- Email: [email protected]
Quantifying occupational risk: The development of an occupational risk model
Available online at www.sciencedirect.com
Safety Science 46 (2008) 176–185 www.elsevier.com/locate/ssci
Quantifying occupational risk: The development of an occupational risk model B.J.M. Ale a,*, H. Baksteen b, L.J. Bellamy c, A. Bloemhof d, L. Goossens a, A. Hale a, M.L. Mud e, J.I.H. Oh f, I.A. Papazoglou g, J. Post b, J.Y. Whiston h b
a TU Delft, Safety Science Group, PB 5015, 2600 GA Delft, Netherlands National Institute for Public Health and the Environment (RIVM), P.O. Box 1, 3720 BA, Bilthoven, Netherlands c WhiteQueen, P.O. Box 712, 2130 AS, Hoofddorp, Netherlands d Consumer Safety Institute, P.O. Box 75169, 1059 GK, Amsterdam, Netherlands e Abbott Risk Consulting, The Hague, Netherlands f Ministry of Social Affairs and Employment, P.O. Box 90801, 2509 LV, The Hague, Netherlands g National Center ‘‘Demokritos”, Aghia Paraskevi 15310, Greece h Whiston Computing, 32 Brookers Court, Off Baldwin Gardens, London EC1N 7RR, UK
Received 23 March 2006; received in revised form 10 December 2006; accepted 21 February 2007
Abstract Each year eighty-five people are killed on the job in the Netherlands and 167,000 are injured to the extent that they are at least a day absent from work. Their death and injuries occur during the approximately seven million person years that the Dutch workforce spend on their job. The ministry of Social Affairs and Employment (SZW) has as one of its main tasks to reduce and control occupational risk. Recently it commissioned a project to determine the risk and its causes following the same principles as used in quantified analyses of the third party risks of nuclear and chemical plants. To this end a model has been constructed: the occupational risk model (ORM). With this model authorities, industries and experts can evaluate the occupational risks for individual workers, for companies and for projects. The project has four major parts: assembly and analysis of accident and exposure data, generalisation of these data into a logical risk model, deriving improvement measures and their costs and developing an optimiser that supports cost effective risk reduction strategies. The model is a further development of previous work executed with support of SZW and the European Union, such as IRISK and AVRIM. This paper describes the concepts used in the model and the overall structure. Some of the results are also given. More detail and more results are given in other papers in this conference. Ó 2007 Elsevier Ltd. All rights reserved. Keyword: Occupational risk
*
Corresponding author. Tel.: +31 15 2786353; fax: +31 15 2783177. E-mail address: [email protected] (B.J.M. Ale).
0925-7535/$ - see front matter Ó 2007 Elsevier Ltd. All rights reserved. doi:10.1016/j.ssci.2007.02.001
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
177
1. Introduction In the Netherlands occupational health and safety is the concern of the ministry of Social Affairs and Employment (SZW). This ministry has developed and executed many programs to reduce these risks ever since the Fabriekswet (Factory Act) came into force in 1875 (Gorter, 1889). The reduction of human suffering that results from occupational accidents was the main reason for these concerns. In the era of market economy however the economic loss in the form of absence from work, reduced family income and medical cost is a significant secondary issue that supports the drive towards reduced risk (Arbeidsinspectie, 2002). Dutch parliament now demands that prioritising of measures is judged on the basis of cost effectiveness. This defined the context and boundary conditions of the project (SZW, 2004). SZW’s policies used to consist of the traditional ingredients of governmental action: legislation, regulation, standards, supervision and – if necessary – prosecution and punishment. A more modern approach is to have workers and industries develop and maintain their own safety policies and safety management systems. The idea is that companies take care of their workers, providing a safe and healthy working environment. By putting the costs of safety and of accidents back to the employer, economic forces will make safety management systems in companies work correctly and guarantee a more acceptable – cost effective – level of risk. Interestingly this was also the idea behind the Fabriekswet of 1875 mentioned earlier, and regulations and laws passed since were deemed to be necessary to repair the shortcomings of the market. The Fabriekswet specified that occupational safety in principle is a matter between workers and their employer. The task of the government is to create a level playing field by setting boundary conditions. SZW seeks to shape their current policy along the lines of current policies regarding third party risks (Ale, 1987, 1991, 2002; NN, 1988, 2004). The components of this policy are quantitative analysis of risk, determination of dominant paths to accidents from these quantifications and analysis of underlying scenarios and reduction of risk by addressing the dominant threats first and by using the most cost effective method of risk reduction (Jongejan et al., 2006). Just as was done in the early 1980s for third party risk (Ale and Whithouse, 1986, 1990, 1992), a modelling approach for occupational risk had to be developed to support the specification and deployment of such a policy. In order to develop such a method a consortium of organisations was formed. The members of the consortium were previously involved in other efforts for SZW to improve the understanding of safety in the workplace and safety management systems (Ale et al., 1998; Bellamy et al., 1999; Papazoglou et al., 1999, 2003). Based on this previous work and work done for the Health and Safety Executive in the past (Bellamy and Geyer, 1992; Papazoglou et al., 2000) a system is developed to perform the needed quantification and optimisation, the occupational risk model (ORM).
