Kristiansen Svein. Maritime Transportation: Safety Management and Risk Analysis
Подождите немного. Документ загружается.
. Strengthen the construction of the bow door hinges in order to avoid the bow door
opening in severe weather/sea conditions.
. Down-flooding of water on the vehicle deck to tanks (equipped with pumps) situated
in the lower parts of the hull.
. Introduce transverse bulkheads on the vehicle decks.
This list of risk control measures/options is not exhaustive.
10.5.3 Grouping Risk Control Measures
Based on the identification of potential risk control options, a wide range of measures
reflecting various areas, effects and characteristics should be forwarded to step 4 in the
FSA methodology, i.e. the cost-benefit assessment. In relation to this it is often very useful
to group the risk control options in different categories based on the practical type of
regulatory options that can be used/implemented. It may also be useful to group the
options/measures based on their effects on the system/activity under consideration. Typical
effects will include preventive, mitigation, engineering, procedural, etc. Some risk control
measure characteristics are given in Table 10.6.
Table 10.6. R isk cont rol measu re characteristics
Risk control Description
Preventive Preventive risk control is where the risk control measure reduces the
probability of the undesired event under consideration.
Mitigating Mitigating risk control is where the risk control measure reduces the
severity of the undesired event outcome or subsequent events,
should they occur.
Engineering Engineering risk control involves including safety features (either
built in or added on) within a design. Such safety features are safety
critical when the absence of the safety feature would result in an
unacceptable level of risk.
Inherent Inherent risk control is when choices are made in the initial design
process that restrict the level of potential risk.
Procedural Procedural risk control is where the operators of the equipment/
systems are relied upon to control the risk by behaving in
accordance with defined procedures.
Redundant Redundant risk control is where the risk control is robust to failure
because redundancy principles have been applied.
Diverse or concentrated Diverse risk control is where different risk control measures are
applied for different aspects of the system, whereas concentrated
risk control is where similar risk control is applied across the
system.
(continued )
296 CHAPTER 1 0 FO RMAL SAFETY ASSESSMENT
10.6 COST-BENEFITASSESSMENT
The cost-benefit assessment (CBA) is important in any FSA because it decides whet her
or not the suggested risk control options /measures are suitable for implementation. A
CBA analysis determines if the benefits of implementing a given risk control option
outweigh the cost of implementation. Cost-benefit assessment was described in detail
in the previous chapter, and in this chapter a more general approach is introduced by
including important CBA aspects and issues relevant in an FSA context. The cost-benefit
assessment used in a FSA context may be illustrated as a series of stages as shown in
Figure 10.9.
Table 10.6. Cont i nued
Risk control Description
Passive or active Passive risk control is where there is no action required to deliver the
risk control measure, whereas active risk control is where the risk
control is provided by the action of safety equipment or operators.
Independent or
dependent
Independent risk control is where the risk control measure has no
influence on other elements, whereas dependent risk control is
where one risk control measure can influence another elements of
the risk contribution trees (i.e. fault and event trees).
Human factors
involved and critical
Human factors involved risk control is where human action is
required to control the risk but where failure of the human action
will not itself cause an accident or allow an accident sequence to
progress. Human factors critical risk control is where human
actions are vital to control the risk, and where failure of the human
actions will directly cause an accident or allow an accident sequence
to progress. Where human factor critical risk control exists, the
human action (or critical task) should be clearly defined in the risk
control measure.
Auditable or not auditable Auditable or not auditable reflects whether the risk control measure
can be audited or not.
Quantitative or qualitative Quantitative or qualitative reflects whether a particular risk control
measure has been based on a quantitative or qualitative assessment
of risk
Established or novel Established risk control measures apply currently existing technology
and solutions, whereas novel risk control measures are where the
measure is new. However, the measure may be novel to shipping but
established in other industries.
Developed or non-developed Developed or non-developed reflects whether the technology under-
lying the risk control measure is developed both in its technical
effectiveness and in terms of costs. Non-developed is either where
the technology is not developed but it can be reasonably expected to
develop, or where the costs of the measure can be expected to
decline over a given period of time.
