Acceptance criteria in Denmark and the EU
2 Earlier Danish studies
This chapter summarises earlier Danish studies reflecting developments in the practice of risk analysis and acceptance in Denmark. The most important study is known as ‘Environment Project 112’ (Taylor et al., 1989). This study discusses considerations in relation to the choice of risk analysis methods and risk acceptance criteria, and concludes with recommendations in this area. It has subsequently been found that Environment Project 112 does not offer a solution for how to delimit safety zones when using qualitative risk assessments. This has led to further consideration in a report on delimitation of safety zones for an underground natural gas storage facility in Tønder, Denmark (the ‘Tønder Report’) (Danish Environmental Protection Agency, 1996).
2.1 Environment Project 112
Environment Project 112 contains a thorough review of risk analysis methods and acceptance criteria. It recognizes a link between the choice of risk acceptance criteria and risk analysis methods. The report concludes that two analysis or assessment methods can be readily used in practice – a method based on qualitative analysis, and a method based on quantitative analysis. A standards-based method is considered impractical due to the work involved in providing the necessary standards.
The conclusion notes that ‘it has been shown possible to compare results from the quantitative and qualitative approaches, such that these can provide comparable results under certain conditions’. This is an important condition for regulatory authorities to be able to accept the use of various methods and criteria, in light of the ‘consistency’ requirement formulated in the most recent European Commission Guidelines (European Commission, 2006) (see section 3.1).
The report highlights the principle considerations forming a basis for acceptance criteria. The three most important considerations, concerning risk to third parties, are repeated here:
- The natural risk we are exposed to in daily life should not be significantly increased by activities, such as industry, etc., created by others without our personal consent.
- Before process plant is established, it should be investigated whether certain processes can be substituted by other processes with a smaller inherent risk of accident.
- The resources available for activities to promote safety should be primarily applied in ways that lead to the best overall result.
Parts of these principles take effect in the following requirements for approval of plant:
- Plant must be organised based on the ‘ALARA principle’[6], i.e. all reasonable measures must be taken to reduce the risk of accident. This includes drawing on accumulated experience within the industry, adherence to recognised standards, and implementation of safety measures to counter the potential risks of the plant.
- It must be demonstrated that the plant does not expose individuals or society to unacceptable levels of risk.
- The advantages to society deriving from the plant must be greater than the risk the plant represents to society.
Qualitative criteria and assessment methods particularly address the first requirement, while quantitative criteria and methods address the second requirement. The third requirement involves cost-benefit analyses. These are often difficult to perform and open to uncertainty in terms of comparisons made between various values (life, the environment, the economy). They will therefore not be considered further.
The following issues are not covered in Environment Project 112:
- Questions relating to existing versus new plant, and development activities in proximity to major hazard establishments.
- Criteria for environmental damage.
2.1.1 Recommendations in Environment Project 112 for quantitative risk acceptance criteria
Environment Project 112 recommends the following criteria for the technical assessment of plant:
- A location-based (individual) risk of death for the most at-risk neighbour of 10-6 per year.
- Societal risk formulated as a risk of death of 10-4 per year for an accident involving at least one fatality. Where societal risk falls within the shaded grey region above the minimum curve, the risk should be “As Low As Reasonably Achievable” (ALARA).
- These criteria should be supplemented with a requirement that risks be reduced as far as reasonably possible (the ALARA principle), and that consideration be given to serious or permanent damage, and damage with delayed onset.
Environment Project 112 only makes recommendations relating to quantitative criteria based on number of fatalities.
Acceptance criteria for societal risk (see also Figure 2) are shown in Figure 5. Figure 5 shows the ‘grey zone’ within which the above ALARA principle should be used, extending over a frequency factor of 100. In other words, if the risk of an accident involving at least one fatality is less than 10-6 per year (100 times less than the minimum criteria of 10-4 per year[7]), no further safety measures are necessary.
The argument for these acceptance criteria for location-based (individual) risk is that:
- They correspond to the risk of natural disaster.
- Plants with good safety measures can realistically fulfil the criteria in practice.
- They only increase the risk of death due to other causes by a tiny fraction (no more than one per cent for children aged approx. 10-15 years[8]).
The main issues relating to societal risk criteria relate to:
- The slope of the curve.
- The absolute level (i.e. trimming the curve for accidents involving only one death).
- Whether or not the curve should be cut off at a particular accident size (i.e. that accidents above this size are not permitted).
The argument for the selected acceptance criteria for societal risk is that:
- A slope of 2 on a logarithmic scale matches practical situations (observations of accidents and results of risk analyses).
