COMPARISON OF RISK ANALYSIS METHODS AND DEVELOPMENT OF A TEMPLATE FOR RISK CHARACTERISATION

J.M. Ham, M. Struckl, A.-M. Heikkil, E. Krausmann, C. Di Mauro, M. Christou, J.-P. Nordvik Institute for the Protection and Security of the Citizen
2006

EUR 22247 EN

European Commission Directorate-General Joint Research Centre Institute for the Protection and Security of the Citizen

Contact information European Commission DG Joint Research Centre, Institute for the Protection and Security of The Citizen, Traceability and Vulnerability Unit TP 361, Via Fermi 1 21020 Ispra(VA), ITALY E-mail: jean-pierre.nordvik@jrc.it Tel.: +39 0332 78 5021 Fax: +39 0332 78 5145

http://www.jrc.cec.eu.int

Legal Notice Neither the European Commission nor any person acting on behalf of the Commission is responsible for the use which might be made of this publication.

EUR 22247 EN Luxembourg: Office for Official Publications of the European Communities European Communities, 2006 Reproduction is authorised provided the source is acknowledged

Printed in Italy

PREFACE
Managing risk associated with technological systems has always been a demanding task. Today this task is becoming even more challenging for politicians and risk-decision makers. Different factors contribute to this situation such as an always increasing complexity of technological systems, the increased expectations of the European citizen for a knowledge-based society and transparent decisionmaking processes, and the emergence of new threats like sabotage and terrorism. In fact, when manmade and environmental risk-related issues are concerned, it appears that a lack of balance exists between citizen's expectations and decision-maker's behaviour. This discrepancy can be traced back to the variety and complexity of the risk assessment approaches in use today as well as to the uncertainties that affect the results of these studies. Decision makers are confronted with a large variety of approachesto assessand manage a specific risk; a fact that makes the comparison of risk studies performed by different analysts or for differ j nt endusers a difficult task and, consequently, has significantly hampered the widespread use
I

of

risk

assessmentfor certain decision-making purposes.

Currently, the existing risk assessment approaches differ in their terminology, their underlying assumptions, the way they are applied in practice, and the [mal format of their results. In 1999, the JRC launched a number of activities to better understand the structural characteristics of the results of such studies -the so-called risk figures -and to investigate how the quality of these risk figures I can be evaluated. i These activities resulted in the following two events: (a) a JRC International Workshop on Promotion of Technical Harmonization on Risk-based Decision Making, held at Stresa & Ispra, Italy, 22-25 May 2000 and (b) a meeting in July 2001 with other Directorates-General of the European Commiss~onand representatives from standardization organizations. I As a follow-up of these events, an Institutional Activity called COMPASS (Risk Comparability and Integrated Risk Assessment) was started in 2003 under the 6th Research Framework Program of the European Commission. During the period 2003-2004, a main study of the COMPASS Activity was the development of a common format, also called template, to characterize a risk figure as wen as the overall process that lead to this risk figure. The template was intended to comprise the presentation of the results and of the structure of a specific risk-analysis process, therefore facilitating the verification of the completeness and adequacy of the process. It should be noted that the development of a generic technical standard on how to perform a risk assessmentwas no objective of the project. Thi report presents the final results of that study.

Although the template is intended to cover as many risk-related activities as possible, the current study focuses only on the comparison of risk assessment in chemical industrial facilities and transportation of dangerous goods. This way, it benefited from the experience with risk assessment in Seveso installations and the work that is being carried out in the JRC, and it received significant input from other Seveso-related activities, such as the European Working Group on Land-use Plannin~ in the Context of Article 12 of Directive 96/82/EC (Seveso II Directive). I The study was funded entirely by JRC and was carried out by TNO Environment, Energy and Process Innovation (TNO-MEP)a under Service Contract No. 21503-1003-12, and JRC staff from the COMPASS team and from the Major Accident Hazards Bureau (MAHB).

/~)

/J.
M. Christou

/
I.-P. Nordvik

l.t.~:fL~~i~:~~~~
MAHB NEDIES Action Leader, JRC/IPSC

COMPASS Action Leader, JRCRPSC I

aSince 1stJanuary 2005 known as: TNO Built Environment and Geosciences,Team Industrial and External Safety.

CONTRIBUTORS
J.M. Ham, TNO Built Environment and Geosciences, Team Industrial and External Safety M. Struckl, MAHB, JRC-IPSC A.-M. Heikkil, COMPASS, JRC-IPSC E. Krausmann MAHB, JRC-IPSC C. Di Mauro COMPASS, JRC-IPSC M. Christou MAHB, JRC-IPSC J.-P. Nordvik COMPASS, JRC-IPSC

SUMMARY
In the context of the Institutional Activity COMPASS Risk Comparability and Integrated Risk Assessment of the Joint Research Centre of the European Commission, a specific study entitled: Comparison of Risk Analysis Methods and Development of a Template for Risk Characterisation was conducted. The objective of this study was twofold: 1. to carry out a comparative analysis of existing risk analysis approaches, for estimating the technological accidental risks related with the process industry and the transportation of dangerous goods by road, rail and pipelines, over member States (MS), Candidate Countries (CC) and other relevant countries; and 2. to develop a template for the characterisation of the outcome of risk analysis and of the risk analysis process itself. Objective 1: Comparison of risk analysis practices The first objective was realised by collection of risk analysis requirements and practices in twelve countries, mainly in the EC. The formal requirements of risk analysis mainly refer to the regulatory obligations following from the (implementation of) the Seveso-II Directive. National requirements in the various EC Member States show considerable differences in the way risk analysis is implemented, both in formal regulations and in risk acceptance criteria as well as in the standardisation of practices and availability of tools and guidance for the subject. The most prominent difference is a deterministic approach versus a probabilistic approach in risk analysis and risk evaluation. The choice of either of the two approaches whether determined by technological, or by political and historical reasons appears to be not only a strict country preferred issue. The objective of conducting a risk analysis in a specific situation and the purpose of application of the results, are criteria to give preference to one approach rather than the other. The required nature of a risk analysis depends on the field of decision making for which the results of such an analysis are needed. In this study, at least four objective areas have been distinguished: Application of environmental permit and licence to operate (LIC) Demonstrating the technological safety (state-of-the-art) of an installation and its operation, and defining measures for risk reduction (RRM) Land-use planning (LUP) Preparation for Emergency response (ERP)

In Safety Reports, mandatory as per Seveso-II, all these four issues have to be addressed. Differences, however, exist between countries of the role and priority of risk analysis therein. The conclusions of the actual comparisons are given in this report and in an extensive appendix with the results of data collection through questionnaires. As an additional result, a spreadsheet table has been developed for item-wise comparison of the different risk analysis practices. Objective 2: Development of template(s) for risk characterisation A set of pilot templates has been developed that decision makers can apply to verify the completeness and the quality of a given risk analysis. A set of four different templates is proposed based on the mentioned differences in approach in risk analysis studies, in the area of application of their results and in the interest of the different decision makers. The templates are presented for the purpose of: LIC & RRM, with a deterministic approach; LIC & RRM, with a probabilistic approach; LUP & ERP, with a deterministic approach; LUP & ERP, with a probabilistic approach.

Each template comprises a comparison table with: The five elements of the risk analysis process, chosen for these templates: (i) hazard identification, (ii) frequency assessment, (iii) consequence assessment, (iv) risk figure determination, and (v) decision making. For each element: (i) the method(s) applied; (ii) the tool(s) and model(s) available or used; and (iii) the result obtained in the respective phase.

The templates can be used as a tick-table and may be completed with specific data drawn from the risk analysis report. Recommendations for introduction of the templates The templates were developed in a desk exercise. The objectives and the envisaged end-users (stakeholders) were determined in communication with the JRC. It is advised to test and validate these templates on practical use among (categories of) stakeholders, by e.g. translating past risk-analysis studies into the format of the templates. This test and validation should reveal: Whether the format of the template is workable; Whether its contents are complete, in phases and items; Whether it provides the information the decision maker needs; Whether a system of scoring of the quality of a risk analysis shall/can be developed, and which weighting factors shall then be applied; Whether written guidance and instruction in the application would be sufficient, or practical training will be required; How the template(s) can be made to living documents, to satisfy the application on the longer term in the dynamic discipline of risk analysis.

CONTENTS
1 2 Introduction ................................................................................................................................................ 7 Issues of the study ...................................................................................................................................... 7 2.1 2.2 2.3 3 3.1 3.2 3.3 Background to this study..................................................................................................................... 7 Objectives of risk analysis .................................................................................................................. 8 Different appreciations of risk analysis............................................................................................... 8 Main phases ........................................................................................................................................ 9 Steps of the risk analysis procedure .................................................................................................... 9 Example: Risk analysis for land-use planning .................................................................................. 10 The consequence-based Methods........................................................................................... 10 The risk-based Methods ......................................................................................................... 10 Hybrid Methods ......................................................................................................................... 10 State-of-the-Art Approach................................................................................................... 11

General procedure for risk analysis............................................................................................................ 9

3.3.1 3.3.2 3.3.3 3.3.4 3.4 4 4.1

Other objectives of risk analysis and their approaches ..................................................................... 11 Inventory sources and methods......................................................................................................... 12 Questionnaire............................................................................................................................. 12 Selection of countries ................................................................................................................ 12 The Netherlands......................................................................................................................... 13 Belgium / Flanders..................................................................................................................... 13 Germany .................................................................................................................................... 13 France ........................................................................................................................................ 14 United Kingdom ........................................................................................................................ 14 Spain .......................................................................................................................................... 15 Finland ....................................................................................................................................... 15 Switzerland ................................................................................................................................ 15 Greece ........................................................................................................................................ 16 Sweden....................................................................................................................................... 17 United States of America........................................................................................................... 17 Israel .......................................................................................................................................... 17 General observations ................................................................................................................. 17 Conclusions on comparability ................................................................................................... 18

Inventory of data from various countries: methods and results ............................................................... 12 4.1.1 4.1.2 4.2 4.2.1 4.2.2 4.2.3 4.2.4 4.2.5 4.2.6 4.2.7 4.2.8 4.2.9 4.2.10 4.2.11 4.2.12 4.3 4.3.1 4.3.2

Inventory results................................................................................................................................ 13

Observations and conclusions from comparison over seven countries............................................. 17

Risk analysis practices for transport of dangerous materials ................................................................... 21 5.1 5.2 General.............................................................................................................................................. 21 Pipelines transport............................................................................................................................. 21 5

5.3 5.4 5.5 6 6.1 6.2 6.3 6.4 6.5 7

Road and rail transport...................................................................................................................... 22 Acceptance criteria............................................................................................................................ 23 Developments and current studies .................................................................................................... 23 Objectives of the template................................................................................................................. 24 Considerations on structure and contents of the template................................................................. 24 Templates instruction for use........................................................................................................... 26 The templates .................................................................................................................................... 26 Recommendations for introduction of the templates ........................................................................ 37

Template Development: Risk analysis Comparison scheme.................................................................... 24

References ................................................................................................................................................ 37

Appendices Annex 1 Annex 2 Annex 3 Annex 4 Annex 5 Risk Analysis Comparison Scheme: Fixed installations Results of Comparison, Item-Wise Explanation of Terminology Detailed description of risk analysis process in seven EU countries Risk analysis methods and practices in seven EU countries, spreadsheet for comparison

Introduction
Under the 6th Framework Program of the European Commission (EC), DG Joint Research Centre is carrying out an Institutional Activity called COMPASS Risk Comparability and Integrated Risk Assessment. In this context, DG JRC conducted, in close cooperation with TNO Environment, Energy and Process Innovation (TNO-MEP) b , The Netherlands, a study entitled Comparison of Risk Analysis Methods and Development of a Template for Risk Characterisation. The objectives of this study were: (i) To carry out a comparative analysis of existing risk analysis approaches, for estimating the technological accidental risks related with the process industry and the transportation of dangerous goods by road, rail and pipelines, over member States (MS), Candidate Countries (CC) and other relevant counties; and (ii) To develop a template for the characterisation of the outcome of risk analysis and of the risk analysis process itself. The results of the study are presented in this report.

