journey to alarp u - asems to... · alarp – hse perspective • using “reasonably...

1

Journey to ALARP

2

Hazard Identification

• Hazards not identified are not analysed and therefore not reduced; – Consider the whole life-cycle;

manufacture, commissioning, trials, operation, maintenance, foreseeable modifications and disposal;

– All reasonably foreseeable hazards must be identified, not just those of intelligent layperson, but professional in that field – hence importance of SQEP team.

3

HSE Everyday Risk Decision-Making Process

Is a given risk so great or the outcome so unacceptable that it must be refused altogether?

4


Is the risk, or has it been made, so small that no further precaution is necessary?


5


Is the risk, or has it been made, so small that no further precaution is necessary?


Has a risk, which falls between these two states, been reduced to the lowest level practicable, bearing in mind the benefits flowing from its acceptance and taking into account the costs of further reduction?

6

Categories of Risk

Uses quantitative (cost or frequency) boundaries to separate the categories of

Unacceptable, Tolerable and Broadly Acceptable levels of risk.

The ‘normal’ MOD Risk to Life (RtL) four-category risk classification scheme:

7 7

As Low As Reasonably Practicable ALARP

• ALARP defined as A risk is ALARP when it has been demonstrated that the cost of any further

Risk Reduction, where the cost includes the loss of defence capability as well as financial or other resource costs, is grossly disproportionate

to the benefit obtained from that Risk Reduction.

• ALARP principle appears ‘relatively simple’ • However hides significant subtleties and difficulties in its

robust and satisfactory application

8

So Far As Is “Reasonably Practicable” SFAIRP

• “shall be the duty” is a strict liability which means that if the outcome occurs there will be no defence to a prosecution;

• “so far as is possible” what can be done - that is, what is possible in the circumstances for ensuring safety. The duty holder must then consider whether it is reasonable, in the circumstances to do all that is possible.

• “so far as is reasonably practicable” means it shall be done if the time, trouble and expense is not grossly disproportionate to the benefit gained

• SFAIRP appears 20 times in Health and Safety at Work Act 1974

9

ALARP – HSE Perspective

• Using “reasonably practicable” allows us to set goals for duty-holders, rather than being prescriptive. This flexibility is a great

advantage but it has its drawbacks, too. Deciding whether a risk is ALARP can be challenging because it requires duty-holders

and us to exercise judgement. In the great majority of cases, we can decide by referring to existing ‘good practice’ that has been

established by a process of discussion with stakeholders to achieve a consensus about what is ALARP. For high hazards, complex or novel situations, we build on good practice, using

more formal decision making techniques, including cost-benefit analysis, to inform our judgement.

Reference: HSE Web Site http://www.hse.gov.uk/risk/theory/alarpglance.htm

http://www.hse.gov.uk/risk/theory/alarpglance.htm

10

ALARP versus SFAIRP

• SFAIRP is – Enshrined in law; – What the courts will judge you against; – A judgement, based in the future, about actions in the past; – Subjective.

• ALARP is – Not part of any law; – A process used by HSE to help demonstrate SFAIRP; – A judgement about today which may not be valid tomorrow; – Subjective.

11

Getting to ALARP – A Process?

Risk to be shown to be ALARP when…..

Mandatory or prescribed requirements defined in legislation

are in place.

The Entire scope of the system, equipment, feature or design element

affected have been considered.

Alternative control measures have been considered with the safest option being applied wherever

reasonably practicable.

Relevant good practice has been identified, considered and

implemented.

Is Residual Risk Broadly Acceptable?

(Risk Class D)

Document into ALARP Statement

YES

NO

12

Getting to ALARP Application of “legislation”

• Within the United Kingdom (UK) we comply with all applicable HS&EP legislation.

• Overseas we apply our UK arrangements where reasonably practicable and, in addition, respond to host nations’ relevant HS&EP expectations.

• Where Defence has exemptions, derogations or disapplication's from HS&EP legislation, we maintain Departmental arrangements that produce outcomes that are, So Far As Is “Reasonably Practicable, at least as good as those required by UK legislation.

