The ALARP principle in connection with offshore oil and gas operations

March 2017

The guideline explains how the ALARP principle is used to reduce health and safety risks and risks of major environmental incidents in connection with offshore oil and gas operations.

The guideline concerns the meaning of the ALARP principle, and how to apply the principle in connection with reducing health and safety risks, as well as how to document in the Health and Safety Document (also known as the Health and Safety Case (HSC)) that risks have been reduced in accordance with the ALARP principle.

The guideline is for anyone under an obligation to perform an assessment of health and safety risks, as well as risks of major environmental incidents, and to subsequently reduce the risks in accordance with the ALARP principle, i.e. operators, owners, contractors and employers. The guideline is also aimed at the safety organisation and employees contributing to reducing risks in accordance with the ALARP principle. Finally, the guideline may be of interest to consultants and others carrying out tasks related to risk reduction in accordance with the ALARP principle.

The most important rules

In connection with installations, well operations and other offshore oil and gas operations, health and safety risks and risks of major environmental incidents must be brought to a level which is As Low As Reasonably Practicable (the ALARP principle).

The terms ”risk” or “risks” are used in the guideline to refer to health and safety risk(s) and risk(s) of major environmental incidents, unless otherwise stated.

The term “installation” is used in the guideline to cover installations as well as connected infrastructure and pipelines, unless otherwise stated.

Sections 1-4 concern the ALARP principle generally, while sections 5-11 deal with application of the ALARP principle in various situations, including expectations for the content of the ALARP demonstration.

1. Definitions

The sections below contain definitions relevant to understanding the concepts of the guideline. The guideline may use concepts that are not defined here. These concepts are described in DWEA guideline no. 65.1.1 concerning concepts related to offshore oil and gas operations.

1.1. Risk

Risk of personal injury, illness or death measured as

a) safety risk: combination (product) of the probability of an event and the consequence of that event; or

b) health risk: combination (product) of the magnitude and duration of a harmful effect.

1.2. Prevention

All the steps or measures taken or planned at all stages of work to prevent or reduce health and safety risks.

The measures taken to reduce risks according to the ALARP principle must prevent fatalities, personal injuries or diseases. Prevention of injuries is a fundamental principle in both EU legislation and Danish legislation. The principles applicable in connection with risk reduction are described in more detail in the DWEA guideline on risk management in connection with offshore oil and gas operations.

1.3. Hazard

Source of potential injury

1.4. Costs

In this guideline, costs in connection with risk reduction means costs in terms of money, time and effort associated with reducing the risks.

1.5. The ALARP principle

As Low As Reasonably Practicable. Following the ALARP principle means that risks must be reduced to a level that is as low as reasonably practicable.

1.6. ALARP demonstration

Demonstration that risks have been reduced in accordance with the ALARP principle, including that good practice has been used, when available; and including a description of cases in which risks have not been further reduced and the reason why there is a gross disproportion between costs and risk reduction.

1.7. Highest acceptable level of risk

Defined as the highest level of risk at which operations may be performed.

The highest acceptable level of risk can be measured. The risk can be expressed as one of the levels mentioned in the DWEA guideline on risk management in connection with offshore oil and gas operations.

Non-compliance with the risk levels is not acceptable, and in the event of non-compliance, the activity, e.g. operation of an offshore installation, may not be performed until the risk has been reduced to below this level and brought into line with the ALARP principle.

Furthermore, the legislation stipulates a number of specific requirements concerning health and safety at work (e.g. with regard to noise and substances and materials). When these requirements are complied with, individual risks are considered to be below the highest acceptable level of risk.

For some types of harmful influences, an upper limit (limit value) for measurable impacts has been established in the offshore safety legislation. For instance, this applies to impacts from noise and vibration and to impacts from substances and materials. In such cases, these limit values reflect the highest acceptable level of risk unless the enterprise itself has laid down lower highest acceptable levels of risk.

1.8. Acceptance criterion

Established quantitative (measurable) limit for the highest acceptable level of risk to perform an activity under normal operating conditions.

The acceptance criteria are limits for when an activity may be carried out.

The operator and the owner, respectively, must lay down acceptance criteria for risks of major accidents, while the acceptance criteria for other health and safety risks are established by the operator and the owner, respectively, in accordance with their management systems for health and safety.