2. Occupational risk The quantification of occupational risk is approached in a similar fashion as the approach taken when calculating the risk of a chemical plant (Ale and Uijtdehaag, 1999). The risk profile of a chemical plant is constructed from the risks of its components: vessels, pipes, reactors etc. The risk of a job is constructed from the risks associated with the hazards a worker has to face when he or she performs his job. For example a fisherman is exposed to the risks of a fall overboard, entanglement in nets, being crushed between moving objects, cuts from handling catch or fishing tackle and cleaning fish (EASHW, 2003; Murray and Dolomont, 1994). To this end the jobs or job-profiles in the Netherlands were decomposed according to the accident statistics in the Netherlands ‘‘GISAI”. GISAI is the ‘‘Gezamenlijk Informatie Systeem Arbeids Inspectie” (SZW, 1997), in which among other things, the reports of the inspectors on investigations into occupational accidents are kept. From these records a list of hazards or causes of accidents could be derived. This list is partly based on a classification of accident types used by the Labour Inspectorate in their reporting on occupational accidents (ESAW, 2002), classifications form the UK (HSE, 1995) and from previous Dutch studies (Swuste and Hale, 1993). This list is shown in Table 1. Accidents are assigned to the class of the hazard that caused the injury. In case of a complicated accident such as a fall (class 1) followed by a drowning (23), the Storybuilder allows transfer points to be included in the Storybuild from one class to another. The ‘‘fall” accident would then have no victims, as the victims will be assigned to the drowning. Double counting is avoided by a coding mechanism
178
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
inside the Storybuilds, which will ensure that the complicated accidents are treated as one whenever appropriate. By analysing the accident database on the relation between accidents and occupation a database could be derived linking activities – such as cleaning fish or loading a tank – with these hazards. In addition confidential accident data from Denmark were used to enhance this list. The list linking activities and hazards are used to construct the risk profile of a job or jobtitle. Each jobtitle is constructed on the basis of the activities associated with that job. For instance a mason has to climb ladders, work on scaffolds, carry bricks, use tools, be in the neighbourhood of cranes etc. This however is not sufficient to derive optimal risk reduction strategies later. Whether or not a particular activity – such as using a chain saw – is particularly dangerous does not make it a high priority item in itself. The contribution to the overall risk of a job is also determined by the exposure to each of the hazards. Through the activities and hazard list the risk profile for this job-title is constructed by adding the exposures to each of the associated hazards for a full year of employment. This means among other things that two ‘‘real” human beings who share a single job-position each for half of the time – two half-times thus – are considered to have ONE JOB. This means that to translate the risk of a job title to the risk of a person, the risk has to be weighted according to the time spent on the job or jobs that the person occupies. The exposure can either be the number of missions undertaken per unit time or the duration of a certain activity. Which one is used depends on the nature of the activity and the nature of the risk. In some cases – such as going up and down a ladder – the risk is determined by the number of times this is done: i.e., the number of missions. In other cases – such as walking up and down a hospital corridor as a nurse – is associated with the time spent doing this. The resulting list of activities, hazards and exposures form the inventory of risks for this job profile. Exposure data are derived from nationwide surveys on activities associated with jobs and using data from the Danish Labour inspectorate (see Bengtsson, 2001). This will be described in a separate paper. The risk of an entire company can then be constructed by combining the risks of the job titles in the company rated according to the number of job positions with that title (Figs. 1 and 5). The resulting risk could be expressed in a large range of possible metrics. An obvious example is the probability of being killed. But other constituents of the risk profile could be expressed as the probability of having an injury leading to one day hospitalisation, two days, three days, etc. The data however do not allow to depict such a detailed picture and therefore risk is expressed according to the classification used when data are introduced in GISAI. There only three sorts of consequences are distinguished: Death, permanent injury and repairable injury. Thus the desired final result is an expression of risk in terms of the expected frequency of being killed, permanently injured of reversibly injured per unit time (see Fig. 2). There is however a problem with these expressions. By inspecting the database and comparing the entries in the database with other sources it has to be concluded that there is a considerable underreporting of non lethal accidents. In addition, occasionally there are accidents reported that should not have been reported according to the specifications in the law. Therefore the risk calculated on the basis of these data is the expected frequency of having an accident reported resulting in either death, permanent injury or reversible injury. 3. Building accident scenarios Using the list of hazard types as a starting point, the scenarios are systematically analysed into the chain linking cause with consequences. For this purpose the Storybuilder was developed. Storybuilder is part of the ORM software that organises the inspectors’ reports around single centre events, which are the materialisation of the hazards from the hazard list. Thus a storybuild is constructed for falling from ladders, falling from scaffolds, being hit by falling object etc. The stories are developed according to strict building rules. Record is kept of all the steps taken in the analysis. Later it will be possible to revisit the analysis and find the reasons for having the story depicted as it is. The full procedure is explained by Bellamy et al. (2006), Bellamy et al. (2007). The Storybuilds developed for this project can be found on the internet.1
1
See www.storybuilder.eu.
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
179
Table 1 The hazard list 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
Falls Struck by moving vehicle Contact with falling/dropped/collapsing object /person/wall/vehicle/crane which is falling under gravity Contact with flying object = missile Hit by rolling/sliding object or person Contact with object person (self or other) is carrying or using Contact with hand held tools operated by self Contact with moving parts Moving person strikes against something Buried/suffocated In or on moving vehicle which has loss of control Contact with electricity Contact with extreme hot or cold surfaces or open flame Exposure to hazardous substances in open container Loss Of Containment of hazardous substance (active) from normally closed containments LOC hazardous substances (passive) Fire Exposure to damaging noise dose Exposure to damaging non-ionising radiation dose Victim of human aggression or animal behaviour Trapped in hazardous space Deprived of oxygen supply Lost buoyancy in water or other liquid in which the person is in due to the activity Too rapid decompression Extreme muscular exertion Office risk (standard) Explosions
Data currently available for the period 1998–2004 cover just over 22,000 accident reports, of which 7400 have both prosecution and accident reports and a further 5300 have only accident reports. The remaining 10,000 consist only of the short descriptions. Accidents which are directly reportable under the Dutch law are those causing death, permanent injury (or the reasonable expectation that injury will be permanent) or treatment of the patient in hospital. In 80% of the 10,000 with only an initial report, the accident turned out not to fall within one of these categories, in other words it was a more minor accident. In the Dutch database the number of falls from height is the largest category and of these falls from ladders is the largest subcategory with over 1000 instances. Therefore these accidents were used as the basis to develop the methodology and tools and to verify the correct workings of the tools before progressing to analyzing all the available data. The storybuilds already give information about the make-up of the accidents and about the distribution of causes and causal chains given that an accident of a certain type occurs. The way this is done is closely related to the way the risks are logically modelled. Therefore this is described first. 4. The Bow-tie There are several ways to link causes and consequences of a single accident-type. The relationship between an accident and its possible causes is often given as a fault tree. The relationship between an accident and its potential consequences is often depicted as an event tree. If one couples these tree at the accident a Bow-tie shaped diagram results. This converging and diverging shape is also used in depicting more fuzzy relationships of cause and consequences in influence diagrams. This structure has proven a valuable concept in analysing past accidents (Hale et al., 2005; Visser, 1998). The structure allows us to think of measures to prevent accidents in terms of barriers in the causal chain. In order to make quantification possible the structure of the accidents obtained in the scenario analysis, and information about the exposure is combined into a simplified structure, which is suitable for quantification.
