The Hazards Forum Newsletter · Hazards Forum Newsletter No 67 – Summer 2010WV Hazards Forum AGM 2010 Brian Neale – Secretary, Hazards Forum The Annual General Meeting this year

Hazards Forum Newsletter No 67 – Summer 2010WV

The

Hazards Forum

Newsletter

Issue No. 67

Summer 2010

Web version

1


Hazards Forum Newsletter

Issue No. 67 - Summer 2010

Contents

2 Hazards Forum AGM 2010

3 New Hazards Forum Chairman

3 New Members of the Executive Committee

4 New Hazards Forum Newsletter Editor

4 Sir Frederick Warner makes the Century

5 Safe Operation of Decarbonised Fuel Schemes

9 The Institution of Mechanical Engineers Safety and ReliabilityGroup

16 From the Secretary …

19 HSE eNews – some examples

20 Calendar of Events

Edited by James Kearns

Views expressed are those of the authors, not necessarily of the Hazards Forum

Further information regarding the articles in this issue is available from

Tim Fuller on 020 7665 2230, in the Hazards Forum Secretariat Office

E-mail: [email protected]

Hazards Forum website: www.hazardsforum.org.uk

Hazards Forum Secretary: Brian Neale

June 2010

2


Hazards Forum AGM 2010

Brian Neale – Secretary, Hazards Forum

The Annual General Meeting this year washeld on Tuesday 16th March at TheGeological Society, Burlington House,Piccadilly, London, W1J 0BG,commencing at 17.00 hrs. The meetingwas chaired by the Hazards Forumchairman, Sir David Davies, whowelcomed the members attending.

The Annual Report of the Trustees for theForum for 2009 was available. Sir Davidbegan by explaining that following thereview of the Hazards Forum’s objectivesin 2008 the agreement not to change themwas found to be appropriate during 2009and that they would remain as they stoodin the Annual Report for 2008. It wasadded further that the Hazards Forum wasestablished to bring professionalstogether. The Hazards Forum did notclaim to be an expert body itself, but moreas a Forum for well informed professionalsbrought together to discuss anddisseminate experiences for the mutualbenefit of the professions.

He continued with a brief summary ofsome of the highlights from the year,including mention of the evening events ofwhich there had been six and followingwith an outline account of the Forum’sfinances for the year. He stated thatdetails were, of course, in the report nowbefore the meeting. The independentannual reviewer (or examiner) of theaccounts, Alexander Bierrum, had statedthat from his review he was satisfied withthe accounts and emphasised thatalthough a qualified accountant, he did asrequired which was not an audit. He wasduly thanked in his absence. The meetingsignified it’s satisfaction with the accounts.The Chair added that the signed reportwould be sent to the CharityCommissioners with the annual return for2009 in due course.Mentioning staff changes, he thankedAdam Kirkup in his absence, who had left

the Secretariat towards the end of theyear. In his place he welcomed Tim Fullerand took the opportunity to thank JasonSimpson who had completed his secondyear looking after the accounts.

The Chairman continued his report bymentioning the Executive Committee. Heexplained that his term had expired at thisAGM as had the term of two othertrustees. One of whom had sought re-election and one had not. There had thusbeen three trustee vacancies out of theavailable five to be filled for the 2010-11year. This was put to the membershipwith the Notice for the AGM and noalternative suggestions were received tothe three candidates put forward at thattime. Hence the Executive Committeewas pleased to agree in their meeting priorto the AGM that the new trustees would bePaul Thomas CB FREng, Dr JeanVenables OBE FREng and John Barber,with Paul Thomas being proposed andaccepted as the new Chair of the HazardsForum. It was reported that ExecutiveCommittee member Patrick McDonald hadtaken up the new position of HSEobserver, having previously been a co-opted member. Stepping down from theCommittee also were Dr Chris Elliott andDr Robert Muir-Wood who were thankedfor their contributions. Sir Davidmentioned that he had enjoyed his time aschair and had enjoyed the stimulatingenvironment that the Forum offered.

To conclude his report, Sir Davidexpressed the Hazards Forum’s sadnessat Dr John Bond passing which he linkedto his appreciation of his editorship of theNewsletter for four editions from theSummer 2008 edition (No. 60). In additionSir David expressed the Hazards Forum’sthanks to the former editor, Dr IanLawrenson, who kindly stepped back intothe role for the last two editions of the yearand who is still involved with Forum

3


activities through both his membershipand his continuing link with theParliamentary & Scientific Committee. SirDavid said that as an update, he waspleased to mention that the search for anew editor had been successful towardsthe end of the year when James Kearnsstepped into the role.

Before a brief discussion, Sir Davidthanked the remaining members of theExecutive Committee for their work duringthe year and also thanked the HazardsForum Secretary, Brian Neale, for hiscontinued support and hard work.Before the meeting closed, Paul Thomas,on behalf of the members and Executive

Committee, thanked Sir David for hisenthusiastic leadership during the pastseven years which had seen a variety ofhazards issues being presented anddebated with appreciation that the Forumwas working on a reasonable financialfooting.

The next Annual General Meeting wasproposed for a date in spring 2011, yet tobe determined. The meeting closed at17.30 and was followed by refreshmentswhich were in turn followed by the eveningevent on Safe Operation of DecarbonisedFuel Schemes.

New Hazards Forum Chairman

The Executive Committee is pleased to introduce the new Chairman of the Hazards Forum.He is Rear Admiral (retd) Paul Thomas CB who also became a trustee at the AGM in March,following his joining the Executive Committee as a co-opted member in 2009. As a briefintroduction:

Rear Admiral (retd) Paul Thomas CB, FREng FIMechE HonFNucI

Paul’s 35 year career in the Royal Navy was spent mostly in submarines and submarinerelated roles culminating in his appointment as Chief Strategic Systems Executive withresponsibility for the procurement of the TRIDENT submarines, missile systems and nuclearwarheads.

