.Followingtheguidanceisnotcompulsoryandyouarefreetotakeotherequally effective action.
5 Theguidanceisforoperatorsandmanagersofhazardousinstallationshandling,storingorprocessingthehazardoussubstancesdetailedinthescope.Itwillalsobeofinteresttoplantsupervisors,design,process,andmaintenanceengineersandsafetyprofessionals.
6 ThroughoutthisguidancereferencestotheimplementationofaROSOVshouldbetakentomeanaROSOVorotherequallyeffectivemeasuresthatwillachieveanequivalentdegreeofriskreduction.AllpublishedmaterialislistedintheReferencesandusefuladdressessectionandtitlesappearinitalics.
Why is there a need for guidance?
7 Inanemergency,rapidisolationofvesselsorprocessplantisoneofthemosteffectivemeansofpreventinglossofcontainment,orlimitingitssize.
8 Thisguidegivesyousimplifiedcriteriafordecidingwhenyouneedtoprovideafacilityforremoteisolation.
9 Theappendicesincludeguidanceonhowtomakeacase-specificassessmentofthereasonablepracticabilityofretrofittingaROSOVtoanexistinginstallation.
10 TheprovisionofROSOVswashighlightedbytheHSEinvestigationintoanincidentattheAssociatedOctelCompanyLimitedatEllesmerePort
Remotelyoperatedshutoffvalves(ROSOVs) Page5of47
Health and Safety Executive
inFebruary1994.ThefindingsoftheinvestigationintothisincidentwerepublishedbyHSEin1996:The chemical release and fire at the Associated Octel Company Limited.1
11 AnotherincidentthathascontributedtothedriveforguidanceonROSOVswasthefireonthefluidisedbedcatalyticcrackingunitattheBPGrangemouthRefineryinJune2000.AreportontheincidentisavailableontheHSEwebsiteonwww.hse.gov.uk/comah/bpgrange/contents.htm
Lessons from the Associated Octel fire
12 OneoftheconclusionsoftheAssociatedOctelreportwasthattheincidentescalatedrapidlybecauseitwasnotpossibletostoptheinitialrelease.ThisproblemcouldhavebeenavoidedifROSOVshadbeeninstalled(astheywereelsewhereonthesite).Thereportdescribedanumberoflessonstobelearnedfromtheincidentincludingthefollowing,whichrelatedirectlytotheprovisionofROSOVs:
‘Lesson 5:Aspartoftheircomprehensiveriskassessments,companiesincontrolofchemicalprocessplantatmajorhazardssitesshouldcriticallyreviewtheprovisionofROSOVsatbothstorageandprocessvesselsinwhichsignificantinventoriesofdangeroussubstancesareheld.
Lesson 6:HSE,inconjunctionwithotherinterestedparties,shoulddevelopandpublishadditionalguidanceontheprovisionofROSOVsandothermethodsofmitigatingrisksonprocessplant.’
HSE response
13 InresponsetoLesson6,interimguidanceonthegeneralprinciplesofisolationofhazardoussubstanceswaspublishedbyHSE:ChemicalsInformationSheetNo2Emergency isolation of process plant in the chemical industry.2
How HSE uses good practice in assessing compliance
14 Thelawrequiresthatyouundertakeasuitableandsufficientriskassessmenttodeterminethemeasuresnecessarytoensurethatriskstohealthandsafetyareadequatelycontrolled.
15 HSEexpectssuitablecontrolstobeinplacetoaddresseverysignificanthazardandthatasaminimumthosecontrolsmustachievethestandardofrecognisedgoodpracticeprecautionsforyourindustry.
16 HSEinspectorsseektosecurecompliancewiththelawandmayrefertorelevantcodes,standardsandguidanceasillustratinggoodpractice.
17 HSE’spublicationReducing risks, protecting people(R2P2)3andthesupportingdocumentAssessing compliance with the law in individual cases and the use of good practice4discussHSE’spolicyontheroleofgoodpractice.Thelatterincludesadefinitionofgoodpracticeinthiscontext.BothareavailableontheHSEwebsiteatwww.hse.gov.uk
18 Adoptingrelevantgoodpracticeprecautionsforyourindustryisastraightforwardwaytodemonstratethatyouarecontrollingriskseffectively.It
Remotelyoperatedshutoffvalves(ROSOVs) Page6of47
Health and Safety Executive
freesyoufromtheneedtotakeexplicitaccountofthecostsandbenefitsofeachindividualriskcontrolmeasure(systemofwork,itemofhardwareetc).Thesewillhavebeenconsideredwhenthegoodpracticewasestablished.However,thisdoesnotmeanthatyouwillneverneedtodoanymoretosatisfythelaw.Youstillhaveadutytoconsiderifthereisanythingaboutyourcircumstancesthatmeansfurtheractionisnecessary.
19 HSEconsidersthatthisguidancerepresentsgoodpracticeforemergencyisolationwithinthelimitationsofthescope.However,theguidanceisundercontinuousreviewandadvancesintechnologyornewknowledgeofhazardsmayleadHSEinspectorstoseekahigherstandardinsomecases–thestandardsethereshould,therefore,beregardedastheminimum.
Remotelyoperatedshutoffvalves(ROSOVs) Page7of47
Health and Safety Executive
How to use this guidance
20 TheflowchartinFigure1summariseshowtoapplythisguidancetoidentifywhereROSOVsshouldbeprovided.
Figure 1HowtoapplyROSOVs
Remotelyoperatedshutoffvalves(ROSOVs) Page8of47
Health and Safety Executive
Meeting the standard
21 Youshouldcomparetheprovisionforemergencyisolationonyoursiteagainsttheselectioncriteriaandidentifyanyareaswheretheprecautionsinplacedonotmeetthestandarddescribedinthisguidance.
22 Unlesstheselectioncriteriaindicateotherwise,ROSOVsshouldbeincorporatedintothedesignofanewinstallation.
23 InthecaseofanexistinginstallationROSOVsshouldbeprovidedunlessyoucandemonstratethatretrofittingisnot‘reasonablypracticable’inthecircumstances(seeAppendix1).
24 Aphased,prioritisedprogrammeofupgradingmaybeappropriate.IfnecessaryyoucandiscusswiththeHSEproposedworkarisingfromyourassessments.Whereyouconsiderthatyouhaveidentifiedalternativebutequally(ormore)effectivemeanstocontroltheriskyoushoulddocumenttheseconclusionsaspartoftherecordofyourstatutoryriskassessment.
25 Thisriskassessmentneedstobekeptunderreview.Changesinunderstandingoftherisk,orreductionsinthecostsofimplementingthemeasure,mayshiftthebalanceofthecost/benefitequation.
26 Followingthisgoodpracticeguidancedoesnotmeanyouwillneedadditionaldocumenteddemonstrationsofsafety.IfyouuseotherequallyeffectivemeasuresinsteadofaROSOV,thereisnoneedtoperformaseparateassessment.Yourdemonstrationthatthemeasuresactuallyinplacemakerisksaslowasreasonablypracticable(ALARP)isallthatisneeded.
27 IfyoucannotdemonstratethatyouhaveotherequallyeffectivemeasuresonsiteandyoudonothaveaROSOVwhereoneisindicatedbythisguidancethenyoushouldbeabletoshowthatfittingaROSOVisnotreasonablypracticable.
28 Appendix1ofthisguidancegivesadditionaladviceondemonstratingreasonablepracticability.Appendix2summarisessomeoftherelevantlegalrequirementsrelatingtotherecordingofriskassessmentfindingsingeneralandthemoredetailedrequirementsimposedonsomedutyholdersundertheControl of Major Accident Hazards Regulations 1999(COMAH).5
29 Ifadetailedriskassessmentshowsthatupgradingisnotreasonablypracticablethenthebasisforthisconclusionshouldbedocumentedaspartofyourassessmentrecord.
ALARP demonstration
30 Thisguidanceislimitedtoaconsiderationofasingleriskreductionmeasure–theprovisionforemergencyisolation.ThismaybeonlyoneofanumberofmeasuresnecessarytomaketheriskfromaparticularhazardALARP.
31 Whereitcanbeshownthatconformancewithgoodpracticeresultsinrisksbeingreducedtothe‘broadlyacceptable’level(seeR2P2)3thenthiswillnormallybeacceptedasdemonstratingcompliancewiththelaw.
32 Wheretheresidualriskremainshigher,inthe‘ALARPregion’(R2P2)3thenyoushouldcontinuetoseekfurtherreasonablypracticableriskreduction
Remotelyoperatedshutoffvalves(ROSOVs) Page9of47
Health and Safety Executive
measuresand,whereapplicable,toincludetheseaspartofyourALARPdemonstration.
33 Goodpracticethatcoversalltherisksfromyourworkactivitymaynotbeavailable,soifyouarerequiredtomakeanexplicitALARPdemonstration,amorerigorousanalysismaybeneededtodemonstratethatallmeasuresnecessaryhavebeenimplemented.
Remotelyoperatedshutoffvalves(ROSOVs) Page10of47
Health and Safety Executive
Scope of the guidanceHazardous substances included
34 Thisguidanceislimitedtooperationsinvolvingthestorage,transfer,orprocessingofsubstancesthatare:
n classifiedundertheChemicals (Hazard Information and Packaging for
Supply) Regulations 2002(CHIP)6asflammable,highlyflammable,extremelyflammable,toxicorverytoxic;and
n liquidsorgasesundertheconditionsofstorageand/orprocessing.
35 ThegeneraladviceonwhatyoushouldconsiderwhendecidingwhetherornottoprovideaROSOVmayalsobeusefulinthecontextofotherhazardoussubstances.However,theseothersubstanceswerenotconsideredinsettingthedecisioncriteriaandsothespecificresultmightnotbeappropriateineverycase.
36 WhendecidingifyouneedtoprovideROSOVsforsubstancesnotincludedinthescopeofthisguidance,youshouldeither:
n refertoothergoodpracticeguidancewrittenforthatsubstanceorcategory
ofsubstances;orn undertakeyourowncase-specificriskassessment.
37 Appendix1isausefulguideformakingacase-specificriskassessment.However,youwillneedtoconsiderexplicitlythehazardousproperties(physical,chemicalandtoxicological)ofthesubstancesyouuseiftheriskassessmentistobesuitableandsufficient.
38 SomehigherflashpointsubstancesnotclassifiedunderCHIPasflammablearestoredorprocessedattemperaturesabovetheirflashpoint,orunderelevatedpressures.Thesemaybecapableofformingaflammableatmospherefollowinglossofcontainment.Thisguidancewillalsobeusefulindecidingwhetherornottoprovideforremoteisolationofsubstancesinthiscategorywheremorespecificguidancedoesnotcurrentlyexist.
