| Front page | | Contents | | Previous | | Next |

Acceptance criteria in Denmark and the EU

4 Discussion of risk acceptance criteria

• 4.1 Discussion of developments within Denmark
• 4.2 Discussion of review of practices within the EU
  • 4.2.1 Qualitative versus quantitative criteria methods
  • 4.2.2 Ensuring consistent and uniform decisions
  • 4.2.3 Comparison of quantitative risk acceptance criteria
  • 4.2.4 Existing and new situations
  • 4.2.5 Dealing with vulnerable objects (such as hospitals, schools, and infrastructure)
  • 4.2.6 Risk acceptance criteria for environmental damage
  • 4.2.7 Risk acceptance criteria for personal injury
• 4.3 General observations
  • 4.3.1 Individual risk level and protection of vulnerable objects
  • 4.3.2 Societal risk and risk aversion
  • 4.3.3 Frequencies for reference accident scenarios and maximum consequence distances
  • 4.3.4 Risk acceptance criteria for existing and new situations
  • 4.3.5 Risk acceptance criteria for environmental damage
  • 4.3.6 Risk acceptance criteria for personal injury

This chapter discusses the studies presented in the preceding two chapters. Section 4.1 discusses Danish studies and developments based on Environment Project 112. Section 4.2 discusses and compares European studies. Section 4.3 concludes with some general observations on choosing risk acceptance criteria based on an overall evaluation of the studies and existing practices in Europe.

4.1 Discussion of developments within Denmark

Environment Project 112 provides a thorough examination of risk analysis and risk acceptance criteria issues.

The qualitative method developed, using safety barrier diagrams, has been found useful. The method is widely used in Denmark and in some other countries^[19]. Discounting the fact that more experience with using various methods and criteria has since been gained, the work can only be criticised on the following points:

1. The qualitative method is not linked to an explicit assessment of the geographic conditions for the establishment in question (distance to residences, extent of consequences).
2. The qualitative method focuses on acceptance criteria for individual accident scenarios, and makes no comment on how to sum risk contributions from various accident scenarios.

This has presumably been a factor in the later focus in Denmark on selecting a reference accident scenario to determine safety distances, so that the worst case accident is discounted, and the consequence distance for a smaller accident is used to determine the safety distance. This approach is only reasonable if explicit and justified rules exist governing selection of this reference accident (Environment Project 112 provides no guidance in this area). This approach also fails to perform assessment of societal risk. Societal risk is related to the risk outside the safety distance (for example, if there are densely populated areas just outside the safety distance), and can therefore only be assessed if the accident scenarios resulting in consequences outside the safety distance are assessed.

Environment Project 112 has attempted to make the quantitative and qualitative criteria comparable. For any given event, the qualitative criteria are more stringent than the quantitative criteria, but the qualitative approach does not take into account the fact that several accident scenarios often contribute together to the total risk. These effects may possibly compensate for each other, but they also make comparison difficult.

If quantitative and qualitative criteria are to be used on a side-by-side basis, one must be willing to comment on events with frequencies as low as 10^-6 per year within the qualitative method, in order to get insight into the maximum consequence distance, even though the reference accident (which determines the safety distance) has a frequency of 10^-4 per year. The practice of confining assessment to the reference accident scenarios, as described in the ‘Tønder Report’ mentioned earlier (Danish Environmental Protection Agency, 1996), conflicts with the principles in Environment Project 112 and is partially to blame for the current need for more detailed risk assessment guidelines in Denmark.

4.2 Discussion of review of practices within the EU

On the basis of the Commission’s guidelines and the above review of practices in seven Member States, it is apparent that there are significant differences in acceptance criteria and methods of implementing risk analysis in EU Member States.

4.2.1 Qualitative versus quantitative criteria methods

The Commission’s description of qualitative methods in the guidelines shows that when reference accident scenarios are used, the worst case accident scenarios are generally not assessed, making it impossible to assess the need for emergency plans for accidents greater than the reference scenarios (worst credible accidents). This is partly because terms such as ‘worst case’, ‘worst conceivable’ and ‘worst credible’ are poorly defined, leading to a poor grasp of the differences between the terms.

