BAES SMARTer Hazard Log Guidance for the production

BAES SMARTer Hazard Log Guidance for the production of draft ALARP Statements 1

Guidance on ALARP Statements General - • The Health and Safety at Work etc. Act 1974 (HSWA 74) requires that: It shall be the duty of any person who designs, manufactures, imports or supplies any article for use at work or any article of fairground equipment— (a) to ensure, so far as is reasonably practicable, that the article is so designed and constructed that it will be safe and without risks to health at all times when it is being set, used, cleaned or maintained by a person at work. [Regulation 6 (1) (a)]. This means that the regulatory requirement is for a Product to be ALARP for all the risks which can arise from its use. • For the Type 26 project every risk must have an associated ALARP Statement; this is a reasoned argument that all reasonable steps have been taken to ensure that risk is ALARP. • The ALARP statement is a summary of the ALARP justification, and does not need to duplicate specific evidence from the body of the Hazard Log. For example, it is acceptable to say that “Relevant Good Practice has been identified and applied” in the ALARP Statement, provided that the specific evidence to substantiate this is contained within the Mitigation section of the Hazard Log. • The detail in the ALARP statement shall be proportionate to the final risk classification, more effort and justification shall go into final Class A and Class B risks than into Class C and Class D risks. 2

Guidance on ALARP Statements – General (contd) • Additional consideration should also be given to ensuring that the statement is proportionate to the risk reduction claimed, i. e. more effort and justification will be required where a risk reduces from Class A to Class C than where a risk reduces from Class B to Class C. • The ALARP statement is owned by the Risk Owner and they should be responsible for drafting it with the support of the Safety Team. 3

Risk Tolerability and ALARP 4

Useful References • Ships Operating Centre Safety Risk Review – Leaflet 5 • DE&S Safety and Environmental Protection Leaflet 02/2011 – ALARP in a Military Equipment Capability Context • • HSE principles for Cost Benefit Analysis (CBA) in support of ALARP decisions http: //www. hse. gov. uk/risk/theory/alarpcba. htm • • • HSE Guidance on Cost Benefit Analysis Checklist http: //www. hse. gov. uk/risk/theory/alarpcheck. htm 5

Composition and amount of substantiation required to demonstrate ALARP – Mo. D Guidance SRR Leaflet 5 6

ALARP Statement Typical Structure Initial assessment statement A. Initial Safety Assessment (including Risk Classification) and if relevant statement outlining why the risk cannot be avoided (brief statement) Summary of mitigations implemented B. Summary of mitigations applied (succinct list of risk reduction options applied) C. Summary outlining good practice employed Other Mitigations considered but not implemented D. Summary of mitigations rejected (succinct list of risk reduction options rejected and brief reason for rejection, including reference to cost-benefit analysis if cost is one of the reasons for rejecting the mitigation) Legal/regulatory confirmation E. Statement confirming compliance with Regulations and/or Legislation Final assessment statement F. Post Mitigation Safety Assessment (i. e. Risk Classification, Tolerability) and summary statement 7

Specific ALARP Statement requirements for Class D Risks • Residual Class D risks where the initial risk classification was also Class D are considered to be Broadly Acceptable and therefore a only simple standard ALARP statement is required (see slide 9). • Residual Class D risks where a risk reduction has been claimed (i. e. the initial risk classification was C or above) will require an ALARP statement proportionate to the risk reduction (See slide 10). 8

Initial/Final Risk Class D – Required ALARP Statement • The risk was initially assessed as Class D which indicated that it was already considered Broadly Acceptable. • The mitigations put in place along with good practice and adherence to legal requirements have resulted in this risk being reduced so far as reasonably practicable and remains at Class D and Broadly Acceptable without any further demonstration of ALARP. • Note: if there are no mitigations or applicable L&R consult the Safety Team for guidance. 9

