Presentation on pros and cons of current COMAH Environmental Risk Assessment Guidance from the CDOIF committee, including description of method.

1. COMAH Environmental Risk
Assessment Guidance
Humber Major Hazards Group
23rd July 2015, CATCH Facility
Janet Greenwood

2. 2
“As we know,
there are known
knowns; there are
things we know
we know. We also
know there are
known unknowns;
that is to say we
know there are
some things we do
not know”.
But there are
also unknown
unknowns – the
ones we don't
know we don't
know. And if one
looks throughout
the history of
our country and
other free
countries, it is
the latter
category that
tend to be the
difficult ones”.
Donald Rumsfeld, 12th February 2002

3. Jargon Alert!
• MATTE – Major Accident To The
Environment (can affect humans too)
– reported to EU by country involved
• CDOIF - Chemical and Downstream
Oil Industries Forum, an HSE/
industry committee
• SPR – Source Pathway Receptor
• ALARP – As Low As Reasonably
Practicable
3

4. COMAH law, including MATTE
definitions
• EU level - SEVESO III Directive,
Annex VI (1 page out of 37),
http://eur-lex.europa.eu/legal-
content/EN/TXT/PDF/?uri=CELEX:32012L0018&fr
om=EN
• UK level - COMAH 2015 Regulations
(1 page out of 44),
http://www.legislation.gov.uk/uksi/2015/483/con
tents/made
4

5. Current COMAH ERA guidance
• DETR - Guidance on the
Interpretation of Major Accident to
the Environment for the Purposes of
the COMAH Regulations, 1999 (can’t
find online, but still valid) (48 pages)
• CDOIF guidance, 2013/14
http://www.hse.gov.uk/aboutus/mee
tings/committees/cif/environmental-
risk-assessment.pdf (88 pages)
5

6. ERA required at Top Tier
sites…
CDOIF – “COMAH requires all Top Tier
site operators to submit site safety
reports to the Competent Authority
(CA) that demonstrate that the
environmental risk for the whole
COMAH establishment has been
reduced to a tolerable level”.
- In our experience, this has always
happened, ERA is part of Safety Report
6

7. … and at Lower Tier sites
CDOIF - “Lower Tier operators must
prepare risk assessments making a
demonstration proportionate and
appropriate to the environmental risk,
and whilst these are not required to be
submitted to the CA these need to be
available during CA inspection.” –
historically often covered by EPR/PPC for
sites under this regime, but may not have
been sufficient
7

8. CDOIF guidance purpose
“The purpose of this guidance is to
provide a common methodology by
which this risk assessment can be
carried out. The methodology can be
used by both duty holders and the
Competent Authority when preparing
or reviewing risk assessments.” – in
theory, seems perfectly reasonable –
use for both LT and UT sites
8

9. Is CDOIF really working?
• How does it work
• How is it different to what happened
earlier
• Is it fit for purpose on both Upper
and Lower Tier sites
• Where can it break down
• What are the alternatives
9

10. ERA before CDOIF
• HAZID provides initiating incidents
• Detailed environmental description and
SPR analysis to identify potential MATTEs
• Consequence modelling – compare to
DETR guidelines to see if MATTE
• Some frequency assessment, individual
risk criteria used by sites/ consultants
• Recommendations (mainly infrastructure
improvements or procedures)
10

11. ERA problems pre-CDOIF
(our experiences quoting for, and writing, reports)
1) Insufficient SPR analysis – missing out obvious pollutant
linkages
2) Not taking pollution far enough from site either down-wind
or downstream
3) Not taking worst-case quantities because “it can’t happen
here”, consequently not modelling very large spills e.g.
overland flow
4) People sticking in conceptual “comfort zone” – flammable
risks on flammable sites, physical hazards at formulators,
reaction hazards at chemical manufacturers
5) Different sites/ consultants using different risk matrices –
inconsistency
6) No clear guidance for Lower Tier sites on ERA
11

