New CDOIF guidance on major hazard human harm risk assessment (MHHHRA) lands on upper and lower tier sites alike and sites could read this as more work. Two of the things it asks for are not. They are the simplest route to a demonstration they already owe.

What is MHHHRA and how does it affect COMAH sites?

Understanding Major Hazard Human Harm Risk Assessment (MHHHRA) for COMAH is new guidance developed through the Chemical and Downstream Oil Industries Forum (CDOIF). The guidance sets out a structured way to assess the risk a major accident poses to people, and to show that risk has been reduced to as low as is reasonably practicable (ALARP). It does for human harm broadly what the existing CDOIF guidance already does for environmental risk assessment.

The guidance has not yet been issued but has been finalised following stakeholder review and update. Although still in draft form, the messages within the guidance are worthwhile understanding since it contains the principles required to conduct a suitable and sufficient risk assessment for an establishment regulated under the Control of Major Accident Hazards Regulations (COMAH).  

Does MHHHRA apply to lower-tier as well as upper-tier COMAH sites?

And it is not just an upper tier problem. That assumption is worth killing early, because it is the one that catches some operating companies out. The duty to carry out a suitable and sufficient risk assessment of the risk to people comes from the Management of Health and Safety at Work Regulations. The requirement to demonstrate the risks are ALARP ultimately tracks back to the Health and Safety at Work etc Act and the requirement to protect people so far as is reasonably practicable (SFAIRP). In practical terms, the requirement to identify and control major accident risks to people is relevant to both lower-tier and upper-tier COMAH establishments although the formal requirements and level of regulatory demonstration differ between the two tiers.

Why past accident review and relevant good practice are central to MHHHRA

Most sites are reading MHHHRA as more work, and in places it is. But two of the things it asks for, a proper past accident review (PAR), and a genuine comparison against relevant good practice (RGP), look like extra studies bolted onto an already long list. They, however, do two jobs at once that you are already legally obliged to do. Contribute to the identification of Major Accident Hazard Scenarios (MAHS) and the demonstration that risks are ALARP. 

Why HAZOP alone cannot identify every major accident hazard scenario

Traditionally, MAHS identification was pinned to an underlying hazard study such as a HAZID or HAZOP. The new MHHHRA guidance challenges this approach and proposes that the identification process requires consideration of RGP and PAR in addition to traditional hazard studies. In my view, this is largely since no hazard study is perfect and given the huge potential consequences posed by MAHS, additional and complementary methods of identifying MAHS have a huge upside. So why are no hazard studies perfect? 

HAZOP limitation 1: people and organisational blind spots

Time pressure, fatigue, a dominant voice, groupthink. And the structural one: the team is drawn from the site, so it shares the site’s blind spots. The things everybody has stopped noticing are, by definition, the things nobody raises.

HAZOP limitation 2: incomplete or outdated process safety information

The whole assessment is pinned on the process safety information, and P&IDs are frequently out of date, incorrect, or degraded by years of unmanaged change. A study conducted on wrong drawings finds the wrong hazards, diligently, and files them.

HAZOP limitation 3: interactions between nodes and escalation scenariosde

A HAZOP proceeds deviation by deviation, node by node. It is structurally weak at interactions between nodes, at escalation, at external initiators, and at event combinations for which nobody has a guideword.

HAZOP limitation 4: slow-developing and cumulative hazardsshot

It asks: what if this parameter deviates? A state, at a moment. It is poor at slow accumulation, a phenomenon that builds over hours or over batches until it quietly defeats something. 

All four limits are irreducible. You cannot HAZOP your way out of them, because they are not caused by insufficient HAZOP. They are properties of the technique.

Can HAZOP identify every major accident hazard?

No hazard identification technique can guarantee that every credible major accident scenario will be identified.

HAZOP is extremely valuable for systematically examining process deviations but its effectiveness still depends on the information available, the experience and behaviour of the study team and the boundaries imposed by the study method.

Scenarios involving unusual human behaviour, interactions between separate systems, historical failure mechanisms, external events or slow accumulation may therefore require complementary hazard identification methods.

For major accident hazards, this matters because even a relatively small gap in scenario identification can have very high consequences.

And for some hazards, that matters less. A small gap in a small risk is a small problem. But a small gap in a major accident hazard is not, because the thing on the other side of it could kill a dozen people, potentially including off-site populations. The imperfection is the same size. The consequence of leaving it there is not.