- A slope with a value greater than 1 places more stringent requirements on larger accidents, and thereby takes into account the extra burden larger accidents place on the community.
- It can be argued that the value at one death (10-4 per year) does not conflict with the criteria for location-based (individual) risk in most practical situations.
- Plants with good safety measures can realistically fulfil the criteria in practice.
Figure 5. Acceptance criteria for societal risk, according to Environment Project 112. The purple line indicates the minimum criteria. The grey zone indicates where the ALARA principle should be used.
2.1.2 Recommendations in Environment Project 112 for qualitative acceptance criteria
Environment Project 112 defines qualitative acceptance criteria as criteria ensuring the safety measures in place are reasonable in proportion to the risk of accident. A consequence analysis is essential when using quantitative methods in order to quantify in detail how the accident impacts the surrounding area. However, when using qualitative methods, a consequence analysis is used to qualify these accidents in terms of their potential to impact the surrounding area – i.e. to qualify the seriousness of a given accident.
Depending on the seriousness and expected frequency, requirements may be specified regarding the number and quality (failure rate and effectiveness) of safety measures. Environment Project 112 recommends barrier diagrams[9] as a tool to help present the results of risk analysis. These diagrams show the possible sequences of events prior to an accident, and the safety measures (hereafter referred to as barriers or safety barriers) that can prevent or mitigate the accident.
Figure 6. Example safety-barrier diagram
Analysis procedure:
- Assess the seriousness of the final event (e.g. ‘Reactor explodes’ in Figure 6) based on an analysis of the consequences this event would have for people, buildings, the environment, etc.
- Determine the (approximate) frequency of the initiating events (‘Fault at mixing plant’ and ‘Incorrect mixture of ingredients’ in Figure 6).
- The seriousness of the final event and the frequency of the initiating events, in combination, will determine the requirements to be placed on the intervening safety barriers (three barriers in Figure 6).
Environment Project 112 proposes scales for the seriousness of the consequences (consequence scale K, Table 2), frequency (frequency scale H, Table 3) and failure rates for safety barriers.
Table 2. Consequence scale K for accidents proposed by Environment Project 112
| Consequence scale K | Description of consequences | |
| 0 | No consequences – events within normal plant operations that involve no disruption or hazard | |
| 1 | Insignificant consequences – minor disruption, but no hazard, and no great impact on production | |
| 2 | Noticeable consequences – noticeable impact on production, but no injury to humans or environmental damage, and only minor damage to equipment in the vicinity of the accident | |
| 3 | Significant consequences – less serious personal injury and/or significant damage to the environment or equipment in the vicinity of the accident |
|
| 4 | Serious consequences on site – events of a serious nature, but which do not affect the plant’s surroundings. Plant is destroyed, and permanent injuries or fatalities occur among employees. | |
| 5 | Major accident with impact both on site and on its surroundings. Several permanent injuries and possibly fatalities and/or major destruction to plant within the enterprise, as well as impacts on the enterprise’s surroundings in terms of permanent injuries to people and possibly fatalities, environmental damage, or material destruction. May be subdivided into 5.1 and 5.2: | |
| 5.1 | Potential for up to 10 fatalities off site and/or limited environmental damage | |
| 5.2 | Potential for more than 10 fatalities off site and/or extensive environmental damage | |
Table 3. Frequency scale H for initiating events proposed by Environment Project 112[10]
| Frequency scale H | Qualitative description | Magnitude (per year) |
| 6 | Frequent event, twice a week or more | > 100 |
| 5 | Common event occurring one or more times a year, but less than twice a week | 1 - 100 |
| 4 | Uncommon event | 0.01 - 1 |
| 3 | Rare event | <0.01 |
| 2 | Very rare event | <10-4 |
| 1 | Extremely rare event | <10-6 |
| X | Event for which a probability cannot be calculated due to its unpredictable or irrational nature, e.g. sabotage. |
Failure rates for barriers are specified using points (barrier points). Each point indicates that the accident frequency is reduced by a factor of square root of ten. If the frequency of the initiating event is characterised as H=4 (once a year at most) and the total point score for all barriers between the initiating event and the consequence is 8, the maximum expected frequency of the consequence will be 10-4 per year. The report contains recommendations on assigning points to various types of safety barriers.