12. ERA under CDOIF (1)
12
• HAZID provides initiating incidents
• Detailed environmental description and
SPR analysis to identify potential MATTEs
• Much more detailed consequence
modelling – compare to DETR guidelines
and to CDOIF guidelines to see if MATTE,
and what severity of MATTE (length/ area
affected)
• New duration criteria (how long affected)
– knowledge of ecosystem effects required

13. ERA under CDOIF (2)
13
• Full frequency assessment of all MATTE-
initiating incidents
• Full frequency assessment of all MATTE
outcomes (sub-set of initiating incidents)
• Frequencies combined together per
receptor and MATTE level (not required for
HHRA)
• Comparison of overall frequencies with
CDOIF tolerability guidelines

14. ERA under CDOIF (3)
14
• Comparison needs to be carried out
TWICE – once with “no mitigation”, and
once with “current mitigation”
• Then, if frequencies on “current
mitigation” are intolerable or TiF ALARP:
– Describe improvements
– Estimate changed frequency of incident and/or
outcome
– Run the frequency assessment AGAIN to show
how tolerability is improved (3 times in
total!)

15. Standardised ERA risk
tolerability criteria (new)
• Analogous to human health risk
assessment
• More detailed, as based on new
MATTE levels A to D
• Also requires all MATTEs to be
considered to an individual receptor
(unlike human health risk
assessment)
15

16. MATTE matrix (new)SeverityofHarm
4 catastrophic
Sub-MATTEduration
C D D
3 major
B C D
2 severe
A B C
1 significant
Sub-MATTE Harm
1
short term
2
medium term
3
long term
4
very long
term
Harm Duration Category
16

17. Severity criteria example (in
CDOIF, taken from DETR)
Receptor
Type
Severity of Harm
Significant
While this level of
harm might be
significant pollution,
it is not considered
a MATTE.
Severe
DETR Criteria - the
lowest level of
harm that might be
considered MATTE.
Major Catastrophic
Severity Level → 1 2 3 4
Soil or sediment
(i.e. as receptor
rather than purely
a pathway)
Contamination
not leading to
environmental
damage (as per
ELD), or not
significantly
affecting overlying
water quality.
Contamination of 10-
100ha of land etc.
as per Widespread
Habitat;
Contamination
sufficient to be
deemed
environmental
damage
(Environmental
Liability
Directive)
Contamination of
100-1000ha of
land, as per
Widespread
Habitat;
Contamination
rendering the soil
immediately
hazardous to
humans (e.g. skin
contact) or
the living
environment, but
remediation
available.
Contamination of
>1000ha of land, as
per Widespread
Habitat;
Contamination
rendering the soil
immediately
hazardous to
humans (e.g. skin
contact) or
the living
environment and
remediation
difficult or
impossible. 17

18. Duration criteria (new in
CDOIF, not in DETR)
18

19. Straightforward duration
criteria:
• built environment – essentially
whether repairable or not, and in
specific timescales
• groundwater (note - process water
abstraction is non-MATTE unless
going into food processes or other
human consumption)
19

20. Trickier duration criteria:
• Land
• Surface water
CDOIF - “These criteria are based on estimating the
likely time for the habitat (or species, etc.) has
substantially recovered (unaided) from the damage
caused. Complete recovery is difficult to judge for
the environment, and hence it is suggested that
this should be clarified as >80% of the damage.”
Ecological knowledge is expected/ essential - NEW
20

21. MATTE matrix – 4 MATTEsSeverityofHarm
4 catastrophic
Sub-MATTEduration
C D D
3 major
B C D
2 severe
A B C
1 significant
Sub-MATTE Harm
1
short term
2
medium term
3
long term
4
very long
term
Harm Duration Category
21
• A – lowest level MATTE
• B – second level MATTE
• C – third level MATTE
• D – worst level MATTE

22. Summation of MATTE
frequencies
Prob. of D MATTEs = D MATTE prob. only
Prob. of C MATTEs = C MATTE prob. + D
MATTE prob.
Prob. of B MATTEs = B MATTE prob. + C
MATTE prob. + D MATTE prob.
Prob. of A MATTEs = A MATTE prob. + B
MATTE prob. + C MATTE prob. + D MATTE
prob.
22