10.6 COST-BENEFIT ASSE SSMENT 297
10.6.1 Problem Definition
This first stage of the cost-benefit assessment (CBA) process is to make a problem
definition. The boundaries for the analysis are already established in the previous steps of
the FSA, and these boundaries should be implemented in the CBA in addition to some
boundaries used explicitly in the CBA. One additional boundary that shou ld be defined
is the geographical boundaries of the CBA. Most safety measures may be applied
world-wide and could in some cases be considered as generic, e.g. SOLAS or other IMO
conventions. Another aspect of the geographical boundary is the variation in cost, and in
some cases also the benefits, with geographical area. In addition some safety measures are
only effective in a specific area of operation, for example in port or in transit. This may
have an impact on the benefits (i.e. averted consequences) of the measure.
An important aspect to define in the problem definition stage is the base-line year to
be used in the cost-benefit assessment. This ba se-line year must be defined in order to
establish the risk improvements and the costs of implementation for a given risk control
option (or measure). In most FSA applications the base year will be the time of investing
in the option. If there is any limited time duration of the safety measure’s effectiveness, this
must be included in the problem definition because it will influence the calculations of the
benefits and costs related to a risk control option. In addition, it must be taken into
account that different stakeholders often incur different costs and receive different benefits
(this problem is, however, not relevant for the society risk approach).
It is of crucial importance in the problem definition stage that the alternative risk
control options are defined as precisely as possible, because this information will affect
both the benefits and the costs related to the implementation of the option/measure. In the
Figure 10.9. Step 4 of the FSA methodology.
298 CHAPTER 1 0 FO RMAL SAFETY ASSESSMENT
next two stages of the cost-benefit assessment (CBA) process the benefits and costs for the
suggested risk control options are identified and quantified.
10.6.2 Identify Costs and Benefits
All the potential costs and benefits related to each of the relevant risk control
options/measures should be identified in this stage of the CBA process. It is, however,
equally important to identify potential negative effects that the implementation of risk
control options can have on the system/activity in question. On a ship such negative
effects could, for example, include longer loading/unloading times, reduced speed, more
downtime due to inspections and controls, etc.
The implementation of risk control options (or safety measures) may involve many
different types of costs and benefits. Typical costs involved may include one or more of the
following:
. Capital/investment cost
. Installation and commissioning cost
. Operating or recurrent cost
. Labour cost
. Maintenance
. Training
. Inspection, certification and auditing
. Downtime or delay cost
There are also costs associated with not implementing safety measures, and avoiding
these costs are benefits of implementing such measures. The benefits of implementing a
risk control option on a ship usually include one or more of the following:
. Reduced number of injuries and fatalities
. Reduced casualties with vessel, including damage to and loss of cargo and damage to
infrastructure (e.g . berths)
. Reduced environmental damage, including clean-up costs and impact on associated
industries such as recreation and fisheries
. Increased availability of assets
. Reduction in costs related to search, rescue and salvage.
. Reduced cost of insurance
In the process of identifying costs and benefits related to a system, one should be
careful not to double-count. Double counting may result in unbalance in the CBA
assessment and will increase the uncertainties related to the assessment as a whole.
10.6.3 Quantify Costs and Benefits
When all the relevant costs and benefits related to the implementation of a risk control
measure to a system/activity are identified, these must be quantified (AEA, 1995). Several
10.6 COST-BENEFIT ASSE SSMENT 299
approaches may be used to quantify costs and benefits. One common valuation approach
is to evaluate the effect of the consequences on production factors. By applying this
approach, the costs of an injury to a human being can be derived by considering the length
of hospitalization and its costs, the degree of permanent disability, and the lost earnings
due to this disability (see Chapter 9 for further details). Another valuation approach is
based on the creation of a hypothetical market for a reduced probability of occurrence,
consequence or risk, and then establishing the price individuals are willing to pay to reduce
these factors. Several other valuation approaches exist, but it is outside the scope of this
chapter to go into these in detail. However, most valuation approaches have in common
that they result in a monetary cost of a fatality, pollution to the environment, etc. It may
seem ‘heartless’, for exampl e, to calculate/estimate the monetary benefits of averting
a fatality because this is associated with identifying the ‘value’ of a human life. Such
considerations are apparent, but some sort of criterion is necessary when analysing risk
exposure to humans as well as property and the environment. Setting no value on the costs
related to a fatality may in the worst case be counter-productive in the process of reducing
the risks associated with activities and the operation of systems.
