Intolerable and imminent risks: How safe is safe enough?

How safe should personnel in or nearby a process plant be?

The most obvious and serious risk to personnel is fatality. How safe should personnel in or nearby a process plant be? Should working in a process plant be as safe as driving a car?

In the U.S. there are approximately 45,000 fatalities every year due to automobile accidents (in the Netherlands – 613 (2017). Would having a similar risk in the process industry mean the industry could kill 45,000 people every year? Or 613 people? Obviously not! For one, not as many people work in process plants as drive automobiles. The issue is not total number of fatalities, but fatality rates.

Fatality rates

There are two common methods of expressing fatality rates. One is the fatal accident rate, or FAR. It is the number of deaths per million-person hours of exposure. Another is the probability per unit of time. There are a number of sources that list fatality rates for various activities, from different industries, means of transportation, recreational activities, including voluntary as well as involuntary risks.  

While the term FAR may be simple to understand and may represent a useful yardstick, companies, are unwilling to put such targets in writing. Imagine walking into a headquarters office and on the wall in the reception area is a sign that reads, “We consider it tolerable to kill 4 people per 100 million-man hours.” The lawyers would have a day!  

However, the industry established another quantified risk target – it’s IRF (Individual Risk of Fatality). Individual risk (IRF) is calculated by identifying all sources of fatality risk to a given individual, deriving the contribution from each source and then summing these to give the overall risk. 

For typical workers the primary sources of risk are:  

1. ? Occupational, e.g. slips and falls, drowning;
2. ? Transport, e.g. road traffic accidents;
3. ? Process safety related, e.g. loss of containment leading to toxic releases, fires or explosions

An IRF of 10-3 per year was first used by the UK HSE as the maximum tolerable criterion because it approximated to the risk experienced by high risk groups in mining, demolition and deep-sea fishing.  Expressed from a dispassionate business perspective, the company must decide how frequently large fatality accidents would need to occur before the company’s survival is put severely at risk due to the adverse reaction of shareholders, the regulator, media and public.

A conservative assumption by the industry is made that process risks represent 10% of all risks. As a result, the default risk criterion for all process risks might be an IRF of 10-4/year.

To illustrate the point, assume for example that a company believes that its future survival would be severely threatened if an accident causing 10 or more fatalities occurred more regularly than once every 10 years across all of its facilities, and if an accident causing 100 or more fatalities occurred more regularly than once every 300 years. 

Figure 1. An example from internet

Furthermore, if the company operates 30 facilities, it decides to allocate its risk evenly between each facility. It can be seen that each individual facility of the company shall never exceed blue line because to its contribution to the company IRF.

 Individual Rate of Falling off chairs

There are approximately 2,300 petrochemical plants in the United States alone. If on average one plant were to have a catastrophic event (involving over 20 fatalities every year) which represents an individual plant risk of 1/2,300 per year, how long would it be before there was a public outcry and the government stepped in?

The relevant statistics can be rather confusing. An individual risk of 1/2,300 means that out of 2,300 plants, on average, one might go “boom” every year. It’s important to realize, however, that you can’t predict which plant and you can’t predict when one will go “boom.”

But since people don’t build 2,300 plants all at once, or live next to 2,300 plants, they want to know the risk of the one plant they’re associated with – their individual risk!

The risk for an individual plant remains the same, 1/2,300 per year. However, some are just not comfortable with such a number. Some twist things around a bit and say the risk of an accident is “once every 2,300 years.” This causes even more confusion. Some then assume it will be 2,300 years before there’s an accident and, therefore, they have nothing to worry about. Nothing could be further from the truth.

For example, approximately 1 in 4,000 people in the U.S. die in a car crash every year (US population: 325 mln, 45000 fatalities every year). If you go to a sports event with 4,000 people present, one can make the prediction that someone will die in an automobile accident within the next 365 days.

3 people out of 100,000 die in the Netherlands in a car crash every year. So, if you live in a city with 100,000 people you can make prediction that 3 people in this city will die due to a car accident within the next 365 days. 