On leaving the RN in 1998, he joined AEA Technology Nuclear Engineering as DirectorProjects and in 2001 he moved to BNFL as Group Director Environment, Health, Safety &Quality. He is currently Chairman of RSSB and President of the Nuclear Institute. He wasco-opted onto the Executive Committee of the Hazards Forum in 2009.

New Members of the Executive Committee

The Executive Committee is pleased to welcome two new members of the Committee. Theyare Dr Jean Venables, as a new Trustee, and Brian Wimpenny who has agreed to join as aco-opted member. As a brief introduction to each:

Dr Jean Venables OBE FREng CEng CEnv FICE MCIWEM

Jean is a Director of the Venables Consultancy, Chairman of Crane Environmental Ltd, ChiefExecutive of the Association of Drainage Authorities and Chairman of the Thames EstuaryPartnership. She is also Immediate Past President, Institution of Civil Engineers and Past-Chairman, Independent Industry Panel, Thames Estuary 2100 Project.

Through Venables Consultancy and Crane Environmental, Jean has wide experience of andexpertise in strategic flood risk assessment, facilitation and chairmanship, and works with

4


colleagues to assist the construction industry, its clients and suppliers to reduceenvironmental risk and the adverse environmental impact of its projects and operations, andto improve their environmental and sustainability performance.

A major Crane Environmental project has been to lead and manage the team that developedCEEQUAL, the ICE-initiated environmental assessment and awards scheme and now leadsthe team that operates CEEQUAL for the industry and profession. She holds VisitingProfessorships at Southampton University, University of Strathclyde and Imperial College.For more about Jean please see http://www.venablesconsultancy.co.uk/directors.htm

Brian Wimpenny CEng FIMechE

Brian spent 37 years in Rolls Royce Marine on nuclear reactors for submarines. Thisincluded:

Research and Development in heat transfer, fluid mechanics, noise and vibration andcomponent testing

System design for new generations of submarine Safety and reliability of operational submarines and support infrastructure.

When RR set up a competency matrix, he became the discipline head for all 200 RR safetyand reliability engineers. This involved defining competencies and reviewing training. Oneoutcome was that I set up an MSc at Loughborough with Prof John Andrews.

On leaving RR four years ago, Brian became an independent safety consultant and sit onMOD and BAE Systems safety committees. He is also a Visiting Professor in the Risk andReliability Department at Loughborough University and remains an active member of theSafety and Reliability Working Group of the IMechE as past Chairman.

New Hazards Forum Newsletter Editor

The Hazards Forum is pleased to welcome James Kearns as the new editor of theNewsletter. James graduated in Physics from The University of Manchester with an MPhys(First Class Honours) in 2008. He then began a PhD at City University, London, under thesupervision of Professor Philip Thomas. He is currently in his second year of research, whichfocuses on risk analysis and management, in particular, applying J-value techniques toassess the risks presented by nuclear power plants. The research is part of the SPRIngproject, which seeks to assess the sustainability prospects of nuclear power in the UnitedKingdom, and is funded by EPSRC and ESRC. During the course of his research so far,James has had a paper published in a peer reviewed journal and had three papers publishedat conferences.

Sir Frederick Warner makes the CenturyThe first Chairman of the Hazard Forum was Sir Fredrick (Ned) Warner FREng FRS whocelebrated his one hundredth birthday in March. The Executive Committee of the HazardsForum sent him a birthday card wishing him well for his second century.He is a past President of the Institution of Chemical Engineers and led the first Internationalteam to examine the after effects of the Chenobyl meltdown (so much for the hazards ofradiation). He was also a founder Fellow of the Royal Academy of Engineering - which wasthen called the Fellowship of Engineering. He has been a consultant since his retirement in1980.

Sir David Davies, Immediate Past Chairman

5


Safe Operation of Decarbonised Fuel Schemes

James Kearns

On Tuesday 16th March 2010 theHazards Forum and the GeologicalSociety jointly hosted an evening event atthe latter’s premises at Burlington House,Piccadilly, London. The event was thethird of three in the Hazards Forumsenergy series.

The event was concerned with safetyissues presented by carbon capture andstorage schemes, which are starting toreceive much attention as bothgovernment and industry seek to mitigatetheir carbon dioxide emissions. The eventbegan with outgoing Hazards ForumChairman Sir David Davies introducingthe new Chairman Paul Thomas, whothanked Sir David for the outstanding workhe’d done for the Hazards Forum. MrThomas then introduced the chair for theevening, Mr Adrian Collings, whothanked the audience for attending, andthe Geological Society for hosting andsponsoring the event.

The event had three presentations, whichwere subsequently followed by a briefsession for questions from the audienceand a reception for more informaldiscussions and networking opportunities.The first presentation was given by Dr.Laurence Cusco, Head of Fire andProcess Safety Unit at the Health andSafety Laboratory, who gave apresentation titled “A Comparison ofHazard and Risks for CO2 and NaturalGas Pipelines”, in which Dr. Cuscodescribed the work he had been carryingout in identifying and investigating thehazards presented by carbon capture andstorage (CCS) systems. This was followedby a presentation from Professor HarounMahgerefteh, of University CollegeLondon, titled “CO2 Pipelines Materialand Safety Considerations”. In thispresentation, Professor Mahgereftehdiscussed the research he has beencarrying out looking at how transporting

carbon dioxide affects the pressurisedpipeline through which it is carried and thesafety implications of such effects. Finally,Dr. Murray Shearer of BP AlternativeEnergy in his talk “Safe Design of a Pre-Combustion Capture Power Plant”discussed the safety issues which need tobe considered in the design of a uniquehydrogen power and carbon capture plantwhich is currently planned to be built inAbu Dhabi in the United Arab Emirates.

Dr. Laurence Cusco began his talk with abrief history of the Health and SafetyLaboratory and how the HSL work relatesto the Health and Safety Executive inensuring that appropriate measures aretaken to reduce the risks posed by carboncapture and storage technologies.

