Ale BJM — Risk — An Introduction — The Concepts Of Risk Danger And Chance

Risk: an introduction
The concepts of risk,
danger and chance

Ben Ale

First edition published 2009
by Routledge
2 Park Square, Milton Park, Abingdon, Oxon OX14 4RN Simultaneously published in the USA and Canada by Routledge 270 Madison Avenue, New York, NY 10016, USA Routledge is an imprint of the Taylor & Francis Group, an informa business

This edition published in the Taylor & Francis e-Library, 2009.
To purchase your own copy of this or any of Taylor & Francis or Routledge’s collection of thousands of eBooks please go to www.eBookstore.tandf.co.uk.
© 2009 Ben J. M. Ale All rights reserved. No part of this book may be reprinted or reproduced or utilised in any form or by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying and recording, or in any information storage or retrieval system, without permission in writing from the publishers.
The publisher makes no representation, express or implied, with regard to the accuracy of the information contained in this book and cannot accept any legal responsibility or liability for any errors or omissions that may be made.
British Library Cataloguing in Publication Data A catalogue record for this book is available from the British Library Library of Congress Cataloging in Publication Data Ale, Ben J. M.
Risk : an introduction the concepts of risk, danger, and chance / Ben Ale. -1st ed.
p. cm.
Includes bibliographical references and index.
1. Risk management. 2. Decision making. I. Title.
HD61.A418 2009 658.15'5--dc22 2008044873 ISBN 0-203-87912-0 Master e-book ISBN

ISBN10: 0-415-49089-8 (hbk)
ISBN10: 0-415-49090-1 (pbk) ISBN10: 0-203-87912-0 (ebk) ISBN13: 978-0-415-49089-4 (hbk) ISBN13: 978-0-415-49090-0 (pbk) ISBN13: 978-0-203-87912-2 (ebk)

Contents

List of tables and figures
Preface

vii
x

Chapter 1 Introduction: what is risk?

1

Introduction
Why we take risks
The essence of risk Safety science Security and safety Technological risk Risk science defined

1
3
4
8
12
13
14

Chapter 2 Modelling risk
Cause and consequence Probability Systems and interfaces

Chapter 3 The systems approach
The system
The intestines Using the system to find scenarios Life cycle Mitigation Quantified Risk Assessment

Chapter 4 Managing risk
The development of an accident Management of risk T.O.C.: Unsafe acts and unsafe design

16
16
18
20

29
29
31
36
53
54
61

62
62
69
77

v

Chapter 5 Risky information: the difference
between data and knowledge

85

Occupational accidents
Aviation
CFIT
Human error probability No data but still knowledge

85
90
91
95
96

Chapter 6 Risk and decision-making

vi

99

Taking risks
Risk metrics
Risk acceptability and criteria Cost–benefit analysis Setting standards Framing Nuclear waste Discourse Risky decisions

99
107
110
112
115
120
121
122
123

References
Index

125
133

LIST OF TABLES AND FIGURES
Tables
Table 1.1

Risk of using a ladder

12

Table 2.1

Test results for 1,000 patients

20

Table 5.1

Occupational accidents in the Netherlands, 2004

86

Table 5.2

Occupational accidents in Belgium, 2004

86

Table 5.3

Number of casualties for selected accident classes in the Netherlands, 2004

88

Table 5.4

Mortality of certain activities in the Netherlands

89

Table 6.1

Probabilities of death and probabilities
of winning certain lotteries

102

Table 6.2

A preliminary catalogue of the cost of saving life

Table 6.3

Building restrictions in relation to LPG fuel stations

113–14
118

Figures
Figure 1.1

Maslow’s hierarchy of human needs

3

Figure 1.2

Page 467 of Arnaud’s book La Logique ou l’art de penser

5

Figure 1.3

Steps in the risk management cycle

6

Figure 1.4

Risks divided according to their consequences and probabilities

13

Figure 1.5

Number of natural and health disasters reported in the world

14

Figure 2.1

When we want to intervene, a consequence has to have a cause

Figure 2.2

A car light system

17

Figure 2.3

The car–road–driver–light system

21

17

Figure 2.4

The Man, Technology, Environment system

22

Figure 2.5

The domino metaphor

24

Figure 2.6

The hazard–barrier–target model

24

Figure 2.7

Pictorial model of road accident causation

25

Figure 2.8

Swiss cheese model

25

Figure 2.9

Schematic of a nuclear power plant

26

Figure 2.10

Preconditions and latent failures

27

Figure 2.11

Functional resonance model

28

Figure 3.1

Vehicles are part of a transport company (system) and a transport network (system)

30

Figure 3.2

Black box

31

Figure 3.3

Process, input, output, management

35

vii

Figure 3.4

The student as a system

Figure 3.5

Fault tree for light failure

39

Figure 3.6

Example event tree from the Causal model for
Air Transport Safety (CATS)

40

Figure 3.7

Some symbols used in the drawing of fault trees

42

Figure 3.8

Simple fault tree

43

Figure 3.9

Part of the possible consequence tree resulting from the failure of a car light

44

Figure 3.10

Consequence tree from the CATS study for a
controlled flight into the ground accident

