Embed Size (px)
Citation preview
Risk, Safety and
Liability
PHIL/ENGR 482Ethics and Engineering
Required reading:
• Harris, Pritchard and Rabins, Engineering Ethics: Concepts and Cases, 2nd ed. Chapter 7, “Risk, Safety and Liability in Engineering”
An engineering responsibility
• Codes of ethics require the engineer to prevent exposure of the public to unacceptable risks.
NSPE Code
• “Hold paramount the safety, health and welfare of the public” design to “accepted engineering standards”
• Do not “complete, sign, or seal plans and/or specifications that are not of a design safe to the public health and welfare in conformity with accepted engineering standards”
• In “circumstances where the safety, health, property or welfare of the public are endangered” engineers must “notify their employer or client and such other authority as may be appropriate”
Understanding and managing risks
• What is risk?• How do we operate engineering
systems to reduce risks?• How do we design engineering
systems to reduce risks?• What are acceptable risks?
What is risk?
• One definition of “risk” is:• “Exposure to the chance of injury or
loss;a hazardous or dangerous chance” *
• This definition involves both• the probability of an event occurring • the consequences of the event
* Webster’s Dictionary
An engineering definition of risk:
R isk (p ro b ab ility o f ev en t) (co n seq u en ces)
Risk is inherent in engineering
• All engineering involves risk.• Innovation in design generally increases
risk. More generally, any change (from proven practice) will often increase risk.
• Examples:• Tacoma Narrows Bridge--1940 collapse• Three Mile Island Power Plant--1979
radiation release• Concorde airliner--2000 crash in Paris
Probability of failure
• A nuclear reactor will “meltdown” if the control rods fail and the cooling pump fails. What is the probability of this occurring?
Event tree analysis of failure probability
Engineering risk assessment
• Bridge foundation depths are often governed by the depth of scour, which is related to the size of the flood. A 100-year flood (a flood which has a 1% chance of occurring in any given year) is a common design flood level.
• Consider a bridge footing designed to have a 210-3 annual probability of being undercut by scour in any given year.
R isk (p ro b ab ility o f fa ilu re) (co n seq u en ces)
Engineering risk assessment...
• Consider a a bridge that has an 210-3 annual probability of collapse due to scour.
• If collapse occurs during a rush hour (1/24 probability), 10 lives will likely be lost. If collapse occurs during non rush hours (23/24 probability) 1 life will likely be lost. One way to measure this risk is…• (210-3)(1/24)(10) = 83310-6 (risk of death)
• (210-3)(23/24)(1) =191710-6 (risk of death)
• Total risk is 83310-6 + 191710-6 =275010-6 (risk of death)
Problems with event-tree analysis:
• assigned probabilities are sometimes conjectural
• cannot anticipate all failure modes:• pipe rupture, • pipe corrosion, • terrorist attack, • human error, • etc...
Safety: Operation of engineering systems to reduce risk
• Many “engineering” failures involve, at least in part, an operations failure…consider the reactor failure at Three Mile Island:
• The main feedwater pumps failed; a pressure relief valve automatically opened, but stuck open. Signals failed to show that the valve was stuck open.
• Because of either administrative or human error, a critical valve in the emergency feedwater system was left closed, delaying the operation of that system for 8 minutes.
• Systems are said to be tightly coupled when a failure in one system can adversely and rapidly affect operations in another system. Tightly coupled systems make failures more difficult to predict and control.
Safety: Operation of engineering systems to reduce risk
• The loss of the Space Shuttle Challenger is another example of an engineering system failure due to operations failure.
• The practice of “normalizing deviance”, that is the acceptance of anomalies (unexplained leakages of the O-ring seals) in previous flights led to continued operation of a system that was dangerously close to it’s safe limit of operation.
• Also, operational limits (launch temperature) were increased without appropriate study.
Safety: Design of engineering systems to reduce risk to acceptable levels
• Develop inherently low-risk designs • Incorporate redundancy in design• Design for failure modes that give
warning before catastrophic failure (ductile structures)
• Design for appropriate Factor of Safety• Structural design philosophies...
• Allowable Stress Design (ASD or WSD)• Load Factor Design (LFD)• Probabilistic design methods (ex. LRFD)
Factors of Safety
• To accommodate uncertainties in...• applied loads,• material properties,• simplified methods of analysis,• construction quality,• maintenance, ...
• and, to reflect different consequences for different failure modes.
loadDesign
loadFailureFS
Allowable (or Working) Stress Design philosophy
• ASD design philosophy limits the stress to a certain “allowable” value, which is usually some fraction of the yield or ultimate stress.
Design difficulties...
• Different loadings may have different uncertainties
• Different failure modes have different risk (uncertainty consequence),
• Also the resistance (strength) of some modes may be affected more by construction quality, maintenance inspection interval, etc…
• ...so different Factors of Safety may be appropriate for different loadings and failure modes.
