Risk Acceptability (Tolerability) in System Safety: Concepts and Methodology

Transcription

1 Risk Acceptability (Tolerability) in System Safety: Concepts and Methodology Presented By: Elya B. Joffe President, IEEE Product Safety Engineering Society

2 Introduction: Why Risk Management? ARE YOU SAFE NOW??? Or Could the ceiling fall? Could meteorite strike? Could fire start? HOW SAFE ARE WE NOW?

3 Introduction: Why Risk Management?

4 Introduction: Why Risk Management? Risk Management = Decision Making choosing an option that is perceived to have the best benefit / cost ratio No one takes a risk for the chance of loss Option A Option B Perceived Costs Perceived Benefits Perceived Costs Perceived Benefits

5 The Ford Pinto Engineering Disaster Crash tests revealed defect in gas tank rear-end collisions over 25mph resulted in rupture and explosion The tank met legal standards, but Ford engineers knew its design was flawed Cost-benefit analysis (CBA) estimation Cost to pay for injuries: 180 Deaths, 180 Injured, 2100 Burned Cars = $49.5 million Cost to make safe cars: $12.5 million cars x $11/car = $137 million

6 The Ford Pinto Engineering Disaster - Ford s Dilemma Safety Cost

7 Outline 7 Introduction Buzzword Alert! Key Terms and Definitions Risk Assessment Risk Response Strategies Risk Acceptability Summary

8 Why do Men Die Younger? Do they Take Extra Risks?

9 Technology and Risks Technology has improved our level of well-being significantly But all technologies also have their potential downsides or risks How should we decide about risky technologies? Or What is an acceptable risk?

10 Buzzword Alert! Key Terms and Definitions There are a number of technical terms in this lecture Yes, you have to know them! These terms have precise meaning, even though you will often see them MIS-used Since risk assessment is (or aims to be) a scientific activity we must agree on terminology

11 Buzzword Alert! Key Terms and Definitions Mishap (Accident) An unplanned event or series of events resulting in death, injury, system damage, or loss of or damage to equipment or property Mishap Likelihood Likelihood of mishap occurrence over a specified exposure interval. Probability is a component of risk and has no dimension but must be attached to an interval of exposure (example: one operating year, a million vehicle miles) Mishap Probability Category A categorization that provides a range of probabilities (or likelihoods) for the occurrence of a mishap

12 Buzzword Alert! Key Terms and Definitions Harm Physical injury or damage to the health of people, or damage to property or the environment Hazard Potential source of harm, A condition prerequisite to a mishap Severity Measure of the possible consequences of a hazard; Severity is one component of risk

13 Buzzword Alert! Key Terms and Definitions Risk Combination of the probability of occurrence of harm and the severity of that harm Risk contains two elements: The likelihood of an event occurring The consequence and/or impact if it happens Residual Mishap Risk The mishap risk that remains after all approved control measures have been implemented and verified Safety Freedom from unacceptable risk

14 Risk Acceptance: A decision to accept a risk. That level of residual risk that the managing authority is willing to assume on behalf of the agency, users and the public. Risk acceptance depends on Risk Criteria. Risk Criteria: Terms of reference by which the significance of risk is assessed Risk Control Buzzword Alert! Key Terms and Definitions Process in which decisions are made and measures implemented by which risks are reduced to, or maintained within, specified levels

15 Introduction - What is Risk? Any uncertainty about the future Technically can be both positive and negative Safety questions focus only on negative outcomes

16 Risk Assessment Risk Assessment is an effective mean of identifying system or process safety risks Characterizes hazards within risk areas and critical technical processes Analyzes them for their potential mishap severity and probabilities of occurrence Prioritizes them for Risk Acceptance A scientific/mathematical discipline A substantive, changing and controversial field The most accepted tool is the Risk Assessment Matrix (RAM) First used in 1662, when Blasé Pascal created Pascal's concept of Proportional Risk

17 Quantitative Risk Assessment (QRA) Timeline RelSafe Ltd

18 Blasé Pascal: Father of Risk Based Decision

19 Risk Assessment Key Concepts of Risk The frequency of the potential harm The likelihood/probability that an accident will occur due to the hazard The consequences of that loss The most likely outcome/result of such an accident The perception of the loss The overall risk level of each hazard How seriously the stakeholders view the risk that might affect them