The CCS chain consists of three steps:capture, which takes place at the point ofproduction in the power plant; transport,whereby the captured carbon dioxide istransported through a pipeline, and lastly,storage, which is deep underground. Thework done at the HSL attempts to identifyand quantify risks and hazards over theentire chain.

Dr. Cusco explained in detail themethodologies employed in hazardidentification, and gave some specificexamples of hazards created by carbondioxide, such as hydrogen and oxygen

6


being present in a CO2 pipeline combiningto form water which then corrodes thepipeline. There were also instanceswhereby workers have been overcome bya build up of CO2 from leaks in a pipe.

Dr. Cusco also made the point that there isuncertainty in how to regulate CCSpipelines. CCS is an important mediumterm strategy in mitigating climate change,and if it is to become more widespread,then it is necessary to clarify exactly how itwill be regulated. The main point in thisdebate would be whether or not theexisting Pipeline Safety Regulationsshould apply to CO2 pipelines.

Dr. Cusco then elaborated on some of thehazardous properties of carbon dioxide.CO2 is a toxic asphyxiant which acidifiesblood and increases breathing rates. It canalso cause acidic corrosion in thepresence of water, and is very cold ifreleased from a pipeline. The approachtaken by the HSL is to compare the risksof CO2 pipelines with natural gas pipelines.

The toxicity of CO2 means it is a moredangerous asphyxiant than natural gas.Also, the higher pressures involved withCO2 transportation means there aregreater risks involved. These factorshighlight some significant differencesbetween CO2 and natural gas pipelineswhich are important to consider whendeciding on the appropriate regulations toimplement.

Professor Haroun Mahgereftehcontinued the theme of CO2 pipeline safetyin his presentation, in which he gave anoverview of the most important factors thatshould be considered in the safe operationof CO2 pipelines. Professor Mahgereftehnoted that most of the current researchinto CO2 pipeline safety was limited to onlystudying the transportation of pure CO2 insparsely populated areas, whereas theproposed CCS systems will transportimpure CO2 in high density populationareas, which introduces new significantsafety issues.

The CO2 pipelines will carry impure carbondioxide. The impurities are typicallycomprised of many other substances, themost prominent of which are methane,nitrogen and hydrogen sulphide. In somecases the impurities can comprise up to10% of the mixture.

The presence of impurities alters thethermodynamic properties of the CO2

mixture, and there is currently no equationof state which describes analytically the

7


variations introduced by impurities. Theimpurities also adversely affect thepipeline itself. One way in which it doesthis is through embrittlement, in whichhydrogen present in the mixture diffusesinto the pipeline material, causing it tobecome brittle and promoting the chancesof a fracture occurring.

Another way in which impurities can affectthe pipeline is through corrosion. If wateris present in the pipeline, then it can eithercorrode the pipeline material directly or itcan combine with the already present CO2

and form carbonic acid, which is a morecorrosive substance.

Professor Mahgerefteh then discussedsome related research he had beencarrying out in fracture analysis. There aretwo ways of classifying fractures: brittlefractures and ductile fractures.

In a brittle pipeline fracture, cracks willappear suddenly and travel quickly withlittle deformation of the pipe.

In a ductile pipeline fracture there is a lotof deformation to the pipe, which typicallyoccurs over a prolonged time period, andthe cracks move slowly compared to thebrittle fracture cracks.

CO2 pipelines are more susceptible to fastbrittle fractures because of CO2’sprolonged phase transition and expansionduring depressurisation.

Professor Mahgerefteh then explained theimportance of accurately modelling theproperties of the CO2 as it disperses out ofthe pipeline following a fracture, as thiswould help in determining the level ofharm to a receiving target as a function ofdistance from the pipeline.

Dr. Murray Shearer gave the final talk ofthe evening in his presentation regardinghow to design a novel “pre combustionpower plant” safely. The power plant willconvert natural gas into hydrogen andcarbon dioxide. The hydrogen is thenburnt for electricity production, whilst thecarbon dioxide is first captured, and thenpumped into depleted oil fields in anattempt to recover more oil.

The plant is to be built in Abu Dhabi, in theUAE, and is known as the “HydrogenPower Abu Dhabi project”. The project is ajoint venture between BP AlternativeEnergy and MASDAR, an Abu Dhabigreen energy company. The plant will

8


export 400 MW of clean power to powerand water companies, and will capture 1.8million tonnes of carbon dioxide each year.

Dr. Shearer then discussed the processflow for the plant. Hydrogen molecules arefirst removed from the natural gas. Thisleaves CO and CO2 molecules. The entireCO is then converted into CO2 by addingan extra oxygen atom from a supply ofH2O. The CO2 is then compressed to asupercritical state and exported for oilrecovery. Meanwhile, the hydrogen is sentto a gas turbine generator for combustionand subsequent electricity production.

Dr. Shearer went on to discuss some waysof designing the plant in such a way as tominimise the risk from the many hazardspresent in this sort of power station. Theobjectives of the design process are to firstseek to limit releases, and second assumethat a given accident occurs, and findways to mitigate the consequences, suchas minimise the event through goodventilation and detection systems, and toprevent escalation and harm to theimmediate surrounding area.

Some models of methane and hydrogendispersion following a release in the plantwhere then shown. The development of acloud for each gas was shown in twoscenarios, one in which the failingequipment was contained in a building,and one in which there was no building.The models showed that the buildingwould lead to a much larger gas cloud,and would eventually cause the building

walls to fail in the case of hydrogen, butwould not fail in the case of methane. Thescenarios shown suggested that it wouldbe safer if there was no building.

Mr Collings thanked the speakers for theirinteresting and informative presentations,and invited all three speakers onto thestage for questions from the audience.

The ensuing discussion addressed abroad range of topics associated with thepresentations. The discussion includedsome comments regarding research intothermodynamic modelling of impuresubstances and their equations of state,the psychology of risk and it’s perceptionby the public, and the philosophy ofbringing plant back to design conditions –rather than looking at failure rates. Thespeakers answered all questionssuccinctly and thanked the audience fortheir comments.