2 2.1

Issues of the study Background to this study

In all decision making processes where risks to the public, to employees, to the environment or to property are involved, some kind of risk analysis is required. This particularly holds for the so called higher tier Seveso-II enterprises, where the operator has to demonstrate that he has identified the risks of the hazardous installation(s) and that these risks are controlled, managed and prepared for. But also for lower tier companies and for transport of dangerous goods, the potential risks to the surrounding areas are often considered for decision making on the prime objectives: environmental permits, land-use planning or emergency response planning. Technological risks are dealt with differently in different applications (industries) and in different circumstances (regulatory regimes)2,3,4,5,6. Decision-makers are therefore confronted with a variety of approaches, methodologies and forms to evaluate and present a specific risk, a fact that makes the comparison of risk studies performed by different analysts or for different end-users a difficult task. Non-uniformity in methods, data and applications has significantly hampered the widespread use of risk assessment for decision-making purposes. In the EU Member States, considerably big differences exist in both the extent of prescribed procedures for, and the type of result of risk analysis, as well as in the use of (quantified) risk criteria for decisionmaking in the various purposes listed in section 2.2. These differences in approaches and results may pose a problem to decision makers in interpretation of results of different risk studies. Another complicating consequence arises for (management of) multi-national companies, who are confronted with differing requirements between the different EU Countries even if production process & control as well as the safety management systems are similar for the entire company, regardless in which country a particular process unit is located. This study distinguished the following issues of risk analysis approaches and practices in Europe: Various objectives of risk analysis: why is it done, what are the results used for and what kind of decisions are based on it? Various countries: what is the risk analysis approach, how is the RA-process carried out and what is the nature of results? Which steps in the process can be distinguished? Which input is used and what are the uncertainties in this process? Various approaches and risk results, and the strictness of regulations and directives in this

Since 1st January 2005 known as: TNO Built Environment and Geosciences, Team Industrial and External Safety.

field (or the freedom of application of preferred methods and models).

2.2

Objectives of risk analysis

Risk analysis for technological hazards can have different objectives, either in isolation or in combination. The most important stakeholders and their objectives are: Competent authorities, for the purpose of environmental permission; Competent authorities, for the purpose of fulfilling safety report obligations, e.g. as per SEVESO-2 requirements; Emergency Response organisations, for the purpose of response preparation; Regional planning authorities, for the purpose of decision making on land-use planning in an area with major hazard industries or dangerous goods transport; Installation owners, for the purpose of identifying priorities in risk reduction or for costbenefit analysis of different risk reduction options. Licence application (LIC) Determination and evaluation of risk reducing measures (RRM) Land-use planning (LUP) Emergency response preparation (ERP),

The objectives (or purposes) of a risk analysis may thus cover the following:

or combinations of two or more of these. The various objectives logically lead to differences in the nature and the extent of risk studies.

2.3

Different appreciations of risk analysis

As described in the IEC/ISO Guide 737 on risk management, it is fundamental to distinguish the risk assessment and the decision-making steps. The guide explains that risk assessment is a part of the risk management process, ended up with the decision. Risk assessment is a tool used to estimate the risk, characterised by the likelihood and severity of specific events. A risk based decision-making process is naturally based on risk assessment criteria, but must also integrate other criteria that can be economical, cultural, ethical, etcetera. It is obvious that the different stakeholders and the differing objectives will lead to a variety of definitions and appreciations of risk. Though there is a common opinion about the definition of risk: Risk = the Probability of an Undesired Outcome, As the definitions of a deterministic and probabilistic approach in risk analysis are often disputed, the key characteristics with respect to this document are the following: the traditional deterministic risk assessment approach is based on conservatively defined values for design or structural reliability in conjunction with a safety factor based on judgment, evidence of satisfactory performance or calibration exercise; in simple words, safety is expressed with 0 (= insufficient safety) or 1 (=sufficient safety).Deterministic quantities can be interpreted as random variables with deviations tending to zero. The probabilistic assessment may be seen as an extension of the deterministic approach, taking into account the variety of physical behaviour, poor information or human error, thus aiming at a more realistic modelling of a structural behaviour. This quantification or even the necessity to quantify- of risk is an issue of a long lasting debate. As far as the risks of hazardous substances are concerned, this debate has as yet not resulted in uniformity in definitions of neither the probability, nor the nature or extent of the outcome. Consequently, the dimension of the risk figure differs in the various applications, and so does the presentation of this figure. 8

In this report, the Outcome is mostly expressed in the consequences for humans of exposure to (the effects of) a release of hazardous material. These consequences may vary from experience of nuisance to serious injures or even death. Alternatively, and depending on the surroundings potentially to be affected or on the objectives of the stakeholder, the outcome may also be damage to the environment, e.g. area of polluted soil, number of killed sea species, etc. The differences in the risk figures applied in various countries are partly due to historical or cultural background. In some cases, a quantified risk value as a basis for decision making is explicitly excluded. This then results in a fully deterministic approach with qualitative outcomes and decision making, like in Germany. In other countries, like UK and The Netherlands, a risk based approach has been adopted.

3 General procedure for risk analysis 3.1 Main phases

In general, the process of the risk analysis methodology comprises the following phases: Hazard identification: to find the parts of the installation, which are of importance with respect to safety including mapping of the origin and causes of possible accidents and the quantities and properties of chemicals used. The HAZID phase may result either in direct measures to reduce the risks (fully deterministic) or in (a list of) scenarios that are to be considered quantitatively in consequences and/or frequencies. Analysis of accident scenarios: to describe the possible modes how an accident can develop, e.g.: a malfunction in a valve triggers other failure modes and gives a release of a dangerous compound to the environment threatening humans. Analysis of frequencies and consequences: the accident scenarios are analysed more thoroughly. The frequency of a scenario occurring and the consequences resulting from the scenario are assessed. The consequences are often measured as the impact on human health or even as mortality. Also, the environmental impacts might be used as a measure. Evaluation of the total risk: the final evaluation of the risk includes a ranking of the scenarios found and might be expressed as a sum of the risk of all the scenarios. The probabilistic approach will define the risk as the product of the frequencies and the consequences. The quantified deterministic approach is based on the possible consequences.

3.2

Steps of the risk analysis procedure

A stepwise procedure of a risk analysis could be listed out as follows e.g.8: Gathering of all relevant information regarding the hazardous activity (e.g. chemical plant) to be analysed and its environment (plant documentation). Listing of the plant sections containing special hazardous substances and having special safety systems (hazard-preventing and consequence-limiting technical and organisational systems). Analysis (e.g. by HAZOP, FMEA, etc.) of the plants danger potential with consideration of the effectiveness of existing safety systems. Evaluation of the results of the hazard analysis as to completeness and accuracy of triggering events and possible hazard/incident scenarios. Definition of the hazard/incident scenarios to be investigated resulting in event sequences; quantitative statement of the frequency of occurrence of triggering events; definition and analysis of triggering events in the same manner. Determination of the effects of individual hazard/incident scenarios (e.g. spread of toxic substances, pressure shock waves, thermal radiation). The calculated effects of the different hazard/incident scenarios are evaluated on the basis of evaluation criteria (e.g. IDLH values or Probit functions for substances that are toxic when inhaled, or limit values for pressure shock wave strength and thermal radiation intensity). Combination of the quantitatively determined and evaluated effects and the determined/calculated 9

frequencies of occurrence of individual hazard/incident scenarios for the purpose of risk estimation. Summation of all individual scenarios resulting in the chemical plants total risk; evaluation of the total risk.

Most of the steps are common for both qualitative and quantitative risk analysis. Particularly the first four steps are fully applicable to both the probabilistic as well as the deterministic studies. Differences exist in the extent of quantification in steps 5 and 6. Especially the frequency statement (step 5) in the deterministic approach will be qualitative in nature, and be expressed in terms of quite likely or this has never happened in a similar process. Evidence is given through casuistry of accidents in the past (databases) or through engineering judgements. The consequence assessment however is usually quantified, even in the deterministic approach, especially for scenarios with the potential of affecting people or the environment offsite. In all cases, the eventual conclusions are derived by combination of the two steps 5 and 6. This combination results in an expression of risk (qualitative or semi-quantitative or fully quantitative). This risk figure forms the basis for decision making about acceptability of the level of risk, necessity of risk reduction, required accident preparedness, etc. In the following sections 3.3 and 3.4, the different approaches of risk analysis used for the purpose of land-use planning are described. The purpose of these sections is mainly illustrative.

3.3

Example: Risk analysis for land-use planning

Currently the following methods in use for risk assessment in Land Use Planning may be distinguished9.

3.3.1

The consequence-based Methods The consequence based approach follows the assessment of consequences of pre-selected credible (or conceivable) accidents, without quantifying the likelihood of these accidents. The pre-selected reference scenarios can be chosen in various ways, either by a numerical or nonnumerical consideration of the likelihood of occurrence or by simple expert judgement. The consequences of the accidents mostly are taken into consideration by calculating the distance in which the physical and/or human health - relevant magnitude describing the effects (e.g. toxic concentration) reaches, for a given exposure period, a threshold value corresponding to the beginning of the undesired effect (e.g. irreversible health effect/harm or fatality).

3.3.2

The risk-based Methods The risk-based approach presents the risk usually in the form of a numerical value for the likelihood of a certain undesired effect. The related methods have an underlying calculation of the consequences stemming from selected accidents. The consequence calculation may be identical like the one carried out in the consequence-based methods; also the scenario selection may be the same. The main difference lies in the additional use of the numerical value of the occurrence likelihood of the scenario which finally defines the likelihood of the calculated undesired effect (with supplementary factors, e.g. the likelihood of weather conditions).