45

Figure 3.11

Multistate logic in a consequence tree

45

Figure 3.12

Simple event tree

46

Figure 3.13

Risk calculation: scheme in principle

47

Figure 3.14

The basic bow tie diagram

49

Figure 3.15

Bow tie diagram for falls from ladders

50

Figure 3.16

The simplest belief net

51

Figure 3.17

Bayesian belief net (BBN) for mixed-approach
execution from CATS

52

Figure 3.18

The probability of failure depends on age: the bathtub curve

53

Figure 3.19

Dynamics of unmanageable and manageable scenarios

56

Figure 3.20

Overlap between different stages of evacuation

58

Figure 3.21

Line of best fit through evacuation data points

59

Figure 4.1

Example of an accident model

63

Figure 4.2

A static barrier does not need a transitional area

65

Figure 4.3

Dynamic barrier

65

Figure 4.4

Safe zone–danger zone personal protection: machines

66

Figure 4.5

Safe envelope for a ladder

66

Figure 4.6

Safe envelope for a bridge

68

Figure 4.7

Safe envelope for an edge

68

Figure 4.8

The four barrier tasks

69

Figure 4.9

Dynamic barrier control cycle

74

Figure 4.10

Event tree for a control cycle

75

Figure 4.11

The four layers in the IRISK risk control system

76

Figure 4.12

Control as a process involving judgement

77

Figure 4.13

Barrier and AND gate equivalence

78

Figure 4.14

Life cycle of a system

78

Figure 4.15

Partly collapsed passenger terminal at Charles de Gaulle Airport, Paris

79

Levels of civilization of an organisation and its people

81

Figure 4.16

viii

35

Figure 4.17

The safety system of a bank, and the barrier involved

83

Figure 5.1

Probability of death per year of activity for workers in the Netherlands

89

Figure 5.2

Distribution of accidents among accident categories

91

Figure 5.3

Effect of ground proximity warning system

92

Figure 5.4

The hockey stick curve

93

Figure 6.1

Risk characterization elements

101

Figure 6.2

Scale of awfulness

103

Figure 6.3

The ‘big thunder’ of Delft, 1654

104

Figure 6.4

Risk matrix

107

Figure 6.5

FN curve and expectation value

109

Figure 6.6

Risk limits in the Netherlands

117

Figure 6.7

Risk limits from the province of Groningen

119

Figure 6.8

What has happened in the past 10,000 years

122

ix

PREFACE
For years the course on Safety Science or Risk Science at Delft University has been given from overheads and Microsoft PowerPoint files. No written course notes were developed after the early 1980s. The people for whom the courses were and are given are usually complete novices both in the concepts of risk and decision making and in the associated mathematics and other methodologies. This leads to the question of where to begin.
The concept of risk is not very new. Its earliest mention is over two millennia old, and the concepts of probability and consequence were developed in the seventeenth century. However, probability in particular proves difficult to grasp. And as safety and risk are close to our heart, it is difficult to separate science and technology from emotion. In fact, this difficulty has developed into a field of science in its own right.
This book provides an introduction to the field. Some concepts are worked out in more detail, either because relevant material is difficult to find elsewhere or because it illustrates the point. On other occasions – in particular, for the more fundamental underlying mathematics – the reader is referred to other literature.
Many people have helped develop the material and ideas in this book.
Special thanks are due to Linda Bellamy, who over the past 20 years has sorted out many data problems that supported the further development of risk analysis methodology, as well as my English; Roger Cooke and Dorotha Kurowicka, who converted Bayesian belief nets into a usable analysis tool; Andrew Hale, whose chair I was allowed to take, which led to the need for course material and this book; and Ioannis Papazoglou, who sticks to justifiable mathematics, and rightly so.
Finally, very special thanks are due to Marga van der Toorn, my wife, who saw many holiday days become working days, but kept her cool.

x

1

Introduction: what is risk?

Risk is everywhere and always has been. Although industrial risks, environmental risks and health risks seem new, they have been around since the origin of humankind. Human beings have always tried to be safe; that is, to maximize their safety, or at least the feeling of safety. Therefore, the aim has always been to minimize risks and manage them where possible. Safety and risk are like conjoined twins; they cannot be separated. Safety is related to the absence of risk, but risk does not have to be absent for a situation to be called safe. The risks of modern technological society can be managed by using the means society has developed.
But today the decision to reduce risk is political in principle, just as it always has been. This means that decisions about activities, and especially risky ones, always involve what we think about society, about the value of human life, about democracy, about ourselves – in short, values. In many instances, these other values and opinions are in the end much more important for the decision than the risk. This, however, does not take away the need to get the science right.
Therefore, this book is primarily about risk. The first step in understanding decisions about risk is to understand risk itself. In the final chapter of this book we shall look at decision making and at what is involved in what is called risk governance.
Many of the examples in this book involve risks to human life and health. Decisions on risks involving life and death are much closer to our heart than decisions about money, and examples from this area are more enlightening about the problem that a risk analyst, assessor, manager or governor is facing, but we shall see that the concept of risk is everywhere.

INTRODUCTION
It is said that modern society is a risk society (Beck, 1986). And indeed some risks are new. Moreover, because of the global connectivity of our societies, many risks are shared by all of us. Even so, many risks in former times were just as dangerous to the society they threatened. They constituted a threat to the whole of the known world, and all known societies were exposed to the danger. For example, between 1347 and 1350 the Black Death wiped out one-third of the population of Europe (www.20eeuwennederland.nl). In the seventeenth century the average life expectancy was 25 years, and to reach

1

Risk: an introduction

the age of 45 was exceptional. As recently as 1918 the Spanish flu killed 170,000 people in the Netherlands alone.
What now is called industrial risk also has roots in the past. Pliny the Younger described illnesses among slaves (Ramazzini, 1700). In 1472, Dr U. Ellenbog of Augsburg wrote an eight-page note on the hazards of silver, mercury and lead vapours (Rozen, 1976). Ailments of the lungs found in miners were described extensively by Georg Bauer, writing under the name Agricola (1556). In the seventeenth century a significant proportion of the crews of ships sailing to the East and West Indies never made it home.
The Netherlands has a long history of having to deal with the threat of floods. In the Middle Ages, several groups, such as Huguenots and Jews, fled to the Netherlands because of oppression by the government of their home country. These people descended from the Central European Plain into the Low Countries, the swamp that is now the Netherlands. For a long time, the only authorities that were accepted were the ‘water boards’. These were deemed necessary to manage the flood defences. The oldest water boards were those of Schieland (1273), Rijnland (1286) and Delfland (1319). Today the Netherlands has 478 people per square kilometre, making it one of the most densely populated areas in the world, and houses the harbour of Rotterdam, Schiphol Airport and a third of the refinery capacity of Europe, and hence managing the risks resulting from the close proximity of people and industry has become just as important an activity as managing the risks of flooding.
Attempts to avoid unnecessary risk have also been part of human activities for as long as history has been written. Those who had something to lose surrounded themselves and their possessions with walls, castles, guards and armies. Those who had enough money left the city to escape the plague (Chaucer, writing in the fourteenth century). And societies have long put people into power, for example a king, in order to protect them from harm.
Nevertheless, it is true that worldwide and in absolute numbers the number of disasters and the associated costs have increased. At the same time, the population of the earth is increasing, suggesting that people are increasingly living in less and less suitable locations (OECD, 2003).
This raises the question of why risk management looks so different today and why we have so much difficulty in formulating an organized policy on risk, whether we are in public office, in government or in private enterprise. To understand the reason, we have to understand risk and why we sometimes gladly take risks and at other times seek to avoid risk. We have to understand how to measure and assess risk. We need to have a knowledge of risk assessment methodologies in order to understand the genesis of accidents and to be able to devise strategies to eliminate them or reduce the probability of their occurring. We have to understand the forces involved in the debate about risks and we have to understand the mechanics of making decisions concerning risk. Therefore, we need to be aware of the development of risk perception research and findings, and we have to

