ACTUAL METHODS ON TECHNOLOGICAL RISK ASSESSMENT

Transcription

1 ACTUAL METHODS ON TECHNOLOGICAL RISK ASSESSMENT Marco Nicola Carcassi First European Summer School on Hydrogen Safety Belfast UK, 15th - 21st August 2006

2 Presentation Outline Technological Risk Categories of technological risk Risk Assessment Levels The Problem of Measure The decision Risk assessment structure Deterministic and Deterministic approach Hazard evaluation methods 2

3 Technological Risk The word risk is currently associated with notions of uncertainty and loss, or damage. Sometimes, as for instance in economics, it is used with an emphasis on uncertainty, other times, as for example in medicine, the emphasis is put on damage. Among the different definitions provided by dictionaries for the word risk,, one is the possibility of damage (OED, p. 1602). This definition is preferable because it includes both the meaning of uncertainty and of damage. Possibility implies uncertainty: not all that is possible is real. 3

4 Technological Risk (cont) Since the second half of the last century, the term risk has been adopted in the field of philosophy, thus becoming a key notion in philosophical theories, such as Existentialism, which have shifted the attention from the category of the real to that of the possible. According to Kierkegaard, man fears the possible, not the real. Moreover, Abbagnano defines risk as the negative aspect of possibility. In the last two decades, the term risk has begun to circulate in scientific, technical and political circles, indicating the negative collateral effects of technology and human productive activities, whether monetary or not. Technological risk corresponds to the negative aspect of the possibilities offered to man by technology. In fact, the industrial society has turned its attention, and tension, from the real to the possible, as the word innovation reveals. 4

5 Total number of Industrial accidents with more than 50 victims ( ) 1986) 25 Number of accidents Slope: 2 accident/ 1 year Slope: 1 accident/ 5 years Year 5

6 Technological and natural risks By natural risks I mean the possibilities of damage to human beings that do not derive from a free human choice. Risks of seismic and meteorological nature are typical examples. By technological risk I mean the risk that directly derives from a human decision. 6

7 Categories of technological risk It is possible to distinguish between various categories of technological risk: time of harmful event continuous or repetitive, occasional or rare time of damage immediate or delayed deterministic or stochastic subjects at risk individual or collective attitude of these subjects towards risk voluntary or involuntary 7

8 RISK ASSESSMENT LEVELS Systemic level Spatial boundary Time boundary Damage Techniques Level 1 PLANT PLANT OPERATION RELEASE reliability FMEA -HAZOP FTA -ETA MARKOV GRAPH DYLAM PETRI NETS Level 2 GEOGRAPHIC AREA PLANT OPERATION CONCENTRATION DISPERSION AND DIFFUSION MODELS Level 3 GEOGRAPHIC AREA WITH TARGETS (MAN, ECOSYSTEM) CONSIDERED ON THE WHOLE PLANT OPERATION ABDSORBED DOSE FROM THE TARGETS METABOLISM AND CIRCULATIO N MODELS Level 4 GEOGRAPHIC AREA WITH TARGETS CONSIDERED AS INDIVIDUAL AND AS SYSTEMS THAT SUFFERS THE DAMAGE LIFETIME OF THE TARGETS AND FUTURE GENERATIONS PRONT AND LATE EFFECTS ON TARGETS BEHAVE VULNERABIL ITY MODELS 8

9 The Problem of Measure The problem of measure lies in finding out rules that allow to use numbers in order to represent the properties of the empiric reality. Risk is possibility of damage. Thus, it entails a problem of measure of two completely different elements: damage and possibility. The knowledge of damage is a knowledge of the same logical level as the knowledge of external empirical reality which is the typical research object of physics. By contrast, the knowledge of the degree of possibility is the knowledge of a knowledge, that is to say a knowledge of a different logical level. 9

10 Measure of Damage Monetary equivalent damage deferred in time. The use of a discount rate may be a solution, but the solution is highly questionable for periods longer than 10 years. Absolute vs Relative measure Incremental values of a given damage and the absolute or gross values. Ordinal and cardinal measure Composition of different types of damage in order to obtain an overall index 10

