Air Force System Safety Handbook - System Safety Society

3.6 Risk Acceptance.
Risk Acceptability. Accepting risk is a function of both risk
assessment and risk management. Risk acceptance is not as
simple a matter as it may first appear. Several points must be
kept in mind.
(1) Risk is a fundamental reality.
(2) Risk management is a process of tradeoffs.
(3) Quantifying risk doesn’t ensure safety.
(4) Risk is a matter of perspective.
Day and night, everywhere we turn, we are surrounded by a
multitude of risks, some large and some so minimal that they
can easily be overlooked, but all demanding, sooner or later,
to be recognized (i.e., assessed) and dealt with (i.e.,
managed). Risks seem like the invisible radio signals that fill
the air around us, some clear and some very faint, but all want
to be heard. (16:26)
We view taking risks as foolhardy, irrational, and to be
avoided. Training children to avoid risk is an all-important
duty of parenthood. Risks imposed on us by others are
generally considered to be entirely unacceptable.
Unfortunately, life is not like that. Everything we do involves
risk. There are dangers in every type of travel, but there are
dangers in staying home--40 percent of all fatal accidents
occur there. There are dangers in eating—food is probably
the most important cause of cancer and of several other
diseases—but most people eat more than necessary. There
are dangers in breathing—air pollution probably kills at least
10,000 Americans each year, inhaling natural radioactivity is
believed to kill a similar number, and many diseases are contracted
by inhaling germs. There are dangers in
working--12,000 Americans are killed each year in job-related
accidents, and probably 10 times that number die from
job-related illness. But most alternatives to working are even
more dangerous. There are dangers in exercising and
dangers in not getting enough exercise. Risk is an
unavoidable part of our everyday lives. Truly: Living is
Dangerous. (16:26-27)
Realistically, some mishap risk must be accepted. How much
is accepted, or not accepted, is the prerogative of
management. That decision is affected by many inputs....As
tradeoffs are being considered and the design progresses, it
may become evident that some of the safety parameters are
forcing higher program risk. From the program manager’s
perspective, a relaxation of one or more of the established
parameters may appear to be advantageous when
considering the broader perspective of cost and performance
optimization. The program manager frequently will make a
decision against the recommendation of his system safety
manger. The system safety manager must recognize such
management prerogatives. However, the prudent program
manager must make his decision whether to fix the identified
problem or formally document acceptance of the added risk.
An adjustment of the original parameters would be required.
Of course, the addition of personnel loss changes the picture
considerably. When the program manager decides to accept
the risk, the decision must be coordinated with all affected
organizations and then documented so that in future years
everyone will know and understand the elements of the
decision and why it was made. (37:1-7)
Quantitative Assessment. In any discussion of mishap risk
management and risk assessment, the question of quantified
acceptability parameters arises. While it is not impossible to
obtain meaningful results from such a program, care should
be exercised so that the program balance is not disturbed. In
any high-risk system, there is a strong temptation to rely
totally on statistical probability because it looks on the surface
like a convenient way to measure safety. Before embarking in
25
this direction, be sure that the limitations and principles of this
approach are well understood and that past engineering
experience is not ignored. Quantitative acceptability
parameters must be well defined, predictable, demonstrable,
and above all, useful. They must be useful in the sense that
they can be converted easily into design criteria. Many
factors fundamental to system safety are not quantifiable.
Design deficiencies are not easily examined from a statistical
standpoint. Additionally, the danger exists that system safety
analysts and managers will become so enamored with the
statistics that simpler and more meaningful engineering
processes are ignored. Quantification of certain specific
failure modes, which depend on one of two system
components, can be effective to bolster the decision to accept
or correct it. Be careful! Arbitrarily assigning a quantitative
measure for a system creates a strong potential for the model
to mask a very serious risk. (37:1-8)
In the design of certain high-risk systems such as nuclear
power or weapon systems, there is a strong tendency to rely
solely on statistical analysis. To program management, this
appears reasonable because it provides a convenient medium
to express safety in terms to which the uninitiated can relate.
One trap for the unwary is the failure of occurrence. On one
such program, risks with a probability of occurrence of 10 -42
were considered unacceptable! Let’s consider this in terms
that we can easily relate to—money. If it can be assumed that
a single dollar bill is three thousandths of an inch thick, the
probability of selecting that bill from a stack of bills, which is 3
inches high (or 1,000 dollars), is 1 X 10 -3 (or 1 chance in
1,000). One million dollars is a stack 250 feet tall. The
chance of selecting that single dollar bill from the stack is now
1 X 10 -6 or one chance in a million. When we go to 1 X10 -9 , or
one chance in a billion, our stack is now over 47 miles high.
One chance in a trillion--47,000 miles! When we talk in terms
of 1 X 10 -42 our stack probably won’t fit in the galaxy! The
probability of an undesired event approaches one occurrence
in many times the life of the universe. The point is that we
have to establish realistic, reachable safety goals so that
management can make intelligent decisions. In this particular
instance, the safety analysis dwelled upon the probability of
the impossible, and allowed a single human error, with a
probability of occurrence in the range of 1 X 10 -3 , to cause a
near disaster; mainly, because it was not a quantifiable
element. It is doubtful if the decision makers were fully aware
of the mishap risks they were accepting but were placated by
a large, impressive-looking number. (37:1-9)
General risk management principles are: (37:1-9 to 1-10)
a. All human activity involving a technical device or
process entails some element of risk.
b. Do not panic at every hazard; there are ways of
controlling them.
c. Keep problems in proper perspective.
d. Weigh the risk and make judgments according to
your own knowledge, experience, and program
need.
e. Encourage other program disciplines to adopt the
same philosophy.
f. System operations represent a gamble to some
degree; good analysis tilts the odds in favor of the
house.
g. System safety analysis and risk assessment does
not free us from reliance on good engineering
judgment.
h. It is more important to establish clear objectives and
parameters for risk assessment than to find a
cookbook approach and procedure.
i. There is no “best solution” to a safety problem.
There are a variety of directions to go. Each of
these directions may produce some degree of risk
reduction.