2

Introduction: what is risk?

have insight into the many value-laden choices that people make. Which means that a study of risk is, in many ways, a study about ourselves.
The risks discussed so far are concerned directly with life, health or death. There are many other kinds of risks, such as losing money in a casino or on the stock exchange, or the destruction of crops by bad weather. We shall see that the techniques of analysing, characterizing and managing these risks are common to all these types of risks. But the risks that are most widely discussed and debated are those associated with a threat to our own health. And even if it seems to be ‘only money’, we do become really interested if there is a threat to the money we use to buy food and shelter.
Therefore, most of the examples in the following will have to do with life and death. But lesser risks will be referred to as well.

WHY WE TAKE RISKS
With the possible exception of those who are ‘thrill seekers’, we rarely take risks for the sake of it. We accept risks as part of an activity we undertake – an activity we undertake because we have to or want to.
Some activities are necessary. We have to eat. Therefore, we have to acquire food and drink. In prehistoric times we would go hunting in forests and on plains inhabited by creatures that would try to eat us before we could eat them.
Only for some 5,000 years or so have we obtained our food by farming.
But farming is itself not without dangers. Today we use machines, build houses, mingle with traffic as drivers or pedestrians, use refineries, build chemical plants and use nuclear power.
Today, most of our activities do not seem to have a direct relationship with survival. But still, no money, no food. So, the act of earning money, whether in agriculture or in a chemical factory, ultimately is earning the means of living.
Human needs and wants can be divided into several layers or classes.
Maslow (1943) conceived these as taking the form of a mountain or pyramid (Figure 1.1). The base of the pyramid represents our needs for survival and Figure 1.1 Maslow’s hierarchy of human needs Self-fulfilment Esteem Belonging Safety Food and drink Source: Adapted from Maslow (1954)

3

Risk: an introduction

the top represents what Maslow thought were the higher needs of humankind: esteem by others and self-fulfilment. To fulfil our needs we use technology. Unfortunately, we humans are far from perfect, and so is our technology. Failures of ourselves and of our technology infringe on the needs of other people to fulfil their needs and wants. This is usually not what we want ourselves. Therefore, these failures are called unwanted side effects or unwanted effects. Since these unwanted effects may bring us into conflict with other people, we want to prevent them. And if we cannot prevent them, we at least try to minimize them and perhaps recognize the need to compensate other people for any damage or nuisance we have inflicted on them.
Interestingly, in the overwhelming majority of cases, failures of ourselves or our technology harm only ourselves. Usually there is not even any damage to our health or any danger to our lives. Most failures merely mean that the technology or the system we are using fails to work. We have already seen some examples of how we can investigate what the consequences of failure could be, but sometimes it is extremely simple: if a car does fail (that is it, as long as it is not hit by another car) it just sits there and we complain. If an aircraft stops working, it falls to the ground. Gravity takes care of that. A crashing plane, by contrast, is usually bad news for anybody who is in it; it means something much worse than just not being able to get home on time. Reliability has to do with both cases; safety only with the latter. Clearly, whether a failure is a safety issue is a matter of what sort of failure in what system.

THE ESSENCE OF RISK
The essence of risk was formulated by A. Arnaud as early as 1662 (Figure 1.2): ‘Fear of harm ought to be proportional not merely to the gravity of the harm, but also to the probability of the event.’ The essence of risk lies in the aspect of probability, chance, uncertainty.
Even the most hazardous system or the most dangerous activity is not certain to bring us harm or death. Only one activity will definitely get us killed, and this is an activity that we would normally consider quite safe: living itself. Note that Arnaud treats probability more as a certainty than as an uncertainty and as, in principle, measurable. Many who have followed him have done the same. Allan H. Willett (1901) defined risk as ‘The objectified uncertainty regarding the occurrence of an undesired event’ and Frank Knight (1921) as ‘measurable uncertainty’.
There are many risks that do not involve human life or health or the state of the environment. In many cases the stakes are of a different nature.
In the financial markets, risk is usually associated with losing money as a consequence of investments turning bad, mortgages not being paid back or fraudulent bookkeeping. In construction the risks are associated with, say, completing a railway on time and within budget.

4

Introduction: what is risk?

Figure 1.2 Page 467 of Arnaud’s book La Logique ou l’art de penser

Source: Gallica (www.gallica.brf.fr)

All these examples have in common that the outcome of an action, a decision or an activity is uncertain – sometimes more uncertain than at other times. In order to deal with uncertainty in an organized way, we use the concept of probability. Probability is the chance that something will happen. Probability can be calculated, estimated, judged, believed in.
Uncertainty and our judgement of it play an all-important role in the way we deal with hazards and risk. Organized, institutional dealing with risk is also referred to as risk management.
Risk therefore is a combination of consequences and probabilities. In Arnaud’s view the true measure of risk is the product, in a mathematical sense, of probability and consequence. Risk is chance multiplied by effect – what in mathematical terms is designated the expectation of the consequences. We shall see that decisions that follow Arnaud’s rule in having the acceptability of an activity directly proportional to this measure of risk are common in economics. However, the more contentious decisions – and these are often related to issues of life and death – do not seem to follow this rule. Many attempts have been made to capture apparently different relationships between acceptability, probability and consequence. We shall see some later.

