The Illusion of Risk Control: What Does it Take to Live With Uncertainty?

Front matter

SPRINGER BRIEFS IN

APPLIED SCIENCES AND TECHNOLOGY - SAFETY MANAGEMENT

MIO

Contents

Gilles Motet

Ove Njå, Øivind Solberg and Geir Sverre Braut

3 A Conceptual Foundation for Assessing and Managing Risk, Terje Aven

Chapter 1 Uncertainty: New Perspectives, Questions and Proposals Gilles Motet

Abstract Safety is ensured when hazardous circumstances, their consequences and their controls are known. How then, in uncertain contexts can safety be defined and achieved? Uncertainty raises new questions and needs new approaches for dealing with safety. These are introduced in the first chapter and developed throughout the book.

Keywords Uncertainty - Safety 1.1 Uncertainty: A New Perspective on Safety

The term “technological risk” was initially associated with the occurrence of unwanted circumstances (e.g. leading to accidents) which are both possible and probable. “Possible” expresses the fact that these circumstances are known and enumerable; “probable” means that these circumstances may arise in the future. These circumstances are described, for instance, by combinations of events or by sequences of events (scenarios), or both. In the context of safety, the considered circumstances inevitably lead to harmful events (accidents) when these circumstances arise (the deterministic approach to risk assessment). If all the circumstances are known, treatments can be defined a priori. Barriers prevent the occurrence of accidents by avoiding the occurrence of undesirable combinations or by neutralizing dreaded sequences of events. In this paradigm, safety is defined by the absence of such circumstances and by the absence of accidents, and is guaranteed by the presence of risk controls (barriers).

An adaptation of this viewpoint, called the “probabilistic approach to risk assessment”, involved a change to the assumption that the circumstances considered by risk analysts always lead to accidents, by attaching a probability to the appearance of harm. Furthermore, the harm caused is no longer assumed to be constant for the same circumstances. For example, the failure of a system component does not always lead to the system’s failure; the consequences of the failure may be more or less serious. Risk, or rather its estimation, is then defined using criteria such as a combination of the

G. Motet (BX) INSA. LAAS-CNRS, Université de Toulouse, Toulouse, France e-mail: gilles.motet @insa-toulouse.fr

© The Author(s) 2017 1 G. Motet and C. Bieder (eds.), The Illusion of Risk Control, Safety Management, DOI 10.1007/978-3-319-32939-0_1

2 G. Motet probability of the occurrence of a harmful event and the severity of the harms. Safety is defined by the absence of unacceptable risk, usually expressed as a threshold (e.g. probability of a catastrophic failure <10~° per flight hour). This viewpoint is the most commonly used today. Safety is still achieved by the introduction of barriers, whose availability (measured by the probability of failure) intervenes in the evaluation of residual risk. This value is compared with the maximum level of risk allowed (the acceptability threshold). While all accidents are not avoided, their risks are controlled.

However, these two viewpoints on risk and safety are only variations on the same underlying paradigm: the circumstances that may lead to accidents are known, as are their possible effects: causes and consequences are enumerable, even if they are probable and not certain. The risk controls (and therefore the level of safety) can be defined a priori. If unforeseen circumstances arise, they are handled by “experience feedback” and added to the list of circumstances, which is considered as a finite set.

We are currently facing a challenge to this founding paradigm of risk and safety, having to admit that the circumstances (such as initiating events and scenarios) which may lead to accidents are uncertain and potentially infinite. Our ignorance of causes (circumstances), effects (harms) and their relationships is primarily quantitative in nature. This ignorance concerns, for instance, the difficulty in determining the probability of occurrence of events (causes and effects), the effectiveness of the barriers and the severity of consequences. Our ignorance is also, even more importantly, qualitative. This concerns, for example, our inability to establish an exhaustive list of circumstances which may lead to accidents, as this list is not finite in complex systems. Similarly, the nature of the effects of certain circumstances (in particular medium- and long-term effects) cannot be predicted given the state of knowledge (e.g. emerging risks related to innovation). This paradigm shift has impacts on the concept of safety which has to be revisited, but also other related concepts such as risk acceptability and their operational implementations (models, techniques, processes, practices, cultures, etc.).

