Safety management and the use of expected values
E.B. Abrahamsen 1, T.Aven 1, J.E. Vinnem2, and H.S. Wiencke3
1
Stavanger University College, Norway
Stavanger University College/Preventor AS, Norway
3
Proactima/ Stavanger University College, Stavanger, Norway
2
December 2003
___________________________________________________________________________
Abstract
In this paper we review and discuss the modern principles of safety management. These
principles are to large extent based on the use of risk assessments and cost/benefit
(cost/effectiveness) analyses, which in their turn to large extent are based on statistical
expected values. The thinking and tools are seen to provide a rational framework for decision
making under uncertainty. In the paper we search for characteristics specifying what a riskbased approach can do and how it relates to other principles and strategies for dealing with
safety, such as the precautionary principle. We show that an essential concept when dealing
with safety management is uncertainty about the consequences and phenomena, how
uncertainty is described, perceived, communicated and managed. As uncertainty cannot be
fully described and calculated by statistical expected values, there is a need for a broad
perspective on uncertainty and risk. A risk picture has to be established showing different
dimensions and aspects of the risks, and this picture has to be seen in relation to the
limitations of the analysis. Our starting point is the offshore oil and gas industry, but our
discussion is to large extent general and could also be applied in other areas.
Keywords: safety management; risk assessment; cost-benefit analysis; portfolio theory;
statistical expected value
__________________________________________________________________________________
1. Introduction
Safety management searches for cost-effective solutions, and to attain and maintain a safety
level that conforms to defined policies, goals and requirements. Key tools used to meeting
these objectives are cost/benefit (cost/effectiveness) analyses and risk assessments. These
analyses are to large extend based on statistical expected values. Examples of expected values
used in safety management are:
-
FAR (Fatal Accidental Rate). FAR is defined as the statistically expected number of
fatalities per 108 exposed hours as a result of accidental events.
PLL (Potential Loss of Life). PLL is defined as the statistically expected number of
lives lost (normally per year) as a result of accidental events.
E[NPV] (Expected Net Present Values). The expected present value of an
investment’s future net cash flows subtracted the initial investment. Cash flow is
essentially the movement of money into and out of your business.
1
Using expected values in cost/benefit (cost/effectiveness) analyses and risk assessments are
seen to provide a rational framework for decision-making under uncertainty. In this paper we
challenge this framework. To what extent is it sufficient to focus on expected values? Is
uncertainty in future performance properly taken into account using the standard procedures
of the framework? We believe that there is a need for a rethinking of these issues, and the aim
of the paper is to contribute to a better understanding of what such a risk based (informed)
system can do and not, and give recommendations on how to make improvements in the
safety management.
The use of expected values are justified by portfolio theory, saying that corporate risk
(uncertainty) is basically systematic risk (uncertainty) generated by general market forces.
The loss of values as a result of accidents, contribute to unsystematic risk (uncertainty) and
has a minor effect on explaining variations in the corporate production values.
However, the consequences of possible accidents are often very uncertain and difficult to
predict, meaning that there is a risk for negative surprises. Furthermore, production values
does not incorporate the values of life and the environment, and these values could be
different from a firm’s point of view compared to the individual’s or the society’s point of
view. Hence there is a need for the firm to have a broader perspective on risk (uncertainty)
than just using expected values. To determine what is the best concept, the arrangement or
measure, the firm needs to address also the probability of large accidents and risk perception,
and the limitations of the analyses, as well as strategic and political considerations. The firm
must deal with uncertainties, and to some extent think along the principles of precautionary,
robustness, and social responsibility, and have a behaviour that is risk averse to some degree.
But what do we mean by “to some extent” and “to some degree”? That is the interesting
question and it is the purpose of this paper to provide an answer. Of course, it is a partial
answer, the topic is very large and our work here is focused on just some of the relevant
issues.
In the paper we show that a proper framework can be established for such an extended
perspective on risk, when risk is considered as the combination of possible outcomes
(consequences) and uncertainty. As long as the uncertainty can be adequately expressed by
expected values, the narrower traditional framework applies, whereas in cases with large
uncertainties, other and broader perspectives are required.