JSP 815 ANNEX A SAFETY, HEALTH, ENVIRONMENTAL PROTECTION AND SUSTAINABLE DEVELOPMENT IN THE MINISTRY OF DEFENCE - A Policy Statement by the Secretary of State for Defence signed 20/9/2010

PresenterPresentation Notes

Exemption A legislative instrument that specifically identifies that the Secretary of State (or other named authority) may authorise the exemption of some or all legislative requirements under a piece of legislation. The availability of an exemption must be written into the law concerned, which may make provisions as to the circumstances in which an exemption may be granted. An exemption will always require a formal authorisation by a named authority. Derogation A lessening or restriction of the authority, strength, or power of a law, right, or obligation which can have a caveat (e.g. must be solely for a specific purpose and not used for any dual purpose). Once a derogation is in place the use of the derogation does not require further legal authorisation by the relevant authority. However the SofS requires where a derogation exists that internal standards and management arrangements are in place that, so far as is reasonably practicable, produce outcomes at least good as those otherwise required by legislation Disapplication Legislation or a requirement within legislation, which explicitly states that it is not applicable to the MOD or defence activity and where the MOD does not have to officially do anything to use the exemption e.g. MARPOL but where internal processes may require action.

13

Getting to ALARP - Good Practice

• ‘Good practice’ refers to measures, actions, procedures or specifications considered appropriate by professionals based on either experience of their application or a consensus view.

• Good practice is likely to ensure that risk is reduced to ALARP. • Applying good practice removes the need to assess safety risks from

first principles, as well as providing quick and effective guidance as to how to proceed in a particular set of circumstances.

• Good practice can include: – HSE – British and EN standards; – Defence or NATO Standards; – SOLAS; – ACOPs; – OEM Company Standards.

PresenterPresentation NotesACOP - Acceptable Code of PracticeSOLAS – Safety Of Life At Sea.

http://www.imo.org/home.asp?topic_id=424

14

Getting to ALARP - Good Practice - Problems

• Applicability – examples:- – Defence Standards – infrequent updates; – IEC/EN standards – which, if any, apply.

• Who judges applicable “good practice” ?

– MOD Regulators - Defence Safety Authority (DSA) – SME – Manufacturer / Supplier

• New Technology (or novel application of existing technology)

– New hazards but no standards exist, therefore “good practice” not established.

PresenterPresentation NotesDefence Safety and Environment Authority (DSEA), the Military Aviation Authority (MAA) and Defence Fire Safety Regulator (DFSR)Defence Maritime Regulator (DMR), DOSR Defence Ordinance Munitions and Explosives Safety Regulator

International Electrotechnical Commission

15

Getting to ALARP - Good Practice Evolves

Best Practice Good Practice

Good Practice Not

Good Enough Practice!

TOMORROW TODAY Knowledge, Experience, accidents

16

Getting to ALARP - Do I need to do more?

PresenterPresentation NotesRIDDOR Reporting of Injuries Diseases and Dangerous Occurrences Regulations 1995 Definitions of injuries

17



18



19


Examples

• Remove people from hazard

• PPE


20


Examples

• Redundancy

• Defence in Depth

• Reliability

Examples

• Remove people from hazard

• PPE


21

Getting to ALARP - Can I do more?

• Reasonably foreseeable “Control Measures” need to be considered – This needs SQEP to deduce control measures.

• Determine for each control measure whether it is reasonably practicable to apply. – This needs SQEP to deduce whether

• “practicable” (e.g. technology or process exists and it could be applied)

• “reasonably” (e.g. benefit is worth the trouble, cost benefit analysis, professional judgement or experience)

22

Hierarchy of hazard control.

ERICPD Eliminate – the safest control measure is to eliminate the hazard completely.

Reduce or Substitute – Do it less often, reduce the number of people who do it, use something else.

Isolate – physically separate the hazards from people.

Control – A safe system of work, procedures, training, supervision, safety devices and tools.

Personal Protective Equipment – Gloves, eye protection, respirators etc.

Discipline – Ensure that all controls are monitored, enforced and reviewed.

