Societal Security – Risk communication – Dialogues on risk issues Professor Jørn Vatn, NTNU

Topic for reflection Does a true objective risk exist? Under which conditions does it make sense to introduce the concept of a true objective risk? Is the main objective of risk communication to contribute to making perceived risk equal to the true objective risk? How could decisions be made in a societal security context with a basis in An objective risk picture A perceived risk picture that are not consistent?

The challenge of the idea of a true risk picture The idea of a true risk picture, will in most cases lead to a discussion on what is the uncertainty in the risk analysis “We do not believe in numbers” In contrast to “numbers are used to express uncertainty related to our concerns” Adding “uncertainty” to the risk in the meaning that we do not believe in the analysis, is extremely difficult in risk communication A more direct approach where focus is uncertainty regarding whether accident will happen, and how serious they are is reccomeded

Risk communication - Dialogue processes Main objective Obtain concerns regarding the analysis object among stakeholders Structure this wrt Dimensions to take into account in the risk analysis Factors to take into account in the risk analysis Present the risk picture such that the main concerns are reflected in the risk picture (established by accepted risk analysis methods), and presented in an understandable manner

4 domains as a basis for risk definition Real world domain Observables such as number of gas leakages next year Scientific cause and effect domain What is the relation between the observables, which theories exists? We do not claim to possess true knowledge in this domain Uncertainty domain (we do not know with certainty) Lack of sure (certain) knowledge regarding future values of observables, current values of observables, and cause & effects Value and preferences domain How desirable the various outcomes in the real world are

What is risk? Conceptual definition: risk is to be understood as the uncertainty regarding the occurrence and the severity of events Operational definition (expressing uncertainty) R = {<ei,pi,Si>} ei = undesired events pi, = an expression of the uncertainty regarding occurrence of events, i.e., probability statements are the quantitative language to express uncertainty (not an inherent property of the system) Si = Severity of the event, also uncertain, i.e., we need probability statements to express Si

The issue of conditional risk A risk statement is never unconditional, it should reflect many aspects U = the relevant information, the theories, the understanding, the assumptions etc. which are the basis for the risk assessor when risk is assessed D = the result of dialog processes and risk communication processes conducted in order to agree upon which elements of severity to focus on (e.g., fatality rate vs gross accidents) “Ambiguity” V = the result of the verification processes to verify the correctness of the assessment given U and D  R = {<ei,pi,Si>} | D, U, V Be as explicit as possible regarding D, U, V

Background case study The local energy provider Lyse was developing an LNG (liquefied natural gas) facility at Risavika outside Stavanger in Norway Natural gas from the North Sea is transported through pipelines to shore, and then being liquefied at a process plant before it is stored in a huge tank The LNG is distributed from the facility to local consumers by LNG tankers and LNG lorries The localisation of the plant has been a hot issue in the region

Localization of the LNG factory

Project history The LNG plant is under construction on a dismantled yard of a refinery The yard was deregulated for new industry and several other enterprises are also under development, including a foreign ferry terminal approx 300 meters from the LNG plant The LNG facility was approved according to the development plan by the local authorities in June 2006 The authorization to store and treat inflammable goods was given by the national directorate (DSB) in December 2007 based on a preliminary risk analysis In order to obtain the final authorization from DSB updated risk analyses have to be provided showing that the risk of the facility as built is in accordance to the acceptance criteria SINTEF/NTNU engaged to assist on risk communication A first quantitative update of the risk analysis is available 2008 There is significant resistance against the factory, and it has been claimed that more or less all central actors have committed serious mistakes in the approval process (Vinnem, 2008) Test production started in 2010 The plant was official opened in October 2011

Risk communication approach (SINTEF/NTNU) Mass meeting to inform about the process to come Invitation to participate in focus groups 4-5 focus groups representing different stakeholders What are the threat scenarios, and what could be done to counteract these (measures) A second meeting where one representative for each stakeholder group meet to discuss the findings in the groups The findings from the dialogue meetings are important input to the risk analysis, i.e., D and U The presentation of the risk picture in subsequent mass meeting(s) reflects (i) the concerns, (ii) how it is assessed, and (iii) the impact on the risk picture