Until now, most approaches have aimed at reducing and finally liquidating uncertainty, being based on the illusory hope of the contribution of knowledge development. Other approaches consist in forbidding any circumstances that lead to increased uncertainty (e.g. certain applications of the precautionary principle). They have all proven unsuccessful, leading to dramatic accidents. The inability to nullify this uncertainty and the need to live with it must be accepted: such is the new premise.

However, the results of uncertainties on safety must not be considered as inevitable effects of fate that we have to suffer. Uncertainty gives a new perspective on safety.

1.2 Uncertainty: New Questions for Safety Management

Risk management has long been considered the magic wand to address safety. The growth of knowledge would lead to the disappearance of uncertainties and the development of fully controlled risks. This would promise the achievement of our objective: a safe world. Yet, it seems that in a number of accidents, risk management

1 Uncertainty: New Perspectives, Questions and Proposals 3 was not up to the challenge. What challenge? Dealing with the unexpected? Yet, the unexpected is now acknowledged as being unescapable...

Before going any further, it is worth going back to the notion of unexpected. Why is the unexpected? Several philosophies exist. Because no one put sufficient effort into anticipation is one of them. No one had the proper knowledge to anticipate some scenarios is another one. Who by the way is a question that would be worth addressing? Is it the first line operator who faced the real-time situation? Or the organization that provides the operators with the means and conditions to do their job? Or the risk manager who is in charge of identifying all risks and reducing the unacceptable ones? Or everyone, each one at his/her level and within his/her scope?

Going back to the initial question of the origin of the unexpected, is it a crisis of means allocation or of profound beliefs...? Or illusions? The illusion that everything can be controlled, including all risks.

To describe or explain these new situations that escape traditional risk management approaches, a new “magic” concept was introduced: uncertainty.

Beyond the magic word, what does the concept mean? What can it describe... and not describe?

Has dealing with uncertainty ever been within the scope of traditional risk management methods? If yes, what type of uncertainty did it pretend to address?

Are there alternative approaches that would work beyond the scope of traditional risk management?

If yes, how do these approaches relate to risk analysis?

Should we oppose them? Can they coexist? Under what conditions? Can we envisage their complementarity? How to build it?

1.3 Uncertainty: New Proposals

This book addresses various facets of the previous questions, proposing several viewpoints considered by various disciplines.

In Chap. 2, Ove Nja discusses the concept of uncertainty, analyzing its ontological status and its connections to safety. The chapter introduces the whole rationality spectrum (from relativism to positivism) of the uncertainty concept, focusing on its impact on the safety concept. This introduction also discusses a number of philosophical issues. The purpose is illustrated on safety concerns of the health sector and civil aviation.

The three following chapters deal with the control of effects of uncertainty.

In Chap. 3, Terje Aven presents and discusses recent advances in the risk field faced with uncertainty, linked to the conceptualization of the risk and specially addressing unforeseen events, surprises and so-called black swans. It shows how the traditional probabilistic approaches can be extended for assessing and then for handling uncertainties in the safety domain.

In Chap. 4, Jean Pariès extends the previous chapter discussing the way safety can be managed in an uncertain context. He highlights the illusion of reducing uncertainty

4 G. Motet and introduces and compares two management alternatives: Resilience engineering and High Reliability Organizations.

Nowadays, society through regulation requires safety cases. In a well-defined context, evidence must be provided to obtain an authorization to operate hazardous activities. Uncertainty disrupts this principle. In Chap.5, Arie Rip develops, in a sociological perspective, the idea that regulation and other a priori risk controls are all part of the “danger culture” of our industrial society which requires conformance to rules for avoiding accidents. The chapter shows that uncertainty simultaneously jeopardizes this approach and, by allowing “gray zones” in which the actors can manoeuvre, provides some necessary flexibility to the system.

Chapter 6 examines risk governance in an uncertain context from a legal perspective. Eric E. Johnson considers the catastrophic possibility that the superconducting synchrotron particle accelerator built at CERN could create a black hole which would swallow the Earth. Courts have the power to order the halt of such an activity, but their usual approach to decisions on risky activities, based on expert judgment and benefit-cost criteria, are difficult to apply in situations in which possible consequences are properly cataclysmic and experts are all biased. The chapter analyzes a number of court decisions to extract general opinions about the way justice considers uncertainty in the safety domain.