20 Risk Assessment Defining and Calculating Risk Risk is defined as a measure of frequency and severity of harm due to a hazard Safety is relative It is a judgment of the acceptability of risk An activity is considered safe if it s risks are considered acceptable Risk by its nature can be considered a rare event

21 Risk Assessment Key Concepts of Risk Understanding A Risk How likely is it to occur? What can happen? What are the impacts? Historic experience Risk Assessment Foundation Analytic methods Knowledge & intuition

22 Risk Assessment Ask Six Questions Risk Assessment What can happen? How likely is it to happen? What are the consequences if it happens? Risk Management What can be done? What are the benefits, costs and risks of each option? What are the impacts of each option on future options?

23 probability combination of an Risk of event R eo, [ P( e) P( o e) V( e, o) ] = For every event and outcome Risk Assessment The Risk Equation r probability of an outcome given that event r the value of that event and outcome pair

24 Risk Assessment Assessing The Risks Example The likely effect of a hazard may, for example, be rated: (1) Major Death or major injury or illness causing long term disability (2) Serious Injuries or illness causing short-term disability (3) Slight All other injuries or illnesses

25 Risk Assessment Assessing The Risks The likelihood of harm may be rated (1) High Where it is certain that harm will occur (2) Medium Where harm will often occur (3) Low Where harm will seldom occur

26 Risk Assessment Assessing The Risks Risk = Severity of Harm x Likelihood of occurrence Computation gives a risk value between 1 and 9 enabling a rough and ready comparison of risks The lower the number, the greater the risk Prioritizes hazards so that control action can be targeted at higher risks

27 Risk Assessment Assessing The Risks

28 Impact/Probability Matrix (or Risk Assessment Matrix (RAM)) Incorrect: Confusing or combining Impact & Probability It is very unlikely, therefore the impact is low Correct: Keep Impact & Probability independent Probability is low, but if it happens, the project will fail; therefore the impact is high

29 Impact/Probability Matrix (or Risk Assessment Matrix (RAM)) A common tool to conduct Risk Assessment for establishing system s Risk Acceptance Combines the two dimensions of a risk ( probability-severity doublet ): Probability of occurrence Its impact if it occurs Serves to: Determine whether a risk is considered low, moderate, or high Prioritizes hazards Determines either acceptability of the risk or appropriate management level to make the risk decision for tolerability

30 Impact/Probability Matrix (or Risk Assessment Matrix (RAM)) The Severity and Probability dimensions of Risk define a Risk Plane The concept of iso-risk contour is useful to provide guides, convention and the Acceptance Limits for Risk Assessment In mathematical terms, the risk curve is the complementary cumulative distribution function (CCDF), i.e., the frequency of exceeding a given consequence severity

31 The Risk Plane (S) (R) Logarithmic scales produces linear iso-risk plots for R=S P=constant Risk is constant along any iso-risk contour (P)

32 RAM Iso-Risk Contour Uses Risk Assessment Convention Risk for a given hazard can be assessed at any severity level Assess risk for the worst credible outcome An iso-risk contour gives the probability at all lesser severity levels Risk Assessment Guides If risk for a given hazard does not display as an isorisk contour, then assess the severity and probability for the Worst Credible Risk Further desirable reduction Risk at Risk at B A Equals

33 The Risk Plane Becomes A Matrix Impact/Probability Matrix

34 The Risk Plane Sample Probability/Impact Matrix Example

35 Typical Impact/Probability Matrix (or Risk Assessment Matrix (RAM))

36 Risk Assessment Assessing The Risks Risk Likelihood (Frequency Codes) based on IEC Frequent Probable Occasional Remote Individual: Occurs repeatedly in career All: Continuous experienced Individual: Occurs often in career All: Occurs frequently Individual: Occurs sometime in career All: Occurs sporadically or several times Individual: Seldom chance of occurrence All: Expected to occur sometime > Improbable Individual: Probably will not occur in career All: Possible but not probable, rare Incredible Individual: Occurs so implausibly as to elicit disbelief All: Not plausible or believable < 10-6

37 Risk Assessment Assessing The Risks Risk Severity (Severity of Consequence Codes) based on IEC Negligible Marginal Critical Catastrophic First aid or minor supportive medical treatment, minor system impairment, minor property damage Minor injury, lost workday accident, compensable injury or illness, minor system damage, minor property damage Permanent partial disability, temporary total disability in excess of 3 months, major system damage, significant property damage Death or permanent total disability, system loss, major property damage

