ALARP and CBA all in the same game

Safety Science 76 (2015) 90–100

Contents lists available at ScienceDirect

Safety Science journal homepage: www.elsevier.com/locate/ssci

Review

ALARP and CBA all in the same game B.J.M. Ale a,⇑, D.N.D. Hartford b, D. Slater c a

Technical University Delft, PO Box 5015, 2600 GA Delft, The Netherlands BC Hydro, Vancouver, Canada c University of Cardiff, United Kingdom b

a r t i c l e

i n f o

Article history: Received 7 October 2014 Received in revised form 1 February 2015 Accepted 20 February 2015

Keywords: As Low As Reasonably Practicable Quantified risk analysis Cost Benefit Analysis Decision making

a b s t r a c t The concept of reducing risk As Low As Reasonably Practicable (ALARP) as presented by the UK Health and Safety Executive for the purpose of discharging its decision-taking responsibilities and the principle of balancing cost and benefits through monetary Cost Benefit Analysis (CBA) which is used more widely in health and safety decision-making seem to occupy the extremes of the decision making spectrum. ALARP seems on the qualitative, holistic, principles based side whereas CBA seems on the quantitative, limited, precisely defined side. These characteristics expose both principles to criticism. Application of the ALARP concept may to lead to different decisions in similar contexts resulting in uncertainty and unpredictability in decision making. CBA leads to decisions in which only money counts and all that cannot be expressed in money or is perceived of no monetary value is neglected. In this paper this issue is explored in more depth, and it is concluded that they are part of the general decision making process. The nature of the relevant safety laws and how they are applied frame the application of these concepts. If the level of acceptable risk is not explicitly set by law, the risk level resulting from compliance to the regulations is just as accidental as the Value of a Statistical Life (VOSL) found from ex post evaluations of decisions. ALARP, QRA and CBA are part of the grander scheme of making decisions. Throughout, the focus is on the principle rather than the practices of ALARP and CBA in reducing risk. Ó 2015 Elsevier Ltd. All rights reserved.

Contents 1. 2. 3. 4.

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ALARP and SFAIRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reasonability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cost Benefit Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1. The value of life. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2. Cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3. Safety budget. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4. Distribution of cost and benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5. Societal risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6. Values used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.7. CBA in decision making . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5. Multi criteria analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6. Optimisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7. Dams and the question ‘‘How safe is safe enough?’’ – A brief overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8. Fusing the extremes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9. The bottom line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

⇑ Corresponding author. E-mail address: [email protected] (B.J.M. Ale). http://dx.doi.org/10.1016/j.ssci.2015.02.012 0925-7535/Ó 2015 Elsevier Ltd. All rights reserved.

90 91 92 92 93 93 94 94 94 95 95 95 96 96 97 98 98

B.J.M. Ale et al. / Safety Science 76 (2015) 90–100

91

Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

1. Introduction The principle of As Low As Reasonably Practicable (ALARP) and the principle of balancing cost and benefits through monetary Cost Benefit Analysis (CBA) have been increasingly used by a diverse range of industries that cover the spectrum of industrial and public safety applications ranging from dams and levees, hazardous process industries, railways and even steep slopes in urban areas. In this regard, while the principle of balancing costs and benefits has a long history, the range of current applications of the ALARP principle, which may be used in conjunction with CBA, is considerably more diverse than the application for which the ALARP principle was originally formulated. These principles seem to occupy the extremes of the safety decision making spectrum. ALARP being on the qualitative, holistic, principles-based side does not necessarily lead to uniformly predictable outcomes, whereas CBA is on the quantitative, limited, precisely defined side. These characteristics expose both principles to criticism. Application of the ALARP process may to lead to different decisions in similar contexts resulting in uncertainty and unpredictability in decision making. CBA leads to decisions in which only money counts and all that cannot be expressed in money or is perceived of no monetary value is neglected. This paper explores this issue in more depth and concludes that ALARP and CBA are part of the general decision making process, even if they are identified as separate, individual, explicit steps.

2. ALARP and SFAIRP ALAP stands for As Low As Practicable. ALAP originated in the field of radiation protection in the US in the 1950s. In 1970 title 10 of the Code of Federal Regulation Parts 20 and 50 specified that exposure to radiation should be kept as far below the limits as was reasonably practicable. By 1970 the notion of limits, to be used also as reference, was part of the protection construct. In 1979 ALAP changed in to As Low AS Reasonably Achievable (ALARA) (Loewen, 2011). In radiation protection the ALARA principle is used as a ratchet mechanism to update – i.e. lower – the radiation exposure limits as a function of the developments in science and technology. When the limit technically can be set lower it will. Interestingly the terminology in the regulation does not require the limits to change as technology improves. It only requires that one operates as far below the limits as can be achieved. Apparently the updates of the limits are necessary to make enforcement of the required behaviour possible or easier. The principle that measures should be reasonable and practicable was already used earlier in the United Kingdom in the Electricity Regulations 1908 (Evans, 2008), in the Spinning by Self-acting Mules Regulations of 1905 reg 3 (Rothery, 2008) and in Section 5 of the Salmon Fishery Act 1861. Another early use was found in the Chaffing Machines Act 1897, the Threshing Machines Act 1878 (Bagnall, 2008) and the Alkali Act Amendment Act 1874, but before that appeared in the Leeds Act of 1848 (NN, 2014a,b,c): ‘‘But no person shall be subject to the foregoing penalties for any act done in the exercise of any right to which he is by law entitled, if he prove to the satisfaction of the court, before whom he is tried, that he has used the best practicable means, within a reasonable cost, to render harmless the liquid or solid matter so permitted to flow or to be put into waters’’.

The underpinnings of the term ALARP originates in the UK and actually predates the term ALAP. The Health and Safety act in the UK specifies as duty that the risk should be reduced As Far As Is Reasonably Practicable (SFAIRP). The term ALARP appears to have emerged between the late 1960s and the late 1980s in relation to how the UK Health and Safety Executive dealt with how it controls risk from nuclear power stations. The term ALARP in the context of the way in which the UK Health and Safety Executive is a regulatory interpretation made by the UK Health and Safety Executive with respect to how it considers industrial safety over the spectrum of industries for which it has responsibility. According to the HSE document ‘‘ALARP at a glance’’ (HSE, 2014a) these terms mean essentially the same thing. While this may be the case with respect to how the HSE discharges its responsibilities; that is ALARP describes the level to which we (HSE) expect to see workplace risks controlled, it does not mean that the Courts will consider ALARP to be equivalent to ‘‘In So Far as is Reasonably Practicable’’ (SFAIRP) (HSE, 2014b). The term ‘‘So Far as is Reasonably Practicable’’ (SFAIRP) is used widely in health and safety legislation in the UK, whereas the term ALARP is not used. However, much of the contemporary commentary on ALARP suggests that the term has been enshrined in the UK case law since the case of Edwards v. National Coal Board in 1949 (NN, 1949). In the case the court stated that ‘‘Reasonably practicable’’ is a narrower term than ‘‘physically possible’’ and seems to me to imply that a computation must be made by the owner in which the quantum of risk is placed on one scale and the sacrifice involved in the measures necessary for averting the risk (whether in money, time or trouble) is placed in the other; and if it be shown that there is a gross disproportion between them, the risk being insignificant in relation to the sacrifice – the [person on whom the duty is laid] discharges the onus on them [of proving that compliance was not reasonably practicable].’’ The ruling implied that the risk must be insignificant in relation to the sacrifice (in terms of money, time or trouble) required to avert it: risks must be averted unless there is a gross disproportion between the costs and benefits of doing so. The term SFAIRP was used in the Health and Safety At Work Act in 1974 and is used in the regulations. In 2001 Cullen and Uff concluded that at that time this was still an accurate expression of the law (Cullen, 2001). Notwithstanding all of the above, duty holders cannot assume that if the HSE concludes that a certain risk is ALARP that it means that the statutory duty of the dutyholder to reduce the risks SFAIRP is fulfilled. It only means that the HSE is satisfied, not that the Courts will be satisfied that the SFAIRP condition has been achieved. The important point here, that is generally not made, is that the two qualifications are applied to quite different properties. ALARP is applied to the level of ‘risk’ whereas SFAIRP is applied to being ‘safe’. The key question is whether being ‘safe’ is determined solely by the level of ‘risk’. Safety is relative and influenced by values whereas risk is quasi-objective and held to be value-free. The numbers mean the same to everyone, which of course is why risk became the parameter or property of choice. In practice, the difference means that the requirement ‘safe SFAIRP’ focuses on reducing the hazard. This is what the law requires and on which the courts pass judgement. The discussion on the difference between ALARP and ALARA hinges on the definitions of Achievable and Practicable. Munson

