“f

AH

1

AFaaupa

pT

B

0d

process safety and environment protection 8 7 ( 2 0 0 9 ) 21–25

Contents lists available at ScienceDirect

Process Safety and Environment Protection

journa l homepage: www.e lsev ier .com/ locate /psep

Total risk of death”—Towards a common and usable basisor consequence assessment�

ndrew G. Rushton ∗, David A. Carterazardous Installations Directorate, Health and Safety Executive, Merseyside, UK

a b s t r a c t

Assessment of the risk of exposure to a “dangerous dose” (DD) is the basis of the UK Health and Safety Executive’s

HSE’s current risk assessments for land-use planning (LUP). Some years ago, a hybrid approach using both DD and

“significant likelihood of death” (SLOD) was proposed as an improvement, but was not adopted.

Here, an alternative, weighted multiple threshold approach, provisionally titled “total risk of death” (TROD), is

described. TROD improves the comparability of assessed risks from diverse hazards. This is achieved by first per-

forming assessments for more than one threshold of consequence (such as DD assessment and SLOD assessment).

The predicted risk for each threshold is then combined into a single risk value (at a specified location) by weighting

the contributions to risk according to the predicted consequences for each threshold.

This paper makes the case, in principle, for using TROD and illustrates how TROD values are constructed.

TROD overcomes some of the objections that have barred progress to more widespread use of risk assessment, it

is more comparable between different installations and hazards than DD, it is more sensitive than SLOD and more

adaptable than probits (which can introduce a false sense of precision). It could support more direct comparison

with other risks (e.g. everyday risks and transport risks) in the future.

The appropriate “weightings” for addition of risks predicted for different consequence thresholds (contributing

to TROD) are discussed here. A three-threshold scheme for evaluation of TROD is described. The thresholds are DD

(assumed to approximate to a dose leading to ∼1% fatal consequences or LD1), LD10, and SLOD (∼LD50).

TROD has been used in HSE sponsored research and in HSE’s exploration of societal risks.

Crown Copyright © 2008 Published by Elsevier B.V. on behalf of The Institution of Chemical Engineers.

All rights reserved.

Keywords: Risk assessment; Land-use planning; Harm criteria; Risk criteria; Fatal risk profile

advice zones. This paper makes the case, in principle, for using

. Introduction

ssessment of the risk of exposure to a “dangerous dose” (DD;airhurst and Turner, 1993) is the basis of many current riskssessments for land-use planning (LUP) by the UK’s Healthnd Safety Executive (HSE). Some years ago, a hybrid approachsing both DD and “significant likelihood of death” (SLOD) wasroposed as an improvement, but was not adopted (Franks etl., 1996).

Here, an alternative, weighted multiple threshold approach,

rovisionally titled “total risk of death” (TROD), is described.ROD aims to improve the comparability of risk assessments

� The views expressed in this document are the opinions of the auth∗ Corresponding author at: Chemical Industries Strategy Unit (CI4), Hazootle Merseyside, L20 7HS, UK.

E-mail address: andrew.rushton@hse.gsi.gov.uk (A.G. Rushton).Received 19 February 2008; Received in revised form 11 July 2008; Acce

957-5820/$ – see front matter. Crown Copyright © 2008 Published by Elsevier Boi:10.1016/j.psep.2008.07.001

for diverse hazards. This is achieved by first performingassessments for more than one threshold of consequence(such as DD assessment and SLOD assessment). The pre-dicted risk for each threshold is then combined into a singlerisk value (at a specified location) by weighting the contribu-tions to risk according to the predicted consequences for eachthreshold.

Use of TROD would cause some disruption to existing prac-tice and policy, including some established risk-based siting

ors and may not represent the official position of HSE.ardous Installations Directorate, HSE, 5S2 Desk 2, Redgrave Court,

pted 14 July 2008

TROD and illustrates how TROD values can be constructed, butdoes not explore implementation other than in general terms.

