1

Societal Security – Risk communication – Dialogues on risk

issues

Professor Jørn Vatn, NTNU

2

Topic for reflection

Does a true objective risk exist? Under which conditions does it make sense to introduce the

concept of a true objective risk?

Is the main objective of risk communication to contribute to making perceived risk equal to the true objective risk?

How could decisions be made in a societal security context with a basis in An objective risk picture A perceived risk picture

that are not consistent?

3

The challenge of the idea of a true risk picture

The idea of a true risk picture, will in most cases lead to a discussion on what is the uncertainty in the risk analysis “We do not believe in numbers” In contrast to “numbers are used to express uncertainty related to

our concerns”

Adding “uncertainty” to the risk in the meaning that we do not believe in the analysis, is extremely difficult in risk communication

A more direct approach where focus is uncertainty regarding whether accident will happen, and how serious they are is reccomeded

4

Risk communication - Dialogue processes

Main objective Obtain concerns regarding the analysis object among

stakeholders Structure this wrt

Dimensions to take into account in the risk analysis Factors to take into account in the risk analysis

Present the risk picture such that the main concerns are reflected in the risk picture (established by accepted risk analysis methods), and presented in an understandable manner

5

4 domains as a basis for risk definition

Real world domain Observables such as number of gas leakages next year

Scientific cause and effect domain What is the relation between the observables, which theories

exists? We do not claim to possess true knowledge in this domain

Uncertainty domain (we do not know with certainty) Lack of sure (certain) knowledge regarding future values of

observables, current values of observables, and cause & effects

Value and preferences domain How desirable the various outcomes in the real world are

6

What is risk?

Conceptual definition: risk is to be understood as the uncertainty regarding the

occurrence and the severity of events

Operational definition (expressing uncertainty) R = {<ei,pi,Si>}

ei = undesired events

pi, = an expression of the uncertainty regarding occurrence of events, i.e., probability statements are the quantitative language to express uncertainty (not an inherent property of the system)

Si = Severity of the event, also uncertain, i.e., we need probability statements to express Si

7

The issue of conditional risk

A risk statement is never unconditional, it should reflect many aspects U = the relevant information, the theories, the understanding, the

assumptions etc. which are the basis for the risk assessor when risk is assessed

D = the result of dialog processes and risk communication processes conducted in order to agree upon which elements of severity to focus on (e.g., fatality rate vs gross accidents) “Ambiguity”

V = the result of the verification processes to verify the correctness of the assessment given U and D

R = {<ei,pi,Si>} | D, U, V

Be as explicit as possible regarding D, U, V

10

Background case study

The local energy provider Lyse was developing an LNG (liquefied natural gas) facility at Risavika outside Stavanger in Norway

Natural gas from the North Sea is transported through pipelines to shore, and then being liquefied at a process plant before it is stored in a huge tank

The LNG is distributed from the facility to local consumers by LNG tankers and LNG lorries

The localisation of the plant has been a hot issue in the region

11

Localization of the LNG factory

12

Project history The LNG plant is under construction on a dismantled yard of a refinery The yard was deregulated for new industry and several other enterprises are

also under development, including a foreign ferry terminal approx 300 meters from the LNG plant

The LNG facility was approved according to the development plan by the local authorities in June 2006

The authorization to store and treat inflammable goods was given by the national directorate (DSB) in December 2007 based on a preliminary risk analysis

In order to obtain the final authorization from DSB updated risk analyses have to be provided showing that the risk of the facility as built is in accordance to the acceptance criteria

SINTEF/NTNU engaged to assist on risk communication A first quantitative update of the risk analysis is available 2008 There is significant resistance against the factory, and it has been claimed

that more or less all central actors have committed serious mistakes in the approval process (Vinnem, 2008)

Test production started in 2010 The plant was official opened in October 2011

13

Risk communication approach (SINTEF/NTNU)

1. Mass meeting to inform about the process to come

2. Invitation to participate in focus groups

3. 4-5 focus groups representing different stakeholders What are the threat scenarios, and what could be done to

counteract these (measures)

1. A second meeting where one representative for each stakeholder group meet to discuss the findings in the groups

2. The findings from the dialogue meetings are important input to the risk analysis, i.e., D and U

3. The presentation of the risk picture in subsequent mass meeting(s) reflects (i) the concerns, (ii) how it is assessed, and (iii) the impact on the risk picture

14

Risk analysis ↔ Mass meeting ↔ Dialogue groups

Purpose of the dialogue groups Express concern Bring forward factors affecting risk Advocate decision criteria and what to focus on, D