How past accident reviews and good practice add external evidence to COMAH risk assessment

Look at the inputs to a COMAH risk assessment. HAZID, HAZOP, LOPA, consequence modelling, frequency analysis. Every one of them is your own people, in your own room, reasoning about your own plant.

Past accident review and relevant good practice are the only two inputs that carry knowledge from outside your organisation into your assessment. Everything else is introspection.

And they are not two things. They are the same thing at different stages of maturity.

What is the relationship between past accidents and relevant good practice?

A review against RGP is in essence a form of PAR. Every design feature in every code exists because something went wrong somewhere. Bunding, relief sizing, separation distances, ignition control, overfill protection. Codes, however, lag incidents potentially by several years. RGP reviews tell you what the industry has already learned and written down whilst PARs tell you what it has learned and has not written down yet, or what it learned in a sector adjacent to yours, in a configuration nobody has yet codified.

Past accident review example: road tanker driveaway during HAZOPoad tanker

A real HAZOP example. Road tanker driveaway. The team worked through the causes and largely concluded it was not credible.

Then a delegate raised a past accident that he was aware of. The driver had not forgotten to disconnect. He had checked the hose was connected and driven away deliberately. He wanted to be sacked, because leaving voluntarily meant repaying his training costs.

No guideword produces that. More flow, no flow, reverse flow, the deviation framework reasons about process states, not human intent. A person carrying inherited knowledge generated it and happened to be sitting in a HAZOP at the time. It depended on the right person being in the room, on that day, remembering that story, and choosing to speak, against a team that had already concluded the cause was not credible. Change any one of those and the cause never surfaces. For all intents and purposes, this was the application of past accident learnings, albeit in a HAZOP setting.  

How past accidents identify additional risk-reduction measures

And it hands you a measure: self-sealing breakaway couplings on high-hazard fluids. Would this example of a past accident change the view of the team regarding whether this is reasonably practicable to implement? 

Past accident review example: a major accident scenario missed by HAZOP

A processing operation where feed rate, composition and agitation all matter. The HAZID and HAZOP studies had properly considered deviations in each, more flow, less flow, loss of agitation, off-spec feed. Competently done however what none of them reached was this. Unconverted material accumulating and floating, forming a layer on the surface. That layer does two things at once. 

• It falsifies the level measurement; the instrument is no longer seeing what it believes it is seeing.
• It impairs the pressure relief path.

Level protection and pressure protection are two different systems. Different sensors, different final elements, different failure modes. They appear in every assessment, and in every LOPA, as independent layers. One slow physical phenomenon was therefore capable of defeating two safeguards that had previously been treated as independent protection layers.

It was also knowable. It had happened before, more than once, to other people running similar operations and a systematic past accident review found it. It produced a new major accident scenario, and a design change.

The failure was not that it was unforeseeable. The failure was that it was not foreseeable from inside the room.

What does a relevant good practice review contribute to a COMAH assessment?iew gives you

A relevant good practice review is not a check that you hold the right standards, nor a note that the plant was built to code when it was installed. 

How to perform a relevant good practice gap analysis

It is walking your plant against what a competent operator would be expected to do, and asking of each feature the standard requires: do we have this, does it still work, and if not, why not? A standard is a solution to a problem somebody had. 

Using HSG176 and HSG51 in a COMAH good practice review

It is also, for many sites, considerably less work than they fear. Take a lower tier site with some bulk storage tanks and a drum and IBC store. A documented gap analysis against HSG176 (the storage of flammable liquids in tanks) and HSG51 (in containers up to 1,000 litres) will deliver a large part of the MHHHRA work in a single exercise, because these documents can provide much of the recognised good-practice framework needed for the assessment

They already contain the hazards, because that is why they exist. They contain the scenarios, because that is what they protect against. They contain the measures, because that is what they require. And they contain the benchmark, because that is what a competent operator does.

That is not a shortcut. For a site like that it is the correct approach, because the depth of assessment should be proportionate to the scenario, and a drum store is not a novel system.

Which leads somewhere counter-intuitive. The absence of relevant good practice for a unit operation is itself a factor that increases the depth of assessment expected. So, the presence of good practice is what makes an assessment easier, and its absence is what makes it more difficult.

