Options: Reducing Risk

“To have constructive conversations about … options, one needs to take a calm look at the numbers.”  — David J.C. MacKay

In addition to the usual hazards found in all jobs—transportation related fatalities, workplace violence, and slips, trips, and falls—the chemical process industries have three special hazards to worry about: fires, explosions, and toxic releases. These are recognized, and we are obliged to protect our workers from them. What that means, though, is worth discussing.

Options

Rarely is there just one option to reduce risk from a particular hazard. After a specific hazard is identified, the first objective of a risk assessment is to determine what the risk of that hazard is and whether it is too high. When it is too high, the next objective consists of proposing as many options as possible to reduce the risk to a tolerable level. That includes confirming that any proposed risk reduction measure actually reduces the risk of the hazard. It is possible to propose a risk reduction measure that doesn’t really help, or worse, to propose a risk reduction measure that introduces a new hazard making the overall risk worse.

When there is more than one option, any of which will reduce the risk to a tolerable level, the one to choose is the one that has the lowest cost, both in terms of implementation and ongoing operation and maintenance. There is no virtue in spending more than necessary.

An example: Sampling well-side oil storage tanks

NPR’s “Morning Edition” ran a story a couple of years ago about oilfield workers dying while taking samples and checking volume atop well-side oil storage tanks. The story reported that over a period of six years, nine truck drivers died after climbing up on the catwalk to open the thief hatch to dip their sample bottles into the tank and then manually lowering a level stick into the tank to check the volume.

The story made a convincing case that they were overcome with vapors that had collected in the headspace of the tank, arguing that the vapors not only caused chemical asphyxiation because of their toxicity, but were also capable of displacing enough air in the vicinity of the hatch to cause simple asphyxiation as a result of low oxygen concentration. The story went on to report on a few suggestions for addressing the hazard.

One approach the story suggested was automated level monitoring, the cost of which the story reported as $2,000 per tank. However, there were objections from the Bureau of Land Management, which is concerned that automated instrumentation is not as accurate as having a driver measure volume by eye, especially because this measurement is done for the financial purposes of custody transfer.

Another suggested approach was outfitting each driver with air-supplying respirators that also purified toxic vapors.

An approach favored by the companies that operate these tanks was to have drivers open the thief hatch and then allow the vapors to disperse before pulling the samples and measuring the level.

Consider the benefit

This is the point at which a risk assessment is important. The NPR piece identified a hazard and it described the impact severity of that hazard. It never addressed risk. In the absence of a risk assessment, any decision to act will be based on emotion and opinion. Emotion and opinion are cheap; actually addressing hazards requires thoughtful consideration.

The vast majority of drivers atop well-side oil storage tanks perform their tasks with no ill effect. The benefit of a risk reduction measure would be reducing the fatality rate of this task from 1.5 fatalities per year for all drivers. A review of publicly available data shows that this rate is already about 20 times lower than the fatality rate associated with driving to and from the wells, but there is no outrage over the transportation fatalities. As tempting as it may be to assert that the fatality rate is not significant—either in terms of the absolute rate or as a contributor to the overall fatality rate for drivers—the nine fatalities each represented a significant loss to their families.

This begs the question: how much lower is low enough? No risk reduction measure is perfect, so there is no risk reduction measure that will reduce the fatality rate to zero. A measure that lowers the risk by a factor of 10 would give a fatality rate for working at the thief hatch of 0.15 fatalities per year, about 200 times lower than driving; a measure that lowers the risk by a factor of 100 would give a fatality rate for working at the thief hatch of 0.015 fatalities per year, about 2,000 times lower than driving.

Let’s assume that thoughtful consideration leads us to believe that reducing the fatality rate for working at the thief hatch to 0.15 fatalities per year, about 200 times lower than driving to and from well-side oil storage tanks, is low enough. That means that well-side oil storage tanks need a risk reduction measure that reduces risk by a factor of 10.

How much risk reduction do measures provide?

Different types of risk reduction measures provide different amounts of risk reduction. Generally, administrative controls reduce risk by a factor of about 10. No matter how well designed the administrative control is, it still relies on being properly executed by a person, and people aren’t perfect. Administrative controls can include wearing special PPE like a respirator, or carrying out special procedures, such as allowing vapors to clear after opening a hatch.

Automated systems also reduce risk, also by a factor of about 10, but only if they address the hazard. An automated solution would have to address the entire hazard—automating the level measurement in a way that satisfies everyone concerned with custody transfer, but also collecting representative samples from unstirred tanks. Automation engineers are very clever, however, and they might be able to come up with something.

