| Bottom | | Front page |

Environmental Project No. 1269, 2009

Acceptance criteria in Denmark and the EU

Contents

Preface

Summary and conclusions

1 Explanation of terms

• 1.1 Introduction
• 1.2 Hazard, consequence and risk
  • 1.2.1 Risk matrices
  • 1.2.2 Consequence distance and maximum consequence distance
  • 1.2.3 Location-based (individual) risk
  • 1.2.4 Societal or group risk
  • 1.2.5 Potential Loss of Life (PLL)
• 1.3 Land use planning and major hazard establishments
  • 1.3.1 Safety distances
  • 1.3.2 Risk analysis methods

2 Earlier Danish studies

• 2.1 Environment Project 112
  • 2.1.1 Recommendations in Environment Project 112 for quantitative risk acceptance criteria
  • 2.1.2 Recommendations in Environment Project 112 for qualitative acceptance criteria
• 2.2 The ‘Tønder Report’

3 Use of risk acceptance criteria within the EU

• 3.1 Land Use Planning Guidelines from the European Commission
  • 3.1.1 Risk analysis methods and risk criteria
  • 3.1.2 Other technical issues
• 3.2 European Commission’s examples of risk analysis methods (‘Roadmaps’)
• 3.3 Risk acceptance criteria in Finland
• 3.4 Risk acceptance criteria in Flanders
• 3.5 Risk acceptance criteria in France
• 3.6 Risk acceptance criteria in the Netherlands
• 3.7 Risk acceptance criteria in Iceland
• 3.8 Risk acceptance criteria in the United Kingdom
• 3.9 Risk acceptance criteria in Germany

4 Discussion of risk acceptance criteria

• 4.1 Discussion of developments within Denmark
• 4.2 Discussion of review of practices within the EU
  • 4.2.1 Qualitative versus quantitative criteria methods
  • 4.2.2 Ensuring consistent and uniform decisions
  • 4.2.3 Comparison of quantitative risk acceptance criteria
  • 4.2.4 Existing and new situations
  • 4.2.5 Dealing with vulnerable objects (such as hospitals, schools, and infrastructure)
  • 4.2.6 Risk acceptance criteria for environmental damage
  • 4.2.7 Risk acceptance criteria for personal injury
• 4.3 General observations
  • 4.3.1 Individual risk level and protection of vulnerable objects
  • 4.3.2 Societal risk and risk aversion
  • 4.3.3 Frequencies for reference accident scenarios and maximum consequence distances
  • 4.3.4 Risk acceptance criteria for existing and new situations
  • 4.3.5 Risk acceptance criteria for environmental damage
  • 4.3.6 Risk acceptance criteria for personal injury

5 Conclusions and recommendations regarding use of risk acceptance criteria in Denmark

• 5.1 Status in Denmark and the EU
• 5.2 Risk acceptance criteria requirements
• 5.3 Incorporating frequency criteria
• 5.4 Protection of vulnerable objects
• 5.5 Risk analysis methods
• 5.6 Needs for further work

6 Glossary

7 References

Preface

In connection with an environmental and emergency-planning review of major hazard establishments in Denmark, the Danish Emergency Management Agency, the Agency for Spatial and Environmental Planning, and the Environmental Protection Agency decided to investigate the use of acceptance criteria for risk to third parties in other EU countries, and compare these with Danish criteria. A task force has gathered the relevant information from a number of EU countries. This report contains the results from a review of this information, and makes comparisons with the situation in Denmark. The report concludes with some observations on how these experiences from other countries can be applied within Denmark. The report thus serves as a supplement to previous contributions in this area.

The report is targeted at major hazard authorities in Danish local authorities and the regional environmental centres of the Danish Ministry of the Environment, and may also be of interest to the major hazard establishments themselves.

Major hazard authorities need risk acceptance criteria that can be used in the following situations:

• when auditing environmental permits for existing major hazard establishments,
• when planning changes in land use (in municipal or local plans) close to existing major hazard establishments,
• in connection with environmental impact assessment and environmental permit for expansion or changes to existing major hazard establishments, and
• when establishing new major hazard establishments.

Risk acceptance criteria have to protect human life and health, as well as environmental resources and natural areas.

“Environment Project 112” (Taylor et al., 1989) provides an important data basis by gathering methods and data for risk assessment of major hazard establishments in Denmark. Most of the considerations in Environment Project 112 are still current. This report may therefore be viewed as an update to the basis of Environment Project 112, based on developments and experience within Denmark and a number of other European countries since 1989.

The report has the following structure:

Chapter one reviews the relevant terms used in risk assessment, and provides a brief description of two different types of risk analysis method (quantitative and qualitative). A glossary at the end of the report contains a brief explanation of these and other relevant terms in the report.

Chapter two reviews previous Danish studies. This includes Environment Project 112, and a recent report reflecting changes in risk analysis and acceptance practices in Denmark.

Chapter three reviews risk analysis and acceptance practices in the European Union, based on documents prepared by the European Commission, and special information obtained from selected countries (Finland, Flanders, France, Germany, Iceland, the Netherlands and the United Kingdom).

Chapter four discusses and compares the information presented in chapters two and three to provide a picture of the current status of certain issues. The chapter closes with a number of conclusions for the areas where the review indicates consensus, and provides possible solutions where consensus is lacking – for example, in relation to dealing with environmental damage.

Chapter five concludes with recommendations for how this experience might be applied in Denmark. These recommendations consist of a summary of a number of requirements for general risk acceptance criteria and assessment methods, and a proposal for the general design of risk acceptance criteria and assessment methods in Denmark.

Chapter six includes a glossary of the most important terms used in this report.

This report was prepared by Nijs Jan Duijm (DTU Management Engineering, consultant and writer) between November 2007 and April 2008.

A task force consisting of:

• Allan Thomsen (Danish Emergency Management Agency)
• Anne Christine Bryderup (Danish Emergency Management Agency)
• Gert Johansen (Danish Agency for Spatial and Environmental Planning)
• Nanna Rørbech (Danish Environmental Protection Agency)
• Anders Skou (Danish Environmental Protection Agency) and
• Axel Bendtsen (Danish Environmental Protection Agency, coordinator)

has served as a monitoring group.

The conclusions of the report do not necessarily represent the opinions of the Danish Emergency Management Agency, the Agency for Spatial and Environmental Planning, or the Environmental Protection Agency.

Summary and conclusions

This report describes the use of risk acceptance criteria in order to identify conflicts between major hazard establishments (establishments covered by the major hazard (“Seveso”) directives) and surrounding land use with respect to protection of human life and environment.

The report explains relevant notions in risk assessment and a glossary is included. The report describes different types of risk acceptance criteria based on individual or location-based risk, societal risk and potential loss of life. The different types of risk assessment methodologies are described.

Earlier Danish studies are reviewed, including “Environment Project 112”, in order to identify the background for the present practice in Denmark, and the practice for risk acceptance in a number of other European countries is summarised.

Conclusions are drawn where European practice has converged towards consensus regarding risk acceptance criteria, viz. the order of magnitude for individual or location-based risk (fatality risk of an individual shall be less than 10^-6 per year for the protection of the general population) and societal risk (the probability of an accident shall be less than 10^-3 per year for major accidents with up to 1 fatality, dropping with a factor 100 when consequences are ten times bigger). These values are in the middle of the “grey” zone proposed by “Environmental Project 112”.

The ALARA (As Low As Reasonably Achievable) principle states that all safety precautions should be implemented that are reasonable in view of technical and economical possibilities. The ALARA principle should always be applied, and therefore it is not necessary to define separate intervals of risk where ALARA has to be used.

The report concludes that in Denmark no guidance is available on how safety distances should be determined using the available qualitative risk analysis methods, nor is a method to assess environmental damage available. It is proposed to define accident classifications for environmental damage similarly to those used for qualitative assessment of societal risk, by using the size of the area affected by the accident.

The report’s conclusions give some recommendations on risk acceptance criteria. These criteria have to fulfil requirements regarding:

• Consistency, proportionality and transparency.
• All accident possibilities to be considered.
• Environmental damage to be considered.
• Reasonable safety distances (for land-use limitations) to be determined as well as the consequence distance for the worst-case accident (for emergency planning).
• Societal risk for land use outside the safety distances to be assessed.
• Specific safety measures at the establishment to be considered.

It is necessary to consider the probability of events in the assessments, as probability is elementary in the notion of risk. Inclusion of probability can be either quantitatively or qualitatively.

Limitations in land use distinguishes between vulnerability of different objects such as residential areas, hospitals, schools or natural reserves; generally higher levels of risk are accepted in industrial areas as compared to residential areas, while hospitals and emergency support facilities should be given the best protection possible. The same risk criteria should apply, if needed after a transitional period, for existing land-use situations and new developments.

The use of quantitative and qualitative risk analysis methods should be possible side by side, but efforts should be directed into making the results more comparable. This means that among others there should be obtained consensus about the relation between verbal descriptions and the numerical values of accident probabilities. The French risk assessment method, which includes both quantitative and qualitative elements, could be used as a basis for a relatively simple and transparent risk assessment method in Denmark.

Further work is required in order to develop the qualitative methods to determine safety distances, to develop criteria and methods to deal with risks for environmental damage, and to develop a practical guideline for the use of the ALARA principle.

1 Explanation of terms

• 1.1 Introduction
• 1.2 Hazard, consequence and risk
  • 1.2.1 Risk matrices
  • 1.2.2 Consequence distance and maximum consequence distance
  • 1.2.3 Location-based (individual) risk
  • 1.2.4 Societal or group risk
  • 1.2.5 Potential Loss of Life (PLL)
• 1.3 Land use planning and major hazard establishments
  • 1.3.1 Safety distances
  • 1.3.2 Risk analysis methods

1.1 Introduction

Words such as ‘risk’, ‘hazard’ and ‘consequence’ are commonly used. Yet communication about risk can sometimes be difficult, as the precise definitions used by risk experts are not always understood by non-experts with their more subjective perception of these terms.

This chapter will explain these terms as they are used by experts in the field of assessing risk of industrial activities. Earlier publications exist in which these terms are defined and discussed (in Danish), including Environment Project 112 (Taylor et al., 1989), Danish Standard DS/INF 85 (Dansk Standard, 1993) and a paper by the Danish Environmental Risk Council (Christensen et al., 2002; Christensen et al., 2003). This report adheres most closely to the definitions in Danish Standard DS/INF 85. There is a glossary at the end of the report containing the most important terms.

1.2 Hazard, consequence and risk

The terms, ‘hazard’, ‘consequence’, and ‘risk’, are used in the risk analysis process.

In order to determine the risks an activity may entail, one must first identify the hazards inherent in the activity. A ‘hazard’ is defined as a situation or state that could lead to injury. It thus refers to the possibility of an accident, without considering probability or consequences.

A ‘consequence’ is the result of an undesired event (an accident), such as injury to health, life, assets, or the environment.

‘Risk’ expresses a combination of the frequency (or probability) of an undesired event, and the scope of the consequences. ‘Risk’ is used in order to be able to compare various events in terms of the highest or lowest risk. Risks must either be classified qualitatively or expressed using a quantitative value, if they are to be ranked. A common quantitative expression for risk is the consequence (expressed in a particular unit, such as number of deaths, or financial loss) multiplied by the probability. This expression of risk is also called the expected loss, but it is only one of many options for expressing risk as a combination of consequence and probability.

When we discuss risk criteria for third parties at major hazard establishments (i.e. people other than employees of the establishment), there are various relevant ways to express risk. The most common terms are individual risk and societal risk. The concept of consequence distance is useful when one is unable or unwilling to calculate risk quantitatively. It can also be used in combination with a risk matrix. These terms are explained further in the following sections.

It should be noted that terms have not yet been developed for assessing the environmental impacts of major accidents. Environmental damage is only discussed qualitatively. This will be further dealt with in section 4.3.5.

1.2.1 Risk matrices

Risk analysis produces a list of accident scenarios, i.e. various potential accidents involving fire, explosion and/or the emission of dangerous substances into the environment (air, water, or soil). For each of these scenarios, one can assess:

• The probability (expected frequency)
• The magnitude or extent of the consequences

This allows the scenarios to be entered in a table ranking probability classifications on one axis (e.g. from frequent to extremely rare) and consequence classifications on the other axis. Such a table is called a risk matrix. Each field in a risk matrix represents a particular risk, and you can identify the sections of the matrix showing major risks (high probability and major consequences) and minor risks (low probability and minor consequences), see Table 1.