Germany uses a purely qualitative method whereby frequencies are not assessed at all. There are clear, explicit rules governing selection of reference accident scenarios. These scenarios are defined based on a technical description of emissions and in relation to the surroundings. Accidents larger than the reference scenarios (such as the collapse of a tank, delayed ignition of explosive emissions, or simultaneous failure of several containers due to fire) are not considered. There are clear risk acceptance criteria in the form of distance requirements.

Quantitative risk acceptance criteria apply to both existing and new situations in the Netherlands and Flanders. These criteria examine both location-based (individual) risk and societal risk. The United Kingdom uses criteria based on location-based (individual) risk of a new development in proximity to existing plant. These criteria place limits on the number of people who may be exposed to particular levels of risk, thus giving partial consideration to societal risk (implicit criteria for expected loss of life).

France has developed a hybrid method that approximates to a thorough quantitative risk analysis. However, the following qualitative aspects have been retained:

• Frequency may be assessed using frequency classes.
• Fixed end-point values are used to calculate consequence distances.
• Various types of consequences such as heat radiation, toxicity, and overpressure are assessed separately (i.e. their frequencies are not summed).
• The effects of wind direction and speed are not considered, i.e. the safety zones are concentric circles around the hazard source.

Clear risk acceptance criteria have been set, providing a framework for managing existing and new establishments. Planning requirements for extra safety measures may also exist, governing the establishments themselves, and the way that exposed buildings are constructed, such that they provide protection for their occupants.

The approach followed in Italy is similar to the method used in France (European Commission, 2007).

4.2.2 Ensuring consistent and uniform decisions

Section 1.3.2.2 discussed the fact that frequency estimates can be subject to great uncertainty. Major differences have also been observed between the various consequence models (Lauridsen et al., 2002). As a result, the same (type of) plant may be assessed to have different levels of risk. This is in conflict with the principle of consistency. The review in chapter three shows two ways of dealing with this problem, which are both related to quantitative methods and criteria:

4.2.2.1 Harmonisation

The Netherlands has given major focus to harmonising its quantitative risk assessment method. The view is that it is more important that results are comparable, than that they are correct in absolute terms. This work led to the publication of their ‘coloured’ books (Committee for the Prevention of Disasters, 1992; Committee for the Prevention of Disasters, 1997; Committee for the Prevention of Disasters, 1999; Schüller et al., 1997). Establishments must have compelling arguments in order to have a risk assessment accepted that is not carried out in compliance with these guidelines. Since January 2008, establishments have been required^[20] to use a particular software package (SAFETI-NL).

One disadvantage of this harmonisation is that generic failure rates are used, as specified in the ‘purple book’, and not site-specific information about equipment and safety measures. The risk for an establishment that implements extra safety measures is assessed in exactly the same way as for a comparative establishment that has no such measures. This conflicts with the principle of proportionality. Establishments have no extra incentive to improve safety, and it is difficult for the authorities to handle assessment of extra technical measures in relation to article 12 in Seveso II (in contrast to the French method).

4.2.2.2 Central assessment

In the United Kingdom, quantitative risk assessment is carried out by a central authority (HSE) based on information provided by the establishment and the local authorities. This is not harmonisation in a formal sense, but the approach ensures that assessments are performed using identical methods, data sources and expertise. In principle, the HSE also uses generic data (the FRED database), but HSE experts may make allowance for site-specific conditions based on information from the establishment’s safety report and/or an inspection^[21].

4.2.3 Comparison of quantitative risk acceptance criteria

The review of practices indicates agreement among the selected EU countries on acceptance criteria for location-based (individual) risk for the general population of 10^-6 per year. Flemish, British and Dutch regulations permit small ‘non-vulnerable’ groups to be exposed to risk up to 10^-5 per year. Business activities are permitted at even higher levels of risk in the United Kingdom. British and Flemish regulations deal with lower limits for some vulnerable objects, or objects where many people may gather, but never lower than 10^-7 per year.