23. MATTE tolerability levels per
receptor per annum
MATTE level Intolerable Tolerable if ALARP (Tif
ALARP)
Broadly
Acceptable
A > 1.0 E-02 From 1.0 E-04 to 1.0 E-02 < 1.0 E-04
B > 1.0 E-03 From 1.0 E-05 to 1.0 E-03 < 1.0 E-05
C > 1.0 E-04 From 1.0 E-06 to 1.0 E-04 < 1.0 E-06
D > 1.0 E-05 From 1.0 E-07 to 1.0 E-05 < 1.0 E-07
23
One of my consultant friends considers environmental
tolerability frequencies to be 10 x more stringent than
Human Health – optimist!

24. What do frequencies per
annum relate to?
• All initiating incident frequencies
which can cause a MATTE
• Excluding those incidents where a
MATTE could not develop
• For example – a tank failure could
cause a MATTE; but if the bund
holds, it won’t. So the overall
probability of tank failure needs to
be reduced to take into account
24

25. How do you find the frequency
of outcome?
• Start with HAZID – identify MAs
• Bow Tie Diagrams are essential
25
Fault tree
Event
tree
Incident

26. Sources of information,
incident frequency
• Site information, e.g. maintenance and accident/
incident records
• Published industry data, including:
– Failure Rate and Event Data for use within Risk
Assessments (28/06/2012) HSE
http://www.hse.gov.uk/landuseplanning/failure-
rates.pdf
– For flammables, OGP documents – ignition probabilities
http://www.ogp.org.uk/pubs/434-06.pdf ; incident
frequencies http://www.ogp.org.uk/pubs/434-03.pdf
– Books – Lees’ Loss Prevention in the Process Industries,
2012
26

27. Beware - multiple frequency of
outcome in the environment
• Jetting loss from tank – 3 outcomes
27
River
Open land
Bund
How do you assign the
probability of outcome
from a single incident?
Open land incident is
to aquifer and then
river, “potential for
double counting”

28. ERA under CDOIF (1)
• Is more consistent in terms of
tolerability of risk
• Is still dependent on valid SPR
modelling
• Requires a lot more work on
consequence modelling, to assess
severity of MATTEs
• Requires new work on consequence
timescales for duration of MATTEs
28

29. ERA under CDOIF (2)
• Requires a lot more work on incident
frequency and frequency of outcome
• Then requires extra work to
summarise and calculate overall
frequencies by receptor
• Has a more precise outcome of
tolerability
• But is not necessarily more accurate
29

30. Benefits of CDOIF
• If it works
– Identifies worst case environmental
impacts and their frequencies
– Identifies initiating incidents for those
impacts
– Ensures improvements are targeting the
worst/ most likely risks
– Can move away from purely
infrastructure risks (traditional ERA) into
other prevention
30

31. Will CDOIF method always get
reliable results?
• CDOIF only “works” where you have
“complete knowledge”
• Known unknowns can drive a horse
and cart through the frequencies
• Unknown unknowns will make it
completely useless
• Unfortunately, environmental work is
often more about unknowns than
knowns
31

32. Some known unknowns
32
Drains
Biodegradation
in soil, aquifer,
surface waters
Chemical
reactions in
environment
Consequences
from modelling

33. Drainage systems
• Drainage systems on site: effluent; foul
sewer; surface water; historic/ disused/
forgotten about
• Do you know where your drains run to?
Do you know how many different drain
systems you have on site?
• Are they in good condition? Would they
leak out contamination? Could
contamination leak into them, or travel
round the outside, or in the permeable fill?
33

34. Forgotten re-routed drainage
system traps NaOH spill
34
Gravel
overlying old
drain acting as
sink for caustic
from bund leak,
travelling along
outside of drain

35. Chemical reactions in the
environment
• Is there any historic contamination on/
under your site?
• Would it react with materials you could
spill and end up in open land?
• Would any degraded materials react with
the contamination?
• Do you know what the reactions might be?
What quantity of new material could be
made? How that would travel in the
groundwater?
35