.V. on behalf of The Institution of Chemical Engineers. All rights reserved.

22 process safety and environment pr

Nomenclature

Di the consequence severity of scenario i at a spec-ified location (% fatality)

fi the frequency of scenario i (cpm)F(D) the cumulative frequency of scenarios leading

to a consequence severity of D or >D for a par-ticular location (cpm).

R(DD), R(10), R(SLOD) the risk values evaluated for dan-gerous dose (or worse), 10% fatality (or worse)and significant likelihood of death (or worse),respectively for a particular location (chancesper million per year, cpm)

Wi weights for summation

lations handling flammable materials that the precise point

TROD overcomes some of the objections that have barredprogress to more widespread use of risk assessment, it is morecomparable between different installations and hazards thanDD, it is more sensitive than SLOD and more adaptable thanprobits (probability units). It could also provide for more directcomparison with other risks (e.g. everyday risks and transportrisks) in the future.

The appropriate “weightings” for addition of risks predictedfor different consequence thresholds (contributing to TROD)are discussed here. A three-threshold scheme for evaluation ofTROD is described. The thresholds are DD (assumed to approx-imate to a dose leading to ∼1% fatal consequences or LD1),LD10, and SLOD (∼LD50).

TROD has been used in HSE sponsored research (Quinn andDavies, 2004) and in HSE’s exploration of societal risks (Fowleret al., 2004).

2. Background

The concept of SLOD (significant likelihood of death) wasdeveloped as part of HSE’s work to develop quantitative riskassessment (QRA) methodology for pipelines and fixed instal-lations handling flammable materials (Franks et al., 1996). Itappears to have been argued that using SLOD would makerisks from toxic and flammable hazards more comparable andwould also chime with the approach taken in industry, insome other sectors and in some other nations (where it isthe practice to use “risk of death” as the “currency” of riskassessment).

HSE’s current criteria for setting risk-based zones forLUP development control are: 10 (inner zone), 1 (middlezone), and 0.3 (outer zone); calculated as chances per mil-lion per year (cpm) risk to a hypothetical house resident(with specified behaviour and vulnerability) of exposure to adangerous dose or worse (HSE, 1989; the “Risk Criteria docu-ment”).

HSE contemplated, but did not deploy, a revised hybridapproach to setting advice zone boundaries. For this hybridapproach mixed criteria would have been applied (inner zoneat 5 cpm SLOD, middle zone at 0.4 cpm SLOD, outer zone at0.4 cpm DD) and, where necessary, borderline cases wouldhave been assessed using SLOD in scaled risk integral (SRI) cal-culations (Carter, 1995). The intention, at the time, was thatthis new approach would be run in parallel with the exist-

ing DD approach, with conflicts between the new and the oldbeing reviewed.

otection 8 7 ( 2 0 0 9 ) 21–25

The SLOD/DD hybrid approach was trialled but notadopted. Reasons may have included: lack of added value toassessment of typical toxic risks; lack of confidence that SLODrepresents flammable hazards in a way that makes them com-parable with toxic risks; the messiness of using both SLOD andDD to set zones.

Franks et al. concluded that SLOD and DD are strongly cor-related for typical toxic risk assessments, so there is probablylittle to be gained from revising many toxic assessments to useSLOD criteria instead of DD.

Later on, briefly, this paper deals with the question ofwhether SLOD values are any more comparable than DD val-ues (and, therefore, extendable to other hazards and additivebetween different hazards). The arguments set out below sup-port the view that SLOD (used as a single threshold) does nothelp very much in making risk values more comparable.

The messiness of using both SLOD and DD to set zones was,perhaps, the principal problem. A move to the SLOD/DD hybridwould not leave DD behind, and so would complicate explana-tion of HSE’s approach to external ‘stakeholders’ (developers,local planning authorities, etc.).