92

B.J.M. Ale et al. / Safety Science 76 (2015) 90–100

(1988) state that despite that there may be subtle differences between the two terms, they are in practice interchangeable. However it looks like the use of the term ALARP in the UK as opposed to ALARA seems to imply that achievable includes that it could be theoretically possible to go lower even if it has not been demonstrated in any way to be feasible in practice. ALARA then demands to do work, research, engineering to make it work. Practicable seems to indicate that the technical feasibility needs to have been demonstrated. Whether this also means that the technical implementation of the possibility should have been realised in practice and that practicable means the same as available technology is unclear. In this context the term BAT, Best Available Technology, plays a role. BAT implies that the costs are not considered. Then BAT means the same as ALAP, As Low As Practicable, the term used in radiation protection before it became ALARA. ALARP apparently means that the technology not only should be available, but also that the costs should be reasonable. This is confirmed in the verdict on the appeal in the case of Baker against the Quantum Clothing Group (The Supreme Court, 2011a). ‘‘In considering what is practicable, account must be taken of the state of knowledge at the time. A defendant cannot be held liable for failing to use a method which, at the material time, had not been invented: Adsett v K and L Steelfounders and Engineers Ltd [1953] 2 All ER 320; nor for failing to take measures against a danger which was not known to exist: Richards v Highway Ironfounders (West Bromwich) Ltd [1955] 3 All ER 205.’’ In the same verdict the demand of gross disproportionality was confirmed: (The Supreme Court, 2011b) I agree with Smith LJ in her conclusion (at para 84 of her judgment) that for the defence to succeed, the employer must establish a gross disproportion between the risk and the measures necessary to eliminate it. In the words of Asquith LJ in Edwards v National Coal Board [1949] 1 KB 704, 712, ‘‘the risk [must be] insignificant in relation to the sacrifice’’. In the present case, the provision of ear defenders at relatively modest cost was entirely practicable. For that reason, and since I have concluded that the employers ought to have been aware of the risk of noise induced hearing loss to the respondent, I do not consider that the defence of reasonable practicability was available to them. Another acronym that seems to mean the same is BATNEEC. This term was introduced with the 1984 Air Framework Directive (AFD) and applies to air pollution emissions from large industrial installations. BATNEEC stands for Best Available Technology Not Entailing Excessive Costs. In any case the introduction of several different acronyms over the years suggests that the authors were not satisfied that the existing acronyms conveyed had the same meaning of what they tried to express. Central in the discussion is what is meant by reasonable. A flavour for the extremes in these discussions are acronyms also used in the debate: CATNIP (Cheapest Available Technology Not Invoking Prosecution) or as David Slater put it (1994): ALARA: As Large As Regulators Allow, bringing back the notion the only a limit ultimately can prevent the risks from growing. This also is expressed by the drift to danger model as presented by Rasmussen (1997). The verdict in the case of Baker against the clothing group states as elements that the person or institution is aware of the risk or could reasonably be expected to be aware of it, and that a reasonable person or institution could not use cost or difficulty as a valid reason for not having such a policy. A valid reason could be that the costs are substantially disproportionate. Whether this

substantially differs from grossly disproportionate in Evens against the Coal Board is difficult to assess.

3. Reasonability The use of the term reasonable suggests that – in the UK risk management context – it is not sufficient to just adhere to some limit, if it exists, and that the reasonability of performing or refraining from an action is not just a matter of money. The term expresses that besides aspects that can be expressed in terms of money or have a monetary or market value, there are aspects that do not have such a monetary value, or such a value cannot be established with reasonable accuracy. The aspects may comprise such things as equity, sociality and even maybe beauty – even if it is only in the eye of the beholder. An area of outstanding beauty may appeal to one and not to another. And this is certainly true for buildings, which are conserved for their beauty, the beauty of which is an area of contention between architects. In either case the monetary value of these areas and buildings in many if not in most cases is considerably less that the costs associated with keeping them that way. In addition areas usually are much more valuable in terms of economic production and sales value when they can be used as building sites or agricultural areas than when they are designated as nature conservation areas. Therefore reasonability comprises much more than money and it is only loosely defined. It is what those who happen to make a decision consider reasonable. In particular instances, once it is ruled that a certain measure is reasonable, then it usually does not change, even if circumstances change. If a city grows and encroaches on a listed building it has to construct around this building. At the same time the economic factors change. It probably was a building to keep in a rural area, but is it also a building to keep now that the area has become a city? It seems that once listed means always listed.1 So it looks like reasonability depends on the circumstances until the decision has been made, after which changing circumstances no longer change the reasonability. Therefore in the UK in many cases the practical meaning of ALARP can only be inferred and may only be defined definitely after a trial in court, which may only take place after an incident. In the Netherlands legislation follows the Napoleonic principle that it is a citizens right to know in advance what the legislature demands and that governmental decisions need to be predictable (Ale, 2005). The advantage of a qualitative somewhat vague concept, and decision-making that depends on a to a large extent subjective value judgement by a decision maker, lies in that it avoids questions that are difficult to answer. It also avoids questions that have ethical connotations. The question of the value of land has already been touched above. A much more stinging problem is the monetary value of a human life. By demanding substantial disproportionality or gross disproportionality of costs before refraining from a risk reducing measure, the problem of precisely setting a value on a human need not be addressed. However many decisions imply a value for a human life. Sometimes these values are assessed by dividing the costs of the measure by the number of statistical lives saved (or at least not killed by the activity under consideration), such as in Tengs et al. (1995). However it should be borne in mind that these evaluations implicitly assume that saving lives was the only purpose of the measure and the only not monetised issue in the decision. In some of the decisions mentioned by Tengs et al. it seems obvious that the continuation of the political career of the decision makers was considered an important but not explicitly monetised factor. So the apparent inconsistency in 1

The same applies in the Netherlands.

