Accepted Manuscript

Calibration of risk matrices for process safety

Paul Baybutt

PII: S0950-4230(15)30035-8
DOI: 10.1016/j.jlp.2015.09.010
Reference: JLPP 3042

To appear in: Journal of Loss Prevention in the Process Industries

Received Date: 31 May 2015

Revised Date: 3 August 2015
Accepted Date: 16 September 2015

Please cite this article as: Baybutt, P., Calibration of risk matrices for process safety, Journal of Loss
Prevention in the Process Industries (2015), doi: 10.1016/j.jlp.2015.09.010.

This is a PDF file of an unedited manuscript that has been accepted for publication. As a service to
our customers we are providing this early version of the manuscript. The manuscript will undergo
copyediting, typesetting, and review of the resulting proof before it is published in its final form. Please
note that during the production process errors may be discovered which could affect the content, and all
legal disclaimers that apply to the journal pertain.
Highlights (for review)
ACCEPTED MANUSCRIPT

HIGHLIGHTS

Risk matrices are used commonly in process safety.

They must be calibrated with reference to appropriate numerical risk tolerance criteria but the calibration process is prone to errors.

PT
Calibration procedures are provided to guide the process and avoid errors.

RI
U SC
AN
M
D
TE
C EP
AC
*Manuscript
Click here to view linked References ACCEPTED MANUSCRIPT

CALIBRATION OF RISK MATRICES FOR PROCESS SAFETY

Paul Baybutt
Primatech Inc., Columbus, Ohio, USA
paulb@primatech.com

PT
Abstract

Risk matrices are used to rate and rank risks of hazardous events for processes.

RI
They provide for the lookup of the risk level for an event using its severity and likelihood

SC
levels which are estimated subjectively. Risk levels are associated with requirements for

risk reduction to achieve tolerable risk. Often, risk matrices are defined using numerical

U
values for event severity and likelihood levels. Therefore, the resulting risk levels

AN
denote numerical values of risk. Consequently, such risk matrices must be calibrated

with reference to appropriate numerical risk tolerance criteria, or process safety target
M
levels, to define appropriate risk reduction requirements. Calibration poses several

pitfalls for the unwary. Many practitioners are unaware of these pitfalls and use risk
D

matrices that are calibrated improperly producing incorrect risk reduction requirements.
TE

This paper describes how these pitfalls can be avoided and provides calibration
EP

procedures. Use of these procedures will help to avoid incorrect decisions on risk

reduction for processes.

C
AC

Key words: Risk matrix, risk rating, risk ranking, process hazard analysis, risk analysis,

process safety, risk tolerance criteria, process safety target levels.

1.0 Introduction

1
 ACCEPTED MANUSCRIPT

Risk matrices are used widely in process safety to rate and rank risks posed by

processes to help with decision making on risk reduction. For example, commonly they

are used in process hazard analysis (PHA) to rate the risks of hazard scenarios and

determine the need for risk reduction measures [1, 2].

PT
When the severity and likelihood levels of a risk matrix are defined in numerical

RI
terms, risk levels with numerical definitions necessarily result. Risk levels are

associated with requirements for risk reduction to achieve tolerable risk. Therefore, the

SC
numerical risks that are tolerated are clearly evident in the risk matrix and a valid basis

must be used when assigning risk reductions required by the matrix. Consequently,

U
such risk matrices must be calibrated by using appropriate numerical risk tolerance
AN
criteria as a reference point. The process of calibration entails deciding on a tolerable

risk value and defining required risk reductions in the risk matrix to achieve it.
M
Risk matrices are used with events for which a severity and likelihood can be
D

assigned. In the case of their application in PHA, the event is a hazard scenario. In this
TE

case, the risk tolerance criteria built into risk matrices must be for single hazard

scenarios. However, it is not possible to assign a risk tolerance criterion for a hazard
EP

scenario arbitrarily. Such criteria can only be assigned with reference to overall facility

risk tolerance criteria which are the only meaningful risk tolerance criteria that can be
C

specified empirically [3]. Note that it is erroneous to use overall facility risk tolerance
AC

criteria for individual hazard scenarios which would result in tolerating far more risk than

intended. The overall facility criteria must be allocated to the contributing scenarios. In

such cases, allocation must be part of the calibration process. Also, many overall facility

criteria are intended to include risk from all sources of all hazards in a facility, not just

2
 ACCEPTED MANUSCRIPT

process safety hazards. Thus, such criteria must be offset for contributions made by

non-process-safety hazards when used in process safety studies.