The Dutch risk criteria implemented in the Decree External Safety Establishments (BEVI) 2011 are quantitative risk criteria formulated as Location Specific Individual Risk, to ensure that no individual is exposed to excessive risk. Decisions by the authorities (i.e. environmental permits for establishments and urban planning close to existing establishments) must also take societal risk into consideration. The Individual risk criterion is: vulnerable objects (e.g. houses, schools): maximum of 10?6 deaths/year.  

Given the fact that there are 17 mln. citizens, the Dutch government can maximum tolerate <17 fatalities a year. If you think it is a high number just think about 613 fatalities due to the car accidents in the Netherlands in 2017!

However, you can’t predict which person and you can’t predict which day. The error associated with inverting the number and stating that you’ll live 4,000 years before you die (US) in a car crash (or 33,333 years in the Netherlands) should now be obvious. 

Let’s take a hypothetical example with a chair standing in my office. If someone sits on the chair, he may fall and get injured.  Let’s call it Potential Loss of Balance (instead of Potential Loss of Life).Potential Loss of Balance for the chair (particular scenario) is

  PLB = F (statistical chance of falling off the chair);

If PLB = 1/year (or 100%) then it means that we predict that someone will fall within the next 365 days while sitting on this chair. If only I sit on that chair, then I know that this risk applies only to me.  

What if 4 of my colleagues also sometimes sit in the same chair? Then the risk will be shared among us, so I’d be happier because I’d knew that my Individual Risk of Falling off the chair is: 

IRF = PLB/ people who share the risk = 1/year / 5 = 0.2/year = 2 x10-1 = 20% chance.

I know that someone will definitely fall from this particular chair (PLB=1), but my individual chance is 20%. It might be one of my other colleagues.

What if there is another chair in the room with, with the Potential Loss of Balance is 0.1 (once in ten years?) 

My Individual Risk of Falling off any of the chairs in the room = 0.2/year (1st chair) + 0.02/year (2nd chair) = 0.22/year = 2.2x10-1.

So, it would be 22%. Hence, adding a “safer” chair to the room actually increases the overall individual risk. I cannot tolerate this risk.

In industry, IRF less than 1 x 10-4/year moves the risk into the “tolerable if ALARP” region.

Tolerable or acceptable risk?

We would rather not have the risk, but it is tolerable in view of the benefits obtained by accepting it. The cost in inconvenience or in money is balanced against the scale of risk and a compromise is accepted. ALARP is an acronym for As Low As Reasonably Practicable. It is not reasonably practicable to eliminate all risks entirely. It would be extremely costly to implement all possible risk-reduction measures. There is always a balance between investing more money and the risk reduction obtained by it.

This would apply to traveling in a car, we accept that accidents happen, but we do our best to minimize our chances of disaster.

“Tolerability” does not mean “acceptability”. It refers rather to the willingness to love with a risk to secure certain benefits and in the confidence that it is being properly controlled. To tolerate a risk means that we do not regard it as negligible or something we might ignore, but rather as something we need to keep under ALARP review and reduce still further if and as we can.

Intolerable risk or imminent danger?

When shall we cease the activity? Stop the plant? Or facility?

The intolerable risk and imminent (looming) danger are two interrelated concepts. While intolerable risks can only be risks posing a threat of death to the employees, imminent danger is applicable to more consequences in terms of harm.

The overlapping definition (OSHA, HSE UK and BRZO) of imminent danger/risk/ imminent threat of major accident) is:

“any conditions or practices which are such that a danger exists which could reasonably be expected to cause death or serious physical harm (risk of serious personal injury) or an imminent risk of serious pollution immediately.”

 The following conditions must be met before a hazard becomes an imminent danger:

 1.        There must be a threat of death or serious physical harm or an imminent risk of serious pollution. "Serious physical harm" means that a part of the body is damaged so severely that it cannot be used or cannot be used very well.