180
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
Hazard Activity 1 Activity 2 ….. Job
Job
CE
CE
Hazard Job
Hazard
CE
Job
Company Fig. 1. Company, jobs, hazards and Bow-ties.
Activity nr 1 2 3 4 5 6
Time or nr of missions
CE
Σ
CE
CE
…….
No risk
RISK Jobprofile Fig. 2. Job profile, exposure, Bow-tie and risk.
In this structure two layers are distinguished in the chain of events leading from an exposure to an accident: primary safety barriers (PSB) and support safety barriers (SSB). The conditional probability of a PSB to fail, leading to the accident, is determined by the state of the SSB’s, which can be either appropriate (not-failed) or not appropriate (not failed). It is noted that in the ORM, barriers are inappropriate or not appropriate states rather than failed or not failed, because it is rarely unambiguous what failed in this context really means. The probability of a fall on an – even – surface is among other dependent on whether there is debris on the floor. To state that a floor with some debris on it is ‘‘failed” to be clean is cumbersome at least. An example of a logical diagram, block diagram or Bow-tie is given in Fig. 3. This is the Bow-tie for one of the modes of exposure to chemicals, in this case without loss of containment. The SSB’s also form the points where the safety management systems attach to the logical structure. The model for the safety management system is a further development of a model used in the analysis of loss of containment accidents (Bellamy and Geyer, 1992) and in the IRISK (Bellamy et al., 1999; Papazoglou et al., 2003) and AVRIM (Bellamy and Brouwer, 1999; Bellamy and van der Schaaf, 1999; Oh and Bellamy, 1998) projects. This system works by maintaining the integrity of the safety support barriers. The ‘‘state” of the safety management system can also be appropriate or not appropriate depending on the state of the constituent parts. These are the eight management influences – procedures, equipment, ergonomics, availability, competence, communication, motivation,. conflict resolution – distinguished in the management model that
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
181
Fig. 3. Bow-tie for exposure to chemicals.
influence the state of the barriers through the tasks of providing, using, maintaining and monitoring the barriers. The relationship between the constituents of the management model and the barrier states is modelled by weighting of their influence. For instance certain safety features cannot be used if they are not provided. On the other hand they can be used without monitoring, but in that case the feature will fail at some point in the future.
182
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
Also for PUMM DELIVERIES Procedures Equipment Ergonomics Availability Competence Communication Motivation ConflictConflictresolution
% of paths = max reduction
TASKS Provide Use Maintain Monitor
BFE BFM LCE BFE BFM P+cond (SSB = +) Change % + state
Measure
SSB PSB
CE
SSB
Fig. 4. From storybuild to Bow-tie.
As GISAI only contains data on reportable accidents, additional information is needed on the total workforce. Amongst other things, this information concerns the number of times certain activities are undertaken and to what extent safety measures that are required by rules and regulations or that could otherwise be envisaged, exist in the workplace. This will allow the comparison of the population of those who have had an accident with those who have not. This provides the data necessary to compare a particular situation with the national average and to calculate the associated risk. To assemble these data, surveys representative of the whole or a selected part of the Dutch workforce are carried out. In addition the data do mainly give information on the state of the barriers that failed and were thought to be relevant for the accident by the inspector. This means that the state of the other barriers has to be inferred from the available information. The Bowtiebuilder is the tool developed to construct the Bow-tie and to set up the relationships between the blocks in the Bow-tie by specifying the equations. Bow-tie builder then is used to quantify the risk on the Bow-tie level on the basis of input supplied by the user of the ORM. In order to be able to link the Bow-ties with the Storybuilds, the structure of the scenario analyses is shaped in the form of a barrier analysis. These barriers include things which Johnson (1973) in the MORT approach calls ‘controls’; that is to say things which are necessary for the primary function of the system or equipment. They are not additional measures taken only for safety (which MORT calls ‘barriers’), such as special non-slip feet added to the bottom of a ladder. We have not retained the MORT distinction, since it is often very arbitrary what can be considered necessary for the primary purpose and what is ’purely’ for safety. However, we do want to emphasise that some characteristics necessary for the normal functioning have an important safety function as well. So wherever in the analysis a function fails, this is formulated and described as a barrier failure mode (BFM), which links to an inappropriate state of a block or barrier in the Bow-tie (Fig. 4). The data for the accidents in the top of the diagram are developed in the WORM project. A pre-selection of possible measures and their costs are provided with the ORM. Company specific information will have to be provided by the user of the model, as they depend on the particular situation in a company.
5. Risk reduction Risk can be reduced by taking measures. Measures influence the risk and this is reflected in a change in the probabilities of blocks in the logical diagram to be in one of their states. The smallest possible unit of change
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
183
in the total risk picture of a company, which can consist of many job-titles, which in turn can consist of many activities associated with many Bow-ties, influences only ONE block in ONE Bow-tie. This ‘‘atom” of risk influence is called a probability influencing entity or PIE. Measures can result from rules and regulations in which they usually consist of improved compliance. Measures can also be technical. In most instances they ultimately need improvements in the management influences, such as improvement of competence or motivation of personnel. Measures and Pies in ORM are defined by two parameters: the effect on probability and the associated costs. The baseline risk for a job is obtained by using data from the Storybuilds and from the User Survey when quantifying the risk. These data among other things comprise the average exposure to certain hazards for the jobs in companies according to a classification code and the resulting accident rates that follow from the historical record. In specific situations the exposure to hazardous activities may differ from the average and therefore the ORM-User at company level will be presented with a number of questions similar to those in the Survey. If he chooses to answer these the exposure profile and related parameters will be adapted to his particular circumstances. Similarly the base case for the level of implementation of safety and other measures will be initially set to the average as obtained by the User Survey. Again the ORM user will be asked to specify the level of implementation for his specific situation. These will be his starting position in the optimization process. Establishing this base correctly is important as the effect of potential additional measures depend on the existing level of implementation. The less risk there is to reduce, the higher the marginal costs of further risk reduction. 6. The optimiser The optimiser combines the information on the Dutch national average, the information supplied by the user on his specific situation and the information on PIEs – probability effect and cost – to seek out the optimal combinations for risk reduction. In doing so it evaluates an efficient frontier of possible strategies, from which the user can choose a combination of cost and risk according to his needs. The optimizer is based on the work of Papazoglou et al. (2000) performed in earlier projects. The three constituents: story builder, Bow-tie builder, optimiser together form the ORM. This is depicted in Fig. 5 (Ale, 2006).