Relevant basis literature for the following discussions are Aven (2003), Aven et. al. (2003),
Bedford and Cooke (2001), UKOOA (1999) and Vinnem (1999), which give overviews of
fundamentals of risk assessments and cost/benefit (cost/effectiveness) analyses, and Varian
(1999), Dixit and Pindyck (1994) and Levy and Sarnat (1990) which present the portfolio
theory.
The paper is organized as follows. In section 2 we give an overview of some of the main
principles of safety management, and these principles are discussed in section 3. Then in
section 4 we present and discuss the extended framework for safety management. In section 5
we present an example from the offshore oil and gas industry to illustrate our main message.
Finally, in section 5, we draw some conclusions.
2. An overview of the main principles of safety management
This section gives an overview of some main principles of safety management relating i.a.
overall policies, goals and requirements, identification of alternative solutions, analysis and
2
the decision process. By safety management we understand all systematic measures
undertaken in order to attain and maintain a safety level that conforms to defined policies,
goals and requirements. The key elements of safety management are shown in Fig. 1 (Aven
(1994)).
To meet the overall policies, goals and requirements different means are used. These means
can be related to technical and operational conditions, management and organization, analyses
and other factors that possibly can affect the safety level. In practice, however, there will
always be restrictions on the choice of the means. These restrictions, which we refer to as
constraints and boundary conditions, can be due to e.g. governmental requirements, political
decisions, company requirements, sales agreements and product specifications, available
technology, limited time and resources, and limitations with respect to weight and space. The
constraints and boundary conditions also affect the choice of overall policies, goals and
requirements, for example by governmental or company requirements.
Overall policies,
goals and requirements
Constraints and boundary
conditions
Means
Fig. 1. Main elements of safety management.
In order to use the different means to meet the overall policies, goals and requirements a
systematic optimisation process must be implemented. The principles of this process are
illustrated in Fig. 2 (Aven (1994)).
Overall policies, goals
and requirements
Alternative
solutions
Analysis
Evaluation of
results
Actions/choice
of solution
Final
solution
Fig. 2. The optimisation process.
3
Possible solutions that are expected to meet the overall policies, goals and requirements, must
be developed. By means of different analysis methods we must find out how the solutions
really conform to the defined policies, goals and requirements, and depending on the result of
the analyses actions must be taken and specific solutions must be chosen. The analyses
include cost/benefit (cost/effectiveness) analyses and risk analyses. The process will be
repeated as a result of implementation of risk reducing measures, increased level of detail in
the solutions, change in project phase and use of different types of analyses.
Risk assessments cover both risk analysis and evaluation. In risk analyses it is usual to
produce numbers like FAR and PLL. In the offshore oil and gas industry the risk analysis is
used in combination with risk acceptance criteria, as input to risk evaluation. The criteria state
what is deemed as an unacceptable risk level. The need for risk reducing measures is assessed
with reference to these criteria.
In safety management risk assessments are often combined with cost/benefit or
cost/effectiveness analyses. In cost/benefit analyses costs and benefits are balanced. The
standard method is to assign monetary values to a list of burdens and benefits, and summarize
the “goodness” of an alternative by the expected Net Present Value (NPV). To measure the
NPV of a project, the relevant project cash flows are specified, and the time value of money is
taken into account by discounting future cash flows by the appropriate rate of return. The
formula used to calculate NPV is:
T
Xt
t 0
(1  r) t
NPV = 
,
where Xt is equal to the cash flow at year t, T is the time period considered (in years) and r is
the required rate of return, or the discount rate.
The method is not trivial to carry out, as it requires the transformation of non-economic
consequences such as expected loss of lives and damage to the environment, to monetary
values. To avoid the problem of transformation of all consequences to one unit, it is common
in many situations to perform a cost/effectiveness analysis. In such analyses, indices such as
the expected cost per expected saved life are computed.
3.sDiscussion of the main principles of safety management
In this section we discuss the main principles of safety management, with an emphasis on the
use of statistical expected values in risk assessments and cost/benefit (cost/effectiveness)
analyses.