2.        For a health hazard there must be a reasonable expectation that toxic substances or other health hazards are present and exposure to them will shorten life or cause substantial reduction in physical or mental efficiency. The harm caused by the health hazard does not have to happen immediately.

3.        The threat must be immediate or imminent. This means that you must believe that death or serious physical harm could occur within a short time;”

By this definition not every intolerable risk is an imminent danger and not every imminent danger is an intolerable risk.

The public view of risks

The probability of an incident is, of course, one of the factors that the public take into account. Yet it is not the only factor and in addition the public's knowledge of the relative size of different risks is often far removed from their actual sizes. The risk from pesticide residues in food, for example, a subject of popular concern, is far less than the risk from natural poisons. Other factors that affect the public's attitude are:

1         Is it voluntary or imposed? 

We accept without complaint risks such as smoking or rock-climbing that we choose to follow but object to risks such as those from industry that are imposed on us without our permission. Drag someone to a mountain and tie boards to his feet and push him downhill. Outrageous, right? Invite that same individual to a ski trip and the picture changes drastically. Individuals accept the risk of a lifetime of smoking (a voluntary action) and driving motorcycle but they insist on protecting a nuclear plant that according to risk experts has negligible risk.

 2         Is it under our control? 

We accept more readily risks, such as driving, that we feel are under our control, than risks such as those from industry, railway accidents or pollution that are not under our control. 

3         Is it natural or man-made? 

We accept more readily natural risks such as those from floods, storms, radioactive radon and natural foods and drugs than man-made risks such as those from industry, nuclear power stations, pesticides, food additives and synthetic drugs. It is due to the mistaken belief that little can be done about Acts of God, as they are sometimes called; in fact, floods, droughts and famines are due to mismanagement rather than too much or too little rain while the effects of earthquakes, volcanoes and hurricanes are often magnified by mismanagement.

In part, the public's attitude is due to an equally mistaken belief that natural foods and drugs are always good for us. In fact, the average US diet contains about only about 0.15 mg/day of synthetic pesticides but 1.5 gram/day of natural pesticides, that is 10,000 times more. Many of the natural pesticides present in food would never be approved if they were tested in the same way as synthetic pesticides. 

Similarly, natural drugs that have been in use for a long time can be sold without going through the rigorous testing necessary for new synthetic drugs. Plants contain natural pesticides because they cannot pull up their roots and run away or fight back with tooth and claw; their only defense is to poison (or prick) their enemies.

What could be more natural than enjoying a bright sunny day? Yet this activity involves a risk of skin cancer. The US National cancer institute has determined that one serous sunburn can increase the risk of skin cancer by as much as 50%. However, many individuals aren’ t concerned to apply protective sunscreen lotions. Because sun is natural it does not carry the same emotion as exposure to asbestos. For the general population, the risk of asbestos poisoning is an insignificant threat when compared to cancer caused by sun worship.

4         Is it familiar? 

We readily accept familiar risks such as those of driving, long-established drugs such as aspirin and traditional industries such as farming but are less ready to accept unfamiliar risks such as those of new drugs and nuclear power. If we want to reduce the consumption of salt, perhaps we should give it an E-number.

We know the size of familiar hazards. Road accidents kill about 3.500 people per year in the UK. This is terrible but at least the extent is known; we are confident that the number killed this year will not be 10,000. In contrast, even if we agree that nuclear power and the chemical industry will probably kill no one this year, we do not feel sure there will not be another Bhopal or another Chernobyl.

5         Have we experienced the hazard?

If we have had personal experience of a risk, we are wary of it in future. If a particular food has made us ill, we may avoid it in the future even though we know that we are unlikely to be offered another contaminated batch. Similarly, if the local factory has caused pollution in the past we tend not to believe assurances that all will be well in the future.

6         Do we fear the consequences? 

Heart disease kills about twice as many people as cancer but nevertheless many people would support the expenditure of greater sums on cancer prevention as cancer inspires so much more fear. This is not a decision made in ignorance as almost every family has experience of both.

