What is acceptable risk?

(1)

AW-PRO

V r i j l i

1 7 9 1

1 9 9 3

W H A T IS ACCEPTABLE RISK?

august 1 9 9 3

Prof. drs. ir. J.K. Vrijling ir. J.F.M. Wessels ir. W . van Hengel ing. R.J. Houben age sex education 1 age sex education 1 occupation risk aversion perception of awareness of: - personal interest - avoidability

- seriousness of the risk

the risk personal interest usefulness or benefit direct: private benefit indirect: sodal benefit probability of undesirable event consequence on undesirable event historical background of the risk

T Delft

Faculteit der C i v i e l e T e c h n i e k

Technische Universiteit Delft

(2)

Deze studie is verricht in opdracht van het Ministerie van Verkeer en Waterstaat

Directoraat Generaal Rijkswaterstaat Bouwdienst Rijkswaterstaat

Afdeling Bouwspeurwerk

T U Delft

Technische Universiteit Delft Faculteit der Civiele Techniek Vakgroep Waterbouwkunde

(3)

(4)

WHAT IS A C C E P T A B L E RISK ?

Prof. J.K. Vrijling ^

Ir. J.F.M. Wessels

2

Ir. W. van Hengel

2

Ing. R.J. Houben

3

Date: 31 August 1993

1 Dept. of Civil Engineering, Delft University of Technology, 2628 CN Delft, Holland

2 Rijkswaterstaat, Ministry of Public Works, P.O. Box 20.000, 3502 L A Utrecht,

Holland

(5)

CONTENTS

5 4.3

Introduction . . .

Acceptable risk; two points of view .

3 The acceptable level of risk according to T A W 9

3.1 Personally acceptable level of risk • 9

3.2 Socially acceptable level of risk 12

3.3 A concept of acceptable risk 2 0

4 The approach of acceptable risk by HPE 2 2

4.1 Personally acceptable risk 4.2

6 Synthesis .

7 Conclusions

8 Literature .

22

Socially acceptable level of risk 23

A concept of acceptable risk 25

Comparison of the two approaches 2^

33

39

41

(6)

Annex 1 Socially acceptable failure probability in case of a Bernouilli distribution for the number of

deaths 42

Annex 2 Socially acceptable failure probability in case of an exponential distribution for the number of

deaths 46

Annex 3 Socially acceptable failure probability in case of an inverse quadratic distribution of the

number of deaths 4 9

Annex 4 HPE rule for socially acceptable risk put into terms of expected value and standard deviation,

for a Bernouilli distribution of the number of deaths 51

for an exponential distribution for the number of deaths 53

irrespective of the distribution type for the number of deaths 5f

Annex 7 Symbols and notation 5

(7)

Abstract

The acceptable failure probability of technical structures and systems is studied in this paper. The problem is approached from two points of view : the personal and the societal point of view. The different view points of acceptable risk lead to different criteria, although the basis of both is a cost/benefit analysis.

Two trains of thought, that were put forward in the Netherlands as an answer to the question "What is acceptable risk ?", are described and compared in this paper, to conclude that they basically agree.

1 Introduction

What is acceptable risk ? What is risk ? One might say that risk is a feeling that people have when they think of some activities, that are dangerous in some respect, like flying,

mountaineering, cleaning the windows on the third floor or driving a Harley Davidson. Such feelings are subjective and in many cases contradictory to statistical facts. According to statistics the step-stool in the kitchen is one of the most dangerous instruments of all.

The idea of acceptable risk or safety may change quite rapidly. For instance one feels pretty safe behind the Dutch river dikes. Nevertheless the probability of an inundation is relatively high (1/1.250 year) compared with other technical risks like harmful effects of chemical plants (1/1.000.000 year)

I f however one riverlevee breaches the safe feeling will most probably disappear overnight. The papers in Holland were filled with indignation when in March 1988 a small summer levee near Deventer, protecting only meadows, breached (as it should) during an exceptional river discharge.

In the same sense the catastrophe at Chernobyl finished the idea of nuclear power as a clean and safe energy source, that over many years had been promoted by the Dutch electricity generating board. Plans to build two nuclear reactors had to be scrapped immediately,

although the Russian accident had no effect on the objective safety of the completely different Dutch designs.

It is therefore imaginable, that one single spectacular failure of a coastal protection

undermines the trust that people have in the coastal engineering profession. I f a framework to judge acceptable risks is missing, politicians might be tempted to propose draconian measures to regain the trust of the public.

Forwardlooking engineers should develop such a framework before a never to be ruled out catastrophe occurs.

(8)

The problem of the safety of technical systems, such as coastal defence systems, has two sides :

1 How safe is safe enough ? 2 How safe is it ?

The second question is, at least at a theoretical level, easily answered by means of the methods of probabilistic design [1]. Using these methods the level of safety of a structure becomes a design objective. By means of additional measures or investment any desired level of safety can theoretically be reached.

Thus the designer expects that the answer to the first question will be given as a design objective or in the form of a consistent philosophy that guides him to the optimal answer. Nothing is, as every experienced engineer knows, more frustrating, costly and time consuming than changes in the safety requirements during design or even worse during construction.

Here lies the root of a misunderstanding between the engineer as a technical specialist and the politician as a translator of the publics preferences. Engineers mostly define risk as the expected value of the loss (i.e. probability * consequence). However many different definitions of risk can be found or deduced if one reads scientific and general papers :

• probability of an accident

• magnitude of the consequence of an accident

o expected value of the consequence of an accident (probability * consequence) • probability * consequence"

• variance of the financial outcome of a project

Moreover psychological research shows that the general public in its judgement of risks uses no abstract notions as probability and expected value. The research reveals that people define the "riskiness" in order of descending importance by :

• potential lethal or damaging effects

• containability of the consequences by emergency measures and institutionalised protection (e.g. fire brigade)

• number of exposed persons

• familiarity of the effects and the consequences • voluntariness of the exposure

The above list should make clear that the designer of a technical system, after having chosen an optimal safety level by means of statistics and decision theory should not attempt to convince the general public of the acceptability of his choice by pointing at the very low probability of failure. A severe misunderstanding will very likely result.

To provide insight in the carefulness of the design, the extra strength of structures, the doubling of hydraulic systems, the management procedures and the emergency measures to

(9)

contain the consequences i f the unlikely event happens, may be a more effective way of communication.

A l l this still leaves the question : How safe is safe enough ?

Designers need a practical (i.e. numerical) and consistent answer to this question of the acceptable risk.

It should be noted that this report contains an academical study. The ideas expressed are not formally endorsed by the Technical Advisory committee Waterretaining structures (TAW) or the Ministry of Housing, Planning and Environment. The mentioning of T A W and HPE refers only to publications [1,5,6] made under their auspices.

(10)

Acceptable risk; two points of view

Generally two points of view appear in studies of acceptable risk levels. The first point of view is that of the individual, who decides to undertake an activity weighing the risks against the benefits.

The opinion formed by the general public, concerning the question whether or not an activity is acceptable in terms of the risk involved for the total population, is addressed by the second point of view.