10.6.4 A daptation onto a Com mon Scale
Different risk control measures result in differen t risk reductions, and each measure is
associated with a set of distinct benefits and costs. In order to select the most cost-effective
measures for implementation, it is very advantageous to evaluate these against each other
on a common scale, which normally implies monetary values. In the previous chapter
several approaches for cost-benefit analysis (CBA) of risk control/reduction measures
were presented, and these must be applied wi thin the framework of the FSA. In particular,
the Implied Cost of Averting a Fatality (ICAF) approach/methodology is very much used
in FSAs, and a detailed review of this approach can be found in Chapter 9. In essence,
the ICAF methodology estimates the achieved risk reduction in terms of cost using the
following equation:
ICAF ¼
Net annual cost of measure
Reduction in annual fatality rate
ð10:1Þ
ICAF may also be calculated by dividing the net present value of all costs for the whole
lifetime of the safety measure by the total reduction in fatalities for that particular period of
time. The ICAF value can be interpreted as the economic benefits of averting a fatality. A
decision criterion must be established for this value in order to evaluate whether a given risk
control option/measure is cost-effective or not. A method for developing such a criterion is
also presented in the previous chap ter. Risk control measures with an ICAF value less than
the criterion should be considered as cost-effective and therefore implemented.
10.6.5 Evaluating Uncertainty
There are always uncertainties involved in a cost-benefit analysis (CBA), especi ally in the
process of identifying and quantifying costs and benefit. The uncertainties must be taken
30 0 CHAPTER 1 0 FORMAL SA FETY ASSESSMENT
into account in the CBA, and several approaches exist for achieving this objective.
One approach is to create an interval for each specif ic cost (and benefit) in which it may
vary. This will result in a cost-benefit ratio with a pos sible range of values and a most
likely value. Another approach is to perform a sensitivity analys is of the parameters
involved and then assess the uncertainty of the information implemented in the most
sensitive parameters.
10 . 7 RECOMMENDATIONS F OR DECIS ION- MAKING
Step 5 of the FSA methodology involves proposing recommendations to the decision-
makers on which risk control option(s) should be adopted in order to make the risks
ALARP, i.e. as low as reasonably practicable. The recommendations will be based on the
information generated in steps 1–4 of the FSA methodology. The results obtained in the
cost-benefit calculations will generally form the basis for the recommendations. Of
particular importance is normally the evaluation of different risk control options relative
to each other using a common scale (e.g. CURR or ICAF).
The recommendations may be presented as a prioritized list of cost-effective risk
control options/measures. Such a list should include a description of the options, including
their cost-benefit ratios, and an evaluation of the uncertainties related to each of the
options. It must be ensured that the recommendations made are fair to all the stakeholders
involved in the safety management of the activity/system under consideration (e.g. a ship).
The recommendations could also include suggestions for improvements to the analysis
(or the FSA methodology) and advice on further work that should be carried out on the
subject under consideration.
10.8 APPLICA TIO N OF THE FSA METH ODO L OGY
In the last section of this chapter, some important elements of a comprehensive FSA study
on life-saving applian ces for bulk carriers are presented. In addition to showing how the
FSA methodology can be used in practical applications, a major objective of the example (or
case) presented here is to illustrate how the methodology can be flexibly modified to suit a
particular problem. This flexibility is one of the great advantages of the FSA methodology.
Exam p le
Problem
At the 70th session of IMO’s Maritime Safety Committee (MSC) the topic of life-saving
appliances (LSAs) for bulk carriers was discussed, and it was decided to include LSAs as
part of the formal safety assessment (FSA) process for these vessels. This case example
briefly summarizes some important aspects of a comprehensive FSA project on LSAs for
bulk carriers performed in Norway (Skjong, 1999; DNV et al., 2001).
This FSA study focuses solely on LSAs with the objective of identifying risk control
options (RCOs) for bulk carriers that give improved life-saving capability in a cost-
effective manner. The study is considered representat ive for all SOLAS bulk carriers over
85 metres in length.
