1. Some principles for acceptance criteria for online risk picture
Jørn Vatn, NTNU

2. Principle 1
Acceptance criteria shall contribute to good decisions

3. Principle 1 Acceptance criteria shall contribute to good decisions
A good decision should
Reflect preference structures
Take uncertainty into account

4. Principle 2
Online criteria shall reflect the same preference structure as stated in the acceptance criteria for average considerations

5. What is acceptance criteria?
Acceptance criteria define lines of demarcation between what is acceptable, and what is not acceptable
Acceptance criteria (AC) may be defined for any condition, variable, action, behaviour etc.
Risk acceptance criteria (RAC) define criteria related to risk

6. Note
Risk acceptance criteria may be in conflict with stated preference structures:
Abrahamsen and Aven (2008) show that the use of risk acceptance criteria may violate the independence axiom of the expected utility theory
In risk management frameworks RAC are important, whereas use of consistent frameworks like utility theory is not!

7. What is risk?
Within the risk analysis society two different views are often presented:
Risk exists independent of the analyst, i.e., risk is a property of a technical system, a socio-technical system etc. Risk is generally uncertain, we have not sufficient data to assess the true risk.
Risk is uncertainty related to future events. Uncertainty means that the risk analyst does not know everything regarding future events.

8. Principle 3
The way we express and use risk acceptance criteria should reflect our understanding of risk
Risk is a property: In this perspective risk exist, but is usually unknown. The analyst needs to take uncertainty into account, e.g., letting the risk, R, be a random quantity. It is required to define how a random quantity can be compared to the RAC!
Risk is uncertainty: To express risk, probabilities are used to express the uncertainty. Probabilities are not random quantities, hence it is easier to compare with RAC
In the following, approach 2 is pursued

9. What is risk?
Position 2: Risk is essentially the answer to 3 fundamental questions dealing with uncertainty:
What can go wrong?
Will it go wrong?
And if so, how bad will it be?
Probabilities are used to express uncertainty
Probabilities do not exist, i.e., they represent personal believes
Probabilities are not uncertain, but conditional to our understanding

10. Risk picture (1)
A set of undesired events, the causes and factors that may contribute to the event, the possible consequences of the event with corresponding influencing factors …

11. Risk picture (2)
A set of undesired events, the causes and factors that may contribute to the event, the possible consequences of the event with corresponding influencing factors, and uncertainties related to all these issues
Risk = Uncertainty regarding events  RAC
Causes and factors are not risk  AC

12. Average conditions, examples
Acceptance criteria - AC
The Norwegian Activity Instruction § 76 and the Governing instruction § 2 require that there are two independent barriers protecting against the well stream and that the status of these shall always be known
It is not acceptable to drive the car if you are not sober
It is not acceptable to drive the car if you do not have a driving license

13. Average conditions, examples
Risk acceptance criteria - RAC
FAR = 10, i.e., the expected number of fatalities per 108 work hour shall be less than 10 (oil and gas)
PLL = 11, i.e., the expected number of fatalities in Norwegian rail operation shall be less than 11
f-N curve 

14. How to set RAC? It is hard to spot any scientific arguments
Scientific in the “natural science” sense would in any case be meaningless
Three approaches often used
Historical rates (Unacceptable to go in the wrong direction, i.e., increasing risk)
Comparisson with other activities or threats
Extra risk by an activity should be insignificant in relation to baseline risk, MEM (IEC 61508)

15. Principle 1 Acceptance criteria shall contribute to good decisions
It is hard to really see that the way RAC are defined and used today really supports good decisions
Principle 1 is really a bit shaky !

16. “Online” questions (from Lars)
Can hot work be performed in the area in which you have degraded barriers?
What are acceptable risk compensating measures upon barrier degradation?
It is not obvious that these are online risk decisions
The principles, or the way to argue, need to be defined in advance, but used “online”

17. Principle 2
Online criteria shall reflect the same preference structure as stated in the acceptance criteria for average considerations
Given average consideration RACs, we may in principle deduce online implications
Risk allocation principles are required

18. Risk allocation
Risk allocation is often recommended when high level RAC should be distributed to low level RACs, e.g., SIL = Safety Integrity Levels on safety function level
In the Norwegian oil & gas industry this is regarded almost impossible, hence OLF 70 propose other approaches
Principle 2 would be very demanding!

19. The 2 questions and risk allocation - 2nd attempt
Can hot work be performed in the area in which you have degraded barriers? (Q1)
What are acceptable risk compensating measures upon barrier degradation? (Q2)
Proposed principles
Assume overall (average) RAC are fulfilled
Assume risk contribution from each “scenario” is known, and “optimized” from the QRA. On scenario level (totals) we shall have:
Instantaneous risk cannot exceed average scenario risk by more than one order of magnitude (Q1)
Long term risk increase cannot exceed 10% (Q2)

20. Note the following
The numbers (tenfold and 10%) are rather arbitrary, but some case studies may verify these numbers (with modifications)
The approach would require static and operational risk analysis to be combined
Expected utility theory would have “solved” the normative issues in Q1 and Q2
whereas the RAC approach by no means are able to handle these in a similar traceable manner