3. What’s wrong with dangerous dose (andSLOD)?

It is useful to revisit the question which apparently prompteddevelopment of SLOD: “What is it about DD (which appears tohave served us well in toxic risk assessment) that prevents itstransfer to flammable hazards?”.

The key weakness of DD is well known and is explicitlydescribed in the Risk Criteria document. In essence, it is thatDD risk values do not distinguish between scenarios in whicha range from about 1% to 100% fatalities may occur; that isthe risk is calculated as the chance per million that in thenext year the notional individual at the specified location willexperience the dangerous dose or worse.

The Risk Criteria document states (paragraph 53a) “It wouldbe misleading to describe a risk as 10 in a million per year of a‘dangerous’ dose when this may include, say, 8 in a million per yearrisk of an overwhelmingly fatal dose, since the latter would actuallydominate the risk of death.” HSE’s use of DD assessments, and theimplicit assumption that these are not misleading, relies uponit being in the nature of typical toxic scenarios that the risksof worse than a dangerous dose are consistently distributed,so the ‘or worse’ element does not greatly bias the values forcomparability between cases.

The risk criteria document goes on to say that typically the“risk of receiving a somewhat higher dose which would be expectedto result in the death of 50% of the population” contributes aboutone third to the typical DD risk value. If this is interpretedas “death of 50% or more”, i.e. SLOD, then this is essentiallythe conclusion reached by Franks et al. in their correlationbetween DD and SLOD:

R(SLOD) = R(DD)1.11

2.59(1)

where R(SLOD) and R(DD) are the risk values (in cpm) evaluatedfor dangerous dose (or worse) and SLOD (or worse), respec-tively.

It appears to be typical of pipelines and some fixed instal-

raised in the Risk Criteria document can apply; that is to say,“risk of death” contributes much more than one third to the

t prot

tv

baebfrricpdca

flt

4T

Ttre

R

wt

t

Slt

teswuslmwn

ttbf

ma(drtt

c

process safety and environmen

ypical DD risk value. Pipeline assessments can give SLOD riskalues of around 0.75–0.8 of the DD values.

It is attractive to consider that SLOD (in isolation) offers aetter way to compare toxic and flammable risks because itpparently addresses the “or worse” element of the risk. How-ver, whilst SLOD reduces the range of scenarios that are noteing distinguished, SLOD is not conceptually much differentrom DD, it just sets a different consequence threshold. SLODisk values do not distinguish between scenarios in which aange from about 50% to 100% fatalities may occur. This ranges an improvement, but a limited improvement, on the rangeovered by DD. However, SLOD used in isolation would down-lay scenarios in which there is much predictable injury andeath but no exposures above the SLOD threshold. As dis-ussed above, the use of a hybrid SLOD/DD approach, whichims to overcome this problem is awkward.

Another major difficulty in frequency assessment ofammable hazards, which is not discussed here, is the uncer-ainty of ignition locations and probabilities.

. A weighted multiple threshold approach:ROD

he DD risk value is, in a typical case, a summation of con-ributions from different scenarios which are modelled in theisk assessment (e.g. tank failure, holes, delivery hose failure,tc.), i.e.,

(DD) = f1 + f2 + f3 . . . (2)

here R(DD) is the final risk value and fi is the frequency con-ributed by scenario i.

SLOD risk values are composed similarly, using a higherhreshold of interest (∼LD50).

In a simple case, therefore, the difference between DD andLOD risk values can be interpreted as a difference in the

ist of scenarios which lead to a dose exceeding the relevanthreshold in each case.

A weighted total risk value can be composed by addingogether the values obtained by each of several thresholdvaluations (e.g. WDDR(DD) + WSLODR(SLOD). . .). By appropriateelection of the weights (Wi) attached to each threshold, theeighted risk value can be chosen to provide a summary eval-ation of the risk which is more comparable between diversecenarios or hazards. That is to say, the objective risk at twoocations where the weighted total risk value is the same is

ore similar than would usually be the case for two locationshere the risk value based on a single threshold criterion isominally the same.