Accident data
Story Builder
Scenarios
Bowtie Builder
Bowties and Barrieres
Norms Standards Regulations
Exposure
Probabilities
Management Factors
Optimizer
Cost
Fig. 5. The basic ORM components.
Optimal Risk reduction
184
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
7. Conclusions The occupational risk model is a further development of quantification techniques. It is developed for use by enterprises and governments in developing strategies to further reduce occupational risk. The main elements of the ORM follow the structured decisions that are made by safety experts and safety managers. The development of the ORM leads to clarification of a number of issues that are usually implicit in the decision making. Further elaboration of the constituents and on the results is given in other papers at this conference. Acknowledgement The work described in this paper was fully funded by the ministry of Social Affairs and Employment of the Netherlands. References Ale, B.J.M., 1987. Quantitative risk analysis and reducing the risk. In: Conference on environmental technology, June, Amsterdam. Ale, B.J.M., 1990. Analisis y politica de riesgos en los Paises Bajos. Accidentes Majores, IBC/MAPFRE, Madrid. Ale, B.J.M., 1991. Risk analysis and risk policy in the Netherlands and the EEC. J. Loss Prev. Process Ind. 4. Ale, B.J.M., 1992. The implementation of an External Safety Policy in the Netherlands. In: Proceedings of the International Conference on Hazard Identification and Risk Analysis, Human Factors and Human Reliability in Process Safety, Juan 15–17, pp. 173–184, Orland, Florida, ISBN 0-8169-0558-4. Ale, B.J.M., 2002. Risk assessment practices in the Netherlands. Safety Science, 0925-7535 40, 105–126. Ale, B.J.M., 2006. The occupational risk model. TU-Delft/TBM RC 20060731, ISBN 90-5638-157-1, Delft, 2006. Ale, B.J.M., Uijtdehaag, P.A.M., 1999. Guidelines for quantitative risk analysis (CPR18E) RIVM, SDU, Den Haag, ISBN 90-12-08796-1. Ale, B.J.M., Whitehouse, R., 1986. A computer based system for risk analysis of process plants. In: Hartwig, S. (Ed.), Heavy Gas and Risk Assessment III. D. Reidel, Dordrecht, The Netherlands, November 1984. Ale, B.J.M., Post, J.G., Bellamy, L.J., 1998. The interface between the technical and the management model for use in quantified risk analysis. In: Mosleh, A., Bari, R.A. (Eds.), Probabilistic Safety Assessment and Management, Vol. 3. Springer, 1998, pp. 2087–2092, Proceedings of the 4th International Conference on PSAM 4 at New York City, USA, September 13–18, 1998. Arbeidsinspectie (Labour Inspectorate). 2002. Naar een risicomodel arbeidsongevallen (Towards a risk model for occupational accidents). Ministry of Social Affairs & Employment, Labour Inspectorate, The Hague. Bellamy, L.J., Brouwer, W.G.J., 1999. AVRIM2, a Dutch major hazard assessment and inspection tool. Journal of Hazardous Materials 65, 191–210. Bellamy, L.J., Geyer, T.A.W., 1992. Organisational, Management and Human Factors in Quantified Risk Assessment – Report 1 – HSE Contract Research Report 33/92. Bellamy, L.J., van der Schaaf, J., 1999. Major hazard management: technical–management links and the AVRIM2 method. SEVESO 2000. In: European Conference Risk Management in the European Union of 2000, The Challenge of Implementing Council Directive, ‘‘Seveso II”, Chamber of Commerce and Industry of Athens, Athens, Greece, November 10–12, 1999. Bellamy, L.J., Oh, J.I.H., Hale, A.R., Papazoglou, I.A., Ale, B.J.M., Morris, M., Aneziris, O., Post, J.G., Walker, H., Brouwer, W.G.J., Muyselaar, A.J., 1999. IRISK, development of an integrated technical and management risk control and monitoring methodology for managing on-site and off-site risks. EC contract report ENV4-CT96-0243 (D612-D). Bellamy, Linda J., Ale, Ben J.M., Baksteen, Hans, Hale, Andrew R., Mud, Martijn L., Oh, J.I.H., Papazoglou, Ioannis A., Whiston, Julius Y., 2006. Storybuilder: the new interface for accident analysis. In: Proceedings of Probabilistic Safety Analysis and Management (PSAM8), New Orleans 14–19 May 2006, ASME, New York. Bellamy, L.J., Ale, B.J.M., Geyer, T.A.W., Goossens, L.H.J., Hale, A.R., Oh, J., Mud, M., Bloemhof, A., Papazoglou, I.A., Whiston, J.Y., 2007. Storybuilder – A tool for the analysis of accident reports. Reliability Engineering & System Safety 92 (6), 735–744. Bengtsson, B., 2001. ISA – the Swedish information system for occupational accidents and work-related diseases – scope, content and quality. Swedish Work Environment Authority Central Supervision Department Statistics Division January. EASHW, 2003. European agency for safety and health at work. FACTS 38, Risk Assessment for Small Fishing Vessels, ISSN1681 2123. ESAW, 2002. European statistics on accidents at work (ESAW) – Methodology – 2001 Edition, ISBN 92-894-3228-4 (EN).. Gorter, A., 1889. De Fabriekswet van 2 Juni 1875 en hare toepassing bij hooger beroep. Bijdrage tot de kennis der rechtspraak op nijverheidsgebied. ’s-Gravenhage 1889, p. 75. Ex-bibliotheca Tweede Kamer (#22295). Hale, A.R., Guldenmund, F.W., Goossens, L.H.J., Karczewski, J., Duijm, N.J. , Hourtoulou, D., LeCoze, J.-C., Plot, E., Prats, F., Kontic, B., Kontic, D., Gerbec, M., 2005. Management influences on major hazard prevention: the ARAMIS audit. ESREL 2005, GDANSK, June 2005. HSE, 1995. A guide to the reporting of injuries, diseases, and dangerous occurrences regulations. (L73) ISBN 0-7176-1012-8. Available from HSE Books, P.O. Box 1999, Sudbury, Suffolk CO10 6FS. Tel.: 01787 881165, fax: 01787 313995.