The acceptance criteria must, as a minimum, correspond to the level stated as the highest acceptable level of risk in the offshore safety legislation or in recognised standards, but beyond this, the DWEA will expect that the acceptance criteria are not higher than the level applied under comparable circumstances in the other North Sea countries.

When applying the limits for a harmful impacts as an acceptance criterion, aggravating impacts caused by a combination of several impacts must be taken into account.

1.9. Generally acceptable level of risk

The level of risk at which additional reduction of the risk is unnecessary. It may be expressed quantitatively in the same way as the highest acceptable level of risk.

If a risk is found to be at this level or less in connection with a risk assessment, is not necessary to reduce the risk further. The ALARP triangle in figure 1 indicates the position of the generally acceptable level of risk.

Figure 1

1.10. ALARP region

The ALARP region is the risk level between the highest acceptable level of risk and the generally acceptable level of risk. Risk reduction in this region must be carried out in accordance with the ALARP principle.

1.11. Workplace assessment

An expression originating from the Danish Working Environment Act. A workplace assessment includes an assessment of health and safety concerns and an action plan on how to resolve any workplace health and safety issues, including risks of major accidents. Absenteeism due to sickness must be included in the assessment. In the present context, a workplace assessment corresponds to a risk assessment combined with a plan for reducing the risks.

2. The ALARP principle in offshore safety legislation

The ALARP principle is an internationally recognised principle used in the offshore oil and gas sector. Application of the ALARP principle in the Offshore Safety Act corresponds to the principle in the Working Environment Act that health and safety conditions must be fully justifiable, taking social and technological societal developments into consideration. This includes, based on a principle of proportionality, a weighting of the risk reduction achieved against the associated costs. Operationally, the requirement to reduce the risks in accordance with the ALARP principle primarily means unconditional compliance with all specific requirements and instructions, as well as limit values in legislation and regulations. Enterprises should also assess whether it is possible to eliminate completely or to further reduce the risks. The latter also applies to cases in which the legislation does not contain specific instructions or limit values, but only general and functional requirements.

Complying with the ALARP principle means that

a) no measurable risk, or risk established on the basis of measurable indicators, may exceed the highest acceptable risk, and that

b) all risks under item (a) which do not exceed the generally acceptable level must be reduced to a level as low as reasonably practicable, or

c) if the risk cannot be measured either directly or by means of indicators, e.g. in the event of physiological impacts, work must be planned so that risks are reduced to a level as low as reasonably practicable based on a qualitative assessment. Guidance on how to make the assessment is available in guidelines on good practice in the relevant area, and these guidelines must, as a minimum, be complied with. The DWEA guideline on assessment of work postures and work movements is an example of a guideline on good practice where the risk cannot be measured directly. Section B.8 of the DS ISO 17776 provides further guidance in this area. See also section 3.3 below.

The risk levels are illustrated by the ALARP triangle in figure 1.

As shown in the ALARP triangle, a highest acceptable level of risk and a generally acceptable level of risk must be established. The region between these levels is known as the ALARP region or the acceptable (or tolerable) risk.

The enterprises must lay down the acceptance criteria themselves. It is likely that these criteria will not exceed the criteria generally applied under comparable circumstances in the other North Sea countries.

3. Risk reduction by applying the ALARP principle

3.1. Application of the ALARP principle

In all circumstances, a given risk must be kept below the limits stated as the highest acceptable level of risk (e.g. limit values laid down in the legislation) and the enterprise’s own acceptance criteria.

However, this is not sufficient for a risk to be considered as having been reduced in accordance with the ALARP principle.

3.2. Risk reduction

The fundamental principle in the offshore safety legislation is that operators as well as enterprises responsible for operations must reduce risks associated with their operations to a level which is as low as reasonably practicable (ALARP).

Risk is the combination (the product) of the likelihood and consequences; i.e. in order to reduce the risk, it is necessary to focus on reducing the likelihood that the hazardous events occur (prevention) and on reducing the consequences of events if such events do occur.

The following general hierarchy for risk reduction should be applied, see, for example, the DS/EN ISO 17776 standard:

1. Prevention (elimination or reduction of the likelihood that potentially hazardous events occur).
2. Detection (transmission of information to a control point). 
3. Control (systems that control a hazard to minimise or remove consequences). 
4. Mitigation (technical mitigation of consequences of hazardous events).
5. Emergency response (including fire equipment, life-saving appliances, etc.).