Chapter 7 gives a historian’s perspective. Jordan Sand compares the way in which the Japanese handled fires during the Edo period (from 1600 to 1868) and their present approach to technological risks, with a particular focus on the Fukushima nuclear disaster. The comparison reveals that the emphasis during the Edo period on strength and continuity of the social order rather than on the preservation of material property produced a different view of risk and uncertainty.

A last chapter concludes the book, summarizing the lessons learned and highlighting some open questions.

Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter’s Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter’s Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

Chapter 2 Uncertainty—Its Ontological Status and Relation to Safety Ove Nja, Øivind Solberg and Geir Sverre Braut

Abstract The concept of uncertainty is difficult to comprehend, even when we restrict our focus to safety science. In a world with various scientific philosophical stances, “uncertainty” is debated in various contexts. However, in an effort to go deeper into a more basic understanding of uncertainty our knowledge is quickly challenged. What exists? How do we know what exists? What can we know about it? Aiming these questions at uncertainty reveals that interpreting uncertainty as existing in any ontological sense is difficult to defend. Does this imply that uncertainty can only be understood in an epistemological sense or merely as a construct? Epistemological understandings of uncertainty encompass, in principle, the whole rationality spectrum from relativism to positivism, thus not excluding any form of analyses or understanding of uncertainty. However, we recognize the need for an increased understanding of which elements the uncertainty concept comprises, and possible consequences of an unreflective discarding of elements. Within the framework of a linear time concept consisting of the past, the present and not least the future, we claim that uncertainty’s ontological status exists on various levels. In the present uncertainty is a purely epistemological category, and in the past uncertainty has its meaning related to what has been observed, recognized and comprehended, thus a methodological challenge. In the futuristic perspective uncertainty exists and cannot be reduced.

Keywords Uncertainty - Ontology · Epistemology - Safety - Risk

The copyright to third-party material quoted in this chapter is property of its respective owners and is not included in the Creative Commons license for this chapter.

O. Njå (BX) - Ø. Solberg - G.S. Braut University of Stavanger, Stavanger, Norway e-mail: ove.njaa@uis.no

© The Author(s) 2017 5 G. Motet and C. Bieder (eds.), The Illusion of Risk Control, Safety Management, DOI 10.1007/978-3-319-32939-0_2

The rational actor paradigm is often used as a basis for decision making under uncertainty. Proponents of this paradigm consider the uncertainty concept to be something outside the risk concept [10]. Other researchers include the concept of uncertainty as an integral part of the risk concept, where risk is defined as “observable quantities and their associated uncertainties” under the context of a system or activity studied [2, 3]. Opposed to this there are researchers who relate uncertainty to accuracy of e.g. models, data and expert judgments [13]. However, there are very few concrete definitions of uncertainty applied in risk and safety analyses. Lipshitz and Strauss [11] offer interesting thoughts within the Naturalistic Decision Making-Paradigm, in which they relate uncertainty to individuals’ cognitive reasoning based on: inadequate understanding, incomplete information or undifferentiated alternatives. They claim that these uncertainties lead to different coping strategies amongst people involved in crisis management. Furthermore Taleb’s “black swan” metaphor has raised a vast number of studies trying to develop methodologies to cope with the phenomena of unknown unknowns.

A question worth raising is therefore: Does the safety, risk and uncertainty concepts applied to various infrequent phenomena make any sense in scientific perspectives?

2.1.1 From Risk to Uncertainty

Althaus [1] has presented a thorough analysis of various scientific disciplines’ perspectives on risk as depicted in Table 2.1.

Table 2.1 Extract of the analysis presented by Althaus

Discipline View on risk and safety Knowledge applied to the unknown (domain)

Logic and mathematics A calculable phenomenon Calculations and modeling

(method)

Principles, postulates and calculations (ontology, epistemology and method)

Science and medicine An objective reality

Social sciences

Economics

A cultural or societal phenomenon

A decisional phenomenon

Culture, social constructs, (epistemology and method) Decision-making theory and principles (epistemology and methods)

History and the humanities

As a story

Narrative (epistemology)

Philosophy

A problematic phenomenon

Wisdom (ontology, epistemology)

This table use a fairly large brush on each of the disciplines and treat them as uniform. Within the single disciplines there are of course different schools of thought and discussions, contributing to the continued development of each discipline.

