Kristiansen Svein. Maritime Transportation: Safety Management and Risk Analysis
Подождите немного. Документ загружается.
operational phases of the generic ship are defined as below:
. Entering port, berthing, unberthing, and leaving port
. Payload loading and unloading
. Passage/transit
. In dry dock
Each element of the generic ship has more detailed descriptions, and subcategories that
have to be applied when utilizing the FSA methodology, but such descriptions go beyond
the scope of this book. It is, however, important to notice that the defined functions and
systems are closely related to all steps of the FSA .
10.2.2 Stakeholders
One problem when applying cost-benefit analysis (CBA, step 4 in the FSA methodology) in
risk assessment is the number of stakeholders (or parties) involved with regard to the vessel,
and their various roles in relation to the costs, benefits and risks involved. A stakeholder
may be defined as a party investing risk in shipping operations. In many cases the
stakeholder who imposes certain risks is not the same stakeholder who carries these risks.
The extent and complexity of stakeholder groups adds complexity to the CBA analysis
because each group imposes and carries different costs, benefi ts and risks, and has different
risk perception. Each group of stakeholders therefore perceives the costs an d benefits
differently, making the CBA difficult and a major challenge for the analyst. Table 10.2
indicates which stakeholders incur which costs, receive which benefits, and impose
and carry which risks. The so-called ‘risk imposer pays’ principle (or policy) implies
that those stakeholders who, voluntarily or not, impose risk on others should pay for
that privilege.
10.3 HAZARD I DEN TIFI CATI O N
Hazard identification is the first step of the FSA methodology. The main objective of this
step is to identify relevant hazards, i.e. undesirable accidental outcomes, which could
affect the ship operation under consideration. In a safety context the undesirable outcome
could include injury to personnel, damage to property, and/or pollution of the
environment. In addition to identifying the hazards related to an activity, this step
should also include identifying the cau ses of these undesirable outcomes. The hazard
identification step is composed of several sequential stages as may be summarized by the
simple flow diagram in Figure 10.3.
The first stage in the hazard identification step is to make a precise and carefully
defined problem definition. A well-defined problem definition is of great importance
because it provides a desirable starting point for the FSA process. It is important that the
problem definition clearly points out the objective of the particular FSA being carried out,
which would include a description of the systems/activities under consideration and their
relation to the rules/regulations under review or development. Identifying the boundary of
the analysis is very important in this regard. When using the FSA methodology on ships,
286 CHAPTER 10 FORMAL SA FETYASSESSMENT
the following information may be found relevant to include in the problem definition:
. Vessel type
. Relevant systems and functions
. Part of ship operation under concern
. Rules/regulations to be studied
. Geographical boundaries
. Applied measures of risk
. Type and definition of acceptance criteria
Ta b l e 1 0 . 2 . Examples of stakeholders and their risk investments
Stakeholder Incurs costs Receives benefits Imposes risks Carries risks
Owner/
charterer
Cost of vessel Income Choice of vessel
specifications
Loss of vessel
Cargo owner Pays for passage Profit from trade Dangerous cargoes Loss of cargo
Operator Running costs Income Operating practice Loss of income
Crew — Employment Lack of due diligence Loss of life/property
Passenger Fares Transport,
leisure
— Loss of life/property
Flag state Administration
costs,
employment
Fees Inadequate local
legislation
—
Port of call Cost of
infrastructure,
operating costs
Fees Navigational control,
dredging levels
Damage to
infrastructure,
loss of trade
Coast state Local navigation — Inadequate navigation
aids
Pollution and
clean-up
Insurer — Premiums — Claims
Other vessel — — Impact, loss of life Impact, loss of life
Classification
societies
Operating costs Fees Lack of due diligence Negligence claims
Designer/
constructor
Materials/labour Fees Lack of due diligence —
Figure 10.3. Step 1 of the FSA methodol ogy.
10.3 HAZARD IDENTIFICATION 287
A large part of this information will be defined through the application of a generic ship
model in the FSA.
When an appropriate problem definition is established, we proceed to the actual hazard
identification stage. The process of hazard identification, as well as specific techniques that
may be used, is described in detail in Chapter 8. Some generic accident outcomes (i.e.
consequences), causes and influencing factors are outlined as part of the FSA methodology
based on the characteristics of the generic ship. Some generic elements assumed to affect all
ships are given in Tables 10.3, 10.4 and 10.5. These generic elements may be utilized by,
for example, applying different brainstorming strategies to identify relevant hazards.
