ALARP demonstration

The ALARP demonstration needs to be recorded in the safety documents produced, but the question remains how can one ensure that the ALARP consideration is as complete as possible Whilst fairly well accepted in the UK,... 

ALARP demonstration is seen by many international viewers as difficult to verily and there is the perception that claims that all practicable risk reduction has been done, may be made without an appropriate effort [Bibb 2005]. Recent developments in The Medical Device Risk Management Standard (ISO 14971) indicate that the consideration of ALARP may be deleted from the new 2 edition due to the completeness question [Bibb 2005]. 

Some Safety Case reports contain an as low as reasonably practicable (ALARP) demonstration section that shows how the identified major hazards have been managed such that the associated level of risk is acceptable. The vexed topics of ALARP and acceptable risk are discussed in Chapter 1. 

ESC SILComp and Technis LOPAPLUS software both calculate the justified cost of further risk reduction (as part of an ALARP demonstration) automatically, based on data form the LOPA study. 

The regulatory environment is changing in Victoria with introduction from March 2000 of the Major Hazard Facilities Regulations, based on the Seveso II Directives. These are expected to flow on to the other states considered in this chapter. The key requirement of these regulations is the preparation of a Safety Case, which must demonstrate, among other requirements, that the risk from the new plant has been reduced to as low as is reasonably practicable - ALARP . The plants will incorporate a number of design features intended to reduce the risk from the facilities and demonstrate compliance with this criterion. 

This provided a rational basis for storage-tank sizing and inventory levels and was also used to demonstrate compliance with the ALARP principle. 

The majority of hazards will not be issues and will not typically benefit from routine weekly review by the project team. Hazards can, in the main, be seen as entities sitting in the background characterising the risk in the event than an incident was to occur. Their purpose is to focus and prioritise the development of controls during the CRM analysis and to demonstrate the practical measures that have been put in place to reduce the clinical risk to ALARP. In contrast, issues are problems which require active management - they need someone to take ownership and run with the task of fixing them. 

The safety case concept requires that operators demonstrate that the systems and processes they have adopted ensure that their facility is sufficiently safe for all those people who are possibly impacted by their activities (workers and contractors at their facility, passengers and customers, people who live and work in surrounding areas). Most safety case regulations require the demonstration to take the general form of showing that risk is as low as reasonably practicable, or ALARP (or that risk has been reduced so far as practicable - SFAP). Clearly, safety cases are an example of the broad trend towards risk-based regulation (Hood et al. 2004). 

The TR integrity requirement is stated in HSE (2006b), and requires a demonstration that the frequency with which accidental events will result in a loss of TR integrity, within the minimum stated endurance time, does not exceed the order of 1 in 1000 per year. No ALARP objective is stated, but this frequency is required to be reduced to a lower level wherever reasonably practicable. Where the frequency is close to the limit of 1 in 1000 per year, acceptance that further risk reduction measures are grossly disproportionate should be only on the basis of a very rigorous demonstration. 

It is not sufficient to demonstrate that risks are in the ALARP region they must also be made as low as reasonably practicable. 

There are various ways to demonstrate ALARP. It may be sufficient to show that the best available current standards and practices are being apphed. 

Broadly Acceptable Region (No need for detailed working to demonstrate ALARP)... 

However, it is most difficult to obtain easy to use advice and tools for being able to demonstrate completely that risks are as low as reasonably practicable (ALARP). It is accepted that each project s handling of ALARP has to be specific to the particular project risks involved, and so bespoke guidance is not the objective of this text. This paper seeks to introduce a simple tool, well utilised and accepted in another safety field, but developed from a specific use into having generic scope that will be of useful value to safety practitioners looking for dedicated ALARP advice. The tool is called the Accident Tetrahedron. 

Part Two The claim for completeness of assessment and risks being ALARP can be made providing it can be demonstrated through evidence that all four areas of the accident tetrahedron have been equally assessed to a degree appropriate to the credible accident scenarios developed. The greater the risk of the credible accident, the more evidence in all four areas is required. For additional probity of the claim, independent assessment may be taken. It must also be shown that further reduction in risk is not reasonably practicable. 