For each discipline Althaus describes the related view on risk and what types of knowledge is applied to cope with what is termed the unknown. The brackets in the right column are added here as guide to which domain of world (or philosophy and science) this knowledge is related to according to our view. The different domains used are ontology, epistemology and method. Ontology and epistemology as presented in this article, and method as a domain not necessarily adhered to either ontology or epistemology, but an instrumental phenomenon aiming to produce valid argumentations.

When we use the term risk we relate to possible future events, something that has not happened yet, but might happen in the future. This something that might or might not happen often refers to an explicit danger and equally often does refer to an implicit reward. Typical examples of this can be: the risk of driving, the risk of flying, the risk of oil exploration in Northern Norway, the risk of transporting dangerous goods and so on. The challenge with the concept of risk is that risk is about the future. That is probably also the main reason for all the controversies and disputes over the concept of risk. Mastery of risk is the mastery of the all-time riddle: what will the future be like? In modern times, this has been modified to: what is most probable that the future would look like?

The main problem with this riddle is that our knowledge about the future in principle is zero. Anything could happen in the next instance. In current everyday language, many think of risk as synonymous with danger in the future, something to be avoided. This danger can also be seen as positive e.g. as a necessary component in an adventure. Another connotation that can be seen frequently is the adverbial risky with a meaning of probable; as in “it is risky”, meaning it is very likely to occur. For others risk can be a business opportunity that can be exploited to maximize gains. We also speak about different types of risk e.g. objective, subjective and perceived risk.

Risk has become an increasingly important concept in the globalized world. From being based on individual and locally based assessments, risk is now a central part of global discussions and a driver of research on life threatening issues, such as climate change, terrorism and epidemics. The concept of risk is used as a tool for experts claiming to possess superior knowledge of future threats.

However, risk deals with the core of probability theory. The concept of probability is clarified by adopting Pierre Laplace’s formulation of the mathematical theories of probability; “probability theory is only good sense reduced to calculus”. When theories of probability conflicted with the intuition of “reasonable men”, mathematicians went back to the drawing board and changed their theories: a clash between probability theory and intuition meant the theory was wrong, not the intuition.

Uncertainty in relation to the findings from risk analyses has become a much debated topic in the field of risk research. Pending how uncertainty is understood and used in risk analyses and risk management, uncertainty can be seen as something we can deal with and consequently reduce. The presumption is that if we have more knowledge, uncertainty could be further reduced. Consequently, the risk analyses will become more reliable and accurate, corresponding more to contents of and frequency of future events. The underlying idea is that if we had sufficient knowledge there would be no uncertainty and thus we would be able to foresee the future, something which of course is not possible (see Laplace’s Demon! ).

Different schools of thoughts meet these challenges differently. Watson [18] presented “The meaning of probability in probabilistic safety analysis” as the degree of belief and proposed it to be a dialectical debate over safety, which is in sharp contrast to those who believes that there is a true underlying risk in the world. The conflict has been very visible between those who view risk as relative frequencies (classical approach) and those who view probabilities (and risk) as a tool to express uncertainty (Bayesian approach). Typical for risk research and practical risk management has been that it is predominately pragmatic in developing risk models, data gathering and risk assessments, neglecting underlying philosophies of science.

2.1.2 The Connotation and Use of the Concept of Safety, Security, Risk and (un)Certainty

Before we discuss the concept of uncertainty, we take a brief look upon the current denotations and etymological basis for some commonly used words in safety management.

The words safe and safety most likely are brought into English via French (adj: sauf = without danger) from the Latin verb salvare, keep well, live well, save, and the corresponding noun salvus, whole, uninjured, intact, not infringed. It is claimed that it is possible to trace the word back to Sanskrit with similar connotations [7].