One approach is to use brainstorming to identify as many hazards as possible. At the
end of the brainstorming session the findings can be structured and g rouped in the
generic ship categories (i.e. one category covering grounding scenarios, another for
collision, etc.), and a rest group categorized as ship-specific findings. An alternative and
less comprehensive approach is to use the generic hazard elements (i.e. accident outcomes,
causes and influencing factors) as a starting point, then find the ones that are relevant,
and finally inspect the characteristics of the specific ship under consideration to identi fy
and include ship-specific elements not covered by the generic ship characteristics.
Ta b l e 1 0 . 3 . Generic accident outcomes derived from
examination of historical data recordings
Collision (striking between ships)
Contact (striking between ship and other objects)
Fire and explosion
Foundering and flooding
Grounding and stranding
Hull and machinery failure
Missing
Other/miscellaneous
Ta b l e 1 0 . 4 . Gene ri c accide nt causes
Human causes (e.g. failure to read navigational equipment correctly)
Mechanical causes (e.g. failure of pumps)
Fire and explosion (e.g. loss of visibility due to smoke)
Structural causes (e.g. failure of bow doors)
Weather-related causes (e.g. high ambient temperature)
Other causes
Ta b l e 1 0 . 5 . Generi c inf l uenci ng cate gories
Likelihood of underlying causes occurring
Likelihood of an underlying cause progressing to a major accident
outcome
Magnitude of the consequence of the major accident outcome
28 8 CHAPTER 1 0 FORMAL SA FETY ASSESSMENT
The establishment of generic hazard elements in the development phase of the FSA
becomes increasingly difficult the deeper into the accidental escalation one tries to find
generic elements. Hence, the hazard influencing factors in Table 10.5 are described in
categories only.
The last stage of the hazard identification step (or process) is known as the hazard
screening stage and generally involves structuring the findings in the step for
implementation in the late r steps of the FSA methodology. It could be argued that the
grouping of hazards into generic accident categories is some type of hazard screening. One
more extensive approach found to be useful in some maritime applications of FSA is the
use of a risk matrix where the hazards are plotted in a matrix as a function of the severity
of the consequences and the probability of occurrence. This, however, means assessing the
risk, i.e. both the severity and the probability of the hazards, and should in principle be
included in step 2 (risk assessment) of the FSA. It is difficult to define a precise border
between step 1 and step 2 of the FSA, but if we wish to be loyal to the definitions of hazard
and risk (which we should in order to avoid unnecessary confusion), the construction of
risk matrixes, fault trees and event trees should be included in step 2 of the FSA.
10.4 RI SK ASSESSME NT
Step 2 (risk assessment) continues directly from step 1 (hazard identification). The
objective of this step of the FSA methodology is to quantify the risks of loss of life,
damage to property and damage to the environment. To achieve this goal, attempts must
be made to identify and quantify the underlying causes and influences that affect the
likelihood of initiation and progression of accident sequences (all accidents are a sequence
of events). The risk assessment process may be illustrated as a sequence of stages that
should be carried out in order to realize the full potential of the process. Such a sequence
of stages is given in Figure 10.4.
Figure 10.4. Step 2 of the FSA methodology.
1 0 .4 RISK ASSESSMENT 289
Risk can generally be defined as a measure of a hazard’s significance involving
simultaneous examination of its consequence and probability of occurrence, and risk
assessment is the process that determines where a hazard will be located on a risk scale.
The risk scale can either be a continuous numerical scale or a discrete scale (risk matrix).
Risk assessment can generally be divided into qualitative and quantitative risk assessment.
With reference to Figure 10.4, the qua litative risk assessment involves the two first stages,
while the quantitative analysis is the last two stages. It is important to obtain quantitative
risk estimates in a FSA because such estimates can be used to see the effects of risk control
options/measures through the application of a cost-benefit analysis.
10.4. 1 Q ualitative Risk Assessment
The qualitative risk assessment involves the two first stages in Figure 10.4, i.e. to structure
logical relationshi ps as well as to structure and quantify influence diagrams. This includes
a structured an alysis of the hazard findings from the hazard identification step of the
FSA methodology.