5

Risk: an introduction

The magnitude of risk
Arnaud mainly performed risk analysis, comparison and decision making in relation to the Casino of Paris, so he was not too concerned with societal and political discussions. In particular, discussions about the use of nuclear power, about the risks of chemical industry and the associated transport of hazardous chemicals, and about the long-term effects of human activities on climate have shown that decision making is often to do with more than consequence and probability alone (Gezondheidsraad, 1993). As we shall see, there are many factors besides these that influence the decision. Therefore, the process of risk management can be summarized as in Figure 1.3 (van Leeuwen and Hermens, 1995).
After identification of all the potential adverse events, the probabilities and consequences are modelled and quantified. The risks are also qualified.
Qualification in this context means establishing other attributes of the activity with which the risk is associated and which are important for the decision to undertake the activity. These attributes are often value laden, especially when the risk involves potential harm to human life or health. Although it may seem that establishing the magnitude of risk is value free, it often is not, because, as we shall see later, the way this magnitude is expressed may itself contribute to the framing of the decision. After this work has been done, the information is ready for use in a decision-making process. After it has been decided whether the risk is acceptable or has to be reduced, the risk is monitored and a new cycle may start, depending on whether the risk still seems acceptable or not.
Figure 1.3 Steps in the risk management cycle

Identification

Quantification
Consequences
and Probabilities

Qualification
Kind of risk

Decision

Reduction
(when required)

Monitor

6

Introduction: what is risk?

Although decision is only one of the blocks in Figure 1.3, it is making the decision that usually takes the most time and requires the most discussion.
In real life the risk management process is not as clear-cut as the schematic diagram suggests. As has been said, value judgements are often made in the steps where information is assembled, and in this way the gathering and presentation of information becomes a part of the decision making. In real life, however, the people who gather and assemble the information are more often than not different from the people who make decisions. The information is often gathered by consultants and advisers. The decision is often taken by policy makers and politicians. At least, in a democracy we expect elected politicians to make these decisions. Therefore, everybody involved in risk management needs to be conscious of his or her own value judgements and how they influence the outcome of the process, and must try to keep the real decision making where it belongs. As Harry Otway (1973, 1975) put it:
Risk estimation may be thought of as the identification of consequences of a decision and the subsequent estimation of the magnitude of associated risks. Risk evaluation is the complex process of anticipating the social response to risks … this could be termed as the ‘acceptability of risks’.
We could also make a distinction between risk management and risk governance. Risk management may be thought of as keeping risk within defined limits against defined costs. Risk governance includes the process by which we deal with a problem that involves risk, but also many other things.

Risk and expectation
As we have seen, in its simplest form the magnitude of risk is the total value of the expected outcomes, probability multiplied by consequence:
R=pxc So, if the prize in a lottery is A1 million and the probability of winning it is 1 in a million, then the value of the risk is R = p x c = 1,000,000 x 0.000001 = 1 Such an expectation can be used to judge whether it is worthwhile to buy a lottery ticket. If the ticket is more expensive than the value of the prize, we could decide not to buy the ticket. Later we shall see that in practice it is not as simple as that. But in this case the cost–benefit relationship is straightforward.
In a real lottery, however, there is not one prize, but a range of prizes. If the probability of winning any one of these prizes were the same, the value of the prizes could be calculated in the same way as the expectation value of the throws of a dice. This is calculated by summing the values of the separate prizes or outcomes, that is, the magnitude of the outcome multiplied by the probability.

7

Risk: an introduction

A dice has six faces, numbered 1 to 6, and the probability of throwing any one of these numbers is 1/6. Thus, the value of the ‘risk’ is

Σ

Σ
6

6

R=

Pi × ci =

i=l

1

/6i = (1 + 2 + 3 + 4 + 5 + 6)/6 = 3.5

i=l

If the probabilities for the different outcomes are different, then the risk in general is

Σ
6

R=

Pi × ci

i=l

This definition of the value of risk is used in finance and insurance. Using this definition of the risk magnitude in decision making means assuming that probability and consequence are the only two dimensions that are important in the decision. As was mentioned earlier, in many instances this is not the case.

Immeasurable risk
Now suppose we are confronted with a risk that cannot be measured, for instance the risks associated with global warming. Global warming presents a tricky problem for the management of risk. We cannot really assemble data on the effects before they take place, and we cannot assemble data on the probability either. The reason is very simple: there is only one earth and we cannot go back in time. So, probability in the frequency sense is not an issue here. When and if certain effects take place, there will be absolute certainty: the effects will have taken place. And before that there is only probability in the true Bayesian sense: a degree of belief that certain negative – or positive – effects will result from our activities. The degree of belief may be increased by factual information, but it remains a belief.
In such cases, where the ‘proof’ by mathematics or by experiment is impossible in principle, decision making is much more difficult, and having a decision implemented if the cooperation of non-believers is involved is more difficult still. In the absence of actual facts, values and interests dominate the decision-making process. When involved in a decision-making problem, a wise scientist always first tries to assess whether the problem is about risk or about uncertainty and fundamental absence of knowledge.
The former problem can be dealt with by science, the latter only by discussion and conviction. Or crusade.

SAFETY SCIENCE
Safety science deals with risk problems. Risk problems can be assessed and explained. Risk can be studied, analysed, prevented and managed. There are technologies and methodologies that can be used and applied.
Risk problems are never isolated. They have a context in society and in law. There is policy and planning.

8

Introduction: what is risk?