The chairman for the evening thankedthe speakers for their answers to thequestions and also those who commentedduring the discussion session. He thencommented that this research helps in theunderstanding of the risks to workers andthe general public that new technologiesinevitably present so that it is notnecessary to proceed via trial and error ashas been done countless times before.

Mr Collings invited Dr. Mike Considine,Head, Major Hazards and Fire, BP togive some concluding remarks. Dr.Considine explained that the pipelines

9


present the greatest risks to the public inthe CCS chain, but that these risks are nottoo dissimilar from those posed bystandard natural gas pipelines, and henceone must always maintain perspectivewhen assessing risks.

The Chair thanked Dr. Considine andinvited all attendees to continue anydiscussions and network over the lightrefreshments which followed.

The Institution of Mechanical Engineers Safetyand Reliability Group

Dick Vote

“Safe, Reliable Engineering cannot be left to chance”

The Institution places great emphasis onsafety and reliability in engineering andstrongly believes in proactive, structuredassessment to verify that a product orservice will work safely and reliablythroughout its life. Unwillingness tomanage risk, as veiled in statements suchas “it has been safe to date” has beenproved to be seriously mistaken and isincreasingly likely to be treated asirresponsibility in court.

Proactive, holistic assessment, neversimplistically prescriptive nor complex andunnecessarily erudite, steers the path to“Dependability” an overarchingconfidence in hardware, software and thehuman/machine interface. Purchasersshould instigate (and suppliers shouldprompt for) a Dependability Strategy withquantitative criteria and clear, realisticdefinitions of “success” and “failure”especially when embracing newtechnology and in competitive tenderingprocesses.

Evidence gleaned from relevant testingand feedback from operations will allowtimely mitigation of risk within the wholelife contractual process.

Dependability neither just “happens”despite the view of some who, by payinglip service with simplistic “right” data,“right” model and “right” answers,

invariably guarantee poor performance,foreshortened useful life and breachedfinancial containment. Impreciseobjectives, unrealistic aspirations,uncontrolled changes or failure to take arealistic view and above all poorcommunication between and withinpurchaser and supplier increases risk butworst of all is dismissing the need toconsider it.

The SRG recommend that Dependabilityshould be invoked contractually – withoutexception and established in a “reasoned,auditable argument - DependabilityCase” addressing the whole life cycle,gathering and analysis of evidence, to finetune design, operations and maintenanceand respond to change.

This brings greater confidence in integrity,delivery to specification and expectations,reduced costs with greater longevity andsustainability of resources. It also supportsand verifies expectations by performanceindicators and which can be demonstratedcontractually.

Compromise or even complete re-appraisal is better than embarrassmentafter delivery.

The cycle of Dependability is describedbelow in the “Ring of Confidence”.


[Diagram – Brian Wimpenny]

The SRG “Ring of Confidence"

- Scope

What is the product or service?

What environment will it operate in?

How will it be used?

Rhys David

It is important to understand anddocument the system or product in termsof what it is and how and where it will beused. This will be used to scope theSafety and/or Dependability assessmentof the product, so that people canappreciate it and understand whether it isrelevant to their application. The definitionshould record the constituent parts,including hardware and software elementsas well as how people and other systemsinteract with the system of interest.System functions, in all operating modes ifrelevant, should be listed, together withcriteria for success and failure. Theoperating context of the product must berecorded, in terms of the environment andinterfaces with other systems.

Any assumptions should be documentedexplicitly so that they can be understoodand validated where necessary.

- Assessment and Modelling

What can go wrong?

What effects will failure have?

How robust can/will I make the product?

What are the important features?

Bill Wong

Assessments need to be made to ensuresafety in the whole life cycle of design,manufacture, operation, maintenance andfinal disposal of any machine or system.

Published regulations require anassessment that all the essential healthand safety requirements have beensatisfied and certified to be in compliance.Depending on the type of equipment thiscan range from self certification to theneed for independent third partyassessment and verification of the design,materials and manufacturing processes.Examples are the Machinery Directive andthe Pressure Equipment Directive.

Documentation

Operation &Maintenance

Design, BuildManufacture &Commissioning

Tolerability ofRisk

Demonstration

SoundEngineering

Assessment &Modelling

ScopeQuality

Assurance

Through LifeManagement

EnvironmentalImpact

OrganisationalInterfaces

The DependabilityCycle for Safety and

Reliability

11


Generally advice on the applicableregulations can be obtained from the HSE.

As well as being safe machines andequipment must be fit for purpose. Awhole range of inspection and testprocedures to verify this are published bythe relevant industry authorities for thispurpose. Examples are the AmericanPetroleum industry standards forequipment for use in refinery services andthe American Society of MechanicalEngineers Power Test Codes formechanical equipment. ISO standards andcodes of practice developed from theseare also available. In the case ofhazardous processes a safety case maybe needed that must be assessed by anindependent authority before operationcan be allowed.

All machines and systems and theircomponents have a limited life span. Theyfail due to material degradation and wear,and tear. Their life span and theirconsequences of failure need to beassessed. Techniques such as FailureMode and Effects Analysis and Fault treeAnalysis has to be used for this purpose.Where any failure is identified as safetycritical the design is required to meet asafety performance level which isdetermined by the probability of failure andits attendant risk of harm. Measures areneeded to give warning of incipient failurefor maintenance action to avoid disaster.In some cases a Risk based inspectionprocedure may be applicable.

Machines or systems should only use andapply proven components in suitableoperating environments for which reliabilitydata is available. When a deviation fromthis is undertaken the assessment of itsreliability, especially of safety criticalcomponents has to be dependent on lifetesting and field operation. This can be along and expensive process.

- Sound Engineering

State key features of the design

Demonstrate that the design is robust

What key assumptions are carried

forward?

John Hopper

In recent years there has been a numberof major disasters (and near disasters) ofa technical or commercial nature wheregood sound engineering practice haseither been ignored, and/or a company’spriorities have become confused.