11 Measure of Possibility The degree of possibility is a quality of the possible event that corresponds to its attributed distance from certainty Probability and the axiom of additivity But for unrepeatable or imprecise events, the judgement on the event, which measures our uncertainty, does not necessarily imply a judgement on the complementary event. 11

12 Measure of Possibility (cont) Several measures of uncertainty called blurred or fuzzy have been formalised, particularly, the measure of plausibility g. This measure includes, as a peculiar case, the measure of additive probability and a blurred measure called measure of possibility. If (Φ)=( 0 g(φ)=0 If Ω = certain event p(ω)=1 e g(ω)=1 If A B=0A p(aub)= p(a)+p(b) g(aub) max(g(a),g(b max(g(a),g(b)) )) if became = then the plausibility became possibility 12

13 The decision The decisional problem is that to face two risk functions, or to compare the risk curve with criteria of tolerability (acceptability). According to the Expected Utility theory if the measure of the consequence of a possible event is supposed to be also the measure of its utility, the distribution is equivalent to the decisional effects, and to its mean value (also called expected value ), namely its barycentre. The definition of risk as probability of an event multiplied by its consequence underlies the acceptance of this theory. The limits of the theory of the decisions of the expected utility are connected with the limits of probability as a measure of uncertainty of frequently repeated events 13

14 The decision (cont) The reality of technological risk can only partially be retraced to the conceptual reference of Expected Utility Theory (gambling, which, in fact, has been the conceptual reference in the development of this theory) When dealing with safety and risk in decisional administrative practices, an approach based on the judgement of the events taken singularly is mainly employed. In other words, a logic of threshold is applied to each event. The so called deterministic approach to safety, which is usually contrasted with the probabilistic approach, leads to consider as reference for the calculations of safety only one possibility and only one event the event considered the worst or the one perceived as plausible, which is defined as design basis accident. This approach, which is most used in practice, has yet to find a formal theorisation analogous to that of the model of the expected utility, developed in centuries of conceptual work. 14

15 Conclusions on technological risk Technological risk is a new reality technological society has to come to terms with. It is a systemic reality, which is neither easy nor immediate to evaluate. Risk assessment is not an algorithm, but a complex cognitive process full of uncertainty. As a result, it is most unlikely that two different evaluators will reach exactly the same results. Convergence and consent on risk assessment depends more on transparency of the processes and methods that generated it, than on precision. In this sense, the techniques that highlight qualitative aspects, in the end, prove to be more relevant than those which produce numeric results. 15

16 Risk assessment structure 16

17 Deterministic approach In the deterministic approach, the evaluation of the risk introduced by an activity / process is made only on the basis of the entity of the consequences, without taking into account the probability of the related events. So, even an event presenting a very low probability of occurrence is evaluated in terms of consequences on the plant, people and/or environment. In other words, a logic of threshold is applied to each event. In this approach, the entity of the consequences are compared to fixed values listed in national regulations or proposed in several standards acceptance criteria. 17

18 Examples of reference damage limit values REFERENCE DAMAGE LIMIT VALUES Fires (stationary thermal load) Bleve / fireball (variable thermal load) Flash-fire (instantaneous thermal load) Explosions (peak overpressure) Damage to equipment / domino effect High lethality 12.5 kw/m 2 Starting value for lethal effect Seveso Directive as it is in IGC Doc 75/01/E/rev force in Italy through the Ministerial Decree of 9th May 2001 Mandatory Not mandatory 12.5 kw/m kw/m 2 7 kw/m kw/m 2 (pain threshold reached after 8s; second decree burns after 20s ) High harm to people 5 kw/m 2 Minor harm to people 3 kw/m 2 No harm 1.6 kw/m 2 Damage to equipment / m (*) domino effect High lethality fireball radius Starting value for lethal 359 kj/m 2 effect High harm to people 200 kj/m 2 Minor harm to people 125 kj/m 2 High lethality LFL Starting value for lethal ½ LFL LFL effect No harm ½ LFL Damage to equipment / 0.3 bar 0.2 bar domino effect High lethality 0.3 bar Starting value for lethal 0.14 bar effect High harm to people 0.07 bar 0.07 bar Minor harm to people 0.03 bar No harm 0.02 bar 18