Risk science is all about choices, and the methods and tools to make these choices.
After their introductory course the student who uses this book as his or her course material will:
●

●

●

●

●

know how to explain what sort of risk problem is at hand, and how serious it is;
know what the principles of studying, analysing, preventing and managing risk problems are;
be able to describe and use available safety methods, methodologies and techniques;
be able to describe the legal and societal framework in which safety policy and planning occur;
understand the role of beliefs, values and perceptions in decisionmaking processes.

Risk is, in a way, the opposite of safety, but not its exact opposite, as we shall see. But the conjoined twin of risk is so important that we have to discuss safety a little more first.

What is Safety?
Everybody knows how it feels to feel safe – and how uncomfortable it feels to be in danger, to feel threatened. Yet nobody really knows what safety is.
Safety is something like not being in danger, just as health is the absence of illness. Safety, health and the environment are generally considered as things worth protecting and cherishing. They are ‘good’ things. As I have said, safety is very dear to our heart. It is considered one of our basic needs, just after food and drink (Maslow, 1943, 1954). We never can have enough of it.
And that is where the problem starts. The quest for safety can come into conflict with one of our other basic needs, or with the needs of others. And suddenly we need a way to decide, to choose. And thus we need a way to measure. And we cannot, because we do not know what safety really is.
Therefore, we cannot answer the question ‘how safe is safe enough?’ other than by saying ‘when we feel safe’. Such an answer leads to obvious problems if decisions are to be taken by people other than ourselves or if our need to feel safe can only be satisfied by others. When have they done enough?
And what if doing ‘enough’ infringes on their needs? And what if you feel safe but your neighbour does not, and making the neighbour feel safe costs YOU money. Again, what if your neighbour wants to do something that makes YOU feel unsafe? The neighbour gets the money and you the danger.
Should the neighbour stop? Or should he or she give you money? Because feeling safe is so important, and there are so many things that make us feel unsafe, safety, like health and the environment, is the subject of public debate, societal processes and political decision making. We cannot be safety scientists without looking at these processes.

9

Risk: an introduction

If we Google ‘safety’, the free dictionary comes up with the following definition:
SAFETY is the condition of being safe, freedom from danger, risk, or injury.
The first part of this definition is not very helpful: safety is to be safe; we know that. The second part is more interesting: freedom from danger, risk or injury. These three, danger, risk or injury, can be defined in ‘operational terms’. This is important, because using operational terms means that we can observe, measure and thus weigh. And as soon as we can measure and weigh, we can choose and decide.
Danger and injury are different from risk – and for decision making the difference is important.

Danger
Danger is also called hazard or threat. Dangers are the things that make us feel unsafe. The world is full of dangers. These dangers are associated with activities: our own and those of others. Examples of these activities are ● ● ● ● ● ● ●

●
●
●
●
●

driving a car
transporting fuel and chemicals
having a supertanker full of oil cross the ocean producing chemicals storing chemicals having a nuclear power plant flying – being in an aircraft – having aircraft flying over our head pollution of the sea burning fuel (and producing gases that result in global warming) storing fireworks DIY going up and down stairs or ladders.

Such a list makes one wonder how anyone can ever feel safe. In order for us to feel safe, we have to keep these hazards under control – not only the big, spectacular hazards on a national or world scale, such as tsunamis and chemical disasters, but also the small, everyday hazards.
Dangers or hazards have two properties or dimensions that need to be considered:
● ●

What is the nature of the potential damage?
How bad is it?

As an example, consider standing on a ladder (Ale, 2006). The hazard is falling from the ladder to the ground. Depending on the height, you may be

10

Introduction: what is risk?

injured or killed if you fall. So, the nature of the damage is mechanical damage to your body, and that damage can be bad enough to cause death.
As another example, consider having a chemical plant using methyl isocyanate. This chemical is a vapour that causes chemical burns when in contact with the mucous membranes of our body. Mucous membranes are the moist surfaces of our body such as the cornea and the inner lining of our lungs. Attacking these leads to blindness and to oedema of the lungs. The latter can be lethal. In 1984 in Bhopal in India a few tons of this chemical was released from a pesticide plant to the atmosphere. Three thousand people were killed and 200,000 injured, many of whom died later (Bahwar and Trehan, 1984). This example clearly demonstrates the hazards associated with the use of certain chemicals.
The description of the hazard associated with the use of a ladder already hints at the problem with using hazard as the basis for making a decision. What should be the determining consequence in our decision?
Breaking some bone, or death? Or the fact that we mostly survive the use of a ladder in one – undamaged – piece?

Injury
An injury is physical damage to the body, such as broken bones, wounds, or burns from chemicals or heat. Injury is different from illness. Illness is a malfunction of the body not caused by physical damage. Illness is caused by bacteria, viruses, bad food, insufficient or excessive food, an unhealthy lifestyle, etc. Preventing and curing illness is often considered part of healthcare rather than of safety science. However, the probability of contracting these illnesses is a risk, just as for any of the risks mentioned earlier, and therefore health risks can be managed via similar processes.

Risk
Risk is the entity that is mostly used in managing hazards, dangers and injury.
Keeping hazards and injury under control is called risk management. Systems designed to manage risk are often called safety management systems (SMS).
Risk has two dimensions: extent of consequence and probability of occurrence. This gives us the possibility of solving the problem that we encountered with the ladder example. Rather than considering only one possible consequence, we consider the whole range of possible outcomes of our activities – the use of a ladder is an example – together with their probability. We can then see that not having an injury at all is the most probable outcome. Even when we do have a fall, the probability of survival is still very high, as can be seen from Table 1.1 (Papazoglou et al., 2006). The decision to use a ladder may, in this light, be driven more by the probability of survival than by the seriousness of the most adverse consequence: death. Similarly, the large policy decisions

11

Risk: an introduction

Table 1.1 Risk of using a ladder
Consequences

Probablility

None

Once in 1 year

Recoverable injury

Once in 1,724,137 years

Permanent injury

Once in 3,571,428 years

Death

Once in 55,555,555 years

such as on the siting of chemical industries or the growth of air traffic are made considering the whole range of consequences and probabilities.
The concept of risk is not confined to questions of life and death. It is similarly useful in the area of financial risk management (McCarthy and Flynn, 2004). In fact, it was in economics – and in the casino – that many of our ideas about risk and risk management originated. But debates about decisions involving life and death are often much more heated, and the issues are considered much more political, whereas decisions involving financial risks are considered to be far more of a technical nature. As we shall see later, decisions are never really based on consequence alone. There is always some element of probability in the decision.