The acceptance criteria are formulated in a way that safety barriers with a cumulative point value of N must be present, as shown below, for initiating events with a frequency scale value of H:
- For accidents with the potential for fatalities (individual risk): N= 4×H-2;
- For accidents with a consequence scale value of K=5.1 (societal risk): N= 4×H-4;
- For accidents with a consequent scale value of K=5.2 (societal risk): N= 4×H+2;
Simplified acceptance criteria are also described. These only consider the barriers that fulfil all the requirements for good barriers. These (automatic, as a minimum) barriers can be assigned at least 6 barrier points, and then a minimum number of barriers for a given initiating event and level of seriousness will be sufficient.
Environment Project 112 notes that the qualitative requirements are more restrictive than the quantitative requirements (the above criteria for individual risk is a maximum of 10-7 per year). This may be seen as a disadvantage for these criteria. However, Environment Project 112 does not discuss how the qualitative method handles different accident scenarios that each contribute to risk separately. This situation would make the qualitative criteria less restrictive for the total plant, if applied per scenario.
2.2 The ‘Tønder Report’
In 1996, a task force under the Danish Environmental Protection Agency and Danish Energy Agency, with representatives from the relevant major hazard authorities, prepared a report – the Tønder Report – advising the regional authority (known at that time as the County of Sønderjylland) about the location and design of a surface plant for a planned natural gas storage facility in Tønder (Danish Environmental Protection Agency, 1996). The recommendations made to the County particularly related to the delimitation of safety zones, and may therefore also be relevant in relation to other major hazard establishments.
The Tønder Report was prepared in order to highlight a number of safety issues related to an underground natural gas storage facility, without placing unnecessary restrictions on business development opportunities close to the facility.
The report focuses on an event considered to be a reference scenario for the safety distance (restrained leakage from a 12”/16” pipe). No assessment was made of the consequences of an uncontrolled gas blow-out due to fire, as the probability “was perceived by the task force to be so small that it should [not[11]] serve as a reference event for the safety zones”. The report does not specify whether a) the consequences of blow-out would be greater than for restrained leakage, or b) the probability levels in question.
Safety zones are defined as zones where rapid evacuation is possible, and institutions that are difficult to evacuate may not be placed within them. ‘Rapid evacuation’ is not further explained. Reference is made to the town of Stenlille, where an inner and outer safety zone have been defined. No buildings may be erected in the inner safety zone, as is the case for safety zones adjacent to gas transmission pipes. The report proposes that the inner safety zone for Tønder be set to the consequence distance for the accident scenario, ‘leakage from 12/16” pipe with restrained gas cloud’. The outer safety distance has been set using the method used at the time to set the outer safety zone at a maximum of 200m adjacent to gas transmission pipes[12].
We conclude that:
- The inner safety distance is only based on consequences. Accident frequency for the reference scenario has not been explicitly stated.
- The outer safety distance is not explicitly based on either consequences or risks, but follows a design standard.
Based on the minutes of a meeting attached to the Report, we conclude that quantitative calculations were performed which support the choice of a safety distance of 100-200m as acceptable in comparison to Environment Project 112’s societal risk criteria (the lower curve in Figure 5).
[6] ALARA: As Low As Reasonably Achievable. Risks must be reduced using all ‘reasonable’ means, i.e. taking into account the cost of such measures. This report views ALARA and ALARP (As Low As Reasonably Practical) as synonyms. ALARA has been used, as this term has been used in Environment Project 112.
[7] Expected accident frequencies are usually expressed as powers of ten, i.e. 10-4 per year means that the probability of an accident is 1 in 10,000 per year. This is the same as saying that, on average, one accident is expected every 10,000 years at the given plant, or that if there were 10,000 similar plants, an average of one accident would be expected each year at any of these plants. However, it should be borne in mind that the accident could occur at any time (or place).
[8] Environment Project 112 refers to foreign statistics. The corresponding Danish statistics are shown in Figure 8. This figure shows that children aged 6-12 years have the lowest fatality risk in Denmark.
[9] The full name is safety-barrier diagram.
[10] Some consultancy firms currently use frequency classifications in the reverse order, with a factor of square root of 10 between each class, like barrier points, i.e. category 2 corresponds to a frequency of 0.1 per year, and category 4 to 0.01 per year. This allows acceptance criteria to be formulated by stating that the sum of the frequency category and barrier points must exceed a set minimum value.
[11] The original text omits the word ‘not’.
[12] The regulations relevant for the determination of safety zones can be found in Danish Ministry of Employment Statutory Order no. 414/1988, supplemented by the Working Environment Authority’s supplementary provisions to the “ASME Guide for Gas Transmission and Distribution Piping Systems” (1983). At the present time, refer to the Danish Working Environment Authority Guide F.0.1 “Naturgasanlæg”, 2001
Version 1.0 Marts 2009, © Danish Environmental Protection Agency