SYMPOSIUM SERIES NO 162 HAZARDS 27 © 2017 IChemE
1
Practical application of the Chemical and Downstream Oil Industry Forum
(CDOIF) Guideline “Environmental Risk Tolerability for COMAH
Establishments”
Ron Graham BSc CEng FIMechE, COMAH Manager, Sellafield Ltd, Seascale, Cumbria CA20 1PG
Introduction
Sellafield Ltd is registered as a Lower Tier establishment under the Control of Major Accident Hazards (COMAH)
Regulations 2015.
A key activity, working towards COMAH compliance, is to conduct Major Accident to the Environment (MATTE)
assessments.
Sellafield Ltd site is adjacent to a Marine Conservation Zone (MCZ) and near to a coastline Special Area of Conservation
(SAC).
Sellafield Ltd worked in partnership with Amec Foster Wheeler utilising the Chemical and Downstream Oil Industry Forum
(CDOIF) guideline “Environmental Risk Tolerability for COMAH Establishments 2013 [1], and the “Guidance on the
Interpretation of Major Accident to the Environment for the Purpose of the COMAH Regulations, by the Department of the
Environment, Transport and the Region (DETR) [2].
The assessment method employed was tailored to facilitate application of the CDOIF method for assessing the risk of Major
Accident to the Environment (MATTE), and incorporates the CDOIF risk ranking method and matrix.
Definition of a Major Accident to the Environment (MATTE)
COMAH 2015 clarifies the definition of a MATTE by the following text: ‘an incident will also be a major accident if it
results in serious danger, whether realised or potential, to the natural or built environment. The effect may be immediate or
delayed and may sometimes be relatively long-lasting but not necessarily irreversible. Operators should consider the
potential for widespread loss or damage to the general environment as well as the risk adverse effects on a rare, unique or
otherwise valued component of our natural or built environment. Details of the surroundings will form part of the safety
report for upper-tier establishments.
A MATTE scenario is therefore an acute event which has the potential for severe, long-term / permanent damage to the built
or natural environment (e.g. ancient monuments or eco systems).
Environmental Risk Assessment Methodology
The adopted model for environmental risk assessment follows a Source Pathway Receptor model as is
outlined within CDOIF and DETR Guidelines
Source Assessment of the properties of the substance, identification of environmental hazards and potential
impact on receptors
Pathway Review of onsite pathways, assessing how a release could breach site containment and the
assessment of offsite pathways to identified vulnerable receptors
Receptor Determination of the consequences of release on vulnerable receptors, with analysis of the
environmental tolerability by the receptor. This is further assessed considering:
o Severity of harm on the receptor (the extent of the effect in terms of area % or of habitat affected)
o The harm duration and / or receptor recovery timeframe
In addition to the severity and harm of the scenario, the likelihood of the scenario occurring is used to find the overall
environmental risk of the scenario.
The CDOIF guidelines require the risk level of an unmitigated release to be determined and compared to a set of MATTE
threshold criteria; these vary depending on the receptor type and vulnerability. Unmitigated releases do not take credit for
any safeguarding measures (e.g. operator intervention, containment, isolation)
The CDOIF guidance adopts a screening approach. Where unmitigated release is Sub-MATTE then no further assessment is
undertaken. However where the potential for MATTE is identified in the initial scenario screening, further assessment is
required to provide a refined understanding of the level of risk posed and the effectiveness of the safeguarding measures in
place.
MATTE threshold criteria are outlined below within Table 1.
SYMPOSIUM SERIES NO 162 HAZARDS 27 © 2017 IChemE
2
Table 1: MATTE Definitions and Damage Criteria
If the unmitigated risk is considered to be ‘intolerable’ or tolerable if as far as reasonably practicable (TifALARP), then risk
management strategies would normally be considered within a MATTE assessment. (Hierarchy of control)
Elimination of the risk
Prevention of the risk
Control of the risk
Mitigation of the risk through emergency responses
Severity of Harm
The criteria for the determination of the level of consequence of an unmitigated release are outlined within the CDOIF
guidance. The severity levels of Significant, Severe, Major and Catastrophic are also established within the guidance for
each receptor type, with guidance included on the boundaries between these severities of harm categories. The severity of
harm levels for each receptor type is duplicated from the CDOIF guidance in Table 1.1.
