RISK ASSESSMENT METHODOLOGY - OPTIONS FOR STEP 2: FSA METHODOLOGY Background to Development A number of options can be considered in the application of the Step 2 FSA methodology. These are, amongst others: Hazard based risk assessment Hazard and operability (HAZOP) studies Failure modes and effects analysis (FMEA) Issues analysis Risk profile generation. Each of these options is considered in turn below. Hazard Based Risk Assessment This is the 'traditional' approach to risk assessment, and is based upon the following sequence of activities: Define the system being studied. Identify the hazards associated with that system. Assess the likelihood of the hazards occurring. Identify how each hazard might progress to various outcomes. Assess the likelihood of progression to each outcome. Assess the consequences associated with each outcome. Multiply likelihood and consequence to obtain the risk associated with each outcome. Sum the risks associated with the outcomes to produce an overall risk. This is a very robust and systematic approach, and has been used for many years to assess risks in a large number of diverse industries, including the shipping industry. In addition, these eight steps listed above could be said to comprise a generic methodology for assessing risks and, as such, warrants consideration as an approach for the application of a FSA methodology.The above approach has several advantages, namely: It is a generic technique; It is very thorough; It easily leads to the identification of incident progression pathways; It attempts to recreate reality (i.e. hazards lead to accidents, which in turn have consequences). The main disadvantage to this approach is that, although the sequence of steps is generic for all risk assessments, the analysis does not lead to a generic answer. This is due to the necessity to rigorously define the system being studied in order to identify the hazards associated with that system. Although such an approach is ideal when considering a specific vessel, the shipping industry is by nature a very diverse industry. Even so-called 'sister' ships often vary in ways that significantly affect the way in which it is operated or in the way that a hazard might progress to cause an accident. Thus, for this approach to be able to produce a realistic estimate of the risk to an entire class of vessels, a very large number of separate arrangements of hardware (engines, bulkheads, fuel systems, fire extinguishing systems, etc) and software (procedures) must be evaluated. Attempts to evaluate the overall risk levels by defining a 'typical' vessel will at best lead to a poor estimation of overall risks, and at worst divert attention from the real issues and lead to a net risk increase. In addition, there are several other areas of difficulty and complexity associated with this approach: Often insufficient data exists on the likelihood of failures and on the potential for those failures to escalate e.g. the likelihood of a fuel leak in an engine room igniting or the proportion of steering gear failures that lead to a collision). All mitigating measures must be considered explicitly in order to examine the progress of the event. It is difficult for future updates to the analysis to incorporate novel risk reduction measures or changes to the system description. Typically, a large proportion of the analysis must be re-worked. The approach is not easy to audit. Many fault trees and/or event trees are generally required to perform the analysis, and these are difficult to check. HAZOP Studies A HAZOP study is a generic methodology for formally identifying the hazards associated with a system. It can be combined with a risk assessment exercise (either ranking by experts or by more rigorous quantification) in order to assess the risk associated with that system. A HAZOP study relies on several key items: A rigorously defined system to study; The use of appropriate keywords and guide-words; An experienced HAZOP team with complementary areas of knowledge. As with the hazard-based risk assessment technique, this approach is generic and systematic. It has also been used for several years in many industries, and has proven its worth for hazard identification and, when combined with risk ranking, for simple risk assessment. In order to utilise this technique for FSA purposes it is necessary to: Define appropriate keywords and guidewords; Define an appropriate level of risk assessment. The lack of the above definition does not detract from the potential usefulness of this tool. The advantages of this approach are: it is a generic technique; it is very thorough; it is a visible process (i.e. it is possible to identify exactly which events have been considered); it requires little knowledge of risk assessment techniques. However, as previously discussed techniques that rely on a very rigorous definition of the system being studied have several inherent disadvantages. In addition, other disadvantages are: it does not lead easily to an explicit quantification of overall risk; the team members are limited by their personal experience; it is difficult to update the analysis over time; whilst hazards are identified thoroughly, the progression of those hazards to final outcomes is not rigorously examined. FMEA The FMEA technique is very similar to a HAZOP study, in that a defined system is considered in some detail, following a formalised procedure. Faults at the part/component level are identified and, using failure rates for the appropriate operating conditions, their effect on the system level is determined. Each part is considered in turn as having failed in each possible mode. The effect of each of these failures at various system levels is noted and a failure rate assigned from available data. Each system level failure mode will be seen to result from various possible component failures, and these can be grouped together for the purpose of calculating the system failure rate. Again, this approach is generic and systematic, and is a widely accepted technique for assessing the reliability of a system. The advantages to this approach are: it is a generic technique; it is very thorough; it easily leads to the identification of incident progression pathways. Again, however, a detailed system definition is required. It suffers from the same disadvantages as the hazard-based approach. In addition it does not quantify the effects of failures, and so further work is required in order to estimate risk levels. Issues Analysis Issue analysis is a systematic approach to ensure that all key issues are identified with a lower chance of oversight. There are four tasks in the process: The first task requires that the overall over-riding issue should be identified. The second task beaks down the overall issue into issues and sub-issues in terms of simple statements of requirements; these must have yes or no answers as to whether they are correct or complied with or "not confirmed". The third task develops hypotheses from these sub-issues. The fourth task develops conclusions and recommendations. This approach is very good for analysing a non-numerical problem in a logical and systematic way. It does not rely on a detailed system description, and can very quickly develop a logical basis from which decisions can be made or attention focused. The approach is highly visible, as a logical structure can be drawn showing the relationship between the issues and sub-issues, facilitating auditability. The disadvantage is that this method does not readily facilitate the analysing of a numerical problem, as the answers are all in terms of 'Yes/No'. Risk Profile Generation This approach is generic methodology for determining the risk profile of a type of vessel, system or function and for identifying the underlying causes which make up that risk profile. The first task is to classify the various causes of accidents. This allows the classification of risks into categories (e.g. 