Finally, the area under the F/N curve provides the total risk in terms of expected fatalities per year. In many respects, this single number is very useful for comparative purposes but is not generally used.

The concept of F/N curves is laudable. They allow for the presentation of high frequency/low consequence and low frequency/high consequence accidents on the same graph, they allow the tolerability of the risks to be judged and they allow the total risk to be expressed as a single number.

Unfortunately, the beauty of the concept is not carried through simplicity and ready understanding. F/N curves are anathema to the explanation of risk.

It is far too complex a concept to be of any use in explaining risk to a wider audience and even most professionals have difficulty. The use of log/log scales is an immediate barrier and should be used only for risk practitioners. Equally, the frequencies are often written in scientific notation which even many practising engineers rarely use.

However, the greatest failing of F/N type criteria for comparing risks is that there is no concept of the size of the risk. It cannot be placed in the hand the way one would pick up a stone and judge its weight. There has to be a better measure. Societal risk is too intangible for the public to grasp.

The two aspects we strive to get across are:

• the totality of the risk
• the likelihood of the high consequence events (tens and hundreds of fatalities)

The UK Health and Safety Executive and the UK rail industry have recently sought to move away from Societal Risk criteria as expressed by Societal F/N curves and sought to set criteria which express society's horror at large consequence accidents, such as the Ladbroke Grove rail disaster in 1999 which killed 31 people and injured many more.

For example, the Channel Tunnel Rail project has eschewed F/N curve criteria for societal risk and preferred to set design safety values on large consequence accidents as shown in Table 3 below.

Table 3: CTRL Societal Risk Criteria

One of the causes dearest to the UK population's heart at the moment is the delay in the introduction of automatic train protection (ATP) on the network. Previous studies had shown that the benefit, in terms of lives saved, would not be worthwhile. This decision was based upon a cost benefit analysis of the cost of introducing the system based upon the cost of every life which the ATP system (which prevents trains going past signals at danger) would save.

There is no reason to believe that this analysis was not carried out in a dispassionate and professional manner and the conclusions were genuine. It was based upon a value preventing a fatality (VPF) and so effectively values a hypothetical human life in millions of pounds. Clearly the value decided by the courts varies according to age, earning capability, dependants etc. but this is too complex for cost benefit analysis.

In healthcare, the age of the patient is always known and so it is possible to make decisions as to whether an operation is worthwhile for an individual. For example, it is rare to provide more than two hip replacements for anyone under the UK National Heath scheme. So, if your second hip replacement wears whilst you are still alive, it is very unlikely you will be given at third.

The cost benefit process is generally applied in the National Health Service as a help to making expenditure decisions and it has clearly been applied so some aspects of rail safety.

Since Ladbroke Grove, the political will has changed and the original cost benefit analysis conclusions have been overturned. The UK is also now using a more sophisticated cost benefit analysis where the value of preventing a fatality (VPF) is currently L1.24 million per equivalent fatality for single fatalities but L3.46 for multiple fatalities (Ref. 4) or where the risk are close to intolerable.

4 Final Remarks

The authors have been through various considerations regarding use of the most popular risk measures in the safety practice such as individual and societal risk. In this context a very important role in the decision management system is played by the criteria adopted for deciding whether a risk is unacceptable, tolerable or broadly acceptable. In practical terms there are two measures, which are to be used when assessing risk, and which are then subsequently compared with criteria established, i.e. individual and societal risk.

The framework makes clear that

• both the level of individual risks and the societal concerns engendered by the activity or process must be taken into account when deciding whether a risk is unacceptable, tolerable or broadly acceptable.
• HSE has proposed numerical criteria for informing decisions on the tolerability of risks only for very limited categories of risk, for example, those entailing fatalities either individually or in multiple fatality accidents

The authors would also like to endorse a concluding remark from the 'Societal Risks Report (Ref. 3)

"... while we see a continuing useful role for the expression of 'simple' societal risks as curves on an FN diagram, and for application of societal risk criteria as guidelines, we stress that these techniques should not be seen as over-endowed with either scientific provenance or moral justification."

Our conclusion is that the criteria may not be perfect but they do provide a useful framework for helping to make decisions on risk tolerability. Perhaps the greatest challenge is to involve the general public in this process and to ensure that the come to understand the process and see that their perceptions play just as important a part as numerical risk analysis.

References

1. Reducing Risks, Protecting People - HSE's decision making process, 2001, HSE Books, UK

2. The tolerability of risks from nuclear power stations, 1992 (revised version), London HMSO

3. Societal Risks - Report prepared for the HSE by D J Ball and P J Floyd, 1998

4. Railway Group Safety Plan, 2002/2003, Railway Safety