Final Risk Class D – Example ALARP Statement Risk 181/1 - Helicopter Handling System cable failure leading to injury from cable snapback A. The risk was initially assessed as class C which indicated the need to determine if further risk reduction was possible. It was not possible to remove the hazard as a cable based system is necessary to move the helicopter. B. The towing cables are designed with a safety factor of 3 and the HHS continuously monitors cable tensions to ensure that they are not overloaded which along with regular inspections of cable condition to ensure that any cable damage is detected allowing cable replacement will minimise the risk of cable failure in use. C. Users of the HHS are required to be trained to operate the equipment and to identify conditions where there may be excessive tensions in the cables. As is standard RN practice only essential personnel are in the vicinity when aircraft movements are carried out. D. No reasonably practicable mitigations were not implemented. E. All applicable Legal and Regulatory requirements are complied with. F. All identified mitigations and controls have been confirmed in place and are considered robust and sufficient by the Aviation PSWG and no reasonably practicable options to further reduce this risk have been identified. The risk reduction claimed is considered reasonable and the final risk, at Class D, lies within the Broadly Acceptable region of the T 26 risk criteria, it therefore has been assessed by the Aviation PSWG that this risk is ALARP without additional mitigation or further analysis to substantiate this. 10

Specific ALARP Statement requirements for Class C Risks • Class C risks are considered to be Tolerable, however they still present an increased final risk and as such additional justification is required to demonstrate that the risk is ALARP. • Reasons for rejecting risk mitigations should be outlined and where cost is one of the factors for rejecting a mitigation a simple CBA should have been completed and referenced. • A final statement that all risk mitigation is in place and that it is not practicable to apply further risk mitigation and that the risk is ALARP as assessed by the appropriate TA PSWG. 11

Final Risk Class C – Example ALARP Statement Risk 510/1 - Personnel come into contact with live electrical components and receive electric shock (Earth fault) A. The risk was initially assessed as class B which while tolerable is undesirable and indicated the need to determine if further risk reduction was possible. B. The electrical assemblies are designed such that exterior metal surfaces bonded to the ship structure to prevent them from becoming live under fault conditions and all enclosures are secured to prevent casual access to internal parts which may become live under fault conditions to minimise the risk of accidental contact. Should an earth fault occur the switchboards incorporate earth fault monitoring to provide warning of earth faults. The 230 V circuits to user sockets incorporate RCCBs to trip in the event of an earth fault to minimise the risk of electric shock. C. The design of all relevant assemblies comply with applicable T 26 design rules and policies for earthing and bonding of electrical assemblies to ensure that while earth faults cannot be completely eliminated, the risk of harm to personnel is reduced SFAIRP. As is standard RN practice, all work on electrical systems is carried out by SQEP personnel which will minimise the risk of inadvertently introducing hazardous faults. D. No reasonably practicable mitigations were not implemented. E. All applicable Legal and Regulatory requirements are complied with. F. All identified mitigations and controls have been confirmed in place and are considered robust and sufficient by the P&P PSWG and no reasonably practicable options to further reduce this risk have been identified. The risk reduction claimed is considered reasonable and the final risk, at Class C, lies within the Tolerable region of the T 26 risk criteria, it therefore has been assessed by the P&P PSWG that this risk is ALARP. 12

Final Risk Class C – Example ALARP Statement Risk 102/1 - Lowering/raising Flight Deck nets leading to fall overboard A. The activity of raising/lowering flight deck nets is a hazardous activity which has led to accidents in falling overboard. The risk was initially assessed as class B which while tolerable is undesirable and indicated the need to determine if further risk reduction was possible. B. The design of the flight deck nets allows them to be deployed whilst standing back from the deck edge. The flight deck is designed to be non slip and adequate lighting is provided for the task. The Operability Statement stipulates the wearing of harnesses and restraining lines to prevent falling overboard. When lowered the nets can support weights of up to TBDkg reducing the risk of a fall leading to man overboard. Personnel also wear auto inflate life jackets. C. Net deployment is managed in accordance with well proven, extant RN procedures, which consider whether deployment of the nets is safe for the flight deck conditions. D. Fitting of powered remote operating nets was considered but rejected due to a number of reasons including increased safety risk in maintenance, problems in meeting the minimum height of equipment above the flight deck and cost, which was grossly disproportionate to the benefit and, justified using a cost benefit analysis. E. All applicable Legal and Regulatory requirements are complied with. F. All identified mitigations and controls have been confirmed in place and are considered robust and sufficient by the Aviation PSWG and no additional reasonably practicable options to further reduce this risk have been identified. The risk reduction claimed is considered reasonable and the final risk, at Class C, lies within the Tolerable region of the T 26 risk criteria, it therefore has been assessed by the Aviation PSWG that this risk is ALARP. 13