38 Risk Response Strategies The process of developing options and actions to enhance opportunities and to reduce threats to the project objectives Proactive, not reactive Appropriate to significance of risk Cost effective Timely

39 Risk Response Strategies A-T-M Avoidance (A) Taking a conscious decision to apply specific, necessary measures to remove a potential threat by eliminating the cause of the risk Transference (T) The legal assignment of the negative impact of a threat, along with the ownership of the response, from one party to another (e.g., by insurance) Mitigation (M) / Reduction Taking actions to systematically reduce the expected value/probability or impact of an adverse risk to an acceptable threshold through control measures, according to a hierarchy of risk control

40 Acceptance Risk Response Strategies Acceptance Recognizing the existence of a specific risk and accepting the impact of the risk, should it occur Passive acceptance: no action, deal with threats as they occur (workarounds) Active acceptance: establish a contingency reserve to handle risk

41 Risk Response Strategies Probability Low High Passive Acceptance (workaround) A T - M Active Acceptance (A T M) Low Impact Avoidance (A) Transference (T) Mitigation (M)/ Reduction High

42 Total original risk Tolerable risk level Acceptable risk level Risk Treatment Residual risk Category Risk Avoidance Risk Transference Risk Mitigation/ Reduction Risk Acceptance Measures Policy, regulations, land use planning Insurance Technical Measures, Preparedness Living with Risk with or Without caution

43 Cost Benefit Analysis (CBA) Simply put, CBA weighs costs against benefits to help determine the best course of action

44 Risk Acceptability/Tolerance Most Risks have associated benefits, however Overall concept: Severe accidents are not acceptable they should be avoided!!! As severe accidents never have zero probability, some form of acceptance criteria is necessary Even with properly identified hazards, someone may chose to operate outside design limitations a gamble at best!

45 Risk Acceptability/Tolerance The Challenger Disaster The lowest temperature the system had previously experienced was 53ºF and both the primary and secondary component had failed to function as designed. The predicted temperature for operation was approximately 26ºF. data below 53ºF was not available and [my] department could not prove it was unsafe to launch Morton-Thiokol VP of Engineering, STS-51L Accident Investigation, 1986

46 Risk Acceptability/Tolerance The Challenger Disaster O-ring Sealing problems Engineers argued against launch at low temperature Management over-ruled the engineers warnings Shuttle exploded minutes into the flight 7 Lives lost Setbacks to the shuttle program

47 Risk Acceptability/Tolerance The Challenger Disaster Sr. VP to VP Engineering: Take off your engineering hat and put on your management hat... There is a difference between engineers and managers Engineers should adhere to their professional norms and hold safety paramount

48 Risk Acceptability/Tolerance The Challenger Disaster Murphy s Law for Management Technology is dominated by those who manage what they don t understand! Ignoring risk doesn t make the risk go away!

49 Risk Acceptability/Tolerance Governing Safety Using Quantitative Risk Assessment

50 Risk Acceptability/Tolerance

51 Risk Acceptability/Tolerance An acceptable risk is the risk associated with the best of available alternatives, not with the best of alternatives which we would hope to have available

52 Risk Acceptability/Tolerance Factors that Determine Risk Acceptability Personal Political / Social Economic Injustices The process of determining the acceptability of risk can be influenced by those with money and vested interests Setting a $ figure (in cost-benefit analyses) on a human life is considered by many to be unethical and unconscionable Remember the Ford Pinto Engineering Disaster?

53 Factors Influencing Risk Acceptance

54 Risk Acceptability/Tolerance Risk Acceptability Assessment Methods No Go Alternative Accept the Risk Establish a De Minimis Risk Level Risks are so trivial that action to reduce risk generally would be unwarranted Establish a De Manifestis Risk Level Risks are so high that they are manifestly intolerable Perform a Cost-Benefit Analysis (CBA) Perform Cost Effectiveness Choose the Best Choice Among Alternatives

55 Risk Acceptability/Tolerance Acceptability Criteria for Risk Risk levels, risk to individuals, societal risk, voluntary risk and involuntary risk, perception of risk Profound questions of Ethics and philosophy of life What risk is acceptable? What is the value of life? Risk can be minimized at a cost even if can not be completely eliminated How far should one go along this road?