39 SomesubstanceswillnotbeincludedinthecurrentCHIPApproved supply list,7whichlistsdangerouschemicalsalongwiththeirEC-agreedclassifications.Thismayincludeintermediatesthatarenot‘supplied’and,therefore,wouldnotbesubjecttoCHIP.Toapplythisguidanceyouwillneedtoself-classifythesubstanceaccordingtothemethoddescribedintheCHIPApproved classification and labelling guide6asifitwereintendedforsupply.
40 Somesubstancesmayhavedualclassification.Forsubstanceswithbothflammableandtoxicpropertieseachhazardshouldbeassessedseparately.Ifdifferentstandardsareindicatedthenthehigherstandardshouldbeadopted.
41 ThisguidancemayleadyoutoconcludethataROSOVisnotareasonablypracticablemeasureforthecontrolofriskstohealthandsafety.However,theEnvironmentAgency(EA)ortheScottishEnvironmentProtectionAgency(SEPA)maystillrequireyoutoprovideforremoteisolationofdangeroussubstancestoprotecttheenvironment.FordetailsofhowtocontacttheEAandSEPAseeReferencesandusefuladdressessection.
Remotelyoperatedshutoffvalves(ROSOVs) Page11of47
Health and Safety Executive
Activities included
Onshore installations42 Thisguidanceisapplicableatonshoreinstallationsincludingchemical
manufacturingsites,petrochemicalfacilitiesandsitesengagedinthestorageanddistribution(excludinglongdistancepipelines)ofhazardoussubstances.
43 Theguidancemaybeappliedatallonshorefacilitieswherestorage,transferorprocessingofthespecifiedcategoriesofsubstancestakesplace,irrespectiveofwhetherthesiteissubjecttotherequirementsofCOMAH.
Petroleum dispensing44 Petroleumretailissubjecttoalicensingregimeandisoutsideofthescopeof
thisguidance.Theprovisionoftechnicalmeasuresincludingmeansofsafeisolationinanemergencyiscoveredbyspecificguidanceand,whereappropriate,bylicenceconditions.
45 However,thisguidanceisapplicablewherethenon-retaildispensingoffuelintovehiclestakesplace,egduringvehiclemanufacture.
Offshore installations and transmission pipelines (on or offshore)46 Thisguidancewasproducedspecificallyforusebytheonshoresector.Offshore
installations,andpipelinescoveredbythePipelines Safety Regulations 1996,8aresubjecttospecificlegislationthatincludesexplicitrequirementsforremoteoperationofplant,includingemergencyshutdownvalves.Forexample,theOffshore Installations(Prevention of Fire and Explosion, and Emergency Response) Regulations 1995(regulation12)9andthePipelines Safety Regulations 1996(regulation19).8
Topics excluded
47 Thisguidancedoesnotgivedetailedadviceonmeasuresforprocesscontrolorpressurereliefarrangements(includingreactordepressurisationandthe‘dumping’or‘quenching’ofrunawayreactions)andthefollowingissuesareexcluded.
Specification of valves48 Adviceonsuitabilityofvalvestoperformaparticularduty,includingappropriate
materialsofconstruction,shouldbesoughtfromyoursupplierormanufacturer.
Maintenance49 Itisfrequentlynecessarytoisolateplantcontaininghazardoussubstancesto
allowformaintenance.Therequirementsforsafeisolationforthesepurposesarenotcoveredhere.AdviceonthistopicmaybefoundinHSE’sThe safe isolation of plant and equipment.10
Detection systems50 Thisguidancedoesnotconsiderinanydetailthedetectionsystemsthatarea
necessarycomponentofasystemforautomaticactivationofROSOVs(automaticshutoffvalves,ASOVs).
Control of exothermic reactions51 Thereisaroleforremotelyoperatedvalvesinthecontrolandemergency
shutdownofexothermicreactionstoavoidrunaway.TheuseofROSOVsforthesepurposesisoutsideofthescopeofthisguidance,butadvicecanbefoundintheHSEpublicationDesigning and operating safe chemical reaction processes.11
Remotelyoperatedshutoffvalves(ROSOVs) Page12of47
Health and Safety Executive
Assessing your siteHierarchy of measures
52 Youshouldbeabletodemonstratethatyouhaveconsideredahierarchyofmeasures:
n Inherentlysaferoptions(suchassubstitutionofahazardoussubstance
byalesshazardousone,reducingthequantityofthesubstancestoredorprocessedetc).
n Optionsforpreventionandcontroloflossofcontainment(suchaspreventivemaintenance,inspection,testingetc).
n Mitigationmeasures(suchasROSOVsandbunding).
53 Forexistinginstallations,optionsforinherentlysaferprocesseswillbemorelimited.Youshouldstillgiveprioritytomeasuresthatpreventorlimitlossofthehazardoussubstancefromtheprimarycontainmentovermitigationmeasuressuchassecondarycontainment.
54 Theguidanceappliestobothnewandexistinginstallations.
New installations
55 Thedesignofanewinstallationshouldfullyconformtothegoodpracticesetoutinthisguidance.
Existing installations
56 Forexistinginstallationswherethecurrentprovisiondoesnotmeetthestandardsetoutinthisguidance,youshouldupgradetheinstallationsofarasisreasonablypracticable.Takeyourcurrentsituationasthestartingpoint,whenyouassesstherisktobereduced,forcomparisonwiththecostofachievingthatreduction.Youmaytakeaccountofanymeasuresthatarealreadyinplacewhenestablishingthepresentlevelofrisk(withoutaROSOV).However,themeasuresmustbeeffectiveagainstthesamecontainmentfailures,forexample:
n whereitemsofplantarebundedtheremaybelongrunsofinterconnectingpipeworkoutsidethebund;
n aROSOVclosetotheplantitemwillprovideprotectionwhereverapipeworkfailureoccursbutbundingwillonlymitigatereleasesthatoccurwithinthebundedarea.
57 Itisrecognisedthattheremaybeadditionalcostsassociatedwithretrofittingmeasurestoexistinginstallationsandthatitisappropriatetoconsidertheseextracostswhenreachingadecisiononreasonablepracticability.InR2P23Appendix3includesadiscussionoftherelevantcostandbenefitstobeconsidered.
58 Someoftheadditionalcostsassociatedwithretrofitting,suchasdowntimeandlossofproduction,canbeminimisedbyco-ordinatingtheretrofittingwithplannedmaintenance,refurbishmentorupgradingoftheinstallation.
Remotelyoperatedshutoffvalves(ROSOVs) Page13of47
Health and Safety Executive
Reasonable practicability
59 HSEconsidersthatdutiestoensurehealthandsafetysofarasisreasonablypracticable(SFAIRP)anddutiestoreducerisksaslowasisreasonablypracticable(ALARP)areequivalent.Eachcallsforthesamesetofteststobeapplied.
60 TherequirementunderCOMAHtotake‘allmeasuresnecessary’topreventmajoraccidentsandlimittheirconsequencesisinterpretedasmeaningthattherisksfrommajoraccidenthazardsshouldbereducedtoALARP.
61 Insomecircumstancestherisksfromaparticularhazardousactivitymaybesohighastobeunacceptableforallpracticalpurposes,whatevertheassociatedlevelofbenefits.Conversely,whenthelevelofriskisinherentlyveryloworhasbeenmadeverylowbytheapplicationofsuitablecontrols,thenformostpracticalpurposestheriskcanberegardedasinsignificant.HSEwouldnotnormallyseekfurtherriskreductionmeasures,astheresourcerequiredwouldbedisproportionatetotherisk.However,wherefurtherreasonablypracticableriskreductionmeasurescanbeidentifiedthenthelawrequiresthatthesebeimplemented.
62 Betweenthesetwoextremes,agivenlevelofriskfromahazardousactivitymaybejudgedtolerableforthebenefitsthattheactivitybrings,providedthattheriskismadeALARP.
63 Wheretherisksaretolerable, if ALARPyoushouldcompare:n thebenefitsarisingfromthereductioninriskachievedbyparticular
measures;andn thecostintime,moneyortroubleofimplementingthosemeasures.
64 Onlywherethereisa‘grossdisproportion’betweenthetwo,ietheriskreductionbeinginsignificantinrelationtothecost,canthemeasuresberuledoutasnotreasonablypracticable.
65 FurtherdiscussionofthetolerabilityofriskandtheprincipleofALARPcanbefoundintheHSEpublicationR2P2.3
Precautionary approach
66 WhenmakingdecisionsregardingtheprovisionofriskreductionmeasuresitisHSEpolicytoadoptmorecautiousestimates:
n wheneverthereisgoodreasontobelievethatseriousharmmightoccur,
evenifthelikelihoodisremote;orn whenuncertaintyregardingeithertheconsequencesorthelikelihood
underminesconfidenceintheconclusionsoftheriskassessment.
(Seriousharmisdefinedasdeathorseriouspersonalinjury,especiallywhenmultiplecasualtiesresultfromasingleevent.)
When to consider fitting a ROSOV
67 YoushouldassesstheneedtofitaROSOVwhereverthereisthepotentialforamajoraccidentasaresultoflossofcontainmentofahazardoussubstance,theconsequencesofwhichcouldbesignificantlyreducedbyrapidisolation.
Remotelyoperatedshutoffvalves(ROSOVs) Page14of47
Health and Safety Executive
68 Manualvalvesshouldneverbeusedinsituationswheretheemployeeeffectingtheisolationwouldbeplacedindanger.ThisisamajorconsiderationindecidingwhentouseROSOVs.Manualvalveisolationmaybeacceptableinsomecaseswhererapidisolationisnotrequiredtopreventamajoraccident.However,manualvalvesareoftenfittedmainlyformaintenanceworkandareunlikelytobethesafestormosteffectiveoptionforemergencyisolation.
69 Thepotentialforamajoraccidentwilldependonarangeoffactorsincluding:
n thenatureandpropertiesofthesubstance;n thequantityofsubstancereleased;n thesizeandnatureofpopulationsatriskandtheirproximitytotheplant;andn thepresenceofotherplantincludingconfiningstructuresandother
hazardousinventories(escalationpotential).
70 Ultimatelythedecisionwhetherornottoprovideremoteisolationisbasedonanassessmentof:
n thelikelihoodthatthemajoraccidentwilloccur;n theconsequences(intermsoftheextent and severityofharmtopeople).
71 Togetherthesefactorsrepresenttherisk.Thereductioninriskisthebenefitthatmustbebalancedagainstthecostofprovidingthefacility.
Benefits of ROSOVs
Toxic hazards72 FortoxichazardsROSOVscanhaveasignificantbenefitbyreducingtheextent
ofthehazardsothatfewerpeopleareexposed.However,sincetheROSOVmayfailondemand,theriskisreducedbutnoteliminated.
73 Also,peopleonsitemaybewithinthehazardrangeirrespectiveofwhetherthereleaseisterminatedrapidlybyaROSOVorismoreprolongedduetorelianceonmanualisolation.However,eveninthesecases,terminatingthereleasemorerapidlywillreducetheirexposure.