Table 1.1: MATTE Severity of Harm
Duration of Harm
In addition to the severity of harm for a scenario, the duration of harm (i.e. exposure and the time for recovery) must be
reviewed to allow the complete extent of an unmitigated potential for MATTE to be assessed. In the CDOIF methodology
for an incident to be considered as a major accident, there must be persistence in the effects caused, or alternately a delay in
recovery of the environment to pre-incident conditions. The criteria for duration of harm varies depending on receptor
category, as outlined in Table 1.2
SYMPOSIUM SERIES NO 162 HAZARDS 27 © 2017 IChemE
3
Table 1.2: MATTE Duration of Harm
Receptor MATTE Tolerability
Upon determination of both the severity of harm and duration of harm expected for the scenario, the overall receptor
MATTE tolerability can be determined by application of the CDOIF tolerability matrix, as shown in Table 1.3.
Table 1.3: MATTE Receptor Tolerability
A CDOIF risk matrix can be used, from the values in the table which allows easy visualisation of the frequencies and
tolerability regions with regards to varying degrees of MATTE scenarios, as contained in the CDOIF Tolerability matrix
Table 1.4. This represents aggregated risk by receptor (i.e. it combines risk from all contributors in its evaluation of
tolerability).
SYMPOSIUM SERIES NO 162 HAZARDS 27 © 2017 IChemE
4
Table 1.4: CDOIF Tolerability Matrix
Within the CDOIF risk matrix the coloured segments indicate different tolerability rankings:
Green Broadly acceptable risk:
Orange Tolerable if ALARP (TifALARP)
Red Intolerable Risk
If a scenario produces an outcome within the TifALARP (orange) or Intolerable (red) categories then a risk management
strategy should be assessed for elimination/ mitigation. Additionally a scenario outcome of Broadly Acceptable (green) does
not by itself infer ALARP has been demonstrated. The tolerability matrix is used to benchmark both mitigated and
unmitigated risk.
Phase 1of the Project
Initial data review and identification of priority facilities
The Establishment major Chemical Hazard Inventory (EMCHI) provided
Substances
Location
Quantity
Concentrations
Storage Conditions (Solid/Liquid/gas, Temperature, Pressure etc.)
The highest risk catchment areas were established and if substances on site could affect them.
Phase 1a - MATTE Potential
Assessment of substances held on site and their locations which identify the highest quantity of substances, the most
hazardous substances, the highest risk catchment areas and the highest risk local environmental receptors and if substances
on site could affect them.
Review of potential MATTE (with completion of CDOIF tables)
MATTE substances Table 1 (CDOIF App 5)
Receptors in the local environment under the CDOIF definitions for MATTE if affected by events
greater than their thresholds (Table 2 CDOIF App 5)
Definition of scenarios / substances which could affect receptors at / above the levels for potential
MATTE including all credible and high consequence events (Table 3 CDOIF App 5)
Substance hazard information for confirmed MATTE risk substances (Table 4 CDOIF App 5)
The CDOIF guidelines require the risk level of an unmitigated release to be determined and compared to a set of
MATTE threshold criteria; these vary depending on the receptor type and vulnerability. Leading to the
determination of target frequencies
Phase 1b - Risk Screen
If the unmitigated risk is considered to be ‘intolerable’ or tolerable if as far as reasonably practicable (TifALARP),
then risk management strategies would normally be considered within a MATTE assessment. (Hierarchy of
control)
It is important that the initial screening process is completed with the relevant expertise to ensure confidence in a detailed
assessment programme. This avoids organisations trying to carry out detailed assessments on relatively minor scenarios
creating unnecessary and expensive work.
Phase 1 Outcome
Assessment of substances held on site and their locations
Identified highest risk facilities
SYMPOSIUM SERIES NO 162 HAZARDS 27 © 2017 IChemE
5
Highest quantity of substances
Most hazardous substances
Identified highest risk ‘catchment areas’
Identified highest risk environmental receptors
Initiated the creation of a prioritised programme for detailed Environmental Risk Assessment (Phase 2)
Phase 2 of the Project Overview
Detailed review of highest risk identified facilities
Development of conceptual model and Source-Pathway-Receptor (SPR)
Review of substances within facility
Unit size; storage location; delivery method; protection measures in place etc.