Calibration is susceptible to various pitfalls. They relate to the nature of risk

tolerance criteria and the nature of the events to which they are applied. The pitfalls are

PT
described and guidance is provided to help ensure calibration is performed correctly.

RI
The guidance was derived by applying key concepts in the field of risk tolerance criteria

to risk matrices and their use in process safety. Calibration is described for hazard

SC
scenarios but the discussion applies equally to other types of events.

Section 2 of the paper addresses the history of risk matrices in process safety.

U
The process of allocation and calibration of risk matrices is described in Section 3.
AN
Procedures for the calibration of risk matrices for individual and group risk to people are

described in Sections 4 and 5, respectively. Calibration for group risk for other types of
M
receptors is addressed in Section 6. Examples of risk matrices are discussed in Section
D

7 and conclusions are drawn in Section 8.

TE

2.0 Risk Matrices in Process Safety

EP

Most PHA studies performed today include risk ranking of hazard scenarios

using risk matrices. However, historically, risk ranking of hazard scenarios was not
C

part of PHA studies performed within the process industries using methods such as the
AC

Hazard and Operability (HAZOP) study and What-If analysis. Instead, decisions on the

need for risk reduction originally were made using engineering judgment. Other PHA

methods that were developed in the system safety field, such as Failure Modes and

Effects Analysis (FMEA) [4], used a criticality ranking and the concept of risk ranking

3
 ACCEPTED MANUSCRIPT

was introduced into the HAZOP and What-If methods beginning in the late 1980's when

commercial PHA software was first released. For example, the product suite

HAZOP-PC, WHAT-IF PC, PHA-PC, and FMEA-PC provided the ability to risk rank

hazard scenarios [5]. This was found useful when PHA began to be practiced more

PT
widely and its practitioners realized that a more objective basis than engineering

RI
judgment was needed for decision making on risk reduction measures.

Furthermore, the U.S. Occupational Safety and Health Administration=s (OSHA=s)

SC
process safety management (PSM) regulation, which became effective in 1992,

contains a regulatory requirement in paragraph 1910.119(e)(3)(vii) which states, AThe

U
process hazard analysis shall address a qualitative evaluation of a range of the possible
AN
safety and health effects of failure of controls on employees in the workplace@ [6]. The

preamble to the standard notes that this evaluation of the failure of engineering and
M
administrative controls is for the purpose of guiding decisions and priorities in planning
D

for prevention and control, mitigation, and emergency response. Risk ranking of hazard
TE

scenarios provided the means to do so. Subsequently, OSHA clarified that the use of

risk matrices is one way in which this requirement can be met [7].
EP

Little attention has been paid in the literature to the development and use of risk

matrices in process safety. Guidelines for hazard evaluation procedures from the
C

Center for Chemical Process Safety (CCPS) provide two examples of risk matrices and
AC

briefly describe their use in PHA studies [1]. However, the CCPS guidelines do not

address the construction or use of risk matrices.

Use of risk matrices finds favor because they appear to be simple to understand,

do not require specialized expertise, and are graphically appealing. However, there are

4
 ACCEPTED MANUSCRIPT

no industry or government standards for risk matrices for process safety. Consequently,

risk matrices are constructed intuitively but arbitrarily. Companies develop and use their

own risk matrices. Unfortunately, risk matrices often are flawed in various ways,

possibly because their development appears to be deceptively simple but is actually

PT
more complicated than it seems. Poorly designed risk matrices make the process of risk

RI
ranking difficult and produce risk estimates ill-suited for decision making. In particular,

there are pitfalls in the allocation and calibration process for risk matrices that often are

SC
unrecognized.