74 Providingaremote(orautomatic)activationfacilitywillavoidemployeeshavingtodeliberatelyenteratoxicatmospheretoeffectisolationmanually.
Flammable hazards75 Forflammablesubstances,employeesshouldnotberequiredtodeliberately
enteraflammableatmospheretoisolateplantmanually,especiallyaspersonalprotectiveequipment(PPE),isnotapracticablesolution.
76 Thepotentialforescalationismuchgreaterforflammablesubstances,particularlyincomplexplantwithsignificantareasofcongestionduetocloselyspacedplant,pipeworkandotherstructures.Whenignitionoccursinacongestedareathereisanincreasedriskofavapourcloudexplosion.Theoverpressurefromavapourcloudexplosionmaybecapableofcriticallydamagingotherplant,leadingtofurtherlossofcontainmentandpotentialcasualties.
Personal protective equipment
77 InaccordancewiththehierarchyofmeasuresdescribedintheControl of Substances Hazardous to HealthRegulations(COSHH),12provisionofpersonal
Remotelyoperatedshutoffvalves(ROSOVs) Page15of47
Health and Safety Executive
protectiveequipment(PPE)isnotconsideredanadequatealternativetoremoteisolationforanewinstallationforwhichfittingROSOVsisconsideredreasonablypracticable.
78 Forexistinginstallations,thepracticeofmanualisolationbyemployeeswearingPPEshouldonlybeadoptedifthecostofretrofittingROSOVsisgrosslydisproportionatetothereductioninrisk.
Bunding
79 Secondarycontainmentintheformofabundisameasuretomitigatetheconsequencesofaspillonceithasoccurred,andthereforecomeslowerinthehierarchyofcontrolsthanmeasuresthatlimitthelossofmaterialfromtheprimarycontainmentsystem.
80 AbundmayberequiredtocontainarangeofpotentialreleasesforwhichaROSOVwouldnotbecapable–including,forexample,overflowingofavesselandholesinthevesselitself.ROSOVsandsecondarycontainmentarenotmutuallyexclusiveandbothmayberequiredtoreducetherisksfromtherangeofpossiblehazardouseventstoALARP.
81 Foranewinstallation,priorityshouldbegiventoreasonablypracticablemeasurestopreventtheescapeofthehazardoussubstancefromtheprimarycontainmentsystem(vessel,pump,pipeworketc)overtheprovisionofsecondarycontainment.
82 Forexistinginstallationswheresecondarycontainmentisalreadyprovided,theconsequencesofareleasewithinthebundedareawillbemitigated.ThiscanbetakenintoaccountwhenmakingdecisionsaboutthereasonablepracticabilityofretrofittingaROSOV.
83 However,wherethepipeworkextendsbeyondthebundedarea,theprincipalbenefitsofferedbythebundwillbelostintheeventofafailureoutside.Thebundwallmaylimitencroachmentofthespillageonthevessel(s)withinthebund,buttheresultingpoolwillbepotentiallymuchlargerandmayspreadtoothervulnerablelocations.
84 Wherethehazardoussubstanceisunderpressure,egbeingpumped,thensomefailuresthattakeplacewithinthebundcouldresultinajetorsprayofthefluidbeingprojectedbeyondtheconfinesofthesecondarycontainment.Thisisparticularlytrueforsomepoorlydesignedorinadequatelymaintainedbunds.
85 Evenforreleasesintothebund,bundingdoesnothingtolimitthesizeofthereleasebutlimitsthesizeofthepoolandhencetheevaporationrate.Theevaporationratewillreachamaximumoncethequantityofmaterialreleasedissufficienttocovertheareaofthebund.Thisisirrespectiveofwhetherthereleaseisisolatedmanuallyorremotely.However,alongerreleasemeansmorematerialtransferredintothebund.Unlessstepsaretakentocontrolevaporationfromtheliquidinthebund,egbycoveringthesurfacewithaninertbarrier,theevaporationwillcontinueforalongerperiodwithpotentiallyadverseresults.Forexample,ifaflammablesubstanceisreleasedintothebundandignited,thelargerquantityoffuelislikelytoresultinamoreprolongedfire,increasingtheriskofescalation.
Remotelyoperatedshutoffvalves(ROSOVs) Page16of47
Health and Safety Executive
Dual hazard substances and mixtures
86 SomesubstancesmaybebothtoxicandflammableandwhiletheirCHIPclassificationusuallyreflectsthegreaterhazard,insomecircumstancesthesecondaryhazardmaydominate.Forsubstanceswithbothflammableandtoxicpropertiestheselectioncriteriashouldbeappliedforeachhazardseparatelyandifdifferentstandardsareindicatedthenthehigherstandardshouldbeadopted.
87 Inthecaseofsimplemixturesofsubstanceswithinthescopeofthisguidanceasimilarapproachmaybetaken,withthestandardadoptedbeingthehighestrequiredforeachofthecomponents.
88 Ifonecomponentisaminorconstituent,egasmallpercentageofatoxicsubstanceinaflammablesolvent,thenyoushouldrefertoSchedule3oftheCHIPRegulationsandtheApproved Classification and Labelling Guide6toarriveatanappropriatecategorisation.
89 Insomecasesthesubstancemayhaveasecondaryhazardcategorythatfallsoutsideofthescopeofthisguidance,egforoxidisersorsubstancesthatreactwithwater.Thesecondarypropertyshouldbeseparatelyassessed,byreferencetootherrelevantgoodpracticeorbymeansofacase-specificassessment,andagainthehigherstandardshouldbeadopted(seeAppendix1).
Remotelyoperatedshutoffvalves(ROSOVs) Page17of47
Health and Safety Executive
The selection criteriaHow do the selection criteria work?
90 TohelpyoudecidewhethertouseaROSOVinaparticularcase,anumberofselectioncriteriahavebeendevelopedbasedonjudgementsabouttheextentandseverityoftheconsequencesintheeventofamajoraccident.
91 Thecriteriaaredividedintotwogroupsofprimaryandsecondaryselectioncriteria.
92 Primaryselectioncriteriaservetoquicklyeliminatelow-riskcaseswherethehazardpotentialissufficientlylowthattheprovisionofremoteisolationisunlikelytobejustified.
93 Whereitcanbeshownthatalloftheprimaryselectioncriteriaaresatisfied,thenaROSOVwouldnotnormallyberequired.
94 WhenyouapplytheprimaryselectioncriteriaandtheydonoteliminatetheneedforaROSOV,youshouldchooseeithertoprovideaROSOVoralternativelytorefinetheassessmentbyapplyingthesecondarycriteria.
95 ThesecondaryselectioncriteriaidentifyaseriesofgenericcircumstancesinwhichthehazardsareconsideredtobesosignificantthatyoushouldnormallyfitROSOVswhenanyoneormoreofthesecriteriaapply.
96 Thissecondgroupofcriteriaaremoredetailedandrequireadeeperanalysisofthepotentialconsequencesofalossofcontainmentevent.IfyoucanshowthatnoneofthesecondaryselectioncriteriaareapplicablethenaROSOVisunlikelytobeareasonablypracticablemeasure.
97 IftheapplicationoftheselectioncriteriadoesnoteliminatetheneedforaROSOVthenprovisionofaROSOVisconsideredtobegoodpracticeforanewinstallation.
98 Foranexistinginstallation,aROSOVshouldnormallybefittedunlessasufficientlydetailedanalysisismadetoshowthatretrofittingisnotreasonablypracticableinthecircumstances.
99 Appendix1givesguidanceonthefactorsthatyouwillneedtoconsiderinacase-specificassessmentifitistobeacceptedasasuitableandsufficientdemonstration.
Event frequencies100 Thereisconsiderabledifficultyanduncertaintyassociatedwithdeterminingthe
frequencyoflossofcontainmentevents.Thisguidanceemployssimplifieddecisioncriteriainwhichgreateremphasisisplacedonthescaleofthepotentialreleaseandtheseverityofthepotentialconsequencesthanonthefrequency.Ifyouchoosetoemployfrequency-basedargumentsyoushouldbepreparedtoprovidearobustjustificationforthefrequenciesused.
Remotelyoperatedshutoffvalves(ROSOVs) Page18of47
Health and Safety Executive
The primary selection criteria
101 Thefollowingaretheprimaryselectioncriteria:
n Themaximumforeseeablereleaseofahazardoussubstanceintheeventoffailuretoisolatemanuallyislessthan1%ofthecontrolledquantity(Q)specifiedinSchedule1,Column2ofthePlanning(ControlofMajorAccidentHazards)Regulations1995forthepurposesofHazardousSubstancesConsentforthenamedsubstance(PartA),orcategoryofsubstance(PartB).
n Manualisolationwouldnotrequireemployeestoenteraflammableatmosphereandexposethemtoriskofseriouspersonalinjuryordeathduringtheattempt.
n Manualisolationwouldnotrequireemployeestoenteranareainwhichtheconcentrationofatoxicsubstanceexceedsalevelatwhichanormalhealthyindividualcouldescapeunaidedandwouldnotputthematriskofseriouspersonalinjuryordeathwhileattemptingtheisolation.
n Therateanddurationofthereleaseissuchthatnopotentialforseriousdanger(deathorseriousinjury–ieinjuryrequiringanovernightstayinhospital)canbeforeseen.
The secondary selection criteria
102 IfyoufindthattheprimaryselectioncriteriadonotruleouttheneedforaROSOVthenthefollowingsecondarycriteriashouldbeusedandaROSOVfittedwhenoneormoreofthesecriteriaapply:
n AROSOVisrequiredbyotherrelevantandauthoritativeguidanceongood
practice,egsubstanceorprocessspecificguidancesuchasSafety advice for bulk chlorine installations13ortheLiquefiedPetroleumGasesAssociationCodesofPractice.
n ThehazardoussubstanceispresentasagasliquefiedunderpressureandthecircumstancesunderwhichROSOVsshouldbefittedarenotalreadydealtwithinexistingsubstanceorprocessspecificandauthoritativeguidanceongoodpractice.
n Thevalveservestoisolateaflexibleloadingarm,hoseorsimilarvulnerableitemofplantwheretherearefrequentconnectionsanddisconnections.
n Thelocationofthepotentiallossofcontainmentisoutsideofanybundedareaorothersecondarycontainment.
n Failuretoisolateareleaseofaflammablesubstance,thedirectconsequencesofwhich(egthermalradiationoroverpressure)areconfinedtothesite,couldresultinescalationinvolvingareleaseofanotherhazardoussubstancewithoff-siteconsequences.
n Theextendedreleasedurationassociatedwithmanualisolation(likelytobeatleast20minutes)resultsinanincreasednumberofpredictedoff-sitefatalitieswhencomparedtothecasewithaROSOV.