10.8 APPLIC ATION OF T HE F SA ME T HODOLOGY 301
Solution
The five steps of the FSA methodology are carried out in succession below. It must be
recognized that many details are left out from the original FSA project report.
Step1: Hazard identification
The hazard identification step of the FSA methodology begins with establishing a precise
and carefully defined problem definition. The problem addressed in this study was related
to the identification of effective risk control options that could bring down the fatality
rates in evacuation associated with bulk carrier accidents, i.e. to improve the probability of
evacuation success given different accident scenarios (e.g. a collision). Previous individual
and societal risk assessments for bulk carriers have shown that the risks are high in
the ALARP region, and that cost-effective risk con trol options therefore should be
implemented. Several regulations in SOLAS 74 are affected by the recommendations of
this particular FSA study. More detailed background information can be found in the
reference source (DNV et al., 2001).
The process of hazard identification was carried out in multidisciplinary teams of
relevant experts using the so-called ‘What if...?’ technique. In this method a list of
potential hazards is produced for a system or subsystem by asking ‘What if...?’ something
does not work as planned or something unexpected/undesirable happens. The hazards
were identified and ranked separately for commonly used LSAs on bulk carriers, i.e.
conventional lifeboats, free-fall lifeboats, davit-launched liferafts, and thrown overboard
liferafts. All phases of an evacuation event were analysed for hazards, from the occurrence
of the initiating event, through mustering, abandoning, survival at sea and the final rescue.
Some, but not all, hazards were generic for all categories of survival crafts. Some hazards
were also related to survival at sea and rescue.
The last task of the hazard identification step is to perform a hazard screening. In this
particular analysis this included a ranking of the hazards based on a qualitative assessment
of their importance in terms of risk. The most important hazards were given particular
consideration in the risk assessment step of the FSA.
Step 2: Risk assessment
Probabilities for various accident scenarios are fairly well established for bulk carriers
through incident data sources such as Lloyd’s Maritime Casualty Reports (LMIS) and
Lloyd’s Casualty Reports (LCR). With regard to evacuations, these data sources show that
a total of 115 bulk carrier evacuations were identified during the period from 1991 to 1998.
The ship population exposed during this period of time was 44,732 ship years (i.e. an
average fleet size of approximately 5592 ships), identified through Lloyd ’s Register’s
World Fleet Statistics. This gives a total evacua tion frequency of 2.6 10
3
per ship year.
This is approximately the same evacuation frequency as for merchant ships in general.
Distributed with respect to type of accidental event, the resulting evacuation frequencies
are as listed in Table 10.7. The number of crew members on board is obtained by
multiplying the number of events by the average crew size per ship of 23.7.
302 CHAPTER 10 FORMAL SA FETYASSESSMENT
With regard to studying the risks involved in evacuation using life-saving appliances
(LSAs), it is not of particular interest to study the causes resulting in the accidental events
shown in Table 10.7. The structuring and quantification of the fault trees underlying these
events is therefore not performed. In terms of studying how the use of different LSAs
affects the evacuation risks, an evacuation model consisting of event trees must be
constructed to model how an initiating accidental event may develop into fatalities, in
particular fatalities related to evacuation. The event trees modelled in this FSA study
are generic, implying that they are structurally identical for all accident scenarios. The
probabilities in the event trees are, however, conditional on the initiating event defining
each accident scenario. The event trees must be very detailed so that they can be used to
assess (i.e. quantify) the risk-reducing effect of risk control options (RCOs). Potential
loss of life (PLL) is the only decision parameter predicted by the risk assessment model
that is developed, as LSAs do not have any important impact on environmental and
economic risk.
As mentioned above, an evacuation model is created to analyse how the different LSAs
affect PLL. The model consists of the typical sequences of events that are associated with
evacuation using different LSAs. The sequence of events expected for evacuation using
conventional lifeboats is shown in Figure 10.10. The model is deve loped by following
an individual crew member. The sequence of events is slightly different for thrown
overboard liferafts and davit-launched liferafts. For example, thrown overboard liferafts
are launched before boarding.
