Acceptable risk levels examples

Safety-related constraints should have two-way links to the system hazard log and to any analysis results that led to that constraint being identified as well as links to the design features (usually level 2) included to eliminate or control them. Hazard analyses are linked to level 1 requirements and constraints, to design features on level 2, and to system limitations (or accepted risks). An example of a level 1 safety constraint derived to prevent hazards is ... 

An acceptable risk level for structures must be related to the basic risk accepted by all people in a society. Tliis basic risk is that which is beyond th individuals direct control. In modern times it has been the duty of govermeni through various safety controls, to regulate this hazard at an acceptable level fo society as a whole. The choice of an acceptable risk level will be affected by th special importance of structures in society as previously discussed, but must b clearly distinguished from the risk levels that an individual is prepared to tolerat when he is in control of what he is doing (for example mountaineering). 

Real-world descriptions of acceptable risk levels are demonstrated by these examples. They vary considerably. 

Earlier in this chapter, reference was made to a speaker who reviewed the hazard analysis and risk assessment methods used in his company, which relied on typical risk assessment and decision-making matrices, to achieve acceptable risk levels. Use of such matrices is a method some organizations apply to arrive at acceptable risk levels. Table 15.1 is an example of such a risk assessment matrix. Using the results from Table 15.1, levels of remedial action or risk acceptance for individual risk categories can be established, as in Table 15.2. 

There are minor differences between the two decision processes. The SSCl is determined in a more qualitative way by using two factors, i.e. hazard severity and software autonomy. The SIL should he determined in a quantitative probabilistic way by computing the risks of the system and comparing with accepted risk levels. Thus the necessary risk reduction is determined which in tun determines the rehahhity requirement for the safety function. Risk graphs (see section 2.2) and risk maps are rather considered as qualitative estimation methods by lEC 61508. Finally we mention that the AOP 52 presents in chapter 11 in total 6 case studies where 3 are taken fi om the ammunition domain. Such specific examples are not available in the lEC 61508. 

A PRA aims to quantify Equation (9.1). The identification of hazards will always be a qualitative process, but numerical values can be assigned to the consequence and frequency terms. For example, the hazard of overfilling an on-board methanol tank could result in a fire leading to a fatality. If this event occurs maybe once every 5000 years then the risk associated with overflowing a methanol tank is 0.0002 fatalities per year. If the Acceptable Risk Level (ALARP) states that a fatality rate of more than 1 in 10,000 years is unacceptable (the ALARP value discussed in Chapter 1), then the methanol overflow hazard needs to be ameliorated. If the hazard cannot be removed altogether, then the consequence term can be reduced, say by reducing the size of the spill or by using a... 

A risk assessment matrix for use in determining acceptable risk levels is offered as an example. 

The ALARP concept (as low as reasonably practicable) is discussed with an example of how the concept is applied in achieving an acceptable risk level. 

Where multiple, diverse hazards exist, the practical approach is to treat each hazard independently, with the intent of achieving acceptable risk levels for all. In the noise and toluene example, the hazards are indeed independent. In complex situations, or when competing solutions to complex systems must be evaluated, the assistance of specialists with knowledge of more sophisticated risk assessment methodologies such as Hazard and Operability Analysis (HAZOP) or Fault Tree Analysis (FTA) may be required. However, for most applications, this author does not recommend that diverse risks be summed through what could be a questionable methodology. 

Some of the MOC examples provided require that risk assessments be made at several stages of the change activity. The intent is to achieve and maintain acceptable risk levels throughout the work process. Thus, risk assessments are to be made as often as needed as changes occur and particularly when unexpected situations arise. In this regard, safety professionals who become skilled in making risk assessments can provide a significant value added consultancy. 

One of the provisions in this section recommends that suppliers of equipment, technologies, processes and materials provide documentation establishing that a risk assessment has been conducted and that an acceptable risk level, as outlined by the procuring organization, has been achieved. Addendum D is an example of a basic Risk Assessment Report that can be used as a guide for that purpose. 

Each application has revealed new aspects that had not been considered previously (Table I). Nevertheless, the examples share one characteristic common to toxic chemical risk analysis an acceptable exposure level must be combined with a relationship between source concentration and estimated degree of exposure. This concept has been published previously(1,2,3) ... 

