Some principles for acceptance criteria for online risk picture Jørn Vatn, NTNU

Principle 1 Acceptance criteria shall contribute to good decisions

Principle 1 Acceptance criteria shall contribute to good decisions A good decision should Reflect preference structures Take uncertainty into account

Principle 2 Online criteria shall reflect the same preference structure as stated in the acceptance criteria for average considerations

What is acceptance criteria? Acceptance criteria define lines of demarcation between what is acceptable, and what is not acceptable Acceptance criteria (AC) may be defined for any condition, variable, action, behaviour etc. Risk acceptance criteria (RAC) define criteria related to risk

Note Risk acceptance criteria may be in conflict with stated preference structures: Abrahamsen and Aven (2008) show that the use of risk acceptance criteria may violate the independence axiom of the expected utility theory In risk management frameworks RAC are important, whereas use of consistent frameworks like utility theory is not!

What is risk? Within the risk analysis society two different views are often presented: Risk exists independent of the analyst, i.e., risk is a property of a technical system, a socio-technical system etc. Risk is generally uncertain, we have not sufficient data to assess the true risk. Risk is uncertainty related to future events. Uncertainty means that the risk analyst does not know everything regarding future events.

Principle 3 The way we express and use risk acceptance criteria should reflect our understanding of risk Risk is a property: In this perspective risk exist, but is usually unknown. The analyst needs to take uncertainty into account, e.g., letting the risk, R, be a random quantity. It is required to define how a random quantity can be compared to the RAC! Risk is uncertainty: To express risk, probabilities are used to express the uncertainty. Probabilities are not random quantities, hence it is easier to compare with RAC In the following, approach 2 is pursued

What is risk? Position 2: Risk is essentially the answer to 3 fundamental questions dealing with uncertainty: What can go wrong? Will it go wrong? And if so, how bad will it be? Probabilities are used to express uncertainty Probabilities do not exist, i.e., they represent personal believes Probabilities are not uncertain, but conditional to our understanding

Risk picture (1) A set of undesired events, the causes and factors that may contribute to the event, the possible consequences of the event with corresponding influencing factors …

Risk picture (2) A set of undesired events, the causes and factors that may contribute to the event, the possible consequences of the event with corresponding influencing factors, and uncertainties related to all these issues Risk = Uncertainty regarding events  RAC Causes and factors are not risk  AC

Average conditions, examples Acceptance criteria - AC The Norwegian Activity Instruction § 76 and the Governing instruction § 2 require that there are two independent barriers protecting against the well stream and that the status of these shall always be known It is not acceptable to drive the car if you are not sober It is not acceptable to drive the car if you do not have a driving license

Average conditions, examples Risk acceptance criteria - RAC FAR = 10, i.e., the expected number of fatalities per 108 work hour shall be less than 10 (oil and gas) PLL = 11, i.e., the expected number of fatalities in Norwegian rail operation shall be less than 11 f-N curve 

How to set RAC? It is hard to spot any scientific arguments Scientific in the “natural science” sense would in any case be meaningless Three approaches often used Historical rates (Unacceptable to go in the wrong direction, i.e., increasing risk) Comparisson with other activities or threats Extra risk by an activity should be insignificant in relation to baseline risk, MEM (IEC 61508)

Principle 1 Acceptance criteria shall contribute to good decisions It is hard to really see that the way RAC are defined and used today really supports good decisions Principle 1 is really a bit shaky !

“Online” questions (from Lars) Can hot work be performed in the area in which you have degraded barriers? What are acceptable risk compensating measures upon barrier degradation? It is not obvious that these are online risk decisions The principles, or the way to argue, need to be defined in advance, but used “online”

Principle 2 Online criteria shall reflect the same preference structure as stated in the acceptance criteria for average considerations Given average consideration RACs, we may in principle deduce online implications Risk allocation principles are required

Risk allocation Risk allocation is often recommended when high level RAC should be distributed to low level RACs, e.g., SIL = Safety Integrity Levels on safety function level In the Norwegian oil & gas industry this is regarded almost impossible, hence OLF 70 propose other approaches Principle 2 would be very demanding!

The 2 questions and risk allocation - 2nd attempt Can hot work be performed in the area in which you have degraded barriers? (Q1) What are acceptable risk compensating measures upon barrier degradation? (Q2) Proposed principles Assume overall (average) RAC are fulfilled Assume risk contribution from each “scenario” is known, and “optimized” from the QRA. On scenario level (totals) we shall have: Instantaneous risk cannot exceed average scenario risk by more than one order of magnitude (Q1) Long term risk increase cannot exceed 10% (Q2)

Note the following The numbers (tenfold and 10%) are rather arbitrary, but some case studies may verify these numbers (with modifications) The approach would require static and operational risk analysis to be combined Expected utility theory would have “solved” the normative issues in Q1 and Q2 whereas the RAC approach by no means are able to handle these in a similar traceable manner