1. Societal Security – Risk communication – Dialogues on risk issues
Professor Jørn Vatn, NTNU

2. Topic for reflection Does a true objective risk exist?
Under which conditions does it make sense to introduce the concept of a true objective risk?
Is the main objective of risk communication to contribute to making perceived risk equal to the true objective risk?
How could decisions be made in a societal security context with a basis in
An objective risk picture
A perceived risk picture
that are not consistent?

3. The challenge of the idea of a true risk picture
The idea of a true risk picture, will in most cases lead to a discussion on what is the uncertainty in the risk analysis
“We do not believe in numbers”
In contrast to “numbers are used to express uncertainty related to our concerns”
Adding “uncertainty” to the risk in the meaning that we do not believe in the analysis, is extremely difficult in risk communication
A more direct approach where focus is uncertainty regarding whether accident will happen, and how serious they are is reccomeded

4. Risk communication - Dialogue processes
Main objective
Obtain concerns regarding the analysis object among stakeholders
Structure this wrt
Dimensions to take into account in the risk analysis
Factors to take into account in the risk analysis
Present the risk picture such that the main concerns are reflected in the risk picture (established by accepted risk analysis methods), and presented in an understandable manner

5. 4 domains as a basis for risk definition
Real world domain
Observables such as number of gas leakages next year
Scientific cause and effect domain
What is the relation between the observables, which theories exists?
We do not claim to possess true knowledge in this domain
Uncertainty domain (we do not know with certainty)
Lack of sure (certain) knowledge regarding future values of observables, current values of observables, and cause & effects
Value and preferences domain
How desirable the various outcomes in the real world are

6. What is risk? Conceptual definition:
risk is to be understood as the uncertainty regarding the occurrence and the severity of events
Operational definition (expressing uncertainty)
R = {<ei,pi,Si>}
ei = undesired events
pi, = an expression of the uncertainty regarding occurrence of events, i.e., probability statements are the quantitative language to express uncertainty (not an inherent property of the system)
Si = Severity of the event, also uncertain, i.e., we need probability statements to express Si

7. The issue of conditional risk
A risk statement is never unconditional, it should reflect many aspects
U = the relevant information, the theories, the understanding, the assumptions etc. which are the basis for the risk assessor when risk is assessed
D = the result of dialog processes and risk communication processes conducted in order to agree upon which elements of severity to focus on (e.g., fatality rate vs gross accidents) “Ambiguity”
V = the result of the verification processes to verify the correctness of the assessment given U and D
 R = {<ei,pi,Si>} | D, U, V
Be as explicit as possible regarding D, U, V

8. Background case study
The local energy provider Lyse was developing an LNG (liquefied natural gas) facility at Risavika outside Stavanger in Norway
Natural gas from the North Sea is transported through pipelines to shore, and then being liquefied at a process plant before it is stored in a huge tank
The LNG is distributed from the facility to local consumers by LNG tankers and LNG lorries
The localisation of the plant has been a hot issue in the region

9. Localization of the LNG factory

10. Project history
The LNG plant is under construction on a dismantled yard of a refinery
The yard was deregulated for new industry and several other enterprises are also under development, including a foreign ferry terminal approx 300 meters from the LNG plant
The LNG facility was approved according to the development plan by the local authorities in June 2006
The authorization to store and treat inflammable goods was given by the national directorate (DSB) in December 2007 based on a preliminary risk analysis
In order to obtain the final authorization from DSB updated risk analyses have to be provided showing that the risk of the facility as built is in accordance to the acceptance criteria
SINTEF/NTNU engaged to assist on risk communication
A first quantitative update of the risk analysis is available 2008
There is significant resistance against the factory, and it has been claimed that more or less all central actors have committed serious mistakes in the approval process (Vinnem, 2008)
Test production started in 2010
The plant was official opened in October 2011

11. Risk communication approach (SINTEF/NTNU)
Mass meeting to inform about the process to come
Invitation to participate in focus groups
4-5 focus groups representing different stakeholders
What are the threat scenarios, and what could be done to counteract these (measures)
A second meeting where one representative for each stakeholder group meet to discuss the findings in the groups
The findings from the dialogue meetings are important input to the risk analysis, i.e., D and U
The presentation of the risk picture in subsequent mass meeting(s) reflects (i) the concerns, (ii) how it is assessed, and (iii) the impact on the risk picture