The first point of view leads to the personally acceptable level of risk or the acceptable individual risk. Individual risk is defined in [8] as "the frequency at which an individual may be expected to sustain a given level of harm from the realisation of specified hazards". The socially acceptable level of risk or the acceptable societal risk results from the second point of view. The societal risk or group risk is mostly defined [8] as : "the relation between frequency and the number of people suffering from a specified level of harm in a given population from the realisation of specified hazards".

If the specified level of harm is narrowed down to the loss of life, the personal risk is the probability that an individual looses his life due to the realisation of a specific hazard. And the societal risk may be modelled by the frequency of exceedance curve of the number of deaths, also called the FN-curve due to a specific hazard.

Throughout this paper it is assumed that the probability of a fatal accident for one activity i at one place j in one year is small. From this it follows that the probability of two or more accidents in one year is (very) small as compared to the probability of one accident.

This assumption and its implication allow us to derive the probability density function of the annual number of deaths straightforwardly from the FN-curve, without having to spell out the Poisson Process that governs the annual number of accidents.

The p.d.f. of the annual number of deaths Nd i j for activity i at place j can have many forms.

But three forms are presented here to facilitate further thinking. The first is a Bernouilli one, that limits the outcomes to zero or N fatalities :

Equation 1 P r ( ^d i j. = 0) = 1 - p

Pr(Ndij=N) = p

with

Delft

31 August 1993 Vrijling, Wessels, van Hengel & Houben

(11)

Equation 2 E ( Nd l j) = pN

Var{Ndij) = p • ( 1 - p) • N2

The second, that allows for a greater variation in the outcome, is the exponential distribution : P r ( Nd i j = 0) = 1 - p f „ (x) = p/N • e x p ( - x / N ) f o r x > 0 Equation 3 with E ( Nd i j) = pN Var(Ndij) = p • (2 - p) • N2 Equation 4

The third is the little known inverse quadratic distribution. This distribution is of special interest, because it coincides with the type of norm put forward by the Ministry of Housing, Land Use Planning and Environment [6] :

Equation 5 P r ( Nd i j = 0) = 1 - p [x) =0 f o r 0 < x < 1 2 p i <t v f ( x ) =0 for x > Nmax with E ( Nd i J) = 2p Var(Ndij) = 2 p - l n ( i Vm a x) Equation 6

provided that p < < 1 and Nm a x > > 1,

The p.d.f.'s and the probability of exceedance curves of all three forms are given in Figure 1.

T U Delft

(12)

probability density function probability of exceedance

Bernouilli

exponential

inverse quadratic

Figure 1. Theoretical p.d.f's and probability of exceedance curves for the number of deaths.

The probability of exceedance curve, that can be derived from the second form reflects to some extent the FN-curves that result from practical studies (Figure 2).

(13)

Figure 2. Probability of exceedance curve for the number of deaths resulting from, a practical study.

Returning to the question "How safe is safe enough ?", it is observed that the acceptability of an activity follows from an overall cost/benefit judgement that a society or an individual applies to a specific case. One of the aspects of the cost is formed by the probability that one or more people loose their lives due to the activity. It strongly depends on the benefits of the activity whether this specific cost is judged acceptable. In many cases however the question of acceptable risk is treated as a separate issue not directly connected to the overall

cost/benefit ratio. This separate treatment can be explained by the fact that often the safety of the activity can be greatly improved by extra expenditures that do not threaten the overall rentability of the project.

Two approaches may in principle be adopted for the determination of an acceptable level of risk for each of both positions, namely :

a mathematical-economic method which, with the main emphasis on the probability of an economic loss, leads to an economic optimum;

T U Delft

(14)

a method based on accident or death statistics which, with the main emphasis on the probability of a number of deaths, leads to an (apparently) accepted accident probability.

The two approaches lead to sometimes essentially different results. The theory cannot, however, establish a particular objective standpoint with regard to acceptable levels of risk, for the determination of such levels should be the task of the political process. The theory should instead be viewed as an instrument to add consistency to the process of opinion-forming on the subject of a justifiable level of safety.

Below two specific Dutch solutions to the problem of acceptable risk will be explained and compared; one solution was proposed in a study prepared under the auspices of the Technical Advisory committee Waterretaining Structures (TAW) and the second by the Ministry of Housing, Planning and Environment (HPE). Finally the two solutions will be merged into one single theory.

T U Delft

(15)

3 The acceptable level of risk according to T A W

3.1 Personally acceptable level of risk

The smallest component of the socially accepted level of risk is the personal assessment of risks by the individual. In the personal sphere the appraisal of alternatives, i.e., balancing the desired benefits against the expected costs, the risk being one of the costs, associated with them, is often accomplished quickly and unconsciously. Nobody performs a formal

cost/benefit analysis including the risk of a lethal accident when he buys a car. Also, a correction can be quickly made if the appraisal turns out to be incorrect.

The result of an attempt to establish a model of this appraisal procedure is represented in Figure 3, presupposing an objective rational balancing of the benefit - both the direct

personal and the social benefit - against the cost including risk (expected loss = probability * consequence). age sex education education occupation risk aversion perception o( awareness of: • personal Interest - avoldablllty

• seriousness of the risk

direct private benefit indirect: social benefit consequence on undesirable event personal avoldabillty degree of organized protection frequency estimates historical background of the ri3k degree of organized protection historical background of the ri3k

Figure 3. Theoretical risk assessment model of an individual.

T U Delft

(16)

In a specific case the probability component of the risk is estimated on the basis of the individuals own experience or of the reported experience of others. An idea of the possible consequences is also derived from these sources. That is why forming a personal opinion with regard to new activities is often difficult due to lack of historical data. In such cases the information is derived from estimates by "experts" and from the visible degree of protection provided by e.g. governmental bodies.

An important aspect is the degree of voluntariness with which the risk is endured. In the case of non-voluntariness the individual can make his appraisal in accordance with his own set of standards, but any adjustment of the choice in the event of an unfavourable result is outside his sphere of influence. This point compels him to adopt a sceptical attitude towards non-voluntary risks.

The aspect of non-voluntariness together with the non-availability of historical data and the lack of clarity as to the nature of the benefit to be gained may explain the social resistance to modern sources of energy such as LNG and nuclear energy.

Psychometric research has so far not attained an operational version of the model presented in Figure 4. A practical solution consists in presuming that the appraisal process of each individual is consistent and in considering that the result of this process yields an indication of his preferences. Under these presumptions the statistics of death causes provide a source, which reveals the average result of the individual appraisals of benefit and risk. An

unavoidable risk is the probability of dying by natural causes. In the Western countries this probability for a person under 60 years of age is about 10"3 per year.

For specific activities the personal acceptance of risk is arrived at by dividing the annual number of fatalities by the number of participants in the activity concerned.

probability of dying per year statistics of causes of death mountaineering illness motoring flying factory acceptance of risk-voluntary activities p -

10

non-voluntary activities p = 0,1

Figure 4. Personal risks in Western countries, deduced from the statistics of causes of death and the number of participants per activity.