3.1 The use of expected values
An investment project example will be used to illustrate ideas. To simplify, we assume that
there are only two attributes of interest; the production value Y and the number of fatalities as
a result of accidental events, Z. The number of fatalities as a result of accidental events is
either 0 or 100, and can have great influence on the production value. The performance
measures used to evaluate the goodness of the project are the statistical expected value for the
production value, EY, and the statistical expected number of fatalities as a result of accidental
4
events, EZ. For the company, the return and economic risk for the project itself is of course of
interest, but more important is the effect the project will have on the return and economic risk
for the company’s portfolio as a whole. This comes out from the portfolio theory. Generally, a
portfolio consists of N different projects. Assume that each of the N projects has a 1/N weight
in the portfolio and let us use the notation Ei  E ri  for the expected value of the return ri
and for the variance, VARi  VARri , i  1,2,..., N . Then for the portfolio p:
N
Ep  
i 1
1
1
Ei 
N
N
N
E
i 1
i
and
2
2
N
N
1
1
VAR p     VARi      COVi , j
i 1 N 
i 1 j  i , j 1  N 
N

1
1

VAR  1  COV = “unsystematic risk” + “systematic risk”
N
N

(3.1)
where
COVi , j  E{ri  Ei r j  E j }
and
VAR 
N
N
1 N
1
 VARi and COV  2
  COVi , j
N i 1
N  N i 1 j i , j 1
In portfolio theory, the risk is divided into unsystematic risk and systematic risk, as shown by
formula (3.1). The systematic risk relates to general market movements, for example caused
by political events, and the unsystematic risk relates to specific project uncertainties, for
example accident risks. When the number of projects is large, we see from (3.1) that the
variance for the portfolio is approximately equal to the average covariance, and each
individual variance is not relevant. Thus the unsystematic economic risk is negligible when N
is sufficient large. By diversification of the risks into many projects, the unsystematic risks
are removed. The company’s total cash flow (all projects are included) is approximately equal
to the expected cash flow to all projects, when ignoring the systematic risk. The relation
between the portfolio’s actual value (Y’) and its calculated statistical expected value (EY’) is
given by
Y’ = EY’+ systematic risk
or
systematic risk = Y’- EY’.
The difference between the portfolio’s actual value and its calculated statistical expected
value is from the portfolio theory just dependent on the systematic risk.
Thus it is a reasonable approach for the firm to use the expected value as the tool for
evaluating goodness of alternatives, in combination with focus on the systematic risk. The
systematic risk could give large Y’ deviations from EY’. Hence analysis, for example
sensitivity analysis, of this risk is required to support decision-making.
5
There are, however, some additional problems that we have not yet included in the
argumentation, which makes the evaluation based on expected values somewhat more
complicated;
a) We have restricted attention to production values - the values of lives and the
environment have not been incorporated
b) As we focus on the firm’s portfolio, we cannot in practice ignore the unsystematic
risk. Corporate procedures for investment and management could give large Y’
deviations from EY’. And there are large uncertainties associated with what will be
the consequences of an accident – there is a potential for big losses.
c) In an evaluation, we assign probabilities and compute expected values based on a
number of assumptions and presuppositions.
In the following we will discuss these problems in more detail.
a) The values of accidents and lives
The portfolio theory is based on one being able to transform all values to one unit, the
production value. And from a business perspective, firms may argue that this is the only
relevant value. All relevant values should be transformed to this unit. This means that the
expected costs of accidents and lives should be incorporated in the evaluations. However,
such an evaluation would be difficult as a life has a value in itself, which cannot be measured
in money. We may calculate what a risk reducing measure means in cost per expected saved
lives (often referred to a the value of statistical life), but this is not the same as saying that a
life has a finite value. In real life, most people would not be willing to give his or her life for a
certain amount of money. But of course, you may accept a risk for a certain money. This is a
very important distinction, but it is unfortunately often overlooked.
The consequence of this fact, that a life has a value in itself, is that specific considerations
have to be given to safety for human beings. How this concern should be balanced with the
economic measures is a managerial and strategic issue. Different policies could be used, for
example saying that safety should meet the minimum levels required by the law and
regulations, or on the other extreme, saying that the firm should be a leading one on safety.