Remotelyoperatedshutoffvalves(ROSOVs) Page19of47
Health and Safety Executive
Selection and operation of ROSOVsActivation
103 ROSOVscanbemanuallyactivatedthroughpushbuttonslocatedadistancefromthevalve.Automaticshutoffvalves(ASOVs)activatedbyadetectionsystem,egatoxicorflammablegasdetector,canprovideamoreimmediateresponse.
Manual activation104 Oneadvantageofmanualactivationisthatanintelligentassessmentofthemost
appropriatemeasurefordealingwithareleasecanbemade.Claimsaresometimesmadethatmanualactivationisnecessarytoavoidspurioustripsassociatedwithautomaticsystems;however,therootcauseisoftenabadlydesignedsystemratherthananyinherentweaknessinanautomatedresponse.
105 Manualactivationmustbejustifiableandthelocationofpushbuttonsmustnotendangertheemployee.Theyshouldbeaccessibleandinasafeandsuitableplaceinrelationtothehazardouseventthatmayoccur.Thereshouldnormallybeatleasttwoalternateactivationpoints,whichshouldbereadilyidentifiablebothontheplant(eglabelling)andinallrelevantoperatinginstructions.
ASOVs106 AdvantagesofASOVsincludemorerapidisolationandareductioninthe
frequencyofsomemodesofhumanerror.
107 Facilitiesformanualactivation,onemergencyescaperoutesforexample,shouldbeprovidedasabackuptoautomaticactivationandcanresultinamorerapidresponseinsomecircumstances.
Types of valves
108 Thedetailedselectionofaparticularvalve,includingmaterialsofconstruction,isbeyondthescopeofthisguidanceandadviceshouldbesoughtfromyoursupplierormanufacturer.Akeyfeatureofanyvalveusedforemergencyisolationistheabilitytoachieveandmaintaintightshutoffwithinanappropriatetimescale.Commonlyusedvalvetypesincludegatevalvesandplugvalves.Butitisimportantthateachvalveischosentomeetthespecificrequirementsofyourinstallation.
Actuators
109 Aremotelyoperatedvalvecanbeoperatedbyavarietyofdifferentmethodssuchaspneumatic,hydraulicorelectricalenergysources.ROSOVsshouldcontinuetobecapableofperformingtheirfunctionintheeventoffailureoftheprimarypowersupply,egmechanicalspringsorpressurisedfluidreservoirs.
110 Itmaybepossibletoconvertexistingmanualisolationvalvestoremoteoperationbyincorporatinganactuatorandasuitablecontrolsystem.Thesuitabilityofsuchaconversionisbeyondthescopeofthisguidanceandadviceshouldbesoughtfromthemanufacturerofthevalveand/ortheactuator.
Remotelyoperatedshutoffvalves(ROSOVs) Page20of47
Health and Safety Executive
111 ThecorrectsizingoftheactuatoriscrucialtomeetingthesafetyrequirementsspecificationoftheROSOV.Undersizingmayresultinthevalvenotoperatingondemandwhileoversizingmayresultindamagetothevalveoractuatorassembly.Thedesignmustshowanunderstandingofthesafetyrequirementsandbebasedonthecompletesystemcharacteristics.Thiswouldincludetakingintoaccount:
n thestatic/dynamicforcesoftheassembly;n theeffectoftheprocessapplicationontheseforces;n thefrequencyofexercisingthesystem;n theminimum/maximumrangeofgas/hydraulicpressuresusedforactuation;
andn thefactthatactuatorsaremanufacturedindiscretesizes.
112 Thecompetencerequiredtocarryoutasuccessfulsystemdesignmaynotresideinasingleorganisation(egiftheactuatorandvalvecomefromdifferentsuppliers).However,overallresponsibilityforthecompletesystemmeetingitssafetyrequirementsspecificationshouldbeclearlyassigned.
Failure mode
113 MostROSOVsprovidedforemergencyisolationaregenerallyconfiguredtoclose,andsoisolatethehazardousinventory,onfailure.However,itshouldnotbeautomaticallyassumedthatthisresultsinasafeconditioninallcases.Iftheabilitytoreopentheisolationvalvefollowingtheinitialshutdown(egduetolossofutilities)iscriticaltosafety,thenbackupsuppliesshouldbeprovided.
External hazards
114 ROSOVsshouldbeprotectedagainstexternalhazardssuchasfiresorexplosionstoensurethat:
n theycanbeclosed;andn theywillcontinuetoprovidetightshutoff.
Consequential hazards
115 ThebenefitsofROSOVsareclear,butitisimportanttorecogniseandaddressanumberofnewhazardsthatmayariseasaconsequenceoftheirinstallation.SomeoftheriskreductionprovidedbytheROSOVmaybeoffsetbyrisksassociatedwiththeinstallationandongoingmaintenance.TheneedforadditionalmeasurestotackletheseconsequentialhazardsshouldnotbetakenasabartofittingROSOVs,butmayinfluencethereasonablepracticabilityofretrofittingROSOVstoanexistinginstallation.Examplesofsomeoftheseconsequentialhazardsarelistedbelow.
116 Oncomplexorinterconnectingplant,thelocationofROSOVsneedscareful
considerationduetothepotentialfor:n overpressurisationdueto‘blockingin’aliquidwithahighexpansion
coefficient;andn theeffectsofspuriousvalveoperation.
117 Otherpotentialhazardsassociatedwithisolation valvesinclude:
Remotelyoperatedshutoffvalves(ROSOVs) Page21of47
Health and Safety Executive
n thecreationofdamagingpressuresurges(‘hammer’)inlongpiperunsifvalvesclosetooquickly;
n introductionofanewpotentialleaksource;n hazardsassociatedwithinstallation,maintenanceandtesting;andn generalincreaseincomplexityofthesystem.
Dual function valves
118 Insomecases,thenormalprocesscontrolsystemincludesvalves,activatedbyprocessmeasurementsensorsandactingaspartofatriporshutdownsystem.
119 Emergencyisolationvalvesneedtobecapableofachievingandmaintainingtightshutoff.Sometypesofcontrolvalvesaredesignedtoprovidea‘throttling’actionandthistypedonotalwaysprovideasufficientlytightseal.Othertypesofvalveused,eginthecontrolofbatchtransfers,maybecapableofachievingatightseal.Failureofadualfunctionvalvemaycompromisebothfunctionsandapostulatedfailureofthecontrolvalvemayitselfleadtoarequirementforanemergencyisolationvalve.
120 Therefore,thefunctionsofprocesscontrolandemergencyisolationshouldnormallybekeptseparate.Ultimately,thetestwillbewhetherthecontrolsystemcandelivertherequiredsafetyintegritylevelwithadualfunctionvalve.
121 FurtheradviceoncontrolsystemintegritycanbefoundinBritishStandardsEN61508Functional safety of electrical/electronic/programmable electronic safety-related systems andIEC61511Functional safety: safety instrumented systems for the process industry sector.
Excess flow valves
122 Anexcessflowvalveisdesignedtoremainopeninnormaloperation,butiftheflowthroughthevalveexceedsapresetmaximum,thevalvecloses.Thesevalvesallowflowineitherdirection,butnormallyonlytriggerforexcessflowinthespecifiedflowdirection.Thevalvesettingmustexceedthemaximumflowrateforeseeableinnormaloperation.Dependingontheparticulardesignofvalveasettingsignificantlyhigher(perhapsasmuchas50%)mayberequiredtoavoid‘chatter’anddamagetothevalve.
123 Acatastrophicfailuredownstreamofthevalvewillresultinincreasedflowandapressuredropacrossthevalve,causingittoclose.Wherethedownstreamfailureismorelimited,egaholeoracrack,orthereiscrushingofthepipeworkthentherestrictedflowmaynotbesufficienttocausethevalvetoshutandthereleasewillcontinue.
124 Otherfactorsarerelevantwhenconsideringuseofanexcessflowvalve.Foreignmattercanlodgeinthevalveandpreventitfromclosing.Insomeapplicationsitcanbedifficulttosimulatetheexcessflowconditionforprooftesting.
125 Advantagesclaimedforexcessflowvalvesincludetherelativesimplicityofamechanicalsystemandtheirautomaticaction–eliminatingsomepotentialhumanerrors.InthecontextofthisguidanceexcessflowvalveswouldnotnormallybeconsideredequivalenttoROSOVsforemergencyisolation.Manyofthesameissuessurroundingretrofittingapply,butinsomecaseslowercostsoverallmaymeanthatanexcessflowvalveisreasonablypracticabletoretrofitwhenaROSOVisnot.
Remotelyoperatedshutoffvalves(ROSOVs) Page22of47
Health and Safety Executive
Vulnerable vessel fittings 126 Processequipmentmayincludesmall-boreconnectionsforitemssuchas
controlsystemcomponents.Someofthese,egforlevelinstrumentation,mayenterbelowtheliquidlevelinthevessel.Failurecould,therefore,resultinlossofthevesselcontents.Fittingsofthistypemaybemostvulnerabletoguillotinefailure(beingshearedoff).Anexcessflowvalve,preferablylocatedintheoutlet,butinanycaseasclosetothevesselaspracticable,maybeanacceptablealternativetoaROSOVforthistypeofapplication.
127 Detailedadviceontheselection,installationandmaintenanceofexcessflowvalvesisbeyondthescopeofthisguidance.Adviceshouldbesoughtfromyoursupplierormanufacturer.
Reliability and integrity
128 Anycontrolsystemcanfail.Propermaintenanceandregularprooftestingofvalvesmakeamajorcontributiontomaintainingvalveintegrity.
129 Examplesofpotentialfailuremodesareconsideredbelow.Ifyouestablishhowsystemscanfailitprovidesusefulinformationforinclusionintestingandmaintenancearrangements.Commonfactorsidentifiedinpreviousindustrialincidentswhereisolationsystemsfailedinclude:
n failuretocloseondemandduetoinadequatemaintenance/prooftesting;n failuretoshuttightleadingtoleakageinternallyduetoincorrectspecification
ofthevalveorinadequatemaintenance/prooftesting;n failureofemployeestoactivateaserviceablevalveduetoinadequatetraining
and/orunclearinstructions;n largevolumesreleasedafter‘successful’isolationduetoinappropriate
spacingbetweenisolationvalves;n valvesrenderedunserviceablebytheincident,egdamagedbyfireor
explosion;andn failure-to-dangerofvalveonlossofmotivepower.
Inspection and proof testing130 Youshouldputinplaceappropriatearrangementsforinspectionandproof
testingtoreducethelikelihoodoftheROSOVtofailtooperateeffectivelyondemand,toALARP.
131 Thefrequencyofinspectionandtestingrequiredwilldependtoagreatextentontheconfidenceheldinthecompatibilityofthevalvewiththeprocessfluidsandconditions.Thisconfidencemaybeobtainedthroughpreviousoperationalexperience,testing,knowledgeofbasicmaterialscompatibilityoracombinationofthese.