Table 1. Example risk matrix.
Risk increases from low to high as you move along the diagonal from the bottom left to the upper right corner. The letters (A, B, C, etc.) illustrate how you can enter example accident scenarios in the table.

1.2.2 Consequence distance and maximum consequence distance

One can calculate the maximum distance within which fatalities or injury can occur for each potential accident. Consequence distance is generally defined as the distance within which death or serious injury is expected (most units for measuring risk and risk criteria are based on fatality alone, but this problem will be discussed later). The consequence distance is either based on the distance within which a particular mortality rate would be expected (a mortality rate of one per cent is used in many studies and methods, e.g. the distance to a concentration level of ‘LC 1%’^¹), or the distance to a particular end-point value for toxicity, heat radiation, or overpressure. The spread of toxic or explosive gas clouds will depend on meteorological conditions. One can use the worst scenario (e.g. scenario ‘G’ in Table 1) and the worst case meteorological factors to determine the maximum consequence distance that applies to the establishment in question. The establishment will not represent a risk to human life outside the maximum consequence distance.

1.2.3 Location-based (individual) risk

The term, ‘individual risk’, is often used in relation to quantitative risk criteria. DS/INF 85 defines individual risk as the risk an individual is exposed to, based on their distance from the risk source. This person-linked definition is problematic in relation to land use planning for major hazard establishments, as it involves assumptions about the movements and presence of individuals, which are not significant to understanding the risk situation surrounding the establishment. In the Netherlands and Flanders the term ‘location-based risk’^² has therefore been introduced. Location-based risk is calculated as the risk that a person who is continually present and unprotected at a given location will die as a result of an accident within the establishment.

Figure 1. Example ISO risk curves showing the distribution of location-based (individual) risk surrounding an enterprise.

Location-based risk describes the geographic distribution of risk for the establishment in question. It is shown using ISO risk curves, and is not dependent on whether people or residences are present (see Figure 1). Location-based risk is used to assess whether individuals are exposed to more than an acceptable risk in the locations where they may spend time (e.g. where they live or work). It does not directly provide information on potential loss of life. Nor does it distinguish exposure affecting employees or the general population (By only drawing risk curves outside the company the indication is made that employees will not be considered in the assessment).

In order to maintain continuity with the commonly used term, this report will use the term ‘location-based (individual) risk’.

1.2.4 Societal or group risk

Societal risk expresses the risk that a group of people is simultaneously exposed to the consequences of an accident. This is expressed – using an ‘F-N curve’ – as a relationship between the expected frequency of the accident, and the number of people who will die (or be injured) as a result of the accident. ‘F’ is the (cumulative) frequency of an accident involving more than N deaths^³, see Figure 2. The result expresses the total expected simultaneous loss to the community. Calculation of an F-N curve takes into account the probability of a number of accident scenarios, and an assessment of how many people might be exposed to consequences under these scenarios, based on population density, places of work, and local protection (whether they are indoors or outdoors). Practices differ regarding the inclusion of the establishments workforce as well as employees at surrounding establishments, or if only the general population is included. Figure 2 shows an example societal risk curve. Each step in the curve represents an accident scenario.

Criteria for societal risk and location-based risk are used to complement each other. Criteria for location-based risk are used to determine areas (risk zones) which may not be used for residential or similar purposes, and ensure that individual persons are not exposed to excessive risk. Criteria for societal risk are used to ensure that locations where many people may assemble are not exposed to excessive risk of a major accident, even if they lie outside the risk zones. This is explained further in section 1.3.1.

Figure 2. Example societal risk curve for an establishment.
The first ‘step’ on the right side of the curve shows the most severe accident scenario (estimated to lead to approx. 400 fatalities, with a frequency of 10^-9 per year). The second step shows the contribution from the second-most severe accident (estimated to lead to approx. 200 fatalities, with a frequency of 3×10^-9 per year).

1.2.5 Potential Loss of Life (PLL)

The concept of potential loss of life (PLL) is occasionally used when discussing risk acceptance for third parties. This is an easily understood term used in relation to dangerous workplaces, such as oil rigs. The potential loss of life is calculated by summing up (i.e. using mathematical integration) the location-based (individual) risks, multiplied by the population density for each location (after assessing local protection due to people being indoors or outdoors) for the entire area within the maximum consequence distance. The result is a simple figure (expressed as the number of deaths per year), expressing the total potential loss of life to the community. However, unlike societal risk, it does not take into account whether the loss results from many small accidents, or a few large ones. Potential loss of life is used indirectly in the United Kingdom when risk acceptance criteria are formulated as the maximum number of people to whom exposure to a particular location-based (individual) risk is acceptable.

1.3 Land use planning and major hazard establishments

1.3.1 Safety distances

Clearly, the risk of being affected by an accident at a chemical plant or a warehouse storing dangerous substances is greatest close to the risk source. The risk of injury to neighbouring residents and/or damage to conservation-worthy natural habitats due to accidents in major hazard establishments can be effectively managed by controlling the distance between such establishments and the objects to be protected. However, risk zones surrounding major hazard establishments that cannot be used for residential or business purposes represent a cost to society. It is often very expensive to locate major hazard establishments at a distance greater than the maximum consequence distance from populated areas and other vulnerable objects. People are exposed to other involuntary^[4] risks deriving from human activity (such as traffic), and it is therefore seen as acceptable to expose the population to a certain minor risk from major hazard establishments. However, it is difficult to define how small this risk ought to be, i.e. to lay down risk acceptance criteria, and to develop a method to ensure compliance with these criteria in practice. Figure 3 illustrates the difference between the maximum consequence distance and the safety distance (the distance within which limitations are placed on the movement of people, to prevent them from being exposed to excessive location-based (individual) risk in relation to the agreed risk acceptance criteria).

Societal risk depends on the population density within the maximum consequence distance. The population density within the safety distance will often be low (or effectively zero), so the societal risk is determined by the population density between the safety distance and the maximum consequence distance. An assessment of societal risk is therefore complimentary to an assessment of safety distance. Safety distances are either determined on the basis of location-based (individual) risks, or reference accident scenarios (please refer to the next section).

Figure 3. Illustration of concepts relating to land use planning for major hazard establishments and their surroundings.
The risk is zero at any distance greater than the maximum consequence distance. The safety distance indicates the point at which the risk falls below the risk acceptance criteria, i.e. at greater distances the risk to individuals is acceptable. Iso risk curves show the geographic distribution of location-based (individual) risk.

1.3.2 Risk analysis methods

In order for risk acceptance criteria to work, there must be a relationship between the criteria, and the information generated using the risk analysis methods that are to be compared with the criteria. When using quantitative risk acceptance criteria (such as a particular value for location-based (individual) risk), it is necessary to perform quantitative risk analyses that produce location-based (individual) risks under the same conditions as were used as a basis for the definition of the criteria. Various practices in some EU Member States are reviewed in chapter three. This review shows that the way risk acceptance criteria are formulated is strongly correlated with the methods used for risk analysis.s

Figure 4. Diagram of activities involved in risk analysis

The general activities performed during risk analysis are shown in Figure 4. These activities must be performed for both qualitative and quantitative analyses (although the time required for each activity in the two types of analyses can vary greatly). Risk analysis begins with the identification of all the hazards that exist for a given major hazard establishment. A number of hazards are then analysed in detail by considering the scenario and possible types of consequences. This detailed analysis must clarify how frequent the event is, and what magnitude the consequences would have. These analyses may be qualitative or quantitative (although consequences are usually analysed using quantitative methods, such as simulation of fires, explosions and atmospheric dissemination). The results are combined into an expression of the total risk in a way that can be compared to one or more risk acceptance criteria (this comparison is often called risk assessment).

1.3.2.1 Quantitative risk analysis

The aim of quantitative risk analysis is to generate numeric values for location-based risk and societal risk that include risk contributions from all possible accidents.

There is a clear understanding of the content of a quantitative risk assessment for non-nuclear land-based major hazard establishments. The method has, for example, been explained in the Dutch ‘Purple Book’ (Committee for the Prevention of Disasters, 1999). This method analyses all accident scenarios expected to have an impact outside the establishment’s fence^[5]. The frequency for all these scenarios is determined quantitatively. The consequences are calculated in detail using consequence models for dissemination, explosion, fire and/or toxic effects. This includes calculation of the probability of fatality (or injuries/damage) within the accident consequence area (e.g. the area covered by a toxic cloud). The risk distribution surrounding the establishment for a given scenario is calculated, taking into account probable wind direction and strength. The risks for all accidents are summed up, and the total represents the geographic distribution of location-based (individual) risk for the establishment. Societal risk is calculated by returning to the individual scenarios and determining the frequency for impact on a particular population area, taking into account the scenario frequency and the probability of the necessary wind direction and strength occurring.

1.3.2.2 Qualitative risk analysis

The expression, qualitative risk analysis, covers a range of different methods that do not use numeric values (i.e. precise figures) for location-based (individual) risk or societal risk. The term is therefore less well-defined than quantitative risk analysis.

Qualitative methods are in use because it is difficult to determine expected frequencies for rare accidents. There can be major differences in results from various analysis groups. A factor of 100 is not uncommon due to the use of different data sources (Lauridsen et al., 2002). Another argument for using qualitative methods is that it is impossible for people to comprehend frequencies as low as 10^-6 per year.

Qualitative methods therefore focus primarily on an accident’s consequences, and the consequence models used in qualitative methods are the same as those used in quantitative methods (although often only the distance to a particular damage effect is used, whereas quantitative methods use the entire damage area).

Based on hazard identification (see Figure 4), the worst case accident can be selected. This accident is determined largely by basic physical factors at the establishment, such as the total volume of a dangerous substance (in storage tanks) or the mass flow (in pipes), and its pressure and temperature. The worst case accident might be the total collapse of a tank, or complete rupture of a pipe, in combination with aggravating conditions such as low wind speed and delayed ignition (only once the explosive gas cloud has reached maximum size). The maximum consequence distance is calculated for these scenarios. A purely qualitative method that does not assess probability only results in an expression of the maximum consequence distance (this risk analysis method is sometimes called deterministic).

This is an unsatisfactory situation (see section 1.3.1), and a less serious, but more probable scenario is often selected. This is sometimes referred to as the ‘worst credible accident’. We prefer the more neutral term, ‘reference accident scenario’. The reference accident scenario is used to determine the safety distance. The reference scenario is perceived to be the most serious of all accident scenarios with a frequency high enough to represent an unacceptable risk, while more serious scenarios (including the worst case scenario) are thought to be of such a low frequency that the risk may be discounted.

This approach can lead to the following problems:

• Criteria have not been specified for selecting the reference scenario (i.e. risk acceptance criteria for the qualitative approach).
• The worst case scenario, and hence the maximum consequence distance, is excluded from the risk analysis. The maximum consequence distance is relevant to emergency planning, and as described in section 1.3.1, the region between the safety distance and the maximum consequence distance is pivotal to the assessment of societal risk.

Some consideration of probabilities cannot be avoided, even when using a qualitative approach. Most qualitative methods therefore use frequency classifications based on qualitative verbal descriptions, like those introduced in the risk matrix (Table 1, column one). When such methods begin to incorporate probability considerations (like the effect of subsequent safety measures on accident frequencies), they are called ‘hybrid’’ methods.

The ‘safety-barrier diagram method’ used in Denmark, can also be viewed as a hybrid method. In this method, initiating events and safety barriers are allocated points, depending on the frequency of the event and the barrier failure rate (see section 2.1.2). The method focuses on assessment of initiatives to prevent accidents and reduce consequences, in contrast to the quantitative method described in the ‘Purple Book’. The latter is based on generic (i.e. non-site specific) frequencies for emissions of dangerous substances.

[1] LC x %: Lethal Concentration, the concentration at which x per cent of the exposed population will die.

[2] In Dutch: “Plaatsgebonden risiko”, translated as “locational risk” or “location-based risk” in English. The term, “locational risk”, can mean something different in other contexts.