3.3.3

Hybrid Methods Semi-Quantitative Methods: The semi-quantitative methods are a specific subcategory of the risk-based methods. Here explicitly a quantitative element (e.g. likelihood analysis) is accompanied by a qualitative one (e.g. the consequence assessment). Tables of fixed distances: Tables of fixed distances may be considered as a simplified form of the consequence-based method, most common as a rough consequence estimate based on selected scenarios, or in their most simple form they may have been derived from expert judgment, including consideration of historical data or the experience from operating similar plants and are developed on a rather conservative basis 10

Tables of appropriate distances are often used because of the limited relevance of the case. The distance extent depends mainly on the type of industrial activity or on the quantity and type of the hazardous substances present; design characteristics, safety measures and particular features of the establishment under question are not explicitly taken into account. 3.3.4 State-of-the-Art Approach The State-of-the-Art Approach is not a RA method for LUP in the strict sense. The underlying philosophy is based on the idea that if measures exist sufficient to protect the population from an accident considered to be the worst conceivable, sufficient protection will also be available for any less serious incident. It is assumed that the consideration of the consequences of the worst conceivable accident (including a precautionary element) has been carried out during the identification of a specific State-of-the-Art. As the deterministic foundations of the underlying assumptions are mostly not retraceable it is necessary to have an add-on consequence-based method. As a synthesis of the summary above, the following most important common best practice elements of risk assessment in LUP may be listed: Scenarios: they are used either directly in different numbers, pre-selected (reference) or implicitly e.g. for generic distance tables scenario selection Event Frequencies: the event frequency is either a factor directly necessary for the assessment method or it appears implicitly in other form, e.g. as limiting condition for the scenario definition determination models & frequency data. Endpoint Values: they are applied either for individual consequence calculations or are considered implicitly in a generic form underlying basics for risk/consequence evaluation. Technical Measures: they influence the event frequency consideration (the acknowledged level of confidence may vary) or are proposed as additional measures to reduce the likelihood of an undesired event or limit the consequences (with different ways to impose them) feasibility of technical measures vs. incompatibility of situations.

3.4

Other objectives of risk analysis and their approaches

The example in section 3.3 was worked out for various options of risk analysis for land-use planning. It is obvious that this application requires some kind of measuring, either of risk (probabilistic) or of consequences (deterministic). Setting safety zones or defining exclusion zones requires to some extent the use of modelling and computation. Also for off-site emergency response planning (ERP) and the definition of resource requirements, estimation of potential consequence areas and/or numbers of potential victims of a calamity requires an approach that indicates clearly the zones of concern. Response organisations often define a few reference incidents (scenarios) for training and preparedness. Risk analysis for licence application (LIC) or for identification of risk reducing measures (RRM) is often qualitative or semi-quantitative in nature. Structured techniques and lessons learned are applied to determine the required level of safety, judged against qualitative principles like State-of-the-Art, As Low As Reasonable Achievable (ALARA), or Practicable (ALARP), Best Available Technique (BAT), Best Practice, etc. At the other hand, in some applications a fully quantified probabilistic approach is followed, for instance in power generation and in nuclear reactors. A last possible objective of risk analysis mentioned here, is occupational safety: the risk that workers are exposed to during their job. Both deterministic methodologies as well as probabilistic quantification are applied. Moreover, human reliability assessment and ergonomics are disciplines that are exploited in occupational risk analysis. Statistical evaluation of accident histories forms an important element of focussing on particular risky jobs. The issue of internal risks is excluded from the scope of this study.e.g. 10

11

4 Inventory of data from various countries: methods and results 4.1 Inventory sources and methods
The comparison of risk analysis methods applied in various countries and by various organisations was aimed at describing the actual situation: which are the current practices and what is the nature of results? In principle, the inventory should focus on information available in open bibliography in sources like periodicals, conference proceedings and the internet. These open sources however appeared not sufficiently detailed or accessible for a full comparison of all issues of relevance. Therefore a direct collection of data from a representative sample of countries was considered necessary to provide the issues that are relevant for the comparison of risk analysis practices and for the development of a comparison template. 4.1.1 Questionnaire During the study, it appeared that a thorough inventory of practices and methodologies would not be feasible without enquiries of persons and organisations directly involved in decision-making about risk analysis or in doing such studies. A format of an elementary questionnaire was developed and sent out to representatives in a limited number of countries. The questionnaire comprised the inventory of the following main issues: 1) Definition of risk, or risk characterisation 2) Methodology of risk analysis Overall structure and phasing Methods of hazard identification Frequency assessment Consequence assessment Risk calculation and presentation

3) Risk mapping and decision making The questionnaire (Annex 1), called Comparison Scheme, together with a Clarification document were filled in for the situation in The Netherlands, serving as a format to other countries to ensure uniformity in the collection of data. 4.1.2 Selection of countries It appeared that in many countries, especially in the newly accessed EU Member States, a clear policy on implementation of Seveso-II was not yet in place. It was therefore decided that the detailed inventory could best be carried out for a limited number of key countries, based on intensity of industrialisation and on regions where the policy development and the time of learning experience would be more or less in a stage of maturity. The following regions and countries were selected: Western Europe: The Netherlands (NL), Belgium (BE), United Kingdom (UK), Germany (DE); Southern Europe & Mediterranean: France (FR), Spain (ES), Greece (GR); Northern Europe / Scandinavia: Finland (FI).

The questionnaire was sent to one representative per a country. From countries that were approached with the full questionnaire, information was received from FR, DE, ES and FI. For BE and UK, part of the information was gathered from various internet sites and in the scope of the project SHAPE-RISK11. Additional information from other countries that was collected during literature searches and/or from hands-on experience within TNO is also included in the inventory. Such information is reported here as well, but in a less structured format than for the above named countries. This also includes a few countries outside Europe: USA and Israel. 12

The findings of the various countries / practices are summarised in section 4.2 and in Annex 2. Section 4.3 summarises the key findings of the comparison, similarities and differences.

4.2

Inventory results
In this section, the results of the inventories in various countries are given.

4.2.1

The Netherlands In The Netherlands, a fully quantified probabilistic risk assessment (QRA) is required in the safety report for each of the top tier Seveso-II sites. Moreover, competent authorities may require a QRA to be carried out as part of a permit procedure for new installations or for urban developments, also for nonSeveso installations. The scenarios for the QRA have been prefixed by the national Committee for the Prevention of Disasters (CPR). Acceptance criteria are in place both for location specific risk (individual risk) and for societal risk, outside the plants boundaries. Additionally, for specific types of enterprises fixed safety zoning distances between the installation and the populated surroundings are applied. These zoning distances are also risk based; they reflect the (average) distance for location specific risk LR = 10-6/year. The so called national Committee for the Prevention of Disasters (CPR)12 has issued several guidelines on modelling and quantifying the risks and the consequences of dealing with dangerous materials. These coloured books form the standard for QRAs in the Netherlands and are increasingly used in countries abroad as well. The Purple Book (CPR-18E)12 gives the standardised procedures for a QRA in the Netherlands, including reference scenarios for equipment on industrial sites and for transport of dangerous goods by road and rail and over inland waterways, and their frequency of occurrence. The Yellow Book (CPR-14E)12 presents recommended models for physical effect calculations for the release, evaporation and dispersion of hazardous materials and for assessing thermal radiation due to fire, overpressures due to explosion and exposure to toxic dose. In the Green Book (CPR-16E)12 one finds models for assessing the potential damage due to exposure to the mentioned effects. In practice, over 90% of the QRAs follow the mentioned CPR guidelines. Substitution of the recommended methods, models and figures by alternative solutions would only be accepted if the alternatives are demonstrated to be more appropriate to the subject of study. This then requires the consent of the competent authority.

4.2.2

Belgium / Flanders Belgium is a federal state where regulations and their implementation are different for the two regions Flanders and Walloon. The Flemish approach is strongly related to the Dutch one (probabilistic). The Dutch CPR guidelines are also recommended as standard in Flanders. For probability and frequency assessment, the Flemish authorities13 have developed their own set of figures. For the acceptance criteria for location specific risk three types of surroundings are distinguished: the boundary of the establishment, the boundary of the industrial area and the location of vulnerable objects. Moreover, distinction is made in the tolerance limits between existing situations and new ones.

4.2.3

Germany The German approach14 is a fully deterministic one. This follows from a constitutional requirement that, in principle, activities that can lead to accidents with life- or health threatening effects shall never be tolerated. This principle was further acknowledged in procedures around the Kalkar debate in the late 1970s. Whatever measures can be taken to reduce the possibility of occurrence of such accidents shall be applied. The risk analysis thus forms the basis for evaluating whether state-of-the-art technologies are applied. Application of this is in principle a strict condition for LIC procedures. Basis is a hazard identification process using structured techniques like HAZOP, FMEA and Checklists, as well as accident history and expert opinions. 13

Germany applies generic safety distances between potentially hazardous installations and vulnerable (populated) areas. The values of the safety distances have mostly been derived through expert judgement and based on historical data and experience with similar installations / situations. Eventually, for the remaining hazards the possible consequence areas are assessed. The outcome of the consequence assessment is a consequence distance for (a limited number of) foreseeable accident scenarios. Quantification of damage areas is practically limited to the purpose of LUP. Recently, a discussion has started to explore the possibilities of introducing the probabilistic risk approach in Germany as well. The Strfall Kommission15,16 has issued a discussion document for exploring the feasibility of implementing the risk approach in Germany. This is partly driven by developments like the definition of the Eurocodes c which are of semi-probabilistic nature, partly by the multinational character of companies; nevertheless the future implication cannot be foreseen currently. 4.2.4 France Till recently, the French regulations followed the deterministic approach. The requirements comprised the presentation of consequence distances for a number of scenarios that are to be determined by the plant owner. Some guidelines on modelling were available, but no strict requirements were set. This has changed after the Toulouse tragedy in 2001 where a series of explosions of ammonium nitrate caused about twenty fatalities, multiple number of injures and extensive property damage. Since then, the French government has issued several new and stricter regulations, especially for land-use planning17,18,19,20. Several guidelines are now available giving the types of loss of containment, analytical equations for assessing consequence distances for typical events, and prescription of the presentation of the results. End points of calculations are clearly set, e.g. levels of heat radiation or toxic exposure. Also the procedures followed to select scenarios to be included in the safety report, have recently been set more clear and uniform. This includes mandatory consultation of accident databases, structured identification methods (e.g. HAZOP) and selection of relevant scenarios with the help of a risk matrix. A quantified frequency assessment is (will be) required to give evidence that the likelihood of certain scenarios is sufficiently low (e.g. < 10-6/year) in order to rule them out from the external effects calculations. A (revised) set of requirements is expected to be issued in 2005. The French government has assigned a limited number of independent experts (Tiers Experts) that will assist in the evaluation of safety reports submitted by the plant owners. These experts regularly meet to exchange views and experiences, which results in more uniformity and increasing understanding about the issues of risk analysis. Their conclusions will probably be reflected in the future guidelines. It appears obvious that the current practice in France is a very dynamic one, in which the probabilistic phenomena will receive an increasing interest.21,22 4.2.5 United Kingdom In the United Kingdom, the risk analysis approach is primarily a probabilistic one. In safety reports according to Seveso-II (COMAH), a quantified risk assessment is required. The procedures for a QRA are not very strictly prescribed, though the competent authority, the UK-HSE, has developed several guidance documents23,24,25 for assisting the risk analysts. The QRA procedure and phasing is one according to proportionality, which means that the extent of detail of a QRA shall be proportional to the risk generated and/or to the complexity of the process or installation in question. In practice, this means that for relatively simple situations a deterministic or even qualitative approach is followed. If then no (external) hazard is expected, the procedure of risk analysis is satisfied. However, in cases where off-site hazard may occur or high societal concerns exist, a more in depth analysis of scenarios, their causes and mitigating measures is required. Quantified probabilistic assessment of these issues is then required. In decision-making, ALARP26,27 motivation plays a crucial role. Acceptability criteria are set for both individual risk and societal risk. The HSE will provide recommendations with regard to a planned (urban or industrial) development: advise against or dont