Consider if these introduce new hazards

Accidents - Example

Electricity

Hazard

Electric Shock

Accident

Degree of Harm

Tingling, Burns, broken bones, Death

Technical Publications

Safe System of Work (Risk Assessed)

Work Permits

Warnings and Cautions

Process Control

Equipment Design Standards

System Design Standards

Material Design Standards

Jigs and Tools

Design

First Aid Training

Medical Officer/Doctor

Medical Equipment

Hospital

Incident response training

MEDEVAC

Contingency

Access control

Electrical Isolation

Physical Isolation

Physical Control

Trained Operators / Maintainers

Qualified Operators / Maintainers

Experienced Operators / Maintainers

SQEP Protection

PPE

Earthing Arrangements

Insulating Arrangements

First Aid Response

Emergency Procedures

Rescue/Evacuation

Emergency

‘Global’ Versus ‘Local’ Control Measures

• When thinking about systems or platforms it may be appropriate to apply a simple policy of consistent control measures to combat a common risk; some examples include Fire fighting methods, electrocution prevention, lighting, etc.

• Cost Benefit Analysis may show further control measures when applied globally across a platform/fleet would be grossly disproportionate. However, consideration of applying further control measures in specific, individual areas may not be grossly disproportionate.

• Global policies can be useful but may mask local hazard issues and therefore undermine ALARP.

• Zonal risk assessment should be considered and used to check that all reasonably practicable control measures are in place.

PresenterPresentation NotesEquipping a fire suppression sprinkler system in every compartment in a ship may be grossly disproportionateEquipping storage areas containing expensive equipment or explosive/inflammable goods may not.

Consider if these introduce new hazards

25

Getting to ALARP - Guilty till proven innocent!

*Health and Safety at Work etc Act 1974

The onus of proving the limits of what is practicable

In any proceedings for an offence under any of the relevant statutory provisions consisting of a failure to comply with a duty or requirement to do something so far as is practicable or so far as is reasonably practicable, or to use the best means to do something, it shall be for the accused to prove (as the case may be) that it was not practicable or not reasonably practicable to do more than was in fact done to satisfy the duty or requirement, or that there was no better

http://cui6-uk.diif.r.mil.uk/r/929/SEP/0412/Local Settings/group/EUNDESShipsFWE/NATeam/04-RECDel/153-CME/Archived-CME/L_Presentation/ALARP/riding the shaft.wmv

26

Getting to ALARP - Many ways to go to jail…..

• Not taking action to protect people (workers or public) from avoidable danger is a criminal offence.

• An accident does not need to happen for action to be taken against an employer (directors or managers, in our case Duty Holders or HoE).

• If action is taken it is up to the defendant to prove everything reasonably practicable was done to comply with the relevant H&S legislation.

27

ALARP Statement – the case for the defence

• The ALARP statement outlines the basis of your defence of how you:- – Assessed the risk appropriately; – Complied with all relevant legislation; – Implemented relevant “good practice”; – Considered other reasonably foreseeable control

measures and implemented any which were reasonable practicable and showed that the rest were grossly disproportionate;

– Showed that the risk and associated risk reduction control measures were regularly reviewed.

• In hindsight, it should show how you proved that it was not practicable or not reasonably practicable to do more than was in fact done to satisfy the duty or requirement, or that there was no better.

28

ALARP Statement - Pitfalls

• Are ALARP assessments suitably sufficient to demonstrate that we have managed the risk So Far As Is Reasonably Practicable? – Asserted ALARP; – Tweeted ALARP; – Unjustified Assumptions; – Difficult to judge if legislative compliance achieved; – Are we applying “good practice”? – Lack of demonstration of gross disproportion (i.e. sacrifice versus

benefit); – Open ended actions; (no such thing as Temporal ALARP) – No evidence of regular review of control measures; – Lack of diversity in the argument made;

29

ALARP Statement - Example of Class B Risk

Twitter approach, fit statement into

Excel box

Tasks involving access to equipment at height are rare: Work at height subject to case-by-case risk assessment . This risk category has been classified as Tolerable with the managemnets endorsement (Class B risk) and is currently considered as ALARP. The risk only applies when personnel are working on top of the platform. Actions have been raised to obtain further detail on the exact hazard and existing safety measures and local risk assessments. No further mitigation is considered practicable.

30



Excel box Important actions still outstanding Tasks involving access to equipment at height are rare: Work at

height subject to case-by-case risk assessment . This risk category has been classified as Tolerable with the managemnets endorsement (Class B risk) and is currently considered as ALARP. The risk only applies when personnel are working on top of the platform. Actions have been raised to obtain further detail on the exact hazard and existing safety measures and local risk assessments. No further mitigation is considered practicable.