Where reasonably practicable, risk reduction must be built into the installation by taking the following preventive measures:

• reduction (reduce the magnitude or frequency of the hazard, or the duration of the exposure or the event arising from the hazard),
• substitution (replace hazardous activities, substances and materials with less hazardous ones),
• mitigation (e.g. sectioning of processing installations, ESD systems, conducting the process at lower temperatures or pressures), or 
• simplification (simple design of installation, building and operations so as to reduce the need for processing equipment and control, and thereby reduce the risk of human errors).

See also the principles of prevention mentioned in Annex 1 to the DWEA guideline on risk management in connection with offshore oil and gas operations.

When the preventive measures have been assessed, measures must be taken to mitigate effects (consequences) of a potential hazardous event when such event has occurred. Such measures may include detection of gas or smoke, fire water mains and active and passive fire and explosion protection. Next, emergency response must be assessed. This may include manual fire fighting, temporary refuge, escape options and evacuation and life-saving systems, etc.

Choice of risk reduction measures will be influenced by

• technical feasibility, 
• the impact of the measure, 
• the costs and risks of implementing the measure, and 
• the degree of uncertainty when assessing risks or the method to reduce the risks, including human factors.

A risk reduction measure must be implemented if it is “reasonably practicable”. What is “reasonably practicable” is not necessarily the same as fully “technically feasible”, which means that the operator must assess whether there is a gross disproportion between the effect of implementing the risk reduction measure and the associated costs (money, time, trouble).

Assessing what is reasonably practicable typically involves a choice between several technical or operational solutions leading to different degrees of risk reduction.

When choosing a solution, the following conditions must be met as a minimum:

• Legislative requirements must be complied with, including limit values. 
• Good practice in the area must be used.

As a general rule, recognised norms and standards in the area must be conformed to, but it must be assessed whether it is possible to reduce the risks further in accordance with the ALARP principle. For example, this may be relevant if the norms and standards applied are not up-to-date, or if good practice in the area would lead to a lower risk.

3.3. Good practice

Good practice means a recognised practice for risk reduction measures, e.g. installation design and equipment used in the sector.

Good practice involves, for example, appropriate use of recognised norms and standards. Good practice also reflects relevant legislative requirements.

Sources of good practice include:

• Globally recognised standards (e.g. ISO, IEC, API).
• Regionally recognised standards (e.g. EN, NORSOK). 
• Rules laid down by recognised classification societies.
• DWEA guidelines. 
• Sector guidelines, e.g. from the IOGP and the IADC, but also onshore sector guidelines from the sector working environment councils.

The risk management process should follow the hierarchy for risk reduction mentioned above, with the indicated priorities.

Good practice may change over time in line with technical developments, and enterprises should regularly reconsider the nature of good practice. For example, new legislation and changes in norms and standards may have an effect on what was previously good practice.

When using good practice, it must be clearly defined what such practice covers and when its application is relevant. Practice may be recorded in standards or procedures, or form part of a well-defined and well-established practice adopted and written down by the industry or an industry association.

Considerations concerning the use of good practice for an activity or a design must include considerations on whether all aspects of the activity or the design are covered by the good practice. When this is not the case, ALARP assessment of these aspects will be based solely on a risk assessment.

3.4. Reasonably practicable

When assessing what is reasonably practicable, it must be assessed whether there is a gross disproportion between the advantages in the form of preventing fatalities, personal injuries or occupational diseases that are achieved due to the risk reduction effort in the current situation, and the costs incurred when implementing the risk reduction measure (money, time and effort). The outcome of this assessment, and the resulting decision on whether further risk reduction should be implemented, depend on the specific situation.

In the event that the enterprise has a choice between a range of risk reduction measures, none of which demonstrates a gross disproportion between the risk reduction achieved and the associated costs, the DWEA will consider the risk reduction measure causing the lowest total risk of major accidents and the lowest risk to each of the other working environment factors as the measure reflecting ALARP and thus as the measure that should be implemented. Consequently, measures leading to less risk reduction than the measures above will not be considered as meeting the ALARP requirements of the Offshore Safety Act.