However, it is also common to use standards to set up the infrastructure, policies, controls, or rules that mean that incidents and risks occur with acceptably rare probabilities. These standards might be described as strategic standards. For example, controls on ammonia in sewage treatment works (which are back-calculated from environmental standards) are designed to promote good fisheries in the receiving river. The intention is to reduce serious incidents to an acceptable frequency in each river because the infrastructure of sewage treatment appears to function at this level of acceptable risk. This may result in a compromise, which is essentially that standards are set up as particular types of summary statistics and not as absolute limits. 

Interspecies and intraspecies UFs have been used in the development of safe or threshold exposure levels for chronic, noncancer toxicity by health organizations throughout the world. Examples include the acceptable daily intake (ADI) (Lu 1988 Truhaut 1991 Lu and Sielken 1991), the tolerable daily intake (TDI) or tolerable concentration (TC) (Meek et al. 1994 IPCS 1994), the minimal risk level (MRL) (Pohl and Abadin 1995), the reference dose (RfD) (Barnes and Dourson 1988 Dourson 1996), and the reference concentration (RfC) (EPA 1994 Jarabek et al. 1990). The importance of using distribution-based analyses to assess the degree of variability and uncertainty in risk assessments has been emphasized in recent trends in risk analysis. This will enable risk managers to make more informed decisions and... 

In its simplest form, risk assessment asks, How much exposure can we allow without causing irreparable harm Harm to whom Initially, to a maximally exposed individual and more recently to a sensitive and maximally exposed individual. For example, to keep chemical contamination to acceptable levels in a river, EPA would define acceptable risk to a maximally exposed individual. Acceptable risk would be defined as an exposure to a contaminant below its threshold for causing damage or, more often, a one-in-a-million risk of getting cancer from a... 

Decision-makers have sometimes found presentations of comparative risk information a useful aid to the public discourse on risk acceptance. We referred in the last section, for example, to OSHA s use of statistics on the risks of job-related accidents to support decisions on risk reduction goals for workplace carcinogens. The agency noted that lifetime risks of death from injuries suffered in what most people perceive to be safe occupations do not go below about 1 per 1000. Data of these types were helpful in explaining why the agency settled on carcinogen risk levels in this range as sufficiently low to provide a safe work environment. 

For example, the Ontario risk assessment uses a no observable effect level (NOEL) of 0.001 ug/kg/day (6.73) and a safety factor of 100 to obtain a maximum allowable dally intake of 1 X 10" 1 g/kg/day (= 10 pg/kg/day) for humans (74). In contrast, EPA has used a value of 6.4 X 10" 5 g/kg/day which suggests cancer risks that are 1670 fold higher. The United States Food and Drug Administration (FDA) has, on the other hand, accepted risks associated with the ingestion of up to 13 pg/kg/day. (Table IX). 

Achieving understanding of the terms used in risk assessment matrices is vital for their use in a particular organization. For example, in actual practice, a variety of definitions are used of the terms establishing probability and severity levels, as in Table 15.1. Terms applicable to a discussion of acceptable risk are presented in the following definitions. 

Understandably, the level of acceptable risk in operations where most safety practitioners have influence is much lower than those tolerated in space ventures. For example, a major equipment failure of 1 in 1000 startups—the NASA design standard for Loss of Vehicle (LOV) probability — would be unacceptable in all but the exceptionally unusual situation. 

The purpose of the study is to provide a minimum safety integrity level of HIPPS for determination of required risk reduction performance. A systematic approach and an example to assign the acceptable safety level of a pilot HIPPS model are proposed based on the LOPA. 

In order to determine the required SIL level, a detailed hazard analysis is performed for the equipment under control (EUC). From the hazard analysis, all safety functions are identified (example—Detect failure of braking). A target safety integrity level is assigned to each of the safety functions (example—detect failure of braking—SIL 3) in order to ensure the residual risk is lower than the acceptable risk (in other words, the risk is sufficiently reduced). The outcome will be an EUC safety function specification detailing the function and target SIL level (between 1 to %) required for each safety function identified in the hazard analysis. 

---