B.J.M. Ale et al. / Safety Science 76 (2015) 90–100

decision making could perhaps be attributed to other factors than just inconsistency. Nevertheless the question was, is and will be raised whether decisions involving risks for human lives and health should be more consistent on the aspect of the implied monetary value of a human. Before this issue is addressed first the other extreme of the decision making spectrum is considered: CBA. 4. Cost Benefit Analysis In Cost Benefit Analysis and the decision making based on CBA it is assumed that everything has a value that can be expressed in money. It also assumes that these values can be determined and are determined in the market place that the world is considered to be. When all aspects to consider are money such as an investment decision in stocks or bonds the application is straightforward. But it gets complicated even for decisions such as constructing a road. Is the road value for money? The quantum of what has to be spent in monetary terms for the design, construction and maintenance can be calculated. But what is the worth of the time saved by not having tail backs? The value of changing the living environment for those who have to be rehoused is not only the current market value of their houses (which usually is the item in the CBA), but also the ‘‘imponderable’’ costs of children losing their friends, having to go to another school, which has a value for them and for which they do not get compensated, which is not considered but still is a value loss. Cost Benefit Analysis is attractive because whatever the consideration leading to a decision to implement or refrain from a measure, one aspect is always that a measure bears some costs. The other ubiquitous aspect is that the activity under consideration is advantageous to somebody. And in most occasions that advantage is earning money. There are occasions though where money is not the primary objective. Having a race track has ‘‘fun’’ as its main advantage even when money is made by admission fees. The main disadvantage is noise, which is also difficult to express in money terms. Using CBA reduces the question of acceptability to the question of profitability. Even when it is difficult to answer this question, whether it is ethically acceptable to bother people with noise for some people’s fun is a question that is even more difficult. If the racetrack example is not sufficient to explain the issue, consider fireworks. Does having the fun of fireworks outweigh the suffering of those who are killed and maimed in the accidents associated with the production and the storage of these fireworks? The latter raises an even deeper issue. Apparently the people involved in the production accept the risk in return for their pay. So from the point of view of CBA, the market has done its job. There was an offer: money in exchange for a risky job and somebody accepted it. The more ethical question is: should this offer be on the table to begin with. This in turn raises the question whether human lives can be evaluated in terms of money and if that is possible whether that value is a universal constant and all people are indeed created equal and finally if that is the case what that value is. 4.1. The value of life A continuous stream of efforts has been made to deduce a number for the value of a human life. Several attempts have been made that all have their specific ethical drawback (NN, 1995). Recent literature indicates that these estimates can be very misleading because people manage their risk much more intelligently then by just looking at the one risk under consideration. They look

93

at their total portfolio of risks and may compensate an increased level of risk by risk reducing measures somewhere else. For instance, rather than sticking to a moderately healthy diet always they may decide to compensate for a heavy meal by a day of fasting. If earning power is used (Morall, 1986) the question arises how to deal with the unemployed. If the number of life years lost is used, how can the question of putting the elderly or the young in specific hazardous situations be dealt with. The notion of Quality Adjusted Life Years (QALY) brings the question of the handicapped or challenged against the healthy. In terms of expenditure per life-year the numbers range from 0 to 99 ⁄ 109 US dollar (Tengs et al., 1995). The policy value of a human life seemed to gravitate to approximately 7 million US$. This is equivalent to US$200,000 per life-year. In more recent literature, the value for a human life to be used in cost benefit analyses is called the Value Of Saving a Statistical Life rather than the Value Of a Statistical Life (VOSL). The argument given is that the value of LIFE is unmeasurable. Nevertheless, in any cost benefit decisions the bottom line is that the value used is the value for letting that life continue in that decision. In decisions where statistical lives are lost, even when that is called tolerable (HSE, 2001), the activity and the risk are accepted and decision makers would do better in the public debate if they did not hide this behind words. HSE (2001) uses a value of one million pounds in their advice on risky activities. Also this value is based on the amounts spent on road safety (HSE, 2001). HSE remarks that they consider a higher value appropriate for risks for which people have a higher aversion, but they do not specify a value for risks such as disasters in a chemical factory or a nuclear power plant. In an evaluation that is more recent than the one performed by Tengs et al. (1995) and Viscusi and Aldy (2003) derive a value of 4 million US dollar. According to Button (1993), the official value of a human life varies from €12,000 to €2.35 million (Euro) and the market value between €97 and €630,000. Blaeij et al. regarding road safety find values ranging from US$0.15M to US$30M (Blaeij et al., 2000; Blaeij, 2003). They conclude that the value found depends among other things on the method used to determine it and on the background risk. They also say that to assume that a single (average or mean) VOSL can be attained, as is frequently suggested in the literature as well as among policy-makers, is not sound from a theoretical perspective and that the same conclusion can be drawn regarding the empirics of VOSL estimations. The valuation of injuries is even more difficult as are environmental damages. A comprehensive description is given in the ExternE (NN, 1995) report, but even there the results remain inconclusive or as Dolan et al. put it ‘‘elusive’’ (Dolan et al., 2008). 4.2. Cost There are also great difficulties in assessing the actual value of the risk reduction costs. A seemingly expensive measure such as the desulphurization of residual oil actually brought money. Many of the expenses made in safety result also in increased reliability of the production and less costs of down time and accidents. In fact, in the study performed by Pikaar and Seaman (1995) for the Dutch ministry of Housing, Physical Planning and Environment it appeared that most industries did not consider it worth their while to register the costs of these measures. This is consistent with Tengs et al. (1995) finding of the low costs of measures related to the prevention of accidents. So the methodology for Cost Benefit Analysis itself is well established and works well when only material loss and gain is involved, such as in finance. Currently there is not yet a clear understanding of how to use Cost Benefit Analysis in an organised way in risk

94

B.J.M. Ale et al. / Safety Science 76 (2015) 90–100

management, when these risks go beyond financial risks. What to put in monetary terms against what otherwise is called ‘‘imponderable’’ is still the subject of considerable debate. As described several times previously, especially when human life and health are at stake the discussion is more about values than about costs. But real decisions are often much more cynical than that (Evans, 1996). Illustrative in this respect is the discussion about Automatic Train Protection systems (ATP) in the United Kingdom. After Lord Hidden (1989) in his report of the Clapham Junction accident advised to introduce ATP on the British Rail network, British rail issued a report in 1994 (HSC, 1999) in which it showed that, given the Value Of a Statistical Life used in the UK, ATP was disproportionally expensive. This conclusion was endorsed by the Department of Transportation (DoT, 1995). After the crash at Ladbroke Grove Lord Cullen (Cullen, 2001) concludes that that decision was not unreasonable, but that the introduction of ATP was advisable regardless of these costs. This in turn leads Evans (Evans, 2005) to the conclusion that that money could be better spent on road safety, illustrating again that monetary cost benefit evaluations seldom dominate the final decision. However, the regulatory/political decision on ATP has not been the subject of any court case. The cost-benefit argument was conducted entirely in the political domain, much along the lines indicated. To the knowledge of the authors, the ALARP argument has never figured in a court case where the defence would have been that the residual risk was such as to ensure compliance with the law – in effect, that the risk was acceptable. The authors are not aware of any such defence and in any case, the hindsight bias available to the court can be expected to guarantee conviction. Given these experiences the weighting of human lives in an economic framework perhaps has to be left to the decision-makers and any analysis that quantifies human losses in terms of money has to be explicit about the valuation. 4.3. Safety budget The remark made by Evans is repeated by Helsloot who compares various safety measures and states among other things that the costs associated with the signs at emergency exits can better be spent giving children fruits at school (Helsloot, 2012). This reasoning is problematic as it suggests that money spent on saving or extending human lives can best be spent on food and medicines in the poorest regions of the world. Thus the ultimate conclusion of this reasoning would be that it would be better to redistribute the life expectancy over the all the people in the world, making the life expectancy in the ‘‘developing’’ world longer at the expense of the life expectancy in the ‘‘western’’ world. Whether this is ethically better or economically better is unclear. What is clear is that then there must be a mechanism to determine where the safety money should go. It is no surprise that Helsloot et al. propose an independent commission (Helsloot et al., 2010, p163), that would decide on purely scientific grounds where the safety money should be spent. The problem that Helsloot et al. ignore is that there is no such thing as a safety budget. There is money to spend on safety in a project, but this money is part of the project budget. It is difficult to imagine a mechanism by which such a Commission could decide that that a specific project can be made more risky, then take money from whoever is doing the project and spend it somewhere else. It is easy to imagine that should such a procedure exist, whoever has a project would set the safety budget to zero, budget for more risk and wait until and if the Commission would do something about it, preferably by supplying money taken from somebody else. The current practice of determining reasonability takes the spending power of the initiator of a project into account. If the