31



Excel box Important actions still outstanding

No demonstration that other control measures

were grossly disproportionate


32






No check of meeting legislative requirements


33






No check of meeting legislative requirements

No discussion of appropriate “good practice”


34

How to Show ALARP

35

ALARP Statements - Proportionate to Risk

Its important to tell a story of “what we didn’t do” and why not, as much as it is to state “what we

decided to do”.

36

Getting to ALARP - High Consequence

• If the hazard consequences are high then the analysis needs to be thorough: – Should we be doing the

risky activity? – Can the consequences be

reduced? – Am I certain of the analysis

which claims that the frequency is low.

• Can all this withstand detailed scrutiny.

Cost Benefit Analysis (1) Consequences

• A hazard exists that an amphibious platform’s davit could have a structural failure whilst lifting a landing craft could result in the consequence of 2 deaths.

• From D Ships RCM this means the consequence is “Critical”.

Cost Benefit Analysis (2) Frequency

• The annual frequency of occurrence of this accident is qualitative assessed as being no better than 1 in 10000 years but no worse than 1 in 1000 years (Probability of 0.001).

• From D Ships RCM this is “Remote”

Cost Benefit Analysis (3) Risk Assessment

• Therefore the risk class is “B”

40

Cost Benefit Analysis (4) Value to Prevent Fatality or Injury

• Values of VPI have been scaled from DfT published figures for 2007 in TAG unit 3.4: The Safety Objective, Table 4a: Average value of prevention per road accident by severity and class of road: all hours. The scaling factor used is D Ships VPF/DfT VPF = £2,000,000 / £1,876,830 = 1.065627, Serious injury is set at £215,170 (assumed equivalent to permanent RIDDOR), slight injury is set at £22,230 (assumed equivalent to Recoverable RIDDOR) and damage only is set at £ 1,970 (assumed equivalent to Non-RIDDOR injury).

• The value to prevent 2 fatalities is determined to be – 2 x £2,000,000 = £4,000,000

Level of Harm VPF /VPI

Individual Death from Industrial Disease e.g. Cancer (2 x VPF) £4,000,000

Individual Death Resulting from Accident (VPF) £2,000,000

Individual Permanent RIDDOR Injury (VPI) £229,291

Individual Recoverable RIDDOR Injury (VPI) £23,689

Individual Non-RIDDOR Injury (VPI) £2,099

Cost Benefit Analysis (5) Safety Benefit

• The host platform is assumed to have 20 more years of service left before disposal.

• The benefits of preventing this accident occurring can be assessed as follows:- – Annual cost

• ‘Frequency’ x ‘value of preventing a fatality’ • 0.001 x £4,000,000 = £4,000 per year of platform life

– Or Lifetime cost • ‘Frequency’ x ‘value of preventing a fatality’ x lifetime • 0.001 x £4,000,000 x 20 years = £80,000

Cost Benefit Analysis (6) Gross Disproportion

42

A • Risk Class A = 10 x Cost

B • Risk Class B = 6 x Cost

C • Risk Class Cu = 4 x Cost

C • Risk Class Cl = 2 x Cost

D • Risk Class D = Cost

10 6 4 2 1

From MAA/HSE consultation

From MAA/HSE consultation

Tapered cost between A & D Risks

Cost Benefit Analysis (7) Reasonable Practicable Test

• To rule out a control measure on the grounds that it is grossly disproportionate requires

Costs >= Disproportion Factor (DF) Safety Benefits

• which can also be written as

Costs => Disproportion Factor (DF) x Safety Benefits

• For our class B risk the Gross Disproportion Factor to be used in any CBA is x6

• Costs >= DF >= £4000 x 6 = £24,0000 per annum • Benefits

• OR >= DF >= £80,000 x 6 = £480,000 one off cost

• Therefore, any control measure that costs less than £24,000 per annum or less than

£480,000 as a one off cost would be deemed to be “reasonably practicable”.

44

Getting to ALARP - Professional Judgement

• When Sacrifice or Benefit cannot be reasonably quantified, then a quantitative comparisons becomes impractical.