Load Factor Design philosophy
• Expected loads are multiplied by Load Factors, which may have different values for different types of loads
• Strength is reduced by a Strength Reduction Factor reflecting the variability in the strength
• Factored loads must not exceed factored strength
Load Factor Design example
• Consider a bridge girder which carries its own weight plus the weight of the deck (DL) and traffic loads (LL).
• Denote the moments caused by these loads as MDL and MLL, respectively.
• Denote the calculated ultimate moment (which would cause fully plastic failure of the section) as Mult.
Load Factor Design example
• The LFD philosophy requires...
• where…• FLL and FDL are load factors for live and dead
loads, typically specified to be 2.2 and 1.3 respectively, and
is a strength reduction factor, typically specified be 0.90
F M F M ML L L L D L D L u lt
Probabilistic design philosophy (LRFD)
• Load factors and resistance (strength) factors are not fixed, by a design code, but are chosen in each design based on the specifics of the case.
• Factors are determined in such a way that the “probability of failure” of each limit state (failure mode) is maintained at some uniform value.
AASHTO LRFD Bridge design example: design for vessel collision
• Bridges in navigable waterways shall be designed for vessel impact, considering...• waterway geometry,• size, type, loading condition, and frequency
of vessels using the waterway• water depth,• vessel speed and direction, and• structural response of the bridge to collision.
Bridge design for vessel collision (cont’d)
• Bridges are classified as “regular” or “critical”.• “Critical” bridges shall continue to
function after more severe collisions than the collision limiting “regular” bridges
Bridge design for vessel collision (cont’d)
• An analysis of the annual frequency of collapse is performed for each pier or span component exposed to collision.
• The design vessel is selected using a probability-based analysis procedure in which the predicted annual frequency of bridge collapse (AF) is compared to an acceptance criterion.
Bridge design for vessel collision (cont’d)
• The Annual Frequency of collapse (AF) is computed by…
• where...• N=annual number of vessels, by type, size...• PA=probability of vessel aberrancy• PG=geometric probability of a collision by an aberrant
vessel • PC=probability of bridge collapse due to collision
A F N P A P G P C
Bridge design for vessel collision (cont’d)
• The Annual Frequency of collapse (AF) is limited to a specified acceptable risk...
A F N P A P G P C
A F
1 0
1 0
3
4
fo r " regu lar" b rid ges
A F fo r " critica l" b rid ges
Acceptable risk...
• What is an acceptable risk?
Some acceptable risks...
• Note that the average American could, if he/she chose, reduce his/her annual risk of death by 17310-6 by avoiding travel in automobiles or on highways. Since the average American chooses to accept this risk (because of the advantages of automobile transportation), the risk of death associated with automobile travel could be considered an “acceptable risk”, that is one assumed by a reasonable person.
• Similarly, the 810-6 risk of death in commercial aviation is accepted by most persons.
Cost-benefit risk assessment example• The government is proposing legislation to
limit formaldehyde emissions to 3 ppm. Industry estimates that to install and operate the necessary scrubbers will cost $300 million annually. Toxicologists estimate that this new standard will save 30 lives annually. Using cost/benefit analysis, should the new standard be implemented?
• Cost = $300 million/yr• Benefit = (30 lives/yr)($ ??? / life)• What is the dollar value of human life?
What is the value of human life ?
• Some methods to place a value on human life• purchasing decisions involving
safety (e.g. car purchase)• future earnings • extra pay needed for risky jobs
(e.g. house painter vs. smokestack
painter)
Problems with using studies of purchasing decisions to determine the value of life...
• wealthy people are willing to pay more• people will pay 7 times more to reduce risk of
cancer than to reduce risk of death in an automobile • decisions are based on perceptions (values)• women value their lives more than men, i.e., men
are more willing to engage in risky behavior• A 1984 study by Shualmit Kahn indicates that
people typically valued their lives at $8 million (Note: this figure is higher than is typically used in public policy analysis. Also note that Ford used $0.2 million in the 1970’s Pinto case study.)
Public Policy Expert’s Approach to Risk• His/her first priority is to protect the public.• Consider the consequences of an error in a
study to determine whether a chemical is carcinogenic…• False Positive The chemical is banned as being
carcinogenic, when in reality it is not. The producer loses potential profits from the sale of this chemical.
• False Negative A dangerous chemical is approved as safe and sold to the general public. The death rate from cancer increases.
• A public policy expert will choose to err on the side of public safety, when the facts are not clear
Public policy expert approach (cont’d).
• In a democracy, the government policy makers respond to the public’s wishes. The public tends to react to different risks in different, and sometimes irrational ways. As a result, we tend to allocate differing amounts of money to save lives by different measures...
Allocation of Money
Layman’s approach to risk
• Respect for Persons Approach• Key Issues:
• is the risk distributed equitably?• are those assuming the risk
compensated?• is the risk voluntary?• does the person assuming the risk
understand it? • does the person assuming the risk have
control?
Layman’s approach to risk...