Environmental Hazard Identification (ENVID)
Identify potential MATTE scenarios
Assessment and review of unmitigated ‘worst case’ scenarios
Assessment and review of ‘mitigated’ scenarios
Risk evaluation and ALARP assessment
Pre-Study and Information Gathering / Desktop Review
Extensive research and information gathering was carried out prior to the onsite study to allow the assessments to be
conducted effectively.
Key information gathered:
COMAH dangerous substance inventory
Manufacturer’s safety data sheets (MSDS)
Control of Substances Hazardous to Health (COSHH) assessments
Storage locations
General arrangement drawings / layouts and elevations
Process descriptions and process flow data sheets
Deliveries, loading / unloading operations
Containment details, bunding, shared bunds
Local groundwork (concrete, substrate)
Venting and scrubbing arrangements (air bound MATTE substances)
Site layout
GIS mapping
Drainage plans
Operating and maintenance procedures
Operational experience of past environmental events
Onsite and offsite environmental information.
Receptor information on environmentally sensitive receptors offsite
Designated area: national (SSSI, NNR, MNR) and international and European sites: RAMSAR, SAC, SPA
Other designated land (LNR, AONB, ESA, NSA, greenbelt, national parks, wildlife trusts, national trust, common
land / country parks
Scarce habitat (land/water), biodiversity action plan habitats/geological features/built heritage (outside of built
environment definition)
Non-designated land (crops, grazing, agricultural and other widespread habitat eg forestry and amenity)
Non-designated water (fishing, amenity or aquaculture)
Groundwater (drinking (public/private), non- drinking
Soil/sediment type/nature(to 1m depth), including summary baseline of contaminated land
Built environment Grade 1/Category A buildings, monuments, conservation areas
Particular Species: high value special protection species (land/air/water) and significant populations (>1%
population or >5% of a plant’s ground cover in area)
Marine: sea bird and mammal density/populations, benthic community, littoral/sublittoral zone
Freshwater and estuarine habitats (ponds, estuaries, reservoirs, lakes, rivers and sources for public/private
drinking water (including water utilities facilities)
Operating conditions for COMAH substances
PID/PFD, Cause and effect drawings (relevant to Environment/MATTE hazards)
SIL certificates/ Functional Safety Management system documentation for critical equipment
Details of remediation and restoration arrangements and plans
Emergency onsite / offsite plan
Site Environmental summary data (e.g. met data, sea conditions and topographical data)
Existing Environmental studies (baseline studies, ecological studies, registers and reports on built and natural
environment
Existing environmental consequence models including marine dispersion if available
Gap analysis/Register of compliance with good practice and applicable codes and standards
Safety reports / HAZANs for facility that relate to losses of containment with impact on the environment
SYMPOSIUM SERIES NO 162 HAZARDS 27 © 2017 IChemE
6
Phase 2 Detailed Assessments
The quality of the Hazard Identification (HAZID) is dependent upon the knowledge and experience of team members
involved. Therefore, selection of team members is critical for successful ENVID study. The total number of attendees should
ideally not exceed 12, including scribe and facilitator.
Members of the Phase 1 Team: Facilitator, Technical Scribe, Operations Specialist, Operator Representative, Drainage
Specialist, Process Specialist, Maintenance / Mechanical Specialist, Control and Instrumentation Specialist, Emergency
Response Advisor, Health, Safety and Environmental Specialists
Individual competency includes practical knowledge of current and planned operations, relevant experience and
qualifications.
The Environmental Impact Identification (ENVID) workshops begin with a Plant Walk Down involving ENVID facilitator
and scribe and process specialist
Method
At the start of the study, the Facilitator introduced the methodology to the participants and outline how the study
will be approached
Prior to the study, the Facilitator identified sub-sections (nodes) appropriate for the establishment under
consideration. Example “Road Tanker transit to offload point”
At the start of each node, the node will be defined to identify the equipment, activities and substances under
consideration
The team then:
Used Guidewords (appendix (i) to identify potential hazardous events and:
Completed the ENVID table (appendix (ii):
o Consolidating causes in a single scenario where the effects and safeguards are the same
o Creating a separate row to analyse different outcomes e.g. toxic release, fire, explosion; and
o Recording existing safeguards by type (inherent safety, prevention, control and mitigation)
(The format of the (ENVID) recording table was developed so that safeguards can be separated by hierarchy, i.e.
inherent safety measures, prevention control and mitigation)
Risk Ranking - Environmental:
The Environmental Risk Ranking applies the method developed by CDOIF and described in the CDOIF Guideline
“Environmental Risk Tolerability for COMAH Establishments”. The risk ranking uses three criteria:
Severity of Harm (the extent of the effect in terms of area of habitat affected) this factor also depends on the type
of receptor that is impacted; A benchmark LC10 toxicity was established by taking the lowest literature eco-
toxicity LC50/EC50 and dividing by 5. This provided an additional layer of conservation to ensure minimal
receptor / species damage.