Criteria for societal risk only exist in Flanders and the Netherlands. These criteria take the form of a line limiting the F-N curve. In both the Netherlands and Flanders, this line has a slope of 2 (on a double-logarithmic scale). Under the criteria for the Netherlands, risk of accidents involving 10 or more deaths must be less than 10^-5 per year. In Flanders, the limit is 10^-4 per year (in comparison, the grey area defined in Environment Project 112 lies between 10^-6 and 10^-4 per year – see Figure 7).

It is interesting to compare these criteria with the French hybrid criteria. Table 9 is designed to be comparable with an F-N curve. The French frequency and seriousness classes are separated by a factor of 10 (see Table 5 and Table 8). This means the limit of the green region has a slope of 2 (two steps at a time), while the limit of the red region has a slope of 1 from moderate to catastrophic accidents, and a slope of 2 from catastrophic to disastrous accidents. In other words, risk aversion (see section 4.3.2 below) is expressed in the French criteria in almost the same way as in the Netherlands and Flanders.

4.2.4 Existing and new situations

In several countries, risk acceptance criteria are only used explicitly in connection with new establishments, or urban development in proximity to existing establishments. This is probably due to legal issues relating to permits for existing establishments, rather than an indication that the risk in existing situations ought to be accepted.

In the (few) cases where the acceptance criteria are also used for existing situations, until recently these were permitted to be higher than criteria for new situations. Today, the same criteria apply to both new and existing situations, possibly supplemented by transition schemes (the Netherlands, France).

4.2.5 Dealing with vulnerable objects (such as hospitals, schools, and infrastructure)

EU Member States employ various principles to select and protect objects (people, buildings, and land areas) considered to be particularly vulnerable in case of accident. In most cases, the selection of vulnerable objects is not explained, but in some cases selection is justified on the basis of objects that are difficult to evacuate.

Distinction is usually made between four categories of exposed individuals:

1. Employees at the plant itself (both direct employees and external tradesmen). In principle, these individuals are protected by occupational safety requirements. In most cases they are not included in the consideration of societal risk.
2. Employees at establishments neighbouring to the hazardous plant. A higher location-based (individual) risk is often accepted for commercial areas compared to residential areas (usually different by a factor of 10, as in Flanders and the Netherlands). The British criteria in this situation are also based on occupational safety criteria. This can be justified as follows:
   1. The same employees at these establishments are not expected to be exposed 24 hours a day.
   2. There are no sleeping facilities.
   3. Employees are expected to be able to respond to emergency instructions more effectively. Scattered residences (farm properties) are often included in this category, but this is more due to practical reasons than adherence to principles.
3. Residents in normal residential areas.
4. Individuals located in particularly vulnerable objects. This is the category for which the various countries are least consistent. The Netherlands does not distinguish between category three and four. In Flanders, category four covers schools, hospitals, and nursing homes. In the United Kingdom, this category also includes places where large numbers of people may gather, such as shopping centres and sports arenas.

In some countries, the number of exposed people is taken into account when considering whether objects are vulnerable and to what degree. When location-based (individual) risk criteria are supplemented by societal risk criteria, the latter will ensure that objects where large numbers of people gather (such as large workplaces, shopping centres, sports arenas, etc.) are not exposed to excessive risk. Where this is the case, the number of exposed people does not need to be included when considering vulnerability.

4.2.6 Risk acceptance criteria for environmental damage

Countries which use quantitative risk acceptance criteria have not laid down explicit criteria for environmental damage. Qualitative criteria include environmental damage in the definition of seriousness classes, but there are no end-point values in relation to environmental damage.

Part C of the latest Commission guidelines refers to a number of methods for assessing environmental damage (see section 3.1), and concludes that a general method that produces comparable results is lacking.

