CDOIF Guidance

Safety and environmental standards for fuel storage sites

Final report

147

Hazard identification, layers of protection, and assessment of their effectiveness

28 Prior to the Buncefield incident, the

Safety Report Assessment Guide (SRAG) for highly

flammable liquids

implied that, unless there were clear areas of confinement or congestion,

vapour cloud explosions (VCEs) could be ignored from detailed analysis. The current uncertainty

regarding the explosion mechanism at Buncefield suggests that such an approach may no longer

be valid. The SRAG has therefore been amended accordingly.

29 Developing process safety performance indicators involves identifying the risk control systems

in place for each scenario, and determining which of these are important to prevent or control

the various challenges to integrity (HSG254

Developing process safety indicators

). It is therefore

essential to be able to provide an overview of:

the barriers to major accidents (ie layers of protection);

■

what can go wrong; and

■

risk control systems in place to control these risks.

■

30 Various techniques are in use within the industry to give an overview of the layers of protection

and evaluate their effectiveness. There is an opportunity to extend good practice within the industry.

Guidance on the hazards of unconfined vapour cloud explosions

31 The safety report should deal with unconfined VCEs by recognising that such events can

happen following major loss of containment events, and should be dealt with by demonstration

that the measures to prevent, control and mitigate such loss of containment events are of

sufficiently high integrity.

32 Until the Buncefield explosion mechanism is known, it is not appropriate for safety reports

to contain detailed assessment or quantification of the risks from VCEs. However, estimates

of extent and severity should be included. HSE guidance SPC/Permissioning/11 has been

amended to include assumptions to be used, in terms of over-pressure at distances from 250 to

400 metres, for estimating the ‘extent’ information. Initial safety reports, five-yearly updates, and

reports that are currently being assessed but have not yet gone through the ‘request for further

information’ stage, should be updated in the light of this current guidance.

Guidance on hazard identification and risk assessment

33 One of the principles of a MAPP is that the dutyholder should develop and implement

procedures to systematically identify and evaluate hazards arising from their activities (in both

normal and abnormal conditions) (L111). These procedures should address human factors with

the same rigour as engineering and technical issues, and should be described in the SMS. There

should also be systematic procedures for the definition of measures to prevent major accidents

and mitigate their consequences.

34 Techniques used within the industry to help make decisions about the measures necessary

include:

bow-tie diagrams;

■

layer of protection analysis;

■

fault/event trees;

■

tabular records of the hierarchy of control measures.

■

Bow-tie diagrams

35 A bow-tie diagram is a means of representing the causes and consequences of a hazardous

occurrence, together with the elements in place to prevent or mitigate the event. The ‘knot’ in

the middle of the bow-tie represents the hazardous event itself. Such an event might be ‘Loss of

containment’ or ‘Storage tank overfill’ etc.