The three options each provide the same benefit—a risk reduction factor of 10. So, which to choose?

The automated solution

It would take very clever automation engineers to come up with a design that does everything that needs to be done for the $2,000 installation cost reported by NPR. Taking maintenance and training costs into account, it would have an annualized cost of about $1,000 per year. This is the point in the analysis where someone feels compelled to ask the maddening question: “Well, isn’t a life worth a $1,000 per year?” Of course it is, especially if it is your life and someone else is spending the $1,000 per year. But the question isn’t about $1,000 per year.

If we knew in advance which tanks would be associated with a fatality and could avoid that fatality by spending $1,000 per year on that tank, the decision would be a no-brainer. Even the most callous, selfish executive in the country would spend $1,000 per year to avoid a certain fatality, if only to avoid the paperwork involved. But since we don’t know which tanks may be involved in a fatality, we would have to install one on each tank. While the NPR piece reported that there are 83,000 oil wells on public lands, there are more than 600,000 oil wells throughout the industry. At an average of two tanks per well (some have just one, some have as many as four), that works out to over $1.2 billion per year to automate the tanks. This would reduce the fatality rate while taking samples and checking levels in oil storage tanks from 1.5 fatalities per year to 0.15 fatalities per year.

That means that this approach would cost nearly $900 million per fatality avoided.

What about respirators?

Respirators also help, but are not panaceas. Breathing through a respirator imposes a burden on the body. Additionally, people’s faces aren’t all the same shape, so not all respirators fit all people. As a result, OSHA forbids the use of respirators without initial and periodic fit testing, medical testing, inspections, and lots of paperwork. This means that purchasing a respirator is just a small part of the cost of a respirator program.

All drivers would need to be equipped with an appropriate respirator, one that supplies air and protects against toxic exposure. Accounting for the annual fit testing, the annual medical examinations, and the other expenses associated with a respirator program, the cost would be about $6,000 per year per driver. With 150,000 drivers, the annual cost is $900 million per year, or almost $700 million per fatality avoided.

Better procedures?

While the companies that operate these tanks want to implement improved procedures, there is more to this than simply telling drivers “be careful and stand downwind.” This is especially true if there is to be any credit taken for risk reduction. When companies want to take credit for risk reduction from a procedure, they must put the procedures in writing, validate it, and then train drivers on the procedure and on the hazards against which the procedure protects. They must confirm the effectiveness of the training, which means written tests and observations. This is for both initial training and periodic refresher training. They must also periodically check the effectiveness of the procedure. It is only when a company does all these things that they can take credit for an order of magnitude risk reduction.

Therefore, even credit for improved procedures doesn’t come without cost. There is the cost of developing the procedures and of training every driver on the procedures. There is also the cost of a driver’s time to execute the procedure at each storage tank. An estimated cost for all involved companies to develop training and keep their drivers trained is around $30 million per year. An estimated cost of the extra time drivers will have to spend at wells carrying out the procedure of waiting for the vapors to clear is around $50 million per year. The total annual cost comes to about $60 million per fatality avoided.

But how much lower is low enough?

Given the three options—automation at $900 million per fatality avoided, respirators at $700 million per fatality avoided, and risk-reducing procedures at $60 million per fatality avoided—it seems reasonable to conclude that risk-reducing procedures are the best option.

But it still begs the question: how much lower is low enough? How much should be spent to avoid a fatality? No organization, no industry, no society operates with unlimited resources. The amount to spend to avoid a fatality is something about which reasonable people disagree, but I don’t know anyone who would peg the figure at $1 billion, even when it isn’t their money that’s being spent.

The world can be a safer place, and it should. Nonetheless, there are more effective ways to spend a billion dollars to save lives. Improved road safety, for instance. Spending a $100 million to avoid a fatality probably doesn’t make sense either. Many people would still balk at $10 million. Somewhere, though, there is an amount that would make sense, at least to many people. Until we talk about it and agree to it, though, we’re left to make those decisions on our own, knowing that we may be second-guessed by a jury or regulator.

What to do?

For all of us, the first thing to do is to recognize and acknowledge the hazards to which our processes expose us and get on with efforts to address them. The second thing to do is to address them by considering measures that actually reduce the risk, ignoring dread and outrage, and evaluate those options. The final thing to do is to follow through with the risk reduction measures that make the most sense. We’re scientist and engineers. We can do this.

This blog is based on an earlier version, “Reducing Risk in the Chemical Process Industries”, posted on 21-Apr-2016 by Elsevier in Chemicals & Materials Now!