12. Risk analysis  Mass meeting  Dialogue groups
Purpose of the dialogue groups
Express concern
Bring forward factors affecting risk
Advocate decision criteria and what to focus on, D
Issues that came up
Maintenance can not be guaranteed since DSB (safety authority) is considered much weaker than PTIL (authority in the oil&gas)
Be explicit on worst case
RAC should be replaced by worst case consideration
Risk analysis
The concerns and risk factors were included in the considerations
 The risk picture presented aimed to reflect these concerns D/U
Presenting worst case scenarios was appreciated by some of the strongest opponents

13. Topic 1 – Risk acceptance criteria
In Norway it is common that the enterprises themselves establish risk acceptance criteria (RAC)
Criteria are set both for individual risk for various groups, and for societal risk
This is the case even for third person
Safety authorities gives final approval, but do not give recommendations on RAC
For the particular case in Risavika, societal risk was one of the most demanding issues

14. Societal risk acceptance criteria used

15. Avoid «strange» number formatting

16. How reasonable are the RAC?
The RAC are in accordance with values recommended by the HSE in the UK
Similar RAC in the Netherlands are much stricter
How does the RAC relate to “historical” gross accident risk level in Norway?

17. Historical “risk”

18. Criteria used in the Netherlands

19. Conclusions, RAC
In relation to “historical” events, the applied RAC do not impose significant additional risk
Provided not too many enterprises are balancing on the edge between red and yellow
It is not obvious that “natural events” should be used as a basis
However, it is hard to argue that the criteria are unreasonable
The Dutch criteria are much stricter
Note the history of the Dutch criteria: A calibration was done to give a reasonable risk level for 2000 LPG stations in the Netherlands

20. Should one use RAC?
The way RAC were used, the decision problem is seen as a decision problem where one accept any severity level if the assigned probability is sufficient low
Some of the stakeholders claimed that this is not the correct focus, there are some consequences that are unacceptable independent of their probabilities
This calls for a deterministic approach (Perrow?)
Regulations in Norway does not support such ideas
The topic was indeed discussed during the dialogue meetings, and the mass meetings
This may relate to what Aven & Renn denotes ambiguity

21. Topic 2 - Results from quantitative risk analysis
The results from the QRA shows that the risk is in the ALARP region
The main contributor to the risk is the ferry terminal
An ALARP process has been run to obtain efficient risk reducing measures
The decided risk reduction measures will not bring risk to the Dutch level

22. Topic 3 - Additional risk reducing measure
A drifting gas cloud is the main contributor to gross accident risk
A remote operated fire water pump that can establish a “curtain” of water that may stop the drifting of LNG gas
Forced ignition of drifting LNG gas

23. The plant layout

24. ALARP process
In the ALARP region we should implement all possible risk reducing measure unless they are impractical, or the cost of the measure is disproportional to the risk reducing effect
For the fire pump to produce the protective “curtain” of water, the benefit/cost ratio is found to be approximate 1:30, hence it may be argued that this is a rather costly measure

25. Forced ignition of the gas cloud
If there is a huge gas leakage at the plant, it is a possibility that the gas will not ignite immediately
Thus, a gas cloud may drift away from the plant towards the ferry terminal 300 metres away
If the gas cloud ignite when passing the ferry terminal this could cause up to 1000 fatalities
In order to reduce the consequence of this scenario it is proposed to ignite the gas cloud intentionally before it reaches the terminal building
This measure was rejected by Lyse

26. Effect of the measure
The measure may reduce the probability of an accident with 1000 fatalities with one or two decades depending on the reliability of the ignition unit
Hence, the measure will bring the risk in the direction of the Dutch criteria
Negative aspects:
Personnel fighting against the leakage will be exposed to an additional risk  demanding ethical issue
Increased expected material damages because ignition will for sure make huge material damages, whereas a non ignited gas cloud may drift away without any damage

27. Risk communication: Forced ignition
Forced ignition is a measure that was considered to reduce the risk with an order of magnitude or more
Not recommended by Lyse (i.e., Scangass AS)
The measure was proposed from one of the stakeholder groups
The measure was serious evaluated
One of the public critic of the plant (Norwegian risk analyst) used the following term in a feature article:
The plant is so “risky” that one has to implement such a dramatic measure
He did not claim: To approach the ALARP region all measures were considered….

28. LNG leak in Risavika, 2014 (preventor.no)
The 130 kg LNG leak in early May 2014 from the ferry bunkering facility revealed severe faults, and confirm a lot of the criticism made by Prof Vinnem and others over the years. The main deficiencies according to DSB:
ESD system did not function as specified, isolation took too long time
It could not be documented that operators had required competence, nor had been given relevant training in order to conduct bunkering in a safe manner
It could not be documented that risk assessment had been conducted before deviations from procedures were decided
The fire brigade was never informed about the leak.

29. Thank you for your attention Questions?