7         Do we benefit? 

We accept risks from which we earn a living or derive other benefits. We accept the risk of driving because the benefits of the car are clear and obvious. The benefits of the chemical industry are less obvious. All it seems to do is to produce unpleasant chemicals with unpronounceable names in order to increase profits. At the best, it provides employment and exports. Most people do not realize that it provides the essentials for a standard of living that has vastly improved the length and quality of life.

8         Is it immoral?

Cars kill far more people than are murdered but murder is still less acceptable. We would be outraged if the police stopped trying to catch murderers, or child abusers, and looked for dangerous drivers instead, even if more lives would be saved in this way.

9         How many people could be killed? 

To the public the number that might be killed is more important than the probability of being killed. The airlines realized many years ago that as the number of flights increased the number of accidents could not be allowed to increase in proportion or there would be a public outcry. They found it possible to decrease the rate so that the number remained roughly constant. Similarly, we find the death of ten people in a single incident less acceptable than the death of one person per year for ten years.

About 400000 individuals perish each year from smoking-related deaths. Another 45000 people per year die on highways while driving, yet a single airline crash with 300 deaths draws far more attention.

For example, of the 45,000 traffic fatalities every year, the deaths usually occur one, or a few, at a time. Even with this surprisingly high number of deaths, there’s little (if any) public outcry that something be done to lower this figure. Yet when there’s an accident with a school bus involving injuries to many children there typically is an outcry.

The same could be said about relatively high-risk sports such as skydiving, hang gliding, and ultralight aircraft. Although these sports involve relatively high risk, it’s rare that one hears of multiple fatalities.

The people involved also made their own conscious choice to partake in the activity and outsiders are generally not exposed to the risks. Accidents involving the chemical industry, however, frequently do involve multiple fatalities. Bhopal was the worst to date with over 3,000 deaths and 200,000 injuries. The overall risk associated with working in a chemical

plant can be shown to be less than the risk of driving, yet the public’s perception of the risks of the two activities is typically reversed.

10       What does it remind us of?

Nuclear power reminds us of atomic bombs; electricity from the sun, wind or water reminds us of pleasant summer days in the fresh air. The reality is rather different; more people have been killed by the collapse of dams than by any other peacetime artifact.

11       Is it publicized?

The more space the press devotes to a hazard, the greater it is perceived to be. Drugs that could relieve the pain and suffering of many are withdrawn when the press highlight adverse effects in a few users. Unfortunately, publicity can mean that those who shout the loudest get the most resources. Most people do not know what the air quality was like forty years ago and think pollution has got worse, whilst air quality trends show vast improvements over the past decades.

12       Age of exposed population?

People are less willing to threaten the safety of younger people. School age youngsters and babies are important because they are viewed as our future. Older people are also special concern if they are not able to protect themselves without assistance.

 CONCLUSION

Risk Management is a complex and continuous process. From a business point of view, it is important to establish objective guides and standards related to the various risks.

 It is important to distinguish and comprehend differences between Potential Loss of Life, Individual Fatality Rate, cumulative risks for a production site and even a company as a whole.

Aside from this, it is always to stay in touch with the individual and public perceptions of risk. Even if the public opinion is not in line with objective facts, negative public opinion can bring a company down just as quickly as a major accident (for example the way comedian Youp van ‘t Hek brought down Buckler, an alcohol-free beer brand, by repeatedly making negative jokes about it).

Bibliography

1. Risktec, Risk Criteria - When is low enough good enough? 2007;
2. T.Kletz, The Institution of Occupational Safety and Health, Minutes of the 503rd branch meeting held on 11th January 2005 at the Monton House Hotel;
3. Sanders Roy E., Chemical Process Safety - Learning from Case Histories, 1999;
4. OSHA, Imminent Danger, Section 13(a) of the Act;
5. HSE "Dealing with imminent danger"
6. SIS: Design, Analysis and Justification, 2nd edition, by P.Gruhn and H.Cheddie, 2006