4.2.7 Risk acceptance criteria for personal injury

All quantitative risk acceptance criteria are based on the probability of death. If the mortality rates for various levels of exposure (to toxicity, overpressure, or heat radiation) are known, the results may be summed to generate a single objective for risk. Probit functions (Committee for the Prevention of Disasters, 1992)^[22] are often used to estimate mortality rates for a given level of exposure.

The qualitative criteria employ end-point values. These end-point values also refer to other health effects (though often in qualitative terms), and can therefore be included in assessments. However, it is also possible to perform a qualitative assessment using mortality alone.

End-point values for toxicity, heat radiation and overpressure have been compared for three countries in Table 13. These end-point values are not necessarily comparable, if they focus on different effects (mortality or permanent injury). However, it is striking that the German end-point values are lowest for heat radiation, yet highest for overpressure. This suggests either disagreement on the level that causes damage, or inconsistency between the various types of consequence.

Table 13. Comparison of end-point values for qualitative risk criteria

4.3 General observations

4.3.1 Individual risk level and protection of vulnerable objects

Every person is entitled to the same level of protection against unwanted risks. So far, reference has been made to foreign studies in relation to acceptance criteria for individual risk. Information from Statistics Denmark sets the lowest average mortality of slightly less than 10^-4 per year for girls aged six to 12, see Figure 8. Thus an unwanted risk from major hazard establishments of 10^-6 per year accounts for a maximum of 1% of the lowest mortality rate in the Danish population, and this would appear to be sufficiently low.

Some argue that children and young people should be given extra protection. This cannot be argued on the basis of Danish mortality statistics. The protected group would have to be expanded to a cut-off age of approximately 30 years in order to justify a higher level of protection, and then by a maximum factor of three. However, such protection might be justified on the basis that deaths among children and young people represent a large loss of potential years of life, or simply the normal emotional need to protect children and young people.

Figure 8. Mortality in Denmark from all causes, as a function of age (Statistics Denmark)

Evacuation difficulties are cited as a reason for selecting vulnerable objects. However, many accident scenarios are ‘rapid’ (see section 3.5), making the issue of evacuation less relevant in many cases. A more important argument is whether a given object would play a role in an emergency situation. This means that hospitals, as well as fire stations and emergency communication infrastructure, should be placed outside the maximum consequence distance.

Objects where many people may be gathered (such as shopping centres and sports arenas), should be included in consideration of societal risk, in order to adjust acceptance of distances between these objects and major hazard establishments.

4.3.2 Societal risk and risk aversion

Risk aversion is the term used to express the fact that a community has more difficulty accepting one major accident than several smaller accidents, even if the total loss of life is the same. This is one of the reasons why the criteria slope in an F-N curve is usually greater than one. An objective argument for the slope of the F-N curve would be that major accidents exceed emergency capacity, reducing chances of survival for victims of a major accident, and a major accident can also have a big impact on a relatively small population group (residential area or employee group), exceeding this group’s ability to handle normal mortality rates.

There are no specific arguments to support a curve slope of two, as the above arguments cannot be quantified. The slope of the curve for accidents involving few victims (up to approx. 3-5 deaths) could be one (i.e. an accident involving three deaths is given the same weighting as three accidents involving one death), because these are within normal emergency capacity and would not significantly exceed the community’s ability to adapt. Similarly, the slope for very major accidents (over 500-1000 deaths) could be made greater to reflect the fact that emergency services cannot cope with such large accidents, and they would have irreparable consequences for the local community. Such minor adjustments to the extremity of the F-N acceptance curve would be unlikely to have a significant impact on approval of normal establishments in Denmark, as limits will most often be exceeded in the middle of an establishment’s F-N curve (see the example in Figure 2).