[3] In practice, the number of deaths is used as the injury parameter, but other parameters can be used, such as the number of injured or the extent of environmental damage.

[4] An involuntary risk is defined as a risk a person is exposed to, even though they have no part in or direct advantage from the activity the risk is associated with

[5] The ‘Purple Book’ contains two specific criteria for the inclusion of a Loss Of Containment (LOC) event in the analysis: (1) the frequency must be greater than 10^-8 per year, and (2) there must be a possibility of deaths (1 % probability) outside the enterprise’s boundary line

2 Earlier Danish studies

• 2.1 Environment Project 112
  • 2.1.1 Recommendations in Environment Project 112 for quantitative risk acceptance criteria
  • 2.1.2 Recommendations in Environment Project 112 for qualitative acceptance criteria
• 2.2 The ‘Tønder Report’

This chapter summarises earlier Danish studies reflecting developments in the practice of risk analysis and acceptance in Denmark. The most important study is known as ‘Environment Project 112’ (Taylor et al., 1989). This study discusses considerations in relation to the choice of risk analysis methods and risk acceptance criteria, and concludes with recommendations in this area. It has subsequently been found that Environment Project 112 does not offer a solution for how to delimit safety zones when using qualitative risk assessments. This has led to further consideration in a report on delimitation of safety zones for an underground natural gas storage facility in Tønder, Denmark (the ‘Tønder Report’) (Danish Environmental Protection Agency, 1996).

2.1 Environment Project 112

Environment Project 112 contains a thorough review of risk analysis methods and acceptance criteria. It recognizes a link between the choice of risk acceptance criteria and risk analysis methods. The report concludes that two analysis or assessment methods can be readily used in practice – a method based on qualitative analysis, and a method based on quantitative analysis. A standards-based method is considered impractical due to the work involved in providing the necessary standards.

The conclusion notes that ‘it has been shown  possible to compare results from the quantitative and qualitative approaches, such that these can provide comparable results under certain conditions’. This is an important condition for regulatory authorities to be able to accept the use of various methods and criteria, in light of the ‘consistency’ requirement formulated in the most recent European Commission Guidelines (European Commission, 2006) (see section 3.1).

The report highlights the principle considerations forming a basis for acceptance criteria. The three most important considerations, concerning risk to third parties, are repeated here:

1. The natural risk we are exposed to in daily life should not be significantly increased by activities, such as industry, etc., created by others without our personal consent.
2. Before process plant is established, it should be investigated whether certain processes can be substituted by other processes with a smaller inherent risk of accident.
3. The resources available for activities to promote safety should be primarily applied in ways that lead to the best overall result.

Parts of these principles take effect in the following requirements for approval of plant:

1. Plant must be organised based on the ‘ALARA principle’^[6], i.e. all reasonable measures must be taken to reduce the risk of accident. This includes drawing on accumulated experience within the industry, adherence to recognised standards, and implementation of safety measures to counter the potential risks of the plant.
2. It must be demonstrated that the plant does not expose individuals or society to unacceptable levels of risk.
3. The advantages to society deriving from the plant must be greater than the risk the plant represents to society.

Qualitative criteria and assessment methods particularly address the first requirement, while quantitative criteria and methods address the second requirement. The third requirement involves cost-benefit analyses. These are often difficult to perform and open to uncertainty in terms of comparisons made between various values (life, the environment, the economy). They will therefore not be considered further.

The following issues are not covered in Environment Project 112:

• Questions relating to existing versus new plant, and development activities in proximity to major hazard establishments.
• Criteria for environmental damage.

2.1.1 Recommendations in Environment Project 112 for quantitative risk acceptance criteria

Environment Project 112 recommends the following criteria for the technical assessment of plant:

• A location-based (individual) risk of death for the most at-risk neighbour of 10^-6 per year.
• Societal risk formulated as a risk of death of 10^-4 per year for an accident involving at least one fatality. Where societal risk falls within the shaded grey region above the minimum curve, the risk should be “As Low As Reasonably Achievable” (ALARA).
• These criteria should be supplemented with a requirement that risks be reduced as far as reasonably possible (the ALARA principle), and that consideration be given to serious or permanent damage, and damage with delayed onset.

Environment Project 112 only makes recommendations relating to quantitative criteria based on number of fatalities.

Acceptance criteria for societal risk (see also Figure 2) are shown in Figure 5. Figure 5 shows the ‘grey zone’ within which the above ALARA principle should be used, extending over a frequency factor of 100. In other words, if the risk of an accident involving at least one fatality is less than 10^-6 per year (100 times less than the minimum criteria of 10^-4 per year^[7]), no further safety measures are necessary.

The argument for these acceptance criteria for location-based (individual) risk is that:

• They correspond to the risk of natural disaster.
• Plants with good safety measures can realistically fulfil the criteria in practice.
• They only increase the risk of death due to other causes by a tiny fraction (no more than one per cent for children aged approx. 10-15 years^[8]).

The main issues relating to societal risk criteria relate to:

• The slope of the curve.
• The absolute level (i.e. trimming the curve for accidents involving only one death).
• Whether or not the curve should be cut off at a particular accident size (i.e. that accidents above this size are not permitted).

The argument for the selected acceptance criteria for societal risk is that:

• A slope of 2 on a logarithmic scale matches practical situations (observations of accidents and results of risk analyses).
• A slope with a value greater than 1 places more stringent requirements on larger accidents, and thereby takes into account the extra burden larger accidents place on the community.
• It can be argued that the value at one death (10^-4 per year) does not conflict with the criteria for location-based (individual) risk in most practical situations.
• Plants with good safety measures can realistically fulfil the criteria in practice.

Figure 5. Acceptance criteria for societal risk, according to Environment Project 112. The purple line indicates the minimum criteria. The grey zone indicates where the ALARA principle should be used.

2.1.2 Recommendations in Environment Project 112 for qualitative acceptance criteria

Environment Project 112 defines qualitative acceptance criteria as criteria ensuring the safety measures in place are reasonable in proportion to the risk of accident. A consequence analysis is essential when using quantitative methods in order to quantify in detail how the accident impacts the surrounding area. However, when using qualitative methods, a consequence analysis is used to qualify these accidents in terms of their potential to impact the surrounding area – i.e. to qualify the seriousness of a given accident.

Depending on the seriousness and expected frequency, requirements may be specified regarding the number and quality (failure rate and effectiveness) of safety measures. Environment Project 112 recommends barrier diagrams^[9] as a tool to help present the results of risk analysis. These diagrams show the possible sequences of events prior to an accident, and the safety measures (hereafter referred to as barriers or safety barriers) that can prevent or mitigate the accident.

Figure 6. Example safety-barrier diagram

Analysis procedure:

1. Assess the seriousness of the final event (e.g. ‘Reactor explodes’ in Figure 6) based on an analysis of the consequences this event would have for people, buildings, the environment, etc.
2. Determine the (approximate) frequency of the initiating events (‘Fault at mixing plant’ and ‘Incorrect mixture of ingredients’ in Figure 6).
3. The seriousness of the final event and the frequency of the initiating events, in combination, will determine the requirements to be placed on the intervening safety barriers (three barriers in Figure 6).

Environment Project 112 proposes scales for the seriousness of the consequences (consequence scale K, Table 2), frequency (frequency scale H, Table 3) and failure rates for safety barriers.

Table 2. Consequence scale K for accidents proposed by Environment Project 112

Table 3. Frequency scale H for initiating events proposed by Environment Project 112^[10]

Failure rates for barriers are specified using points (barrier points). Each point indicates that the accident frequency is reduced by a factor of square root of ten. If the frequency of the initiating event is characterised as H=4 (once a year at most) and the total point score for all barriers between the initiating event and the consequence is 8, the maximum expected frequency of the consequence will be 10^-4 per year. The report contains recommendations on assigning points to various types of safety barriers.

The acceptance criteria are formulated in a way that safety barriers with a cumulative point value of N must be present, as shown below, for initiating events with a frequency scale value of H:

• For accidents with the potential for fatalities (individual risk): N= 4×H-2;
• For accidents with a consequence scale value of K=5.1 (societal risk): N= 4×H-4;
• For accidents with a consequent scale value of K=5.2 (societal risk): N= 4×H+2;

Simplified acceptance criteria are also described. These only consider the barriers that fulfil all the requirements for good barriers. These (automatic, as a minimum) barriers can be assigned at least 6 barrier points, and then a minimum number of barriers for a given initiating event and level of seriousness will be sufficient.

Environment Project 112 notes that the qualitative requirements are more restrictive than the quantitative requirements (the above criteria for individual risk is a maximum of 10^-7 per year). This may be seen as a disadvantage for these criteria. However, Environment Project 112 does not discuss how the qualitative method handles different accident scenarios that each contribute to risk separately. This situation would make the qualitative criteria less restrictive for the total plant, if applied per scenario.

2.2 The ‘Tønder Report’

In 1996, a task force under the Danish Environmental Protection Agency and Danish Energy Agency, with representatives from the relevant major hazard authorities, prepared a report – the Tønder Report – advising the regional authority (known at that time as the County of Sønderjylland) about the location and design of a surface plant for a planned natural gas storage facility in Tønder (Danish Environmental Protection Agency, 1996). The recommendations made to the County particularly related to the delimitation of safety zones, and may therefore also be relevant in relation to other major hazard establishments.

The Tønder Report was prepared in order to highlight a number of safety issues related to an underground natural gas storage facility, without placing unnecessary restrictions on business development opportunities close to the facility.

The report focuses on an event considered to be a reference scenario for the safety distance (restrained leakage from a 12”/16” pipe). No assessment was made of the consequences of an uncontrolled gas blow-out due to fire, as the probability “was perceived by the task force to be so small that it should [not^[11]] serve as a reference event for the safety zones”. The report does not specify whether a) the consequences of blow-out would be greater than for restrained leakage, or b) the probability levels in question.
Safety zones are defined as zones where rapid evacuation is possible, and institutions that are difficult to evacuate may not be placed within them. ‘Rapid evacuation’ is not further explained. Reference is made to the town of Stenlille, where an inner and outer safety zone have been defined. No buildings may be erected in the inner safety zone, as is the case for safety zones adjacent to gas transmission pipes. The report proposes that the inner safety zone for Tønder be set to the consequence distance for the accident scenario, ‘leakage from 12/16” pipe with restrained gas cloud’. The outer safety distance has been set using the method used at the time to set the outer safety zone at a maximum of 200m adjacent to gas transmission pipes^[12].

We conclude that:

1. The inner safety distance is only based on consequences. Accident frequency for the reference scenario has not been explicitly stated.
2. The outer safety distance is not explicitly based on either consequences or risks, but follows a design standard.

Based on the minutes of a meeting attached to the Report, we conclude that quantitative calculations were performed which support the choice of a safety distance of 100-200m as acceptable in comparison to Environment Project 112’s societal risk criteria (the lower curve in Figure 5).

[6] ALARA: As Low As Reasonably Achievable. Risks must be reduced using all ‘reasonable’ means, i.e. taking into account the cost of such measures. This report views ALARA and ALARP (As Low As Reasonably Practical) as synonyms. ALARA has been used, as this term has been used in Environment Project 112.

[7] Expected accident frequencies are usually expressed as powers of ten, i.e. 10^-4 per year means that the probability of an accident is 1 in 10,000 per year. This is the same as saying that, on average, one accident is expected every 10,000 years at the given plant, or that if there were 10,000 similar plants, an average of one accident would be expected each year at any of these plants. However, it should be borne in mind that the accident could occur at any time (or place).

[8] Environment Project 112 refers to foreign statistics. The corresponding Danish statistics are shown in Figure 8. This figure shows that children aged 6-12 years have the lowest fatality risk in Denmark.

[9] The full name is safety-barrier diagram.

[10] Some consultancy firms currently use frequency classifications in the reverse order, with a factor of square root of 10 between each class, like barrier points, i.e. category 2 corresponds to a frequency of 0.1 per year, and category 4 to 0.01 per year. This allows acceptance criteria to be formulated by stating that the sum of the frequency category and barrier points must exceed a set minimum value.

[11] The original text omits the word ‘not’.