132. Thelowerthelevelofconfidencethemorefrequentshouldbetheinspection
andtestingofthevalve.Recordsoftheseearlyinspectionsandtestswillprovidethebasisofajustificationforincreasedtestandinspectionintervalsasoperationalexperienceisaccrued.
Remotelyoperatedshutoffvalves(ROSOVs) Page23of47
Health and Safety Executive
Appendix 1 A case-specific assessment of the reasonable practicability of a ROSOVIntroduction
ThisappendixgivesguidanceonhowtodeterminewhetheraROSOVisareasonablypracticablemeasuretomitigatetheconsequencesofalossofcontainmentofahazardoussubstance.Itislimitedtoaconsiderationofthepotentialforharmtohumanhealth.
Shouldalossofcontainmentoccurthenatureofthehazardoussubstanceandtheprocessingconditionswouldhaveamajorbearingontheconsequences,andsostronglyinfluencethedecisiontoincorporateremoteisolationfacilities.
Acase-specificassessmentofreasonablepracticabilityrequiresthateachinstallationbeassessedindividually,takingaccountofitsspecificdesignfeatures,safetysystemsandoperatingprocedures.
Remotelyoperatedshutoffvalves(ROSOVs) Page24of47
Health and Safety Executive
Process
The flowchart above illustrates the process of assessment in the context of ROSOVs
Remotelyoperatedshutoffvalves(ROSOVs) Page25of47
Health and Safety Executive
Stage 1: Look for the hazardsIntroduction
Thefirststageoftheassessmentistoidentifyandunderstandthehazardouspropertiesofthesubstancesunderreview.Informationonthehazardsofaparticularsubstancemaybeobtainedfromavarietyofsources.TheforemostoftheseistheMaterialSafetyDataSheet,whichshouldbeissuedbythesupplierofthesubstanceinaccordancewiththeChemicals (Hazard Information and Packaging for Supply) Regulations 2002(SI1689).6AnindicationoftheprimaryhazardofasubstancecanbeobtainedfromtheCHIPclassification.
Dual hazard substances
Somesubstancesmaybebothtoxicandflammable.WhiletheCHIPclassificationusuallyreflectsthegreaterhazard,insomecircumstancesthesecondaryhazardmaydominate.Forsubstanceswithbothflammableandtoxicpropertiesyoushouldapplythecriteriaforeachhazardseparately.Ifdifferentstandardsareindicatedthenthehigherstandardshouldbeadopted.
Inthecaseofsimplemixturesofsubstanceswithinthescopeofthisguidance,asimilarapproachmaybetaken.Thestandardadoptedshouldbethehighestrequiredforeachofthecomponents.
Ifonecomponentisaminorconstituent,egasmallpercentageofatoxicsubstanceinaflammablesolvent,thenyoucanusetheCHIPmethodologytoarriveatanappropriatecategorisation.
Insomecasesthesubstancemayhaveasecondaryhazardoutsideofthescopeofthisguidance,egforoxidisersorsubstancesthatreactwithwater.Youshouldassessthesecondarypropertyseparately,byreferencetootherrelevantgoodpracticeorbymeansofacase-specificassessment,andagainadoptthehigherstandard.
Toxic substances
Toxicsubstancestendtohavelongerhazardrangesandgreaterpotentialtoaffectlarger,moreremotepopulationsbeyondthesiteboundary.Thermalradiationandoverpressureeffectsfollowingignitedreleasesofflammablesubstancesaremorelikelytoresultindamagetootherplant,andhencetoescalation,thanaretoxicreleases.
However,thereisthepotentialforpersonnelexposedtoatoxicsubstancetoberenderedincapableofcontrollingorshuttingdownplantsafely.Thiscanleadtofurtherincidentsandescalation.VulnerableoccupiedbuildingsincludingControlRoomsshouldbeidentifiedaspartofanOccupiedBuildingsAssessmentfortheestablishment.TheChemicalIndustriesAssociationpublicationGuidance for the Location and Design of Occupied Buildings on Chemical Manufacturing Sites,15containsusefuladviceonthistopic.
AROSOVmayreduceboththeriskofharmduetodirectexposuretothetoxicsubstanceandthelikelihoodofescalationoftheeventasaresultofemployeesbeingunabletoperformessentialduties.Routesintothehumanbodyincludeinhalation,ingestionandviacontactwiththeskin.Theprimaryrouteofharmfollowingalossof
Remotelyoperatedshutoffvalves(ROSOVs) Page26of47
Health and Safety Executive
containmenteventisinhalation.Buttherewillalsobethepossibilityofexposureviaotherroutesduringclean-upoperations.
Flammable substances
Thehazardrangesassociatedwithfiresandexplosionsfollowingthereleaseandignitionofaflammablesubstancetendtobeshorterthanfortoxicsubstances,andmaybeconfinedtothesite.However,withflammablesubstancesthereisgreaterpotentialforescalationduetotheeffectsofthermalradiationand/oroverpressureonotheritemsofplantcausingfurtherlossofcontainment.
Other properties
Otherpropertiesofsubstancesinadditiontotoxicityandflammabilitycanhaveasignificantimpactontherisk.Atoxicsubstancewithahighervapourpressure,forexample,willdispersemorereadilyandtoagreaterhazardrangefromthepointofrelease.
Processing or storage conditions
Theconditionsunderwhichthesubstanceisstoredand/orprocessedcanalsobeasignificantfactor.
LiquidsclassifiedasFlammable,butwithflashpointsaboveambienttemperature,generallypresentalowerhazardthanthoseclassifiedasHighlyFlammableliquids.However,storageorprocessingatelevatedtemperaturescanresultinthesesubstancesbeingreleasedabovetheirflashpointsoreventheirauto-ignitiontemperatures.
Substancesthataregasesatambienttemperaturearefrequentlystoredasliquidsunderpressure.Releasesfrompressurisedstoragearemoreenergetic.Foragivenholesize,agreatermassofsubstancewillbereleasedperunittime,particularlyifthesubstanceisreleasedintheliquidphase.
Inventory and scale of release
Processplanttypicallyconsistsofaseriesoflargercontainmentssuchasvessels,columnsetcjoinedbypipework,flanges,pumps,heatexchangersetc.Failuresaremostlikelytooccurinandaroundtheseinterconnectingitems,whichoften(thoughnotalways)containrelativelysmallquantitiesofsubstancesthemselves.But,ifthereisnoeffective(safe)meanstoisolatealeakfromsayapump,thenthecontentsofthelargercontainmentitemmaybelost.
Itisimportant,therefore,toconsidercontainmentsystemsasawholeandnotjustasindividualvessels.Boundariesneedtobesetbetweenunitsofinventory.Appropriatemeansofisolation,whichmayincludeROSOVs,shouldbeprovidedbetweenindividualinventoryunitstolimitthequantityofsubstancethatcanbereleasedfromanysinglefailure.IncidentshaveoccurredinwhichROSOVswereprovidedandfunctionedcorrectly;howeverthequantityofsubstancebetweenisolationswastoolargeandasignificantreleasestilltookplace.
Thenatureandscaleofanemergencyisoftendeterminedbytherateatwhichahazardoussubstanceisreleasedratherthansimplythebulkinventory.Itisthisrateofreleasethatdeterminesthesizeoftheliquidpoolortheflammablegascloud
Remotelyoperatedshutoffvalves(ROSOVs) Page27of47
Health and Safety Executive
formed,orthelengthanddiameterofajetflame.Factorsinfluencingtherateofreleaseincludethepressureandtheareaofthebreach–allotherthingsbeingequal,thegreaterthepressureand/orthelargertheboreofthepipework,thegreaterthereleaserate.Thatsaid,largerborepipeworktendstobelessvulnerabletosomeofthepossiblefailuremodes,egimpact.Toanextent,theconsequencesandfrequencymaybalanceeachotherout.
Remotelyoperatedshutoffvalves(ROSOVs) Page28of47
Health and Safety Executive
Stage 2: Assess the risksIntroduction
Ariskassessmentconsidersarangeofpossibleadverseeventsandevaluatesboththelikelihoodoftheeventandthemagnitudeofthepotentialconsequences.Inthiscontext,thefrequencyandtheconsequencesoftheevent,takentogether,describetheriskassociatedwiththatevent.
Ajudgementisthenmaderegardingthetolerabilityoftherisk,andthereasonablepracticabilityofriskreductionoptions,bycomparisonwithsuitablecriteria.
Degree of quantification
Riskassessmentsmaybemadewithvaryingdegreesofrigourorquantification,andeachoftheelementsofariskassessmentissubjecttovaryingdegreesofuncertainty.
Insomecases,professionaljudgementalonemaybeusedtoassigneventfrequenciesonaqualitativebasis.Inothers,amoredetailedanalysisofthepossiblecausesofafailureusingtechniquesincludingfaulttreesmaybemadetoquantifythefailureratemoreprecisely.
Theconsequencesofaneventarefrequentlybettercharacterisedthanthefrequency.Itiscommontoquantifytheconsequencesofagiveneventandpairtheresultwithaqualitativejudgementastothelikelihood.
Ifaclearandunambiguousdecisioncanbemadethenthislevelofquantificationislikelytobeadequate.If,duetouncertaintiesinthedataortheassumptionsmadeintheanalysis,itisnotclearwhetherornotfittingaROSOVisareasonablypracticableoption,thenfurtherquantificationmayberequired.
Inallcases,thedegreeofquantificationrequiredwillbethatnecessarytojustifythedecisiontaken.Youshouldtestthesensitivityofyouranalysistoanyassumptionsmade,egabouteventfrequencyoraboutsimilarfactorsintheconsequenceassessment.
Definition: quantified risk assessment
Ultimately,theconsequencesandfrequenciesoftherangeofpossibleeventsmaybefullyquantifiedandcombinedintoasingleriskvalueorrelationship.
Iso-contoursofindividualriskcanbeusedtodetermineatwhatdistanceandinwhichdirectionathresholdriskisreachedforthepurposesofcomparisonwithtolerabilitycriteria.
Inmakingjudgementsaboutthereasonablepracticabilityofaparticularsafetymeasure,itisalsonecessarytoconsider‘societal’or‘group’risk–whichisessentiallytheriskofharmtomultipleindividualsastheresultofthesamehazardousevent.
Remotelyoperatedshutoffvalves(ROSOVs) Page29of47
Health and Safety Executive
TheuseofnumericalriskestimatesinthismanneriscommonlyreferredtoasaQuantifiedRiskAssessment(QRA).Itwillnotalwaysbenecessary,orevenhelpful,toperformafullQRA.Inmanycasestheresultsofaqualitativeassessmentwillbesufficientlycleartoallowadecisiontobemade.