(17)

The personal risk levels inherent to some activities are indicated in Figure 4. The fact that these levels show stability over the years and are approximately equal for the Western countries would seem to indicate a consistent pattern of preferences.

The ranking of the risk levels is not surprising either. The probability of losing ones life in normal daily activities such as motoring or working in a factory is one or two orders of magnitude lower than the normal probability of dying. Only a purely voluntary activity such as mountaineering entails a higher risk.

In view of the consistency and the stability - apart from a slightly downward trend due to technical progress - of the death risks presented, it would appear permissible to deduce therefrom a guideline for decisions with regard to the personally acceptable risk. The probability of an accident or failure Pn associated with activity i should meet the

following requirement :

Equation 7

P j •

1CT4

where Pd, n denotes the probability of being killed in the event of an accident. In this

expression the policy factor (3 varies with the degree of voluntariness with which the activity is undertaken and ranges from 10 in the case of complete freedom of choice to 0,1 in the case of an imposed risk.

Failure is defined as a fatal accident, i.e. an accident that causes one or more fatalities. From this it follows that the parameter p, introduced in chapter 2, equals Pn : i f the probability that

a fatal accident occurs in one year is Pr„ than the probability that the number of deaths in

one year is not zero, which is p, is also Pn.

T U Delft

(18)

Socially acceptable level of risk

What a democratic society accepts in terms of risks is in principle the aggregate, or the sum, of all individual appraisals. The aggregated version of the model presented in Figure 4 should provide the answer. Although it can be said, at the social level, for every project in the widest sense the social benefits are balanced against the social costs (including risk), this process of appraisal cannot be made explicit. The social optimization process is accomplished in a tentative way, by trial and error, in which governing bodies make a choice and the further course of events shows how wise this choice was.

If a socially acceptable risk level must be determined for a particular project, a solution can be reached only via considerable simplification of the problem.

One way to achieve this is to convert the problem into a mathematical-economic decision problem by expressing all the consequences in monetary terms. The second approach deduces an acceptable level of risk from accident statistics.

Standard of appraisal based on mathematical-economic optimization

The problem of the acceptable level of risk can be formulated as an economic decision problem.

The expenditure I for a safer system is equated with the gain made by the decreasing present value of the risk (Figure 5).

Figure 5. The economically optimal probability of failure of a structure.

(19)

The optimal level of safety indicated by Pf o p l corresponds to the point of minimal cost.

m i n ( £ ? ) = m i n ( J ( Pf) + PV(Pf • S) )

Equation 8

where :

Q = total cost

PV = present value operator S = total damage in case of failure

In many cases where structures are degrading over time the cost of maintenance should be included as this cost can mostly be reduced by choosing a stronger structure at the start. Mathematically the expression for the total cost is expanded as follows :

M(Pr) = cost of maintenance

This problem has been solved for many practical situations. The optimisation of the Europoort breakwater [2] gives an example where due to the lay out the damage in case of failure is limited to the breakwater structure itself and maintenance forms the main cost item besides the investment. Other lay-outs could involve considerable consequential losses i f the operation of the entire harbour is interrupted by the breakwater failure.

One of the best known examples in the Netherlands is the approximation of the optimal probability of inundation of Holland by Van Dantzig [3,4]. Here maintenance was of reduced importance.

The result formed the basis for the political choice of the return period of 10,000 years for the design flood in the Delta-project. I f despite ethical objections, the value of a human life

is rated at s, the amount of damage is increased to

m i n ( O ) = m i n ( J ( Pf) + PV(Pf • S + M(Pf) ) )

Equation 9

where

• s + S Equation 10

where

Np i = number of participants in activity i .

Delft

(20)

This extension makes the optimal failure probability a decreasing function of the expected number of deaths.

The problem of the valuation of human life is in this paper solved by choosing the present value of the net national product per inhabitant. The advantage of taking the possible loss of lives into account in economic terms is that the safety measures are affordable in the context of the national income.

A limitation of the mathematical-economic approach is that it presupposes the total loss in the event of a failure to be small in comparison with the economy as a whole. In fact it is the confidence in the economy that makes repair a viable proposition.

Standard of appraisal based on accident statistics

The second approach to determine the socially acceptable level of risk starts from the proposition that the result of a social process of risk appraisal is reflected in the accident statistics. It seeks to derive a standard from these.

The standard of appraisal, for socially acceptable risks should be based on a model for the social perception of risk. The model should show that the very low probability of fatal

accidents is perceptible to members of the community. Secondly, the model should be able to explain the inverse proportionality between the permissible probability of an accident and the number of deaths involved.

As a model hypothesis it is assumed that an individual assesses the social risk level on the basis of the events within his circle of acquaintances. Assuming for the moment that the average circle of fairly close acquaintances equates appr. 100 persons, the probability of a death occurring within that circle in consequence of natural causes is equal to :

Pr(death) = 1 0 "3/ y r • 1 0 0 = 0 , 1 / y r

Similarly, the probability of one death among the acquaintances due to a road accident in the Netherlands, with a population of roughly 14.106 and a number of fatalities of 1500 in 1992

is :

Using the circle of acquaintances as an instrument of observation, the very low probabilities of a fatal accident, which appear socially acceptable, are perceptible. The recurrence time is within the order of magnitude of a human life span.

In seeking to establish a norm for the acceptable level of risk for civil engineering structures it is more realistic to base oneself on the probability of a death occurring within the circle o f Equation I f

1 5 0 0 • 1 0 0 14 - 1 0s

Equation 12 Pr (death) = = 1 , 1 - 1 0 "2/ y r

(21)

acquaintances due to a non-voluntary activity in the factory, on board a ship, at sea, etc. which is approximately equal to :

Equation 13 Pr(death) = 2 0 0 '1 0 0 = l ^ K T V y r

1 4 - 1 06

I f this observation-based frequency is adopted as the norm for assessing the safety of activity i , then with due regard to 0 = 0,1 for the non-voluntary character :

N,

pi d\fi f i 1 0 0

Equation 14

14 - 1 06

< p

• 1 , 4

-10-After re-arranging this expression, and adopting a rather arbitrary distribution over for example 20 categories of activities,each claiming an equal number of lives per year, the following norm is obtained for an activity i in the Netherlands :

Pfi <

Equation 15

P •

1 0 0

This norm should be interpreted in the sense that an activity is permissible as long as it can be expected to claim fewer than 0 * 100 deaths per year.( 0 *7e-6*population)

However the formula looks only to the expected number of deaths and does not account for the spread, which will certainly influence acceptance.

Risk aversion can be represented mathematically by adding a confidence requirement to the norm. For this purpose, the mathematical expectation of the total number of deaths, E(Nd l),

is increased by the desired multiple of the standard deviation before the situation is tested against the norm :

Equation 16 E(Ndi) + k • a ( Nd l) < p • 1 0 0

where : k - risk aversion index

Delft

(22)

For a correct determination of the mathematical expectation and the standard deviation of the total number of deaths occurring annually in the context of activity i , it is necessary to take into account in how many independent places NA the activity under consideration is carried

out. The number of such independent places does not influence the expectation of the number of deaths, but it does affect the spread.