U
3.0 Allocation and Calibration for Risk Matrices
AN
Allocation involves estimating the number of hazard scenarios possible and
M
dividing an appropriate overall facility risk tolerance criterion by that number. The result

is an allocation of the overall facility tolerable risk to individual scenarios such that, if the
D

criterion is not exceeded by any scenario, the overall facility risk tolerance criterion will
TE

not be exceeded.

The estimation of the number of hazard scenarios depends on the level of detail
EP

used to define scenarios; the nature, scale, and complexity of the process; and the

range of hazards addressed [8]. These factors can be highly variable from one situation
C

to another. Also, many process facilities contain multiple processes and the overall
AC

facility risk tolerance criteria must be allocated using the total number of scenarios for

the facility, not any one individual process. Consequently, the allocation process is

challenging [3].

There are various types and forms of risk measures [8, 9] and they influence

5
 ACCEPTED MANUSCRIPT

calibration and allocation. In particular, both risk to individual receptors and groups of

receptors can be important. For example, both individual and group risk are important

for people [10]. Individual risk is the frequency at which an individual may experience a

given level of harm as a result of exposure to one or more hazards. Group risk is the

PT
relationship between frequency and the number of people in a given population

RI
experiencing a specified level of harm from exposure to one or more hazards.

Individual and group risk tolerance criteria specify limits for the risks to which

SC
individuals and groups of people are exposed. Individual risk criteria protect any single

individual from bearing too large a share of the risk. Group risk criteria protect

U
populations of people from bearing undue risk. The distinction between individual and
AN
group risk is less important for other types of receptors, such as equipment and

property, where the concern is not necessarily with the risk to an individual piece of
M
equipment or property but rather the cumulative, or group, risk for equipment or
D

property. The different nature of individual and group risk mandates that separate risk
TE

matrices are needed for each type.

The tolerable risk for each facility and process may vary and the number of
EP

hazard scenarios will vary for each facility and process. Consequently, risk matrices

must be calibrated for each facility and process for which they will be used. Thus, each
C

facility and process needs its own customized risk matrices.

AC

4.0 Calibration Procedure for Individual Risk to People

Risk matrices can be calibrated and individual risk to people allocated using the

following procedure which applies key concepts from the field of risk tolerance criteria to

6
 ACCEPTED MANUSCRIPT

risk matrices.

1. Select a reference risk tolerance criterion for the type of casualty of interest.

Casualty types may be, for example, a fatality, a hospitalization, a lost-time

injury, or a first-aid case. A reference risk tolerance criterion for individual risk is a single

PT
number, although often different values are used for different categories of people,

RI
such as facility employees and members of the public. For example, the maximum

tolerable individual fatality risk for facility employees from process safety hazards at a

SC
facility could be specified as 1 x 10-4 per year.

2. Make a conservative estimate of the maximum number of hazard scenarios that

U
contribute to the risk of casualty for any particular exposed person.
AN
A particular person may experience casualty by themselves or with other
M
people. Thus, both single and multiple casualty scenarios must be counted. For

example, it may be estimated that there are 20 hazard scenarios that contribute to the
D

fatality risk of the maximally exposed person. Conservative estimates favor high values
TE

for this number. Note that this number is not the same as the number of scenarios that

could cause the casualty of any exposed person which may be much higher.
EP

It is challenging for practitioners to estimate the maximum number of scenarios

that may cause the single casualty of one particular person. It is even more challenging
C

to estimate the number of multiple-casualty scenarios that could cause the casualty of
AC

the same person, especially as such scenarios often will originate not just within the

process in which the individual works but also within other processes at the facility.

Unfortunately, the numbers are largely guesstimates which may result in

under-specifying or over-specifying the scenario risk tolerance criterion.

7
 ACCEPTED MANUSCRIPT

3. Allocate the overall facility individual casualty risk tolerance criterion to hazard

scenarios.