Here a weighted multiple threshold approach, provisionallyitled “total risk of death” (TROD), is described. So far, threehresholds of consequence (or nominal harm criteria) haveeen used in exploratory work, though this could be variedor other hazards, where appropriate.

TROD aims to improve the comparability of risk assess-ents for diverse hazards. This is achieved by first performing

ssessments for more than one threshold of consequencesuch as DD assessment and SLOD assessment). The pre-icted risk for each threshold is then combined into a singleisk value (at a specified location) by weighting the contribu-ions to risk according to the predicted consequences for each

hreshold.

The way in which a weighted summary risk value can beomposed has been described. For a suitable choice of the

ection 8 7 ( 2 0 0 9 ) 21–25 23

weights, this weighted summary risk value will approximateto the expectation of death at a specified location (in a notionalmillion years, if cpm risk values and appropriate fractionalweights are used). On this basis the new summary risk valueis provisionally titled the “total risk of death” (TROD) and canbe calculated in cpm.

As for DD and SLOD, TROD values can be evaluated fora single scenario or, by summation, for a number of scenar-ios. Unlike DD or SLOD, TROD can be summed or compared(with more confidence) for different hazards (from one or anynumber of installations).

The next section sets out how a TROD value is produced.

5. Composition of a “total risk of death”(TROD) risk value

Ideally, site-specific risk assessments would generate, formany scenarios, a frequency and consequence severity.

Let fi be the predicted frequency (cpm) contributed by sce-nario i.

Let Di be the (modelled) consequence severity of scenario iat a specified location. For simplicity (setting aside non-fatalconsequences for the moment) the value of Di can be the pre-dicted fraction of exposures at the specified location which areexpected to be fatal, i.e., a Di value of 0.1 would apply to a sce-nario in which 10% of people at the specified location wouldbe expected to receive fatal exposure.

5.1. Construction of “FD” or “fatal risk profile” curves

With a set of such data, a composite curve of fi against thevalue of Di can be produced so that F is the cumulative fre-quency of events predicted to have consequences more severethan those indicated by the value of D. As the set of scenariosand their modelling becomes more comprehensive (i becomeslarger) then the composite curve would approach a “true” F(D)curve (or “FD” curve) characterising the risk from the specifiedhazard at the specified location. Integration of the F(D) curvewould give a number characterising the total risk of death,termed here “R(TROD)” (expressed as an expectation of deathin one [million] year[s]). R(TROD) can be estimated from thearea under the composed F(D) curve as

R(TROD) =∑

fiDi (3)

A simple illustrative curve composed from data for fourscenarios is given in Fig. 1. For a trivial case, where this curverepresents the risk at all locations in a small populated areawhich is the only populated area, then the curve has the sameshape as a frequency–number [of casualties] (FN) curve (withthe maximum number of fatalities, or ‘Nmax’, being the sameas Dmax multiplied by the total population). It follows that theFD curve being discussed here can be considered as a kind ofFN density at a point.

The shape of the true F(D) curves (and their distributionaround the hazard location) is a characteristic of the partic-ular hazard and is termed here (for D associated with a fatalconsequence) the “fatal risk profile” of the hazard(s) at thespecified location.

As F cannot decrease as D decreases, then F reaches a max-

imum value at the lowest value of D considered. As the rangeof D is 0–1, then the value of F at the lowest value of D is anupper bound on R(TROD), the integral, as defined by Eq. (3).

24 process safety and environment protection 8 7 ( 2 0 0 9 ) 21–25

Fig. 1 – F(D) composite curve for a location: D, fraction ofpopulation affected (or probability of effect); F, cumulative

Fig. 2 – Schematic “Fatal risk profile”(FD curve) with Rvalues: D, fraction of population affected (or probability ofeffect); F, cumulative frequency of events with D > Di; R(DD),R(10), R(SLOD) ∼ risk (frequency) of 1%, 10%, 50% or morefatality.

frequency of events with D > Di; showing R(DD) ∼�fi forD > 0.01.