• Laymen often overestimate low probability risks
• Willing to accept higher voluntary risks than involuntary risks (by factor of 103)
• Laymen don’t compare a risk to already accepted risks
• Laymen overestimate risks of human origin compared to risks of natural origin
• Laymen’s approach more closely follows Respect-for-Persons approach than the Utilitarian approaches used by many experts
An Acceptable Risk is one that is...
• freely assumed with informed consent
• equitably distributed• properly compensated
Informed Consent• RP says we should treat people as
“moral agents” (autonomous, self-governing individuals)…thus we should seek “informed consent” before assigning risk
• Criteria for informed consent• consent must not be coerced*• person must be accurately informed*• person must be competent* to assess information
*there are possible conceptual and applications issues to be resolved
Problems with informed consent
• difficulty getting informed consent• consent must be obtained before the risk is
assumed• consent requires negotiation• holdouts or unreasonable preferences
• parties must be well informed and reasonable• people are often hysterical regarding dramatic
orcatastrophic risk
• people underestimate the consequences of risks thathave never happened before
When it isn’t possible to get informed consent...
• Only expose people to risks they would consent to, if they were informed of all known risks.
Or, ...
• As an alternative to gaining consent from everyone affected by the risk, the group leaders can decide to accept the risk for the group.
• Some people may give informed consent to things that are not in their interests, because of... • misunderstanding information • immaturity • irrationality
• Such consent isn’t autonomous.
Problems with Informed Consent (cont’d.)
Problems with Informed Consent (cont’d.)
• If consent is not autonomous, then you should find a way to make consent autonomous.
Risk concepts--Example
• The electric power company proposes to build a nuclear power plant near your neighborhood. Given the newly deregulated electricity market, the power probably will be sold out of state because prices are higher there.
Risk concepts--Example (cont’d.)
• Is the risk voluntary?• Does the person taking the risk
understand it?• Does the person taking the risk
have control? • Is the risk distributed equitably?• Do those taking the risk get the
rewards?
Informed Consent by Group Leaders--Example
• The XYZ Chemical Company wants to build a new plant in Smallville. The chemical plant has a pollution effluent that may give one citizen cancer every five years. However, the plant will create 100 new jobs and a substantial tax base for Smallville, which will improve the local schools and hospital. The XYZ Chemical Company asks the town council for approval to build the plant in the industrial park.
Informed Consent by Group Leaders (cont’d.)
• Advantages:• simplifies decision-making process
• Problems:• How do we compensate those
individuals who suffer the consequences of the risk?
• Approval of group leaders does not reflect the wishes of all individuals
• Works okay for small risks, but large risks may need individual consent
Paternalism
• Paternalism: the exercise of power by one person or institution over another in order to help or prevent harm to the latter, when...• Weak paternalism--the latter is not
exercising moral agency effectively.• Strong paternalism--there is no reason
to believe the latter is not effectively exercising moral agency.
• Commonly-accepted criterion for acceptable paternalism:• A fully rational person informed of
the relevant facts would consent to intervention in this case
• Paternalism often causes resentment.• Paternalism (weak) is permissible if
protected person is not autonomous• but people will disagree over who is
autonomous.
Paternalism (cont’d)
Summary
• Be aware that experts tend to use a utilitarian approach and the lay public tends to use a respect-for-persons (RP) approach
• Utilitarian and RP approaches each have their limitations
• It is difficult to quantify risk• Peoples’ values differ regarding risk• Promote informed consent within your
limits as an engineer
For guidance...
• “People should be protected from the harmful effects of technology, especially when the harms are not consented to or when they are unjustly distributed, except that this protection must sometimes be balanced against (1) our need to preserve great and irreplaceable benefits and (2) the limitations on our ability to obtain informed consent.” Harris, et al.
Summary (cont’d.)
• Some technologies provide valuable and irreplaceable benefits, yet are inherently risky (e.g. automobiles)
• Engineers should be paternalistic and protect the public from harmful impacts of technology if:• Consequences are severe• Consequences are unjustly distributed• Informed consent is not possible
Liability
An engineer’s ethical dilemma...
• All engineering involves some risk.• Protecting the public from all risks is
not in the public’s best interest.• We must protect the public from
unacceptable risks.• We may be liable for injuries caused
when we misjudge the risks, as well as when we make errors.
Different standards for tort law and science...
• Tort (injury) law uses different standards for risk and liability than we have been discussing so far.
• An engineer might not feel confident that action A had caused result B without strong statistical evidence (ie., 95% confidence)
• Tort law requires proof by a “preponderance” of evidence (ie., 51%)
Recommendations...
• Work conscientiously, diligently, and ethically; make sure your designs are consistent with best engineering practice.
• Document your actions and decisions in a Daily Log.
• Liability insurance is commonly purchased by design engineers. Costs can be high, depending on the work you do.
Representative costs for liability insurance policies
• Chemical Engineers (with PE designations, signatory authority, plant-scale involvement)• $1million coverage, $5000 deductible,
premium=$900/yr
• Architects/Engineers• $75million coverage, $15,000
deductible, premium=$10,000/yr