The cut-off line for acceptance of societal risk proposed in Environment Project 112 is lower than the acceptance criteria found in the Netherlands and Flanders. The latter criteria are greater by a factor of 10 to 100. Environment Project 112 argues that there is a relationship between an environment project’s location-based (individual) risk criteria and societal risk for a group consisting of one person. However, it is not possible to make a good comparison between the two criteria, as population density is not included in the assessment of location-based (individual) risk. One can only say that it is undesirable for societal risk criteria for a group of one person to be lower than the location-based risk criteria, as that would mean the societal risk criteria would be exceeded before the location-based risk criteria.

4.3.3 Frequencies for reference accident scenarios and maximum consequence distances

When using qualitative criteria, it is necessary to lay down clear guidelines for determining safety distances. These will often be ‘representative’ scenarios, and not necessarily the worst credible scenarios. Limiting risk analysis and acceptance to an assessment of these ‘representative’ reference scenarios is equivalent to denying that accidents with greater consequences can occur. Therefore, it is recommended that scenarios be included which can impact on the surroundings beyond the safety distances, for example, using methods outlined in section 4.3.5.

Safety distances are comparable to the risk contour for acceptable location-based (individual) risk in a quantitative assessment. This is approx. 10^-6 per year for normal residential areas according to the review (section 4.3.1). A safety distance based on an accident scenario with a frequency of approximately 10^-6 per year provides just as much protection as the above risk contour. In practice, protection will be better, because any given accident will often only impact part (typically 1/10 or 1/100) of the area which could potentially be impacted. It is therefore appropriate to select a frequency for the reference scenario such as approx. 10^-5 per year (roughly equivalent to the lower limit of ‘5E’ in the French method, see section 3.5). The criteria for the reference scenario can therefore be defined, for example, as the accident scenario with the greatest consequence distance and a frequency greater than approx. 10^-5 per year (or an equivalent qualitative frequency class).

The lower limit for the frequency of the scenario that determines the maximum consequence distance will lie between 10^-9 and 10^-8 per year. The first value corresponds to the criteria in Environment Project 112 for scenarios with a consequence class of 5.2. The latter value corresponds to the limit used in the Netherlands’ purple book (Committee for the Prevention of Disasters, 1999).

4.3.4 Risk acceptance criteria for existing and new situations

Some countries use, or have used, more lenient criteria for existing situations than for new situations. Some might argue that this is an unacceptable situation in the long term, as all residents are entitled to equal treatment, and all establishments should be able to comply with the same requirements. The argument for more lenient treatment for existing situations is that it is more difficult and expensive to change existing situations. However, there should be a general principle of working towards the situation whereby even residents in proximity to existing establishments are not subject to a risk level greater than the level considered acceptable for others. Transition schemes with compliance deadlines may be used for this purpose. Establishments should be able to adapt to more stringent requirements in relation to their general environmental impact, and risk should be no exception.

4.3.5 Risk acceptance criteria for environmental damage

The Commission’s most recent guidelines (European Commission, 2006) confirm a lack of established acceptance criteria for assessing damage to the environment that can be compared with acceptance criteria for the risk of loss of life.

An approach to comparing accidents involving human injury and accidents involving environmental damage can be derived from Annex VI of the Seveso II Directive, on reporting major accidents to the Commission (European Council, 1997). The author of this study has previously suggested^[23] that this annex be used as the basis for comparisons between consequence descriptions for accidents involving human injury and accidents involving environmental damage (see Table 14). A starting point is the reporting criteria corresponding to consequence class four. Environmental damage descriptions for the other consequence classes are based on adjustments to the extent of damage that mirror the adjustments used for personal injury. The references to rivers and canals in Annex VI of the Directive are not particularly relevant to Denmark, and should probably be replaced with a comparable assessment of environmental damage in salt-water areas, such as fjords, sounds, and coastal regions.

The descriptions have been used in Table 14, and in the risk matrix example (Table 1), and include references to the consequence scales (Table 2) in Environment Project 112 and the French seriousness scales (Table 8). A comparison of this type reveals that even the verbal descriptions of accident magnitude vary substantially (Environment Project 112’s ‘serious accident K=4’ corresponds to ‘major accident’ in the French method and Table 1).