initiator has no more money left to invest, improving safety is not considered reasonable. This makes some projects or technologies safer than others. To prevent ‘‘poor’’ projects from being excessively unsafe, standards exist that define a maximum level of risk. These standards can be and are different for different types of activities. There is no law of nature that defines an (un-) acceptable level of risk, nor is there a principle that all risks should be measured equally. All of the reasonability principles can only operate within the implied or explicit assumption that an ultimate limit exists. 4.4. Distribution of cost and benefits Risk acceptability is also a distribution problem. Those who ‘‘take’’ the risk often are not the same people who ‘‘bear’’ the risks. When the rewards of risk taking goes to the risk creators and the costs are carried by the risk bearers a strong incentive is created for a small group to take large risks at the expense of others. The banking crisis is a prime example. The management of the banks took excessive risks and most of them got away with it. The tax payer had to bail them out. For the moment it looks as if society is curtailing the market freedom of the banks to prevent this behaviour in the future. The separation between risk takers and risk bearers is in part counteracted by litigation. The victims seek compensation from those who created the harm. However, as is illustrated by the case of the fireworks explosion in the Netherlands in 2000, damages in the case of an accident can easily be beyond the financial capabilities of the industry that caused the accident. One could choose for the principle that the damage rests where it falls (Helsloot et al., 2010, p83), and leave the victims with the damage, but this invariably results in public outcry, in which case the tax payer again has to foot the bill. Another persistent problem in societal Cost Benefit Analysis is that even if all the attributes can be expressed in terms of money, what is considered ‘‘good’’ for society is not necessarily ‘‘good’’ for everybody. The increase in ‘‘wealth’’ as a total may be maximised, but some have more profit than others. The sheer fact that economists cannot decide on what is best, making society more egalitarian, with small difference in income and possessions or less egalitarian, with large differences proves the point. Therefore Cost Benefit Analysis which only considers economic optimisation ignores as Tawney (1926), put it: ‘‘A reasonable estimate of economic organization must allow for the fact that, unless industry is to be paralyzed by recurrent revolts on the part of outraged human nature, it must satisfy criteria, which are not purely economic’’.

4.5. Societal risk Societal risk is the term used for risks that involve events with multiple fatalities or victims. Using just the expectation value of a loss implies that the decision maker will attach equal value to risks for which the R is equal; that it does not matter whether there is a 1/100 chance of winning 100 Euros, or a 1/1000 chance of winning 1000 euros. In normal life betting games this is often the case. However, if the consequences are very high, this might no longer be the case. As an example, after 9/11, insurance companies were no longer prepared to insure losses in excess of 1 billion Euros, regardless of the probability. In such circumstances the consequences and the probabilities or frequencies have to be presented and considered separately. The most widely known expression of these effects in mathematical terms is the so-called risk-aversion index. Risk aversion

B.J.M. Ale et al. / Safety Science 76 (2015) 90–100

means that more severe consequences (with the same frequency) weigh heavier in the decision making process than more frequent events (with the same in total consequence). Large consequence or disaster aversion therefore would be a better term (Bedford, 2013). There is considerable debate about whether it is ethical to treat a single accident with say 10 people killed as worse than 10 accidents with 1 person killed each. Evans and Verlander (1993) state that having an FN curve as a linear relationship between F (the frequency) and N (the value exceeded) with a slope steeper than 1, which is the mathematical expression of considering a single multiple fatality accident as less acceptable than a series of one fatality accidents with the same total number of victims, violates the economic rule of constant utility, and that therefore decisions made on any other criterion than the expectation value of the number of victims is wrong. Recently however, Bedford (2013) has shown that an FN curve with a slope steeper than 1, or valuing a multiple fatality accident heavier than a series of single fatality accidents is not risk averse but consequence averse and can be shown to be compatible with the economic laws that entities with the same utility should be valued equally. Multiple fatalities can create more disutility than single fatalities, just by the fact that they occur simultaneously, in the same event and by the same cause. This finding is a further confirmation of the findings in Slovic et al. in 1978. It should be borne in mind that expressing the consequences in terms of fatalities is using a proxy for all the attributes of a multi-fatality event, sometimes referred to as social disruption. Slovic at al. called it ‘‘dread’’, which stands for attributes such as disastrousness, inability to cope without help, beyond control, man-made. When asked directly people probably will say that it does not matter whether the number of people killed is one by one, or in a single accident. This does not take away from the fact that 100 people killed in a train crash leads to social debate and parliamentary enquiries, while the same number killed on the road does not cause any societal ripple. Therefore multiple fatality accidents should not be compared with multiple accidents with a single fatality by the number of people killed alone, which strengthens the argument that values of statistical lives derived from road safety are not transferrable to other areas of industry. It also strengthens the doubts as to whether a value derived from one realm can be transferred to another realm per se. If indeed there is no law of nature from which an acceptable risk level can be derived, there is no reason a priori to assume that the level would be equal for each realm. This in turn does not prevent any decision maker from deciding to adopt a level in one realm which is equal to that in another realm, but this needs separate justification, as for instance was done in the Dutch Premises for Risk Management (TK, 1988).

4.6. Values used All these publications and the elusiveness of the value of human lives does not prevent authorities from adopting standard values for the value of a statistical life. The Australian Government’s Office of Best Practice Regulation adopted a value of 3.5M $US per life and a value of 151,000$US per statistical life year. It is stated that these estimates are based on the assumption that the average person has another 40 years to live, which implies an average life expectancy of 80 years. There is no indication that they noticed that these values are completely inconsistent. The UK Health and Safety Executive stated a value of £1M in their report R2P2 (HSE, 2001). The UK Department of Environment, Transport and the Regions now uses £1.74M2 for road traffic (2014b). For risks close to the limit of intolerability the 2

The value is given in 7 significant digits: 1,742,988.