36. What happens to
degradable substances
• Aerobic degradation?
• Anaerobic degradation?
• Is it continuous or stop-start?
• Formation of gases (Asphyxiant?
Flammable? Toxic? Odourous?)
• Formation of liquids (Water soluble?
Insoluble? Able to further degrade?
Stop degradation proceeding?)
• Formation of solids (precipitated?) 36

37. Very simplified anaerobic
ethanol degradation pathways
37

38. Biodegradation also happens in
slow moving surface waters
• May 2000 - Wild Turkey Distillery fire, 200,000
US gall (757 m3) maturing spirit released to
Kentucky River
• Wiped out all life in the Kentucky River from
around 10 miles downstream of spill
• Dead zone 5 – 6 miles long travelled at around 5
miles per hour – unaffected by passing through
weirs
• Only stopped from affecting Ohio River through
oxygenation barges
• This is fresh water, we don’t know effects in salt
water
38

39. A spill of ethanol to open land
may have different outcomes:
• Either causes no harm at all and is dispersed
naturally, and does not even get into nearby river
• Or causes an explosion risk in low lying buildings
• And/or creates new hazardous substances in
groundwater
• And/or solubilises or reacts with historic
contamination
• And/or creates an aquatic toxicity incident in the
river (and downstream waters) lasting decades
• And/or creates a deoxygenation incident in the
river lasting a short time or decades
39

40. So – do you feel like you
understand degradation in soil
and groundwater?
• Do you feel confident to put frequencies on the
outcomes?
• Do you feel confident to make investment
decisions on the basis of your risk modelling?
• Would you be happy to balance safety and
environmental risks properly? (e.g. jetting risks
vs risks of vapour cloud confinement)
40
“D’ya feel lucky, punk?”
I’m a trained soil scientist, and frankly I don’t
have a clue

41. Consequence modelling
• R&D P95 for groundwater (free model from EA)
– Steady state – amount in is the same
– End point is aquifer contamination, deep
aquifer/ regional scale
– Not so good for shallow aquifer release to
nearby watercourse (most of our sites are old
mills next to water…)
– Contains method for biodegradation
(guesstimate)
– Needs specific parameters to be inputted in
sequence for unsteady-state conditions (i.e. a
spill) 41

42. Surface water consequence
modelling
• River Mass Flow Model from EA
– Only works with small streams/ rivers
where complete dilution/ dispersion can
be assumed
– Not appropriate for fuels, LNAPLs,
DNAPLs
– Not appropriate for estuary environment
(either channel or wider “classic”
estuary environment)
42

43. Visual Plumes model from
US EPA
• Only one sub-model valid for release via
surface channel (e.g from river), others
are all for diffusers at depth and will
overestimate dilution significantly (PDS
model)
• Visual Plumes requires MS XP
• PSW model runs in an old variant of
Fortran – requires Windows NT (our IT
guys threw in the towel at that point)
43

44. So we end up making models
in Excel from 1st principles
• Are these accurate?
• They are worst-case
• However, inputs are often calculated
from previous models (could only be
measured during an incident)
• Capacity for error is large
• Note – even commercial models are
not always very accurate
44

45. Unknown unknowns -
Buncefield Aquifer
“Cherry Tree Lane has a number of road
drains connected to deep chambers, one of
which contains a borehole at least 40
metres deep that penetrates the chalk
aquifer. The on-site drains and road drains
provided pathways for fuel and
contaminated firewater to pollute the
groundwater.”
Bunding at Buncefield, Successes, Failures and Lessons Learned, ICHEME
Hazards XX, 2008
https://www.icheme.org/communities/subject_groups/safety%20and%20loss
%20prevention/resources/hazards%20archive/~/media/Documents/Subject
%20Groups/Safety_Loss_Prevention/Hazards%20Archive/XX/XX-Paper-
11.pdf (if link doesn’t work from slideshare, copy into your browser bar). 45

46. How was this borehole
unknown?
• Off site – not their responsibility
• Not on BGS borehole register, and
uncapped – no seal or top.
• Is it within the remit of a site to work
out where their overland flow could
go to and ask permission to look
down/ CCTV other peoples drains?
(and would a CCTV survey have
found it anyway?)
46