19 Probabilistic approach The Probabilistic Risk Assessment (PRA) approach is an organised process which answers the following three questions: 1. What can go wrong? 2. How likely is it to happen? 3. What are the consequences? In this approach, not only are the consequences of an incidental/accidental sequence evaluated, but also the frequency of occurrence of such an event. In the probabilistic approach, the risk (probabilities as well as consequences) is evaluated by taking into account some acceptance criteria. These criteria can be related with Individual and Social Risk or with Matrix Acceptability. 19

20 Individual risk criterion Individual risk of fatality is the chance that (in any year) a person who is close to a hazardous facility may die, due to potential accidents in the facility The variation of individual risk around a facility is usually presented on a map in terms of constant risk lines or contours 20

21 Social risk criterion Social (event) risk is the probability that a group of (at least) N persons is killed per year, due to exposure to the effects of an incident with hazardous substances. Societal risk is the total expected number of fatalities in a year due to a hazardous facilities, and is estimated from all possible events that may take place at the facilities. The acceptance criteria are shown in the graphs called FN Curves,, where N is the number of fatalities and F is the cumulative frequency of events with N or more fatalities 21

22 CATEGORY DESCRIPTION 1 < 0.02/year (Not expected to occur during the facility lifetime) /year (Expected to occur no more than once during the facility lifetime) /year (Expected to occur several times during the facility lifetime) 4 > 1/year (Expected to occur more than once in a year) Matrix approach criterion CATEGORY DESCRIPTION 1 < 0.001/year (Less frequent than 1 in 1,000 years) /year (Between 1 in 1,000 and 1 in 100 years) /year (Between 1 in 100 and 1 in 10 years) Frequency Categories 4 > 0.1/year (More frequent than 1 in 10 years) CATEGORY DESCRIPTION 1 < 10-6/year (Less frequent than 1 in 1,000,000 years) (Remote) /year (Between 1 in 1,000,000 and 1 in 10,000 years) (Unlikely) /year (Between 1 in 10,000 and 1 in 100 years) (Moderately Likely) 4 > 0.01/year (More frequent than 1 in 100 years) (Likely) CATEGORY PUBLIC CONSEQUENCES 1 No injury or health effects 2 Minor injury or health effects 3 Injury or moderate health effects Consequence Categories ACTUAL METHODS 4 ON TECHNOLOGICAL RISK Death ASSESSMENT or severe health effects 22

23 Matrix approach criterion (cont) CODE CATEGORY DESCRIPTION Example of risk matrix U Unacceptable Should be mitigated with engineering and/or administrative controls to a risk ranking of C or less within a specified period such as six months. N Not desirable Should be mitigated with engineering and/or administrative controls to risk ranking of C or less within a specified time period such as 12 months. C Conditionally acceptable with controls Should be verified that procedures or controls are in place. A Acceptable as it is No mitigation required. 23

24 ALARP principle Classic ALARP approach New ALARP approach 24

25 Hazard evaluation methods vs. risk assessment procedure s s steps HAZARD EVALUATION PROCEDURES STEPS IN HAZARD EVALUATION PROCESS SAFETY REVIEW CHECKLISTS WHAT IF METHOD RISK INDEX DOW- MOND METHOD HAZARD AND OPERABILITY ANALYSIS" (HAZOP) FAILURE MODES AND EFFECTS ANALYSIS (FMEA) HAZID (HAZARD IDENTIFICATION FAULT TREE ANALYSIS EVENT TREE ANALYSIS identify deviations from good practice identify hazards * * * provides context only estimate worst case consequences provides context only identify opportunities to reduce consequences provides context only provides context only provides context only identify accident initiating events estimate probabilities of initiating events provides context only provides context only identify opportunities to reduce probabilities of initiating events identify accident event sequences and consequences estimate probabilities of event sequences estimate magnitude of consequences of event sequences identify opportunities to reduce probabilities and/or consequences of event sequences quantitative hazard evaluation provides context only 25

26 ACTUAL METHODS ON TECHNOLOGICAL RISK ASSESSMENT THANK YOU FOR YOUR ATTENTION First European Summer School on Hydrogen Safety Belfast UK, 15th - 21st August 2006