For products and equipment to operatesafely and reliably it is essential that soundengineering practices are implementedthroughout the product life cycle,especially during the Design phase. Themajor areas that need to be consideredare Design, Manufacture, Operation andMaintenance but also to considerDisposal.

These notes focus on the Design phase,but much of what follows may also beapplicable to other phases. During initialdesign, it is vital that such aspects as theintended use of the product or equipmentis considered fully and understood. Thiswill need to include the customer / user /operator’s expectation. This may notalways be achievable within thetimescales and/or budget. Once thisresolved, the detailed specification writtenand agreed and the detailed aspects of thedesign can be addressed.

These must include the intended operatingenvironment, the use of appropriatematerials, the level of technology (old, newor hybrid), the manufacturing sources andprocesses, and the models and testing tobe employed in validating the product andverifying the design as ‘fit for purpose’.

It is vital that any safety and/or reliabilityrequirements are considered and includedat this stage. Where the product orequipment must comply with mandatory orlegal requirements, the must be compliedwith. Over the years a substantialknowledge base has been built up and thisshould always be referred to and used inan appropriate manner. This shouldinclude those instances where failureshave occurred and safety compromisedand / or reliability degraded, the root cause

12


of those failures and the correctiveaction(s) implemented to minimise the riskof further future occurrences.

Where design rules or guidance exist,these should be adhered to wheneverpossible. Where new technology is beingintroduced, the experience should not beignored.

- Tolerability of Risk

Demonstration

What are the risks in operating the plant,

what features are fitted to prevent mitigate

or contain them?

Are they acceptable against safety &

reliability targets?

Have the risks been optimised?

What further key assumptions need to be

carried forward?

Nicola Stacey

DefinitionA tolerable risk is one that society as awhole is willing to live with so as to securecertain benefits in the confidence that therisk is one that is worth taking, is beingproperly controlled and subject to reviewto take into account new information aboutthe nature and severity of the risk or betterways to control or manage it. This is notthe same as a risk that everyone wouldagree, without reservation, to take uponthemselves or have imposed on them.

Duty-Holder ActionsThe person responsible (duty-holder) foroperating the plant or equipment needs tounderstand what can go wrong, what theconsequences could be and how likelythey are. Or in other words carry out a riskassessment. For complex plants in highhazard industries this might take the formof a full quantitative risk assessment(QRA) or probabilistic safety assessment(PSA) as part of a safety report requiredfor example under the control of majoraccident hazards regulations (COMAH).However for straightforward workequipment this may take the form of asimple qualitative assessment such as that

described in HSE’s 5-Steps guide. Forfurther information on the management ofhealth and safety see HSE’s guide orapproved code of practice.

HSE FrameworkThe HSE tolerability of risk frameworkrecognises that there are some risks thatare simply not tolerable to society suchthat a substance or process needs to bebanned and that there are some which arebroadly acceptable. However most risksfall in-between, requiring risks to bereduced “so far as is reasonablypracticable”. This requires a judgement tobe made about what more could be doneto control the risk. If there are relevantrecognised good practices or standardsthat can be applied then the tolerability ofthe risk can normally be demonstrated byclearly showing compliance with thosestandards and that systems are in place toensure that protective measures remaineffective. The duty-holder needs todemonstrate that they have done all theycan reasonably do to try to first eliminatethe hazard and then reduce risk by design(by reducing the possible severity of harm,the exposure to harm, the probability ofharm occurring) and finally failing all thatto enhance the possibilities to avoid orlimit harm should something go wrong.Any remaining or residual risk must thenbe managed through information, training,safe-operating procedures and as a lastresort, and preferably only as a temporarymeasure, through personal protectiveequipment. For further information abouthow HSE judges whether duty-holdershave done all they can to reduce risk aslow as reasonably practicable see HSE’srisk management web-pages on ALARP.

- Design Build manufacture and

commissioning

What key assumptions need to be

supported?

How will this be achieved?

How will they be supported?

Confirmation of delivery

Feedback and response

Phil Godding

13


The process by which the overall projectobjectives are successfully achieved,avoiding all unacceptable risk,incorporating or exceeding acceptablesafety factors, providing redundancy ofhazard limiting controls and adequatewarning devices to indicate failures orwhere conditions could cause anunacceptable level of risk to prevent orcease operation.

Failure mode analysis should beintegrated into the concept phase of adesign programme and revisited wheneversignificant changes to the project scopeare identified. Design reviews should takeplace and include participants withsufficient product knowledge to effectivelyand correctly evaluate any new projectcontent or conceptual ideas. Areas whichinclude new concepts or carry significantrisk should be included in the testprogramme, for thorough validation beforeproceeding.

General areas of review should include butnot be limited to; structural integrity,mechanical components (including thosefor fluid or other power generation, controlsystems, operating environmental impact.Prototype testing or final commissioningshould be specific to real world applicationof the machine or system, in accordancewith appropriate design limits allowing forall anticipated working conditions andforeseeable system or operator-inducedfailures. Where failures in testing occurthis information should be thoroughlyinvestigated to determine if the originalassumptions were correct and if otherareas are impacted.

Testing should be carried out inaccordance with the applicable standardsand local legislation and whether requiredor not, preferably by an independentperson. The best practice of prototypetesting, pilot build validation and fieldfeedback should all be incorporated intothe project schedule to ensure a robustproduct.

Operations and Maintenance

Do the operating documents support the

assumptions made in the design?

Does the maintenance programme keep

the product in an acceptable state?

Norman Stewart

At the design stage of a product orprocess, consideration must be given tothe potential hazards and reliability issuesthat could manifest themselves duringnormal and abnormal operation. Todemonstrate a safe operation, the hazardsthat are identified must be risk assessedand controls stipulated to militate againstthese risks. Analysis must be provided onthe projected performance levels takinginto account human factors and equipmentpotential failure rates. This will enabledevelopment of controls to ensure anacceptable level of reliability/ dependabilityand fault tolerance are achieved.