Final Risk Class C – Example ALARP Statement Risk 1463/1 - Wholeship occupational hazard - slips, trips and falls. A. Slips , Trips and Falls on wet surfaces – while most outcomes are minor the probabilities are high leading to an initial assessment of class B which while tolerable is undesirable and indicated the need to determine if further risk reduction was possible. It is impossible to prevent the occurrence of slips / trips / falls as they can happen at any time. B. Non-slip surfaces, suitable lighting & emergency lighting, suitable footwear, nets & guardrails, suitable compartment layouts, appropriate floor cleaning methods & materials, appropriate save-alls & drip-trays, equipment maintenance, design of watertight doors, handrails & handholds, stabilisers, and SOPs(including ships rounds) all contribute to the mitigation of this risk. C. SOPs and BRs reflect good practice and are considered to provide mitigations. D. Review of compartments was not considered to reduce the risk to personnel. This mitigation was not rejected on cost grounds and no specific Cost/Benefit Analysis was performed. E. The solution adheres to all applicable legal and regulatory measures. F. The projected assessment is a category C risk. All identified mitigations and controls have had evidence agreed and are considered robust and sufficient by the Wholeship PSWG. No reasonably practicable options to further reduce this risk have been identified. The risk reduction claimed is considered reasonable and the final risk, at Class C, lies within the Tolerable region of the T 26 risk matrix. It has therefore been assessed by the Wholeship PSWG that this risk is ALARP without additional mitigation or further analysis to substantiate this. 14

Specific ALARP Statement requirements for High Severity Class C Risks • High Severity Class C risks (Catastrophic and Disastrous) are considered to be Tolerable when ALARP, however they present an increased severity to a large number of people and as such additional justification may required to demonstrate that the risk is ALARP • Reasons for rejecting risk mitigations should be outlined and where cost is one of the factors for rejecting a mitigation a CBA should have been completed and referenced. • A final statement that all risk mitigation is in place and that it is not practicable to apply further risk mitigation and that the risk is ALARP as assessed by the appropriate TA PSWG and endorsed by the HRWG. 15

Final High Severity Risk Class C – Example ALARP Statement Risk 21/10 - Loss of ship structural integrity causing hull breach / loss of life A. The risk was initially assessed as class A which is Intolerable and determined the need for further risk reduction to reduce the risk to Tolerable levels as a minimum. B. The ship is designed, built and maintained through life to exceed minimum standards set by the Naval Authority Group (NAG) for Structure, Stability and Escape and Evacuation. In the event of loss of structural or watertight integrity these standards provide a proscribed minimum level of: – Structural Integrity – Watertight Integrity and Stability. Extensive sub-division of the ship and isolation of systems to control and limit progressive flooding and maintain the ship afloat and at a reasonable angle of heel and trim. – Sufficient time and resources to escape and evacuate personnel if the loss of structural and/or stability integrity is too great. – Guidance to the ship’s command personnel as to how to operate the ship safely including in the event of damage. In addition the ship has a designed in level of survivability and recoverability required mainly for operational wartime requirements but also are applicable to the peacetime safety case. While immediate response to the incident must lie with the ship’s company additional support is available from shore based Mo. D Ship support, and may also be available from accompanying ships. The level of structural and stability integrity the ship can survive is driven by the level of damaged to be analysed. The principle method of doing was by use of damage templates proscribed in the relevant standards, but other realistic damage scenarios have been analysed to determine the ship’s response. 16