Remotelyoperatedshutoffvalves(ROSOVs) Page30of47
Health and Safety Executive
Steps in risk assessment
Theseparatestepsinariskassessmenthavebeendescribedmorememorablyas
What if..., What then..., Then what..., and So what...
STEP ONE What if...
Introduction
Thefirststepistoidentifythepotentialcausesor‘initiatingevents’ofalossofcontainmentevent.Thesecanbesplitintotwobroadcategoriesofevent:thosearisingfromexternaleventssuchasseismicactivityorflooding,andon-siteeventsincludingfailuresduetocorrosion,vehicularimpactormal-operation.
Equipment failures
Allplantitemshaveasetofuniquefailuremodes,someofwhichcanleadtoalossofcontainment.Areviewofeachfailurewillservetoidentifyifaseriousriskispresent.
Itisimportanttoestablishthosesite-specificfailuremodeswhoseconsequenceswouldrequireisolation.Someequipmentfailuresmayhavenosignificanteffect,warrantingonlyminormaintenanceattentionsuchasadjustmentorresetting.Others,suchassealfailuresorequipmentfailingtooperate,mayhavemuchmoreseriousconsequences.Identificationofthecriticalfailuremodesoftheplantequipmentisbestachievedthroughdirectoperatingknowledgeandexperience.
Plantmaintenancerecordscanbeusedtoidentifyequipmentthatmaygiverisetoalossofcontainmentincident.Genericinformation,frompublishedsourcesorheldcentrallywithinacompany,canbeusefulbutwillnottakeaccountoflocalconditionswhichwillaffecttheperformanceofequipment.OthersourcesofinformationincludereportsfromHazardandOperability(HAZOP)studiesandreviewsofPipeworkandInstrumentationDiagrams(PID).
Table1givessomeexamplesoftypicalequipmentfailures.
Remotelyoperatedshutoffvalves(ROSOVs) Page31of47
Health and Safety Executive
Table 1Typicalequipmentfailures
Equipment Principal Failure Modes Principal Failure Causes
Pipework Holesandruptures Corrosion,erosion,cavitation,impact,vibration,‘hammer’
Pipework,grants,flangedconnections
Leaks Deteriorationofmaterial,wronggasketused,incorrectassemblyofjoint
Instrumentationconnection(smallbasetube)
Rupturesanddisconnections Impact,vibration,incorrectfitting,incorrectmakeup
Flexiblehoses Holes,ruptures,disconnections Fatigue,impactdamage,misuse,poorconnection,mechanicalfailures
Valves Externalleak Glandseal,jointedfaces
Pumps Externalleak Driveshaft,apping,flangedfaces,chainlocks
Compressors Leaks,seals,flangedfaces,soiledconnections,drains
Vibration,perishedjointmaterial,operatorerror,leakpastseat
Drainandsimplepoints Leaksatsealsandflangedfaces,valveleftopen,fullboreruptures
Perishedjointmaterial,operatorerror,impact
Remotelyoperatedshutoffvalves(ROSOVs) Page32of47
Health and Safety Executive
Initiating event frequencies
Itmaybenecessarytoestimatethefrequencyoftheinitiatingeventsifthesearetobeusedtoestimatetheoverallfrequencyofthehazardousevent(lossofcontainment).Alternatively,frequenciesofhazardouseventsmaybeassignedbasedonhistoricaldataprovidedthisisavailableandrelevant.
Definition: external events
Anexternaleventisonethathasnodirectrelationshipwiththeequipment,butwhichiscapableofactingontheequipmentcausingittofail.
Thisincludesallnaturalphenomenasuchasearthquakes,highwinds,floodingetc.Interferencebythirdpartiesengagedinvandalismortheftmayberelevant.Itincludesthoseactivitiesthatmaybegoingonaroundtheplantsuchasthemovementofroadvehiclesorliftingoperations,iethepotentialforimpactdamage.Alsoincludedareincidentsonadjacentplantthatcouldescalate,affectingtheplantunderconsideration,iethe‘dominoeffect’.
Definition: human factors
Inmanycases,accidentsandincidentsareattributedtohumanfailure.Thesecanincludeunintentionalerrorssuchasmistakenlystartingapump,openingthewrongvalve,orfailingtoreplaceaseal.Sometimescustomandpracticeproceduralshortcutscancontributetohumanfailures.
FurtherguidanceisavailableinthepublicationReducing error and influencing behaviour.16
Influences on human failure
Thetablebelowgivessomeinfluencesthatincreasethelikelihoodofhumanfailure.
Table 2Influencesonhumanfailure
JobFactors
Illogicaldesignofequipmentandinstruments
Constantinterruptions
Informationhardtofindorassimilate
Missingorunclearinstructions
Poorlymaintainedorunreliableequipment
Highworkload,timepressure
Noisyandunpleasantworkingconditions
IndividualFactors
Lowskillandcompetence
Tiredstaff
Boredordisheartenedstaff
Individualmedicalproblems
OrganisationalFactors
Poorworkplanningleadingtohighworkpressure
Poorcommunications
Uncertaintiesinrolesandresponsibilities
Poormanagementofhealthandsafety
Inadequatestaffinglevel
Inadequatetraining–routineemergencyoperations
Inadequatesupervision
Remotelyoperatedshutoffvalves(ROSOVs) Page33of47
Health and Safety Executive
What if analysis for human factors
TheWhatif…analysisshouldidentifythosetaskswherehumanfailurescouldarise.Analysisisusuallydonebystructuredtaskanderroranalysismethods.Involvementofoperatorsintheanalysisisessentialtoprovidea‘realitycheck’ofwhatisactuallydoneontheplantandwhatstepsarefeasible.Suchanalysisispreferabletojustrelyingonwhatiswrittenintheoperatingprocedure.
Key tasks
Keytaskstoconsiderinclude:
n normaloperatingduties;n samplingtasks;n venting/draining;n connecting/disconnecting;n startup/shutdown;n cleaningandmaintenance;n emergencyresponse.
Probability estimates
Methodsareavailabletoallowtheestimationofhumanerrorprobabilities.However,thisshouldbedonewithextremecautiontoensurethatestimatesareappropriateforthenatureofthetaskandthesite-specificconditions.
Response times
Particularcareisneededwhenestimatingthelikelytimeforoperatorstorespondtoanincident.Considerationshouldbegiventothedetection,diagnosisandactionstagesofresponse.
DetectionHowanoperatorwillbecomeawarethataproblemexists.Assessmentofalarmprioritiesandfrequencies,thecharacteristicsoftheoperatorconsoledisplays,aswellasoperators’pastexperienceofsimilarproblemsonsitesareallusefulaspectstoreview.Plantproblemsthatappearoveraperiodoftime,andwheretheinformationavailabletotheoperatorscanbeuncertain,areparticularlydifficulttodetect.WhenControlRoomsarenotcontinuallystaffedyouneedtobeabletoshowthatplantproblemscanstillbedetectedquicklyandreliably.
DiagnosisHowanoperatorwilldeterminewhataction,ifany,isrequiredtorespondtotheproblem.Trainingandcompetenceassurance,theavailabilityofclearoperatingproceduresandotherjobaids,andthelevelofsupervisionareallrelevantfactorstothinkabout.Theexistenceofmorethanoneproblemcanmakediagnosismoredifficult.
Remotelyoperatedshutoffvalves(ROSOVs) Page34of47
Health and Safety Executive
ActionThisstagecovershowatimelyresponseiscarriedout.Keyaspectshereinclude:
n areliablemeansofcommunicatingwithotherplantoperators;n timetolocateandoperatethecorrectisolationvalve;n formanualisolationvalves,considertheneedtodonPPEandthe
potentialdifficultyinoperatingthevalvewhilstwearingPPE;n forremotelyoperatedvalves,feedbackneedstobegiventooperators
thatthevalvehasoperatedcorrectly;n considerthatoperatorsmayhesitateifoperatingthevalveleadsto
criticismlater.
A‘walk-through’ofthephysicalaspectsofthetaskwithoperatorscanprovideveryusefulinformationontheminimumtimeneededtooperateanisolationvalve.However,anallowanceforadditionaldelaysduetouncertainty,hesitation,communicationsproblemsandsoonshouldbeaddedforarealisticestimateoftheresponsetime.
Additionalguidanceisavailableinthesepublications(availableontheHSEwebsiteatwww.hse.gov.uk):
Better alarm handlingHSEInformationSheet
Human factors aspects of remote operation in process plants
Assessing the safety of staffing arrangements for process operations in the chemical and allied industries
Human factors integration: implementation in the onshore and offshore industries
Remotelyoperatedshutoffvalves(ROSOVs) Page35of47
Health and Safety Executive
STEP TWO What then...
Introduction
Thesecondstepistoidentifythoseinitiatingeventsthatcontributetothehazardouseventunderconsideration–theeventthatwouldbemitigatedbyisolation.
Hazardous events
Agivenhazardouseventmighthaveseveralpotentialinitiators.Forexample,bothcorrosionandimpactmightbecausesofapipeworkfailure.Similarly,eachinitiatingeventcouldleadtoseveralhazardousevents.SomeofthesemaybeeffectivelymitigatedbyaROSOV,egfailureofpipeworkduetocorrosion,whilstotherswillnot,egacorrosion-inducedholeinastoragetank.
Frequency of hazardous event
Theprocedurefortracinginitiatingeventsthroughtohazardouseventscanbemadeeasierbytheuseoflogictrees.Thisformofanalysiscanbeusedtogeneratefrequenciesforthehazardousevents.
However,therecanbeconsiderabledifficultiesinpracticeanditiseasytooverlookinitiatingeventsandhenceunderestimatethefrequencyofthehazardousevent.Thisiswhyitiscommontoturntoananalysisofhistoricaldata.
STEP THREE Then what...
Introduction
Thethirdstepistoevaluatetheconsequencesoftheidentifiedhazardouseventorlossofcontainment.Thisprocessinvolvespredictingthebehaviourofthehazardousmaterialoncereleasedfromcontainment,inordertodeterminehowtheconcentrationofthesubstancewillvarywithdistancefromthereleasepoint.
Tobecapableofcausingamajoraccident,toxicsubstancesmustbepresentinaphysicalformsuchthatdispersionispossibleintheconditionsthatexistatthetimeoftheaccident.
Forflammablesubstances,ignition(withconsequentthermaland/oroverpressureeffects)canoccurclosetothesourceofthereleaseafterminimaldispersion.Butinsomecasesacloudofflammablevapourmaydriftsomedistanceawayfromthereleasepoint(whereignitionsourcesmaybestrictlycontrolled)beforefindingasourceofignition.
Inthecontextofthisguidance,wearegenerallyconcernedwithreleasesofgaseousorvolatileliquidsubstances,whichcanbecomeairborne,andbetransportedsomedistancefromthepointofrelease.However,evensubstanceswithrelativelylowvapourpressurescanformaflammableortoxiccloud,ifforexampletheyarereleasedunderpressure,formingasprayormist.