After some rearrangement, using the Bernouilli p.d.f. defined" earlier, we obtain the result for the permissible probability of failure (Annex 1):.

- 1 k2 4 •

P

• 1 0 0

Np1 d\fi

Equation 17

I f NA is not too large a good approximation of the acceptable probability of failure is given

by

Equation 18

p

• 1 0 0 n

Pfi <

Often a value of k = 3 is provisionally adopted for the reliability requirement. A further simplification is possible. For large values of NA the formula reduces to a simple norm in

which the acceptable probability of failure is inversely proportional to the expected number of deaths in case of a failure E ( Nd | r, ) = Np i * Pd ( n :

Equation 19

P •

1 0 0

For NA = 1 the requirement is most rigorous, but the formula retains a simple form. The

acceptable failure probability is inversely proportional with the square of the expected number of deaths in case of failure E ( Nd|f i) = Np i * Pd | r, :

P •

1 0 0

Equation 20

it*?'

(23)

P

' A

N„-

1

[1/year] _{k = 3 /} -6 P = 0.1/

10

-5 / N A=« / k - 3

10

- _{/ p -}

0.1/

-4

/

10

_ / eq.18 / -3

_{/ / /}

10 /

/ / k = 3 / / / p = 10 / / e q . 1 7 / p = 10 -2 / / e q . 1 7 /

10

I / _{' i}_y_i _\ _{/ i}

-1

10

0

10 -10/

1 02 X103 l O 4 / ^ 5 106 / / eq.17 E(Nd|fi)

Figure 6. The trend of the social safety norm for some values o f f i and NA ; the probability

of an accident is marked on the vertical axis ; the horizontal axis indicates the total number of deaths, given failure in all NA places.

In order to test the model, the acceptable failure probability is plotted for several values of NA, P and k = 3 as a function of the number of deaths in case of failure (Figure 6). On the

same axes some activities, considered acceptably safe in the Netherlands, have been plotted (Figure 7).

T U Delft

(24)

Storm Surge Barrier [1/year] •el 10 0.0001 J>~ / nuclear power

0.01

1.0 10 -41 10 •31 10 10 10 'Delta Commission/

x7)

factory 100

/ /

/'mountaineering / / " " 7 / • / / I / 1 / I I motoring 10 102 : 1 03 ' 1 04 1 05 1 06 1 07 E(Nd|f i)

Figure 7. Tlie risks of some activities; the probability of failure per system is marked on the vertical axis, the horizontal axis indicates the number of deaths in case of failure at all places.

The agreement between the norm derived in this study for reasonable values of NA and 0.1

< 0 < 10 and the risk accepted in practice in the Netherlands seems to support the model.

I f the exponential distribution of the number of deaths is introduced in stead of the Bernouilli p.d.f. the acceptable probability of failure is halved in all cases. For a further explanation of this relatively minor change the reader is referred to Annex 2.

I f an inverse quadratic distribution of the number of deaths is assumed, the result is (Annex 3 ) :

Equation 21 Pn < ^ ( - v ^ 2 l n ^ a x + ^ 2 l n N m ax

+ 4 P 1 0 0 )

2

(25)

For large values of NA, more precisely if NA ^> l n N ^ / p , the standard deviation of the

number of deaths is small as compared to the expected value. This yields the following result:

n Equation 22

< P-ioo = p-ioo _ P ' 1 0 0

fl 2-NA E ( Nd [ f i) Np i- Pd ] f i

which shows that the acceptable probability of failure is again inversely proportional to the expected number of deaths in case of failure.

For small values of NA, i.e. NA <è lnNm a x/p, the standard deviation overrules the expectation

and the result is :

Equation 23 / J . (

P

- 1 U U «, 2 f i 1

, p

-100 ( _ _ C _ J L ^ ± ! _ ) 2

1 , p-ioo

Mpi-Pd]fi k-fLEW^

which shows that the acceptable probability of failure is still inversely proportional to the expected number of deaths in case of failure. Note that the expected number of deaths, given failure at one place is constant : 2 (cf. Equation 6).

T U D e l f t

(26)

A concept of acceptable risk

Three concepts of determining the acceptable level of risk have been presented in the foregoing sections. One approach, based on accident statistics, has been given for the

personally acceptable level of risk. The socially acceptable level of risk has been approached in two ways. Firstly, the mathematical-economic approach of the material risks weighed against the cost of safeguarding against them. Secondly, an approach based on a model of social perception of risk was developed.

In assessing the safety of a system the three approaches should all be investigated : The personally acceptable risk which a member of the community is on average prepared to accept.

The economically optimal level of risk, where the value of a human life must be taken into account. An objective measure of the value of a human life is the present value of the net national product per head. The optimal level is attained i f the marginal cost of safety measures is just equal to the marginal benefit.

The socially acceptable level of risk, on the basis of the assumed risk aversion model, which leads to an evaluation of the acceptable probability of failure depending on the number of independent places where the activity under consideration is carried out.

Figure 8. The application of the three safety requirements to the acceptable probability of inundation of Central Holland; the social point of view is the most stringent.

(27)

The most rigorous of the three criteria should be adopted as the governing criterion.

To illustrate the proposed procedure, it has been applied to Central Holland. The results are represented in Figure 8.

The permissible probability of a dike failure Pr associated with Central Holland from a

personal point of view is :

p • I P '

4 =

o . i • io-

4 = 1 0

-

3

/

y e a r

Pd l f i 0 , 0 1

Equation 24

It should be noted that Pd t n = 0,01 is an average value for people living in the total area.

The economic approach leads to an acceptable frequency of failure of 8,0 10"6 per year [4]

Given the total number of people (E(Nd, n) = 50.000) that will get drowned in case of an

inundation and given the fact that it centers on one single independent place, the socially acceptable failure probability based on accident statistics is the most rigorous criterion :

2

Equation 25

( Q '1 •1 0 0 ) = 4 , 5 - 1 0 ¬

3 • 5 0 . 0 0 0

per year. The outcome of the political process in 1960 is plotted as a circle, indicated with Delta commission, in Figure 8.

T U D e l f t

(28)

4 The approach of acceptable risk by H P E

Many planning decisions have to be made regarding the location of sometimes hazardous chemical industries. The aspect of hazard to the surrounding inhabited areas in case of a new industrial activity or in case of a new settlement near an existing activity is recognised in the policy of the Ministry of Housing, Planning and Environment (HPE) in the Netherlands. The criteria for LPG systems issued by the Ministry [5] and later explained in more detail in [6] will be described now.

Given its task the Ministry concentrates on hazards posed by industrial and other

developments to passers-by and inhabitants of surrounding areas. The safety of people that are professionally connected to the hazardous activity falls outside the competence of the Ministry of HPE as it is the responsibility of the Ministry of Social Affairs.

The Ministry of HPE also discerns an individual and a societal acceptable risk. Both are intended to limit the loss of life.

