30th January 2010

Written by: Caroline Stoker
Published in: TCE, SHP, Tank Storage Magazine

COMAH Regulations: Why waiting five years could risk safety

Every company that owns and operates a top tier COMAH installation will be aware that, under Regulation 8 of COMAH, they are required to review their safety reports at least every five years. The key word being review – a full re-submission of the safety report is neither obligatory or, in many cases, necessary. However what many companies fail to appreciate is that Regulation 8 is much broader than the ‘five year’ review and places a requirement on operators to undertake a formal review of their safety report;

• In response to new facts or to take account of new technical knowledge about safety matters (Regulation 8(1)(b));
• Whenever the operator makes a change to the safety management system which could have significant repercussions with respect to the prevention of major accidents or the limitation of consequences of major accidents to persons and the environment (Regulation 8(1)(c));
• In advance of any proposed modification to the establishment or an installation, the process carried out, or the nature or quantity of dangerous substances present and where that modification could have significant repercussions as above (Regulations 8(4)(a))

As a consequence, the majority of companies wait until the five year deadline approaches before dusting off their safety report and starting the review process – and this could be putting themselves and others at risk.

The fact is that whenever changes are made to plant, equipment, systems or personnel, there is always the potential for associated risk. Taken individually each change might seem routine or of little consequence, indeed these minor changes do not always get captured routinely by the operators’ Management of Change systems.

The problem most companies face is that they understand and have management systems in place to capture the major changes such as large capital projects, new raw materials, new product introductions or changes to inventory levels and hence update their COMAH safety reports. What is more difficult to grasp is how seemingly insignificant changes to plant, people, software etc., which are not usually captured by the Management of Change system, can have similar consequences.

For example a large terminal may have submitted its COMAH safety report two years ago to the Competent Authority. Since then very little has changed in terms of new equipment. However, following a failure, the company replaces an actuated valve in a tank feed pipeline with a similar one, albeit a slightly different specification to the original. The new one is fail-open on loss of compressed air whereas the original unit failed closed. At the same time an experienced member of staff has retired and a new maintenance team has been contracted.

At face value these seem quite ordinary changes and independent of each other. But looked at in another way the story is completely different. Since the new valve which has been fitted is not exactly the same as the one it has replaced, it might compromise the original design intent.

The replacement for the retired employee may not be privy to the original design and the fact that the valve in question forms part of a Safety Instrumented System protecting against overfill.

Similarly the new maintenance team may propagate this error by subsequently replacing other inlet valves to the new specification. The consequence being that over time systems which the company previously relied upon and claimed credit for in their original COMAH safety report no longer offer the same level of risk reduction. The ultimate consequence of which could be escalation of a minor event into a major accident.

It is clear minor changes could (if overlooked or not effectively captured and controlled) lead to an undesired outcome, but the question remains: How do operators successfully identify those changes, or series of changes, that may have ‘significant repercussions’?

The COMAH Competent Authority has given a degree of guidance such that ‘A change will have significant repercussions with respect to the prevention or control of major accidents if it changes the nature of the major accident risks, so requiring changes in the measures taken to ensure that those risks remain as low as reasonably practicable (ALARP)’

Whether a change has significant repercussions is largely dependent on the degree to which it:

• Introduces a new major accident hazard;
• Changes the risk from an existing hazard; or
• Affects control or mitigation measures (including offsite emergency plans)

Examples of which could be:

• Changes to the Safety Management system, such as changes to the PTW system;
• The replacement of staff with third party contractors;
• De-manning and / the combining or roles;
• Changes in procedures; or
• Plant modifications.

Regulation 8 states that in terms of changes to Safety Management systems a review should take place as soon as possible following the changes. For modifications these can take many forms, for example substance changes in terms of type, classification or inventory; the removal or introduction of safety-critical plant; changes to storage facilities or occupied buildings; control system changes; new suppliers – and so on. It is important to note that the Regulation actually states that, in the case of plant modifications, the review must be carried out in advance of the changes being put into place.

Other factors which could have significant repercussions and therefore need to be incorporated into an updated safety report concern new facts or knowledge which have come to light since the submission of the last report. Examples of these include key learningsfrom worldwide events such as Buncefield and Texas City, or the reclassification of substances e.g. a substance on site which was not previously deemed dangerous but has since been reclassified as dangerous (and vice versa).

So if no major changes have taken place, does the safety report still need to be reviewed?The answer to this is yes, because it is still necessary to ensure that all risks remain as low as reasonably practicable (ALARP), although it is likely that following consultation with the Competent Authority the safety report may not need to be resubmitted or maybe only in part.

Although this may seem like a lot of effort, the fewer changes that are made to the safety report and the less it is resubmitted, the quicker and cheaper the review. If risks have been reduced since the original report, this also needs to be documented.In order to ensure the safety report is up to date, terminals should conduct annual or bi-yearly reviews, rather than waiting five years. Companies should also ensure they have well-developed change management procedures, which are robustly adhered to. Finally they must not see COMAH as a box ticking exercise but as an experience which leads to valuable knowledge and experience that can help drive the business forward.

While undertaking a biyearly review recently for a large multi-national company, the operations manager summed up this point: ‘This is much less painful than doing it once every five years.’