What is relevant good practice in an ALARP assessment?

Relevant good practice is established guidance, standards and industry practice that provides recognised methods for controlling a particular hazard.

Sources may include HSE guidance, recognised industry codes and national or international standards.

For new installations, recognised good practice generally provides a minimum benchmark. For existing installations, operators should consider whether current good practice should be implemented and whether any deviation can be justified on the basis of reasonable practicability.

Where applying relevant good practice does not reduce risk sufficiently, additional risk-reduction measures may also need to be considered.

How past accident review and good practice strengthen the ALARP demonstration

MHHHRA is guidance. The duty to protect people so far as is reasonably practicable (SFAIRP) is the law, set out in the Health and Safety at Work etc. Act. ALARP is how you demonstrate you have met that duty and is essentially the HSE’s operational interpretation of that legal requirement. 

What does an ALARP demonstration actually require?

ALARP is not a number and a risk figure below a tolerability criterion. Showing a green outcome on a risk matrix is not an ALARP demonstration. ALARP is a logical demonstration that where a reasonable further measure exists, you have taken it, or can explain, honestly, why it is not reasonable. It is answering the question: what more could be done and why have we not done it?

That is exactly the question a PAR and RGP review can assist you in answering.

What does ALARP mean in a COMAH risk assessment?

ALARP means reducing risk to a level that is as low as reasonably practicable.

An ALARP demonstration is not simply evidence that a calculated risk sits below a particular number or appears within an acceptable region of a risk matrix.

It should demonstrate that reasonably practicable measures for preventing or mitigating the major accident scenario have been identified and considered.

In practical terms, the assessment needs to answer two questions:

• What more could be done to reduce the risk?
• Why has any identified additional measure not been implemented?

Past accident reviews can help identify candidate measures while comparison against relevant good practice helps establish the recognised benchmark against which existing controls can be judged.

How past accident reviews identify reasonably practicable measures

A past accident review hands you candidate measures since every incident tells you what was missing. Each is a measure already demonstrated necessary, at somebody else’s expense. Your job narrows to the specific question of whether you also have this gap and, if so, whether it is reasonably practicable to close that gap.  That is an ALARP argument, pre-loaded, and it is enormously easier than generating candidates from a blank sheet. The breakaway coupling is not a theoretical safeguard. Somebody’s incident put it on the table.

How relevant good practice establishes the ALARP benchmark

A good practice review hands you the benchmark. Comparing your plant against what a competent operator does tells you where you are covered and where you are not. Every gap is either a measure you should take or, for legacy plants, a justification you must be able to make for its exclusion. Please note that for new designs and installations, compliance with RGP is an expectation of the regulatory authorities and you should not “risk assess” away any deviations from RGP. 

These two studies bookend the entire process. They surface the scenarios at the front, and they supply the ALARP case at the back. Nothing else in the toolkit does both. That is why they are not additional work. They are the work you already owe, done in a way that produces evidence.

Do lower-tier COMAH sites need an ALARP demonstration?

And this is not a scale question. Lower-tier establishments remain subject to COMAH’s general duty to take all measures necessary to prevent major accidents and limit their consequences. For human risk, HSE interprets this through the principle of reducing risk ALARP.

They just have slightly less scrutiny from the regulatory authorities due to the absence of a safety report submission. Such issues tend to reveal themselves during COMAH intervention visits and, logically, the publication of the new CDOIF MHHHRA guidance would indicate that the regulatory authorities are likely to perform focussed visits on this issue. 

Key lessons for MHHHRA and COMAH risk assessment

• No hazard study is perfect. The people, the information, the node boundary and the snapshot are limits of the technique, not symptoms of doing too few studies.
• For a major accident hazard, that imperfection matters, because of what sits on the other side of the gap.
• A past accident review and a good practice review are the only two inputs that bring knowledge in from outside your own organisation. Everything else is introspection.
• Neither is extra work. They feed MAHS identification at the front of the process and your ALARP demonstration at the back.
• Both tiers owe this. A lower tier site simply faces less scrutiny, which is not the same as owing less.
• A robust COMAH risk assessment should be able to explain not only how each major accident scenario was assessed but how the scenario was identified in the first place.

What should COMAH operators do first?