The individual acceptable risk is defined as the acceptable probability to loose ones life due to an accident attributable to a third party. To find a basis for the acceptable risk the statistics of death causes for the Dutch population was used. In these statistics the group of individuals, most unlikely to die in any single year was identified. It appears that boys between 6 and 20 years old have a probability to die in any year of 1,0 10"4. This probability

results from all causes, natural as well as accidents.

Now the reasoning is that an activity to be undertaken cannot be allowed to add more than 1% to the already existing probability to die.

As it is also assumed that a person is present during 24 hours a day at the fence surrounding the area where the activity is performed, the acceptable probability of failure from the individual point of view becomes :

4.1 Personally acceptable risk

1 0 "6 / year

Pd\fi

Equation 26 P

fi

<

This criterium should be met everywhere outside the plants fence.

(29)

The rule for the acceptable individual risk does not account for the possible beneficial character of the activity as it contains no extra factor to reflect this aspect. It should be stressed however that its intended use is limited to situations of more or less involuntarily imposed risks.

To put the small probability to die due to an accident with some external cause in a certain perspective, the decrease in life expectation due to an extra risk p is calculated in the table below. The basis of the calculation is the death rate due to all causes as a function of age.

Extra risk Expected age Decrease Decrease

[1/year] [years] [years] [days]

io-3 74.97 3.16 1153

10"4 77.81 0.32 117

IO"5 78.10 0.03 11

10"6 78.13 0.00 1

io-7 78.13 0.00 0

Thus the introduction of an extra risk to loose one's life with a probability of 10"6 / year

shortens the life expectation with I day, while a similar extra risk of 10"4 / year reduces it

with 117 days .

4.2 Socially acceptable level of risk

The socially acceptable risk as defined by HPE concentrates on the consequences, in terms of loss of life, of an accident at a single location where an activity is performed. The total number of independent places where the activity is performed is not taken into consideration.

The societal risk of an activity is considered acceptable if the probability of exceedance function of the number of deaths fulfils the following requirement :

(30)

1 - w * > < - T

Equation 27

for X > = 10 deaths

where : FN d i j = the c.d.f. of the number of deaths resulting from activity i in place j

in one year

See also Figure 9. Every activity performed at an independent place has to conform to this requirement. The curve is the outcome of a political process, that finally accepted the death of 10 people in case of the failure of a LPG station with a probability of 10~5 per year. The

allowable frequency decreases more than linearly with the number of deaths because of risk aversion. However, for the specific type, the inverse proportionality with the square of the number of deaths, no explicit reason is given.

For static installations the application of the rule for the socially acceptable risk poses no special problems, but for transportation the applicability requires the definition of a standard unit of track length to which the norm is applied.

Figure 9. Acceptability of societal risks as deduced from the LPG Integral Report (18233 Nos 1 and 2) and "Dealing with risk". This norm must be complemented with a maximum individual risk of W6 - 10s per year.

(31)

4.3 A concept of acceptable risk

Two concepts of determining the acceptable level of risk have been presented in the foregoing sections. One approach, based on the death statistics of young boys, has been given for the personally acceptable level of risk. The socially acceptable level of risk has been approached by defining an upperbound to the FN-curve, the probability of exceedance curve of the number of deaths.

In assessing the safety of a system the two approaches should both be investigated : The personally acceptable risk which a member of the community is on average prepared to accept.

The socially acceptable level of risk, on the basis of the upperbound to the FN-curve

Both criteria should be obeyed. To illustrate the proposed procedure, it has been applied to Central Holland. From the personal point of view the acceptable probability of failure of the dike is limited to 10"6 per year as people living directly behind the dike will certainly drown.

The probability to drown in case of a dike breach Pd|n = 0,01 should not be applied as this is

an average value for people living in the total area.

The p.d.f. of the number of fatalities is defined as the Bernouilli type with N = 50.000. Thus the FN-curve consists of a single point and the permissible probability of failure becomes :

_3 Equation 28

Pf i < — = 4 , 0 - 1 0 -1 3

5 0 . 0 0 02

The requirements are far more stringent than the present safety of the dike system. However it should be stressed that the safety of dikes is explicitly excluded in [6].

(32)

Comparison of the two approaches

The standard for the personally acceptable risk of the Ministry of HPE seems a factor 100 more stringent than the TAW rule at first comparison and the standard does not offer a possibility of flexible adaptation.

In view of the fact that the rule is intended to protect third parties against hazards to which they are exposed involuntarily and that do not bring them any direct advantage, it could however be argued that this flexibility is not neccessary. To model this non-voluntary exposure and the lack of direct davantage the range of the factor /3 in the T A W rule for individual risk could be extended with an order of magnitude from 1 0 - 0 , 1 to 10 - 0,001 . After this refinement the level of personal acceptable risk according to HPE is only one order of magnitude more stringent than the T A W criterion. Expressed in days of expected lifetime the difference is a decrease with 1 day versus a decrease with 11 days.

The comparison of the two rules for the socially acceptable risk is less simple.

At first sight a similarity of the HPE-rule (Equation 27) and the simplified TAW-formula (Equation 20) for the socially acceptable risk seems present as both contain the number of deaths squared in the denominator. However here the HPE-criterion specifies an upperbound for the probability of exceedance curve for the number of deaths, the FN-curve, while the TAW-rule limits the probability of failure of the activity. Moreover in case of the HPE-rule the running variable x figures in the denominator against E ( Nd ( n) in the TAW-rule.

It is advisable to return to the basis of the TAW-rule for a rigorous comparison. Basically a limit is placed on the total number of fatalities an activity claims per year. A certain

assurance against exceedance of this number is required :

Equation 29 E(Ndi) + k • a ( Nd i) <L p • 1 0 0

If from this general rule a safety requirement for a single independent place has to be derived the total number of independent places has to be known or estimated.

The HPE-rule for the socially acceptable risk is directly applicable as it places an

upperbound to the probability of exceedance curve of the number of deaths for an activity at one single place :

Equation 30 1 - F (x) < ^

dij ^ 2

for x > = 10 deaths

Delft

(33)

The practical implications of such an upperbound are however not easy to understand. What does it mean for instance, in terms of the standard deviation in the annual number of deaths, if the requirement is not fulfilled for x > 100 ?

I f the Bernouilli form for the p.d.f. of the number of fatalities is assumed and the HPE-condition is imposed on the distribution, it can be mathematically shown (Annex 4) that this means written in TAW-format :

Equation 31 E ( Nd i j) + k • o ( Nd i j) z k • 0 , 0 3 2

where k = 1

The exponential distribution of the number of fatalities, that was also given above, conforming to the HPE-condition, results in the requirement (Annex 5) :

Equation 32 E ( Nd i j) + k • a ( Nd i j) z k • 0 , 0 6 1

where k = 1

I f no specific distribution of the number of fatalities is to be assumed, an upper-bound approximation with the Chebychev-inequality yields the following distribution free result (Annex 6) :

Equation 33 E { Nd i j) + k • a ( Nd i j) < k • 0 , 0 3 2

where k - 1

Thus it can be concluded that, provided that the standard deviation overrules the expectation, the HPE-condition is met whenever the standard deviation is not greater than 0,032. For a standard deviation greater than 0,032 the compliance to the HPE-rule depends on the specific type of distribution for the number of deaths. In case of an exponential distribution, the limit in terms of a is 0,061.