Eurocode: Harmonized European set of structural design codes for building and civil engineering works

14

advise against. 4.2.6 Spain In Spain, the formal national requirements with regard to Seveso-II are described in the Directriz Basica28. The approach with regard to risk analysis is basically a deterministic one. For a number of accident scenarios, the consequence areas (distances) have to be assessed and mapped for a set of prescribed effect values like heat radiation and explosion overpressure29. Not only areas for fatalities are required, but also areas with potential injures. The values are directly related to emergency response levels. Except for Catalonia, policy for using risk analysis for LIC or LUP appears hardly to exist in Spain. Regional differences are observed in Spain. In the province Catalonia for instance, the regional authorities often require a probabilistic assessment to be provided in addition to the national requirements. Use of the Dutch tools and CPR-models is encouraged. 4.2.7 Finland In Finland30, the deterministic risk assessment approach is applied in the industry related to dangerous chemicals. Finnish chemicals legislation doesn't specify the methods that should be used in identifying hazards or evaluating risks. The competent authority (TUKES) requires a description and the control of possible hazards at the plant, as well as measures for protection and intervention in the limiting of the consequences of accidents. At the higher tier plants the use of systematic methods is required by the competent authority. Consequences of major accidents are usually evaluated by using the models of accidental releases. The results of risk analysis can also be used for emergency response planning, by the local rescue services. Risks are often evaluated by using a semi quantitative assessment, e.g. a risk matrix, in which an evaluation is based on simple numerical values. In this method evaluated consequences are multiplied by an evaluated likelihood of an incidence. The result describes a severity of a risk. This type of assessment is a prevailing practice in the higher tier plants, but not a mandatory one for submission in a safety report. For the revising and evaluation of the Safety Reports, TUKES uses a "workbook" in which the method is based on the EFQM model, on quality management. The workbook contains information on required criteria. The book is not available to industries and consultants. 4.2.8 Switzerland Although Switzerland is not an EU Member State, the Swiss Agency for the Environment, Forest and Landscape (SAEFL, BUWAL) has reflected the Seveso II Directive in most of the regulations with regard to major hazard industries: the Ordinance on Protection against Major Accidents (OMA)31. This Ordinance reflects well-established procedures in risk control, in particular those used in The Netherlands in the context of the environment control policy, e.g. the quantitative risk approach. At the same time, the OMA requires implementation of the state-of-the-art technology in agreement with the German practice. The following definitions for hazard potential and risk are given in OMA: Hazard potential means the sum of all the consequences which substances, products, special wastes, micro-organisms or dangerous goods could have as a result of their quantity and properties. Risk shall be determined by the extent of the possible damage to the population or the environment, caused by major accidents and by the probability of the latter occurring.

Assessment of hazard potential and risks is done in a two steps procedure: (1) submission of a Summary Report by the facility owner, and (2) submission of a quantitative risk assessment (QRA), in case the Summary Report shows that major accidents and serious damage must be expected. Fault/Event-tree assessment is an essential element in QRAs in Switzerland. In addition to this top-down approach, also a bottom-up approach of causes is encouraged, for instance through HAZOP, FMEA and similar. The need for consistency in the application of the OMA and in the conduct of QRAs was recognised in an early stage. Therefore, the SAEFL published a series of guidance documents for risk analysts and 15

reviewers. The objective of risk assessment is twofold: (i) to control the risk level of the major hazard facilities, and (ii) to inform the public. Considerable effort has been put into making the hazard and risk assessment simple and accessible to the facility owners. Still, it is expected that both risk analysts and reviewers be knowledgeable in the principles of QRA. The consequence models are supported by LoC events defined in the Manuals. Typically, in Switzerland the (presentation of) risk assessment covers more than only danger to life among the public. Damage indicators (Disaster Values) have been defined in the OMA, covering damage to man, natural resources, and property. For each hazard recipient the Disaster Values are expressed on a uniform scale of three categories: Accident, Major Accident and Catastrophe. In the societal risk curve, these Disaster Values are presented against the expected frequency of occurrence. The acceptability matrix of the curve presents four domains, namely: 4.2.9 No serious damage, i.e. no group risk: < 10 fatalities, or < 100 injures; Acceptable: 10 fatalities at f < 10-7/year, with N2 rule for risk aversion; Unacceptable: 10 fatalities at f > 10-5/year, with N2 rule for risk aversion; Transition, the area between Acceptable and Unacceptable. Greece In Greece, the requirements for the safety report are limited to common interpretations of the Seveso II text, and thus neither quantitative risk analysis nor environmental risk studies are required. As far as safety report supporting instruments are concerned, Greek practice is poor in instruments and guidance32. The single exception is a zoning system with certain consequence criteria that have been widely accepted since they have been proposed by the Ministry of Environment for the external emergency plan of industrial areas. The zoning system comprises three levels of consequences that are based on damage criteria such as TLVs for toxic substances and certain thermal doses and overpressures. This system is widely accepted but not formally adopted. Safety reports have been developed using these criteria to identify the extent of possible damage in the surroundings of the establishments. In Greece, formal risk criteria are neither used, nor have they been proposed by any of the cooperating authorities. Some safety reports were developed with the support of certain risk criteria used in industrial practices of other EU member states. The Greek authorities have planned a programme to develop national guidance documents and to provide training to authority employees, in order to create more uniformity and consensus in risk analysis practices. From an investigation (questionnaire) taken from a few Seveso higher tier companies in the scope of SHAPE-RISK, the following information on used methods was collected: For hazard identification and/or LoC definition: International databases of failure records, Reports from equipment reviews, Checklists, Literature and international guidelines, Reports on lessons learnt and on near miss analysis, LNG Standards from NFPA and EN. For identification of failure causes: HAZOP, Accident analysis, What-If, Fault-tree & Event-tree, International guidelines. For consequence assessment: Gas/toxic cloud dispersion model in PHAST-Pro (refineries), Scenarios for release and ignition of LNG: dispersion with DEGADIS. For QRA: QRA is not required

Although QRA is not required nor guidance on quantitative data is given, the following information and data sources are mentioned for risk assessment: Seveso I: individual risk and societal risk; Seveso-II: Dose zones Dose zones defined by the Ministry of Environment Meteorological data 16

Substance characteristics Quantification of external effects based on distances of toxicity and radiation levels.

4.2.10 Sweden From Sweden, the information is based on documentation from the Rescue Service Agency33. Decision support is based on a risk matrix approach, in which semi-quantitative classification of consequence severity and incident likelihood are presented. Consequences are expressed in human life, damage to the environment and financial loss of property. The results are used to prioritise risks in municipalities, to evaluate possibilities for accident prevention and to plan for emergencies. 4.2.11 United States of America In the USA, the responsibility of risk assessment requirements lays with the US-EPA. They have developed the policy of Risk Management Plan (RMP)34 which requires major hazard industries to submit an RMP document. This document shall provide information primarily required for emergency response planning. Basically, the approach is a deterministic one. At least two scenarios have to be evaluated and to be quantified in terms of consequence distances for each relevant installation: The first one is a major or catastrophic incident, usually defined as the loss of containment of an installation within 10 minutes, at constant rate; The second one is a scenario that is considered to be a more likely serious incident, to be defined by the operator.

For both, the consequences have to be assessed and mapped. The results are communicated to the local authorities and the public, and form the basis for the civil protection agencies and public forums. US-EPA provides guidance documents and consequence assessment software to support a consistent and uniform application of the matter. No evidence has been found that risk analysis results are used for environmental permit procedures. The results do play a role in land-use planning, though no formal risk based acceptance criteria are used. 4.2.12 Israel Although a full QRA is not yet mandatory in Israel, the national Ministry of Environment has adopted the approach of the Dutch Purple Book (CPR-18)12 and requires evaluating LoC events as defined therein. Scenarios that have the potential of life threatening exposure to the public shall be mitigated to a likelihood of occurrence of less than 10-6 per year. The base frequency is taken from the Purple Book, and the effects of mitigating measures must be demonstrated for reduction of the likelihood of exposure to below the set limits. In the Haifa Town area, generally the QRA approach is followed, identical to the Dutch approach. Results are used for permit purposes and for land use decisions.

4.3

Observations and conclusions from comparison over seven countries

The investigation in this report covers the risk analysis approach and practices of twelve countries. For seven of them, an extensive investigation has been carried out. The most obvious or remarkable conclusions of this inventory are discussed in this chapter and are summarised in Table 4.1. An extensive overview of practices is given in Annex 4.