Final High Severity Risk Class C – Example ALARP Statement (Cont. ) C. Design to the standards is evidenced by the Naval Authority Group (NAG) issuing periodic audit reports of the plan approval submissions for Naval Ship Safety Certificates for Structures, Buoyancy and Stability, and Escape and Evacuation. For structure the ship has been designed to LNSR, which meet the NSSC structural standards. The ship has been designed to meet Def Stan 02 -900 for stability, including watertight integrity. The Escape and Evacuation standard is ? ? . The Ship’s material state will be monitored by the NAG during construction and through its service life to ensure it continues to meet the standards either directly (for Buoyancy and Stability) or by its appointed Responsible Organisation (RO), Lloyds Register, for Structures. The ship will be maintained “in Class” for Structure and also Escape and Evacuation TBC. These standards will be evidenced by the issue of NSSC with time limited endorsements for Structures, Buoyancy and Stability and Escape & Evacuation on completion of build and through the service life of the ship. D. No reasonably practicable mitigations were not implemented. E. All applicable Legal and Regulatory requirements are complied with. F. All identified mitigations and controls have been confirmed in place and are considered robust and sufficient by the Platform (Naval Architecture) PSWG and no reasonably practicable options to further reduce this risk have been identified. The risk reduction claimed is considered reasonable and the final risk, at Class C, lies within the Tolerable region of the T 26 risk criteria, it therefore has been assessed by the (Naval Architecture) PSWG and endorsed by the HRWG that this risk is ALARP. 17

Specific ALARP Statement requirements for Class B Risks • While Tolerable when ALARP, Class B risks are considered to be undesirable. They present a significantly increased final risk and as such additional justification will be required to demonstrate that the risk is ALARP. • Reasons for rejecting risk mitigations should be outlined and where cost is one of the factors for rejecting a mitigation a substantive CBA should have been completed and referenced. • A reasoned argument that it is not practicable to apply further risk mitigation and that the risk is ALARP as assessed by the appropriate TA PSWG and endorsed by the PSEC. 18

Final Risk Class B – Example ALARP Statement • To be developed when a suitably mature risk example is identified. 19

HSE Guidance for Gross Disproportionate Calculation • Costs/Benefits > Disproportion Factor • Benefit 1 = Number of casualties x Casualty Value x Probability of Accident x Number of Equipments x Equipment Life • i. e. For a Class B residual risk (For a Class B residual risk GDF = 6 2) 10 Fatalities (for a fatality the Casualty value (VPF) = £ 2, 000 3) Probability of accident = 1 x 10 -4 per year/ship Fleet of 8 ships Ship life of 25 years • Benefit = (10) x (2 x 106 ) x (1 x 10 -4) x (8) x (25) = £ 400, 000 • Gross Disproportionate: Cost > GDF x Benefit = 6 x £ 400, 000 = £ 2, 400, 000 – HSE Cost Benefit Analysis (Checklist) – Ships Operating Centre Safety Risk Review Instruction, Leaflet 5, Sep 2014 para 3. 17 3 - Ships Operating Centre Safety Risk Review Instruction, Leaflet 5, Sep 2014 para 3. 18 1 2 20

What is a draft ALARP statement? The purpose of the draft ALARP statement is to provide the opportunity at an early stage to assure both the TA and AA that an ALARP statement can be prepared which, when all the mitigation is in place, will satisfy both parties. • The draft ALARP Statement defines the proposed final ALARP statement. • It is draft on the basis that the mitigations are not implemented at this point in time and the statement is NOT signed off. • When the both the TA and AA agree that the draft ALARP statement provides a reasonable justification that the risk will be ALARP with the proposed mitigation implemented, an agreement statement should be added on the first line of the Justification/ALARP statement field at the head of the statement. • Documentary evidence of TA/AA agreements should be filed under the “Documents” tab in SMARTer. • Agreement at this point does not prevent the ALARP statement being changed subsequently by mutual agreement. Specific details of how to enter the statement in SMARTer are given in next slide. 21

What is a draft ALARP statement? Adding the draft ALARP statement to SMARTer – complete relevant fields as below. When the draft ALARP statement is agreed by the TA and AA, add this sentence at the beginning. Risk Owner Draft ALARP Sentence as agreed by TA and AA Add draft ALARP statement here. Date Leave as is Do not fill in 22