[12] The regulations relevant for the determination of safety zones can be found in Danish Ministry of Employment Statutory Order no. 414/1988, supplemented by the Working Environment Authority’s supplementary provisions to the “ASME Guide for Gas Transmission and Distribution Piping Systems” (1983). At the present time, refer to the Danish Working Environment Authority Guide F.0.1 “Naturgasanlæg”, 2001

3 Use of risk acceptance criteria within the EU

• 3.1 Land Use Planning Guidelines from the European Commission
  • 3.1.1 Risk analysis methods and risk criteria
  • 3.1.2 Other technical issues
• 3.2 European Commission’s examples of risk analysis methods (‘Roadmaps’)
• 3.3 Risk acceptance criteria in Finland
• 3.4 Risk acceptance criteria in Flanders
• 3.5 Risk acceptance criteria in France
• 3.6 Risk acceptance criteria in the Netherlands
• 3.7 Risk acceptance criteria in Iceland
• 3.8 Risk acceptance criteria in the United Kingdom
• 3.9 Risk acceptance criteria in Germany

This chapter describes risk analysis methods and risk acceptance criteria in relation to land use planning for, or around, major hazard establishments in the European Union. The European Commission has published two guides regarding practical implementation of the land use planning regulations in the Seveso II Directive (European Commission, 1999; European Commission, 2006). The Commission has also prepared an overview of available ‘Roadmaps’ (European Commission, 2007) containing further technical details and implementation examples from a number of EU Member States.

These guides and the publication ‘Roadmaps are described below, followed by a more detailed review of practices in seven selected countries (Finland, Flanders, France, Germany, Iceland, the Netherlands and the United Kingdom).

3.1 Land Use Planning Guidelines from the European Commission

The European Commission has prepared land use planning guidelines for major hazard establishments and surrounding areas (European Commission, 1999; European Commission, 2006). These guidelines show the various ways in which Member States can fulfil their obligations in terms of ensuring the necessary distances exist between major hazard establishments and vulnerable objects. This review focuses on the latest guidelines from 2006. These guidelines have been divided into parts A, B and C.

Part A discusses general considerations to take into account when implementing land use planning policies for major hazard establishments and surrounding areas. These concern protection of human life, natural areas, surface water and groundwater. Robust land use planning policies for major hazard establishments and/or surrounding areas should be based on:

• Consistency: to ensure that comparable determinations are reached in comparable situations.
• Proportionality: the scale of limitations (such as safety distances) should increase in proportion to the extent of the risk.
• Transparency (in the decision process).

These elements have been expressed in a number of general principles, including the need for risk analysis methods (to ensure consistency) and assessment criteria based on damage or risk (to ensure proportionality).

Part B discusses technical issues such as:

• Types of risk analysis methods.
• Risk criteria.
• Selecting accident scenarios to use in the analysis and decision process.
• Information on the frequency of critical events.
• Consequence modelling and damage impact.

A number of these issues are further discussed in sections 3.1.1 and 3.1.2 below.

Part C deals with environment issues. Most risk analysis methods (and hence risk criteria relevant to land use planning) focus on human life. The guide concludes that methods to assess risk to the environment are lacking, yet authorities are still under obligation to consider impacts to neighbouring sensitive natural areas, rare animal or plant species, and protected wetlands. Index methods are being used to a limited extent to qualify the potential for damage by dangerous substances to the environment (using a hazard index), and to qualify the sensitivity of surrounding areas (using a sensitivity index, such as sensitivity based on the speed pollution infiltrate the soil). There have been attempts to define acceptance criteria based on the time required to re-establish the original state.

3.1.1 Risk analysis methods and risk criteria

There are various approaches to risk analysis and risk criteria within the EU. The guidelines from 1999 and 2006 describe these different approaches, without recommending any single method. The most recent guideline highlights four elements on two different axes:

• 1. Quantitative (numeric) versus 2. Qualitative (non-numeric)
• 3. Deterministic (safety is defined using specific consequence analyses, without considering probability) versus 4. Probabilistic methods (safety is defined using probability distributions).

These elements exist in various combinations. Four of these combinations are further explained in the following sections.

3.1.1.1 Consequence-based risk analysis methods

Consequence-based risk analysis methods are also called deterministic risk analysis methods. Consequence-based methods are based on an assessment of the (geographic extent of) consequences of credible/conceivable accidents without explicitly quantifying their frequency. The basic principle is the ‘worst credible accident’. The philosophy is that if the necessary protection is provided to counter the worst credible accident, this protection will also be adequate in the case of smaller accidents. The probability of a given accident is only assessed implicitly in the criteria used to determine the worst credible accident or reference scenario. This assessment may be qualitative (e.g. based on the number and type of safety barriers) or quantitative. More improbable events are excluded from the analysis (see comments in section 1.3.2.2).

The consequence distance for the reference scenario is calculated using one or more exposure threshold values (e.g. one per cent deaths and hospital admissions). This method leads to delimitation of safety zones in the form of concentric circles.

3.1.1.2 Risk-based risk analysis methods

Risk-based methods perceive risk as a combination of frequency and consequence, and are examples of probabilistic methods. The consequences are analysed in the same way as in consequence-based methods, but an explicit assessment of the scenario’s frequency is included. These can be combined with various levels of sophistication. The most advanced methods are called quantitative risk analysis (see section 1.3.2.1). These methods sum the results from all the different accident scenarios, weighted in proportion to their frequency. Quantitative risk analysis generally results in two expressions of risk: location-based (individual) risk, and societal risk in the form of an F-N curve (see sections 1.2.3 and 1.2.4). Location-based (individual) risk is used to show the geographic distribution of risk, while societal risk assesses whether areas with high population density might be exposed to risk.

3.1.1.3 State-of-the-Art / Best Practice approach

This approach is not strictly a risk analysis method. The underlying philosophy is that the necessary safety measures must be in place to protect the population against the ‘worst case’ accident. This means that the establishment needs to have considered the consequences of these worst case accidents, and taken the necessary preventative and accident-limiting steps, such that the risk outside the establishment’s fence is negligible (‘zero-risk principle’). However, it is recognised that it will not always be possible to limit accidents to the establishment’s own property, and therefore safety zones are laid out, based on an assessment of typical (not necessarily the worst credible) accident scenarios.

3.1.1.4 ‘Hybrid’ methods

Risk-based methods are mentioned as an example of ‘hybrid’ methods. Under these methods, one of the elements (usually frequency) is assessed more qualitatively, i.e. using classes rather than continuous figures. Use of a risk matrix is a typical example.

Another hybrid method mentioned is the use of tables with fixed distances as a simplification of the consequence-based method. Tables of fixed safety distances are mostly used for minor or more routine situations (e.g. F-gas vehicle filling stations). The guideline points out that tables are often conservative (i.e. they employ relatively large safety distances), and are mostly used to quickly assess which situations require more analysis.

3.1.2 Other technical issues

The Commission guidelines from 2006 also discuss the data used as a basis for risk analysis. The four most important elements are:

• Selecting accident scenarios.
• Selecting accident frequencies.
• Modelling end-point values.
• ‘Technical Measures’ as defined in article 12 of the Seveso II Directive.

The Commission maintains a database to assist with the selection of accident scenarios (Risk Hazard Assessment Database – RHAD^[13]). This database should contain information about relevant scenarios for each dangerous substance and activity, including frequency based on various conditions and preventative measures, but so far the database only contains few relevant scenarios.

The guidelines list five principles for scenario selection:

• Reference scenarios (equivalent to ‘reference accident scenarios’ in this report) may be selected based on frequency and the severity of the consequences.
• ‘Worst case’ accidents should not necessarily be used as a basis for land use planning, but may be assessed in connection with emergency planning and evaluation of whether the necessary measures (Best Practice) are in place to reduce the frequency of the worst case accident to a negligible level.
• Consideration should be given to the time frame over which the consequences take effect, i.e. whether there is time to activate preventative systems.
• The effectiveness of safety barriers should be included in the assessment.
• Land use planning is seen as both a preventative and mitigating measure for establishments complying with good practices under the applicable standards.

3.2 European Commission’s examples of risk analysis methods (‘Roadmaps’)

The Commission guidelines from 1999 (European Commission, 1999) contained a brief description of various example risk analysis methods for land use planning in a number of EU Member States. They also contained a brief description of practices in Australia, Canada, Russia, Switzerland and the USA.

Following the release of the guidelines in 2006, these descriptions have been expanded in a separate document, called ‘Roadmaps’ (European Commission, 2007). It is now clearly stated in the descriptions from which Member State the examples derive. There is also greater focus on the process of land use planning, with a description of the authorities and stakeholders involved and their powers.

‘Roadmaps’ also contains a detailed introduction describing the various risk analysis methods in relation to acceptance criteria and end-point values. Compared to earlier publications, there is much more focus on the use of risk matrices, with examples of a descriptive (i.e. qualitative) consequence classification.

End-point values are discussed for heat radiation, pressure from explosions, and toxicity. Distinction can be made between ‘probit functions’ and fixed values. Probit functions estimate the percentage of the exposed population that will suffer a particular injury at a particular concentration, radiation intensity, or overpressure. Threshold values specify the concentration, radiation intensity, or overpressure that results in a pre-determined damage to health. The document contains example threshold values for heat radiation and overpressure in the EU Member States, and a comparison of various toxicity data – IDLH, ERPG and AEGL^[14] (data shown in Table 15 in section 4.3.6)

Land use planning methods are reviewed for the following countries: United Kingdom, France, Germany, Italy and the Netherlands. These countries, with the exception of Italy, are also discussed further in the following sections. It should be noted that the Italian method is very similar to French practices.

3.3 Risk acceptance criteria in Finland

Source:

Document written by Päivi Rantakoski and Leena Ahonen, Safety Technology Authority (TUKES) 9.8.2007.

New legislation on land use planning for major hazard establishments is being drafted in Finland. The guiding principle for planning a major hazard establishment is that an accident must not result in permanent injury or prevent people from evacuating their homes or present location. All conceivable accident scenarios must be assessed. An accident scenario may only be discounted if the operator can show that he can prevent the accident in every case. Scenarios are selected using qualitative criteria.

The TUKES safety authority is preparing guidelines for selecting appropriate end-point values for the various effects (shock waves, heat radiation, toxicity) and for selecting accident scenarios.

The consequences of the accident for people, the environment and buildings are considered. The method to be used to implement safety distances is under development. In an initial case study, three zones were placed around an establishment, depending on the magnitude of the consequences. Vulnerable objects (schools, hospitals and nursing homes) may only be placed outside the outer zone, while only other establishments may be located within the innermost zone.

The method only applies to new development, i.e. new construction in the vicinity of existing major hazard establishments, or the location of new major hazard establishments. The method is not being used to assess whether existing major hazard establishments have been located appropriately in relation to existing land use.

3.4 Risk acceptance criteria in Flanders

Source:

“Een code van goede praktijken inzake risicocriteria voor externe mensrisico’s van Seveso-inrichtingen”

Flanders uses quantitative risk criteria which are the same for both new and existing column-2 and column-3 major hazard establishments. The criteria are based on three values for location-based risk (see Table 4) and a curve for societal risk (see Figure 7). If existing establishments fail to comply with the criteria, additional safety measures will be required (such as a ‘safety information plan’, see below), their environmental permit may not be issued, or the government may prohibit operation of (parts of) the establishment.

Isolated residences (including farm buildings) are not counted as residential areas. Childcare centres and preschools are not counted as vulnerable objects.

When the iso-risk curve for 10^-5 per year passes outside the establishment’s property boundary, a safety information plan has to be drawn up describing how the major hazard establishment and other establishments in the surrounding area have agreed to exchange information about risks arising from dangerous substances. Low-tier establishments are not obliged to perform a quantitative risk assessment under the Flemish implementation of the Seveso II Directive, but Flemish local authorities may require a quantitative risk assessment as a basis for an environmental approval.

Table 4. Risk criteria in Flanders.

When assessing societal risk, employees and hired contractors at the major hazard establishment are not considered, but people present in neighbouring establishments are taken into account. No societal risk criteria have been set for accidents involving less than 10 fatalities. The criteria based on location-based risk must provide the necessary protection for such cases. However, establishments must show that all necessary preventative measures have been implemented for smaller accident scenarios (involving less than 10 fatalities).