4.3.1

General observations The investigation revealed that different situations exist with regard to homogeneous application of risk analysis methodologies: i) situations where the practices of risk analysis are strictly prescribed by the government or competent authority (e.g. the CPR coloured books12 in The Netherlands); ii) situations where a generally accepted practice is followed without being precisely prescribed; and 17

iii) situations where the initiative to choose and apply the preferred methodologies is left to the operator, for instance because these belong to a companys strategy. For situations (ii) and (iii) the countrys approaches cannot be exactly defined. The approach in Finland for instance appears to be category (iii), while in Germany both (ii) and (iii) seem to exist. The distinction in the mentioned situations is the most obvious in the phase of hazard identification. Another obvious difference in practices applied (or required), even within a specific country, originates from the objective of a particular risk analysis. One may distinguish in the following areas of application: a) permit / license application (LIC); b) evaluating need and means of risk reduction / demonstration of ALARA (RRM); c) land-use planning (LUP); d) emergency response planning (ERP); e) occupational safety (OCS). And finally there is a category of purely administrative reasons: to fulfil the Seveso requirements, because the Directive requires us so! The principle of evaluation whether a certain situation is ALARA (or ALARP: As Low As Reasonably Practicable; or State-of-the-Art) is followed in several countries, but with different background. This can be explained e.g. for the situations in Germany and in United Kingdom. The fundamental difference can be understood as follows: In Germany risk reduction measures are investigated as an integral part of the risk analysis, and are evaluated and considered till the level of justifiable risk is achieved as defined by the State-of-the-Art. Consequence assessment is done in a last stage, when all reasonable options of minimising the risks have been implemented, and only for specific purposes as LUP zoning or emergency response. Contrary, in United Kingdom the evaluation starts with the quantification of consequence and likelihood, and additional risk reduction is proposed if certain acceptance criteria are exceeded. 4.3.2 Conclusions on comparability From the summary in the previous section and Annex 2, it is concluded that there is a big variation in the risk analysis practices in the investigated countries. Comparison of the end results of a risk analysis, the so called risk figure, will therefore be difficult if not impossible for most of the decision makers and stakeholders defined for this investigation. The differences are not only caused by the adopted approach (deterministic versus probabilistic), but also by a number of other factors like: The procedures of selecting scenarios relevant for the risk analysis, and for discarding others. Some situations allow discarding scenarios because of their limited consequences (e.g. no harm outside the fence), while others allow neglecting the worst case scenarios which are considered too incredible (very low frequency), or they are entirely used only for emergency response. In other words: in one case the selection (and negation) of safety-relevant installations and scenarios is done on the basis of consequence, while in other situations this is done on the basis of likelihood. The purpose of the risk analysis is another cause of differences in the analysis results. For example, it is obvious that differences occur in the levels of calculated consequences that will be used for emergency response planning and those used for land-use planning. These differences are reflected, among others, in the values of the end-point of calculation. These appear to vary by a factor of 3 to 6 for thermal radiation and overpressure, and even more for toxic materials. There appears to be a significant difference in the definition of e.g. individual risk between the two probabilistic approaches of United Kingdom and The Netherlands. The main difference lies in the definition of the respective consequences: In the Dutch definition, the reference consequence is (the likelihood of) fatality. For instance: if at a certain location an effect occurs that would lead to 50% fatality, according to a probit function, then the individual risk is 0.5 times the frequency that the effect occurs. Likewise the effect resulting in 1% fatality leads to an individual risk equal to 0.01 times the frequency of the effect. 18

In the English definition, the figure of individual risk is not corrected for this consequence factor. The IR is expressed as the frequency that a person receives a harm (= exposure to an effect) that would result in 50% or 1% fatality.

Eventually, the risk figures may differ by a factor of 100 in the area away from the scene of the accident, only due to this difference in definitions. Regarding tools and methods, the following is observed: In most of the countries, casuistry of past accident is used as one of the means of hazard identification. Accident databases are used for that. It appears that the various countries use only their own database, while sharing experience between data sources would probably reveal additional relevant scenarios which are now easily overlooked. The following databases have been mentioned in this study: FACTS (NL), MHIDAS (UK), ZEMA (DE), ARIA (FR), VARO (FI) and MARS (EU). Harmonisation in consequence modelling would probably also limit the variation in results, like in the Netherlands.

19

Country Netherlands

Approach P-QRA

Objectives LUP-LIC-RM-ER

Risk IR, SR (cumul)

HAZID Generic LoCs, CPR18

Frequency CPR-18

Consequences CPR-14/16

End-point 1% fatality: heat radiation 9.8 kW/m^2, overpressure 100 mbar, toxic 1% lethality according to probit function AGW, VRW

Risk figure IR: contours 10-4 10-8 SR: fN curve

Tools CPR-14/16/18; several software accepted.

Criteria IR strict: < 10-6 GR advised: 10 fat < 10-5, fN2

Belgium / Flanders

P-QRA

LIC-LUP-ER

IR, SR (cumul)

Generic LoCs

Aminal

CPR-14/16

1% fatality: heat radiation 9.8 kW/m^2, overpressure 40 mbar, toxic 1% lethality according to probit function AGW, VRW

IR: contours 10-4 10-8 SR: fN curve

Aminal + CPR14/16/18; several software accepted.

IR three levels, and separate for existing and new. GR advised: 10 fat < 10-5, fN1; N<1000

Germany

D-QL

LIC-RM-LUP-ER

N.A.

HAZOP + Experts

N.A.

VDI + international models Distances SEL & SEI

Toxic: ERPG-2 and ERPG-3; Heat radiation 1.6 kW/m^2; explosion 0.1 bar Thermal radiation: SEL = 5 kW/m2 , SEI = 3 kW/m^2. Overpressure: SEL = 140 mbar, SEI = 50 mbar. Toxics: SEL (1% and 5%) and SEI; IDLH.

N.A.

No fixed models; VDI models preferred. UIC, UFIP, CPR14

N.A.

France

D-QL/QN

LIC-RM-LUP-ER

N.A.

Casuistry + HAZOP + generic LoCs

N.A. Risk matrix for selection of LoCs

SEL & SEI

SEL and SEI for two categories of urban development: housing and public buildings. IR: 10-6; public 10-4.

United Kingdom

D-QLP-QRA (proportionality)

LIC-RM-LUP

IR, SR

Generic LoCs

Generic figures and CPR-18

Company models; HSE guidance; CPR14

Probit-based values for hypothetical person: 1%, 10% and 50% fatality. Thermal radiation 500 (kW/m^2)^4/3,s; overpressure 70 mbar Probit-based for thermal radiation and toxics. Thermal: ZI = 250 TDU, ZA = 115 TDU, ZD = 8 kW/m^2. Overpressure: ZI = 125 mbar, ZA = 50 mbar, ZD = 160 mbar. Toxics ZI = ERPG-2, ZA = ERPG-1. Not specified. Safety / separation distances are specified for avoiding domino effects.

IR: contours GR: for indiv. LoCs

HSE guidance documents; no preferred software.

Spain

D-QN

ER

N.A., except for Catalonia

No fixed method

N.A., except for Catalonia with CPR-18

Effects not fixed. Damage criteria in DB.

N.A., except for Catalonia

Nothing fixed

N.A.; criteria drafted for Catalonia.

Finland

D-QL/QN

LIC

N.A.

No fixed method

N.A.

No fixed models

N.A.

Consequence models + Workbook for the evaluation of safety reports

N.A.

20

5 5.1

Risk analysis practices for transport of dangerous materials General

The main scope of this investigation is primarily focussed on installations falling under SEVESO-II Directive. In practice, local decision makers also have to deal with the risks of transport of dangerous goods. Massive amounts of chemicals like chlorine, ammonia, LPG and gasoline are transported between industrial sites and harbour terminals, often crossing country boundaries. Transportation routes (road, rail, pipeline and sometimes also water) often cross densely populated areas and cities for which urban development and emergency preparedness are a matter of great concern to the public and to the local authorities. Especially around railway stations, which are usually located in city centres, the presence of many people is a common issue (train passengers, other public transport, offices and houses) together with passing transports of dangerous chemicals. An accident may result in many casualties. Another issue of concern are road- and rail tunnels where high capital loss and societal disruption may occur in case of an accident with flammable materials transport. Essentially, there are three different situations (objectives) for which a risk assessment for transport can be made: A. Risk inventory for environmental or land-use planning: e.g. risk maps, of transport routes and emergency planning. B. Risk comparison of different transport options, such as planning of transport streams and transport routes: e.g. evaluation of different options for transport modes and/or transport routes. C. Risk assessment for a specific location: e.g. check on risk criteria and the effect of specific measures. From a global inventory of practices and experiences of application of risk analysis in various countries it can be concluded that several transport risk studies have been conducted in the past, but that harmonisation of approaches and criteria still hardly exist. An in-depth evaluation of practices across Europe appeared not feasible within the scope of this study. Insufficient data has been collected to develop a specific template for the comparison of risk analysis approaches and results between the various countries. Therefore, this chapter gives a non-limitative overview of observations of experiences and developments in this field.

5.2

Pipelines transport
The major application of pipeline transport in Europe is for distribution of natural gas. Millions of kilometres of NG pipelines cross the states and the continent. Other applications of pipeline transport comprise oil products (crude oil, gasoline, diesel oil, kerosene, LPG) and general purpose chemicals like ammonia, ethylene, propylene, etc. Moreover, between industrial sites and (harbour) terminals several chemicals are transferred by pipelines, including acrylonitril, benzene, LPG products, chlorine, etc. In most countries, there exists a policy of reducing risks around natural gas pipelines by application of safety zones. Within such zones, several activities will not be allowed; e.g. no houses or other vulnerable objects shall be built, no ground works or no vegetation shall be applied. Basically, there exist two approaches or philosophies in setting the zoning requirements. The first one aims at protecting the pipeline from being damaged by activities within its direct vicinity. Such activities include construction of buildings, ground digging, excavation, etc., but also (interference with) other infrastructural objects like crossing roads, electrical power cables, etc. Guidelines and codes of practice are in force for the construction and operation of such pipelines and for the design of their surroundings. This includes both safety distances and depth of burial, as well as extra mechanical protection of the pipes. Traditionally, most of these practices have been developed by the pipeline operators who also assume the responsibility of the enforcement of the requirements. 21

The second approach aims at protecting the surroundings from potential hazards caused by the pipeline and its contents. The objective of this approach is to create sufficient distance between the pipeline and vulnerable areas and the public, so as not to cause an unacceptable risk of exposure to the consequences of a release from the pipeline. In countries where this philosophy is followed, mostly the society and the government have initiated the regulations. From risk analysis point of view the two approaches seem to differ fundamentally. The first one primarily aims at avoiding loss of containment from a pipeline, while the second one intends to reduce the (risk of) consequences. In fact, the first approach can be classified as qualitative and deterministic, while the second one is quantified and even probabilistic in some cases. In the Netherlands, for instance, the zoning distances are derived from a QRA determining the 10-6 individual risk contour. In most cases the required safety distances are a function of pipeline properties like internal pressure and pipeline diameter. In a risk based approach, also other protective parameters are taken into account, like: depth of burial, presence of physical protection, presence of isolation stations, leak detection, periodical monitoring of the pipeline track, external interference prevention, public information centre, etc.35 For pipelines other than those for transport of natural gas, specific risk analysis studies are sometimes required within the scope of an Environmental Impact Assessment (EIA). The approaches often follow the national policy on risk assessment and acceptance criteria as applicable for industrial installations. It appears that the development of dedicated methodologies, modelling and failure data sets is still continuing, mostly at national scale. The problem with existing pipelines often is that the exact routes of a pipeline networks are not properly documented in authoritys archives.