56 Risk Acceptability/Tolerance 5 Steps for Risk Acceptability Assessment Define the alternatives Specify the objectives and measures of effectiveness to indicate the degree to which they are achieved Identify the possible consequences of each alternative Quantify the values for the various consequences Analyze the alternatives to select the best choice Source: Derby, Stephen L., Ralph L. Keeney Risk Analysis: Understanding How Safe Is Safe Enough? Risk Analysis. V.1. No.3. Pp

57 Risk Acceptance Risk-Based Approach IAW IEC Definition safety is the freedom from danger or risk of accidents Absolute: Complete freedom from harm Basic: Freedom from unacceptable risk created by direct physical hazards when equipment is properly used under normal or reasonably foreseeable conditions It is impractical to expect equipment to be absolute safe ( free from risk ) A compliant equipment shall ensure in reality the freedom from unacceptable risks

58 Risk Acceptability/Tolerance You must not say never. That is a lazy slurring-over of the facts. Actually, [risk analysis] predicts only probabilities. A particular event may be infinitesimally probable, but the probability is always greater than zero. Second Foundation (Isaac Asimov) Because

59 Risk Acceptability/Tolerance Murphy is the Patron Saint of Safety Engineers... Everything That Can Go Wrong Sometimes Will Go Wrong!!! Remember Murphy was an OPTIMIST!!!

60 Approaches to Risk-Based Governance Approach A (1-step) Approach B (2-step) Benefits of Approach B: Likelihood Safe, proceed Not safe, can not proceed Consequence Likelihood Consequence Reduces overall risk Accepts greater number of desired actions Defines area of concern for safety professional to reduce risks Go Conduct analysis No Go Go Conduct analysis No Go Analyze, decide Further review Examine risk drivers and reduce Analyze, decide (if obvious) Examine, reduce risk, decide Go

61 USA DoD Actual Concept Higher likelihood ALARP Acceptable with reasonable risk management As Low As Possible (ALAP) Acceptable Significant risk management Risk Region Broadly acceptable Risk Management Requirement None Frequency Broadly acceptable Accept with mitigation Accept with national need ALARP ALAP while meeting the operational requirement ALAP = As Low As Possible ALARP = As Low As Reasonably Possible Consequence More severe Greater undesirability of consequence

62 MIL-STD-882D Risk Acceptance Criteria (RAC) Matrix Mishap Probability Levels (1) Catastrophic Mishap Severity Categories (2) Critical (3) Marginal (4) Negligible (A) Frequent 1A 2A 3A 4A (B) Probable 1B 2B 3B 4B (C) Occasional 1C 2C 3C 4C (D) Remote 1D 2D 3D 4D (E) Improbable 1E 2E 3E 4E Probability per System life Multiplicative factor > 10-1 No limit < 10-6 No limit Injury 1 death Serious injury Minor injury Lost workday Loss of Dollars > $1M Multiplicative factor $200k $1M $10k $200k $2k $10k No limit

63 MIL-STD-882 Risk Acceptance Criteria (RAC)

64 MIL-STD-882 Severity Categories Matrix

65 MIL-STD-882 Probability Levels Matrix

66 Risk Acceptance Matrix The Risk Acceptance Matrix represents the tolerance level for acceptable and unacceptable risks

67 MIL-STD-882 Risk Acceptance Matrix and Authority

68 The Impact/Probability (Risk Assessment) Matrix Zones The Impact/Probability matrix zones indicate areas of: De minimis risk acceptance Strict risk avoidance Both separated by an intermediate zone in which non-mandatory efforts should be devoted to further reducing risk according to As Low as Reasonably Practicable (ALARP)

69 The Impact/Probability (Risk Assessment) Matrix Zones Risk Regions Based on ISO 14971, Fig E.1 Frequent Intolerable (Strictly Unacceptable) Probable Likelihood Occasional Remote Improbable ALARP As Low As Reasonably Practicable Broadly Acceptable Incredible Catastrophic Critical Severity Marginal Negligible

70 Risk Acceptability/Tolerability The ALARP Principle ALARP (As Low As Reasonably Practicable) The level of risk which can be further lowered only by an increment in resource expenditure that cannot be justified by resulting decrement in risk Often identified or verified by formal or subjective application of cost-benefit analysis (CBA) or multi-attribute utility theory A region of risk between strictly acceptable and broadly unacceptable Assumes we know where the acceptable limit is