Risk analysis  Mass meeting  Dialogue groups Purpose of the dialogue groups Express concern Bring forward factors affecting risk Advocate decision criteria and what to focus on, D Issues that came up Maintenance can not be guaranteed since DSB (safety authority) is considered much weaker than PTIL (authority in the oil&gas) Be explicit on worst case RAC should be replaced by worst case consideration Risk analysis The concerns and risk factors were included in the considerations  The risk picture presented aimed to reflect these concerns D/U Presenting worst case scenarios was appreciated by some of the strongest opponents

Topic 1 – Risk acceptance criteria In Norway it is common that the enterprises themselves establish risk acceptance criteria (RAC) Criteria are set both for individual risk for various groups, and for societal risk This is the case even for third person Safety authorities gives final approval, but do not give recommendations on RAC For the particular case in Risavika, societal risk was one of the most demanding issues

Societal risk acceptance criteria used

Avoid «strange» number formatting

How reasonable are the RAC? The RAC are in accordance with values recommended by the HSE in the UK Similar RAC in the Netherlands are much stricter How does the RAC relate to “historical” gross accident risk level in Norway?

Historical “risk”

Criteria used in the Netherlands

Conclusions, RAC In relation to “historical” events, the applied RAC do not impose significant additional risk Provided not too many enterprises are balancing on the edge between red and yellow It is not obvious that “natural events” should be used as a basis However, it is hard to argue that the criteria are unreasonable The Dutch criteria are much stricter Note the history of the Dutch criteria: A calibration was done to give a reasonable risk level for 2000 LPG stations in the Netherlands

Should one use RAC? The way RAC were used, the decision problem is seen as a decision problem where one accept any severity level if the assigned probability is sufficient low Some of the stakeholders claimed that this is not the correct focus, there are some consequences that are unacceptable independent of their probabilities This calls for a deterministic approach (Perrow?) Regulations in Norway does not support such ideas The topic was indeed discussed during the dialogue meetings, and the mass meetings This may relate to what Aven & Renn denotes ambiguity

Topic 2 - Results from quantitative risk analysis The results from the QRA shows that the risk is in the ALARP region The main contributor to the risk is the ferry terminal An ALARP process has been run to obtain efficient risk reducing measures The decided risk reduction measures will not bring risk to the Dutch level

Topic 3 - Additional risk reducing measure A drifting gas cloud is the main contributor to gross accident risk A remote operated fire water pump that can establish a “curtain” of water that may stop the drifting of LNG gas Forced ignition of drifting LNG gas

The plant layout

ALARP process In the ALARP region we should implement all possible risk reducing measure unless they are impractical, or the cost of the measure is disproportional to the risk reducing effect For the fire pump to produce the protective “curtain” of water, the benefit/cost ratio is found to be approximate 1:30, hence it may be argued that this is a rather costly measure

Forced ignition of the gas cloud If there is a huge gas leakage at the plant, it is a possibility that the gas will not ignite immediately Thus, a gas cloud may drift away from the plant towards the ferry terminal 300 metres away If the gas cloud ignite when passing the ferry terminal this could cause up to 1000 fatalities In order to reduce the consequence of this scenario it is proposed to ignite the gas cloud intentionally before it reaches the terminal building This measure was rejected by Lyse

Effect of the measure The measure may reduce the probability of an accident with 1000 fatalities with one or two decades depending on the reliability of the ignition unit Hence, the measure will bring the risk in the direction of the Dutch criteria Negative aspects: Personnel fighting against the leakage will be exposed to an additional risk  demanding ethical issue Increased expected material damages because ignition will for sure make huge material damages, whereas a non ignited gas cloud may drift away without any damage

Risk communication: Forced ignition Forced ignition is a measure that was considered to reduce the risk with an order of magnitude or more Not recommended by Lyse (i.e., Scangass AS) The measure was proposed from one of the stakeholder groups The measure was serious evaluated One of the public critic of the plant (Norwegian risk analyst) used the following term in a feature article: The plant is so “risky” that one has to implement such a dramatic measure He did not claim: To approach the ALARP region all measures were considered….

LNG leak in Risavika, 2014 (preventor.no) The 130 kg LNG leak in early May 2014 from the ferry bunkering facility revealed severe faults, and confirm a lot of the criticism made by Prof Vinnem and others over the years. The main deficiencies according to DSB: ESD system did not function as specified, isolation took too long time It could not be documented that operators had required competence, nor had been given relevant training in order to conduct bunkering in a safe manner It could not be documented that risk assessment had been conducted before deviations from procedures were decided The fire brigade was never informed about the leak.

Thank you for your attention Questions?