The evacuation sequence gives the underlying basis for the construction of an event
tree, or several event trees if the sequence is divided into several sub-sequences as
illustrated in Figure 10.10. The branch probabilities in these event trees are to some degree
different for the different accident scenarios. For example, there is a slight probability of
fatality as a result of the initiating event in the scenarios of ship collision or fire/expl osion,
while this probability is negligible for the accident scenario of hull/machinery failure.
Statistics show that it is the evacuation sequence rather than the initiating event that has
the highest probability of contribution to fatalities. Another example is that there is a
Ta b l e 1 0 . 7. Bulk carrier evacuation frequencies and fatality probabilities for different types of accidental
events (1991^98)
Type of accidental
event
Number of
events
Evacuation
frequency
(per ship year)
Fatalities Number on
board
Probability of
fatality (%)
Collision 14 3.1 10
4
116 332 35
Contact 5 1.1 10
4
54 119 45
Fire/explosion 16 3.6 10
4
6 379 2
Foundered 51 1.1 10
3
618 1209 51
Hull failure 5 1.1 10
4
0 119 0
Machinery failure 1 2.2 10
5
0240
Wrecked/stranded 23 5.1 10
4
0 545 0
Total 115 2.6 10
3
794 2727 29
10.8 APPLIC ATION OF T HE F SA ME T HODOLOGY 303
higher probab ility of not being able to escape to the mustering station in the event of
foundering compared to, for example, hull/machinery failure. Using statistics and expert
judgement, Table 10.8 can be constructed for the undesirable events following an initiating
event until preparation of the LSA. The scenario of jumping into the sea, awaiting and
being rescued may occur in the case where there is a faulty evaluation of the situation, an
untimely decision to muster is taken, the crew is unable to reach mustering stations, and in
the case where the search for missing personnel is not terminated in time.
Similar tables can be produced for the other parts of the event sequence (see
Figure 10.10). Where different branch probabilities are expecte d for the different LSAs,
separate tables and event trees must be constructed for each LSA. The event tree
corresponding to Table 10.8 is given in Figu re 10.11.
The resulting probabilities of fatality and potential loss of life (PLL) for the different
types of accidental events can be summarized by Table 10.9, which shows that the
established evacuation model reflects the real world data fairly well. This is mainly due to
the fact that actual data are used as the basic inputs and broken down into event tree
branch probabil ities. The weaknesses of the model are that the statistical values are based
on a very limit ed number of events, which result in uncertainties, and that the model does
not take sufficient account of the time factor involved in evacuation (i.e. in some cases the
crew have more time available than in other cases).
In Table 10.9, the PLL is calculated as the number of fatalities in the given time period
(1991–98) divided by the number of ship years in that period (44,732; see Table 10.7 earlier
Figure 10.1 0. E vacuati on model for convent i ona l l ife boats.
304 CHAPTER 10 FORMAL SA FETYASSESSMENT
Table 10.8. Event tree branch probabilities for the undesi rable events following a shi p accident until preparation of the LSA
Collision Contact Fire/
explosion
Foundered Hull/
machinery
Wrecked/
stranded
Fatality as result of initiating event 0.0001 — 0.007 — — —
Faulty evaluation of situation 0.31 0.31 — 0.37 — —
Fatality as a result of not jumping into
sea – given faulty evaluation of the situation
11—1 — —
Untimely decision to muster 0.03 0.03 0.015 0.03 0.03 0.03
Fatality as a result of not jumping into
sea – given untimely decision to muster
0.90 0.90 0.90 0.95 0.95 0.95
Unable to reach mustering station 0.06 0.06 0.03 0.07 0.02 0.06
Fatality as a result of not jumping into
sea – given being unable to reach mustering station
0.95 0.95 0.95 1 0.95 0.95
Not terminating search in time 0.04 0.04 0.04 0.04 0.04 0.04
Fatality as a result of not jumping into
sea – given search for missing personnel
not terminated in time
0.625 0.625 0.625 0.625 0.625 0.625
Fatality associated with jumping and
awaiting rescue
0.358 0.323 0.420 0.970 0.420 0.323
Fatality as a result of not being successfully
rescued from the sea
0.0016 0.0016 0.021 0.050 0.021 0.0016
10.8 APPLIC ATION OF T HE F SA ME T HODOLOGY 305