The overall facility individual casualty risk tolerance criterion is divided by the

maximum number of scenarios that could result in the casualty of any one particular

PT
person. For example, 1 x 10-4 per year divided by 20 produces a tolerable individual

RI
fatality risk per hazard scenario of 5 x 10-6 per year. In constraining the risk of fatality

scenarios to this value, the sum of all the frequencies of any 20 fatality scenarios will

SC
not exceed the overall facility individual fatality risk tolerance criterion, thus ensuring

that the individual fatality risk tolerance criterion for the facility is not exceeded for any

U
person since no person is exposed to more than 20 scenarios.
AN
In some cases, there will be fewer scenarios that could result in the individual
M
casualty of particular people than for the maximally exposed person. Thus, the risk to

such people will be less than the individual risk tolerance criterion. Therefore, the
D

scenario risk tolerance criterion produced by the allocation process results in some
TE

people being exposed to a level of risk that may be below the criterion. This is true

particularly when the maximally exposed person is exposed to many more scenarios
EP

than other people.

Note that the criterion must be applied not only to all single casualty hazard
C

scenarios but also to all multiple casualty scenarios because they also contribute to
AC

individual risk. Therefore, in dealing with individual risk, there can be only one severity

level for each type of casualty. Thus, for example, all scenarios involving fatalities use

the same criterion regardless of the number of fatalities involved. It is not correct to

have multiple severity levels for different numbers of the same type of casualty when

8
 ACCEPTED MANUSCRIPT

using individual risk.

4. Use this criterion as an anchor value to determine the required risk reduction for

casualty scenarios with other likelihoods.

The risk of casualty scenarios with frequencies at or below the criterion is

PT
tolerable, while, as the frequency of a casualty scenario increases, the amount of risk

RI
reduction required increases (see Figure 1). Often, risk matrices employ likelihood

levels with frequencies that differ by an order of magnitude. Consequently, required risk

SC
reductions change by an order of magnitude as the frequency level changes for a

particular severity level.

U
This procedure must be repeated for all casualty types of interest. However,
AN
reference values for tolerable risk for casualty types other than fatalities are not readily
M
available. Consequently, an approach used by some practitioners is to base them on

fatality risk criteria using multiplicative adjustment factors. Values can be chosen by
D

equating a certain number of lesser human impacts, such as hospitalizations, with a

TE

fatality. The use of factors of 10 is useful in that it corresponds to the reductions in

scenario frequencies that typically are used. Of course, this practice is highly subjective
EP

and involves a value judgment that will vary for different people. However, there is no

need to set non-fatality risk tolerance criteria in this way if empirical data are obtained in
C

a similar way to how fatality criteria were developed [11]. The calibration of risk matrices
AC

and the allocation of criteria do not depend on the source or values of the criteria used.

An implicit assumption is made when using fatality risk as a reference point for

other types of casualty. The maximum number of scenarios that can produce one of the

lesser casualties effectively is assumed to be the same as the maximum number of

9
 ACCEPTED MANUSCRIPT

scenarios that can produce a fatality. However, this is not likely to be the case.

Conventional wisdom suggests that there will be more scenarios that result in a lesser

casualty for an individual. Thus, higher risk than appropriate may be tolerated for lesser

casualty scenarios if such criteria are used. Of course, multiplicative factors could be

PT
used to set tolerable risk criteria for calibration purposes and estimates of the number

RI
of scenarios that cause lesser casualties used for allocation.

Often, different individual risk tolerance criteria are applied to people in different

SC
categories, such as facility personnel and members of the public, who may be exposed

to process safety risks. Furthermore, the number of scenarios that impacts the

U
maximally exposed individual in each category likely will differ. Consequently, separate
AN
risk matrices are needed for individual risk for different categories of people with their

own calibrations and allocations.

M
D

5.0 Calibration Procedure for Group Risk to People

TE

Risk matrices can be calibrated and group risk to people allocated using the

following procedure which applies key concepts from the field of risk tolerance criteria to
EP

risk matrices.

1. Select a reference risk tolerance criterion for the type of casualty of interest.
C

Typically, group risk is expressed as a F-N curve which displays the cumulative
AC

frequencies of N or more casualties summed for all events that lead to N or more

casualties [8, 9]. F-N curves are referred to as limit lines when they are used to express

a group risk tolerance criterion [12]. Usually, group risk is not addressed for non-fatality

casualties. Setting such criteria using fatality criteria as a reference point suffers from

10
 ACCEPTED MANUSCRIPT

similar problems as for individual risk tolerance criteria.