The logical relationships underlying an accident may be constructed using fault trees
(also known as logical contribution trees). Considerable knowledge of and experience with
the system is needed in order to construct a meaningful fault tree. On a more preliminary
basis, cause and effect diagrams may be used in order to identify the potential causes of
an undesired outcome (i.e. effect) such as an accident. The International Maritime
Organization (IMO) prefers so-called risk profiles, which basically are simplified fault
trees, for the qualitative risk analysis. The common idea for both techniques is the
deduction of the underlying causes (and their relationship) of an accidental outcome, but
in comparison to a fault tree the risk profile is simpler becau se there are no logical gates
between the underlying causes. Risk profiles are deduced mainly from historical accidental
outcomes rather than from underlying causes/failures, which is the case for fault trees.
Figure 10.5 shows the risk profile for the accidental outcome of a collision. It is recom-
mended the common fault tree construction technique is applied instead of risk profiles
if a detailed analysis is performed/r equired.
Influence diagrams, i.e. stage 2 in Figure 10.4, are diagrams constructed to illustrate
the regime of factors that influence the risks in a system/activity. It is usual to distinguish
between regulatory influences, corporate policy influences, organizational influences,
operational influences, etc., and the influence diagrams are often interrelated in very
complicated patterns. Some factors influence the performance of a system directly
(e.g. organizational policies and implementation), while other factors are more underlying
influences. Some IMO regulations may be an example of the latter. A rough draft of an
influence diagram is given in Figure 10.6.
Influence diagrams have proved to be a powerful tool in establishing how the regulator
and the managing organization can influence both the likelihood and outcome of
accidents. The diagrams can be constructed as purely qualitative diagrams or they can
be quantified by assessing the current significance/importance of each influence. If it is
found to be possible to quantify the influence diagrams, this can provide a useful basis for
judging the effectiveness of the safety measures (or risk control options ) derived in step 3
290 CHAPTER 1 0 FO RMAL SAFETY ASSESSMENT
of the FSA methodology. The diagrams may also reveal influencing factors that have
potential for improvements. In a sense the underlying objective of the FSA methodology is
to change/modify the influence diagrams.
10.4.2 Quantitative Risk Assessment
In order to be able to focus on high-risk areas, both the absolute risk level and the relative
importance of different causes have to be quantified. The main objective of the
quantitative risk asses sment, which involves the last two stages in Figure 10.4, is to
establish the relative and absolute importance of the underlying causes, as well as the
influencing causes. This involves calculating risk estimates such as f – N curves/diagrams
(i.e. logarithmic scales showing the probability f as a function of fatalities N), PLL
(Potential Loss of Life), AIR (Average Individual Risk), and similar measures. The
quantification is performed through analysis of historical data and expert judgement
techniques. When analysing historical data it is common to break down a number of
Figure 10.5. Risk profile for the accidental outcome of a collision.
1 0 .4 RISK ASSESSMENT 291
relevant accidents to develop satisfactory quantification of the likelihood of occurrence
of the underlying causes. These historical measur es can be adjusted or complemented by
expert judgement.
Quantification is performed in two directions from the accidental outcome (or
scenario): fault trees are used to quantify the probability of occurrence for a certain
accident outcome/scenario, while event trees are used to quantify the frequency of
different consequences given a certain accidental outcome (e.g. a collision between two
ships). The potential consequences should reflect the injuries to people, as well as damage
to both the environment and physical assets. Considerable knowledge of the system and
situation under consideration is needed in order to create reasonable and valid event and
fault trees (i.e. risk contribution trees). Influence diagrams can be used to aid the process
of establishing valid risk contribution trees.
The risk is calculated by combining/multiplying the probabilities of occurrence with
the severity of the consequences. If this is done for all possible outcomes of an accident
scenario, the total risk picture is established. As mentioned above, the total risk can be
presented in many different ways, for example as a numerical value (e.g. number of
fatalities per 10
8
working hours) or as a f–N curve. The total risk should preferably be
presented both numerically and graphically. Which risk presentation techniq ues are found
appropriate will in general depend upon the system/activity under consideration. The
process of quantitative risk assessment often used within FSA is illustrated in Figure 10.7.
In the next step of the FSA methodology, several safety measures (or risk control
options) are generated and considered implemented. In order to quantify the risk-reducing
effect of these options (i.e. the be nefits), the quantification procedure described in this risk
assessment step of the FSA has to be repeated for each risk control option consider ed.
Figure 10.6. Rough draft of an influence diagram structure.