The justification for the latter view would be a belief that such a policy would give a good
organisational and culture climate and produce high performance levels, on both safety and
production.
b) and c) Uncertainties in consequences and limitations of calculation methods
Consider the above example with a potential of an accident resulting in 100 fatalities. What
are the potential production losses of such an event? Well, that is not straightforward to
describe, a detailed analysis is required. Clearly the losses will depend on a number of factors
characterising the specific situation. The direct consequences may not be so difficult to
predict, but more difficult is it to be precise on matters that are related to competence,
reputation, regulation, etc. We experience from time to time accidents that give the firm a
very bad focus, in the media for example, and the results for the firm could be large measured
in market values. Then the possible losses could be significant also in a portfolio perspective the standard deviation of the project loss could be significant relative to the total cash flow of
6
the firm. And since the uncertainties in the consequences are so large, the assumptions and
suppositions made may influence the results to large extent. The assessments made should be
seen as considerations based on relevant information, but there could be different
assessments, different views and different perspectives on the uncertainties. This applies in
particular to assigned, small probabilities of rare events.
To see this more clearly, note that all statistical expected values are conditioned on
background information. In mathematical terms this is written like E[X|K], where X is an
observable quantity and K is the background information. The background information covers
i.a. historical system performance data, system performance characteristics and knowledge
about the phenomena in question. Assumptions and presuppositions are an important part of
this information and knowledge. We may assume for example in an accident risk analysis that
no major changes in the safety regulations will take place for the time period considered, the
plant will be built as planned, the capacity of an emergency preparedness system will be so
and so, an equipment of a certain type will be used etc. These assumptions can be viewed as
frame conditions of the analysis, and the produced probabilities must always be seen in
relation of these conditions.
Hence uncertainty needs to be considered, beyond the expected values, which means that the
principles of precautionary and robustness have a role to play. Furthermore, risk aversion may
be justified. Roughly speaking, risk aversion means that more concern is given to one
accident with 100 fatalities compared to 100 accidents with one fatality each. To define the
concept more precisely, we need to introduce a utility function u(X), where X is the number
of fatalities, and risk aversion can then mathematically be expressed by the inequality Eu(X)
< u(EX). This formulation fits perfect into an economic, decision analysis framework, but is
not so easily understood and appreciated in a safety management context. What is the
meaning of a utility value of say 0.01 (expressing EX)? As discussed above many firms seem
in principle to be in favour of a risk neutral strategy for guiding their decisions, 100 accidents
with one fatality each is as bad as one accident with 100 fatalities, but in practice it turns out
that they are often risk averse. The justification is partly based on the above arguments a)-c).
In the above case with possible 100 fatalities, the possible total consequences could be rather
extreme - the total loss for the company in a short and long term perspective is likely to be
high due to loss of production, penalties, loss of reputation, changes in the regulation regimes,
etc. The overall loss is difficult to quantify – the uncertainties are large - and it is seldom done
in practice, but the overall conclusion is a high expected loss, and investment in safety is
required. The level of investments is not based on the expected number of fatalities only, as it
ignores aversion.
In theory, the optimisation of the expected utility is the ruling paradigm among economists
and decision analysts. The expected utility is in mathematical terms written like Eu(X), where
u is the utility function and X could either be one attribute or a vector of different attributes.
The expected utility approach is theoretical attractive as it provides recommendations based
on a logical basis. If a person is coherent both in his preferences amongst consequences and in
his opinions about uncertainty quantities, it can be proved that the only sensible way for him
to proceed is by maximizing expected utility. For a person to be coherent when speaking
about the assessment of uncertainties of events, the requirement is that he follows the rules of
probability. When it comes to consequences, coherence means that if b is preferred to c,
which is in turn preferred to d, then b is preferred to d. What we are doing is making an
inference according to a principle of logic, namely that implication should be transitive. Given
the framework in which such maximization is conducted, this approach provides a strong tool
for guiding decision makers.
7
In practice it is difficult to work out a utility function, and the utility theory is therefore
seldom used. Instead of this, statistical expected values, EX, and different aspects in the
distribution to X and X’s components are often used. As we have argued above, it is not
enough to restrict attention to the expected values.
3.2 Foundational basis of risk and decision analyses
A huge number of risk and decision analysis methods and models have been developed to
support decision makers facing choices involving uncertainties about outcomes. Although a
common risk analysis and management nomenclature has been developed in recent years,
there is no authoritative guide on how to deal with such decision problems, - different risk
analysis experts would prescribe different approaches. The difference relate to how risk and
uncertainty should be understood and expressed, how models should be understood and used,
how the risk analysis results should be evaluated, how cost/benefit analyses should be
interpreted and used, etc.