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
185
Johnson, W.G., 1973. MORT – the management oversight and risk tree. ERDA SAN 821-2, Idaho Falls. Jongejan, R.B., Ale, B.J.M., Vrijling, J.K., 2006. FN-criteria for risk regulation and probabilistic design. In: Proceedings of Probabilistic Safety Analysis and Management (PSAM8), New Orleans, 14–19 May 2006, ASME, New York. Murray, M., Dolomont, M., 1994. Accidents in the Fisheries.
Safety Science 46 (2008) 176–185 www.elsevier.com/locate/ssci
Quantifying occupational risk: The development of an occupational risk model B.J.M. Ale a,*, H. Baksteen b, L.J. Bellamy c, A. Bloemhof d, L. Goossens a, A. Hale a, M.L. Mud e, J.I.H. Oh f, I.A. Papazoglou g, J. Post b, J.Y. Whiston h b
a TU Delft, Safety Science Group, PB 5015, 2600 GA Delft, Netherlands National Institute for Public Health and the Environment (RIVM), P.O. Box 1, 3720 BA, Bilthoven, Netherlands c WhiteQueen, P.O. Box 712, 2130 AS, Hoofddorp, Netherlands d Consumer Safety Institute, P.O. Box 75169, 1059 GK, Amsterdam, Netherlands e Abbott Risk Consulting, The Hague, Netherlands f Ministry of Social Affairs and Employment, P.O. Box 90801, 2509 LV, The Hague, Netherlands g National Center ‘‘Demokritos”, Aghia Paraskevi 15310, Greece h Whiston Computing, 32 Brookers Court, Off Baldwin Gardens, London EC1N 7RR, UK
Received 23 March 2006; received in revised form 10 December 2006; accepted 21 February 2007
Abstract Each year eighty-five people are killed on the job in the Netherlands and 167,000 are injured to the extent that they are at least a day absent from work. Their death and injuries occur during the approximately seven million person years that the Dutch workforce spend on their job. The ministry of Social Affairs and Employment (SZW) has as one of its main tasks to reduce and control occupational risk. Recently it commissioned a project to determine the risk and its causes following the same principles as used in quantified analyses of the third party risks of nuclear and chemical plants. To this end a model has been constructed: the occupational risk model (ORM). With this model authorities, industries and experts can evaluate the occupational risks for individual workers, for companies and for projects. The project has four major parts: assembly and analysis of accident and exposure data, generalisation of these data into a logical risk model, deriving improvement measures and their costs and developing an optimiser that supports cost effective risk reduction strategies. The model is a further development of previous work executed with support of SZW and the European Union, such as IRISK and AVRIM. This paper describes the concepts used in the model and the overall structure. Some of the results are also given. More detail and more results are given in other papers in this conference. Ó 2007 Elsevier Ltd. All rights reserved. Keyword: Occupational risk
*
Corresponding author. Tel.: +31 15 2786353; fax: +31 15 2783177. E-mail address: [email protected] (B.J.M. Ale).
0925-7535/$ - see front matter Ó 2007 Elsevier Ltd. All rights reserved. doi:10.1016/j.ssci.2007.02.001
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
177
1. Introduction In the Netherlands occupational health and safety is the concern of the ministry of Social Affairs and Employment (SZW). This ministry has developed and executed many programs to reduce these risks ever since the Fabriekswet (Factory Act) came into force in 1875 (Gorter, 1889). The reduction of human suffering that results from occupational accidents was the main reason for these concerns. In the era of market economy however the economic loss in the form of absence from work, reduced family income and medical cost is a significant secondary issue that supports the drive towards reduced risk (Arbeidsinspectie, 2002). Dutch parliament now demands that prioritising of measures is judged on the basis of cost effectiveness. This defined the context and boundary conditions of the project (SZW, 2004). SZW’s policies used to consist of the traditional ingredients of governmental action: legislation, regulation, standards, supervision and – if necessary – prosecution and punishment. A more modern approach is to have workers and industries develop and maintain their own safety policies and safety management systems. The idea is that companies take care of their workers, providing a safe and healthy working environment. By putting the costs of safety and of accidents back to the employer, economic forces will make safety management systems in companies work correctly and guarantee a more acceptable – cost effective – level of risk. Interestingly this was also the idea behind the Fabriekswet of 1875 mentioned earlier, and regulations and laws passed since were deemed to be necessary to repair the shortcomings of the market. The Fabriekswet specified that occupational safety in principle is a matter between workers and their employer. The task of the government is to create a level playing field by setting boundary conditions. SZW seeks to shape their current policy along the lines of current policies regarding third party risks (Ale, 1987, 1991, 2002; NN, 1988, 2004). The components of this policy are quantitative analysis of risk, determination of dominant paths to accidents from these quantifications and analysis of underlying scenarios and reduction of risk by addressing the dominant threats first and by using the most cost effective method of risk reduction (Jongejan et al., 2006). Just as was done in the early 1980s for third party risk (Ale and Whithouse, 1986, 1990, 1992), a modelling approach for occupational risk had to be developed to support the specification and deployment of such a policy. In order to develop such a method a consortium of organisations was formed. The members of the consortium were previously involved in other efforts for SZW to improve the understanding of safety in the workplace and safety management systems (Ale et al., 1998; Bellamy et al., 1999; Papazoglou et al., 1999, 2003). Based on this previous work and work done for the Health and Safety Executive in the past (Bellamy and Geyer, 1992; Papazoglou et al., 2000) a system is developed to perform the needed quantification and optimisation, the occupational risk model (ORM).