An in depth knowledge of the product orprocess is necessary to enable the aboveassessments to be carried out. Forcomplex processes the interactionbetween various operational parametersmust be understood and the impact onsafety and reliability comprehended.

By assessing potential consequences,both safety risks and reliabilityperformance can then be classified on a‘Tolerability’ sliding scale to enable acomprehensive benefits analysis. Forthose that are unacceptable thenmitigating controls must be developed tomake them tolerable.

OperationsFrom small consumer goods up to a largeindustrial complex a strategy must bedeveloped to ensure that during theiroperation the design considerations arecomplied with. In the operating proceduresthe safe operating limits and performancelevels must be specified to ensure a safeand reliable operation; that waste andenvironmental effects are minimised andthat the process is energy efficient. Havingtrained and competent operators is aprecursor to safe and reliable operations.

MaintenanceThe designer must influence themaintenance strategy for a product orprocess to ensure that operating

14


standards and performance aremaintained during its life cycle. Installedequipment must be designed toappropriate standards and have thenecessary certification e.g. CE marking.The equipment must be cared for toensure the original design requirementsare fulfilled and not compromised due tolack of maintenance.

The operational requirements must beembedded in the maintenance strategy tooptimise performance. This could rangefrom having time based, condition basedmaintenance or just having a replacementpolicy.

Organisational Interfaces

Have other organisations involved in

design, supply, support been identified?

Do they know what is expected of them?

Are processes in place to exchange the

required data?

Environmental Impact

Does the product design and through life

operation need environmental

assessment?

What are the bases for that assessment?

Environmental Impact

Fred Pell

Any engineering undertaking will have anenvironmental impact, the magnitude ofwhich depends upon the nature of theundertaking, and the design effort appliedfor its optimisation. The potential forenvironmental impacts exists throughoutproduct life-cycle, as materials and energywill be consumed, and waste products andemissions produced during manufacture;during the operation and maintenancephase of its useful life; through to eventualdecommissioning and disposal.

The responsible designer will identifyenvironmental considerations, along withthe primary product objectives of theproject, to ensure that they are providedfor from the proposal stage through to the

delivery of the project, and the whole lifecycle.

The strategy for minimising environmentalimpact needs to be established byassessment of the design at an earlystage, so that it can be matched to theapplication. For example, the measuresfor a one-off major industrial installationwill differ in many respects from thoserequired for consumer goods produced inlarge volume.

Life-cycle assessment is an acknowledgedtechnique for identifying the potential forenvironmental impact, used as an aid todesign optimisation. Although there ismuch media exposure to “carbonfootprint”, greenhouse gases and globalwarming, these are not the only factors tobe considered.

The fundamental design considerations forenvironmental impact include:

Depletion of resources – energy, rawmaterials, water, land

Human health impacts (direct) –pathogenic, physiological

Ecological impacts –fauna, flora,biodiversity, acidification,eutrophication

Global impacts – ozone depletion,greenhouse gases, global warming

Aesthetic degradation – spoiling areasof natural beauty

There are standardised methods forquantifying environmental impacts, if aformal declaration of the impact isrequired. Standards relating toEnvironmental management systems havebeen compiled under the auspices of ISOand published by BSI in the BS EN ISO14000 series.

Documentation

Is the safety and reliability case presented

in a useable manner?

15


Are safety performance standards

supported where required by quantified

reliability assessment of safeguarding

features and validated by operational

feedback?

Safety CaseThe documentation referred to here is notthe traditionally considered Safety Reportor the Safety Case which would beconsidered the collection of safety orenvironmental documentation. Thedocumentation suite would need toconsider or draw from some or all of theother aspects of the Ring of Confidence.In this context the documentation requiredto support the Dependability Case willneed to address but be not limited to thefollowing aspects.

CompositionAs a minimum the documentation shouldconstitute the required components tocover all aspects of the full dependabilitycase and these will include; descriptional,operational, discussional, justification andanalysis reports/documents.

AdequateIn all aspects of the documentation theremust be a demonstration of adequacycommensurate with the argument beingpresented. The documentation must beset in context by a defined scope against adefined set of agreed standards such thatthey are clearly linked and focussed onaddressing the specific points within thescope and against the standards.Attempting to develop dependabilityrelated documents and a DependabilityCase without this rigour will result in amuch broader and unfocussed suite ofdocuments with the associated and all toooften increased cost.

CurrentThe documentation included in the casewill need to be current and sufficientlyflexible to allow their amendment followingchanges in circumstance or fundamentalrequirements. The need to allow and caterfor updates and revisions may be drivenby regulatory requirements or the essenceof sound engineering following a managed

change of function or additionalfunctionality.

ComprehensiveThe documentation within the case shouldbe sufficiently comprehensive so as todemonstrate the adequacy of theargument successfully. There may be aneed for documents covering all aspectsof the Ring of Confidence.

ComplexityThe complexity of the overall case willdepend upon the application for which it isintended and the overall case complexitymay change through the lifecycle of thefacility or application being considered. Itwill also depend upon the defined scopeas noted above.

AppropriateIn common with any complexity aspects ofthe case it must also be appropriate to theparticular application being considered asone set of documents comprising a casewill not necessarily satisfy all applications.In general the complexity of the case willdepend upon the particular application, thenature of any regulatory involvement andthe nature of any potential hazards oroperations. The other aspect ofappropriateness is that the case must beusable by those personnel responsible forproviding compliance, the operators willneed a suitable documentation suite tooperate equipment or plant in their chargewithin the bounds of the overall case butthey may only require a relatively highlevel version to demonstrate howoperational constraints and managementtype arrangements have been developed.The appropriateness is also linkedinextricably with the definition of the scopeand the standards by which the overallcase will be judged, this aspect is veryclosely associated with Adequacy.

AdaptableAs the lifecycle of the application developsit may be required to adapt the nature,content and complexity of the casedocuments to reflect the changingrequirements. In regulatory controlledindustry applications and where legislationis driving the requirement the case will

16


need to be adaptable to reflect changes inlegislation or regulatory requirement. Thisaspect is also tied in with the concept ofstaged cases and that of appropriatenessof the argument presented.