3.5 Risk acceptance criteria in France

Sources:

Le plan de prevention des risques technologiques (PPRT), Guide méthodologique, Ministère de l’Écologie, du Développement et de l’Aménagement Durables.

Overview of roadmaps in selected member states (European Commission, 2007).

France has developed a detailed method for managing major hazard establishments and their surroundings. The method is risk-based, but allows for some assessment to be qualitative, and includes simplifications compared to the comprehensive quantitative risk assessments used in the Netherlands, Flanders and the United Kingdom.

The basis of the method is to identify a number of accident scenarios when assessing risk for the establishment in question. These scenarios are first divided into:

• Rapid accident scenarios.
• Slow accident scenarios. Slow scenarios are any scenarios for which the accident process permits the evacuation of all people who might be affected before the accident develops to its peak^[15]. The establishment must present the necessary information to justify classification of a scenario as slow.

All scenarios are assessed with regard to their frequency. This assessment can vary from qualitative to quantitative, using the classes shown in Table 5.

Table 5. Frequency classifications for accident scenarios under the French method

The next step is to assess the consequences. For the ‘slow scenario’, only irreversible damage to assets and the environment is assessed (as people will have been evacuated). For each scenario, the distance from the source at which the consequence will be very serious, serious, irreversible, or (where appropriate) indirect is analysed, see Table 6. In other words, a map can be drawn for each scenario showing three or four circles – one for each level of seriousness (in the case of slow scenarios, there is only one circle, for irreversible damage). These maps for the various scenarios are then summed. Toxicity, heat radiation, overpressure and the ‘slow’ scenarios are summed separately. Substances that are both flammable and toxic will result in four geographic maps showing assessments for each of these types of consequence. Some very unlikely scenarios may be excluded from the amalgamation using a ‘frequency filter’. These are only events in frequency class E fulfilling extra requirements in terms of passive safety or a minimum number of guaranteed safety barriers. Such scenarios are retained for the purposes of emergency planning.

The amalgamation takes place by summing frequency classes: Four scenarios of class E are written as ‘4E’. Scenarios are upgraded to the next class based on a factor of 10, such that 10 scenarios of class E count as one ‘D’.

The final geographic map showing consequence distances is created by:

1. Determining the most serious consequence at a given location on the map.
2. Summing the frequency classes which lead to the most serious consequence at this location.
3. Specifying the ‘risk’ at this location using a risk matrix, such as Table 7.

Table 6. Threshold values for the French method for delimiting the consequence distance

Table 7. Risk matrix for location-based (individual) risk under the French method for preparing land use planning restrictions.

A risk management plan is prepared on the basis of these maps. These plans may contain options for compulsory purchase (only for risk zones classified as TF+ and TF) and ‘délaissement’^[16] (for risk zones classified as TF+ to F). The plans take into account local conditions and historical development.

In general development of new residences or businesses (urbanisation) is forbidden in the risk zones classified as TF+ to F. Urban development is subject to special conditions in risk zones M+ to M (for toxicity or heat radiation) and M+ to Fai (for overpressure, due to the potential for glass breakage).

Institutions which are difficult to evacuate may not be built in areas where consequences are possible from ‘slow’ scenarios.

Risk management plans may also include technical measures to protect buildings and people within the hazard zone (for instance installation of explosion-proof windows). As a rule of thump, these measures may not cost more than 10 per cent of the value of the exposed assets. This applies particularly to risk zones M+ and M.

A significant element in the French method is that the local population is involved in the decision process surrounding these risk management plans.

A holistic assessment of the total risk exposure for an establishment is carried out in addition to the location-based assessment. Five seriousness classifications have been defined for accident scenarios as shown in Table 8. These are used in the risk matrix shown in Table 9. This matrix implements acceptance criteria for societal risk in France.

Table 8. Seriousness scale defined as the link between consequence and the number of people exposed.

Table 9. Risk acceptance matrix for establishments in France. The red fields represent an unacceptable risk, and the plant cannot be approved. The yellow fields show where the plant can be approved, on condition that all practicable (ALARA) safety measures are implemented. The green fields show where the plant can be approved without further conditions.

3.6 Risk acceptance criteria in the Netherlands

Sources:

Decree on External Safety of Installations (Besluit externe veiligheid inrichtingen – BEVI) 2004

Guidance on the Duty of Accountability for Societal Risk

The Dutch risk criteria were implemented in a Statutory Order in 2004. They are quantitative risk criteria formulated as location-based risk, to ensure that no individual is exposed to excessive risk. Decisions by the authorities (i.e. environmental permits for establishments and urban planning close to existing establishments) must also take societal risk into consideration.

The Dutch have developed a software tool to calculate location-based (individual) risk and societal risk. This tool implements the methods from the ‘yellow’ and ‘purple’ books (Committee for the Prevention of Disasters, 1997; Committee for the Prevention of Disasters, 1999). Effective from 1 January 2008, binding guidelines require results from using this tool to form the basis of decisions by the authorities.

Distinction is made between ‘vulnerable objects’ and ‘objects with limited vulnerability’. The latter category includes scattered residences (less than two per ha), small shops and hotels, business areas, recreational objects, and objects which serve as infrastructure (electricity supply, telephone exchanges, air traffic control towers, etc.). Vulnerable objects are residences, areas for children, the aged, the sick, or the disabled (schools, preschools, nursing homes, hospitals, etc.) large (centres containing) stores and hotels (defined as more than 1500 m² of floor space) and campgrounds for over 50 people.

For vulnerable objects, a limit value for location-based risk of 10^-6 per year must not be exceeded. For objects with limited vulnerability, the same value applies as a target, but may be exceeded under certain conditions. For existing environmentally approved establishments, an interim acceptance criteria of 10^-5 per year applies, but the general limit value (i.e. the value used for vulnerable objects) of 10^-6 per year must be complied with by 2010.

Figure 7. Combined presentation of acceptance criteria for societal risk in Denmark in accordance with Environment Project 112, including the grey ‘ALARA’ area), Flanders (section 3.4), the Netherlands (section 3.6) and the United Kingdom (indication of an unacceptable societal risk, see section 3.8).

When assessing permits, the authorities must compare the calculated societal risk with the targets for risk acceptance shown in Figure 7:

• The expected frequency of accidents involving more than 10 deaths must not exceed 10^-5 per year.
• For accidents involving more than 100 deaths, 10^-7 per year.
• For accidents involving more than 1000 deaths, 10^-9 per year.

When calculating societal risk, a maximum consequence distance is used which, by definition, covers the region where the expected mortality rate is greater than one per cent for the worst case accident.

3.7 Risk acceptance criteria in Iceland

Iceland uses fixed safety distances between major hazard establishments or stores of dangerous substances, and other buildings and types of land use. These distances are largely based on fire protection. Explicit risk considerations are not used.

Several statutory orders specify the distance from facilities storing or using dangerous substances, including the statutory order for F-gas storage and storage of flammable liquids. However these statutory orders only address relatively small amounts (25 tonnes of F-gas and 100 m³ of flammable liquid). The statutory order on explosives is the only statutory order addressing Seveso establishments. For example, this statutory order specifies a distance from ‘high-tier’ establishments (referring to an establishment with a 50,000 tonne store) as shown in Table 10.

Table 10. Safety distances from ”high-tier” establishments in Iceland

3.8 Risk acceptance criteria in the United Kingdom

Sources:

Risk criteria for land-use planning in the vicinity of major industrial hazards, UK Health and Safety Executive, ISBN 11 885491 7 (1989)
Proposals for revised policies to address societal risk around onshore non-nuclear major hazard installations, UK Health and Safety Executive, Consultative Document CD112 (2007)

The United Kingdom uses the term, ‘consultation distance’ (CD), which is comparable to safety distance in practice. These ‘consultation distances’ around each major hazard establishment are determined by the central authority, the Health and Safety Executive (HSE). The HSE performs risk calculations in each case based on information gathered via the local authorities from the establishment’s permits (Hazardous Substances Consent data, including information on quantities of dangerous substances, tank sizes, pressure and temperature, etc.). The calculations are probabilistic for toxic substances, but can be deterministic where the risk is due to the potential for fire or explosion.

Consultation distances are divided into three zones, so that the probabilities for exposure to a dangerous dose are 10^-5 (inner zone), 10^-6 (middle zone), and 0.3 x 10^-6 (outer zone). These probabilities are approximately equivalent to individual risk or location-based risk.

Local planning authorities must consult HSE regarding any development involving a major hazard establishment or a surrounding area (i.e. within the outer consultation distance). HSE has no authority to reject a permit, but may return a ‘negative advice. However, the government guidelines state that

“in view of their acknowledged expertise in assessing the off-site risks presented by the use of
hazardous substances, any advice from HSE that planning permission should be refused for development for, at or near to a hazardous installation or pipeline should not be overridden without the most careful consideration.”

For the present, HSE only performs assessments based on individual risk (comparable to location-based risk). HSE uses 10^-6 per year as the lower limit for individual risk to the general population. Any risk lower than this is not significant in relation to everyday risks. A limit of 0.3×10^-6 per year is used for vulnerable people (the aged, people vulnerable to exposure). 10^-5 per year is used as the upper limit for acceptable involuntary risk (involuntarily exposed people include employees in surrounding establishments, etc.).

HSE has assessed the maximum number of people permitted within the high-risk zone (up to 10^-5 per year). A number of more than 25 people is considered a ‘significant risk’. Table 11 shows which types of land use are considered acceptable within the various risk zones.

Table 11. Existing basis for HSE’s assessment of new development plans

HSE has not previously assessed societal risk, partly because it used to be difficult to calculate, but an easy method has now been developed requiring fewer resources. There is a process underway in the United Kingdom to determine criteria for societal risk. There is also debate as to whether HSE’s advisory role should be extended beyond the consultation distance defined above, as societal risk is relevant outside safety distances (see sections 1.2.4 and 1.3.1). In 2001, HSE published a report entitled, ‘Reducing Risks, Protecting People’ (R2P2). This report proposes that criteria for societal risk should ensure the following condition is met: “the risk of an accident involving 50 or more deaths from a single event should be seen as unacceptable if the expected frequency is greater than once every 5000 years” (this condition has been indicated in Figure 7).

The approach described above is only used in connection with new development (construction of new residences, enterprises, etc.) in proximity to existing establishments. It is not used for approval of existing establishments.

3.9 Risk acceptance criteria in Germany

Sources:

SFK/TAA-GS-1: Störfall-Kommission technischer Ausschuss für Anlagensicherheit, Leitfaden.
Empfehlungen für Abstände zwischen Betriebsbereichen nach der Störfall-Verordnung und schutzbedürftigen Gebieten im Rahmen der
Bauleitplanung - Umsetzung § 50 BImSchG

The German ‘Störfallkommission’ prepared guidelines in 2005 for implementing article 12 of the Seveso II Directive on land use planning and ensuring the necessary distances between major hazard establishments and vulnerable objects. The guidelines draw their authority from the German Environmental Protection Act. The guidelines are not used to assess existing situations where an environmental permit has already been issued or where current general environmental regulations have been complied with.

Special distance requirements apply to stockpiles of explosives and ammonium nitrate.

Distinction is made between situations with or without detailed knowledge. Where detailed knowledge of an enterprise is unavailable (this is typical situation when planning new plant), general distance requirements are recommended based on the declared substances stored or used by the establishment. These requirements are divided into four classes, with distances of: 200, 500, 900 and 1500m (see Table 12). In Denmark  these distances apply to establishments that would be covered by section 4 of the Statutory Order on Risk (“low tier” establishments), (Danish Environmental Protection Agency, 2006). These recommendations are based on consequence calculations using the following standard assumptions:

• Leakage of the dangerous substance from a 490 mm² hole (corresponding to a break in a DN 25 pipe^[17]).
• Flammable substances ignite immediately.
• Atmospheric dissemination calculated as described in VDI Guideline 3783, using average meteorological conditions for industrial areas, such as a wind speed of 3 m/s.
• A threshold value of 1.6 kW/m² for heat radiation.
• A threshold value of 0.1 bar for maximum overpressure for explosions (average between 0.175 bar for hearing damage, and 0.05 bar for personal injury due to glass splinters).
• A threshold value for toxic substances equal to the EPRG^[18] 2 value.