95

value used was increased (DoT, 1995). According to Cullen and Uff there does not seem to be a scientific reason for this difference. In their report however Cullen and Uff do not give a judgement on these values, as the issue under their investigation is already settled by law. It looks as though they are of the opinion that this does not by implication set a value on a human life, but they are unclear about this. From the more recent amended Railways and Other Guided Transport Systems (Safety) Regulations 2006 (NN, 2014a,b,c) it appears that this difference no longer is used. The Dutch government uses €5.8M for an average life lost in a flood (Deltares, 2011; IENM, 2013). This is based on studies by Bockarjova et al. (2009a, 2009b, 2009c) who state that the use of their findings as an estimate for the VOSL is problematic, given the answers of the respondents in their study, show that people behave more as ‘‘homo politicus’’ than as ‘‘homo economicus’’ (Bockarjova et al., 2008). Helsloot et al. (2010) propose to use €3.2MEuro for an average life lost as a uniform amount for all policy decisions in the Netherlands. The ministry of Infrastructure and Environment proposes €2.9M per life lost in the CBA for the introduction of the European Rail Traffic Management System (MuConsult, 2014) which is half the value in the CBA for the height of the dykes, which underpins the current proposal3 for the new ‘‘Delta’’ works (IENM, 2013). In health care the Dutch Health Councils prefers a value of €80,000 per Quality Adjusted Life-year (QALY) (RVGZ, 2006). However, when the costs of medicines decreases this may lead to the conclusion that it is worthwhile to treat half of the Dutch population against hypertension even when this risk of adverse consequences is marginal (Smulders and Thijs, 2006). Recent decisions according the preference of the Health Council regarding the treatment of among other things Pompe’s disease resulted in a parliamentary debate and in a revoking of the decision to no longer pay for this treatment under the basic health insurance system in the Netherlands. 4.7. CBA in decision making Just as ALARP, CBA based decision making has its merits and its disadvantages. Its primary merit is that it is precisely defined and the decision is predictable. Its disadvantage is that it does not take into account the imponderables that more often than not weigh into the decision. Using CBA also suggests that the Value of Life is a known and universal constant while there is no scientific evidence other than that the VOSL varies over a large range and highly depends on the circumstances and on the method used to determine it. What seems to be emerging from the examples in (4.6 above) is that decisions on statistical human lives and anonymous future victims are much easier than on real human beings. In the latter example of Pompe’s disease there are only some 10 patients in the Netherlands. In that case the future victims were no longer statistical but real. This is in line with the findings of Slovic et al. (1978), that the possibility of identification with the victims makes a risk – or a consequence – less acceptable. 5. Multi criteria analysis Decisions are made. The processes involved are not always made explicit. They are the result of a complicated value judgement in which many attributes play a role. A possible escape from explicit valuation of human lives is Multi Criteria Analysis (MCA). In MCA criteria are not necessarily expressed in a common metric (such as money), but the relevant 3

The ministry considers this decision as being taken.

96

B.J.M. Ale et al. / Safety Science 76 (2015) 90–100

attributes are described in their own terms, leaving the weighting to the decision maker. MCA appeals to decision makers and others who are uncomfortable with numbers (Vlek, 1996) or are of the opinion that the use of numbers implicitly suggests an accuracy that these numbers do not have. The latter suggestion is sometimes reinforced by expressing the VOSL in seven significant digits as is done in the CBA for the introduction of ERTMS in the Netherlands.4 The different attributes of risk are expressed in qualitative form and judged qualitatively. This does not take away from the fact that after the decision, which in this case is a matter of the willingness to pay, can be evaluated in terms of what the decision means for the – now implicit – economic valuation of a human life. This form of decision making removes another problem that is created by an explicit valuation; specifically that the numbers used are based on studies in which it is stated explicitly that the valuation deduced from willingness to pay investigations or evaluations of past decisions have a wide spread and that these values should not be taken as the basis for future decisions without further discussion. Nevertheless, as described above, the value from the ExternE report seem to percolate through CBA based decision making. The Safety Case Regime, that applies to certain industries in Australia, New Zealand, and the United Kingdom can be considered to fall into the multi-attribute category of safety demonstrations. The United Kingdom Offshore Installations (Safety Case) Regulations 2005 are an example. For the purpose of a design notification or a relocation notification, the particulars to be provided include among other particulars ‘‘a description of how a chosen design concept is intended to ensure that risks with the potential to cause a major accident are reduced to the lowest level that is reasonably practicable’’ (UK Government, 2005). The process for the Verification of Compliance with UK Shelf Regulations (DNV, 2011) provides an illustration of how the Offshore Safety Regulations are being implemented as follows: ALARP is particularly important for fixed installations and floating installations located at a fixed location. However, mobile units coming to the UK will also have to demonstrate an acceptable level of safety including reasonable application of the ALARP principle. The basic principles for hazard management are: – systematic identification of major hazards on the installation – taking action to design out, avoid and reduce hazards at source – risk analysis and assessment of major accident hazards, including PFEER Regulation 5 assessment – inclusion of ergonomics and human factors issues within the risk assessment process – establishing appropriate prevention, detection, control and mitigation measures, including safety-critical elements and their performance standards, to manage remaining hazards – linking to an acceptable verification scheme covering the SCEs identified – providing suitable evacuation, escape and recovery resources – demonstration of fulfilment of the ALARP principle. The above work forms the basis for development of the safety case(s). In terms of the above, an ALARP demonstration, while an important part of the safety assurance process is not the only part.

6. Optimisation ALARP is a form of driving the optimal solution of a complicated problem in a certain direction: One should make the risk as low as 4 The value given for a death is €2,877,857, the value for an injured €295,870 Euro; (€ 2013), before tax.

reasonably practical. It is meant perhaps to counter the drift to danger under market forces as described by Rasmussen (1997). It should be noted however, that there is a general rule for optimisation, which is that the solution is not in the interior of the area of feasible solutions, but always on the boundary. This means that if there are no bounds the solution can be anywhere. It also means that once a limit is set, the solution will be on this limit, unless another constraint is more demanding. In the case of a nonbounded risk problem, the boundary condition for costs is zero costs. This means that the risk will rise until the costs are zero. If there is a risk limit, the risk will be on this limit, unless other demands, such as the operability, are more stringent. The resulting ‘lower than the limit’ risk then is just a co-incidence. If the risk limit puts excessive financial demands on the activity, the activity will be stopped. The remark made in several VOSL studies that the VOSL varies widely, may be the result of a process in which other factors were dominant. In many ex post evaluations of decisions these factors may not be retrievable, because they are only known to the people involved. As an example the fine for not having a fence around a swimming-pool in France is €40,000. In terms of valuation of a statistical life this may seem an enormous amount, unless one knows that the regulation came into force after the grand child of the responsible minister drowned in a swimming pool. He judged apparently that it was unreasonable that children drown in swimming pools regardless of the costs of protection. There are many of these decisions known. They have in common lives that were not valued before the decision, and therefor the value was the accidental result, not a pre-set criterion.

7. Dams and the question ‘‘How safe is safe enough?’’ – A brief overview The failure of a large dam or important flood defence dyke, while perhaps less frightening than a nuclear catastrophe, is comparably destructive. The publication of Tolerability of Risk from Nuclear Power Stations, and in particular the content of Appendix 4 provided British Columbia Hydro, an owner of large hydropower and flood control dams, with a basis to propose a new approach to the assessment of the safety of dams for flood and earthquake hazards (BC Hydro, 1993). The proposed BC Hydro criteria of life safety were mid-way between the ‘‘local scrutiny line’’ and the ‘‘negligible line’’ for ‘‘major hazards of transport’’ (Figure D1 of the Tolerability of Risk report). BC Hydro’s objective was to set ‘‘safety standards’’ for dams in terms of risk to life and economic risk that would be used to determine that a dam would be deemed to be acceptably safe to the Company and to the Dam Safety Regulatory authority. At the same time, the Australian National Committee on Large Dams, an industry association, was working towards a similar objective as BC Hydro (ANCOLD, 1994, revised 2004). In 1995, a study carried out for State of Victoria office of water reform published the Victorian Headworks Review (SMEC, 1995) that represented the first application of a version of risk assessment to a portfolio of dams for prioritisation purposes. CBA has been used for many years to justify the costs of investments in new water resource infrastructure, including flood defences where it plays a very significant role. However the idea of using CBA, which was central to the BC Hydro proposal in the determination of the extent to which safety features for dams to withstand the effects of severe flooding was rejected by the engineering profession, the dams industry and government authorities, largely on moral and ethical grounds relating to the problem of valuation of life. The approach adopted in the Netherlands for flood protection dykes was not adopted by the dams industry. The US Bureau of Reclamation (United States Bureau of Reclamation

