Choosing Safety

A Guide to Using Probabilistic Risk Assessment and Decision Analysis in Complex, High-Consequence Systems

Michael V. Dr Frank

• Publisher: Routledge
• Year: 2010
• ISBN:
  9781136526121
• Edition: 1
• Topic: Business
• Subtopic: Transportation Industry
• Index: Business

The technological age has seen a range of catastrophic and preventable failures, often as a result of decisions that did not appropriately consider safety as a factor in design and engineering. Through more than a dozen practical examples from the author's experience in nuclear power, aerospace, and other potentially hazardous facilities, Choosing Safety is the first book to bring together probabilistic risk assessment and decision analysis using real case studies. For managers, project leaders, engineers, scientists, and interested students, Michael V. Frank focuses on methods for making logical decisions about complex engineered systems and products in which safety is a key factor in design - and where failure can cause great harm, injury, or death.

CHAPTER 1

Choosing Safety: An Overview

SIMPLYPUT, a decision is a choice among alternative courses of action. More complicated situations typically engender more difficult decisions because a decisionmaker (DM)¹ has many more interrelated factors to consider. Decision analysts (DAs) consider a good decision to be different from a good outcome. In the decision analysis context, a good decision has to do with how it is made, not with the final choice or outcome. According to Hammond and colleagues (1999), “The only way to learn to raise your odds of making good decisions is to learn to use a good decisionmaking process….”

In this book, I use examples to show how to make good decisions when system or product safety is involved. Such decisions do not necessarily seek maximum safety because the absolute maximization of either system or product safety may preclude other perspectives, such as overall cost or minimum needed capability. Instead, DMs seek a balance among all the factors.

The notion of maximizing safety implies that it can be measured or quantitatively analyzed. Probabilistic risk assessment (PRA), which had its genesis in the 1970s, provides the quantitative methodology that I use in this book for analyzing safety.

So what kinds of decisions do I analyze in these pages? I briefly describe some examples in the sections that follow.

1.1 A Pumping System is Outdated

When new standards are promulgated, an older pumping system in a nuclear power plant must be replaced. Because it is used for cooling when the plant is shut down, the pumping system is important to safe plant operations. At least one of the three pumps in this system cannot rely on electricity for power because electric power to the plant is sometimes interrupted. Several different pumping systems, all of which are feasible, can meet the new standards. The systems vary in capital and operating cost, in the level of safety they bring to the plant, and in their availability for use during plant shutdown. How should the DM choose the pumping system?

Examples from Everyday Life

Making judgments about and relating disparate attributes, such as costs, product performance parameters, and safety to each other may seem odd. But, really, we make such decisions daily. For example, you wake up with a head cold during a flu epidemic. Do you go to work anyway or stay home to rest? Your company is in crisis and your co-workers could really use your help. On the other hand, you might become sicker if you go to work and you might infect others as well. Sound familiar? Whatever decision you make, you’ll have weighed two attributes that are difficult to quantify—your career and your personal health.

Here’s another common example. You’ve lived in your current location for many years with a satisfying lifestyle except for your employment. One day, you receive an ideal job offer, but it’s in another state that doesn’t have the type of lifestyle benefits you currently enjoy. Whatever you decide, you’re once again weighing two difficult-to-quantify attributes: job satisfaction and lifestyle enjoyment.

1.2 A Ground Rover Needs Enhanced Reliability in Space

A spacecraft for interplanetary exploration is designed to deploy a small ground rover that moves along the planet’s terrain, takes photographs, and analyzes rock samples. The rover must be able to wirelessly communicate data with the spacecraft lander. The lander relays the rover’s data back to scientists on Earth, who use those data to plan the next day’s rover movement. The scientists then transmit the commands back to the lander, which relays the instructions to the rover at the proper time. A successful mission depends on the reliability of the rover’s communications system (a simple wireless modem) and on the rover’s on-board electric power supply.