3.5. Costs

The assessment of costs of risk reduction measures includes both direct costs associated with implementing the measures, and indirect costs, e.g. loss or deferment of production on production installations in connection with shutting down production while implementing the measures. In the latter case, the assessment is more complicated. In principle, the costs associated with deferred production will be restricted to lost earnings during the shutdown period. For mobile non-production installations, the assessment of indirect costs should take into account, for example, whether work on the installation needs to be carried out at a shipyard, thus resulting in loss of earnings.

The cost analysis issue is described in more detail on the British Health and Safety Executive’s website. 

Risk management: Expert guidance - Health and Safety Executive

3.6. Assessment of risk reduction measures

The DWEA does not have an established practice for the size of disproportion operators should accept. This will be based on a specific assessment, including whether existing or new operations are involved; however, the greater the risk, the higher the costs to be accepted before the disproportion will be considered excessive.

The enterprise is responsible for justifying why risk reduction measures have not been implemented with reference to a disproportion that would not be acceptable under the circumstances. In this connection, the enterprise should investigate which disproportions have been accepted under similar circumstances elsewhere. In its assessment of the ALARP demonstration of the enterprise, the DWEA will take this into consideration.

If, after completing the notification procedure to the DWEA, a reasonably practicable means is identified that can further reduce risk for a new installation or a major conversion of an existing installation, the DWEA may require, following a specific assessment, that the risk reduction is implemented. This presupposes that the risk reduction measures should normally have been implemented as part of a good design according to the ALARP principle, but that they have not been implemented.

3.7. Process for risk management by applying the ALARP principle

When applying the ALARP principle to the risk management process, the following steps may be used:

1. Where there are risks to persons or risks of major environmental incidents, assessment of these risks in connection with the operations of the enterprise, both with regard to the risks of major accidents and other risks.

2. This assessment will include the following steps: 

1. Quantitative assessment of total risk, including a specific assessment of the sources of hazard. 
(a) Where the risk associated with an identified source of hazard cannot be assessed with sufficient certainty to make a reliable comparison with the highest acceptable level of risk, the DWEA expects that the precautionary principle will be applied. The precautionary principle is described in more detail on the EUR-Lex website.
(b) If the total risk can be assessed with sufficient certainty, step 2(2) will be followed.

2. Comparison between the total risk and the highest acceptable level of risk: 
(a) If the total risk is higher than the highest acceptable level of risk, the activity may not be carried out until risk reduction measures have been taken and the total risk is lower than the highest acceptable level of risk. Subsequently, the assessment will proceed to step 2(3). 
(b) If the total risk is between the highest acceptable level of risk and the generally acceptable level of risk (the ALARP region), the assessment will proceed as stated in step 2(3). 
(c) If the total risk is at the generally acceptable level or lower, the assessment will proceed to step 3.

3. Identification of any additional risk reduction measures that can be implemented physically or operationally: 
(a) The measures can be implemented, unless it can be demonstrated that this is not reasonably practicable. 
(b) If the benefits of a risk reduction measure cannot be assessed with sufficient accuracy to determine whether it is reasonably practicable to implement the measure, the precautionary principle must be applied.

3. Where risks are at or lower than the generally acceptable level of risk, the risks will be considered tolerable, and additional measures will not normally be necessary.

With regard to demonstrating that risks associated with the operations of the enterprise are ALARP, see section 4 below.

4. Demonstration that risks have been reduced to ALARP (ALARP demonstration)

The ALARP demonstration can be divided into:

• An ALARP demonstration for risks of major accidents, and
• An ALARP demonstration for other risks.

4.1.1. ALARP demonstration for risks of major accidents

The ALARP demonstration must provide evidence that all risks of major accidents have been reduced to a level that is ALARP.