B.J.M. Ale et al. / Safety Science 76 (2015) 90–100

(USBR), 1986) considered the matter with respect to the safety of dams in the mid-1980s but did not pursue it. However, owing to the very high cost and little apparent benefit of traditional safety measures for dams the matter remained of interest in a small number of countries, most notably in Australia and in British Columbia, Canada. BC Hydro withdrew its proposal in 1997 because of difficulties in providing a scientifically robust analysis of the risk, difficulties that continue to inhibit the application of risk analysis in determining the safety of dams, and because of legal and corporate social responsibility concerns. In the same year, the US Bureau of Reclamation (USBR) established a similar criterion to that of BC Hydro for prioritising its expenditures on dam safety improvements. These criteria have remained in place at the since. Since 1997, and in recognition that the setting of societal risk control goals is a matter of politics that must be addressed on a jurisdiction by jurisdiction basis, BC Hydro has focused its efforts on the matter of improving the industry’s capabilities to perform scientifically robust risk analysis methods. In 2004, the New South Wales Dam Safety Committee, the State’s Regulatory Authority for the safety of dams established a policy of progressive improvement of the safety of dams based on risk assessment criteria that reflected the Tolerability of Risk and ALARP philosophy of the UK Health and Safety Executive, as re-interpreted by the Australian National Committee on Large Dams. This Australian approach to risk assessment for dams, the use of which is widespread in Australia for prioritisation of dam safety improvements, adopted societal risk criteria that combine the UK HSE’s Tolerability of Risk criteria and the F-N societal risk criteria used in the Netherlands for the control of industrial risk, and for flood defences. Subsequent to the publication of Reducing Risks, Protecting People, the use of the HSE’s Tolerability of Risk Philosophy became increasingly accepted for prioritisation purposes in the dams industry (e.g. Brown and Godson, 2004). However, this use of the HSE philosophy in the dams industry is not widespread being restricted to Common Law countries, nor is it fully in accordance with the philosophy as set out in Tolerability of Risk from Nuclear Power Stations. Thus far the New South Wales Dam Safety Committee has been the only dam safety regulatory authority to establish dam safety criteria for dams and only in the context of progressive improvement towards established deterministic standards. In 2007 the Canadian Dam Association published proposed societal risk criteria for dams in Canada (CDA, 2007), a proposal that was revised in 2013. In 2009, the US Army Corps of Engineers (Munger et al., 2009) prepared its own interpretation of the HSE’s Tolerability of Risk philosophy that serves as an ‘‘internal regulation’’. In 2013 in the UK, the Department of Environment, Food and Rural Affairs (DEFRA) published its Guide to risk assessment for reservoir safety management. However, the DEFRA Guide does not form part of the reservoir safety legislation in the United Kingdom in the same way as the Offshore Installations Safety Case Regulations. In 2014, the new policy on the safety of flood protection dykes in the Netherlands which meets BC Hydro’s original objective for dykes in the Netherlands was published (Ministerie van Infrastructuur en Milieu, 2014). However, for the legal and political reasons previously described is not applicable to BC Hydro’s dams or to dams in other jurisdictions where the common law system prevails and where the enabling legislation has not been enacted. The situation in the dams industry in common law countries has analogues in other industries such as railways. The existence of the Common Safety Method for Risk Evaluation and Assessment for technical risk aspects of railway safety in the European Union provides a useful means of examining the matter of ALARP, SFAIRP and CBA. In the EU regulation, design targets,

97

referred to as harmonised quantitative design targets have been specified in terms of an acceptable rate of failures per hour. In response the Rail Safety and Standards Board (RSSB), an industry organisation has provided guidance to rail operators on the matter of risk management and demonstrating that risks have been reduced So Far As Is Reasonably Practicable (RSSB, 2014). ‘‘The obligation to ensure safety SFAIRP is sometimes expressed as a requirement to reduce risk to a level that is as low as reasonably practicable. Although SFAIRP and ALARP are different in law, they are used interchangeably in the GB rail industry and are regarded as representing the same health and safety legal test.’’ For the purpose of CBA, the RSSB ‘value of preventing a fatality’ (VPF) was £ 1.826 million in June 2014. In terms of the RSSB Guidance on the use of cost-benefit analysis for ensuring safety, CBA should only provide an input to the overall decision rather than giving a definitive result. Notwithstanding the extensive guidance provided by RSSB to operators, a degree of uncertainty remains with respect to the safety decision because as in other situations in the common law system, the adequacy of a duty holder’s safety measures will ultimately be determined by the Courts after an accident. While in the case of railways in the United Kingdom, guidance on risk-decisions and CBA is provided by the industry, the guidance for dams is provided by a Government Agency. However, in both cases, the risk assessment and CBA information inform the safety decision, they do not form the sole basis for the decision. However, unlike the railway industry, there is no EU-wide regulation on the safety of dams and reservoirs. Thus, after more than 20 years of activity in the domain or risk assessment in dam safety practice, dam owners in common law jurisdictions are still faced with the problem of comprehensively demonstrating that their dams are acceptably safe. In simple terms, the uncertainty associated with the safety decision as described in the Introduction remains a dominant matter for these dam owners with only partial assurance being provided by their ALARP demonstrations and the Cost-Benefit Analysis regardless of how well grounded these analyses are. This is in marked contrast to the situation with respect to flood defences in the Netherlands (or other Napoleonic jurisdictions that choose to) where the responsible duty holders know how much safety to provide as specified in terms of acceptable risk criteria and CBA. 8. Fusing the extremes As is described above the expression of risk in quantitative terms and the valuation of human lives is not going to disappear. In a market driven society the bottom line of all decisions is an amount of money to be paid by a company, a victim, a bank, society, the consumer or the taxpayer. That does not necessarily mean that the non-material damages and the non-material benefits associated with a risk bearing activity need to be valued at the same price in every situation, in every context and in every decision. It should be borne in mind though that the judgement about risk is influenced more heavily by interests than by the ability to influence the decision. Vlek and Stemerding (1984) showed that people judge more favourably on the risks of LPG if they drive a car which is fuelled by it and even more favourably if they sell LPG (Vlek and Stallen, 1981; Vlek et al., 1983). In many cases the risk bearer is not the risk taker. Many studies indicate that a better and more accepted decision can be reached by involving the stakeholders (Smulders and Thijs, 2006; Renn, 2008). Many of these are less familiar with numbers than engineers or economists. Discussions in qualitative terms may help to

98

B.J.M. Ale et al. / Safety Science 76 (2015) 90–100

VOSL ethics

emoons

Societal demands

CBA

QRA ALARP

Risk criteria

Economy

Industry standards

Technical prescripons

ALARP

Legal requirements

Industry

Future license to operate

ethics Client demands

Performance demands

reputaon

Fig. 1. The forces around a hazardous activity.

build understanding about what the – unavoidable – numbers actually mean. In this context the use made of ALARP in the UK policy making is not a bad idea at all. First a problem is analysed in quantitative terms as far as possible, including what taking certain measures mean in terms of the implied value given to a human life. Then these numbers are combined with all the qualitative information that is available and a decision is made. For repetitive decisions such as allowing hazardous activities near populated areas or exposing people to chemical or noise a standard or limit can be set. Such a limit prevents the drift to danger (Rasmussen, 1997) caused by the continuous market pressure to reduce costs. It also prevents malicious exposure of third parties to risks that only benefit some and finally it prevents exposure to risks of a small group ‘‘to the benefit of society’’ without proper compensation. 9. The bottom line The fusion of this all can best be described using a figure (Fig. 1). An industrial activity is subject to many forces. One of these is the legal requirement. In this respect the ‘‘lowest’’ level of safety culture on the ‘‘Hudson’’ maturity scale can also be seen as the bottom line of obligations. Indeed making the lawyers happy is a minimum requirement unless one wants to be a criminal. Showing that what has been done in terms of safety is ALARP can be part of the regulation, but as long as there is no guidance this remains a matter of opinion and therefor a matter of a power struggle between the regulator and the regulated. As discussed before, this is more relevant to common law than to Roman law. ALARP may be translated to industry standards, by which the industry complies. This is usually by their-own volition, but sometimes also because the law can demand it directly or, and while the authors are not aware of any precedents, the regulation could define ALARP as the boundary for reasonability.