The team’s scientists and engineers pepper the DM with suggestions for improving the rover, which range from using better software and enhancing maneuverability to supplying more electric power and increasing the rover’s scientific capability. Each alternative differs in terms of its cost, its impact on the schedule, and the probability of achieving a successful mission. How should the DM decide which suggestions are best?

1.3 An Aircraft Door’s Design Fails to Meet Standards

The design team manager of a new aircraft door operating system just found out that the current design will not meet government certification standards. Using PRA, the team develops a safety risk model for the door, and the results compare unfavorably to the government safety standards for aircraft certification. After some thought and discussion among the team members, four alternatives emerge: modify the existing design; start over, creating a new design; petition the government authorities to relax the standards; or continue the program without government certification. Each alternative differs in terms of its cost, its schedule for project completion, and the resulting level of airplane safety. How should the DM choose the course of action to follow?

1.4 A Wind Tunnel Experiment Could be Dangerous

Engineers are modifying a wind tunnel to allow it to introduce pure oxygen in the model section (which contains the scale model of an aircraft), with a goal of studying the effects of air breathing in relation to the development of hypersonic aircraft. The wind tunnel burns a methane and air mixture to create a wind stream that flows through a nozzle at speeds ranging between Mach 4 and Mach 7. Methane and air mixtures can be explosive and can even detonate under some conditions, and, if something goes wrong, the wind tunnel configuration could create such conditions. Introducing oxygen into the wind stream would increase the probability and severity of a detonation. Different design options carry different levels of safety and cost. Should the project continue? If so, how should the DM choose the optimal design?

1.5 A Power Plant’s Critical Equipment Could Flood

An audit of a power plant near a river found that one of its belowground rooms is open at ground level and can flood during a severe storm. If the room floods, the water will seep through the seals in the walls, which were installed to close off wall openings drilled to allow for passage of electrical cables and wires. The water will then flow into rooms that hold equipment critical to plant operation. In addition, equipment failure could lead to the release of hazardous gases.

The plant manager discusses the situation with company engineers and consultants and finds that this type of seal material has been known to degrade and eventually leak. He also learns that a newer type of seal material has much better long-term properties and is not so prone to leakage. These newer seals, however, are more expensive and more difficult to extract and replace if the electrical cabling must be replaced. The discussions result in five alternative courses of action: (1) seal off the room from the outside, (2) continuously monitor the current seals and repair or replace them in-kind as needed, (3) change all seals to the newer variety, (4) add flood-protection barriers around the critical equipment, and (5) do nothing. Although each alternative carries a different capital cost, operations cost, and safety level, plant capabilities are not affected by any of the alternatives. How should the DM decide which course of action to follow?

1.6 Some Definitions

All of the example decisions I give in this book involve complicated, high-consequence systems or products. High-consequence refers to a system or product whose failure can cause great harm, injury, or even death. A complicated system is difficult to analyze or understand, perhaps because it involves multiple interrelated factors or numerous internal and/or external interdependencies. Changes in such systems often give rise to difficulties in foreseeing consequences. For example, increasing the level of safety can coincide with increased overall cost and decreased product reliability. Ideally, a DM would like to know the ultimate outcome of selecting each alternative ahead of time. If the DM had a crystal ball or an oracle that could foresee alternative outcomes, selecting the best alternative would be easy. But because crystal balls and oracles are in short supply, the outcomes of any choice the DM makes are uncertain.

The term decision attribute, sometimes called decision criterion or measure of effectiveness, is a measurable or calculable factor used in deciding which alternative to choose. In the examples I present in this book, for example, the decision attributes are safety level, operating cost, capital cost, system availability, and mission success. Multiattribute decisions involve more than one attribute, and each alternative has an outcome associated with each attribute. Decision analysis is the field that was developed to help guide DMs through a cogent, rational method for choosing among alternative courses of action. Following this method increases a DM’s understanding of the interrelationships of attributes and alternatives. Although it does take time to go through the process, making potentially dangerous and expensive systems safer demands that this time be taken.