The original meaning of safety points at an ideal situation or state. This is also parallel to one of the connotations of the word in current English, where safety is defined as the condition of being safe. But according to the Concise Oxford Dictionary, it may also be used as a modifier denoting something designed to prevent injury or damage: a safety barrier. The Macmillan English Dictionary defines safety as the fact that a thing is safe to do or use, but also a place or a situation in which you are protected from danger or harm.

The word security stems from the Latin adjective securus which may have a variety of meanings. Ways of translating it into English are free of care, free from worries, happy or cheerful. It has been used in English from late 1500 [7]. At that point of time it replaced the word sikerte, which is related to the word sikkerhet (Eng. safety) in Scandinavian languages.

Throughout history, the term risk has had varying connotations and uses. Its origin can be traced from the Greek word rizha. It denoted something that extended from the trunk of a tree, like a root. Later on in Crete, the beach cliffs “roots” were

'Laplace’s Demon: a machine that has the capacity to know every detail about the existing world and its intrinsic cause-effect relations, and in addition holding the capabilities to calculate the future based on the preconditions.

given the same designation. It is not clear if these “roots” were seen as a danger for bypassing seafarers and thus were labelled a risk, but the word was used in Crete as a nautical expression, a metaphor for “difficult to avoid in the sea”. So it may have referred to sub surface (known and unknown) reefs and other types of obstacles that presented a danger if encountered. The word was later absorbed in Latin as the word for cliff (resicum, risicum), which is the origin of the Italian risco and rischio, which means danger or risk. In respectively French and Spanish risque and riesgo were used denoting a similar meaning as in Italian. English borrowed it from Spanish and German borrowed it from Italian. We think it is worth noting that these expressions were spread to different European languages in a time of daring and discovery of new seaways and continents. In the 16th century it seems that risk had a positive connotation. For example in middle-high-German, Rysigo (1507) was a technical term for business, with the positive connotation “to dare, to undertake, to hope for economic success”.

In the last decades the connotations of risk have become increasingly negative, risk equals dangers and hazards. This can also be seen in several current definitions of risk (examples), and also, as mentioned, in common language connotation. Another explanation for the negative connotation can be found in risks relation to the term hazard. Hazard has evolved from the Arabic al zahr, which means the dice. In Europe playing dice took on a negative connotation as dice games were seen as a possibility for being cheated by con artists. In English as a noun, hazard denotes danger but more interestingly as a verb it denotes to risk or expose to danger. This is the co-notational connection between the English words risk and danger. If nothing else, this shows that risk and danger are somewhat “related” through the word al zahr.

The words certainty and uncertainty appeared in English during the period 1300— late 1400 [7]. It came into English through French from Latin certanitatem, which means something that is given or cannot be doubted. Uncertain thus should signify something that can be doubted or discussed.

2.1.3 MSc Students’ Perception of Uncertainty When Studying Societal Safety at the University of Stavanger

In the period from 2009-2013, masters students studying societal safety in their second semester have been given a survey. The survey was presented for them when starting up a course in risk management containing the following questions:

1. Describe what you relate to the term uncertainty.

2. Discuss whether uncertainty is related to single persons, or whether groups or entire societies can be connected to uncertainty.

3. Can uncertainty be measured? How would you characterize degrees of uncertainty?

4. If you were asked to express uncertainty related to societal safety, what would you think of?

The response to the survey was organized with two or three students discussing and taking notes, and the responses were then discussed in plenary. There are 59 responses, which are all provided as bullet points or free text sentences.

In general the students listed more than three aspects of the term uncertainty in each questionnaire. The most prominent were firstly, an individual, subjective doubt or lack of knowledge. The second most mentioned characteristic was that uncertainty became related to future outcomes and predictions. Thirdly, uncertainty was closely related to probability, but some also mentioned risk. Furthermore, the students mentioned perceptions like fear and unknowns frequently.

Most of the answers described above were related to individuals, but when students were asked to relate uncertainty to various actors (individuals, groups or society), they usually listed all. However, the answers indicate that it was difficult for them to distinguish between societal systems and societal actors, and similarly for groups the discussions varied from risk exposure to group decisions.