2. Occupational risk The quantification of occupational risk is approached in a similar fashion as the approach taken when calculating the risk of a chemical plant (Ale and Uijtdehaag, 1999). The risk profile of a chemical plant is constructed from the risks of its components: vessels, pipes, reactors etc. The risk of a job is constructed from the risks associated with the hazards a worker has to face when he or she performs his job. For example a fisherman is exposed to the risks of a fall overboard, entanglement in nets, being crushed between moving objects, cuts from handling catch or fishing tackle and cleaning fish (EASHW, 2003; Murray and Dolomont, 1994). To this end the jobs or job-profiles in the Netherlands were decomposed according to the accident statistics in the Netherlands ‘‘GISAI”. GISAI is the ‘‘Gezamenlijk Informatie Systeem Arbeids Inspectie” (SZW, 1997), in which among other things, the reports of the inspectors on investigations into occupational accidents are kept. From these records a list of hazards or causes of accidents could be derived. This list is partly based on a classification of accident types used by the Labour Inspectorate in their reporting on occupational accidents (ESAW, 2002), classifications form the UK (HSE, 1995) and from previous Dutch studies (Swuste and Hale, 1993). This list is shown in Table 1. Accidents are assigned to the class of the hazard that caused the injury. In case of a complicated accident such as a fall (class 1) followed by a drowning (23), the Storybuilder allows transfer points to be included in the Storybuild from one class to another. The ‘‘fall” accident would then have no victims, as the victims will be assigned to the drowning. Double counting is avoided by a coding mechanism
178
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
inside the Storybuilds, which will ensure that the complicated accidents are treated as one whenever appropriate. By analysing the accident database on the relation between accidents and occupation a database could be derived linking activities – such as cleaning fish or loading a tank – with these hazards. In addition confidential accident data from Denmark were used to enhance this list. The list linking activities and hazards are used to construct the risk profile of a job or jobtitle. Each jobtitle is constructed on the basis of the activities associated with that job. For instance a mason has to climb ladders, work on scaffolds, carry bricks, use tools, be in the neighbourhood of cranes etc. This however is not sufficient to derive optimal risk reduction strategies later. Whether or not a particular activity – such as using a chain saw – is particularly dangerous does not make it a high priority item in itself. The contribution to the overall risk of a job is also determined by the exposure to each of the hazards. Through the activities and hazard list the risk profile for this job-title is constructed by adding the exposures to each of the associated hazards for a full year of employment. This means among other things that two ‘‘real” human beings who share a single job-position each for half of the time – two half-times thus – are considered to have ONE JOB. This means that to translate the risk of a job title to the risk of a person, the risk has to be weighted according to the time spent on the job or jobs that the person occupies. The exposure can either be the number of missions undertaken per unit time or the duration of a certain activity. Which one is used depends on the nature of the activity and the nature of the risk. In some cases – such as going up and down a ladder – the risk is determined by the number of times this is done: i.e., the number of missions. In other cases – such as walking up and down a hospital corridor as a nurse – is associated with the time spent doing this. The resulting list of activities, hazards and exposures form the inventory of risks for this job profile. Exposure data are derived from nationwide surveys on activities associated with jobs and using data from the Danish Labour inspectorate (see Bengtsson, 2001). This will be described in a separate paper. The risk of an entire company can then be constructed by combining the risks of the job titles in the company rated according to the number of job positions with that title (Figs. 1 and 5). The resulting risk could be expressed in a large range of possible metrics. An obvious example is the probability of being killed. But other constituents of the risk profile could be expressed as the probability of having an injury leading to one day hospitalisation, two days, three days, etc. The data however do not allow to depict such a detailed picture and therefore risk is expressed according to the classification used when data are introduced in GISAI. There only three sorts of consequences are distinguished: Death, permanent injury and repairable injury. Thus the desired final result is an expression of risk in terms of the expected frequency of being killed, permanently injured of reversibly injured per unit time (see Fig. 2). There is however a problem with these expressions. By inspecting the database and comparing the entries in the database with other sources it has to be concluded that there is a considerable underreporting of non lethal accidents. In addition, occasionally there are accidents reported that should not have been reported according to the specifications in the law. Therefore the risk calculated on the basis of these data is the expected frequency of having an accident reported resulting in either death, permanent injury or reversible injury. 3. Building accident scenarios Using the list of hazard types as a starting point, the scenarios are systematically analysed into the chain linking cause with consequences. For this purpose the Storybuilder was developed. Storybuilder is part of the ORM software that organises the inspectors’ reports around single centre events, which are the materialisation of the hazards from the hazard list. Thus a storybuild is constructed for falling from ladders, falling from scaffolds, being hit by falling object etc. The stories are developed according to strict building rules. Record is kept of all the steps taken in the analysis. Later it will be possible to revisit the analysis and find the reasons for having the story depicted as it is. The full procedure is explained by Bellamy et al. (2006), Bellamy et al. (2007). The Storybuilds developed for this project can be found on the internet.1
1
See www.storybuilder.eu.
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
179
Table 1 The hazard list 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
Falls Struck by moving vehicle Contact with falling/dropped/collapsing object /person/wall/vehicle/crane which is falling under gravity Contact with flying object = missile Hit by rolling/sliding object or person Contact with object person (self or other) is carrying or using Contact with hand held tools operated by self Contact with moving parts Moving person strikes against something Buried/suffocated In or on moving vehicle which has loss of control Contact with electricity Contact with extreme hot or cold surfaces or open flame Exposure to hazardous substances in open container Loss Of Containment of hazardous substance (active) from normally closed containments LOC hazardous substances (passive) Fire Exposure to damaging noise dose Exposure to damaging non-ionising radiation dose Victim of human aggression or animal behaviour Trapped in hazardous space Deprived of oxygen supply Lost buoyancy in water or other liquid in which the person is in due to the activity Too rapid decompression Extreme muscular exertion Office risk (standard) Explosions
Data currently available for the period 1998–2004 cover just over 22,000 accident reports, of which 7400 have both prosecution and accident reports and a further 5300 have only accident reports. The remaining 10,000 consist only of the short descriptions. Accidents which are directly reportable under the Dutch law are those causing death, permanent injury (or the reasonable expectation that injury will be permanent) or treatment of the patient in hospital. In 80% of the 10,000 with only an initial report, the accident turned out not to fall within one of these categories, in other words it was a more minor accident. In the Dutch database the number of falls from height is the largest category and of these falls from ladders is the largest subcategory with over 1000 instances. Therefore these accidents were used as the basis to develop the methodology and tools and to verify the correct workings of the tools before progressing to analyzing all the available data. The storybuilds already give information about the make-up of the accidents and about the distribution of causes and causal chains given that an accident of a certain type occurs. The way this is done is closely related to the way the risks are logically modelled. Therefore this is described first. 4. The Bow-tie There are several ways to link causes and consequences of a single accident-type. The relationship between an accident and its possible causes is often given as a fault tree. The relationship between an accident and its potential consequences is often depicted as an event tree. If one couples these tree at the accident a Bow-tie shaped diagram results. This converging and diverging shape is also used in depicting more fuzzy relationships of cause and consequences in influence diagrams. This structure has proven a valuable concept in analysing past accidents (Hale et al., 2005; Visser, 1998). The structure allows us to think of measures to prevent accidents in terms of barriers in the causal chain. In order to make quantification possible the structure of the accidents obtained in the scenario analysis, and information about the exposure is combined into a simplified structure, which is suitable for quantification.