5.2. How dangerous dose (DD) and significantlikelihood of death (SLOD) relate to the fatal risk profile

The dangerous dose is approximately a dose which will leadto 1% fatality (i.e. D ∼ 0.01). The risk of dangerous dose is cal-culated as the sum of the frequencies of scenarios leading toexposure to the dangerous dose or worse.

Thus, in relation to the scenarios described above and illus-trated in Fig. 1, the risk of dangerous dose (or worse) is givenby

R(DD) =∑

fi for Di ≥ 0.01 (4)

Fig. 1 shows how R(DD) relates to the composite F(D) curve.The scale in the figure is distorted to aid presentation.

If, in evaluating R(TROD), the consequences are limited toevents corresponding to the dangerous dose or worse (i.e. sce-narios in which Di < 0.01 are disregarded) then R(DD) is anupper bound on R(TROD).

It follows that R(DD) is a good surrogate for R(TROD) whencomparing risks with similar fatal risk profiles.

The risk of significant likelihood of death is given, similarly,by

R(SLOD) =∑

fi for Di ≥ 0.5 (5)

R(SLOD) is also a good surrogate for R(TROD) when compar-ing (or summing) risks with similar fatal risk profiles (but isinsensitive to scenarios where Di < 0.5).

5.3. How TROD estimation can be based oncomposition of data in a fatal risk profile, as representedby DD, TROD and other risk values

The practical approach developed so far has used three levelsof consequence severity: R(DD), R(10) and R(SLOD), where R(10)is the cumulative frequency of scenarios with an expected 10%fatality or worse.

Fig. 2 shows an illustrative fatal risk profile and how thethree data values might fit the curve (if the many scenariosconsidered were to give a profile approaching a continuum).

TROD can now be estimated from any set of the three

risk values by assuming a shape of the fatal risk profile. Anyassumed shape for a real fatal risk profile will introduce biasbetween assessments of those hazards which do and those

hazards which do not fit the assumed shape (leading to lackof comparability from case to case). A fairly neutral (but, ofcourse, approximate) assumption of the shape is illustrated inFig. 3 and allows a simple estimate by “trapezium” integrationof R(TROD) which should not be unduly (or too inconsistently)optimistic or pessimistic.

R(TROD) = 0.5R(SLOD)2

+ 0.4(R(SLOD) + R(10))

2

+ 0.09(R(10) + R(DD))

2+ 0.01R(DD); or

R(TROD) = 0.45R(SLOD) + 0.245R(10) + 0.055R(DD)

(6)

This treatment accepts a truncation error for D < 0.01 (by ineffect setting fi = 0 for all D < 0.01). This truncation error maybe significant in unusual cases (e.g. persistent toxics) but is inany case perhaps beyond practical evaluation.

The weights implied by Eq. (6) (WDD = 0.055, W10 = 0.245,WSLOD = 0.45) have been derived on the assumption that riskdata is in a cumulative form, so that, for example, R(DD) isthe risk of a dangerous dose or worse including worse thanLD10 (or SLOD). Alternative weights apply if risk values are inincremental form.

Fig. 3 – R(TROD) estimation, by trapezium: D, fraction ofpopulation affected (or probability of effect); F, cumulativefrequency of events with D > Di.

t prot

5p

Irdttimmcosl

bborcsrtd

ubpwaptcdtat

rstastsc

Development of an intermediate societal risk methodology

process safety and environmen

.4. Impact of weighted multiple threshold criteria onast practice and policy

t has been claimed that for typical toxic installations theisks of worse than a dangerous dose are fairly consistentlyistributed. “Typical” here means in effect pressure liquefiedoxic gases (because these dominated HSE’s early interest athe time of writing of the Risk Criteria document (HSE, 1989). Its reasonably likely, therefore, that the adoption of a weighted

ultiple threshold criterion, such as TROD, would requireinimal changes of previous practice and policy where this

laim is true. Other toxic substances (e.g. evaporating poolsf liquids which do not boil at ambient conditions and sub-tances dispersed or produced by fire) can be “atypical” in thisimited sense.