5.3

Road and rail transport

The transport of hazardous goods across Europe by road and by rail involves a wide range of chemicals. Harmonisation of regulations exists mainly on the technical and mechanical provisions on the transport vehicles (truck or rail wagon) in RID- and ADR-rules. Most of these requirements are based on qualitative and deterministic approaches, often initiated by lessons from past accidents. Despite these international rules, differences still appear to exist in specific national requirements like safety provisions on the vehicle and traffic rules. Particularly for road transport, the management of risks to the public living or working close to transport routes often appears to be a decentralised concern: a concern of local and regional authorities. Potential high risk situations, where transport routes run close to (or even cross) populated areas, are often solved by assigning dedicated routes for dangerous transport. There are restriction areas for such transports. In most cases, the assignment of routes is done on qualitative sound arguments or because accident statistics show that a certain route poses higher than average risks of traffic accidents. Also the vulnerable surroundings of a certain road may play a role: e.g. avoid dangerous goods transport through a city centre or passing by a school or hospital. A structured and detailed risk analysis is performed only by exception. In practice, a quantitative risk analysis for the purpose of land-use planning or identifying alternative means of transport is only done for large scale transports, e.g. on highways. The option of assigning alternative routes hardly or not exists for rail transport. Public concerns about rail transport through, or marshalling yards located inside densely populated areas have, in some cases, initiated national risk studies for the comparison of alternatives for the mode of transport. In these cases, the preferred approach of risk analysis is mostly the quantitative probabilistic one. In the Purple Book (CPR-18)12, a full section is dedicated to quantitative risk assessment for (road and rail) transport in The Netherlands. The guidelines rely on a limited number of reference scenarios, like catastrophic failure of a tank truck or rail wagon (e.g. BLEVE) or a leak resulting in pool formation of predefined surface area. Also, the relevant substances are categorised, like flammable liquids, flammable gases, very toxic gases, etc. Often, standard consequence distances are applied. Accident frequencies are usually expressed in [LoCs /km.year] or [LoCs / vehicle.km.year]. Increased frequency figures may be assigned to joints, shunts, crosses-over, etc. The quantitative approach is applied in only few countries; it is known for Switzerland36,37, United Kingdom40 and The Netherlands. 22

5.4

Acceptance criteria
Quantitative risk acceptance criteria for transport risks have been introduced in the Netherlands. The location specific risk criterion along transport routes is enforced in a way similar to that of stationary sites: no vulnerable objects shall be allowed within the 10-6 contour. Societal risk is calculated for each kilometre of route length; the indicative acceptance level is a factor of 10 higher than the one for stationary installations: 10-4/year for 10 fatalities.

5.5

Developments and current studies

Within the scope of implementation of Chapter 1.9 of RID/ADR, an RID experts working group on Standardised Risk Analysis was formed by the Intergovernmental Organisation for International Carriage by Rail (OTIF). The first meeting of this experts group was held in April 2004, with participation of representatives from 13 European countries, the EC, chemical industry and 4 transport unions. From the exchange of practices in the various countries, it appears that still big differences exist in the approach of risk analysis and even in recognising the RA-tool as feasible for this purpose. The followup of the activities and developments from this working group is considered very relevant for the future risk analysis policy in the EU and abroad. The reports and contributions of the group and its members may be followed via the internet: http://www.otif.org/html/e/rid_CExp_RID_gt_analyse_risque_doc_inf2004.php. Other recent developments are on tunnel safety and risk39. During the past few years, the need for harmonisation of road tunnel regulations was recognised. Several contact networking is currently taken up and R&D activities for developing risk analysis methodologies for road and rail tunnels are carried out. Risk assessment for tunnels often requires specific models on effects and consequences that free field flat terrain models cannot cope with. Moreover, evacuation modelling gets much attention. In The Netherlands, a study has been carried out on the external risks involved in the entire chain of production, handling and transport of three basis chemicals: chlorine, ammonia and LPG40. When compared to the risk acceptance criteria in the country, most risk constraint were identified in the transport activities of these substances. Quantitative risk analysis on a wider scale was applied to evaluate possible risk reducing measures and alternative means or routes for transport. This evaluation included cost benefit analysis. In Italy, the risks of hazardous materials transport by rail between industrial sites have been studied.41

23

6 Template Development: Risk analysis Comparison scheme 6.1 Objectives of the template
The scope of this study is the development of a template for the characterisation of the risk analysis procedure: a tool that will aid the decision/policy maker in verifying the completeness and the quality of a given risk analysis (process). The template should therefore list out the minimum required information that is necessary to establish: whether a risk analysis contains all necessary steps (completeness); how these steps have been implemented; and whether these steps have been implemented and documented properly so that the risk figure can be used with confidence.

The collection of information on policy and practices in a large number of countries, described in the previous sections, provided the data that needs to be included in the template.

6.2

Considerations on structure and contents of the template

The inventory of practices in several EU Member States and other countries, together with intensive brainstorming about the envisaged comparison tool, has made a number of things clear: The process of a risk analysis, and hence the required outcome, differs to a large extent, depending on the purpose for which it is carried out. The following objectives have been recognised: Demonstrating that a technological process can be operated at an acceptable level of safety, and that state-of-the-art technology is applied. This is often required for the purpose of obtaining an environmental permit or licence to operate (LIC), for insurance premiums (INS) or for setting acceptance criteria for occupational safety (OCC). Evaluating priority areas and measures of risk reduction in a given process or its design (RRM). Prioritising hazards and risks for which emergency preparedness (on-site and/or off-site) is required, and determination of the required resources (ERP). Determination of required safety zones around hazardous activities and of land-use planning / development (LUP). Administrative reasons, for instance because the risk assessment is required according to governing regulations like the Seveso-II Directive or Environmental Impact Assessment (ADM).

The respective different objectives relate to as many different stakeholders and decision makers, like: environmental authorities; land-use planners and developers; emergency services; local, regional, national and even supra-national authorities; industrial operators; workers unions; etc. More explicitly, the following users can be considered: A competent authority that wants to evaluate a given R.A. and to base decisions of LIC, LUP or ERP upon it. Authorities that want to review their risk policy and reflect their own policy to the one of other countries or regions. Countries and authorities that still need to develop a risk policy, or to choose a particular approach from those available; this may hold for the newly accessed Member States. The European Commission that wants to compare safety studies across countries. A multi-national company that receives and evaluates safety reports of separate plants in different EU countries.

Different philosophies and practices in the risk analysis processes have been developed in the past, and are applicable nowadays. The need for these different approaches is not only related to the mentioned different objectives (LIC, RRM, ERP, LUP, etc.), but also to historical and cultural 24

background of countries and the nature of industrial activities. The most pronounced difference is the distinction between the probabilistic risk approach versus the deterministic approach. A further distinction lays in the extent of quantitative measuring of the risks, varying from a purely deterministic approach (demonstrating state-of-the-art, like applied in Germany), via semiquantitative likelihood estimation and quantification of potential consequences (preferred approach in France), to a fully quantified probabilistic approach (as followed in The Netherlands). Differences are also found in the definitions of the dimension of the risk figures as well as in the application of risk acceptance criteria and their regulatory status. A large number of methods, guidelines and tools have been developed, by (multi-national) industries, by research organisations and by national governments. National approaches vary from presenting suggestions of methodologies that may be applied, to prescriptive manuals of accident scenarios to be considered and models and figures to be used in the risk analysis process. The latter is particularly found in cases where the quantified approach is followed.

It is obvious that the number of options and parameters that determine the eventual result of a risk analysis (the risk figure) is too diverse to claim the development of an all-inclusive comparison template. A limited number of comparison schemes have been developed in which the following prime entries are distinguished: Objective/purpose, for the following two clusters: Licence application and risk reducing measures (LIC & RRM); these objectives mainly focus on the safety of process related aspects, like the technological details of the installation, the operation, the safety management system, etc.; Land-use planning and Emergency response planning (LUP & ERP); these objectives mainly focus on the potential external effects and the management of the external consequences. deterministic, possibly with calculation of consequences; probabilistic, possibly partly with semi-quantitative indications.

Basic approaches, for the following two clusters: -

A strict distinction in these approaches cannot be made in all cases. Particularly in application for LUP and ERP, a fully deterministic approach appears not functional. Estimation and calculation of the extent of off-site consequences will always be required. This has resulted in four sets of templates, namely: LIC & RRM, deterministic LIC & RRM, probabilistic LUP & ERP, deterministic LUP & ERP, probabilistic

The developed template is a two-dimensional table that can be used as a tick-list for evaluating the completeness of a given risk analysis. Each template will have a structure comprising: the elements related to a risk analysis, i.e.: hazard identification frequency assessment consequence assessment risk figure decision making methods that are available or applicable for this stage tools and models that can be used or consulted for employing these methods results from the respective phase 25

overview of characteristics (elements) in each phase, distinguished in:

space for comments and clarification.

In practice, the table can be used in hard-copy format or as a digital fill-in table, for instance in MSWORD. The latter provides some space for modifications and inclusion of methods, tools, etc. that were not included in the non-exhaustive templates presented in this study.

6.3

Templates instruction for use

The main objective of the template is the use as a tool to verify the completeness and the quality of a given risk analysis report. Assuming that a competent authority or a decision maker(s) is the assessor body entrusted with the task to evaluate and verify a risk analysis, he/she will use the template basically as a checklist for ticking the completeness of all relevant elements. The quality shall be verified by checking the references of tools and models against the ones listed in the template. In Annex 3, an explanatory list of terms used in the templates is given. The following procedure shall be followed, having at hand the risk analysis study: 1. Selection of the appropriate template, from the four ones attached. It will not be possible in all cases to clearly determine the purpose (LIC&RRM versus LUP&ERP) of the risk analysis. Particularly if the risk analysis has been done as mandatory for Seveso-II requirements and is included in a Safety Report, the distinction in these two objectives is often not present. In such cases, one shall select the template most relevant to the objective of the assessor or decision maker. 2. Verification of addressing all relevant elements. Each of the stages shall be addressed in the process of a risk analysis. Reference to methodologies, guidelines and used tools (e.g. software programmes) shall be available. Elaboration of the last phase, the Decision Making, may be less extensive in case of a risk analysis included in a safety report. In such cases, the risk evaluation and decision making is done after completion of the R.A. and is (partly) the responsibility of the decision maker who assesses the risk analysis results. These results shall then be fit and sufficiently complete to arrive at a sound decision. 3. For detailed scrutiny of the completeness, correctness and quality of each of the phases, each cell in the template (method, tool/model and result) comprises a number of options through which compliance can be identified. In a risk analysis process, at least one element of each cell should be addressed. In several cases, some space is allowed in the table cells for noting detailed information. For example: the number of the used CPR-guideline or the company internal procedure can be noted for further reference, and a software package or database can be indicated. In many cases, more than one element will apply in a specific risk analysis. All addressed elements shall be ticked. Annex 3 gives an extensive list of explanatory definitions of each of these elements. 4. In cases where the application of certain methods and guidelines is mandatory, as per authoritys regulation, the particular elements shall appear in the risk analysis and shall be ticked in the table. Alternatively, the analysis shall clearly motivate whether a different approach has been followed, as well as why, where, when and how. 5. The entire process of the risk analysis shall be logical. This means that the methods followed and the results obtained in one stage, are logically found back in the sequential phase(s). 6. The eventual result (the risk figure) shall obviously be informative to the decision maker as to formulate further requirements like modifications in the analysis, measures or goal-setting of risk reduction or setting safety zones between hazardous or major hazard sites and vulnerable destinations outside the fence lines.