Throughout this book, I also use the following definitions:

• Risk—the probability of failure, harm, loss, damage, injury, or other undesirable event

• Probabilistic risk assessment—a method that quantifies safety risk

• Risk management—a process of using risk assessment to make decisions about maintaining a desired level of risk

• Decisionmaking—a process of choosing among alternative courses of action

• Decision analysis—a logical method that aids in decisionmaking

• Reliability—the probability that an object can perform its intended function for a specified interval under stated conditions and

• Reliability analysis—a method that quantifies reliability.

1.6.1 A New Way of Thinking: Safety as a Number

It has long been common practice among those who manage engineering projects to calculate cost and schedule consequences of various alternatives. Calculating safety as a number, though, is relatively new and is not yet in common practice. In this book, I emphasize that safety is quantifiable using PRA (sometimes called probabilistic safety assessment [PSA]).

PRA (the term I use in this book) is a method for calculating the level of safety by numerically estimating risk. In this way, the level of safety can be quantitatively included in a decisionmaking process with the same rigor as other quantified attributes such as cost, schedule, reliability, and many more. Calculating safety as a number, or more commonly, as a probability distribution, allows DMs to treat safety as they would other attributes in a multiattribute decision process.

Figure 1-1 is a simplified graphic of the concept of safety-related decisionmaking. At the left of the figure is the point in time when a decision must be made (labeled “Choose among alternatives”). Project engineers or scientists develop alternative courses of actions (labeled A, B, and N), and consult with the DM (e.g., the project manager) to create a set of attributes. The figure shows three typical attributes—cost, performance, and safety.

Figure 1-1 Overview of Safety-Related Decisionmaking

Next, DAs work with the engineers and scientists to estimate the probable consequences (or effects) of each alternative with respect to each attribute.² The effects in Figure 1-1 are numerical quantities (the probability distributions), which yield a metric of each attribute. Multiattribute decision analysis combines all the attribute consequences with the DM’s values or preferences to arrive at a ranking of alternatives.

The DM then decides which set of effects best meets the project’s objectives. As I describe in detail in this book, choosing the best set of effects involves combining consequences with values. As expressed by Keeney (1992), “Values are principles used for evaluation. We use them to evaluate the actual or potential consequences….” Said another way, values are a basis for establishing preferences. Without personal or organizational principles, we have no criteria with which to evaluate attributes and make the best choices. The DM infuses the decision analysis with her own values, allowing her to develop preferences among the attributes. For example, for purposes of the project’s objectives, she may value safety as much more important than cost or performance. Often the attributes must be considered jointly. For example, the incremental cost of additional performance and/or additional safety may be an important consideration.

In this context, we can think of performance as a desired system or product design feature. Examples include weight-carrying capability for rockets, power output for generators and microwave ovens, acceleration for automobiles, and durability for children’s toys. And we can think of safety as the probability of being free from harm. Finally, we can think of cost in terms of metrics such as investment expenditures or loss expressed in dollars.

1.6.2 The Risk Management Connection

Risk management is a procedure in which we attempt to manage the future attribut...

Table of contents

• Cover
• Title
• Copyright
• Contents
• Preface
• Acknowledgments
• 1. Choosing Safety: An Overview
• 2. Safety, Risk, and Hazard Concepts
• 3. Probabilistic Risk Assessment (PRA) Concepts and Methods
• 4. Procedures for Making Safety-Related Decisions
• 5. Principles of Risk Communication within a Project
• 6. The Blade-Trade Case Study
• 7. Choosing among Space Shuttle Auxiliary Power Unit (APU) Safety Improvement Strategies
• 8. The Decision to Launch the Cassini Spacecraft
• 9. Mars Micro-Meteorology (Micro-Met) Stations
• 10. Choosing the Best Severe Accident Management Strategy
• 11. Choosing Safety: The Final Analysis
• Index