To improve the situation there is a need for a holistic framework, which is able to describe the
various elements and their interrelationships in a consistent way, and is able to properly
reflect the issues discussed in the previous section.
4. Recommendations for a holistic and unified framework for safety management
In this section we will outline a holistic and unified framework for safety management,
consistent with the considerations of the previous section 3.
Our starting point is a decision situation where a decision maker is to choose among a set of
decision alternatives relating to whether or not to execute an activity, the choice of concepts,
design configurations, risk reducing measures, etc. The situations considered are characterised
by a potential of rather large consequences and rather large associated uncertainties of what
will be the consequences, if the alternatives are in fact being realized. The consequences and
associated uncertainties relate to economic performance and possible accidents leading to loss
of lives and/or environmental damage.
For a specific alternative, we define risk as uncertainty about the performance of this
alternative, and this makes it meaningful to talk about risk analyses, risk assessments, risk
perception etc. For example, risk analysis means analysis of uncertainties related to the future
performance. In a quantitative risk analysis the uncertainties are quantified by the analysts,
using probabilities. The description of risk could be more or less complete, as the
performance measures used could to various degree cover the important aspects of the
consequences or uncertainties. Risk analysis involves judgments about the future, how
systems, technology, organisations and human beings will act and behave, based on historical
data and other type of information. The analyses have to be viewed in the light of the
background information. This perspective means that we have to acknowledge that
-
risk assignments are judgments made by someone (the risk analysts)
expected risk values do not provide a full picture of risk
people’s risk perception provides information about risk
8
The future performance of an activity is unknown (uncertain), the consequences are unknown
(uncertain) and any description of these consequences would be based on a number of
assumptions, seen through the eyes of someone and restricted to certain aspects. Therefore,
we need to get information through various channels. We need to see the “hard data”, we need
judgments and assessments by many parties and we need processes to build understanding
and trust.
Furthermore, when it comes to cost-benefit analyses, our perspective means that we have to
acknowledge that
-
-
expected cost-benefit calculations represent judgments made by someone (the
analysts), there exist no objective cost-benefit numbers
the expected cost-benefit calculations do not provide hard decisions, but decision
support. The calculations are often based on a restricted set of attributes, and do not
reflect risk aversion.
strategic considerations are required to balance production values and uncertainties
related to safety.
Decisions facing uncertainty must be relied on managerial review and judgement; the decision
support analyses need to be evaluated in light of the premises, assumptions and limitations of
these analyses. The analyses are based on background information that must be reviewed,
together with the results of the analyses. Considerations need to be given to factors such as
 The decision alternatives being analysed.
 The performance measures analysed.
 The fact that the results of the analyses represent judgements, to a large extent
conducted by some experts.
 The difficulty of assessing values for costs and benefits, and uncertainties.
 The fact that the analysis results apply to a model, i.e., a simplification of the world,
and not the world itself.
The managerial review and judgment process involves such considerations. For example, in
the model we may have defined just five possible consequences of an event, even though in
the real world there were many aspects and facets that need consideration. In real life cases
there will always be factors of relevance that go beyond the results of the formal analyses.
The weight the decision-maker will put on the results of the analyses depends on the
confidence he has in the analyses and the analysts. Important issues are: Who are the analysts,
what competence do they have, what methods and models do they use, what is their
information basis in general, what quality assurance procedures have they adopted in the
planning and execution of the analyses? Are the analysts influenced by some motivational
aspects?
The analyses provide decision support, not hard recommendations. Thus we may for example
consider different values of a statistical life, to provide some insight for the decision.
Searching for a correct objective number, is meaningless, as no such number exist - the
statistical life used in the analysis is a value that represents an attitude to risk and uncertainty,
and that attitude may vary and depend on the context. When using a one-dimensional scale,
uncertainty of observable quantities are mixed with value statements about how to weigh the
different assessed uncertainties. Then, of course, we cannot expect to obtain consensus about
the recommendations provided by the cost/benefit analysis as there are always different
9
opinions about how to look at risk in a society. Adopting a traditional cost/benefit analysis, an
alternative with a low expected cost is preferred to an alternative with a rather high such
value, even if the latter alternative would mean that we can ignore a probability of a serious
hazard, whereas this cannot be done in the former case. In traditional cost/benefit analysis it
has also been common to discount the values of statistical lives, the results being often that
negligible weight is put on consequences affecting future generations. Clearly, it is of
paramount importance that the cost/benefit analyses are being reviewed and evaluated, as we
cannot replace difficult ethical and political deliberations with a mathematical onedimensional formula, integrating complex value judgements.