The ALARP demonstration for risks of major accidents should include:

1. A list of persons involved in the ALARP process, including documentation that these persons are competent professionals who together possess the necessary qualifications to assess risk reduction measures in connection with the design and operations of the installation. 
2. A description of risk reduction measures that have been assessed and implemented, including demonstration that all reasonably practicable measures have been identified.
3. A description of the risk reduction measures which have been assessed, but which have not been implemented, including satisfactory justification for not having implemented the risk reduction measures. The justification must include information about the costs associated with establishing risk reduction measures, and an assessment of whether these costs are grossly disproportionate to the benefits gained by the risk reduction. Where the costs are grossly disproportionate to the additional risk reduction achieved by means of the risk reduction measures, the risk reduction measures may be omitted, provided that good practice has been followed and appropriately documented.
4. Where good practice has been used as justification for not taking additional risk reduction measures, this must be appropriately documented, including a description of the content and origin of the practice, and why it is relevant not to reduce risk further. For risks that are lower than the generally acceptable level of risk, no further demonstration is necessary.

4.1.2. ALARP demonstration for other risks

Other risks are risks associated with work on the installation, which are not risks of major accidents.

Other risks typically originate from:

• Physical conditions: For example, the work room, surroundings, noise, indoor climate (including tobacco smoke), vibration and lighting.
• Ergonomics: For example, heavy work, repetitive tasks and work postures. 
• Psychological conditions: For example, working hours, time pressure, repetitive monotonous work, influence and working alone. 
• Chemical conditions: For example, exposure to substances and materials.
• Biological conditions: For example, exposure to bacteria, viruses and fungi in connection with certain types of work, hygiene, air humidifier systems and drinking water. 
• Risks of accidents: For example, from machinery, hand tools, passage, handling, fire and explosion.

The assessment of other risks may be carried out according to the methods described in the DWEA guideline on workplace assessments. The DWEA guideline on workplace assessments may thus be used as guidance for identifying, assessing and reducing other risks (the risks mentioned are also described in ISO 17776, Annex B (B.8)).

The DWEA guideline states how the analysis of health and safety issues (identification of risks) can be performed by means of:

• Interviews with employees
• Round tables 
• Employee satisfaction surveys 
• Questionnaires, for example electronic 
• Use of checklists from the DWEA 
• Use of material from sector working environment councils and sector associations for working environment.

Most other risks can be determined on the basis of measurable data, either directly or via indicators.

Examples include noise exposure; both noise exposure causing damage to hearing and noise exposure that is a serious nuisance, as well as unsatisfactory acoustic conditions. An ALARP demonstration for these risks must include:

1. A specification of the noise exposure limits and action values forming the basis of the design of the installation. 
2. An analysis of the noise exposure level at workstations on the installation (noise prediction report), describing that low-noise equipment has been selected which reduces harmful noise exposure and noise exposure that is a serious nuisance to a level as low as reasonably practicable. 
3. An account of protective measures to be implemented when the daily personal noise exposure exceeds the upper limits laid down in the legislation. 
4. An account of measures to be taken in cases where noise prediction or measurements show that either the upper or the lower action value (83 dB(A)/78 dB(A)) for personal noise exposure has been exceeded.
5. An account of measures to be taken to reduce noise exposures that are a serious nuisance and to address unsatisfactory acoustics.

Other examples are exposures from vibrations, ventilation (draughts and noise) lighting, temperatures and substances and materials.

Psychological risks can be measured by means of employee satisfaction surveys, for example.

Risks of musculoskeletal disorder originating from manual handling of loads, work postures etc. can be measured in terms of weight of loads, reaching distances, lifting height, body postures, etc.

If the operator or the owner, respectively, does not possess the required knowledge, or if the guidelines are inadequate within a specific area, the operator or the owner, respectively, must obtain expert assistance within this area in order to identify and assess risks and ensure that they are reduced according to the ALARP principle.

It should always be assessed whether social and technical developments in society have generated new solutions that will involve lower risk.

4.1.3. ALARP demonstration for risks not related to work

Risks not related to work are risks associated with leisure time activities.

Risks not related to work typically originate from: 

• Physical conditions: For example, accommodation, surroundings, noise, indoor climate (including tobacco smoke), vibration and lighting.
• Chemical conditions: For example, substances and materials in the surroundings. 
• Biological conditions: For example, bacteria, viruses and fungi in connection with hygiene, air humidifier systems and drinking water. 
• Risks of accidents: For example, from machinery, passage, handling, fire and explosion.

The assessment of risks not related to work may be carried out as described above in relation to other risks.

Again, it should always be assessed whether social and technical developments in society have generated new solutions that will involve lower risk.