292 CHAPTER 1 0 FO RMAL SAFETY ASSESSMENT
10.5 ESTABLIS H SAFETY MEAS URES
The output from step 2 (risk assessment) provides a risk profile showing the risks for the
major hazard categor ies and principle subcategories. The results of the risk assessment
step also include knowledge of direct contributing causes and the likelihood of alternative
levels of loss, i.e. consequences. Based on this information, the objective of step 3 of the
FSA methodology is to focus on the activities/systems needing control because of high
Figure 10.7. The process of quantitative risk assessment often used in FSA.
10.5 ESTABLISH SAFETY MEASURES 293
risks or other weighty matters. This involves both considering new safety measures (or risk
control measures) and assessing to what degree current risk management and regulations
mitigate the system hazards. This process is also known as risk management because it
involves managing the risks in the system.
The step 3 process is usually defined as consisting of three stages that should be
performed as illustrated by Figure 10.8.
The border between the step 3 and the step 4 processes is not easily defined. Many would
argue that step 3 (risk control options) should include a quantitative assessment of the
effects (i.e. risk reducti on and/or other possible benefits) of the options/measures, but this
assessment activity will here be placed under the step 4 process of cost-benefit assessment.
10.5.1 Areas Needing Control
There are several areas needing risk control. The main aspects for risk control are as
follows:
. Unacceptable risk levels: If some of the risks identified in the risk assessment
process are found to be unacceptable (or intolerable), risk control options must be
implemented in order to make the risks acceptable/tolerable and ALARP, i.e. as low as
reasonably practicable.
. Risks within the ALARP region: If the identified risks in the risk assessment step of
the FSA are within the ALARP region, cost-effective risk control options/measu res
should be implemented. Risks within the ALARP region should be undertaken if a
benefit is desired, and are only considered tolerable if risk reduction is impracticable or
if its cost is grossly disproportionate to the improvements gained. The ALARP concept
is thoroughly explained in Chapter 9.
. High probability: If some hazard scenarios have a low severity but a high probability,
they may be found to be unacceptable from an operational point of view even if they
have a tolerable risk level. To be able to identify such situations, qualitative risk
assessment must be made.
. High severity: If some hazards have a low probability but a high severity of
consequences, they may be found to be unacceptable even if they have a tolerable risk
level. Qualitative risk assessment is necessary in ord er to identify such circumstances.
Figure 10.8. Step 3 of the FSA methodology.
294 CHAPTER 1 0 FO RMAL SAFETY ASSESSMENT
. Considerably uncertainty: Considerably uncertainty in probability, severity, or both,
could be a reason to take precautions in terms of implementing extra or redundant risk
control options/measures.
10.5.2 Identify Risk Control Measures
Risk control options may take many forms, addressing the technical (engineering), human
and management (organizational) aspects of an operation, and control options /measures
inhabit several characteristics that are important to consider. The proposed risk control
options may address both the prevention of accident/incident initiation and the mitigation
of the consequence severity, i.e. the associated losses. Some risk control options may have an
effect on the risks related to a single or a few hazards, while others may affect the risks
related to all parts of an operation. The effect of the differen t options along the causal chain
(Causal factor ! Failure ! Circumstances ! Accident ! Consequence) may con-
sequently vary. Furthermore, the circumstances in which failures occur may change because
of the introduction of risk con trol measures. For example, the likelihood of engine failure
may decrease when failures due to overload vanish. The effect of risk control measures over
time should also be considered. This may involve the time to full effect of the measure, as
well as the duration of the effect. Because costs and effects of different safety measures may
vary significantly, it is important that a wide variety of measures are considered.
According to IMO’s web site, ‘existing maritime safety efforts are still being primarily
directed towards engineering solutions. Governments and operating companies spend
perhaps 80% of available resources addressing design requirements and technical fixes.
The remaining 20% are directed to the most pervasive and consistent cause of marine
casualties, the human element.’
Exam p le
Problem
The flooding of the vehicle deck on Ro-Ro passenger vessels through an open or partly
open bow door may result in rapid capsizing and the loss of many human lives. This was
the accident scenario in the Herald of Free Enterprise disas ter in 1987. The risk related
to this particular hazard is found to be unacceptable for a given vessel and risk
control options must therefore be implemented in order to reduce the risk. Suggest some
possible/potential risk-reducing control options.
Solution
Possible risk reduction options may include one (or more) of the following:
. Audible alarms on the bridge that will attract the attention of the Master when the bow
door is open or not closed properly.
. Management routines onboard the vessels that control whether the bow door is closed
at departure.
10.5 ESTABLISH SAFETY MEASURES 295