SECURITY AND SAFETY
Although ‘security’ as a word has a similar meaning to ‘safety’ and there is hardly any difference between feeling secure and feeling safe, in the practice of risk management these two terms have different meanings. Safety is used when the threat is an unwanted side effect of something else we want.
Safety thus is associated with incidents and accidents. Security deals with malicious acts, such as sabotage and terrorism.
There is a grey area, however, where the distinction between security and safety, between accident and criminal act, is difficult to draw. This is where accidents are the result of management decisions or decisions of government. The decision not to stop the storage of fireworks in the city of Enschede ultimately cost 22 lives (Ale, 2001) and caused half a billion euros worth of damage. Is that an accident, an unwanted side effect of a desired activity, or was it the result of criminal negligence?
In these areas, safety, security, politics and law form a complicated union that the safety scientist needs to understand in order to carry out his or her job responsibly. This understanding also helps to give an insight into the limitations of safety science and the safety scientist in influencing decisions. It helps therefore to take a position based in science and in ethics. As I have already pointed out, pursuing safety can have a negative impact on other things people pursue, such as health and wealth. The playing field of risk decisions is seldom level, and the safety scientist has to find a position in this field.

12

Introduction: what is risk?

TECHNOLOGICAL RISK
Technological risk is present wherever systems are operating in which technology and people interact. Sometimes the risk is to people operating the machines and equipment, where they are using technology to achieve a particular goal. Sometimes it is because the activity is located near to so-called third parties. Third parties are people who do not take part in the activity but are exposed to the risks. These could, for example, be people living around a facility, or near a route used for the transportation of chemicals or fuels; people living under the flight paths of an airport; or people who work in the office of a chemical factory. It could also be passengers using a particular means of transport, or pedestrians.
Technological risks are only one kind of the risk humankind has to face. Figure 1.4 classifies many common risks according to the extent of the damage they involve and the probability of their occurrence.
The major technological risks associated with explosions, toxic clouds, etc. are located in the right-hand bottom corner of the figure. As can be seen, there are risks for which the probability of an event is much larger, such as traffic accidents and accidents in the workplace such as falls. Famines and epidemics are still the causes responsible for the majority of untimely deaths, followed by floods, earthquakes and war (Nash, 1976). Famines and epidemics occur much more often than technological disasters. These sorts of events tend to have larger consequences, with numbers of victims in the order of tens of thousands. Wars and conflicts sometimes result in millions of victims. The events that the safety scientist deals with are those which have a technological edge. It is the use or misuse of technology that creates a situation in which lives can be at stake. Safety scientists should be aware that their problems may be judged minor with respect to other risks. On the other hand, their problems may have widespread political and societal consequences. These varying opinions will be investigated in chapter 6.
Figure 1.4 Risks divided according to their consequences and probabilities

Probability

Large
Traffic
Falls
Smoking
Skiing

Famines
Epidemics
Earthquakes
Floods

Bee-sting
Lightning

Explosions
Toxic clouds
Falling aircraft
(Floods)

Small
Consequences

13

Risk: an introduction

Figure 1.5 Number of natural and health disasters reported in the world 400 350 300 250 200 150 100 50 0 1950

1960

1970

1980

1990

2000

Source: The OFRA-CRED database

In any case, there is a continuous stream of man-made accidents with many victims, only some of which are caused by intentional malicious acts.
Most accidents genuinely are accidental.
There has been a continual stream of accidental explosions: Delft (1654; 1,500 casualties), Leiden (1807; 51 casualties (NN, 1933)), Oppau (1921, 600 casualties (Nash, 1976)), Enschede (2000, 21 casualties (Ale, 2001)). Aircraft accidentally crash into inhabited areas such as Amsterdam (1993 (www.aviation-safety.net)), Turin (1996), Kinshasa (1996) and the crash in New York in November 2001, which because of the events of 9/11 almost became obscure.
Also, trains crash into each other and into buildings. Accidents such as those in Harmelen (1962) (Jongerius, 1993), Ladbroke Grove in London (1999) (HSE, 2000) and Tokyo (2005 (www.cnn.com)) subsequently led to new policies, and to new measures being taken to enhance safety.
In the world as a whole the frequency and size of disasters are increasing (OECD, 2003), as Figure 5 shows.

RISK SCIENCE DEFINED
Risk science is the study of the threats posed to humankind and the environment by technological systems many of which human beings are a part. Risk science tries to find explanations for the occurrence of unwanted events. From these it tries to make models of these systems with the focus on describing the risk, which helps to predict the future behaviour of the systems and helps those involved to find measures to reduce the risks posed by these systems.

14

Introduction: what is risk?

Risk science also deals with how judgements about the acceptability of risks, on criteria, norms and standards, come about and how policy decisions are made and justified. Risk science aims at making knowledge and insights operational in managing risks and limiting avoidable damage, with the aim of improving life and making people safe (and making them feel safe).
The relationship between safety science and risk science is even closer than that of conjoined twins. They are one and the same.