5. Application of the ALARP principle in connection with design of a new production installation or a major conversion of such installation

When designing a new production installation, whether it is a fixed or a mobile installation, or when designing a major conversion of a fixed production installation, the operator or the owner, respectively, must identify all hazards and assess the associated risks, so that risk reduction measures can be built into the design. The stage from choice of concept to detailed design with specification, drawings, calculations, etc. offers ample room for incorporating risk reduction measures at considerably lower costs in relation to the costs of subsequent establishment of risk reduction measures.

Major conversion means modifications that are material for the overall design of the installation with connected infrastructure, as opposed to modifications typically involving modifications to equipment, well conditions, etc.

Adding or removing platforms or connected infrastructure are examples of major conversions.

Design includes:

a) Overall design of the installation or parts thereof (concept).

b) Design of details of the installation, equipment and systems, including process and auxiliary systems.

c) Layout of workstations and accommodation facilities.

When designing the installation or major conversion, the operator must

a) choose the solutions that overall involve the lowest risk, or

b) demonstrate that rejection of solutions with the lowest risk is in accordance with the ALARP principle (ALARP demonstration).

An efficient way of demonstrating that the risk is ALARP is, on the basis of various concept models, to start by specifying the design that overall involves the lowest risk of major accidents.

For other risks and risks not related to work, the design chosen should involve the lowest risk for each of the working environment factors, to the extent that this can be assessed when choosing the design. The risk from each of the working environment factors cannot be weighed against each other. In other words, a major risk reduction for one working environment factor does not entail that the risk associated with another working environment factor should not be reduced to a level as low as reasonably practicable. For example, the risk from noise exposure cannot be weighed against the risk from substances and materials. The operator should choose the solution that reduces the risk as much as possible, unless it can be argued that this solution is not reasonably practicable. In this case, the operator should proceed to the next solution and make the same assessment. This procedure will be repeated until the operator finds the solution which, according to the operator, complies with the ALARP principle. The working environment factors are explained in more detail in the DWEA guideline on risk management in connection with offshore oil and gas operations.

The overall risk assessment and choice between different risk reduction measures must take into account the expected lifecycle of the installation, including construction, assembly, operation, maintenance and any modifications as well as decommissioning and disposal.

There is a special need to continuously assess current practice, and thus to consider the possibility to apply a higher level of health and safety over time. This is relevant if the circumstances or risks subsequently change, and risk reduction measures that have previously been rejected now have to be implemented in order to ensure that the risk is still ALARP.

The use of good practice in the design phase is crucial to demonstrate compliance with the ALARP principle.

The DWEA expects that risks on a new production installation will generally be lower than risks on a comparable existing, older installation that followed best practice at the time it was built. This reflects general legislative requirements to continuously ensure improvements in health and safety conditions in line with technical and social developments in society.

5.1. ALARP demonstration

The design notification for the installation must include evidence that risks have been reduced to a level that is ALARP (ALARP demonstration). The DWEA expects the ALARP demonstration to contain the elements described in section 4 above.

At the time of notification, the ALARP demonstration will reflect the knowledge available about the design at that time. Consequently, there is a need to continuously update the ALARP demonstration as the design becomes more detailed, until a Health and Safety Document has been prepared for the installation, which includes a fully updated ALARP demonstration.

At the time of notification of the design, the operator will probably have limited knowledge about other risks. Therefore, the operator will only need to enclose a preliminary plan for the assessment of other risks with the application, referring to the norms and standards that are expected to form the basis of continued work (e.g. a programme for risk management in the working environment).

6. Application of the ALARP principle in connection with relocation of existing production installations

A relocation notification must be submitted in connection with relocation of an existing production installation. The notification must include evidence that the ALARP principle is being observed in connection with operations at the new position.

The ALARP demonstration described in section 4 above will apply in this situation. The scope of the demonstration will depend on whether the production installation is being relocated to the Danish sector from a foreign sector, or from one location in the Danish sector to another.

In the latter case, an operating permit will already have been granted for the installation, and the ALARP demonstration will focus on any design modifications triggered by the use of the installation in a new position.

If the installation is relocated from abroad, a full ALARP demonstration must be provided, as described in section 4.