What is considered to be reasonable can be evaluated purely qualitatively, but it is usually based on information on the resulting risk derived from a quantitative risk analysis. Additionally information can be made available on the costs and the balance between costs and benefits. This information also drives the demands of society in general. However since QRA and CBA are supposed to be ‘‘factual’’ and ‘‘objective’’ there is not much room for ethics in these exercises. Ethics and ‘‘emotions’’ are important drivers for human behaviour and thus for society. Although decision makers sometimes try to objectify their decisions, it cannot be ignored that politicians lean heavily on emotions during election time. So unless one favours a technocratic dictatorship emotions will be part of the decision making process, as Slovic and others have shown over decades of research. Also Lord Cullen and Prof. Uff (2001) conclude in the Southall and Ladbroke Grove Joint Inquiry into Train Protection Systems that CBA is a factor to take into account, but should not be the only factor. It is remarked on the side that technocratic dictatorships seem to have a relatively short life span, due to the same emotions and the sometimes violent expression thereof. The resulting societal demands then find their way into ALARP, into the regulatory framework and will result at some point in the value attached to a human life in the case under consideration. 10. Conclusion In all cases QRA and CBA remain information and not overriding criteria. The boundary conditions set in law are the only real limits. The laws could set acceptable risk explicitly, but they do not have to. If the level of acceptable risk is not explicitly set, the risk level resulting from compliance to the regulations is just as accidental as the VOSL found from ex-post evaluations of decisions. What remains is that ALARP, QRA and CBA are part of the grander scheme of making decisions. ALARP defines to a certain extent what is done with the information gained by performing a

B.J.M. Ale et al. / Safety Science 76 (2015) 90–100

QRA and a CBA, by specifying what is reasonable: whether the costs should be equal to the benefits or disproportional costs are reasonable until the disproportion is gross? This represents a reevaluation of the benefits, including the implied VOSL, making ALARP and CBA the same. How the responsible decisions-makers, be they in industry, in government service, or in government office, utilise the information that can be obtained from ALARP and CBA demonstrations will be dependent on the general and specific contexts of each decision. Unlike CBA are no hard and fast rules that define the process as to how such decisions can be made. The manner in which ALARP and CBA are utilised either individually or together can also be expected to be context dependent, with the context being influenced by prevailing political, social, economic and industrial conditions. However, after an accident, and even if regulatory support for the approach to safety has been obtained a-priori, the courts can be expected to judge each case on its merits with each case turning on the facts that are unique to that particular case. Acknowledgement The authors are grateful to Dr. James McQuaid, formerly Chief Scientists and Director of Science and Technology at Her Majesty’s Health and Safety Executive, for invaluable input, comments and Discussions. References Ale, B.J.M., 2005. Tolerable or acceptable, a comparison of risk regulation in the UK and in the Netherlands. Risk Anal. 25 (2). ANCOLD, 1994, 2004. Australian National Committee on Large Dams, Guidelines on Risk Assessment. Bagnall, David, 2008. Letter to the Editor HSE Magazine March/April 2008. BC Hydro, 1993. Interim Guidelines for Consequence-Based Dam Safety Evaluations and Improvements, HED Report H2528. Bedford, T., 2013. Decision making for group risk reduction: dealing with epistemic uncertainty. Risk Anal. 33 (10), 1884–1898. http://dx.doi.org/10.1111/ risa.12047. Blaeij, de A., 2003. The value of statistical life in road safety: a meta-analysis. Accident Anal. Prev. 35, 973–986. Blaeij, Arianne de, 2000. In: Florax, Raymond J.G.M., Rietveld, Piet, Verhoef, Erik (Eds.), The Value of Statistical Life in Road Safety: A Meta-Analysis, TI 2000-089/ 3 Tinbergen Institute Discussion Paper. Bockarjova, M., Rietveld, P., Verhoef, E.T., 2008. Valuation of Flood Risk in the Netherlands: Some Preliminary Results, ESREL 2008 & 17th SRA Conference, 22–25 September, Valencia, Spain. Bockarjova, M., Rietveld, P., Verhoef, E., 2009a. First Results Immaterial Damage Valuation: VOSL in Flood Risk Context – A Stated Preference Study (I). Department of Spatial Economics, VU Amsterdam. Bockarjova, M., Rietveld, P., Verhoef, E., 2009b. First Results Immaterial Damage Valuation: Value of Statistical Life (VOSL) in Flood Risk Context and Value of Travel Time Savings (VOT), A Stated Preference Study (II). Department of Spatial Economics, VU Amsterdam. Bockarjova, M., Rietveld, P., Verhoef, E., 2009c. First Results Immaterial Damage Valuation: Value of Statistical Life (VOSL), Value of Evacuation (VOE) and Value of Injury (VOI) in Flood Risk Context, a Stated Preference Study (III). Department of Spatial Economics, VU Amsterdam. Brown, A., Godson, J., 2004. An Interim Guide to Quantitative Risk Assessment for UK Reservoirs. Institution of Civil Engineers. Button, K., 1993. Overview of Internalising the Social Costs of Transport, OECD ECMT Report. CDA, 2007. Dam Safety Guidelines. Canadian Dam Association. Cullen, Lord W., 2001. The Ladbroke Grove Rail Inquiry. Her Majesties Stationary Office, Norwich, ISBN: 0 7176 2056 5. Cullen, Lord, Uff, Prof John, 2001. The Southall and Ladbroke Grove Joint Inquiry into Train Protection Systems. HMSO, Norwich, UK, ISBN: 0 7176 1998 2. DEFRA, 2013. Guide to Risk Assessment for Reservoir Safety Management. Department of Environment, Food and Rural Affairs. Environment Agency. Deltares, 2011. Maatschappelijke kosten-baten analyse Waterveiligheid 21e eeuw (Societal Cost Benefit Analysis Water Safety 21 Century) Deltares, 1204144006-ZWS-0012, 31 maart 2011. DoT, 1995. Department of Transport. Mawhinney Endorses HSC View on Future of Automatic Train Protection. DoT Press Notice 98, 30 March 1995. Det Norsk Veritas (DNV), 2011. Verification for Compliance with UK Shelf Regulations, Offshore Service Specification, DNV-OSS-202Ó. .