Amongst the students there were a major confusion about measuring uncertainty, they were ambiguous both claiming that it was possible to quantify uncertainty and not. Some equaled uncertainty with probabilities, some claimed that uncertainties could be expressed by risk indices (fatal accident rates, potential loss of life, statistical variation etc.), while many related more qualitative interpretative values (minor, some, much, major) to uncertainty. When the students claimed that lack of knowledge was the premise for uncertainty, they also related psychological characteristics (cognitive, emotional), and even value based considerations (cost-benefit, preferences).

There were no tendencies seen in the students’ responses to uncertainty and society. Media communication, disagreement of priorities, disagreement in definitions, vulnerabilities, major accidental events, climate changes, emergency preparedness, diplomacy and politics were some concepts mentioned. Several described complexity as a characteristic that must be given attention when uncertainty should be related to societal safety.

The conclusion to this five-year survey is that even though the students think that uncertainty is an important concept for societal safety, there is no clarity what uncertainty is, how it should be expressed and with what measurement tools it should be considered. Students in 2013 were not different from students in 2009, the responses indicate major confusion about the uncertainty concept. Now we will discuss how uncertainty relates to the scientific stance of risk and safety.

2.1.4 Uncertainty and Its Relation to Risk Theory and Conceptualizations

A crucial issue of any interpretational approach with respect to a scientific theory is the relational elements of the theory on one hand and the elements of the domain of reality for which the theory is designed on the other. This so-called relation of reference cannot be exhaustively addressed within the scope of the scientific discipline concerned. For its proper discussion, genuinely philosophical issues must be taken into account explicitly. One of the most general demands on a sound philosophical discussion is the distinction between epistemological and ontological statements [4].

Most of the existing scientific and philosophical literature concerning the concept of uncertainty describes uncertainty in epistemological terms. The same can be said about textbooks concerning uncertainty analyses. Much of this literature reflects a normative approach, implicitly stating that the epistemology presented is the most appropriate for solving problems related to uncertainty analyses and decision-making. Seeking the ontological status of uncertainty may yield implications concerning epistemological claims about uncertainty. For example, if uncertainty does not exist as something that is objectively real it cannot be objectively measured as such. If uncertainty can be said to be objectively real it is not a logical or necessary consequence that uncertainty can be objectively measured. Take the core temperature of the sun. The physical state of the core of the sun is an ontological reality, and we can fairly accurately estimate its temperature according to our knowledge of the sun’s physical state, but we cannot actually measure the core temperature as such. Further if uncertainty is objectively real; can it be measured objectively?

If you sit in a chair reading, isn’t it most likely that you will be in the same situation in ten seconds from now given that you don’t choose to do otherwise?. That would be a reasonable assessment. But, it’s not absolutely certain that the status quo will be upheld. Someone could knock on your door, the phone could ring, the fire alarm might go off, or an airplane might crash into your building. The future is a myriad of different possibilities and thinkable outcomes, but just one is being forever manifest as we go from future, via present to past.

To be able to cope with this myriad of possibilities we need to control or at least attain some sense of control of future events. We do this by making choices. We choose amongst different alternatives of what we would like the future to be. We are constantly being faced with “small” and “big” choices, and we more or less consciously choose amongst the alternatives that present themselves relative to the different choices. The goal of choosing is to satisfy our moment-to-moment or long term needs by choosing the seemingly best (whatever best would mean) alternative at the moment.

The list of “small” and “big” choices that present themselves per day is huge. The choices imply that there are alternate ways of taking action, each action containing the possibility for both losses and gains. Future events, like it could start raining, or I could have an accident on my bike on my way to work, or the land slide occurring at the chemical plant site in 15 years are unknowns at the time of decision. We cannot foresee what all possible and relevant consequences of our choices will be. Nevertheless, we use the concept of risk to help us manage the alternatives that more or less present themselves. We manage risk by using the total sum of all our knowledge, experience and capacity for reasoning to make a decision. The decisions span wide, from the spur of the moment “small” decisions to “big” well considered decisions. We have the “small” minute-to-minute choices we make almost constantly, and the “large” risks as launching the space shuttle or deciding on building nuclear reactors and so on. The risk connected to the different choices can thus be labelled “small” or “large”, but seemingly small decisions can have the potential for large consequences and vice versa.