7. Application of the ALARP principle in connection with establishing a pipeline

When establishing a new pipeline, a design notification for the design must be submitted, and the notification must include evidence that the ALARP principle is being observed to the extent that this is relevant. This demonstration will document that risks associated with loss of pipeline integrity have been reduced to a level that is as low as reasonably practicable.

8. Application of the ALARP principle in connection with operations

The Health and Safety Document enclosed with an application for a permit to operate an installation or a pipeline must include an ALARP demonstration for risks. For production installations and fixed non-production installations, the ALARP demonstration will be the demonstration updated during the design phase, as described section 5.1. In connection with relocation of an existing production installation, the ALARP demonstration will be the demonstration described in section 6.

8.1. ALARP demonstration enclosed with an application for an operating permit for production installations and fixed non-production installations

The Health and Safety Document enclosed with an application for an operating permit must include an update of the ALARP demonstration described in section 4.

The ALARP demonstration must document all risks of major accidents that have been identified as potential accidents during the operating period of the installation.

8.2. ALARP demonstration in connection with an application for an operating permit for mobile non-production installations

The Health and Safety Document enclosed with an application for a permit to operate a mobile non-production installation must include an ALARP demonstration for major accidents, as well as for other risks and risks not related to work.

A health and safety document or similar acknowledged by other North Sea countries, possibly with some modifications, can be used as part of the Health and Safety Document enclosed with the application and the ALARP demonstration included in therein. Usually, only risks of major accidents will be included in accepted documentation from other countries. In such cases, an assessment of other risks as well as the associated ALARP demonstration must be included as a supplement.

8.3. Application of the ALARP principle during operation of an installation

In connection with tasks where the risk is known and low, and where a good practice has been established for performance of work, by following this practice, the enterprise responsible for operations (the operator and the owner, respectively) may omit to take explicit account of the calculated individual and collective risk. Following this practice implies that the residual risk was accepted when the practice was established.

Where good practice is used as justification for not taking additional risk reduction measures, this practice must be appropriately documented, including a description of the content and origin of the practice.

In situations other than those described above, use of good practice will be insufficient to reduce risks according to the ALARP principle. In these cases, an assessment of risks and possible further risk reduction measures must be performed. This must be stated in the ALARP demonstration in each individual case.

If the assessment of risks is uncertain, or if an event has major consequences, more emphasis should be placed on expert assessments and operational practice than on arguments concerning the likelihood of the event, failure, etc. 
Section 4 may serve as the basis of compliance with the ALARP principle during operations.

9. Application of the ALARP principle in connection with modification of installations

The Health and Safety Document enclosed with an application for a permit to make modifications to an installation, excluding major conversions, must reflect the risks present after the modification and must demonstrate that these risks are ALARP.

Thus, this is an update of the Health and Safety Document that constituted the basis for previously granting an operating permit or a modification permit.

The Health and Safety Document, including risk assessments and ALARP demonstrations, is a dynamic document throughout the lifetime of the installation. Consequently, it is important that, during design and operation of an offshore installation, thorough risk assessments, including ALARP demonstrations, are conducted, as these assessments will constitute the basis of all subsequent modifications to the installation and of the ongoing assessment of whether the risks on the installation are still ALARP.

10. Application of the ALARP principle in connection with combined operation of several installations

In connection with combined operation of several installations, it will typically be necessary to obtain an operating permit for the mobile installation(s) forming part of the combined operation, and a modification permit for the fixed installation(s) involved.

These permits are granted on the basis of updated Health and Safety Documents for each of the installations, including ALARP demonstration supplemented with bridging documents between the installations. In these cases, the ALARP demonstration conforms to the description in sections 8 and 9, respectively. In connection with combined operation where at least one of the installations involved is an existing installation, i.e. an installation for which an operating permit was granted before 19 July 2015, the above will not apply until 19 July 2018.

11. Application of the ALARP principle in connection with decommissioning fixed installations

In connection with applying for a permit to decommission a fixed installation, a Health and Safety Document concerning the decommissioning work must be enclosed with the application. This document can probably not be based on an update of an existing Health and Safety Document associated with operation of the installation. Thus, a new Health and Safety Document for the decommissioning work is expected. This new Health and Safety Document must include an ALARP demonstration in accordance with the guidance in section 8.1 concerning application for an operating permit.