Where detailed knowledge of an industry is available (for example, in relation to land use planning around existing establishments), consequence calculations are performed for the specific establishment. These calculations are based on the above assumptions, though certain freedom is permitted in selecting scenarios (such as the size of a hole – it is recommended that a hole size greater than 80 mm² be used for the calculations). Where dangerous substances are stored in tanks or cylinders, leakage from a single unit (tank or cylinder) is assumed. Accident-limiting measures are taken into account in consequence assessment. Fire, explosion and toxic effects are assessed separately.

Table 12. German recommended distance requirements for use when detailed consequence calculations are not available

[13] http://mahbsrv4.jrc.it/rhadnew-v3/adminindex.html

[14] IDLH: Immediately Dangerous for Life and Health (values developed for emergency personnel); ERPG: Emergency Response Planning Guidelines (values developed for workers, i.e. people in good health); AEGL: Acute Emergency Guidance Level (values being developed for the general population)

[15]> A typical example of a slow accident scenario is ‘boil over’: when a storage tank fire is permitted to continue burning, oil at the base of the tank eventually gets so hot that it begins to boil. This is a very violent process, but there is time to evacuate the nearby population before it happens.

[16] ‘Délaissement’ refers to a French legal construction whereby the authorities can prohibit land or buildings from being re-used once they are vacated by the existing owners/users, combined with an obligation on the part of the authorities to acquire the property if the owners so wish.

[17] A DN 15 pipe is assumed for phosgene.

[18] EPRG: Emergency Response Planning Guidelines (see also note 14). Three concentrations are specified for each substance (EPRG 1 to EPRG 3). The EPRG 2 value for a substance is the airborne concentration that almost every person can be exposed to for one hour without experiencing permanent injury or effects that would prevent their escape.

4 Discussion of risk acceptance criteria

• 4.1 Discussion of developments within Denmark
• 4.2 Discussion of review of practices within the EU
  • 4.2.1 Qualitative versus quantitative criteria methods
  • 4.2.2 Ensuring consistent and uniform decisions
  • 4.2.3 Comparison of quantitative risk acceptance criteria
  • 4.2.4 Existing and new situations
  • 4.2.5 Dealing with vulnerable objects (such as hospitals, schools, and infrastructure)
  • 4.2.6 Risk acceptance criteria for environmental damage
  • 4.2.7 Risk acceptance criteria for personal injury
• 4.3 General observations
  • 4.3.1 Individual risk level and protection of vulnerable objects
  • 4.3.2 Societal risk and risk aversion
  • 4.3.3 Frequencies for reference accident scenarios and maximum consequence distances
  • 4.3.4 Risk acceptance criteria for existing and new situations
  • 4.3.5 Risk acceptance criteria for environmental damage
  • 4.3.6 Risk acceptance criteria for personal injury

This chapter discusses the studies presented in the preceding two chapters. Section 4.1 discusses Danish studies and developments based on Environment Project 112. Section 4.2 discusses and compares European studies. Section 4.3 concludes with some general observations on choosing risk acceptance criteria based on an overall evaluation of the studies and existing practices in Europe.

4.1 Discussion of developments within Denmark

Environment Project 112 provides a thorough examination of risk analysis and risk acceptance criteria issues.

The qualitative method developed, using safety barrier diagrams, has been found useful. The method is widely used in Denmark and in some other countries^[19]. Discounting the fact that more experience with using various methods and criteria has since been gained, the work can only be criticised on the following points:

1. The qualitative method is not linked to an explicit assessment of the geographic conditions for the establishment in question (distance to residences, extent of consequences).
2. The qualitative method focuses on acceptance criteria for individual accident scenarios, and makes no comment on how to sum risk contributions from various accident scenarios.

This has presumably been a factor in the later focus in Denmark on selecting a reference accident scenario to determine safety distances, so that the worst case accident is discounted, and the consequence distance for a smaller accident is used to determine the safety distance. This approach is only reasonable if explicit and justified rules exist governing selection of this reference accident (Environment Project 112 provides no guidance in this area). This approach also fails to perform assessment of societal risk. Societal risk is related to the risk outside the safety distance (for example, if there are densely populated areas just outside the safety distance), and can therefore only be assessed if the accident scenarios resulting in consequences outside the safety distance are assessed.

Environment Project 112 has attempted to make the quantitative and qualitative criteria comparable. For any given event, the qualitative criteria are more stringent than the quantitative criteria, but the qualitative approach does not take into account the fact that several accident scenarios often contribute together to the total risk. These effects may possibly compensate for each other, but they also make comparison difficult.

If quantitative and qualitative criteria are to be used on a side-by-side basis, one must be willing to comment on events with frequencies as low as 10^-6 per year within the qualitative method, in order to get insight into the maximum consequence distance, even though the reference accident (which determines the safety distance) has a frequency of 10^-4 per year. The practice of confining assessment to the reference accident scenarios, as described in the ‘Tønder Report’ mentioned earlier (Danish Environmental Protection Agency, 1996), conflicts with the principles in Environment Project 112 and is partially to blame for the current need for more detailed risk assessment guidelines in Denmark.

4.2 Discussion of review of practices within the EU

On the basis of the Commission’s guidelines and the above review of practices in seven Member States, it is apparent that there are significant differences in acceptance criteria and methods of implementing risk analysis in EU Member States.

4.2.1 Qualitative versus quantitative criteria methods

The Commission’s description of qualitative methods in the guidelines shows that when reference accident scenarios are used, the worst case accident scenarios are generally not assessed, making it impossible to assess the need for emergency plans for accidents greater than the reference scenarios (worst credible accidents). This is partly because terms such as ‘worst case’, ‘worst conceivable’ and ‘worst credible’ are poorly defined, leading to a poor grasp of the differences between the terms.

Germany uses a purely qualitative method whereby frequencies are not assessed at all. There are clear, explicit rules governing selection of reference accident scenarios. These scenarios are defined based on a technical description of emissions and in relation to the surroundings. Accidents larger than the reference scenarios (such as the collapse of a tank, delayed ignition of explosive emissions, or simultaneous failure of several containers due to fire) are not considered. There are clear risk acceptance criteria in the form of distance requirements.

Quantitative risk acceptance criteria apply to both existing and new situations in the Netherlands and Flanders. These criteria examine both location-based (individual) risk and societal risk. The United Kingdom uses criteria based on location-based (individual) risk of a new development in proximity to existing plant. These criteria place limits on the number of people who may be exposed to particular levels of risk, thus giving partial consideration to societal risk (implicit criteria for expected loss of life).

France has developed a hybrid method that approximates to a thorough quantitative risk analysis. However, the following qualitative aspects have been retained:

• Frequency may be assessed using frequency classes.
• Fixed end-point values are used to calculate consequence distances.
• Various types of consequences such as heat radiation, toxicity, and overpressure are assessed separately (i.e. their frequencies are not summed).
• The effects of wind direction and speed are not considered, i.e. the safety zones are concentric circles around the hazard source.

Clear risk acceptance criteria have been set, providing a framework for managing existing and new establishments. Planning requirements for extra safety measures may also exist, governing the establishments themselves, and the way that exposed buildings are constructed, such that they provide protection for their occupants.

The approach followed in Italy is similar to the method used in France (European Commission, 2007).

4.2.2 Ensuring consistent and uniform decisions

Section 1.3.2.2 discussed the fact that frequency estimates can be subject to great uncertainty. Major differences have also been observed between the various consequence models (Lauridsen et al., 2002). As a result, the same (type of) plant may be assessed to have different levels of risk. This is in conflict with the principle of consistency. The review in chapter three shows two ways of dealing with this problem, which are both related to quantitative methods and criteria:

4.2.2.1 Harmonisation

The Netherlands has given major focus to harmonising its quantitative risk assessment method. The view is that it is more important that results are comparable, than that they are correct in absolute terms. This work led to the publication of their ‘coloured’ books (Committee for the Prevention of Disasters, 1992; Committee for the Prevention of Disasters, 1997; Committee for the Prevention of Disasters, 1999; Schüller et al., 1997). Establishments must have compelling arguments in order to have a risk assessment accepted that is not carried out in compliance with these guidelines. Since January 2008, establishments have been required^[20] to use a particular software package (SAFETI-NL).

One disadvantage of this harmonisation is that generic failure rates are used, as specified in the ‘purple book’, and not site-specific information about equipment and safety measures. The risk for an establishment that implements extra safety measures is assessed in exactly the same way as for a comparative establishment that has no such measures. This conflicts with the principle of proportionality. Establishments have no extra incentive to improve safety, and it is difficult for the authorities to handle assessment of extra technical measures in relation to article 12 in Seveso II (in contrast to the French method).

4.2.2.2 Central assessment

In the United Kingdom, quantitative risk assessment is carried out by a central authority (HSE) based on information provided by the establishment and the local authorities. This is not harmonisation in a formal sense, but the approach ensures that assessments are performed using identical methods, data sources and expertise. In principle, the HSE also uses generic data (the FRED database), but HSE experts may make allowance for site-specific conditions based on information from the establishment’s safety report and/or an inspection^[21].

4.2.3 Comparison of quantitative risk acceptance criteria

The review of practices indicates agreement among the selected EU countries on acceptance criteria for location-based (individual) risk for the general population of 10^-6 per year. Flemish, British and Dutch regulations permit small ‘non-vulnerable’ groups to be exposed to risk up to 10^-5 per year. Business activities are permitted at even higher levels of risk in the United Kingdom. British and Flemish regulations deal with lower limits for some vulnerable objects, or objects where many people may gather, but never lower than 10^-7 per year.

Criteria for societal risk only exist in Flanders and the Netherlands. These criteria take the form of a line limiting the F-N curve. In both the Netherlands and Flanders, this line has a slope of 2 (on a double-logarithmic scale). Under the criteria for the Netherlands, risk of accidents involving 10 or more deaths must be less than 10^-5 per year. In Flanders, the limit is 10^-4 per year (in comparison, the grey area defined in Environment Project 112 lies between 10^-6 and 10^-4 per year – see Figure 7).

It is interesting to compare these criteria with the French hybrid criteria. Table 9 is designed to be comparable with an F-N curve. The French frequency and seriousness classes are separated by a factor of 10 (see Table 5 and Table 8). This means the limit of the green region has a slope of 2 (two steps at a time), while the limit of the red region has a slope of 1 from moderate to catastrophic accidents, and a slope of 2 from catastrophic to disastrous accidents. In other words, risk aversion (see section 4.3.2 below) is expressed in the French criteria in almost the same way as in the Netherlands and Flanders.

4.2.4 Existing and new situations

In several countries, risk acceptance criteria are only used explicitly in connection with new establishments, or urban development in proximity to existing establishments. This is probably due to legal issues relating to permits for existing establishments, rather than an indication that the risk in existing situations ought to be accepted.

In the (few) cases where the acceptance criteria are also used for existing situations, until recently these were permitted to be higher than criteria for new situations. Today, the same criteria apply to both new and existing situations, possibly supplemented by transition schemes (the Netherlands, France).

4.2.5 Dealing with vulnerable objects (such as hospitals, schools, and infrastructure)

EU Member States employ various principles to select and protect objects (people, buildings, and land areas) considered to be particularly vulnerable in case of accident. In most cases, the selection of vulnerable objects is not explained, but in some cases selection is justified on the basis of objects that are difficult to evacuate.

Distinction is usually made between four categories of exposed individuals:

1. Employees at the plant itself (both direct employees and external tradesmen). In principle, these individuals are protected by occupational safety requirements. In most cases they are not included in the consideration of societal risk.
2. Employees at establishments neighbouring to the hazardous plant. A higher location-based (individual) risk is often accepted for commercial areas compared to residential areas (usually different by a factor of 10, as in Flanders and the Netherlands). The British criteria in this situation are also based on occupational safety criteria. This can be justified as follows:
   1. The same employees at these establishments are not expected to be exposed 24 hours a day.
   2. There are no sleeping facilities.
   3. Employees are expected to be able to respond to emergency instructions more effectively. Scattered residences (farm properties) are often included in this category, but this is more due to practical reasons than adherence to principles.
3. Residents in normal residential areas.
4. Individuals located in particularly vulnerable objects. This is the category for which the various countries are least consistent. The Netherlands does not distinguish between category three and four. In Flanders, category four covers schools, hospitals, and nursing homes. In the United Kingdom, this category also includes places where large numbers of people may gather, such as shopping centres and sports arenas.