StagedAn adequate dependability case may wellneed to be planned to accommodateconcept, design, construction, operationand decommissioning and therequirements and nature of thedocumentation will need to reflect thesedifferent requirements.

Through Life Management

Have design and procurement been based

on a realistic view of performance?

Is the organisation capable of delivering

and maintaining that performance?

Jeremy Lewis

Even in an environment of a well run andmaintained facility or factory thedeterioration of particular equipment itemswill continue through age and corrosion,and with the increasing productiondemands other items may be operatingoutside their design capability. Sustainingoperations beyond the original designrequires a level of strategic reinvestment.Understanding the particular plant itemsand systems which will needrefurbishment or replacement allows thedevelopment of a Strategic Plan. This Planprovides the framework for the

determination of appropriate layers ofprotection for the safety and reliability ofequipment with maintenance policies andpractice to provide the essentialinformation needed in the normalbudgetary and planning processes

Quality Assurance

How is compliance with safety processes

demonstrated?

Does reliability and stability meet the

business aspirations?

Do interfacing organisations have an

acceptable QA process?

Jeremy Lewis

The checks and balances of all QAprocesses must be underpinned by thecompetence of the Engineers who applythem. As manufacturing conditions andorganisations change there is a need tomaintain the safety, operability, andsustainability of the factory or facility. TheQA processes must be kept relevant, validand applied by appropriately competentEngineers. Where there is dependence onsupplier organisation, then equivalentmeasures also need to be applied.

Dick Vote is Chair of the Institution of MechanicalEngineer’s Safety and Reliability Group

(http://www.imeche.org/ )

From the Secretary……

This edition of the Newsletter is larger than usual, as regular readers will have noticed.There are two main reasons for this, both of which are of particular interest.

The first is because of the Annual General Meeting held in March and the inclusion of anaccount of the meeting for members who were not able to attend, together with welcomingintroductions of people who are either new to the Committee, or who have taken on a changeof role within it. These include two new trustees, Paul Thomas and Jean Venables; and anew co-opted member, Brian Wimpenny. A change in the Chair of the Forum this year –an event that does not occur very often - saw Paul Thomas unanimously welcomed into thatrole. In this Newsletter, a couple of other people are mentioned also, where we are pleasedto congratulate Sir Fredrick (Ned) Warner FREng FRS, the first Chair of the Hazards Forum,who celebrated his one hundredth birthday in March; and where we learn more about ournew Newsletter editor, James Kearns.

17


Sir David Davies with some members of theHazards Forum Executive Committee

after his last meeting as Chair on 16th March 2010.Also in the picture is the Hazards Forum Secretary. Photograph: Tim Fuller

The Hazards Forum Executive Committee following the AGM:

Chairman: Mr Paul Thomas CB FREng CEng FIMechE HonFNucI

Dr Mike Considine CEng FIChemE

Prof Richard Taylor CEng CPhys FIET FInstP

Dr Jean Venables OBE FREng CEng CEnv FICE MCIWEM

Mr John Barber CEng FICE FCIArb MHKIE

Mr Richard Jones CFIOSH FRSPH AIEMA MIOD

Mr Brian Wimpenny CEng FIMechE

Mr Patrick McDonald CEng CChem FIChemE FRSC FInstP (HSEObserver)

Prof William Bardo FREng HonFInstMC FIET FInstP FPhysSoc (RAEObserver)

Prof Gordon Williams FREng FRS (RS Observer)

Secretary: Mr Brian Neale CEng FICE FIStructE HonFIDE

See the following Hazard Forum website page for the Executive Committee:

http://www.hazardsforum.org.uk/content/index.asp?CONTENT_ID=7

18


The second reason we are pleased to publish this larger edition of the Newsletter this time isthat we welcome an extended article from one the Forum’s member organisations.Readers will be aware that recent Newsletters have included, on a regular basis, an articleper edition describing a member organisation and its interest in the hazards arena. On thisoccasion, the article about the Safety and Reliability Group (SRG) of the Institution ofMechanical Engineers is longer than usual and provides an innovation for such a piece.The article includes views on an approach to management of hazards and the competenciesof those involved. This is timely as the principal author, Dick Vote (who is chair of the SRG)is scheduled to be one of the presenters at the Forum’s Evening Event on 16th June 2010,where event title is “Avoiding Catastrophes: Are you Competent?“. He has taken theopportunity to “trail”, or anticipate, his presentation in the article so that members will havethe opportunity to gain some familiarity with the SRG’s thoughts and approach beforeattending the event.

As competencies has currently come more to fore in the hazards and risks community, theForum is considering a further Evening Event on the topic which will built on the 16th Juneevent and which will be of interest to the wider community of professionals. Please see theForum’s website for updated information as the event is developed.

The website continues to be updated, including information about the ExecutiveCommittee which now includes their professional qualifications and affiliations. The calendarcontinues to include some events from other organisations – and more are welcomed. It isthus worth visiting from time to time to what else might be of interest – that is, in addition toHazards Forum events. As well as seeing developments in the events programme, a visit tothe sponsor’s page will show current and recent supporters of Hazards Forums eventstogether with a link to their home page as a gateway for seeking further information aboutthem and areas of business that may be of particular interest. The link is:

http://www.hazardsforum.org.uk/events/events_sponsors.asp .

Newsletters are usually posted on the website sometime after publication to members.Members will thus have the advantage of receiving their newsletter up to three monthsbefore they are posted on the website. Newsletters can be found on the Hazards Forumwebsite at:

http://www.hazardsforum.org.uk/publications/publications_newsletters.asp

"Learning the lessons of the past is as important as understandingthe possibilities of the future."