'Collision') and subcategories (eg. 'Collision caused by watch-keeping failure'). Secondly, the risk profile for a typical vessel of the type being considered is generated in the form of a logic tree structure, here called "the risk contribution tree". This process performed from the top down, as follows: The top-level risks are initially quantified (from historical data for established ship types). The second level risks are assigned by determining their contribution to the top-level risks. Similarly, any third or further level risks are assigned by determining their contribution to t he first level risks. This process is repeated until all risks have been quantified. Once the risk profile has been generated, the underlying causes of the bottom level risks are determined. These are evaluated separately for factors which influence the frequency of an event occurring, factors which influence the progression of an event to cause loss and factors which influence the magnitude of the loss. A logical structure is then developed showing the relationship between the various factors. In the initial base case, all the influencing factors are set at a value of 1.0, i.e. they neither raise nor lower the risk away from the historically observed value for an average vessel of that type. Once risk reduction measures are proposed, these factors are evaluated in terms of their influence on average risk levels, with a value of 1.2 indicating a 20% increase in the risk and a value of 0.8 indicating a 20% reduction in the risk. Approach Adopted in this Paper It is this latter approach of risk profile generation that has been adopted as the central methodology in this step. The risk profile process is illustrated diagrammatically in Figure 2.1 - as the risk contribution tree. The purpose of the risk contribution tree is to structure the causes of accidents and apportion the contribution they make to the frequency of loss of life (as derived from the F-N, frequency - number of fatality curves). The traditional approaches to risk assessment discussed above, and used in other industries are ideally suited to situations where the large accidents are rare events which cannot be reliably predicted, and where there is a need to reflect precise differences in design and operation of each individual plant or platform. In the case of shipping, however, there is a wealth of data on the major losses that have occurred and their immediate causes. The situation is different therefore from that in which Quantified Risk Assessment (QRA) techniques are normally used. In addition, the need in this case to generate a generic methodology precludes the approach of other industries as this is necessarily tailored to specific installations or operation by means of event trees which vary in structure. The approach to apply is therefore one in which the risk to a typical vessel is determined (from historical data), and then broken down by various hazardous outcomes; multiplying factors (which may raise or lower risk for those outcomes away from the norm) are quantified. The key elements of the methodology are therefore that it will: minimise the use of complex event trees; concentrate on "high level"issues and avoid the consideration of ship-specific aspects; be modular, in order to allow future improvements to be slotted in or taken out as appropriate; be flexible, in order to incorporate results and requirements from other projects running concurrently; account for the possibility that risk reduction measures may raise some risks whilst lowering others. The identification of three categories of influencing factors is consistent with the main components of risk, which are: frequency consequence magnitude of impact. Often consequence and impact are combined and termed severity, however it is important to distinguish between them in the consideration of risk reduction. Clearly an accident can be a serious event in terms of damage to the ship without necessarily affecting the safety of people. At the extreme this may be because there are no people present, however in practice what is meant is the rapid removal of people from the incident or their effective protection from its effects. Therefore in this methodology, these three components have been addressed separately by using likelihood, progression, and magnitude factors. The quantification of the effect of different risk control options on these factors may be achieved in many different ways, using one of several techniques. One particularly useful method in this context however is that of the influence diagram approach which is a method of modeling the network of influences. These influences link failures at the operational level with their direct causes, and with the underlying organisational and regulatory influences. Performance influencing factors represent the effect of underlying causes by operating on the direct causes. In addition to providing a qualitative tool for understanding the nature of these influences, the influence diagram can also be used as a predictive tool. Although the influence diagram approach has been developed in the context of human factors and failures it can also be applied to accidents primarily due to hardware failures or external events (e.g. extreme weather). It is also necessary to consider other causal influences introduced through the state of knowledge inherent in design approaches, material selection, construction technology and the operating environment to which ships are subjected. This knowledge is embedded in rules and regulations and supporting design, construction and operational practice. These largely top down analysis also makes the best use of the relatively good data available at the major accident level. This does not, however, imply that the methodology will only address accidents that have happened in a reactive way. The essential feature of the methodology is the generation of a generic risk profile for a vessel type where the factors that may affect this risk, whether in terms of likelihood, progression or magnitude of fatalities, are explicit and may be varied to reflect changes in operation, design or safety measures aided by appropriate influence diagrams. By trying to understand the underlying causes, therefore, the method becomes a proactive tool rather than reactive. This top down approach has been successfully used in a number of other applications: In the railway industry to determine the causes of fatalities at level crossings, and also to determine the necessity for ATP (Automatic Train Protection) systems. In the nuclear industry to determine the likelihood of degraded cores from loss of coolant accidents. In the offshore industry in two ways; to evaluate events which can cause impairment of safety functions in the Norwegian concept safety evaluation and, on a Liverpool Bay Oil storage barge to modify tanker fire and explosion data for the enhanced operational and human factors situation.