6.4

The templates
The developed templates are presented in the Tables 6.1 to 6.4, for the four combinations of purpose: LIC&RRM versus LUP&ERP, and deterministic versus probabilistic.

26

Table 6.1: Approach: Purpose:

Template Risk Analysis: DETERMINISTIC LICENCE APPLICATION and/or RISK REDUCTION

Installation / activity: Location: Type of hazard: Assessor (name & date):

Method o HAZOP, guide-word approach o What-If o FMECA o Checklist o Fault tree o DOW F&E Index o Risk matrix, not-quantified o Accident database o Other: ..

Tool / model Hazard identification o CCPS guideline o EPSC guideline o CPR guideline: . o Expert opinion: .. o Company internal procedure: .. o Public domain: .. o F&EI guideline, version . o Accident database: o Software: . o Other: Frequency assessment

Result o Measures, hardware: o Measures, software: o Measures, SSM: . o Process / plant modification o Denial of process or permit

Comment / clarification

o None o Qualitative o Qualitative, based on LoCs o Semi-quantitative o Other: .

o CPR guidelines: . o HSE guidelines: o Fault tree o Expert opinions o Identification of measures o Physical barriers o Area classification o Other: .

o None o Semi-quantitative figure

27

Consequence assessment Qualitative: .. o CPR guideline: . o HSE guideline: . o Company internal procedure: . o Software commercial: .. o Software public domain: . o Software other: . Environment and surroundings o Description of surroundings o Identification of vulnerable environment Risk figure o None o Risk matrix o Consequence distance o Authority approved format: consequence distance o Software: . o Other: . o Mapped area(s) at risk o Tabular area(s) at risk o Risk matrix o Other: .. Decision o None o Consequence criteria o Environmental criteria o Approval of licence to operate o Denial of licence to operate o Qualitative: . o Semi-quantitative o Distance of end-point

28

Table 6.2: Approach: Purpose:

Template Risk Analysis: PROBABILISTIC LICENCE APPLICATION and/or RISK REDUCTION

Installation / activity: Location: Type of hazard: Assessor (name & date):

Method o HAZOP, guide-word approach o What-If o FMECA o Checklist o Fault tree o Event tree o Reference LoCs o DOW F&E Index o Risk matrix, quantified o Proportionality o Accident database o Other: .. o Semi-quantitative o Semi-quantitative, based on LoDs o Quantitative, for single LoCs o Quantitative, for single LoCs, and based on LoDs o Other: . o

Tool / model Hazard identification o CCPS guideline o EPSC guideline o CPR guideline: . o Expert opinion: .. o Company internal procedure: .. o Public domain: o F&EI guideline, version . o Risk matrix criteria: . o Accident database: o Software: . o Other: o Frequency assessment o CPR guidelines: . o HSE guidelines: o Database failure frequencies: . o Database ignition sources: . o Fault tree o Company internal figures o Expert opinions

Result o Scenarios: .. Nos. o Measures, hardware: o Measures, software: o Measures, SSM: . o Discarded scenarios: .. Nos o Process / plant modification o Denial of process or permit

Comment / clarification

o Semi-quantitative figure o Quantitative, generic o Quantitative, detailed specific o

29

o Identification of measures o Physical barriers o Area classification o Other: . Consequence assessment Quantitative, Effects: o Release o Gas o Vapour o Liquid o Evaporation o From land o From water o Aerosol o Dispersion o Exposure o Thermal o Overpressure o Toxic dose Quantitative, Damage: o Fatalities o Injuries o Property o Environment o Risk matrix o Frequency assessment Environment and surroundings o Description of surroundings o Inventory of population o Weather distribution o Risk figure o Approved format of frequency presentation o Numerical value of failure frequency 30 End-point values o Exposure dose o Exposure intensity o Emergency response levels: .. o Domino levels o CPR guideline: . o HSE guideline: . o Company internal procedure: . o Handbook approach o Software commercial: .. o Software public domain: . o Software other: . o Qualitative: . o Semi-quantitative, in risk matrix o Casualties o Property loss o Environmental damage o Distance of end-point

o Consequence distance

o Company specific format: . o Software: . o Other: .

o Risk matrix o Other: .. Decision

o None o Risk criteria

o Approval of licence o Denial of licence o Modification of process safety

31

Table 6.3: Approach: Purpose:

Template Risk Analysis: DETERMINISTIC LAND-USE PLANNING and/or OFF-SITE EMERGENCY RESPONSE

Installation / activity: Location: Type of hazard: Assessor (name & date): Result Hazard identification o Scenarios: .. Nos. o Measures, hardware: o Measures, software: o Measures, SSM: . o Discarded scenarios: .. Nos o Process / plant modification o Denial of process or permit Comment / clarification

Method o HAZOP, guide-word approach o What-If o FMECA o Checklist o Fault tree o Reference LoCs o DOW F&E Index o Maximum Credible Accident o Risk matrix, not-quantified o Risk matrix, quantified o Proportionality o Accident database o Other: ..

Tool / model o CCPS guideline o EPSC guideline o CPR guideline: . o Expert opinion: .. o Company internal procedure: .. o Public domain: .. o F&EI guideline, version . o Risk matrix criteria: . o Accident database: o Software: . o Other:

Frequency assessment o None o Qualitative o Semi-quantitative o Semi-quantitative, based on LoDs o Quantitative, for single LoCs o Quantitative, for single LoCs, and o CPR guidelines: . o HSE guidelines: o Database failure frequencies: . o Database ignition sources: . o Fault tree o F&EI credits 32 o None o Semi-quantitative figure o Quantitative, generic o Quantitative, detailed specific

based on LoDs o Other: .

o Company internal figures o Expert opinions o Other: . Consequence assessment

Qualitative: .. Quantitative, Effects: o Release o Gas o Vapour o Liquid o Evaporation o From land o From water o Aerosol o Dispersion o Exposure o Thermal o Overpressure o Toxic dose Quantitative, Damage: o Fatalities o Injuries o Property o Environment o None o Risk matrix

o CPR guideline: . o HSE guideline: . o Company internal procedure: . o Handbook approach o Software commercial: .. o Software public domain: . o Software other: . End-point values o Exposure dose o Exposure intensity o Emergency response levels: .. o Domino levels Environment and surroundings o Description of surroundings o Identification of vulnerable environment o Inventory of population o Inventory of special destinations o Weather distribution

o Qualitative: . o Semi-quantitative, in risk matrix o Off-site casualties o Property loss o Environmental damage o Distance of end-point o Distance of dose o Estimate of casualties o Estimate of financial loss

Risk figure o Authority approved format: consequence distance for single LoCs o Mapped area(s) at risk o Tabular area(s) at risk 33

o Consequence distance o Consequence envelop o Protection zone o Exclusion zone

o Authority approved format: consequence envelop for all LoCs o Company specific format: . o Software: . o Other: .

o Risk matrix o Other: ..

Decision o None o Risk criteria o Consequence criteria o Environmental criteria o Approval of land-use development o Denial of land-use development o Required organisation of ERP o Required resources of ERP o Information for public communication

34

Table 6.4: Approach: Purpose:

Template Risk Analysis: PROBABILISTIC LAND-USE PLANNING and/or OFF-SITE EMERGENCY RESPONSE

Installation / activity: Location: Type of hazard: Assessor (name & date):

Method o o o o o o o o o Checklist Fault tree Reference LoCs DOW F&E Index Maximum Credible Accident Risk matrix, quantified Proportionality Accident database Other: .. o o o o o o o o o o

Tool / model CCPS guideline CPR guideline: . Expert opinion: .. Company internal procedure: .. Public domain: .. F&EI guideline, version . Risk matrix criteria: . Accident database: Software: . Other: CPR guidelines: . HSE guidelines: Database failure frequencies: . Database ignition sources: . Fault tree Event tree F&EI credits Company internal figures Expert opinions Other: . CPR guideline: . HSE guideline: . Company internal procedure: . Handbook approach

Result Hazard identification o Scenarios: .. Nos. o Discarded scenarios: .. Nos o Measures, hardware:

Comment / clarification

o None o Semi-quantitative o Semi-quantitative, based on LoDs o Quantitative, for single LoCs o Quantitative, for single LoCs, and based on LoDs o Other: .

o o o o o o o o o o o o o o

Frequency assessment o None o Semi-quantitative figure o Quantitative figure, generic o Quantitative figure, detailed specific

Quantitative, Effects: o Release o Gas

Consequence assessment o Semi-quantitative, in risk matrix o Off-site casualties o Property loss o Environmental damage 35

o Vapour o Liquid o Evaporation o From land o From water o Aerosol o Dispersion o Neutral gas o Dense gas o Exposure o Thermal o Overpressure o Toxic dose Quantitative, Damage: o Fatalities o Injuries o Property o Environment o Risk matrix o Individual risk calculation o Societal risk calculation o Protection zone determination o Exclusion zone determination

o Software commercial: .. o Software public domain: . o Software other: . End-point values o Exposure dose o Exposure intensity o Emergency response levels: .. o Domino levels Environment and surroundings o Description of surroundings o Identification of vulnerable environment o Inventory of population o Inventory of special destinations o Weather distribution

o o o o o

Distance of end-point Distance of dose Estimate of casualties Estimate of financial loss Consequence envelop

o o o o o o o o o o o o

Risk figure o Mapped area(s) at risk Risk matrix criteria o Tabular area(s) at risk Risk assessment methodology, CPR-18: o Risk matrix Risk assessment methodology, HSE: o Other: .. Format for risk contours Format for fN-curves Company specific format: . Software: . Other: . None Risk criteria Consequence criteria Environmental criteria Decision o Approval of land-use development o Denial of land-use development o Required organisation of ERP o Required resources of ERP o Information for public communication 36

6.5

Recommendations for introduction of the templates

The templates were developed in a desk exercise. The objectives and the envisaged end-users (stakeholders) were determined in communication with the JRC. A full test and validation should be done before the method is introduced and distributed for implementation externally. This should ideally be carried out in collaboration with the end-users. The test and validation of the templates should reveal: Whether the format of the template is workable; Whether its contents is complete, in phases and items; Whether it provides the information the decision maker needs; Whether a system of scoring of the quality of developed, and which weighting factors shall then be applied; a risk analysis shall/can be

Whether written guidance and instruction in the application would be sufficient, or practical training will be required; How the template(s) can be made to living documents, to satisfy the application on the longer term in the dynamic discipline of risk analysis.