Fortoxicsubstances,theextentofthehazardisrelatedtotheconcentrationofthesubstancetowhichthoseaffectedareexposed.Criticalfactorsindetermining
Remotelyoperatedshutoffvalves(ROSOVs) Page36of47
Health and Safety Executive
thedegreeofharmincludetheconcentrationandtheexposuretime–collectivelyknownas‘thedose’.
Forflammablesubstances,thehazardisagainrelatedtotheconcentration.Butthehazardwillonlyberealisediftheconcentrationiswithincertaincriticallimitsandthereisasourceofignition.Someinitiatingeventsmaysimultaneouslyprovideasourceofignition,egintheeventofareleaseduetovehicularimpacttherearealsolikelytobesparksand/orhotvehiclecomponentspresent.
Definition: source term
Asourcetermdescribestheconditions(egtemperatureandpressure)andothercriticalparameters,includingreleaserateandthephysicalpropertiesofthesubstancethattogetherdefinetherelease.
Take,forexample,agasliquefiedunderpressure.Foragivensizedholeinthecontainmentbarrier,thesourcetermdependsonwhetherthesubstanceisreleasedasaliquid,egfrompipeworkcarryingliquid,orasvapourifthefailureoccursinpipeworkconnectedtothevapourspace.
Extent of the hazard
Fromthesourceterm,knowledgeofthewaysubstancesbehavewhendispersedintotheatmosphere,andtheharmcriteria,theextentoftheharmfuleffectorthe‘hazardrange’canbeestimated.Thehazardrange,inconjunctionwithdataonthepopulationatrisk,isusedtodeterminetheseverityoftheconsequences.Adetailedconsiderationofthetechniquesformodellingthedispersionofhazardoussubstancesisbeyondthescopeofthisguidance.Atthetimethisguidancewasbeingprepared,planswereatanadvancedstagetomakethefollowingHTML-basedtoolavailableonHSE’swebsite:‘GuidanceondispersionmodelsfortheassessmentofCOMAHsafetycases’.
Thisworkincludesgeneralguidanceondispersionmodelling,plusreviewsofsomeofthemodelsmorefrequentlyemployedbydutyholdersinpreparingsafetyreportssubmittedundertheCOMAHRegulations.
AnotherusefulsourceistheDutchTNOpublication,(the‘YellowBook’),Methods for the calculation of the physical effects of the escape of dangerous materials(seeparticularlyPart2,Chapter7‘Dispersion’).CJPvanBuijtenen.1979.3/L.
Harm criteria
Harmcriteriadescribethedegreeofharm,whichcouldbedeathorsomespecifiedlesserharmresultingfromexposuretothehazard.
Fortoxicsubstances,theharmcriteriaarecommonlyexpressedintheformofa‘dose’,orconcentration/timerelationship,thoughotherrelationshipsarepossible.
Forflammablesubstances,theharmcriteriaarecommonlyrelatedtoeithertheeffectsofexposuretothermalradiationfrom,forexample,poolfires,jetfiresorfireballsor,intheeventofanexplosion,totheoverpressuregenerated.
Harmcriteriaforoverpressuremayberelatedtothedirecteffectsonthehumanbodyor,moreusually,beindirectlyrelatedtotheeffectsofoverpressureonstructureswhichmaycollapse,ortotheimpactofmissilesgeneratedbythe
Remotelyoperatedshutoffvalves(ROSOVs) Page37of47
Health and Safety Executive
explosion.Itismoreusualtousetheindirectrelationshiptotheeffectsonstructuresbecausethesecanresultinharmatsignificantlyloweroverpressures.
Secondary containment
Itisgoodpracticewhendesigninganewinstallationtoapplyahierarchicalapproachtotheselectionofriskreductionmeasures.ROSOVs(whichservetolimitthequantityofsubstancereleasedfromtheprimarycontainment)shouldbeinstalled,ifreasonablypracticable,inpreferencetobunding,whichservestominimisetheconsequencesoncethematerialhasescaped.
WhenconsideringthereasonablepracticabilityofretrofittingROSOVstoanexistinginstallation,existingmeasures,includingbunding,maybetakenintoaccountwhenestablishingthecurrentriskforcomparisonpurposes.
AbundmayberequiredtocontainandmitigatearangeofpotentialreleasesagainstwhichaROSOVwouldnotbeeffective–including,forexample,overflowingofavesselandholesinthevesselitself.ROSOVsandsecondarycontainmentarenotmutuallyexclusiveandbothmayberequiredtoreducetherisksfromtherangeofpossiblehazardouseventstoALARP.
Toxic releasesForun-bundedreleasesofatoxicliquidatambienttemperature,ignoringcoolingeffectsofevaporation,thesourcetermisproportionaltotheevaporationratefromthepool.Thisisdependentonthepoolsize,whichincreasesasmorematerialisaddedtothepool.Themorerapidlythereleaseisisolated,thelessmaterialwillbereleasedandthesmallerthepoolformed.Asmallerpoolwillmeanareducedhazardrange.
Forabundedrelease,theevaporationratewillreachamaximumoncethequantityofmaterialreleasedissufficienttocovertheareaofthebund.Thisisirrespectiveofwhetherthereleaseisisolatedmanuallyorremotely.However,alongerreleasemeansmorematerialtransferredintothebund.Unlessstepsaretakentocontrolevaporationfromtheliquidinthebund,egbycoveringthesurfacewithaninertbarrier,theevaporationwillcontinueforalongerperiod.Peoplewhoareintheplumeandunabletoescapefromit,willbeexposedtoagivenconcentrationoftoxicsubstanceforlongerandsoaccumulateahigherdose.
Flammable releases Forbundedreleasesofflammableliquids,thegreaterquantityoffuelaccumulatedinthebundislikelytoresultinamoreprolongedfireifignited.Adjacentplantwillbeexposedtothermalradiationforalongerperiod,increasingthepotentialforescalation.Wherevesselsholdingflammablesubstancesshareacommonbund,‘dwarfwalls’orsimilarshouldbeincorporatedtolimitthespreadofsmallerreleases.
Alongcontinuousreleaseofvapourfromanevaporatingpoolcanleadtotheformationofalargercloudofvapourabovethelowerflammablelimit.Thisincreasestheextentoftheflashfirehazard.
Escalation
Forflammablesubstances,animportantconsiderationisthepotentialforescalationor‘dominoeffects’.Forexample,arelativelysmallfire/explosioncouldhavedirecteffectsthatareconfinedtothesite.Butthefire/explosioncouldresult
Remotelyoperatedshutoffvalves(ROSOVs) Page38of47
Health and Safety Executive
inlossofcontainmentofamorehazardoussubstancewiththepotentialforsubstantialoff-siteconsequences.
Inthesecases,thetrueextentofthehazardwillberelatedtotheescalationevent,whichmayhavealowereventfrequencybutsubstantiallymoreseriousconsequences.
Response time
Theresponsetimebetweentheinitiatingeventandthereleasebeingisolatedcanhaveasignificantimpactontheextentofthehazard.Evenwhenitispossibletoeffectasafemanualisolation,theadditionaltimetakentodosocansignificantlyincreasethereleasedurationandthehazardrange.
ASOVs
Afurtherreductioninresponsetime,withapotentialreductioninhazardrange,maybeachievediftheisolationvalveisautomaticallyactivatedinresponseto,forexample,adetector.SuchanarrangementisreferredtoasanAutomaticShutoffValve(ASOV).
SimilarconsiderationsapplywhenjudgingthereasonablepracticabilityofanASOV.Althoughitisimportanttoconsiderthelikelihoodandconsequenceofspurioustrips,thesearenotbythemselvesajustificationfornotfittinganASOV.Spurioustripscanbecontrolledby,forexample,theappropriateuseofdiverseredundantsensorsoperatingona‘voting’system.
Severity of consequences
Inthecontextofharmtohumanhealth,theseverityoftheconsequencesisdirectlyrelatedtothenumberofpeoplewhomaybekilledorinjured.Casualtiescanresultfromdirectexposuretothehazardoussubstance,ortotheeffectsofthermalradiation/overpressureinthecaseofflammablehazards.
Dataonthepopulationsatriskwithinthespecifiedhazardrangeisusedtoestimatetheseverityoftheconsequences,egthenumberofpersonssufferingthespecifiedlevelofharm.
Directional effects
Forsomeevents,particularlytoxicreleases,theextentoftheharmandhencetheriskwillvaryaccordingtodirection.Someflammableevents,includingflashfires,canalsobeinfluencedbyweather,whilstothers,egexplosions,tendtobeomni-directionalintheireffects.
STEP FOUR So what...
Introduction
Thefinalstepistocomparetherisk(frequencyxconsequence)ofthehazardouseventwithsuitablecriteriatodeterminethetolerabilityofthatrisk.
Reducing risks, protecting people: HSE’s decision-making process,3alsoavailable
Remotelyoperatedshutoffvalves(ROSOVs) Page39of47
Health and Safety Executive
onlineatwww.hse.gov.ukincludesadiscussionoftherisktolerabilitycriteriadevelopedbyHSE(astheregulator).
Inthecontextofthisguidance,forrisksthatfallintothe‘Tolerable,IfALARP’regionoftheriskspectrum(seeSFAIRP/ALARP/AMNintheSummaryofrelevantlegalrequirements),aROSOVshouldbeconsideredasameasuretoreducetherisktoALARP.
Risk reduction
Inthiscontext,aROSOVisameasurethatmitigatestheconsequencesofahazardouseventratherthaninfluencingthefrequencyofthatevent.However,itisalsotruethatbylimitingtheconsequencesoftheprimaryhazardousevent,thepresenceofaROSOVmayreducetheprobabilityofanyassociatedescalationevent(s).
Cost-benefit analysis
Informingjudgementsaboutthereasonablepracticabilityofaparticularsafetymeasure,itisnormaltousedeathasthecriterionforharm.Thenumberof‘statisticalfatalities’averted,forwhichthereareacceptedmonetaryequivalents,areconsideredwhenevaluatingthebenefitssideofthecost-benefitcomputation.
Seriousinjuriesavertedshouldalsobeconsideredwhenassessingthebenefitsofthemeasurebeingconsidered.However,althoughattemptshavebeenmadetoestablishequivalencefactors,egtenmajorinjuriesequalonefatality,thereareasyetnogenerallyacceptedmonetaryequivalentsfornon-lethalinjuries.
WhendecidingwhetherornottofitaROSOV,acomparisonismadebetweentheriskwithandwithouttheROSOV,andthereductioninriskiscomparedtothecostofprovidingtheROSOV.