New threshold values for fixing siting advice zones woulde required for use in future assessments, but these coulde chosen to give zones broadly consistent with the thresh-lds used for existing DD assessments. In most cases theisk-based zones already established (for “typical” toxic sites)ould be left alone (because, in these cases, the benefit ofwitching to TROD is low). In those cases where zones wereevised, then the revision could be justified as explicitlyaking account of the case-specific contribution of “risk ofeath”.

In this paper one set of thresholds and weights has beensed, but in principle different weights or thresholds coulde chosen for different hazards (where this would aid com-arability). This might be appropriate for particular caseshere the F(D) curve is more complex (e.g. explosion haz-

rds). This paper has concentrated on “risk of death”, but, inrinciple, the weights could be modified to allow for varia-ion in the predicted extent of permanent disability or lesseronsequences (e.g. where atypical percentages of permanentisability are expected at LD10). Unlike probits or other func-ional approaches, TROD is readily adaptable, in principle, tony shape of F(D) curve. However TROD is broadly conformableo these other approaches.

In principle, use can be made of probit relationships (rep-esenting the complete dose–response curve for a hazardousituation) where they are available. Some authors will choosehat option whenever possible. However probits are not alwaysvailable and do not provide an appropriate relationship forome hazards (e.g. oxygen enrichment) or where there are

hresholds for different modes of harmful effect (e.g. explo-ion overpressure). The approach described here could, ofourse, be extended to probits, but can also be adapted to

ection 8 7 ( 2 0 0 9 ) 21–25 25

other dose–response data (not necessarily using the illustratedthresholds of 1%, 10% and 50% fatality).

The over-liberal use of probits can place too much relianceon extrapolation of data and/or inappropriate interpolation ofdata, so giving a false impression of accuracy.

6. Conclusions

The concept of TROD and elements of its practical use havebeen outlined.

The underlying idea of a fatal risk profile (FN densityat a point) has been presented (and is implied in probitapproaches).

TROD can be viewed as an adaptable model for linking afew threshold assessments into a composite “risk of death”.

TROD overcomes some of the objections that have barredprogress to more widespread use of risk assessment, it is morecomparable between different installations and hazards thanDD, it is more sensitive than SLOD and more adaptable thanprobits (in principle, though this is not much exploited in theimplementation illustrated here, where the modelled fatal riskprofiles are relatively smooth).

The use of different weights (and thresholds) for hazardswith different characteristics might be justifiable where athree-point estimate (DD, LD10 or worse, and SLOD) is notconsidered acceptable.

References

Carter, D.A., (1995). The Scaled Risk Integral—A Simple NumericalRepresentation of Case Societal Risk for Land Use Planning in theVicinity of Major Accident Hazards, Loss Prevention in the ProcessIndustries (Elsevier, Amsterdam), pp. 219–224

Fairhurst, S. and Turner, R.M., 1993, Toxicological assessments inrelation to major hazards. J Hazard Mater, 33: 215–227.

Fowler, A.H.K., Reston, S.D., Carter, D.A., Quinn, D.J. and Davies,P.A., 2004, QuickFN—a less resource intensive methodologyfor determining the magnitude of societal risks at majoraccident hazard installations, In Hazards XVIII, IChemESymposium Series No. 150 , pp. 627–634.

Franks, A.P., Harper, P.J. and Bilio, M., 1996, J Hazard Mater, 51:11–34.

HSE., (1989). Risk criteria for land-use planning in the vicinity of majorindustrial hazards. (HMSO).

Quinn, D.J. and Davies, P.A., 2004. HSE Research Report RR283,

(An investigation of FN curve representation), available athttp://www.hse.gov.uk/research/rrhtm/rr283.htm.