180
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
Hazard Activity 1 Activity 2 ….. Job
Job
CE
CE
Hazard Job
Hazard
CE
Job
Company Fig. 1. Company, jobs, hazards and Bow-ties.
Activity nr 1 2 3 4 5 6
Time or nr of missions
CE
Σ
CE
CE
…….
No risk
RISK Jobprofile Fig. 2. Job profile, exposure, Bow-tie and risk.
In this structure two layers are distinguished in the chain of events leading from an exposure to an accident: primary safety barriers (PSB) and support safety barriers (SSB). The conditional probability of a PSB to fail, leading to the accident, is determined by the state of the SSB’s, which can be either appropriate (not-failed) or not appropriate (not failed). It is noted that in the ORM, barriers are inappropriate or not appropriate states rather than failed or not failed, because it is rarely unambiguous what failed in this context really means. The probability of a fall on an – even – surface is among other dependent on whether there is debris on the floor. To state that a floor with some debris on it is ‘‘failed” to be clean is cumbersome at least. An example of a logical diagram, block diagram or Bow-tie is given in Fig. 3. This is the Bow-tie for one of the modes of exposure to chemicals, in this case without loss of containment. The SSB’s also form the points where the safety management systems attach to the logical structure. The model for the safety management system is a further development of a model used in the analysis of loss of containment accidents (Bellamy and Geyer, 1992) and in the IRISK (Bellamy et al., 1999; Papazoglou et al., 2003) and AVRIM (Bellamy and Brouwer, 1999; Bellamy and van der Schaaf, 1999; Oh and Bellamy, 1998) projects. This system works by maintaining the integrity of the safety support barriers. The ‘‘state” of the safety management system can also be appropriate or not appropriate depending on the state of the constituent parts. These are the eight management influences – procedures, equipment, ergonomics, availability, competence, communication, motivation,. conflict resolution – distinguished in the management model that
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
181
Fig. 3. Bow-tie for exposure to chemicals.
influence the state of the barriers through the tasks of providing, using, maintaining and monitoring the barriers. The relationship between the constituents of the management model and the barrier states is modelled by weighting of their influence. For instance certain safety features cannot be used if they are not provided. On the other hand they can be used without monitoring, but in that case the feature will fail at some point in the future.
182
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
Also for PUMM DELIVERIES Procedures Equipment Ergonomics Availability Competence Communication Motivation ConflictConflictresolution
% of paths = max reduction
TASKS Provide Use Maintain Monitor
BFE BFM LCE BFE BFM P+cond (SSB = +) Change % + state
Measure
SSB PSB
CE
SSB
Fig. 4. From storybuild to Bow-tie.
As GISAI only contains data on reportable accidents, additional information is needed on the total workforce. Amongst other things, this information concerns the number of times certain activities are undertaken and to what extent safety measures that are required by rules and regulations or that could otherwise be envisaged, exist in the workplace. This will allow the comparison of the population of those who have had an accident with those who have not. This provides the data necessary to compare a particular situation with the national average and to calculate the associated risk. To assemble these data, surveys representative of the whole or a selected part of the Dutch workforce are carried out. In addition the data do mainly give information on the state of the barriers that failed and were thought to be relevant for the accident by the inspector. This means that the state of the other barriers has to be inferred from the available information. The Bowtiebuilder is the tool developed to construct the Bow-tie and to set up the relationships between the blocks in the Bow-tie by specifying the equations. Bow-tie builder then is used to quantify the risk on the Bow-tie level on the basis of input supplied by the user of the ORM. In order to be able to link the Bow-ties with the Storybuilds, the structure of the scenario analyses is shaped in the form of a barrier analysis. These barriers include things which Johnson (1973) in the MORT approach calls ‘controls’; that is to say things which are necessary for the primary function of the system or equipment. They are not additional measures taken only for safety (which MORT calls ‘barriers’), such as special non-slip feet added to the bottom of a ladder. We have not retained the MORT distinction, since it is often very arbitrary what can be considered necessary for the primary purpose and what is ’purely’ for safety. However, we do want to emphasise that some characteristics necessary for the normal functioning have an important safety function as well. So wherever in the analysis a function fails, this is formulated and described as a barrier failure mode (BFM), which links to an inappropriate state of a block or barrier in the Bow-tie (Fig. 4). The data for the accidents in the top of the diagram are developed in the WORM project. A pre-selection of possible measures and their costs are provided with the ORM. Company specific information will have to be provided by the user of the model, as they depend on the particular situation in a company.
5. Risk reduction Risk can be reduced by taking measures. Measures influence the risk and this is reflected in a change in the probabilities of blocks in the logical diagram to be in one of their states. The smallest possible unit of change
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
183
in the total risk picture of a company, which can consist of many job-titles, which in turn can consist of many activities associated with many Bow-ties, influences only ONE block in ONE Bow-tie. This ‘‘atom” of risk influence is called a probability influencing entity or PIE. Measures can result from rules and regulations in which they usually consist of improved compliance. Measures can also be technical. In most instances they ultimately need improvements in the management influences, such as improvement of competence or motivation of personnel. Measures and Pies in ORM are defined by two parameters: the effect on probability and the associated costs. The baseline risk for a job is obtained by using data from the Storybuilds and from the User Survey when quantifying the risk. These data among other things comprise the average exposure to certain hazards for the jobs in companies according to a classification code and the resulting accident rates that follow from the historical record. In specific situations the exposure to hazardous activities may differ from the average and therefore the ORM-User at company level will be presented with a number of questions similar to those in the Survey. If he chooses to answer these the exposure profile and related parameters will be adapted to his particular circumstances. Similarly the base case for the level of implementation of safety and other measures will be initially set to the average as obtained by the User Survey. Again the ORM user will be asked to specify the level of implementation for his specific situation. These will be his starting position in the optimization process. Establishing this base correctly is important as the effect of potential additional measures depend on the existing level of implementation. The less risk there is to reduce, the higher the marginal costs of further risk reduction. 6. The optimiser The optimiser combines the information on the Dutch national average, the information supplied by the user on his specific situation and the information on PIEs – probability effect and cost – to seek out the optimal combinations for risk reduction. In doing so it evaluates an efficient frontier of possible strategies, from which the user can choose a combination of cost and risk according to his needs. The optimizer is based on the work of Papazoglou et al. (2000) performed in earlier projects. The three constituents: story builder, Bow-tie builder, optimiser together form the ORM. This is depicted in Fig. 5 (Ale, 2006).