Issues that came up Maintenance can not be guaranteed since DSB (safety authority) is

considered much weaker than PTIL (authority in the oil&gas) Be explicit on worst case RAC should be replaced by worst case consideration

Risk analysis The concerns and risk factors were included in the considerations The risk picture presented aimed to reflect these concerns D/U Presenting worst case scenarios was appreciated by some of the

strongest opponents

15

Topic 1 – Risk acceptance criteria

In Norway it is common that the enterprises themselves establish risk acceptance criteria (RAC) Criteria are set both for individual risk for various groups, and for

societal risk This is the case even for third person

Safety authorities gives final approval, but do not give recommendations on RAC

For the particular case in Risavika, societal risk was one of the most demanding issues

16

Societal risk acceptance criteria used

17

Avoid «strange» number formatting

18

How reasonable are the RAC?

The RAC are in accordance with values recommended by the HSE in the UK

Similar RAC in the Netherlands are much stricter

How does the RAC relate to “historical” gross accident risk level in Norway?

19

Historical “risk”

20

Criteria used in the Netherlands

21

Conclusions, RAC

In relation to “historical” events, the applied RAC do not impose significant additional risk Provided not too many enterprises

are balancing on the edge between red and yellow

It is not obvious that “natural events” should be used as a basis

However, it is hard to argue that the criteria are unreasonable

The Dutch criteria are much stricter Note the history of the Dutch criteria: A calibration

was done to give a reasonable risk level for 2000 LPG stations in the Netherlands

22

Should one use RAC?

The way RAC were used, the decision problem is seen as a decision problem where one accept any severity level if the assigned probability is sufficient low

Some of the stakeholders claimed that this is not the correct focus, there are some consequences that are unacceptable independent of their probabilities

This calls for a deterministic approach (Perrow?) Regulations in Norway does not support such ideas The topic was indeed discussed during the dialogue

meetings, and the mass meetings This may relate to what Aven & Renn denotes ambiguity

23

Topic 2 - Results from quantitative risk analysis

The results from the QRA shows that the risk is in the ALARP region

The main contributor to the risk is the ferry terminal

An ALARP process has been run to obtain efficient risk reducing measures

The decided risk reduction measures will not bring risk to the Dutch level

24

Topic 3 - Additional risk reducing measure

A drifting gas cloud is the main contributor to gross accident risk A remote operated fire water pump that can establish a “curtain”

of water that may stop the drifting of LNG gas Forced ignition of drifting LNG gas

25

The plant layout

26

ALARP process

In the ALARP region we should implement all possible risk reducing measure unless they are impractical, or the cost of the measure is disproportional to the risk reducing effect

For the fire pump to produce the protective “curtain” of water, the benefit/cost ratio is found to be approximate 1:30, hence it may be argued that this is a rather costly measure

27

Forced ignition of the gas cloud

If there is a huge gas leakage at the plant, it is a possibility that the gas will not ignite immediately

Thus, a gas cloud may drift away from the plant towards the ferry terminal 300 metres away

If the gas cloud ignite when passing the ferry terminal this could cause up to 1000 fatalities

In order to reduce the consequence of this scenario it is proposed to ignite the gas cloud intentionally before it reaches the terminal building

This measure was rejected by Lyse

28

Effect of the measure

The measure may reduce the probability of an accident with 1000 fatalities with one or two decades depending on the reliability of the ignition unit

Hence, the measure will bring the risk in the direction of the Dutch criteria

Negative aspects: Personnel fighting against the leakage will be exposed to an

additional risk demanding ethical issue Increased expected material damages because ignition will for

sure make huge material damages, whereas a non ignited gas cloud may drift away without any damage

29

Risk communication: Forced ignition

Forced ignition is a measure that was considered to reduce the risk with an order of magnitude or more Not recommended by Lyse (i.e., Scangass AS)

The measure was proposed from one of the stakeholder groups

The measure was serious evaluated One of the public critic of the plant (Norwegian risk

analyst) used the following term in a feature article: The plant is so “risky” that one has to implement such a dramatic

measure He did not claim: To approach the ALARP region all measures

were considered….

30

LNG leak in Risavika, 2014 (preventor.no)

The 130 kg LNG leak in early May 2014 from the ferry bunkering facility revealed severe faults, and confirm a lot of the criticism made by Prof Vinnem and others over the years. The main deficiencies according to DSB: ESD system did not function as specified, isolation took too long

time It could not be documented that operators had required

competence, nor had been given relevant training in order to conduct bunkering in a safe manner

It could not be documented that risk assessment had been conducted before deviations from procedures were decided

The fire brigade was never informed about the leak.

31

Thank you for your attention

Questions?