Table 14 can be used to construct a cumulative acceptance curve for accidents, which can be used for accidents involving personal injury and accidents involving environmental damage, as shown in Figure 9. Instead of a line, the acceptance criteria are now made up of points (columns) for each consequence class. For comparison, the grey ALARA area under the quantitative criteria from Environment Project 112 and the Netherlands acceptance criteria (light green) are also shown, representing a realistic acceptable level of safety. The French criteria are shown in the same way as in Table 9. The green columns on the bottom left show the frequencies for which minor accidents (classes 2 and 3) can be accepted without further conditions, and the red columns on the top right show the prohibited risks.

The qualitative risk acceptance criteria for accidents defined in Environment Project 112 (section 2.1.2) are also shown in this figure. However, note that in principle these criteria are used for individual scenarios (i.e. the curve is not cumulative). The figure shows that approx. 100 accident scenarios would have to exist before the Environment Project 112 criteria would exceed criteria based on the Netherlands limit for societal risk.

Table 14. Proposed consequence category descriptions for accidents involving both personal injury and environmental damage, based on a comparison of criteria for reporting major accidents under Annex VI of the Seveso II Directive (European Council, 1997) .

Figure 9. Risk acceptance criteria for accidents involving human injury and/or environmental damage using definitions in Table 14. The grey shading shows the ALARA region according to the quantitative criteria in Environment Project 112.

4.3.6 Risk acceptance criteria for personal injury

Quantitative risk acceptance criteria are based on the number of fatalities. It is implicitly assumed that the number of fatalities is proportional to the number of personal injuries. However, it would useful to be able to predict the number of injured persons, as this will place greater demands on emergency capacity than (acute) fatalities.

The correlation between fatality and personal injuries has been further analysed in (Rasmussen et al., 1999). Personal injuries are defined using at least three different parameters:

• Need for medical treatment
• Recovery time
• The extent of permanent injury

There is a lack of practical information to link these parameters to exposure to various substances or effects. Only a few references in the scientific literature describe the link between toxic exposure and, for example, hospital admissions.

The AEGL values^[24] have been developed since the above report was released, and these are currently seen as the best alternative to toxic end-point values for use in risk analysis (Taylor, 2007). AEGL values show three different levels (from irritation, to a life-threatening impact). These may make it possible to determine the distance up to which there is a risk of death, and the distance up to which there is a risk of injury.

AEGL values are used as the preferred data foundation when using qualitative methods to determine safety distances. The Commission Publication “Roadmaps” (European Commission, 2007) contains a comparison of IDLH¹⁴, ERPG¹⁸ and AEGL3 values. This comparison is shown in Table 15.

Table 15. Comparison of end-point values for impacts from toxic substances (European Commission, 2007)

The Commission Publication ‘Roadmaps’ also summarises guideline end-point values for heat radiation and overpressure due to explosion. These end-point values differentiate between several effect levels (see Table 16). This is as close as one can get to a dataset permitting assessment of various personal injuries. Please refer to Table 13 to see how these values relate to the criteria used in France, Germany and Italy.

Table 16. End-point values for different effects for heat radiation and overpressure (European Commission, 2007).

[19] These diagrams are often called ‘Bow-tie’ diagrams.

[20] Regeling externe veiligheid inrichtingen II (Revi II), December 2007

[21] John Murray, HSE, email dated 24 January 2008

[22] Probit functions describe the correlation between death and exposure for an exposed population. Probit functions for toxic substances are based primarily on animal testing.

[23] PHARE Twinning project HU/IB/2001/EN/03: Implementation of the Seveso Directive (96/82/EC) by the National Directorate General for Disaster Management and Regional Directorates in Hungary

[24] Acute Exposure Guideline Levels, see http://www.epa.gov/oppt/aegl

| Front page | | Contents | | Previous | | Next | | Top |

Version 1.0 Marts 2009, © Danish Environmental Protection Agency