Ask one question: where did our list of major accident scenarios actually come from? Trace it back. If it lands on a single type of study, you have just found your gap.

Then take one unit operation and gap analyse it against the relevant good practice. You will learn more in a day than another HAZOP will tell you.

If the answer relies almost entirely on a single HAZID or HAZOP, operators should consider whether past accident experience and relevant good practice could identify additional scenarios, controls or evidence needed to strengthen the MHHHRA and ALARP demonstration.

---

Frequently Asked Questions about MHHHRA and COMAH Risk Assessment

What is MHHHRA?

MHHHRA stands for Major Hazard Human Harm Risk Assessment. The emerging CDOIF guidance provides a structured approach to assessing the risks that major accident hazards pose to people and demonstrating that appropriate risk-reduction measures have been considered.

What is a COMAH risk assessment?

A COMAH risk assessment evaluates major accident hazards associated with dangerous substances and the measures used to prevent accidents or reduce their consequences. The depth of assessment should reflect the nature and significance of the risks involved.

Does MHHHRA apply to lower-tier COMAH sites?

The general COMAH duty to take all measures necessary to prevent major accidents and limit their consequences applies to all COMAH establishments. Upper-tier sites are subject to additional formal requirements including preparation of a safety report.

What does ALARP mean?

ALARP means as low as reasonably practicable. It describes the principle of reducing risk until any further reduction would require a sacrifice in money, time or effort that is grossly disproportionate to the additional risk reduction achieved.

Is a low risk score enough to demonstrate ALARP?

No. An ALARP demonstration should consider what additional measures could further reduce the risk and why any identified measures have not been implemented. A numerical risk estimate or position on a risk matrix does not by itself demonstrate that all reasonably practicable measures have been considered.

What is a past accident review?

A past accident review examines previous accidents, incidents and relevant industry experience to identify failure mechanisms, major accident scenarios and potential safeguards that may be relevant to the establishment being assessed.

Why is past accident review important in COMAH risk assessment?

Past accidents can reveal scenarios that may not emerge through conventional hazard studies. They also provide evidence of failure mechanisms that have occurred in real installations and can identify additional measures that should be considered.

What is relevant good practice?

Relevant good practice consists of recognised methods and standards for controlling particular hazards. It may be found in HSE guidance, industry codes and national or international standards.

How does relevant good practice support an ALARP demonstration?

Relevant good practice provides a benchmark against which existing risk controls can be assessed. Gaps may identify additional measures that should be implemented or evaluated for reasonable practicability.

Is HAZOP enough for a COMAH risk assessment?

HAZOP is an important hazard identification technique but no single study method can guarantee that every credible major accident scenario will be identified. Past accident experience, good practice and other complementary techniques can help identify hazards that may not emerge from the HAZOP process alone.

What are the limitations of HAZOP?

HAZOP depends on the quality of process information, the experience and behaviour of the study team and the boundaries established by nodes and guidewords. It may be less effective at identifying unusual human behaviour, cross-system interactions, external initiators and slow-developing phenomena.

What is a major accident hazard scenario?

A major accident hazard scenario describes a credible sequence of events that could lead to a major accident involving dangerous substances and harm to people, the environment or both.

What is MAHS?

MAHS commonly refers to Major Accident Hazard Scenarios. Identifying a representative and sufficiently complete set of scenarios is a fundamental part of major hazard risk assessment.

What is the difference between ALARP and SFAIRP?

ALARP means as low as reasonably practicable while SFAIRP means so far as is reasonably practicable. HSE treats the concepts as having essentially the same interpretation when considering how far risks should be reduced.

Can relevant good practice replace a site-specific risk assessment?

No. Relevant good practice provides an important benchmark and can greatly simplify parts of an assessment but operators still need to consider the hazards, operating conditions and circumstances specific to their establishment.

Why should past accidents be reviewed separately from HAZOP?

A separate systematic past accident review reduces reliance on individual team members remembering relevant events during a HAZOP. It allows industry experience to be deliberately searched for and compared against the site’s own processes and safeguards.

What should a COMAH operator review first when preparing for MHHHRA?

A useful starting point is to identify where the existing list of major accident hazard scenarios came from. If scenario identification relies heavily on one technique such as HAZOP, the operator can then consider whether past accident review and comparison with relevant good practice identify additional scenarios or measures.