An important factor for choosing alternatives, is one’s attitude to risk and uncertainty. And
this attitude is to large extent based on values and politics, and is not primarily a safety
discipline issue. Two extreme points of views are described by the use of the precautionary
principle (a) and the entrepreneur perspective (b):
a) We do not know the outcome of the choices we make, there are large uncertainties
related to what will happen. A strategy that could be used is to apply the precautionary
principle: as long as there are substantial uncertainties present, let us not take any
chances.
b) Others are more offensive in accepting uncertainties and risks. The driving force is the
total amount of values created by the activity. It is recognized that any activity
generates risks, but the added value from these activities are so strong that we would
still like to carry out the activities.
The task of the risk management is to find the right balance between these two extremes. Our
perspective on risk recognizes that it is primarily a management (political) issue how this
balance is to be done.
For further reading on this perspective, see Aven (2003).
5. An example from the offshore oil and gas industry
Consider the following example in order to illustrate the implications of using expected
values. A riser platform is installed bridge connected to a gas production platform. On the
riser platform, there are two incoming gas pipelines and one outgoing gas pipeline. The
pipelines are all with large diameter, 36 inch and above. The decision problem is whether or
not to install a subsea isolation valve (SSIV) on the export pipeline.
We assume that the analyst has specified an annual frequency of 1x10-4 per year for ignited
pipeline or riser failures, i.e. the computed expected number of failures for a one year period
is 1x10-4, which is the same as saying that there is a probability of 1x10-4 for a failure event to
occur during one year. In the case of an accident, the SSIV will dramatically reduce the
duration of the fire, and hence damages to equipment and exposure of personnel.
Let us assume that the computed expected number of fatalities without SSIV is 5, given
pipeline/riser failure, and 0.5 with SSIV installed. Let us further assume that the expected
damage cost without SSIV is 800 MNOK, given pipeline/riser failure, and 200 MNOK with
SSIV installed. When there is no SSIV installed, the riser platform will have to be rebuilt
10
completely, which is considered to take 2 years, during which time there is no gas delivery at
all. This corresponds to an expected loss of income of 40000 MNOK. With SSIV installed,
the expected loss of income is 8000 MNOK.
The expected investment cost is taken as 75 MNOK, and the annual expected cost for
inspection and maintenance is 2 MNOK. In the calculations of the expected net present value,
10% interest is used. All monetary values are considered without taking inflation into account.
The total expected net present value of costs related to the valve is 93.9 MNOK, with annual
maintenance costs over 30 years. The annual expected saving (i.e. reduced expected damage
cost and reduced expected lost income) is 3.26 MNOK, and the expected net present value
over 30 years is 30.7 MNOK. This implies that the expected net present value of the valve
installation is a cost of 63.2 MNOK.
The expected number of averted fatalities per year is 4.5x10-4 fatalities. Summed over 30
years (without depreciation of lives), this gives an expected value of averted fatalities equal to
0.0135.
Thus, the expected net present value of the costs per averted statistical life is 4675 MNOK,
and a cursory evaluation of such a value would conclude that the cost is in gross disproportion
to the benefit.
But let us examine the results more closely.
It should be noted that if the frequency of ignited failure is 10 times higher, 10-3 per year, the
expected net present value of the reduced costs becomes 307 MNOK (instead of 30.7
MNOK). This implies that the valve actually implies an expected cost saving. In this case, the
conclusion based on expected values, should clearly be to install the valve.
The first observation is that the expected net present value of the reduced costs is strongly
dependent on the analyst’s assignment of the annual frequency for pipeline or riser failures.
As discussed in Section 3.1, item c), we need to see the values produced in the risk analysis in
view of the assumptions made in the analysis, the limitations of the analyses etc. We should
be careful in making conclusions just based on the calculated numbers. Sensitivity analyses
should always be a part of the decision basis provided.