In some countries, the number of exposed people is taken into account when considering whether objects are vulnerable and to what degree. When location-based (individual) risk criteria are supplemented by societal risk criteria, the latter will ensure that objects where large numbers of people gather (such as large workplaces, shopping centres, sports arenas, etc.) are not exposed to excessive risk. Where this is the case, the number of exposed people does not need to be included when considering vulnerability.

4.2.6 Risk acceptance criteria for environmental damage

Countries which use quantitative risk acceptance criteria have not laid down explicit criteria for environmental damage. Qualitative criteria include environmental damage in the definition of seriousness classes, but there are no end-point values in relation to environmental damage.

Part C of the latest Commission guidelines refers to a number of methods for assessing environmental damage (see section 3.1), and concludes that a general method that produces comparable results is lacking.

4.2.7 Risk acceptance criteria for personal injury

All quantitative risk acceptance criteria are based on the probability of death. If the mortality rates for various levels of exposure (to toxicity, overpressure, or heat radiation) are known, the results may be summed to generate a single objective for risk. Probit functions (Committee for the Prevention of Disasters, 1992)^[22] are often used to estimate mortality rates for a given level of exposure.

The qualitative criteria employ end-point values. These end-point values also refer to other health effects (though often in qualitative terms), and can therefore be included in assessments. However, it is also possible to perform a qualitative assessment using mortality alone.

End-point values for toxicity, heat radiation and overpressure have been compared for three countries in Table 13. These end-point values are not necessarily comparable, if they focus on different effects (mortality or permanent injury). However, it is striking that the German end-point values are lowest for heat radiation, yet highest for overpressure. This suggests either disagreement on the level that causes damage, or inconsistency between the various types of consequence.

Table 13. Comparison of end-point values for qualitative risk criteria

4.3 General observations

4.3.1 Individual risk level and protection of vulnerable objects

Every person is entitled to the same level of protection against unwanted risks. So far, reference has been made to foreign studies in relation to acceptance criteria for individual risk. Information from Statistics Denmark sets the lowest average mortality of slightly less than 10^-4 per year for girls aged six to 12, see Figure 8. Thus an unwanted risk from major hazard establishments of 10^-6 per year accounts for a maximum of 1% of the lowest mortality rate in the Danish population, and this would appear to be sufficiently low.

Some argue that children and young people should be given extra protection. This cannot be argued on the basis of Danish mortality statistics. The protected group would have to be expanded to a cut-off age of approximately 30 years in order to justify a higher level of protection, and then by a maximum factor of three. However, such protection might be justified on the basis that deaths among children and young people represent a large loss of potential years of life, or simply the normal emotional need to protect children and young people.

Figure 8. Mortality in Denmark from all causes, as a function of age (Statistics Denmark)

Evacuation difficulties are cited as a reason for selecting vulnerable objects. However, many accident scenarios are ‘rapid’ (see section 3.5), making the issue of evacuation less relevant in many cases. A more important argument is whether a given object would play a role in an emergency situation. This means that hospitals, as well as fire stations and emergency communication infrastructure, should be placed outside the maximum consequence distance.

Objects where many people may be gathered (such as shopping centres and sports arenas), should be included in consideration of societal risk, in order to adjust acceptance of distances between these objects and major hazard establishments.

4.3.2 Societal risk and risk aversion

Risk aversion is the term used to express the fact that a community has more difficulty accepting one major accident than several smaller accidents, even if the total loss of life is the same. This is one of the reasons why the criteria slope in an F-N curve is usually greater than one. An objective argument for the slope of the F-N curve would be that major accidents exceed emergency capacity, reducing chances of survival for victims of a major accident, and a major accident can also have a big impact on a relatively small population group (residential area or employee group), exceeding this group’s ability to handle normal mortality rates.

There are no specific arguments to support a curve slope of two, as the above arguments cannot be quantified. The slope of the curve for accidents involving few victims (up to approx. 3-5 deaths) could be one (i.e. an accident involving three deaths is given the same weighting as three accidents involving one death), because these are within normal emergency capacity and would not significantly exceed the community’s ability to adapt. Similarly, the slope for very major accidents (over 500-1000 deaths) could be made greater to reflect the fact that emergency services cannot cope with such large accidents, and they would have irreparable consequences for the local community. Such minor adjustments to the extremity of the F-N acceptance curve would be unlikely to have a significant impact on approval of normal establishments in Denmark, as limits will most often be exceeded in the middle of an establishment’s F-N curve (see the example in Figure 2).

The cut-off line for acceptance of societal risk proposed in Environment Project 112 is lower than the acceptance criteria found in the Netherlands and Flanders. The latter criteria are greater by a factor of 10 to 100. Environment Project 112 argues that there is a relationship between an environment project’s location-based (individual) risk criteria and societal risk for a group consisting of one person. However, it is not possible to make a good comparison between the two criteria, as population density is not included in the assessment of location-based (individual) risk. One can only say that it is undesirable for societal risk criteria for a group of one person to be lower than the location-based risk criteria, as that would mean the societal risk criteria would be exceeded before the location-based risk criteria.

4.3.3 Frequencies for reference accident scenarios and maximum consequence distances

When using qualitative criteria, it is necessary to lay down clear guidelines for determining safety distances. These will often be ‘representative’ scenarios, and not necessarily the worst credible scenarios. Limiting risk analysis and acceptance to an assessment of these ‘representative’ reference scenarios is equivalent to denying that accidents with greater consequences can occur. Therefore, it is recommended that scenarios be included which can impact on the surroundings beyond the safety distances, for example, using methods outlined in section 4.3.5.

Safety distances are comparable to the risk contour for acceptable location-based (individual) risk in a quantitative assessment. This is approx. 10^-6 per year for normal residential areas according to the review (section 4.3.1). A safety distance based on an accident scenario with a frequency of approximately 10^-6 per year provides just as much protection as the above risk contour. In practice, protection will be better, because any given accident will often only impact part (typically 1/10 or 1/100) of the area which could potentially be impacted. It is therefore appropriate to select a frequency for the reference scenario such as approx. 10^-5 per year (roughly equivalent to the lower limit of ‘5E’ in the French method, see section 3.5). The criteria for the reference scenario can therefore be defined, for example, as the accident scenario with the greatest consequence distance and a frequency greater than approx. 10^-5 per year (or an equivalent qualitative frequency class).

The lower limit for the frequency of the scenario that determines the maximum consequence distance will lie between 10^-9 and 10^-8 per year. The first value corresponds to the criteria in Environment Project 112 for scenarios with a consequence class of 5.2. The latter value corresponds to the limit used in the Netherlands’ purple book (Committee for the Prevention of Disasters, 1999).

4.3.4 Risk acceptance criteria for existing and new situations

Some countries use, or have used, more lenient criteria for existing situations than for new situations. Some might argue that this is an unacceptable situation in the long term, as all residents are entitled to equal treatment, and all establishments should be able to comply with the same requirements. The argument for more lenient treatment for existing situations is that it is more difficult and expensive to change existing situations. However, there should be a general principle of working towards the situation whereby even residents in proximity to existing establishments are not subject to a risk level greater than the level considered acceptable for others. Transition schemes with compliance deadlines may be used for this purpose. Establishments should be able to adapt to more stringent requirements in relation to their general environmental impact, and risk should be no exception.

4.3.5 Risk acceptance criteria for environmental damage

The Commission’s most recent guidelines (European Commission, 2006) confirm a lack of established acceptance criteria for assessing damage to the environment that can be compared with acceptance criteria for the risk of loss of life.

An approach to comparing accidents involving human injury and accidents involving environmental damage can be derived from Annex VI of the Seveso II Directive, on reporting major accidents to the Commission (European Council, 1997). The author of this study has previously suggested^[23] that this annex be used as the basis for comparisons between consequence descriptions for accidents involving human injury and accidents involving environmental damage (see Table 14). A starting point is the reporting criteria corresponding to consequence class four. Environmental damage descriptions for the other consequence classes are based on adjustments to the extent of damage that mirror the adjustments used for personal injury. The references to rivers and canals in Annex VI of the Directive are not particularly relevant to Denmark, and should probably be replaced with a comparable assessment of environmental damage in salt-water areas, such as fjords, sounds, and coastal regions.

The descriptions have been used in Table 14, and in the risk matrix example (Table 1), and include references to the consequence scales (Table 2) in Environment Project 112 and the French seriousness scales (Table 8). A comparison of this type reveals that even the verbal descriptions of accident magnitude vary substantially (Environment Project 112’s ‘serious accident K=4’ corresponds to ‘major accident’ in the French method and Table 1).

Table 14 can be used to construct a cumulative acceptance curve for accidents, which can be used for accidents involving personal injury and accidents involving environmental damage, as shown in Figure 9. Instead of a line, the acceptance criteria are now made up of points (columns) for each consequence class. For comparison, the grey ALARA area under the quantitative criteria from Environment Project 112 and the Netherlands acceptance criteria (light green) are also shown, representing a realistic acceptable level of safety. The French criteria are shown in the same way as in Table 9. The green columns on the bottom left show the frequencies for which minor accidents (classes 2 and 3) can be accepted without further conditions, and the red columns on the top right show the prohibited risks.

The qualitative risk acceptance criteria for accidents defined in Environment Project 112 (section 2.1.2) are also shown in this figure. However, note that in principle these criteria are used for individual scenarios (i.e. the curve is not cumulative). The figure shows that approx. 100 accident scenarios would have to exist before the Environment Project 112 criteria would exceed criteria based on the Netherlands limit for societal risk.

Table 14. Proposed consequence category descriptions for accidents involving both personal injury and environmental damage, based on a comparison of criteria for reporting major accidents under Annex VI of the Seveso II Directive (European Council, 1997) .

Figure 9. Risk acceptance criteria for accidents involving human injury and/or environmental damage using definitions in Table 14. The grey shading shows the ALARA region according to the quantitative criteria in Environment Project 112.

4.3.6 Risk acceptance criteria for personal injury

Quantitative risk acceptance criteria are based on the number of fatalities. It is implicitly assumed that the number of fatalities is proportional to the number of personal injuries. However, it would useful to be able to predict the number of injured persons, as this will place greater demands on emergency capacity than (acute) fatalities.

The correlation between fatality and personal injuries has been further analysed in (Rasmussen et al., 1999). Personal injuries are defined using at least three different parameters:

• Need for medical treatment
• Recovery time
• The extent of permanent injury

There is a lack of practical information to link these parameters to exposure to various substances or effects. Only a few references in the scientific literature describe the link between toxic exposure and, for example, hospital admissions.

The AEGL values^[24] have been developed since the above report was released, and these are currently seen as the best alternative to toxic end-point values for use in risk analysis (Taylor, 2007). AEGL values show three different levels (from irritation, to a life-threatening impact). These may make it possible to determine the distance up to which there is a risk of death, and the distance up to which there is a risk of injury.

AEGL values are used as the preferred data foundation when using qualitative methods to determine safety distances. The Commission Publication “Roadmaps” (European Commission, 2007) contains a comparison of IDLH¹⁴, ERPG¹⁸ and AEGL3 values. This comparison is shown in Table 15.

Table 15. Comparison of end-point values for impacts from toxic substances (European Commission, 2007)

The Commission Publication ‘Roadmaps’ also summarises guideline end-point values for heat radiation and overpressure due to explosion. These end-point values differentiate between several effect levels (see Table 16). This is as close as one can get to a dataset permitting assessment of various personal injuries. Please refer to Table 13 to see how these values relate to the criteria used in France, Germany and Italy.

Table 16. End-point values for different effects for heat radiation and overpressure (European Commission, 2007).

[19] These diagrams are often called ‘Bow-tie’ diagrams.