71 Risk Acceptability/Tolerability The ALARP Principle In the ALARP Range Risk reduction is generally considered because the risks are too high to be neglected, but Risk reduction would be required only if feasible (e.g. cost effective) because the risks are not too high that they are manifestly intolerable

72 Risk Level Intolerable Region The ALARP Region Increasing Individual Risk and Societal Concerns Broadly Tolerable Region Negligible Region Risk Acceptability/Tolerability The ALARP Tolerability Principle Class A Class B $ Class C Class D Risks cannot be justified Acceptable with endorsement of Program Safety Panel only if risk reduction is impracticable Control measures must be introduced for risk reduction to drive residual risk towards the broadly acceptable region If residual risk remains in this region, and society desires the benefit of this activity, the residual risk is tolerable with endorsement of the Program Safety Panel if further risk reduction is impracticable or requires grossly disproportionate action Tolerable with endorsement of the normal project reviews: Level of residual risk is not regarded significant and further effort and resources to reduce risk are likely to be grossly disproportionate to risk reduction achieved

73 Risk Tolerability Criteria/Framework Risk Score Risk Descriptor Extreme All categories of Risk except safety or environment Board Approval Required for Risk Safety and Environmental Risks Intolerable Senior Executive Approval Required 9 Level 2 Manager Approval Required High Moderate Low Risk must be managed in line with the ALARP Principle Risk must be managed in line with the ALARP Principle Risk must be managed in line with the ALARP Principle No approval required but ongoing monitoring and management is required

74 Risk Tolerability Criteria/Framework Hazard Reduction Order Of Preference

75 Risk Acceptance Criteria (RAC) Concept of de-minimis Risk Risks judged to be too small to be of social concern, or to justify use of risk management resources for control A de-minimis risk level of 10-6 (or 1 in a million ) is frequently used by government agencies For increased risk of an adverse effect over a 70 year lifetime in a large population Many times below risks which people face daily A de-minimis risk level of 10-9 (or 1 in a billion ) per operating hour is often used for systems where failure has a credible direct potential for a catastrophic consequence

76 Risk Acceptance Criteria (RAC) Reality Check There is no point in getting into panic about the risks of life until you have compared the risks which worry you with those that don t, but perhaps should. (Lord Rothschild, The Wall Street Journal, 1979)

77 Evaluation of Risk Acceptability Risk acceptability is controversial Acceptability of risk depends on the nature of the risk and on those who may bear it An acceptable level of risk always exists until someone tells you what it is There are levels of risk that people will accept, and other levels that they will not, risk acceptability carries all our social values Report on the inquiry of the Flixborough Accident (*) states: for what is or is not acceptable depends in the end upon current social tolerance and what is regarded as tolerable at one time may well be regarded as intolerable at another. (*) An explosion at a chemical plant close to the village of Flixborough, England, on 1 June It killed 28 people and seriously injured 36.

78 Society/Public Risk Acceptability Society is much less willing to kill people in a single incident than from some factor over time, e.g., car crashes Voluntary risks are those we assume due to some perceived benefit, e.g., smoking, white water rafting. Involuntary risks are imposed on people by decisions made by others or by natural occurrence, e.g., second-hand smoke, and violent storms.

79 Society/Public Risk Acceptability The public takes other considerations into account in determining whether a risk is acceptable: Fair distribution costs/benefits? Risky activity freely chosen? Available alternatives? Some risks can lead to enormous catastrophes, unacceptable, even if low probability Same concerns are shared by risk ethicists

80 Things to Remember IEEE Code of Ethics 1.to accept responsibility in making engineering decisions consistent with the safety, health and welfare of the public, and to disclose promptly factors that might endanger the public or the environment

81 Summary Risk is the potential harm that may arise from some present process or future event A risk probability/impact assessment is used to analyze and prioritize the risks identified in the risk assessment. The risk acceptability/tolerance matrix represents your organization s tolerance level for acceptable and unacceptable risks

82 Things to Remember Murphy s Law for Management Technology is dominated by those who manage what they don t understand!

83

84

85

86 Thank You for your Attention!!!

87 Questions? Comments? Snide Remarks?

88 For Further information: Elya B. Joffe