Harm Duration / Recovery Criteria: and
Likelihood (Frequency)
Where required, recommendations for further detailed analysis, where the output of the high level screening
indicates that the residual that the residual risk on one or more MATTE is TifALARP (Tolerable if As Low as
Reasonably Practicable) or intolerable (based on the CDOIF classifications)
Risk evaluation and tolerability assessment
Control and mitigation measures analysis
Demonstration that the risk is ALARP (i.e. that All Measures Necessary has been adopted) for environmental
hazards. ALARP review carried out with the team responsible for each MATTE assessment.
Conclusions
All MATTE Assessments are complete for the identified phase 2 facilities
All identified MATTE scenarios are tolerable if ALARP
Further risk reduction measures identified
SYMPOSIUM SERIES NO 162 HAZARDS 27 © 2017 IChemE
7
References
1. Control of Major Accident Hazards Regulations (COMAH)
2. Covered Major Accidents to the Environment (MATTE)
3. Chemical and Downstream Oil Industries Forum (CDOIF)
4. Guideline Environmental Risk Tolerability for COMAH Establishments published 2014
Does not replace 1999 DETR guidance but provide framework for its implementation
Appendix (i) Guidewords
Hazard Category
Guideword
Environmental Hazards (to land, air and water) (including
from firewater run off)
Loss of containment (e.g. substances dangerous to the
environment)
Firewater Run Off (contamination, combustion products, in
burned substances)
Recovery (e.g. clean up chemicals)
Catastrophic primary containment failure
Non-catastrophic failure of primary containment (e.g. Tank
shell leak)
Failure of secondary containment including exceeding
capacity
Failure of Tertiary containment
Tank overfill
Tank floor failure / surface integrity failure
Roof Fire / Explosion
Warehouse Fire
Incompatible Materials
Interaction within drainage system
Fire damage to the environment
Human Error
Release to Air / Smoke / Toxic
Release to Water (marine)
Release to Water (fresh / estuarine)
Release to Drinking Water source (treatment / reservoir etc.)
Release to Groundwater
Release to Soil / Sediment
Release to Habitat / Species
Release to SSSI / Designated site
Impact on Built environment
Other “Serious Dangers” to the environment involving
dangerous substances
Fire Damage
Thermal Radiation
Other loss of containment (e.g. asphyxiant)
Human Error / Non-compliance
Maintenance
Mal-operation (too late/ too early / too much / incomplete /
omitted/ right operation on wrong object / Procedural Error
or non-compliance
SYMPOSIUM SERIES NO 162 HAZARDS 27 © 2017 IChemE
8
Checking error (omitted / too late/ too early/ right check on
wrong object
Ergonomics
Resource / staff numbers
Training / Competence
Stress/ Fatigue
Complexity of task
Communication
Loss of primary containment without ignition
Material Selection
Over Filling
Over Pressure
Other process Deviation (Reverse Flow / Misdirected Flow /
Level / Temperature
Thermal Cycling / Fatigue
Ageing Plant
Corrosion / Erosion
Structural Failure
Impact Collision / Dropped or Swung Objects
Cryogenic Failure / Embrittlement
Maintenance / Cleaning / Containment
Failure of Power / Utilities
Electricity
Water
Compressed Air
Steam
Natural Gas
Control Systems
Communication
External Hazards
Seismic Event
Flooding
Lightning
Aircraft Crash
Terrorism
Vandalism / Theft
Off-site / Neighbouring fire / explosion
Subsidence
Historic Site Specific Hazards
e.g. Unexploded Ordnance
Other
Previous Incidents
SYMPOSIUM SERIES NO 162 HAZARDS 27 © 2017 IChemE
9
Appendix (ii) ENVID Recording Sheet