[20] Regeling externe veiligheid inrichtingen II (Revi II), December 2007

[21] John Murray, HSE, email dated 24 January 2008

[22] Probit functions describe the correlation between death and exposure for an exposed population. Probit functions for toxic substances are based primarily on animal testing.

[23] PHARE Twinning project HU/IB/2001/EN/03: Implementation of the Seveso Directive (96/82/EC) by the National Directorate General for Disaster Management and Regional Directorates in Hungary

[24] Acute Exposure Guideline Levels, see http://www.epa.gov/oppt/aegl

5 Conclusions and recommendations regarding use of risk acceptance criteria in Denmark

• 5.1 Status in Denmark and the EU
• 5.2 Risk acceptance criteria requirements
• 5.3 Incorporating frequency criteria
• 5.4 Protection of vulnerable objects
• 5.5 Risk analysis methods
• 5.6 Needs for further work

This final chapter draws conclusions about the situation in Denmark and the EU in relation to the use of risk acceptance criteria for major hazard establishments, and comments on how the situation might be improved. Section 5.1 describes the current situation. Section 5.2 lists the requirements that should apply to risk acceptance criteria and the risk analysis methods used to generate the information compared against these criteria. Sections 5.3 to 5.5 contain recommendations for how risk criteria can be formulated, including the magnitude of acceptable risk levels. Finally, section 5.6 contains comments on the need for further initiatives in this area.

5.1 Status in Denmark and the EU

Most of the risk analyses performed since 1995 for major hazard establishments in Denmark have used qualitative methods, with widespread use of safety-barrier diagrams. These diagrams have been found to be useful for assessing the safety measures establishments have implemented. Unfortunately, these qualitative methods have not been suitable for defining uniform and generally applicable regulations governing appropriate protection of surrounding areas against the residual risk of accidents with consequences outside the establishment’s boundaries. This has meant that decisions about safety distances, for example, have been made on a case-by-case basis, without always giving general consideration to how to deal with accident scenarios with low or very low expected frequencies.

There has been no qualified discussion to date on acceptance criteria in Denmark for environmental damage. This situation is not very different from other EU Member States. With respect to personal injury, some Member States have developed good systems based on quantitative methods (e.g. the United Kingdom, the Netherlands, and Flanders), hybrid methods (France and Italy), or deterministic methods involving no probability considerations (only in Germany). No equivalent well-developed methods exist for dealing with environmental damage.

5.2 Risk acceptance criteria requirements

The first principle of risk acceptance is that all unnecessary risk should be removed. This means that the ALARA or ALARP principle are always followed, even where the level of risk already complies with the general risk acceptance criteria. The ALARA principle involves an assessment of whether the costs of a given safety measure are disproportionately large compared to the safety gain. This assessment will be different depending on whether the level of risk is high or low in relation to the risk acceptance criteria. It is therefore not necessary to highlight risk levels where ALARA is especially applicable.

Other risk acceptance criteria and methods to generate the data to be compared against these criteria must comply with the following requirements:

• Consistency, proportionality, and transparency, as explained in the latest Commission guidelines;
• It should be possible to evaluate the level of risk exposure for surrounding residents considering all activities at the plant, i.e. all relevant accident scenarios must be included in the assessment;
• They should enable assessment of the risk of environmental damage into risk acceptance;
• They should enable selection of one or more safety distances (for different types of land use), and a maximum consequence distance;
• Whenever residential areas are permitted within the maximum consequence distance, assessment of some form of societal risk should be possible, i.e. risk levels for the areas with a concentration of population outside the safety distance, but within the maximum consequence distance, should be accounted for and handled appropriately.
• Risk assessment should reflect the effects of any specific safety measures implemented by the establishment in question, i.e. risk assessment should not be based on generic accident frequencies alone.
  

5.3 Incorporating frequency criteria

The definition of risk involves a clear element of probability. It is necessary to incorporate probability or frequency into any analysis, either as numeric values or using qualitative descriptions or classes. Selection of reference accident scenarios to determine safety distances should be based on explicit quantitative or qualitative frequency criteria, and distinction should be made between safety distances and the maximum consequence distance, in order to achieve acceptable limitations on land use while also staying aware of possible consequences in very rare situations.

5.4 Protection of vulnerable objects

Safety distances, i.e. boundaries for areas with land-use restrictions, can be set for different objects and/or groups of people. The basic division should be as follows:

1. Employees at the major risk establishment will be protected on the basis of normal occupational safety requirements;
2. Workplaces at other establishments must not be exposed to a location-based risk of fatality (or equivalent qualitative criteria), greater than approx. 10^-5 per year. Employees at these establishments must be informed of the risk conditions and management of accident situations
3. General residential areas and other areas frequented by the general public, including schools, homes for the elderly, etc., must not be exposed to a location-based (individual) risk of death (or equivalent qualitative criteria) exceeding approx. 10^-6 per year.
4. Objects playing a role in public emergency services, such as hospitals, and fire and police stations, should be placed outside the maximum consequence distance.

These criteria should be supplemented with criteria for societal risk and environmental damage, in order to limit the cumulative frequency for major accidents to:

• Approx. 10^-3 per year for major accidents (involving up to one fatality, or equivalent damage or injury as defined in Table 14);
• Approx. 10^-5 per year for catastrophes (involving up to 10 fatalities, or equivalent damage or injury);
• Approx. 10^-7 for disasters.

When calculating societal risk, people’s presence or absence and the protective effect of buildings, etc. should be taken into account.

The same criteria should be used for both existing and new situations. For existing situations that do not fulfil the requirements, a timeframe should be set within which the criteria must be fulfilled. This can be done by implementing preventative measures to reduce frequencies, and/or mitigating initiatives to reduce the consequences.

It is expected that where the ALARA principle is followed, most risks can be reduced to at least a factor of 10 less than the above acceptance criteria.

5.5 Risk analysis methods

Environment Project 112 proposes that quantitative and qualitative risk analysis methods should lead to comparable results. This review has found that the methods, as they have been applied to date, are quite difficult to compare.

It is possible to use quantitative risk analysis methods to meet the above risk acceptance criteria. However, it is recommended that the safety-barrier diagram method also be used with quantitative methods, as this is easily comprehensible and relatively simple to use. It also makes it possible to take into account site-specific circumstances.

Qualitative risk analysis methods should continue to be available. However, in order for the results to be applicable in relation to the above risk acceptance criteria, frequency classes and quantitative frequency intervals must be linked, as shown in Table 3 or Table 5. Guidelines should also be developed for the combined assessment of various accident scenarios (for example, the way to sum frequencies). These considerations suggest that the French method would be a good candidate to use as the basis for a Danish hybrid method.

5.6 Needs for further work

Qualitative or hybrid methods need to be developed that can be used to determine safety distances and societal risk. Section 5.5 above mentions that the French hybrid method could provide a basis for a Danish hybrid method. If such a hybrid method is applied, the French frequency and seriousness classes should be critically reviewed and possibly adjusted. It may also be appropriate to include meteorological factors that reduce exposure frequency in terms of emissions frequency, by re-evaluating and generalising Figure 2.2 in Annex A of Environment Project 112.

Acceptance criteria should be developed for natural and environmental damage. A starting point might be to compare the seriousness of personal injury and environmental damage, as listed in Table 14, adapting this to the Danish requirement of being able to assess environmental damage in salt-water areas, such as fjords, sounds and coastal regions, rather than in rivers and canals. This work should include a review of the methods proposed by some EU Member States (see section 3.1), and analysis methods previously used in Denmark, especially with the aim of accommodating Denmark’s particular interest in protecting groundwater aquifers.

There are currently no Danish guidelines for using the ALARA or ALARP principle. Inspiration for such guidelines can be drawn from experience in countries such as the United Kingdom.

6 Glossary

This glossary explains the most important risk terminology used in this report. References are supplied to specific sections within the report where these contain a more detailed explanation.

7 References

Christensen, F.M., Andersen, O., Duijm, N.J., and Harremoës, P., Risk terminology - a platform for common understanding and better communication, Journal of Hazardous Materials, Vol. 103, No 3, pp. 181-203, 2003

Christensen, F.M., Andersen, O., Duijm, N.J., Knudsen, I., and Harremoës, P., Risikoterminologi. Oplæg til fælles forståelse og bedre dialog, pp. 50 _P., 2002

Committee for the Prevention of Disasters, Methods for the determination of possible damage to people and objects resulting from releases of hazardous materials “green book”, CPR 16E
ISBN 90-5307-052-4, Sdu Uitgevers, The Hague, 1992

-----, Methods for the calculation of physical effects due to the releases of hazardous materials (liquids and gases) ‘Yellow Book’, CPR 14E, Sdu Uitgevers, The Hague, 1997

-----, Guidelines for quantitative risk assessment (“Purple Book”), CPR 18E, Sdu Uitgevers, The Hague, Netherlands, 1999

Dansk Standard, Risikoanalyse: Kvalitetskrav, terminologi (Risk analysis: requirements an terminology, DS/INF 85, pp. 1-21, DS-Information, Danish Standards Association, Copenhagen, 1993

European Commission, Guidance on Land Use Planning as required by Council Directive 96/82/EC (Seveso II), Office for Official Publications of the European Communities, Luxembourg, 1999

-----, Land Use Planning Guidelines in the context of article 12 of the Seveso II Directive 96/82/EC as amended by Directive 105/2003/EC, Joint Research Centre, Inst. for Protection of the Citizen, Hazard Assessment Unit, 2006

-----, Implementing Art. 12 of the Seveso II Directive - Overview of Roadmaps in selected member states, Joint Research Centre, Inst. for the Protection and Security of the Citizen, Traceability, Risk and Vulnerability Assessment Unit, 2007

European Council, Council Directive 96/82/EC of 9 December 1996 on the control of major-accident hazards involving dangerous substances, Official J.Eur.Commun, Vol. L 10, pp. 13-33, 1997

Lauridsen, K., Kozine, I.O., Markert, F., Amendola, A., Christou, M., and Fiori, M., Assessment of uncertainties in risk analysis of chemical establishments. The ASSURANCE project. Final summary report., Risø-R-1344(EN)-49, Risø National Laboratory, Roskilde, Denmark, 2002

Danish Environmental Protection Agency, Bekendtgørelse om kontrol med risikoen for større uheld med farlige stoffer, Vol. BEK no. 1666 af 14/12/2006, 2006

Danish Environmental Protection Agency, Rapport fra arbejdsgruppen af centrale myndigheder vedrørende et eventuelt naturgaslager i Tønder, Danish Environmental Protection Agency, 1996

Rasmussen, B., Bertelsen, I., Burchard, V., Christensen, P., Duijm, N.J., Grønberg, C.D., and Markert, F., Multi-objective decisions in land-use planning involving chemical sites, Risø-R-1106(EN)
Contract no. ENV4-CT96-0241, pp. 57_P, Risø National Lab., Roskilde (DK). Systems Analysis, 1999

Schüller, J.C.H., Brinkman, J.L., Van Gestel, P.J., and van Otterloo, R.W., Methods for determining and processing probabilities (Red Book), CPR 12E/PGS4, 2nd edition, Committee for Prevention of Disasters, The Hague, 1997

Taylor, J.R., Afdækning af muligheder for etablering af standardværktøjer og/eller -kriterier til vurdering af sundheds- og miljørisici i forbindelse med større uheld (gasudslip) på risikovirksomheder, Arbejdsrapport Nr. 4, Danish Environmental Protection Agency, København, 2007

Taylor, J.R., Petersen, C.G., Kampmann, J., Schepper, L., Kragh, E.K., Selig, R.S., Becher, P., and Petersen, K.E., Kvantitative og kvalitative kriterier for risikoaccept (Quantitative and qualitative criteria for risk acceptance, in Danish), Miljøprojekt nr. 112
ISBN 87-503-7938-0, Danish Environmental Protection Agency, Copenhagen, 1989

Taylor, J.R. and Platz, O., Sammenligning af risikoniveauer og sikkerhedsforanstaltninger for nogle industrianlæg - arbejdsnotater, TA-90-6-1, pp. 1-71, Taylor Associates ApS, Glumsø, Denmark, 1991

| Top | | Front page |

Version 1.0 Marts 2009, © Danish Environmental Protection Agency