A discussion on a new approach and tool for ALARP justifications has been produced. The approach has been derived taking an accepted and specific method already in use for Are prevention, and enlarging its area of use to the more generic field of accidents to humans, equipment and other valuable assets. The tool represents an easy-to-use and systematic method for guiding the demonstration of ALARP. Some brief examples of use have been utilised, and a new strategy for claiming ALARP completeness has been developed. 

The scale of risk evaluation provides for the definition of an ALARP zone. For a risk to be ALARP, it must be possible to demonstrate that the risk is not able to be eliminated, but that it can be managed in some technical or procedural way. This is one of the requirements of ISO 14971 however, the ALARP management approach does not permit to stop the search by the manufacturer of solutions that can eliminate or reduce the risk to an acceptable zone. 

A Safety Case does not have to be quantified. Indeed, only half the European countries stipulate the use of Quantified Risk Analysis (QRA) in their Safety Case legislation (Rasche 2001). Nevertheless, it is difficult to demonstrate that risks have been reduced to the target ALARP threshold without some type of quantification. 

Following methods are adapted for the demonstration of ALARP. This is based on... 

To confirm the risk is ALARP, one needs to demonstrate that all credible risk reduction methods are impracticable. For this, prior brainstorming sessions with experienced persons is essential, so that all risk reduction methods could be identified and defined. 

Demonstrate the adequacy of control measure as well as reduce risk to ALARP. 

However, there is no prescribed methodology for such demonstration. The documents shall be detailed so that after evaluating control measures it should be possible to see that ALARP has been attained. Risk reductions can be achieved by elimination, reduction of likelihood of occurrence, or reduction in consequences. 

Result of risk analysis is necessary to demonstrate that risks have been reduced to ALARP/SFARP. 

Where the instaiiation of such an independenf aufomatic overfiii prevention system at an existing tank is demonstrated to give rise to other more serious safety or environmentai risks eisewhere then other aiternative measures may be adopted to achieve the same ALARP outcome. 

Dutyhoiders wiii need to prepare a robust demonstration that aiternative measures are capabie of achieving an equivaient ALARP oufcome fo an overfiii prevention system that is automatic and physicaiiy and eiectricaiiy separate from fhe tank gauging system. 

The demonstration that AMN have been taken to reduce risks ALARP for top-tier (X)MAH sites should form part of the safety report as required by regulations 7 and 8 of the (X)MAH Regulations... For high-hazard sites, Societal Risks/Concerns are normally much more relevant than Individual Risks, but Individual Risk must still be addressed . 

The UK Health and Safety at Work Act 1974 defined the concept of as low as reasonable practicable (ALARP). The ALARP principle is based on reasonable practicability, which simply means that hazard controls are implemented to reduce residual risk to a reasonable level of practicality. For a risk to be considered ALARP, it must be demonstrated that the cost in reducing the residual risk further would be grossly disproportionate to the benefit gained. Therefore, a risk assessment is conducted, and a cost-benefit analysis performed to determine how far to carry the hazard control. Of course, the challenge is deciding what is practical (e.g., cost, effort, time) balanced with how much benefit of lower residual risk the hazard control brings. Unfortunately, there is no standard method to demonstrate that the hazard control trade-off will meet ALARP. However, some of the following have been successfully used ... 

A documented safety case needs to be produced to present the claims, arguments, and evidence that the plant or facility is safe to undertake its scope of operation throughout its required life. A safety case is the totality of documented information and arguments that substantiates the safety of the plant, activity, operation, or modification in question. It provides a written demonstration that relevant standards have been met and that risks have been reduced ALARP. The safety case for the plant should be a living document, which is subject to review, change, and amendment as time proceeds. 

The dose and risk associated with the operation of the APIOOO are assessed to demonstrate that the design has reduced them to ALARP. 

This report is a key reference in the demonstration that risk associated with operation of the APIOOO is as low as reasonably practicable (ALARP), which is presented in Chapter 8 of this PCSR. 

---