15

2

Modelling risk

In this chapter we concentrate on establishing the magnitude of risk. To do so, we will at some point need a risk metric or metrics. The choice of metrics is not necessarily value free, as we have already seen. Some people believe that risk cannot be measured at all. In this chapter we shall take risk as being measurable, at least in principle, however.
As we have seen in the previous chapter, risk has two dimensions, extent of the consequences and probability of the risk’s occurrence. This makes it difficult to observe or measure risk directly. If there is a chance that something bad can happen, there is a certainty that it will happen, sooner or later. This certainty is also called ‘Murphy’s law’:
If anything can go wrong, it will.
We just do not know when. And if the probability is small, maybe we will not actually see it happen in our lifetime. In such a case the uncertainty about when is so large that from the point of view of a human, the uncertainty about when it will happen is virtually the same as uncertainty about whether it will happen at all. In the case of such large uncertainties and the impossibility of gaining sufficient information from direct observation, we need models.
We need models even more when we want to predict in advance the result of an intervention we are considering making in the flow of events.

Murphy’s law
Murphy’s law originated at Edwards Air Force Base in 1949. Captain Edward A Murphy was heading a team. When one of his technicians made a mistake, Murphy was reported to have said, ‘If there is any way to do it wrong, he’ll find it.’ This law was later rephrased to the formulation that currently is known as Murphy’s law: ‘If anything can go wrong, it will.’

CAUSE AND CONSEQUENCE
If we need to do something about the possibility that certain events will take place, we have to assume that there is something we can do. We have therefore to assume that an unwanted event – once it has happened – has a cause and that we can intervene between cause and effect (Figure 2.1).

16

Modelling risk

Figure 2.1 When we want to intervene, a consequence has to have a cause Cause

Consequence

Intervention?

This is an important assumption, because causes are also events, and therefore this assumption implies that we can follow back in time the trace of consequences and causes endlessly. This notion is even the basis of Einstein’s theory of relativity: a cause always precedes a consequence, no matter how you look at it (Einstein). This excludes sudden, spontaneous events. Even if an event seems to have no cause – sometimes referred to as ‘an act of God’ – it has to have one. All we have to do is to find it.
But what about events that have not happened yet; say a potential future accident? Such an event may well have more than one potential cause, and which of them is going to be the actual cause we do not know. We may be able to establish the probability that one factor or the other is going to be the cause. Similarly, after the event, when we have a list of possible causes, but cannot (yet) decide definitely between them, we may be able to assess the probability that one or the other has been the actual cause.
In many cases the cause consists of multiple events. Two or more things have to go a certain way before the next event can happen. As an example, take a car light (Figure 2.2).
Every light in a car is connected to the battery AND the generator by means of a switch. Several events can cause the light not to be on, or to fail to work. The light bulb may be broken, the switch may be turned off, or BOTH the battery AND the generator may fail to supply energy. These latter events both have to happen for the light not to work. We will see later how we can use formal analysis techniques to build a logical model for this and other systems and how we can deal with probabilities in such systems.
Figure 2.2 A car light system Generator

Accumulator

Switch

17

Risk: an introduction

Reality is always much more complicated than we can model. In reality, everything is related to everything else. When looking at reality in this way, one can rarely if ever speak of an identifiable cause. Nevertheless, if certain combinations of events usually are followed by certain combinations of other events, we consider that we have found the cause (Kant, 1783). We have to if we want to be able to intervene sensibly, rather than accept the world and our fate as they are.
Whereas according to our way of reasoning, events always have to have a cause, events do not always have to have consequences. They might, but they do not have to. If an apple comes loose from the branch of a tree, it falls towards the ground. It does not have to reach the ground. Somebody (maybe Newton) may catch it before it actually hits the ground. In such cases there is a probability smaller than 1 that the event – in this case apple hits ground – will happen as a consequence of the cause. A probability of 1 means certainty. We will have a closer look at probabilities later.
An event may also have more than one consequence. Some of these may be mutually exclusive. If the brakes of a stationary car on a slope fail and the car moves, it either goes forwards or it goes backwards. It cannot do both simultaneously (unless the car falls apart). Other consequences may occur together, and are thus not mutually exclusive. If you fall from a roof, you may break your arm AND your leg.
We should be aware, though, that some processes are so complicated and the chain of events so subject to chance that we will not be able to find the cause, no matter how hard we try. A thunderstorm in Europe may ultimately be caused by the motion of the wing of a butterfly in China, but how could we ever find that out? Such phenomena are also called chaotic (Stewart, 2002). That is not to say that there IS no cause, but for all practical purposes we may treat the events as if they do not have one. For these events it is not possible to intervene between cause and event. We have to accept the events as they are. We may, however, still be in a position to do something about the consequences.

PROBABILITY
Just as there is a discussion about what cause really means, so there is a discussion about probability. Roughly speaking, there are two schools of thought: the frequentists and the subjectivists. The frequentists take probability to mean the number of specified occurrences divided by the number of tries:
P(A) =

NA
N

in which P(A) is the probability of event A, and NA is the number of occurrences of A in a total of N events – in the case of dice, the number of times

18

Modelling risk

a particular number (say 6) is thrown divided by the number of throws. The outcome will be 1/6 if the number of throws is big enough. Frequentists do not care whether in an actual experiment, where the number of throws necessarily has to be small, the number of 6’s is not one-sixth of the total number of throws.
Subjectivists, however, say that the frequentists only believe that the probability of throwing 6 is 1/6, and that there is no way of knowing for certain. First of all, nobody has done an experiment with an infinite number of throws, which is the hard mathematical demand for the ratio to really be 1/6. And, they say, how do you know that the next throw will behave the same way as all previous throws? You cannot possibly know the future. So, the subjectivists say that probability is a measure of belief that a future event will turn out in a certain way. One of the founding fathers of the subjectivists was Thomas Bayes. He wrote an essay, published after his death, that addressed the – largely philosophical – problem of assessing the outcome of a future event given knowledge of past events (Bayes, 1763).
Therefore, subjectivists are also called Bayesians.
Bayes developed a method to combine beliefs, which may be pre-existing, with observations or new information as follows:
Say we have an event A for which we want to know the probability. We have a pre-existing belief that this probability equals P(A). We now make observations or find evidence or develop a new belief that leads to a probability P(E) (E for evidence). Now the new probability of A is the probability of A given the evidence E, which is noted as P(A|E). We now need to know one more thing: the probability of E given A. In other words, if A is true or occurs, what then is the probability that the evidence occurs or is true also, or P(E|A)? This does not need to be true. Think for instance of tests for a certain illness. The test may be positive for people who are not ill and may be negative for people who are ill.
Say that the event is that the patient is ill and E is that the test is positive. Say the probability of a wrong test when the patient is ill is 1 per cent, and that the probability of a wrong test when the patient is not ill is 2 per cent. This means that 99 per cent of the patients who are ill will be detected and 2 per cent of the healthy people will test as ill.
P(B|A) = 0.99 P(B|A*) = 0.02 where the * means the opposite of A. In this case, therefore A* means that the patient is not ill and E* means that the test is negative.
Bayes now says (and proves it mathematically) that:
P(A|E) =