If we return to the base case values, the probability of experiencing a pipeline or riser failure
near the platform, is 0.3 %. i.e. the scenario is very unlikely. There is a 99.7 % probability that
there is never any need for the SSIV, and the installation is just a loss, without any possibility
of covering any costs.
But with a small probability, 0.3 %, a highly positive scenario will occur. An ignited leak
occurs, but the duration of the fire is limited to a few minutes, due to the valve cutting off the
gas supply. There are still some consequences; the expected number of fatalities is 0.5, an
expected damage of 200 MNOK, and expected lost income of some months, equivalent to
8000 MNOK. This is quite considerable consequences, but they are much worse without
installing a SSIV. The expected saving in this case are 4.5 fatalities, 600 MNOK damage cost,
and 32000 MNOK in lost income. Note that we in the above calculations have disregarded the
probability that the SSIV does not work in the case of a need (the error introduced by this
simplification is small as the assigned probability of a SSIV failure is small).
11
If we focus on the economy, there is a probability of 99.7 % of a 63 MNOK loss (in expected
net present value), and a probability of 0.3 % of 32 600 MNOK reduced damage cost (in
expected net present value) in a year with a pipeline/riser failure. The expected NPV, based
on these conditions, becomes 63.1 MNOK. For the installation in question, the expected net
present value of 63.1 MNOK is not very informative, either the scenario occurs, with an
enormous cost saving (and reduced fatalities) or it does not occur, and there are only costs
involved.
From the portfolio theory, and a corporate risk point of view, it is still a reasonable approach
to use statistical expected values as a tool for evaluating the goodness of this project. But as
discussed in Sections 3 and 4, we should not perform a mechanical decision-making based on
the expected value calculations. We need to take into account the factors a)-c) of Section 3.1.
The conclusion then becomes more of an overall strategic and political one, than one
determined by the safety discipline.
6. Conclusions
The main message of this paper is that expected values should not be the only basis for
managing risks. As discussed in section 3, there are strong arguments for using a broader
perspective on risks. The values of lives and the environment cannot be transformed to a
production value, and with large uncertainties and extreme consequences, unsystematic risks
should not be ignored. In addition, the tools we use for computation are far from being
perfect, and the mechanical application of the risk analysis results could therefore prove
dangerous – decision-making which has a strong element of arbitrariness.
Acknowledgement
The work was funded by the Norwegian Research Council. The support is gratefully
acknowledged.
12
References
Aven, T. (2003) Foundations of Risk Analysis: A Knowledge and Decision-Oriented Perspective.
Wiley, New York.
Aven, T., Nilsen, E.F. and Nilsen, T. (2001) Expressing economic risk – review and presentation of a
unifying approach, Risk Analysis, to appear.
Aven, T. (1994) On safety management in the petroleum activities on the Norwegian Continental
Shelf. Reliability Engineering and System Safety, vol. 45 p. 285-291
Barlow, R.E., (1998) Engineering Reliability, SIAM, Philadelphia
Bedford, T., and Cooke, R. (2001) Probabilistic risk analysis, Cambridge University
Publishing Ltd, Cambridge.
Bernardo, J.M. and Smith, A. (1994) Bayesian Theory. Chichester: Wiley & Sons
Dixit, K. and Pindyck, S. (1994) Investment under Uncertainty, Princeton University Press.
Levy, H. and Sarnat, M. (1990) Capital Investment and Financial Decisions, Prentice Hall.
Lindley, D.V. (2000) The philosophy of statistics. The Statistician 49 293-337
Okrent, D. and Pidgeon, N. (1998) Special issue on Risk perception versus risk analysis. Reliability
Engineering and System Safety 59.
Pidgeon, N.F. and Beattie, J. (1998) The psychology of risk and uncertainty. In Handbook of
Environmental Risk Assessment and Management, P. Calow (ed.), Blackwell Science, London,
pp. 289—318
UKOOA (1999) “A framework for risk related decision support – Industry guidelines.”, UK Offshore
operatiors association.
Varian, H.R. (1999) Intermediate microeconomics. A modern Approach, Fifth edition, W.W.
Norton & Company, New York.
Vinnem, J.E. (1999) Offshore Risk Assessment, Kluwer Academic Publishers, London
13