A new addition to a member’s Proceedings suite of journals, Forensic Engineering isdue to launch its first edition in Spring 2011, although this follows a “pilot” edition in May2009. It will focus on examining under-performance and non-compliance as well as otherfailures to help promote better understanding for future practice. The new journal is currentlywelcoming submissions from the practitioner and academic communities. To read moreabout the journal, visit the homepage http://www.forensicengineeringjournal.com/ where youcan view the full aims and scope and also the editorial advisory panel. You can alsodownload the details of the journal's call for papers in PDF format.

Are you interested in effective communication of risk and what constitutes state-of-the-artrisk communication? If so, you will be interested to see news of a new HSE Research reporton the following page.

Brian Neale

19


HSE eNews – some examples

++ RR785 - Improving health and safety: An analysis of HSE’s risk communication inthe 21st century ++What constitutes state-of-the-art risk communication? Which practices may be consideredanachronistic? Does HSE use the most effective means to communicate risks? Whichtheories and tools are most apposite for the appraisal of HSE’s risk communication? Whatpolicy recommendations would help the Executive to improve its performance in this area?To answer these crucial questions this report develops an in-depth analysis of HSE’scommunication practices. The researchers explore HSE’s risk communication in two specificcases: that of the Buncefield oil storage incident of 2005 and that of the proposeddevelopment at the Oval cricket ground in London. The researchers conducted face-to-faceinterviews of the critical actors involved in each case. These interviews support a robustqualitative analysis of current risk communication practices. The analysis employs the latesttheoretical and empirical knowledge from the academic discipline of risk communication. Theauthors conclude that the HSE has engaged third parties successfully to develop a proactiverisk communication when faced with a major incident. For most decisions, however, HSE stillrelies on communication practices derived from the consensual, expert-led model with whichthe Executive operates. The authors formulate five critical recommendations to adapt HSE’srisk communication towards a more proactive model.

To download the full report, visit the following link:http://www.hse.gov.uk/research/rrhtm/rr785.htm

++ Workers Memorial Day – Wednesday 28th April ++On workers memorial day, the Bishop of Liverpool Reverend James Jones spoke on the‘Thought for the Day’ slot on BBC Radio 4’s Today programme. His talk can be heard at thefollowing link:http://www.hse.gov.uk/news/2010/radio4-tftd.htm

++ Explosion at Buncefield Oil Storage Depot ++Three companies are on trial over the Buncefield Oil Storage Depot explosion in 2005.Information on the defendants and their charges can be found at the following link:http://www.hse.gov.uk/news/buncefield/index.htm

++ Award Winning “Hidden Killer” Campaign ++Asbestos is a hidden killer, so now’s the time to get clued up on the facts, so that you, yourworkmates, your friends and family are protected.http://www.hse.gov.uk/asbestos/hiddenkiller/index.htm

++ "True to your own values" ++Judith Hackitt in Sunday Timeshttp://www.hse.gov.uk/news/2010/hackitt-sunday-times.htm?ebul=hsegen/24-may-2010&cr=2

++ HSE at Expo 2010 ++Chief Executive - the challenges aheadhttp://www.hse.gov.uk/news/2010/expo-2010.htm?ebul=hsegen/24-may-2010&cr=3

20


Calendar of Events

Please check the Events section of the Hazards Forum website for more information atwww.hazardsforum.org.uk and to see any updates in the calendar. These may include

additional events or perhaps amendments to the Events shown below.

Please note that attendance at Hazards Forum events is by invitation. If you are interestedand do not receive an invitation, please contact as shown below.

Date Event Venue Contact/furtherinformation

JUNE16 Hazards Forum Evening

Joint Event:Avoiding Catastrophes: Are youCompetent?

IMechE, 1 BirdcageWalk, London, SW1H9JJ (Provisional)

Tim [email protected]

17 Safety and Reliability Society:Language of Safety

Royal Institution ofNaval Architects, UpperBelgrave Street, London

www.sars.org.uk

28 - 29 Institution of Civil Engineers(ICE) Event:, HF Supported –Innovate to Survive: Engineersfor One Planet Future ®

ICE, One Great GeorgeStreet, Westminster,London, SW1P 3AA

www.ice-innovatetosurvive.com/

JULY15 Safety and Reliability Society

Event: 21st Century Reliability -the First Decade

The RaddisonEdwardian Hotel,Manchester

www.sars.org.uk

SEPTEMBER14 IMechE Event, HF Supported:

Engineering Judgement - TheImpact of Ethics

University of Leeds http://events.imeche.org/EventView.aspx?code=s1556

21 Hazards Forum eveningevent: Provisional date



23 IMechE Event, HF Supported:Using Human Factors forEngineering Success

Austin Court ConferenceCentre 80 CambridgeStreet BirminghamB1 2NP

http://events.imeche.org/EventView.aspx?code=S1541

OCTOBER14 Safety and Reliability Society

Event: 30 Years of RiskAssessment

Royal Institution ofNaval Architects, UpperBelgrave Street, London

www.sars.org.uk

27 IMechE Event, HF Supported:What is Reliability?

IMechE, 1 BirdcageWalk, London, SW1H9JJ

http://events.imeche.org/EventView.aspx?code=s1526

NOVEMBER

30 Hazards Forum eveningevent: Provisional date



21


The Hazards Forum’s Mission is to enable government, industry, science, universities, NGOsand Individuals to find practical ways of approaching and resolving hazard and risk issues, inthe interests of mutual understanding, public confidence and safety.

The forum was established in 1989 by four of the principal engineering institutions because ofconcern about the major disasters which had occurred about that time.

The Hazards Forum holds regular meetings on a wide range of subjects relating to hazardsand safety, produces publications on such topics, and provides opportunities forinterdisciplinary contacts and discussions.

The Hazards ForumOne Great George Street

WestminsterLondon SW1P 3AA

Telephone: 020 7665 2230Fax: 020 7799 1325

Website: www.hazardsforum.org.uk

Registered charity number 1047047

The Hazards Forum Newsletter · Hazards Forum Newsletter No 67 – Summer 2010WV Hazards Forum AGM 2010 Brian Neale – Secretary, Hazards Forum The Annual General Meeting this year

Documents