47. 2 CDOIF COMAH ERAs for
Lower Tier sites later (whisky!)
• We have become experts in:
– Ethanol biodegradation in soil
– Ethanol biodegradation in surface waters (we
still don’t know about salt water effects)
– Re-using existing models to suit, writing new
ones (not reverse engineering, that’s illegal!)
• Is it sensible to have a standard method
which, done thoroughly, takes the
authors to the edge of current knowledge
(and beyond)?
47

48. Why have we got into this
state?
• The CDOIF document is a classic
example of good old-fashioned
British “gold-plating”
• Not inflicted by legislation or
bureaucrats, but mainly inflicted by
industry and HSE on industry
• By BIG industry on everybody else
…. but they can afford to do it….
48

49. There is NO requirement from
EU:
• To have sub-sets of different MATTE types
• To use such detailed frequencies as part of
an ERA
• To do anything like the CDOIF method
• So why are we spending so much time
and effort on report writing when we could
be upgrading our infrastructure, or putting
in fire prevention, or better lightning
protection, or other things which will
actually mitigate incidents?
49

50. CDOIF seems to have been
written from this perspective:
• “We know everything about a site’s
environment”
• “We know everything which can
happen to a hazardous substance
within the soil, groundwater and
surface water”
• “We can put realistic frequencies on
the probabilities of various incidents
happening”
50

51. This works for releases of
energy, or to atmosphere:
• Explosions
• Fires
• Toxic release of gas
•But CDOIF assumes that we
know far more about the
natural world than we
actually do!
51

52. Is CDOIF fit for purpose?
• In certain Upper Tier circumstances,
ye-e-es: simple sites, well
characterised, simple receiving
environments, no or little
degradation (e.g. oil and gas sites)
• For more typical chemical or process
Upper Tier sites, barely fit to unfit
• For Lower Tier sites, unfit
52

53. All these problems add up to
one thing:
• Too much effort and investment is
being spent on the ERA
• When it should be being spent where
it actually counts, which is on the
improvements to the plant,
processes, people, and protecting
people and the environment to the
best of our understanding and
abilities.
53

54. Does CDOIF help with the
main COMAH ERA problems?
1) Insufficient SPR analysis - no
2) Not taking pollution far enough from site either down-wind
or downstream - no
3) Not taking worst-case quantities because “it can’t happen
here” - no
4) People sticking in conceptual “comfort zone” – flammable
risks on flammable sites, physical hazards at formulators,
reaction hazards at chemical manufacturers - no
5) Different sites/ consultants using different risk matrices –
inconsistency – yes
6) Lack of guidance for Lower Tier sites - yes
54

55. So CDOIF:
• Only works in a few cases
• Only solves two out of what we
consider to be the six main problems
with COMAH ERA (the ones which most
affect regulators, funnily enough)
• Adds to workload and expense
considerably without improving
technical quality
55

56. The COMAH ERA method:
• Needs to be simplified – too many
calculations, too much error
• Needs to include uncertainty in a
sensible way
• Needs to help people with basic
conceptualisation of site and
potential risks – this will improve
ERA quality more than anything
56

57. SPR method for COMAH
• Does not rely on frequencies of incident
• Less open to “gaming”
• Relies more on practical skills -
infrastructure inspection and investment
• May not always pick up on larger initiating
incidents properly, and still requires good
SPR, but can be improved with better
guidance and support
• Can also be improved for overall
consistency of approach
57

58. To everyone involved in writing
or understanding a CDOIF
COMAH ERA (whether site staff,
managers, consultants or even regulators):
GOOD LUCK
You’ll need it!
58

59. 59
Thank you very much
• For help with COMAH ERA, email
janet@ttenvironmental.co.uk
• We have a copy of DETR 1999 if anyone needs it,
or if any links in slideshare don’t work
• Contact tel 01422 24 22 22
Linkedin: https://uk.linkedin.com/pub/janet-
greenwood/7/166/700
Twitter: www.twitter.com/ttenvironmental
Facebook: www.facebook.com/ttenvironmental
Website: www.ttenvironmental.co.uk