In case of an inverse quadratic distribution, the local activity is acceptable if (cf. Equations 5 and 3 0 ) :

p < 103.

This limits the expected value to 2-10"3, but does not restrict the standard deviation (cf.

Equation 6). So for this specific distribution type, the compliance to the HPE-rule is

independent of the standard deviation. The reason is that the inverse quadratic distribution is a very peculiar one: it would not have a finite a, i f not for Nm a x.

Delft

(34)

It is interesting to study at how many independent places an activity, that complies with the HPE-rule, can be undertaken before the total adds up to the TAW-rule. I f the Bernouilli distribution is assumed, it follows that HPE- and TAW-rule are equivalent i f :

Equation 34

_ (P •

1 0 0 )2

A k 2 • K T3

provided that the standard deviation overrules the expectation, which is true for N > 10.

I f 0 = 0 , 1 and k = 3 , it follows that NA « 11.000.

I f the exponential distribution is assumed, it follows that HPE- and TAW-rule are equivalent i f :

Equation 35 N =

(P •

1 0 0 )2

A k 2 • 3 , 7 • 1 0 ~3

provided that the standard deviation overrules the expectation, which is true for N > 10.

I f jS=0,l and k = 3, it follows that NA * 3.000.

I f the inverse quadratic distribution is assumed, it follows that HPE- and TAW-rule are equivalent i f :

Equation 36 N =

(P •

1 0 0 )2

A k 2 • 2 l n A Tm a x • l O -3

provided that the standard deviation overrules the expectation, which is true for large N ^ .

I f 0 = 0 , 1 and k = 3, it follows that NA = 600 for Nm a x= 10.000.

Again the Chebychev inequality can be used to generalise the result obtained for the

Bernouilli distribution. In any case, the number of independent places NA should not exceed

(/?• 100/k)2- W if at every place the HPE-rule is just met and the total is to meet the

TAW-rule.

(35)

The conclusion is that the HPE-rule and the TAW-rule are basically equivalent i f the total number of installations is taken into account.

To study the influence of the number of installations an interesting question is what will happen, if the number of independent places NA at which an activity that complies with the

HPE-rule takes place, increases to for instance 30.000 or more. The HPE-rule does not object against this increase. However according to the TAW-rule the total situation may become unacceptable as the total number of fatalities grows. And the public opinion might also come to the conclusion that an unsafe situation exists, because the probability of an accident with an expected number of deaths of say 10 has grown to 1/3 per year. A more stringent safety requirement per installation would seem desirable.

Example 1

Suppose the probability of an accident at an LPG-station, that claims 10 fatalities is 10'5

/year. This Bernouilli p.d.f. fulfils the requirement of the HPE-rule, so the station is allowed. The total number of LPG-stations does not influence the requirements per station. I f the TAW-rule was applied the total number of stations is of interest. Suppose the number of stations in the Netherlands is equal to NA=30.000.

The expected value and the standard deviation of the total number of deaths in a year summing over all stations can be calculated :

Equation 37

E(Ndi) = NA • p • N = 30 . 0 0 0 - 1 0 -5 • 10 = 3 , 0

o ( Nd i) = <J (NA ' p) • N = y ^ O . O O O - l O -5 • 10 = 5 , 4 8

I f the TAW-rule is applied to judge the certainty equivalent:

Equation 38

E(Ndi) + k • o ( Nd i) < P • 1 0 0

for j8 > 0,19

the situation with 30.000 stations appears to be out of bounds on a national level, as /3 exceeds 0,1, although each station complies with the HPE-rule.

T U Delft

(36)

I f the exponential distribution with N = 10 was a better description of the consequence of failure, the standard deviation would have been equal to 7,75 and the result of the test:

E(Ndi) + k • a ( Nd i) = 2 6 , 2 4 > 10 = P • 1 0 0 Equation 39

This situation would be even stronger disapproved of as $ > 0,26

Example 2

From an airport, surrounded by inhabited areas, 90.000 planes leave every year. The same number of landings take place. So the total number of movements is 180.000 per year. The probability of an accident is on the basis of historical data estimated at 3,0-10~7 per

movement. The number of fatalities at the ground (excluding passengers and crew) in case of a crash is estimated at 50. This may seem a high estimate but in this example every crash will hit inhabited areas.

The personal risk for a person just outside the airport has to be calculated by means of a special computerprogram that provides the individual risk contours. The probability of a crash is 180.000 * 3,0 10"7 = 0,054 per year.

According to the HPE-rule for societal risk one single flight movement (per year) is just acceptable because :

_3 Equation 40

3 , 0 - 1 0- 7 < = 4 , 0 - 1 0- 7

5 02

But, due to the large number of aircraft movements the expected value and the standard deviation of the total number of fatalities in a year are not very small.

Equation 41

E(Ndl) = NA ' p ' N = 1 8 0 . 0 0 0 - 3 , 0 -10~7 - 5 0 = 2 , 7

o{Ndi) = JJSfc • p) • N = f i l m . 0 0 0 - 3 , 0 - 1 0 "7) - 5 0 = 1 1 , 6

The standard deviation exceeds the HPE requirement of 0,032 (based on the Chebychev inequality) by several orders of magnitude. A dramatical improvement of aircraft safety would be required, i f the total airport operations were to meet the HPE requirement.

(37)

I f the original TAW-rule is applied, the result is :

Equation 42

E(Ndi) + k ' o ( Nd i) = 3 7 , 5 < P • 1 0 0

The societal risk is only acceptable i f |3 > 0,1. This means that the situation depicted here will not be acceptable without discussion. The benefits of the airport have to be weighed against the external risk and the possibilities of improvement have to be studied, before a political decision can be taken to accept the risk.

Of utmost importance, but outside the scope of the HPE-rule, is the question of the risk for passengers. The personal risk amounts to 6,0-10'7 per flight, i f it is assumed that every crash

claims the lives of the passengers on board. The personal risk depends on the number of flights a person makes per year. With 10 flights the risk becomes 6,0-10"6 per year. I f a

person flies 100 times in a year the resulting personal risk is 6,0-10"5 per year.

The TAW-rule views 10 flights per year as an acceptable personal risk. In the case of 100 flights per year the risk level becomes relatively high. The order of magnitude approaches the risk of car traffic, that is normally voluntarily accepted Q3 - 1,0).

I f a plane crash occurs, the number of fatalities including passengers might well be 200 persons. The expected value and the standard deviation of the total number of deaths per year can be calculated by :

Equation 43

E(Ndl) = NA • p ' N = 1 8 0 . 0 0 0 • 3 , 0 - 1 0- 7 - 2 0 0 = 1 0 , 8

a ( Nd i) = J(NA • p) • N = v/TÏ8Ö . 0 0 0 - 3 , 0 - 1 0 "7) • 2 0 0 = 4 6 , 4

If the TAW-rule is applied

Equation 44

E(Ndi) + k - a ( Nd l) = 1 0 , 8 + 3 - 4 6 , 4 = 1 5 0 £ P • 1 0 0

the societal risk would only be acceptable if a value /? > 1,5 reflected the attitude of

thesociety towards the airport. It seems likely that the situation will not be acceptable without a very lengthy discussion.