References
1. Council Directive 96/82/EC on the control of major-accident hazards involving dangerous substances (SEVESO II Directive), Official Journal of the European Communities No L 10 of 14 January 1997. 2. Dechy, N., Descourriere, S., Bouissou, C., (2004). Recent accident frequency on fixed installations in France and in the EU. Proceedings of the International Conference on Probabilistic Safety Assessment and Management (PSAM 7/ESREL 04), June 14 18 2004, Berlin, Germany. 3. DHV Consultants, (2002). External Safety and Spatial Planning: a case study in eight industrialised countries. For the Netherlands Ministry of VROM (partly in Dutch). 4. Gagliari, R. V., Ludovisi, G. (2004). Case studies in Italy of Potential additional Safety Measures for the Purpose of Land-Use Planning. ISPESL, Proceedings of the International Conference on Probabilistic Safety Assessment and Management (PSAM 7/ESREL 04), June 14 18 2004, Berlin, Germany. 5. Graf, H., Klein, T., Schmid, O. (2004). Explicit Offsite Risk Analysis Methods: Weaknesses and Current Work. Loss Prevention and Safety Promotion in the Process Industries, Proceedings of the 11th International Symposium, Praha, Czech Republic, 31 May - 3 June, 2004. 6. Ministry of Economic Affairs (2000). International comparison of the policy on External Safety (Belgium, Germany, United Kingdom, France and The Netherlands. Ministry of Economic Affairs, The Netherlands (in Dutch). 7. IEC/ISO Guide 73: Risk Management Vocabulary Guidelines for use in standards, First Edition 2002 8. Mannan, M.S. (2005). Lees Loss Prevention in Process Industry: Hazard Identification, Assessment and Control. 3rd Ed. Butterworth Heinemann, 9. Christou, M., Struckl, M., Duffield, S., Salvi, O., Bernuchon E., Hourtolou, D., Post, J., Beerens, H., (2004). Development of European Guidance and Common Risk/Hazard Assessment Database for Land-Use Planning in the Context of Major Accident Hazards. Proceedings of the International Conference on Probabilistic Safety Assessment and Management (PSAM 7/ESREL 04), June 14 18 2004, Berlin, Germany. 10. Health and Safety Executive (2001). Probabilistic Methods Uses and Abuses in Structural Integrity, 37

HSE Research Report 398/2001 11. http://shaperisk.jrc.it/index.html 12. Committee for the Prevention of Disasters (CPR), The Netherlands: i) CPR-12 (Red Book); Methods for determining and processing probabilities (1997). ii) CPR-14 (Yellow Book): Models for the calculation of effects (1997). iii) CPR-16 (Green Book): Models for calculation damages to people and constructions (1992). iv) CPR-18 (Purple Book): Guidance of quantitative Risk Assessment (1999). v) CPR-20 (Grey Book): Information Requirements for BRZO99 (Seveso-II) (1999). 13. AMINAL (2004). Handboek Kanscijfers voor het opstellen van een Veiligheidsrapport (Methodology for the quantitative judgement of safety reports). Ministerie van de Vlaamse Gemeenschap, AMINAL Afdeling Algemeen Milieu- en Natuurbeleid (Flanders Ministry of Environment). (in Flemish) http://www.mina.be/vr_richtlijnen.html 14. Uth, H.-J., Umwelt Bundesamt, Germany: Information provided through investigation questionnaire on October 1st, 2004. 15. Strfall-Kommission beim Bundesministerium fr Umwelt, Naturschutz und Reaktorsicherheit (2004). Risikomanagement im Rahmen der Strfall-Verordnung. Bericht SFK-GS-41. 16. Bundesministerium fuer Umwelt, Naturschutz und Reaktorsicherheit (German Ministry for Environment) (2004). Allgemeine Verwaltungsvorschrift zur Strfall-Verordnung (Entwurf). http://www.bmu.de/anlagensicherheit/doc/6133.php (in German). 17. Ministry for Land-use Planning and the Environment (2004). Principes gnraux pour llaboration et la lecture des tudes de danger. Ministry for Land-use Planning and the Environment, France. 18. Ministry for Land-use Planning and the Environment (2000). Circular letter (to the Prefects, County Chiefs of Police) concerning the prevention of major accidents involving hazardous substances or preparations present in some installations categories classified for the protection of the environment subject to authorisation (implementation of the Directive Seveso-II). Ministry for Land-use Planning and the Environment, France. 19. Ministry of Ecology and Sustainable Development, France i) A new law on risk prevention (September 2003) ii) Policy and Action programme as concerns the prevention of Industrial Risks (September 2003) iii) New legislative tools in France: 30th July 2003; Changes in risk prevention and control www.legifrance.fr and www.aria.environnement.gouv.fr 20. Ministry of Ecology and Sustainable Development (2004). Guide Technique relative aux Valeurs de Rfrence de Seuils deffets des Phnomnes accidentels des Installations Classes. Ministry of Ecology and Sustainable Development, France. 21. Salvi, O., Rodrigues, N., Descourrire, S., Gaston, D. (2004). Towards an evolution of risk assessment and land-use planning (LUP) approaches in France. Proceedings of the International Conference on Probabilistic Safety Assessment and Management (PSAM 7/ESREL 04), June 14 18 2004, Berlin, Germany 22. Salvi, O., Rodrigues, N., Descourrire, S., Gaston, D. (2004). Risk assessment and Decision Making Related to Land-Use Planning in France. Loss Prevention and Safety Promotion in the Process Industries, Proceedings of the 11th International Symposium, Praha, Czech Republic, 31 May - 3 June, 2004. 23. Health and Safety Executive (2002). Comah Safety Reports: Information about the Extent and Severity of the Consequences of Identified Major Accidents. http://www.hse.gov.uk/comah/circular/perm06.htm (last visited on 29th July 2005) 24. Health and Safety Executive (2003). COMAH Safety Report Assessment Manual: How to use the criteria for assessing the information in a safety report during its examination. 38

http://www.hse.gov.uk/hid/land/comah2/pt2ch1a.htm (last visited on 29th July 2005) 25. Health and Safety Executive (2001). HID Safety Report Assessment Guide: LPG. Criteria. http://www.hse.gov.uk/comah/sraglpg (last visited on 29th July 2005) 26. Health and Safety Executive (2001). Reducing risks, Protecting people (R2P2); HSEs decisionmaking process. http://www.hse.gov.uk/risk/theory/r2p2.pdf 27. Health and Safety Executive (2004). HIDs Approach to As Low As Reasonably Practicable (ALARP) Decisions. http://www.hse.gov.uk/comah/circular/perm09.htm (last visited on 29th July 2005) 28. Ministerio de Trabajo y Asuntos Sociales (2003). Directriz Bsica de proteccin civil para el control y planificacin ante el riesgo de accidentes graves en los que intervienen sustancias peligrosas. Ministerio de Trabajo y Asuntos Sociales, Instituto Nacional de Seguridad e Higiene en el Trabajo (in Spanish). http://www.mtas.es/insht/legislation/tl_acc.htm 29. Ministerio de Trabajo y Asuntos Sociales (1991). Documentacin NTP 291: Modelos de vulnerabilidad de las personas por accidentes mayores: Mtodo Probit. Ministerio de Trabajo y Asuntos Sociales, Instituto Nacional de Seguridad e Higiene en el Trabajo (in Spanish). http://www.mtas.es/insht/ntp/ntp_291.htm 30. Rantakoski, P., Vauhkonen, I., TUKES, Finland: Information provided through investigation questionnaire on July 20th and August 31st, 2004. 31. Gmnder, F., Meyer, P., Schiess, M., (2002). The control of major chemical hazards in Switzerland in the Framework of Sustainable development Liquefied Petroleum, Ammonia and Chlorine as examples. Proceedings of the Conference PSAM6, June 23-28, 2002, San Juan, Puerto Rico, USA. 32. van Steen, J., Papapakis, G. (2004). Experience with Seveso II Implementation: Successes and Failures of Safety Reporting and Safety Management Systematising in Two EU Countries (The Netherlands and Greece). Loss Prevention and Safety Promotion in the Process Industries, Proceedings of the 11th International Symposium, Praha, Czech Republic, 31 May - 3 June, 2004. 33. http://www.srv.se/ 34. EPA-CEPP (1999). Risk Management Program Guidance for Offsite Consequence analysis. Environmental Protection Agency EPA-Chemical Emergency Preparedness and Prevention Office CEPP, USA. 35. Plss, C.; Niederbumer, G. and Sgesser, R. (2000): Risk assessment of the Transitgas pipeline, Pipes & Pipelines International, Vol. 45, No. 6. 36. Bundesamt fr Verkehr, Bundesamt fr Umwelt, Wald und Landschaft and Scheizerische Bundesbahnen (2000). Personenrisiken und Wirking von Sicherheitsmassnahmen beim Transport gefhrlicher Gter auf der Bahn (Zusamenfassung der Studie vom November 2000). 37. Bundesamt fr Umwelt, Wald und Landschaft (BUWAL) (2001). Richtlinien: Beurteilungskriterien zur Strfallverordnung StFV (Vorabdruck). Switzerland. 38. HSE (1998): The implications of major hazard sites in close proximity to major transport routes. UK Health and Safety Executive, Contract Research Report 163/1998 (report prepared by WS Atkins Safety & Reliability). 39. Krausmann E., Mushtaq, F. (2005). Analysis of tunnel-accident data and recommendations for data collection and accident investigation, EUR Report 21658 EN, 2005 40. Molag, M., Ham, K., Elbers, S. (2004). Safety Assessment of the Ammonia, Chlorine and LPG Product Chains in the Netherlands. Loss Prevention and Safety Promotion in the Process Industries, Proceedings of the 11th International Symposium, Praha, Czech Republic, 31 May - 3 June, 2004. 41. Antonio, G., Spadoni, G., Milazzo, M., Maschio, G. (2004): Major Accident Risks of HazMat Transport by Rail between Industrial Sites; A Case Study in Sicily. Loss Prevention and Safety Promotion in the Process Industries, Proceedings of the 11th International Symposium, Praha, Czech Republic, 31 May - 3 June, 2004.

39

European Commission EUR 22247 EN DG Joint Research Centre, Institute for the Protection and Security of the Citizen Luxembourg: Office for Official Publications of the European Communities 2006 39 pp 21 x 27.9 cm Scientific and Technical Research series

Abstract In the context of the Institutional Activity COMPASS "Risk Comparability and Integrated Risk Assessment" of the Joint Research Centre of the European Commission, a specific study entitled "Comparison of Risk Analysis Methods and Development of a Template for Risk Characterisation" was conducted. The objective of this study was twofold: 1. to carry out a comparative analysis of existing risk analysis approaches, for estimating the technological accidental risks related with the process industry and the transportation of dangerous goods by road, rail and pipelines, over member States (MS), Candidate Countries (CC) and other relevant countries; and to develop a template for the characterisation of the outcome of risk analysis and of the risk analysis process itself.

2.

The mission of the Joint Research Centre is to provide customer-driven scientific and technical support for the conception, development, implementation and monitoring of European Union policies. As a service of the European Commission, the JRC functions as a reference centre of science and technology for the Union. Close to the policy-making process, it serves the common interest of the Member States, while being independent of special interests, whether private or national.