Gross disproportion
TheimplementationofariskreductionmeasuresuchasaROSOVwillinvolveacosttothedutyholder.Equally,aROSOVisintendedtoreduceriskfromanoperationandthisreductionwillbringaboutabenefit(intermsoflivessavedetc),whichcanbeexpressedinmonetaryterms.Theratioofthecoststothebenefitscanbedescribedasaproportionfactor(PF).Thegenerallyacceptedvalueofavoidingastatisticalfatalityisapproximately£1millionatthetimeofwriting.
Itshouldalsobenoted,however,thatthebenefitsmightalsoincludetheavoidanceofsuchthingsasenvironmentalclean-upcosts,increasedinsurancepremiums,lossofassetvalue,thecostsofincreasedregulatoryinterferenceetc.Themeasuretoreducetherisk,inthiscasetheROSOV,shouldbeimplementedunlessthecostisgrosslydisproportionatetothereductioninrisk(oranequallyeffectivealternativeisadopted).
Providingtheriskanalysisisbasedoncautiousbestestimatesandthecostsarerealistic(notneedlesslyinflatedbeyondtheprovisionofafitforpurposesolution)then,inthecontextofmajorhazards,HSEwillusethefollowingasthebasisforexercisingjudgement:
Remotelyoperatedshutoffvalves(ROSOVs) Page40of47
Health and Safety Executive
n Theproportionfactorisatleast1(andpossiblyatleast2)forriskswhichareclosetobeingbroadlyacceptablerisks.
n Theproportionfactorisatleast10atthetolerable/unacceptableriskboundary.
n Forrisksbetweentheselevelstheproportionfactorisamatterofprofessionaljudgement,butthedisproportionbetweenthecostsofpreventingafatality(CPF)andthevalueofapreventedfatality(VPF)mustalwaysbegrossforameasurenottobereasonablypractical.
Remotelyoperatedshutoffvalves(ROSOVs) Page41of47
Health and Safety Executive
Stage 3:Record the assessment findingsRationale
Thefinalstageoftheassessmentprocessistodocumentthefindingsoftheassessmentandthereasoningbehindthedecisionstaken.ThereisalegalrequirementundertheManagementofHealthandSafetyatWorkRegulationstodocumentthefindingsofariskassessment.Inthecontextofthisguidance,itisparticularlyimportantthatthefindingsaredocumentedthoroughlywhentheyareusedtojustifynotimplementingaROSOV,whereoneisidentifiedasgoodpracticebythedecisioncriteriapresentedinthisdocument.
Remotelyoperatedshutoffvalves(ROSOVs) Page42of47
Health and Safety Executive
Stage 4:Implement ROSOV where reasonably practicableComment
WheretheconclusionoftheassessmentisthataROSOV(or,whereapplicable,anotherequallyeffectivemeasure)isreasonablypracticable,thenimplementationshouldfollowasalogicalconsequence.
Remotelyoperatedshutoffvalves(ROSOVs) Page43of47
Health and Safety Executive
Stage 5:Review the assessment periodicallyIntroduction
Assessmentisnotaonce-and-for-allactivity.Withthepassageoftime,changesinlocalcircumstancesandadvancesintechnologyetcmayaltertheconclusionsoftheriskassessment.Forexample,anincreaseinthesizeofthelocalpopulationoradecreaseinthecostofprovidingremoteisolationmaymakefitmentofaROSOVareasonablypracticableoptionwherepreviouslyitwasnot.
Significant change
InaccordancewiththeManagementofHealthandSafetyatWorkRegulations,dutyholdersshouldreviewand,ifnecessary,modifytheirassessmentifthereisreasontobelievethatitisnolongervalidorifthereisasignificantchange(eganincreaseinthepopulationatrisk)inthematterstowhichitrelates.
Itisprudentinmostcasestoplantoreviewriskassessmentsatregularintervals.Thereisanexplicitrequirement(regulation8)fortheOperatorsofinstallationssubjecttotheTopTierrequirementsofCOMAHtoreviewtheirsafetyreportatleastonceeveryfiveyears,orwhenevernecessary,totakeintoaccountnewfactsorknowledgethatbecomesavailable.ThisshouldbeconsideredindicativeofGoodPracticeforOperatorsofotherestablishmentshandlinghazardoussubstances.
Remotelyoperatedshutoffvalves(ROSOVs) Page44of47
Health and Safety Executive
Appendix 2 Summary of relevant legal requirementsHealth and Safety at Work etc Act
1 The Health and Safety at Work etc Act 1974placesadutyonemployerstoensure‘sofarasisreasonablypracticable’(SFAIRP)thehealth,safetyandwelfareatworkoftheiremployees,andadutyonemployersandtheself-employedtoensurethatpersonsotherthantheiremployees(including,inthecaseoftheself-employed,themselves)areprotectedfromriskstotheirhealthorsafetyarisingfromtheworkactivities.
Management of Health and Safety at Work Regulations
2 The Management of Health and Safety at Work Regulations 1999(SI3242)requireemployers(andwhererelevanttheself-employed)tomakeasuitableandsufficientassessmentoftheriskstotheiremployeesandtopersonswhoarenottheiremployeesbutwhomaybesubjecttorisksarisingfromtheworkactivities.
Control of Major Accident Hazards Regulations
3 Regulation 4 of the Control of Major Accident Hazards Regulations 1999 (COMAH)(SI743)placesadutyontheoperatorsofestablishmentstowhichtheregulationsapplytotake‘allmeasuresnecessary’(AMN)topreventmajoraccidentsandlimittheirconsequencestopersonsandtheenvironment.
4 GuidanceontheseregulationscanbefoundintheHSEpublicationA guide to the Control of Major Accident Hazard Regulations 1999.5
5 OperatorsofCOMAHestablishments(whether‘lowertier’(LT)or‘toptier’(TT))haveadutytoprepareaMajorAccidentPreventionPolicy(MAPP).OperatorsofCOMAHTTsiteshaveanadditionaldutytosubmitasafetyreporttotheCompetentAuthority(CA).TheCOMAHsafetyreportshoulddemonstratethattheOperatorhastakenallmeasuresnecessaryandthatthemajoraccidentriskshavebeenreducedtoALARP.Oneofthekeydemonstrationswillbetoshowthatappropriatemeasureshavebeentakentopreventandeffectivelycontainreleasesofdangeroussubstances.
Dangerous Substances and Explosive Atmospheres Regulations
6 The Dangerous Substances and Explosive Atmospheres Regulations 2002(DSEAR)(SI2776)implementtwoEuropeanDirectives:theChemicalAgentsDirective(CAD)andtheExplosiveAtmospheresDirective(ATEX).
7 Theseregulationsdealwithfires,explosionsandsimilarenergy-releasingevents(egexothermicchemicalreactions)arisingfromdangeroussubstances(chemicalagents)andtheexplosiveatmospherescreatedbythosedangeroussubstances.
8 DSEARmodernisesandrepealsover20piecesofoldsafetylegislationonflammablesubstances,dustsandliquids.
Remotelyoperatedshutoffvalves(ROSOVs) Page45of47
Health and Safety Executive
References and useful addresses1 The chemical release and fire at the Associated Octel Company Limited: A report
of the investigation by the Health and Safety Executive into the chemical release and fire at the Associated Octel Company, Ellesmere Port on 1 and 2 February 1994ReportHSEBooks1996ISBN0717608301
2 Emergency isolation of process plant in the chemical industryChemicalInformationSheetCHIS2HSEBooks1999
3 Reducing risks, protecting people: HSE’s decision-making processReportHSEBooks2001ISBN0717621510
4 Assessing compliance with the law in individual cases and the use of good practice.AvailableontheHSEwebsite:http://www.hse.gov.uk/dst/sctdir.htm#riskassessment
5 A guide to the Control of Major Accident Hazard Regulations1999HSEBooks1999ISBN0717616045
6 Approved classification and labelling guide. Chemicals (Hazard Information and Packaging for Supply) Regulations 2002.Guidance on RegulationsL131(Fifthedition)HSEBooks2002ISBN0717623696
7 Approved supply list. Information approved for the classification and labelling of substances and preparations dangerous for supply. Chemicals (Hazard Information and Packaging for Supply) Regulations 2002. Approved listL129(Seventhedition)HSEBooks2002ISBN0717623688
8 A guide to the Pipelines Safety Regulations 1996L82HSEBooksISBN0717611825
9 The Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995TheStationeryOfficeSI1995No743
10 The safe isolation of plant and equipmentHSEBooks1997ISBN0717608719
11 Designing and operating safe chemical reaction processes HSG143HSEBooks2000ISBN0717610519
12 Control of substances hazardous to health. The Control of Substances Hazardous to Health Regulations 2002. Approved Code of Practice and guidanceL5(Fourthedition)HSEBooks2002ISBN0717625346
13 Safety advice for bulk chlorine installationsHSG28(Secondedition)HSEBooks1999ISBN0717616452
14 The Management of Health and Safety at Work Regulations 1999TheStationeryOfficeSI3242
15 Guidance for the location and design of occupied buildings on chemical manufacturing sites(Secondedition)RC21/03ChemicalIndustriesAssociation2003ISBN1858971144DetailsontheCIAwebsiteat:http://www.cia.org.uk/bookshop/system/index.html
16 Reducing error and influencing behaviourHSG48(Secondedition)HSEBooks1999ISBN0717624528
Remotelyoperatedshutoffvalves(ROSOVs) Page46of47
Health and Safety Executive
The Environment Agency
TheEnvironmentAgency(EnglandandWales)hasageneralenquirylineon08459333111orvisitwww.environment-agency.gov.uk
The Scottish Environment Protection Agency
ForScotland,thePublicAffairsDepartmentoftheScottishEnvironmentProtectionAgency,on01786457700,handlesgeneralenquiriesorvisitwww.sepa.org.ukWhileeveryefforthasbeenmadetoensuretheaccuracyofthereferenceslistedinthispublication,theirfutureavailabilitycannotbeguaranteed.
Further informationForinformationabouthealthandsafetyringHSE’sInfolineTel:08453450055Fax:08454089566Textphone:08454089577e-mail:hse.infoline@natbrit.comorwritetoHSEInformationServices,CaerphillyBusinessPark,CaerphillyCF833GG.
HSEpricedandfreepublicationscanbeviewedonlineororderedfromwww.hse.gov.ukorcontactHSEBooks,POBox1999,Sudbury,SuffolkCO102WATel:01787881165Fax:01787313995.HSEpricedpublicationsarealsoavailablefrombookshops.
TheStationeryOfficepublicationsareavailablefromTheStationeryOffice,POBox29,NorwichNR31GNTel:08706005522Fax:08706005533e-mail:customer.services@tso.co.ukWebsite:www.tso.co.uk(Theyarealsoavailablefrombookshops.)StatutoryInstrumentscanbeviewedfreeofchargeatwww.opsi.gov.uk.
PublishedbyHSE02/10 Page47of47
Health and Safety Executive
top related