(38)

Finally it is important to note that the TAW-philosophy contains a standard of appraisal of risks based on a mathematical-economic optimization. It seems advisable to include an economically based approach in a philosophy of acceptable risk.

(39)

6 Synthesis

A common standard tor the personally acceptable risk can be developed by including the policy factor in the HPE approach and extending the range from 10 to 0,01. This is necessary to model the acceptability of involuntarily imposed and not directly advantageous activities in the TAW-rule.

In order to synthesize the views on socially acceptable risk by T A W and HPE, the following philosophy is adopted.

Risk criteria for any technological activity should be consistent with the risk criteria for chemical plants, that were put forward by and are being implemented today by the HPE.

The national total risk of an activity should be limited too. This limit is implicitly set by the local HPE-requirement, knowing the national total number of chemical plants. I f this limit corresponds to a reasonable value for the policy factor 13 in the TAW-approach, it should be transferred to other risk evoking activities. I f not, it is corrected before transferring.

The locally acceptable risk takes the form of the HPE-rule, i.e. a bound to the FN-curve. The numeric value of this bound is derived from the nationally acceptable risk, taking into account the national total number of plants or locations for the activity under consideration.

This leads to the following procedure to merge the views of TAW and HPE.

1. Assuming a distribution type for the number of deaths, the expected value and standard deviation of the annual number of deaths resulting from one chemical plant are calculated, under the condition that the complement of the c.d.f. of the number of deaths just meets the HPE requirement.

2. The expected value and standard deviation of the annual number of deaths resulting from all Dutch chemical plants are calculated, knowing the national total number of chemical plants.

3. The value of the policy factor fi, that would render the expected value and standard deviation of the annual number of deaths, resulting from all Dutch chemical plants, just acceptable in the TAW approach, is calculated and tested for reasonability.

4. The expected value, increased by the product of the risk aversion factor k and standard deviation, of the annual national total number of deaths resulting from any

technological activity is set equal to that of chemical plants, i f necessary multiplied by a correction factor.

Ms

T U Delft

(40)

5. The figure found in the previous step is combined with the national total number of places where the activity under consideration is undertaken.

6. Assuming the same distribution type for the number of deaths as in step 1, the

complement of the c.d.f. of the annual number of deaths resulting from the activity on one place, is calculated, under the condition that its expected value and standard deviation correspond to the figure found in the previous step.

7. A limit to the probability of exceedance, inversely proportional to the square of the number of deaths, is determined, under the condition that the complement of the c.d.f. found in the previous step, just touches this limit.

The key factor in synthesizing both approaches is the policy factor B. From steps 1 through 3 it follows that :

under the second condition mentioned below and where the index 1 denotes the activity "chemical plants".

This policy factor cannot be transferred to other realms of activity, as it should reflect the acceptability of the risks in terms of an informal cost/benefit judgement. Thus in principle:

where

r„ the /3-ratio, reflects the differences in voluntariness and economical benefits between activity i and activity 1. This allows for a higher (r > 1) or lower (r < 1) acceptable risk for activity i than for activity 1, within certain limits.

The total procedure can be summarized as follows. Find C„ the desired parameter o f the local norm, under the following three conditions :

(1) activity i just meets a HPE-type of rule by sharing a tangent point: P i = K i • E ( Nd l j) * k • JTQ • a ( Nd l j) ) I 1 0 0 Equation 45 P i = * i ' P i Equation 46 x2 Equation 47 1

- J W * >

=

f o r at least one value of X

1 - F „ U ) <£ - 4

"dij js2

f o r all values of X

(41)

(2) chemical plants just meet the HPE-rule (with C, = 10"3) :

Equation 48

1 f o r at least one value of X

C-1 - F„ (X) <. — f o r all values of X

(3) activity i consistent with chemical plants from T A W point of view, accounting for the respective numbers of independent places, and the differences in voluntariness and economical benefits :

The results of this procedure, for the three distribution types for the number of deaths, are given below.

I f a Bernouilli distribution type is assumed, Equation 45 yields :

With C, = 10"3, NA 1 = 103 (a rough estimate, allowing for a margin of, say, one order of

magnitude), k = 3 and N, = 10, it follows that IJ, = 0,040, which from the T A W point of view is fairly stringent, but not unreasonable for an involuntarily imposed risk. For N, > 10 only slightly smaller values of 15 come out, 0,030 being the minimum.

Applying the conditions mentioned earlier to the Bernouilli distribution in order to determine Q yields :

Equation 49

Equation 50

2 Equation 51

Delft

(42)

If the expected value of the number of deaths is much smaller than its standard deviation, which is often true, the previous result reduces to :

Ci = • 1 0 0 '

Equation 52

With NA 1 = 103 , k = 3 and ft = 0,03 it follows, as expected, that

q =

1 0 "3

Equation 53

I f an exponential distribution type is assumed, Equation 45 yields:

P i = W

A1

• ^ • cjNi + kfllZ •

N

• / q ) / 1 0 0

Equation 54

With C, = 10"3, NA 1 = 103, k = 3 and N , = 10, it follows that B = 0,060, which is

somewhat more stringent than the value 0,10 proposed by TAW for involuntarily imposed risks as discussed before. For N , > 10 only slightly smaller values of B come out, 0,058 being the minimum.

Applying the conditions mentioned earlier to the exponential distribution in order to determine Q yields : Ci =

-k

Equation 55

12

2 NA 2 N

k

2 . a2 N _{è + e} 2

N

-£ • p ,

- 1 0 0 N 1

,2

NA 2 N

If the expected value of the number of deaths is much smaller than its standard deviation, which is true for N > 10, the previous result reduces to:

(43)

Ci =

p

i

•

1 0 0

1

Equation 56

which is similar to the result obtained for the Bernouilli distribution.

I f an inverse quadratic distribution type is assumed, Equation 45 yields :

Equation 57

P i =

(N

A1

• 2 • q + k^fNZ • ^2inN

mgiX

• / q ) / 1 0 0

With C, = 10"3, NA 1 = 103, k = 3, it follows that 13 = 0,084 i f Ni n a x = 10 and 8 = 0,11 i f

N,™ = 10.000. These 13 values hardly differ from 0,10, the value proposed by the T A W for an involuntarily imposed risk.

Applying the conditions mentioned earlier to the inverse quadratic distribution in order to determine C, yields an expression similar to the result obtained earlier for the Bernouilli and exponential distribution. The result is not explicitly mentioned as the quadratic distribution does not really f u l f i l the requirements for a distribution.