Accident data
Story Builder
Scenarios
Bowtie Builder
Bowties and Barrieres
Norms Standards Regulations
Exposure
Probabilities
Management Factors
Optimizer
Cost
Fig. 5. The basic ORM components.
Optimal Risk reduction
184
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
7. Conclusions The occupational risk model is a further development of quantification techniques. It is developed for use by enterprises and governments in developing strategies to further reduce occupational risk. The main elements of the ORM follow the structured decisions that are made by safety experts and safety managers. The development of the ORM leads to clarification of a number of issues that are usually implicit in the decision making. Further elaboration of the constituents and on the results is given in other papers at this conference. Acknowledgement The work described in this paper was fully funded by the ministry of Social Affairs and Employment of the Netherlands. References Ale, B.J.M., 1987. Quantitative risk analysis and reducing the risk. In: Conference on environmental technology, June, Amsterdam. Ale, B.J.M., 1990. Analisis y politica de riesgos en los Paises Bajos. Accidentes Majores, IBC/MAPFRE, Madrid. Ale, B.J.M., 1991. Risk analysis and risk policy in the Netherlands and the EEC. J. Loss Prev. Process Ind. 4. Ale, B.J.M., 1992. The implementation of an External Safety Policy in the Netherlands. In: Proceedings of the International Conference on Hazard Identification and Risk Analysis, Human Factors and Human Reliability in Process Safety, Juan 15–17, pp. 173–184, Orland, Florida, ISBN 0-8169-0558-4. Ale, B.J.M., 2002. Risk assessment practices in the Netherlands. Safety Science, 0925-7535 40, 105–126. Ale, B.J.M., 2006. The occupational risk model. TU-Delft/TBM RC 20060731, ISBN 90-5638-157-1, Delft, 2006. Ale, B.J.M., Uijtdehaag, P.A.M., 1999. Guidelines for quantitative risk analysis (CPR18E) RIVM, SDU, Den Haag, ISBN 90-12-08796-1. Ale, B.J.M., Whitehouse, R., 1986. A computer based system for risk analysis of process plants. In: Hartwig, S. (Ed.), Heavy Gas and Risk Assessment III. D. Reidel, Dordrecht, The Netherlands, November 1984. Ale, B.J.M., Post, J.G., Bellamy, L.J., 1998. The interface between the technical and the management model for use in quantified risk analysis. In: Mosleh, A., Bari, R.A. (Eds.), Probabilistic Safety Assessment and Management, Vol. 3. Springer, 1998, pp. 2087–2092, Proceedings of the 4th International Conference on PSAM 4 at New York City, USA, September 13–18, 1998. Arbeidsinspectie (Labour Inspectorate). 2002. Naar een risicomodel arbeidsongevallen (Towards a risk model for occupational accidents). Ministry of Social Affairs & Employment, Labour Inspectorate, The Hague. Bellamy, L.J., Brouwer, W.G.J., 1999. AVRIM2, a Dutch major hazard assessment and inspection tool. Journal of Hazardous Materials 65, 191–210. Bellamy, L.J., Geyer, T.A.W., 1992. Organisational, Management and Human Factors in Quantified Risk Assessment – Report 1 – HSE Contract Research Report 33/92. Bellamy, L.J., van der Schaaf, J., 1999. Major hazard management: technical–management links and the AVRIM2 method. SEVESO 2000. In: European Conference Risk Management in the European Union of 2000, The Challenge of Implementing Council Directive, ‘‘Seveso II”, Chamber of Commerce and Industry of Athens, Athens, Greece, November 10–12, 1999. Bellamy, L.J., Oh, J.I.H., Hale, A.R., Papazoglou, I.A., Ale, B.J.M., Morris, M., Aneziris, O., Post, J.G., Walker, H., Brouwer, W.G.J., Muyselaar, A.J., 1999. IRISK, development of an integrated technical and management risk control and monitoring methodology for managing on-site and off-site risks. EC contract report ENV4-CT96-0243 (D612-D). Bellamy, Linda J., Ale, Ben J.M., Baksteen, Hans, Hale, Andrew R., Mud, Martijn L., Oh, J.I.H., Papazoglou, Ioannis A., Whiston, Julius Y., 2006. Storybuilder: the new interface for accident analysis. In: Proceedings of Probabilistic Safety Analysis and Management (PSAM8), New Orleans 14–19 May 2006, ASME, New York. Bellamy, L.J., Ale, B.J.M., Geyer, T.A.W., Goossens, L.H.J., Hale, A.R., Oh, J., Mud, M., Bloemhof, A., Papazoglou, I.A., Whiston, J.Y., 2007. Storybuilder – A tool for the analysis of accident reports. Reliability Engineering & System Safety 92 (6), 735–744. Bengtsson, B., 2001. ISA – the Swedish information system for occupational accidents and work-related diseases – scope, content and quality. Swedish Work Environment Authority Central Supervision Department Statistics Division January. EASHW, 2003. European agency for safety and health at work. FACTS 38, Risk Assessment for Small Fishing Vessels, ISSN1681 2123. ESAW, 2002. European statistics on accidents at work (ESAW) – Methodology – 2001 Edition, ISBN 92-894-3228-4 (EN).
B.J.M. Ale et al. / Safety Science 46 (2008) 176–185
185
Johnson, W.G., 1973. MORT – the management oversight and risk tree. ERDA SAN 821-2, Idaho Falls. Jongejan, R.B., Ale, B.J.M., Vrijling, J.K., 2006. FN-criteria for risk regulation and probabilistic design. In: Proceedings of Probabilistic Safety Analysis and Management (PSAM8), New Orleans, 14–19 May 2006, ASME, New York. Murray, M., Dolomont, M., 1994. Accidents in the Fisheries.