P(E|A)P(A)
P(E|A)P(A) + P(E|A*)P(A*)

or
P(A|E) = P(E|A)P(A)
P(E)

19

Risk: an introduction

Table 2.1 Test results for 1,000 patients
Patient ill

Patient not ill

Total

Test positive

1

20

21

Test negative

0

979

979

Total

1

999

1,000

since P(E), the fraction or probability of a negative test in the whole sample, is often all we know.
Now say we test 1,000 patients of which 1 patient is ill. For the test results, what this means is shown in Table 2.1. Although we have found the one ill patient, we have found another 20 patients who we think are ill but are not.
Say we believed the test was perfect for the ill patients (i.e. P(E/A)=1);
we now have a new estimate that 5 per cent of the patients who test positive are ill, which is the right answer. We would also have got this answer if we had been frequentists, but in many cases the evidence is much less clear than in this example.
We can also see that if we believed nobody was ill, we would still believe nobody was ill after we found 20 per cent of the tests to be positive.
This is an important result for the Bayesian estimates of accident probabilities in cases when one of the parties involved is of the opinion that the accident cannot happen. Even in the face of an accident, the non-believers will state that the accident will not happen again, and Bayesian statistics would support them (Unwin, 2003).

SYSTEMS AND INTERFACES
If we want to find causes and consequences, it is often said that we have to look at ‘the system’. This leads to the obvious question: ‘What is “the system”?’ Now we can have a very narrow look at it. The light system of Figure 2.2 could be considered a system. This limited view of what constitutes a system also leads to a limited view on potential causes or causal chains for light failure. Investigations of failures of the light bulb cannot be broadened into investigations into underlying causes such as the vibrations of the car on which the lamp unit is mounted; the car is not part of the system.
Therefore, it is very useful to cast a wider net and include a larger section of the surroundings in the system.
We could go so far as to include the whole car in this case. Then we could, for instance, investigate whether the vibrations of the car are in any way related to the suspension or the tyres and whether we can do something to make the vibrations less severe, or design a light bulb that can withstand

20

Modelling risk

Figure 2.3 The car–road–driver–light system

Driver

Generator

Accumulator

Switch

Car
Road

these vibrations. In that case we may discover that the condition of the road has something to do with the vibrations of the car and thus with the probability of a light bulb failure.
Having discovered that the road matters, we then discover that the speed matters as well. And speed? That is controlled by a driver. So now our system is already pretty large: it has a light in a car on a road driven by a driver (Figure 2.3).

Man, Technology, Environment
Industrial, technological and natural risks should be studied and controlled in the system consisting of Man, Technology and Environment (MTE). In this system, man – human beings – designs and operates technology, influences and changes his environment and at the same time is affected by the technology he designs and operates and by the environment that he changed (Kuhlman, 1981). The interactions between these three elements of the MTE system produce wealth and prosperity on the one hand and are the source of trouble and risk on the other. Man is part of this system and in part also the creator. Managing risk is all about controlling the MTE system, and risk science is all about understanding this system and the behaviour of it that results from human interventions.

21

Risk: an introduction

Figure 2.4 The Man, Technology, Environment system

Man

Environment

Technology

The most important step in understanding a system is grasping how it is put together. Figure 2.4 gives only a very superficial indication of the anatomy of the MTE system. It shows the areas of binary interaction between the three constituents and the area in the middle where all three constituents interact.

Accident Causation Metaphors
Three-dimensional picture The idea of a three-dimensional picture is another form of model. In fact, the picture is just as two-dimensional as any other picture. This means that we cannot walk around or take another view from another angle of the object in the picture. Thus, things that are hidden ‘behind’ other things remain hidden.

There are various metaphors used to capture the essence of accident causation and the protection against harm. They include the hazard–barrier–target model, the Swiss cheese model and the bowtie model.
The concepts and metaphors that I shall describe originated from the practical question of where and how to prevent future accidents. For very rare accidents, the underlying causes are sometimes difficult to identify.
Furthermore, every underlying cause has another, deeper, cause. Thus, the thinking about accidents evolves into ever deeper constructs and models.
Nevertheless, any effort to construct a model describing chains of causality of events in a system must be based on the assumption that causality exists

22

Modelling risk

and that causality even in systems as complex as the aviation industry can be described. This unavoidably leads to the question of whether the work will ever be finished and whether there is a final cause to be found.
Several lines of discussion are continuing. Some of these are triggered by the perceived incomprehensibility of low probability–high consequence events, some of them by the notion that analysis of causality seems to have no end, and some by the more legalistic discussion on whether a probabilistic progression of a sequence of events should lead to a negation of the certainty of the cause after the fact.
The matter of causality is a highly philosophical question. I shall describe my position with respect to these questions briefly a little later, in order to justify the continuation of efforts towards those in the scientific community who have reached the point of seeing no further point in causal analysis and modelling.
The discussion about the infinity of the chain of causality is an old one and goes back to the Greek atomists around 400 BC (Russell, 1946). The why question in this context can have two meanings: ‘to what purpose?’ and ‘with what cause?’. Both questions can only be answered within a bounded system, because they imply that there is something causing the system to exist.
A bounded system can show beh