99

Dolan, Paul, Metcalfe, Robert, Munro, Vicki, Christensen, Michael C., 2008. Valuing lives and life years: anomalies, implications, and an alternative Health Economics. Policy Law 3, 277–300 (ª Cambridge University Press 2008. http:// dx.doi.org/10.1017/S1744133108004507). Evans, Andrew W., 1996. The economics of automatic train protection in Britain. Transp. Policy 3 (3), 105–110. Evans, A.W., 2005. Railway risks, safety values and safety costs. Proc. Inst. Civ. Eng. Transp. 158 (TR1), 3–9 (February 2005). Evans, Ron, 2008. Letter to the Editor HSE Magazine March/April 2008. Evans, A.W., Verlander, N.Q., 1993. What is wrong with criterion FN-lines for judging the tolerability of risk? Risk Anal. 17 (2), 157–168. HeLsloot, I., 2012. Veiligheid als (bij)product (Safety as Byproduct). Oratie Radboud Universiteit Nijmegen. Helsloot, I., Pieterman, R., Hanekamp, J.V., 2010. Risico’s en Redelijkhed (Risk and reasonability). Boom Juridische Uitgevers, ISBN: 978-90-8974-243-8. Hidden, Anthony, 1989. Investigation into the Clapham Junction Railway Accident. HMSO, London, ISBN: 0101082029. HSC, 1999. (as per 14.12.14). HSE, 2001. Reducing Risk, Protecting People, Her Majesty’s Stationery Office, Norwich NR3 1BQ, p. 36. ISBN: 0 7176 2151 0. HSE, 2014a. (as per 16.09.14). HSE, 2014b. Principles and Guidelines to Assist HSE in its Judgements that Dutyholders have Reduced Risk as Low as Reasonably Practicable. . IENM, 2013. Letter of 26 April 2013 to the Parliament, Ministerie van Infrastructuur IENM/BSK 2013/19920. Loewen, Eric P., 2011. Is ALARA Reform Needed? Address to both Eastern Washington and Trinity Sections of the American Nuclear Society on May 19 & 20, 2011. Remarks by Eric P. Loewen, Ph.D. Vice President/President Elect American Nuclear Society. Ministerie van Infrastructuur en Milieu, 2014. Deltaprogramma: Synthesedocument deelprogramma Veiligheid, DG Ruimte en Water, Directie Algemeen Waterbeleid en Veiligheid. Morall, J.F., 1986. A review of the record. Regulation 10 (2), 1986. MuConsult, B.V., 2014. Maatschappelijke Kosten-batenanalyse ERTMS Datum 12 maart 2014 Kenmerk IM035 (Societal Cost Benefit Analysis ERTMS, date 12 March 2014) Amersfoort. Munger, D.F., Bowles, D.S., Boyer, D.D., Davis, D.W., Margo, D.A., Moser, D.A., Regan, P.J., Snorteland, N., 2009. Interim tolerable risk guidelines for US army corps of engineers dams. In: Proceedings of the Annual Meeting of the US Society on Dams, Nashville. Munson, L.H., 1988. (Chairman), Herrington, W.N., Higby, D.P., Kathren, R.L., Merwin, S.E., Stoetzel, G.A., Vallaria, E.J. DOE Project Manager, Health Physics Manual Of Good Practices For Reducing Radiation, Exposure To Levels That Are As Low As Reasonably Achievable (Alara) June 1988, Prepared for the U.S. Department of Energy Assistant Secretary for Environment, Safety, and Health under Contract DE-AC06-76RLO 1830. NN, 1949. Edwards vs The National Coal Board (1949) 1 A11 ER 743. NN, 1995. Externe, Externalities of Energy, vol. 2, Methodology, European Commission EUR 16521 EN. NN, 2014a. (20140412). NN, 2014b. (as per 13.12.14). NN, 2014c. (as per 13.12.14). Pikaar, M.J., Seaman, M.A., 1995. A Review of Risk Control, Report nr SVS 1994/27A. Ministry of Housing Physical Planning and Environment, The Netherlands. Rasmussen, J., 1997. Risk management in a dynamic society: a modeling problem. Saf. Sci. 27 (2/3), 183–213. Renn, O., 2008. Risk Governance. Coping with Uncertainty in a Complex World. Earthscan, London, ISBN: 978010844-7-291-0. Rothery, Dave, 2008. Letter to the Editor HSE Magazine March/April 2008. RSSB, 2014a. Taking Safe Decisions, Rail Safety Standards Board. RSSB, 2014b. Guidance on the Use of Cost-benefit Analysis When Determining Whether a Measure is Necessary to Ensure Safety so far as is Reasonably Practicable, Rail Safety Standards Board. RVGZ, 2006. Zinnige en duurzame zorg (Sane and Sustainable Care). Raad voor de Volksgezondheid en Zorg, Den Haag. Slater, D., 1994. Private communication. Slovic, P., Fischoff, B., Lichtenstein, S., Read, S., Combs, B., 1978. How safe is safe enough, a psycho-metric study of attitudes towards technological risks and benefits. Policy Sci. 8, 127–152. Smulders, Y.M., Thijs, A., 2006. Kostprijs per gewonnen levensjaar: trends en tegenstrijdigheden (Value per Lifeyear Gained, Trends and Contradictions) Ned Tijdschr Geneesk. 2006 11 november, 150(45). Snowy Mountains Engineering Corporation Limited, 1995. Final Report on the Review of Headworks. Office of Water Reform (Department of Conservation and Natural Resources), State of Victoria, Australia. Tawney, R.H., 1926. Religion and the Rise of Capitalism. Penguin Books. Tengs, T.O., Adams, M.E., Pliskin, J.S., Safran, D.G., Siegel, J.E., Weinstein, M., Graham, J.D., 1995. Five hundred life saving interventions and their cost effectiveness. Risk Anal. 15, 369–390. The Supreme Court, 2011a. UKSC 17 on Appeal from [2009] EWCA Civ 499 dd 13 April 2011, nr. 214, p. 96.

100

B.J.M. Ale et al. / Safety Science 76 (2015) 90–100

The Supreme Court, 2011b. UKSC 17 on Appeal from [2009] EWCA Civ 499 dd 13 April 2011, nr. 184, p. 83. TK, 1988. Omgaan met Risico’s, Tweede Kamer, vergaderjaar 1988–1989, 21137, nr. 5. Under the Same Number the Translation in English is Titled: Premises for Risk Management TK (2001) Records of the Second Chamber of Parliament of the Netherlands, year 2001–2003, 27603 nr. 52. United Kingdom Government, 2005. The Offshore Installations (Safety Case) Regulations 2005, Statutory Instrument 2005 No. 3117. The Stationary Office Limited. United States Bureau of Reclamation, 1986. Guidelines on Decision Analysis, ACER Technical Memorandum No. 7, US Department of the Interior. United States Bureau of Reclamation, 1997/2003. Guidelines for Achieving Public Protection in Dam Safety Decision Making. US Department of the Interior. Viscusi, W.K., Aldy, J., 2003. The value of a statistical life: a critical review of market estimates throughout the world. J. Risk Uncertain. 27, 5–76.

Vlek, C.A.J., 1996. A multi-stage, multi-level and multi-attribute perspective on risk assessment decision making and risk control. Risk Decis. Policy 1 (1996), 9–31. Vlek, C., Stallen, P.-J., 1981. Judging risks and benefits in the small and in the large. Organiz. Behav. Human Perform. 28 (2), 235–271. Vlek, C.A.J., Stemerding, S., 1984. Beschrijving en beoordeling van risico’s verbonden aan het gebruik van gevaarlijke stoffen. Deelrapport I. Probleemstelling, projectoverzicht, samenvatting, conclusies en aanbevelingen (Description and Judgement of Risks Associated with the Use of Hazardous Materials. Part 1, Problem-Statement, Project Description, Summary, Conclusions and Recommendations) IVEM-rapport nr. 3. Groningen 1984. Vlek, C., Kuyper, H., Boer, H., 1983. Large-scale Risk as a Problem of Technological, Psychological and Political Judgement, Environmental Impact Assessment, Technology Assessment, and Risk Analysis. roc.