• How do you show that a risk is As Low As Reasonably Practicable? – Often such “first principles” comparisons can be done qualitatively,

i.e. by applying common sense and/or exercising professional judgment, or experience.[1]

[1] - http://www.hse.gov.uk/risk/theory/alarpglance.htm - sighted 5th May 2010

Professional Judgement!

http://www.hse.gov.uk/risk/theory/alarpglance.htmhttp://cui6-uk.diif.r.mil.uk/r/929/SEP/0412/Local Settings/group/EUNDESShipsFWE/NATeam/04-RECDel/153-CME/Archived-CME/L_Presentation/ALARP/BrickiesLabourerinBangladesh.wmv

45

Getting to ALARP - “Ah, ha, ha, ha, Stayin’ ALARP.”

• ALARP is judgement about a risk today. • Tomorrow the risk may not be ALARP • Eventually, over a longer period of time,

the risk will not be ALARP (evolving best practice, new standards, laws, technology, material state degrades, etc.)

• Regular review of risks is required to remain or return to ALARP – Risk assessment – Legislation changes – Good practice – Control measure effectiveness – Failure data and accidents/incidents

ALARP

http://en.wikipedia.org/wiki/File:Bee_Gees_Stayin_Alive.jpg

46

Operation

Maintenance

Documentation

System Design

Accident

Hazard

Hazard

‘Swiss cheese’ end to end safety model

• Consult & communicate • Treat the holes, watch creep • Look for trends & address • Increase barrier thickness • Share problems

47

Getting to ALARP - “Ah, ha, ha, ha, Stayin’ ALARP.” Good Practice Evolves

Best Practice Good Practice

Good Practice Not

Good Practice Enough???

TOMORROW TODAY Knowledge, Experience, accidents

48

Warning - Risk Compensation!

Propensity to take risks

Rewards

Perceived Danger Accidents

Balancing Behaviour

49

But be warned - Idiots are getting smarter

JCB Gazebo

50

Safety Ambition

Continually panicking

about safety

Perpetually uneasy about safety

Everything is

alright

51

Safety Ambition

Continually panicking

about safety

Perpetually uneasy about safety

Everything is

alright

Slide Number 1Hazard IdentificationHSE Everyday Risk Decision-Making ProcessHSE Everyday Risk Decision-Making ProcessHSE Everyday Risk Decision-Making ProcessSlide Number 6As Low As Reasonably Practicable�ALARPSo Far As Is “Reasonably Practicable”�SFAIRPALARP – HSE PerspectiveALARP versus SFAIRPGetting to ALARP �– A Process?Getting to ALARP�Application of “legislation”Getting to ALARP - Good PracticeGetting to ALARP - Good Practice - ProblemsGetting to ALARP - Good Practice�EvolvesGetting to ALARP - Do I need to do more?Getting to ALARP - Do I need to do more?Getting to ALARP - Do I need to do more?Getting to ALARP - Do I need to do more?Getting to ALARP - Do I need to do more?Getting to ALARP - Can I do more?Slide Number 22Accidents - Example‘Global’ Versus ‘Local’ Control MeasuresGetting to ALARP - Guilty till proven innocent!Getting to ALARP - Many ways to go to jail…..ALARP Statement – the case for the defenceALARP Statement - PitfallsALARP Statement - Example of Class B RiskALARP Statement - Example of Class B RiskALARP Statement - Example of Class B RiskALARP Statement - Example of Class B RiskALARP Statement - Example of Class B RiskHow to Show ALARPALARP Statements - Proportionate to RiskGetting to ALARP - High ConsequenceCost Benefit Analysis (1)�ConsequencesCost Benefit Analysis (2)�FrequencyCost Benefit Analysis (3)�Risk AssessmentCost Benefit Analysis (4)�Value to Prevent Fatality or InjuryCost Benefit Analysis (5)�Safety BenefitCost Benefit Analysis (6)�Gross DisproportionCost Benefit Analysis (7)�Reasonable Practicable TestGetting to ALARP - Professional JudgementGetting to ALARP - “Ah, ha, ha, ha, Stayin’ ALARP.”Slide Number 46Getting to ALARP - “Ah, ha, ha, ha, Stayin’ ALARP.” Good Practice EvolvesWarning - Risk Compensation!Slide Number 49Safety AmbitionSafety AmbitionSlide Number 52

journey to alarp u - asems to... · alarp – hse perspective • using “reasonably...

Documents