I f no specific distribution type is assumed, the Chebychev inequality can be used. I f the expected value of the number of deaths is much smaller than its standard deviation, Equation 45 yields :

Equation 58 P i =

k • JTQ • yfc[ I

loo

With C, = 10'3, NA 1 = 103 and k = 3, it follows that 13 = 0,030, which from the T A W

point of view is fairly stringent, but not unreasonable for an involuntarily imposed risk.

Applying the conditions mentioned earlier in order to determine C; yields :

C4 =

Equation 59

-k •

_v

7 7

^

+

\ ic2 .

N + 4 _ j5

• p

i ' 1 0 0

N

(44)

I f N > 10 a simpler expression results:

p

i

•

1 0 0 k - jm

12

Equation 60

which is a generalisation of the result obtained before.

T U Delft

(45)

7 Conclusions

1 From the personal point of view, the probability of failure (a fatal accident) should meet the following requirement :

Equation 61

p ,

• K T4

Pa <L — Pd\fi

The HPE approach of personally acceptable risk corresponds to a policy factor of ft = 0,01. From the T A W point of view, such a stringent norm would be justified in case of an unvoluntarily imposed risk, that brings no clear direct benefits to those affected by the risk. In many practical cases, a less stringent norm, specifically chosen from the range 10 > ft > 0,01, might be justifiable.

2 The synthesis of the T A W approach and the HPE approach for socially acceptable risk leads to a locally tolerable frequency of accidents, which is inversely proportional to the number of independent places and the square of the number of fatalities :

1 - FN,,_.(X) £ d i j where C, P i Equation 62 f o r all X ;> 10 1 0 0 ' k

The numerical value of the tolerable frequency can, within certain limits mentioned above, be tuned by the factor ft. This factor ft the policy factor, reflects the relative voluntariness and economical benefits of the activity under consideration. For ft = 0.03, NA = 1000 and k = 3 the rule is equal to the existing HPE-rule for chemical

plants.

3 An mathematical-economic approach of the acceptable risk should be included in the philosophy of acceptable risk. It is important to weigh the reduction of risk in monetary terms against the investments needed for additional safety. In this way an economic judgement of the safety level proposed by the two other approaches is added to the information available in the decision making process.

4 In assessing the required safety of a system the three approaches described above should all be investigated and presented as in Figure 8. The most stringent of the three criteria should be adopted.

T U Delft

(46)

5 Finally it should be realised that the philosophy and the techniques set out above are just means to reach a goal. One should not loose sight of the goal managed safety,

when dealing with the tools, that are provided as instruments to measure an aspect of the entire situation.

(47)

8 Literature

[1] CUR, Probabilistic design of flood defences, Gouda, 1988

[2] V A N DE KREEKE, J., PAAPE, A . , On the optimum breakwater design, Proc. 9-th Int. Conf. Coastal Eng.

[3] D A N T Z I G , V . D , KRIENS, J. The economic decision problem of safeguarding the Netherlands against floods. Report of Delta Commission, Part 3, Section I I . 2 (in Dutch), The Hague, 1960.

[4] DANTZIG V . D , Economic Decision Problems for Flood Prevention, Econometrica 24, pp 276-287, New Haven, 1956.

[5] MINISTRY OF HOUSING, L A N D USE PLANNING A N D ENVIRONMENT, LPG Integral Study (in Dutch), The Hague, 1985.

[6] MINISTRY OF HOUSING, L A N D USE PLANNING A N D ENVIRONMENT, Relating to risks (in Dutch), The Hague, 1992.

[7] National Health and Safety Executive, Risk criteria for land-use planning in the vicinity of major industrial hazards, H.M.Stationary Office.

[8] Inst.of Chem. Engin., Nomenclature for hazard and risk assessment in the process industries, 1985, ISBN 85 295184 1

T U Delft

(48)

Annex 1 Socially acceptable failure probability in case of a Bernouilli distribution for the number of deaths

Total number of fatalities 1500 / year

Population in the Netherlands 14 • 106

Number of aquaintances 100

Number of fatalities at work 200 / year

The probability that someone in the circle of aquaintances dies due to an accident :

Pr(death) 1 5 0 0 • 1 0 0 14 - 1 0s

= 1 , 1 - l O "2 / year

Equation 1

The probability that someone dies at work :

Pr (death) = 2 0 0 • 1 0 0 14 - 1 06

1 , 4 -10~3 / year

Equation 2

The policy factor j3 is reflected in the difference between the two frequencies.

So it could be stated that in general the total number of fatalities over all n activities is limited by : Equation 3 <£ Npi • Pd | f i • P£i) • 1 00 i =1 14 - 1 06

< p

• 1 , 4 -10"

I f 20 activities are assumed, each claiming the same number of fatalities, the result is :

Equation 4 20 • (Npi • Pd l f i • Pf i) • 1 0 0 14 - 1 06

< p •

1 , 4 -10" or : Mr

T U Delft

(49)

E(Ndi) = % '

Pd\£i 'P n < P • 1 0 0

Equation 5

So, for the Netherlands the norm for activity i is expressed as :

Equation 6 P < P •1 0 0

Or in words the expected value of the number of fatalities in activity i should be smaller than 0 * 100.

However due to risk aversion one will not only look at the expected value but also at the standard deviation rj(Nd i). Therefore the norm might be better described by :

Equation 7 E(Ndi) + k • a ( Nd l) < P • 1 0 0

Now the p.d.f. of the number of fatalities for activity i is introduced. At one place the probability of no fatalities is (1-p) and of N is p.

f Nd ' j

t

1-p J

1

P / c ) N _Xw

(50)

The expected value is

Equation 8 E ( Nd i j) = p • N

V a r ( Nd l j) = ( 1 - p ) • p ' N2

a ( Nd i j) = si ( 1 - p ) -p ' N ~ \[p • N

I f the activity is performed at NA independent places, the expected value and the standard

deviation of the total number of fatalities due to activity i in one year become :

E(Ndi) = NA- P f l - N

o ( Nd i) = ^ • JPjd -N

Substituting these expressions in the rule leads to :

E(Ndi) + k • o ( Nd i) < P • 1 0 0

N

A

• P

fi

• N + k • JN~

A

• JPJI • N < P • 1 0 0

Equation 9

Equation 10

This is a quadratic form with V Pf i as the unknown. The general solution with a positive value

is : Equation 11 -k ' JN2 ' N + sjk2 • NA • N2 + 4 • P • 100 • NA ' N 2 ' NA • N Equation 12 +

1

2JWA 2 ^ N. k2 + _4_ 1 0 0 -12 N* • N

(51)

Or i f it is realised that NA • N = E(Hi[r) = Np i • Pd|n

Equation 13

ft

1 0 0

pi d\fi

This general expression fits the "accepted" situation in the Netherlands for k = 3 . The expression is reduced to the following simple forms for extreme values of NA :

If NA is very large the standard deviation vanishes with respect to the expected value and the

expression becomes :

Equation 14

p • loo

Pj Pd\fi

p •

1 0 0

If NA is small the standard deviation determines the acceptable probability of failure

Equation 15 P • 1 0 0 k - N, _pi rd\fi

p •

1 0 0 k ' E ( Nd { f i) for NA = 1