2. Allocate group risk tolerance criterion to hazard scenarios.

Allocation of limit lines to hazard scenarios must be performed for all values of N.

Limit lines may be expressed for ranges of value of N in a form similar to a histogram.

PT
In such cases, allocation is performed for each set of values of N within each range.

RI
Allocation of risk tolerance criteria directly from F-N limit lines to individual hazard

scenarios is problematic. F-N limit lines constructed for fatalities display the tolerable

SC
frequency for one or more fatalities, two or more fatalities, etc. Thus, reference points

taken from F-N limit lines represent cumulative risks summed over multiple different

U
values of N. Allocation using an F-N limit line would take the value for each cumulative
AN
number of fatalities read from the limit line as a reference criterion for allocation to all

scenarios that result in that number or more fatalities by dividing its value by the
M
estimated number of such scenarios. Thus, scenarios involving multiple fatalities would
D

be subject to multiple criteria as they would have to meet the allocated criteria for one
TE

or more fatalities, two or more fatalities, etc. Also, the number of scenarios for each

cumulative number of fatalities will vary, further complicating the process.

EP

An alternative approach is to use reference points for specific values of N rather

than for cumulative values of N by converting F-N limit lines to f-N form which display
C

the frequencies of all events that result in N fatalities [8, 9]. Thus, group fatality risk in
AC

f-N form denotes the tolerable frequencies for which any one person, any two people,

etc. may suffer fatality. For example, the tolerable group risk of a single fatality in a

11
 ACCEPTED MANUSCRIPT

facility using the limit line (50, 2 x 10-4, -1)1 would be 5 x 10-3 per year. Note that this

value is the tolerable frequency of all single fatalities that can occur in a facility. In other

words, a group risk tolerance criterion is being set for groups of one. This criterion is not

the same as an individual fatality risk tolerance criterion which is the maximum tolerable

PT
frequency with which any one particular person may suffer fatality.

RI
Next, the number of scenarios that can cause any single fatality must be

estimated. The overall facility single fatality group risk tolerance criterion is divided by

SC
this number to produce a value for the tolerable group risk for a single fatality for a

scenario. While there may be, say, 20 scenarios that could cause the fatality of one

U
particular person, generally, there will be many more scenarios that could result in the
AN
fatality of any single person in a facility, say 1,000. Using this number and the reference

criterion specified above, the tolerable group risk for a single fatality for a scenario is 5 x
M
10-6 per year. In constraining the frequency of all single fatality scenarios to this value,
D

the sum of all their frequencies will not exceed the overall facility group risk tolerance
TE

criterion for a single fatality.

The same calculation is repeated using reference points taken from the f-N curve
EP

for other values of N and estimating the number of contributing scenarios for those

values (see Figure 2). Note that the number of scenarios is specific to and likely
C

different for each value of N. Generally, as the value of N increases, it can be expected
AC

that the number of scenarios decreases. In Figure 2, the numbers of scenarios for

higher N values have been reduced by an order of magnitude for each increase in the

1
The notation represents a F-N limit line for which F = 2 x 10-4 at N = 50 with
slope -1.

12
 ACCEPTED MANUSCRIPT

value of N by an order of magnitude. Of course, the actual numbers of scenarios will

vary for each facility. Unfortunately, generally the values of tolerable risk produced will

not differ by simple factors of 10. Consequently, in such cases, risk matrices cannot be

displayed as cleanly as in Figure 2. Even this risk matrix uses an approximation to

PT
designate severity level 1and likelihood level 4 as tolerable to maintain symmetry.

RI
Group criteria obtained by allocation from f-N limit lines are applied to scenarios

based on their consequence severities (values of N) with the advantage that a single

SC
criterion is applied to each scenario. Only scenarios with the same number of fatalities

contribute to the group risk for each severity level. The need to allocate risk tolerance

U
criteria across scenarios with different numbers of casualties that is necessary for
AN
individual risk does not arise in the case of group risk allocated using f-N limit lines

except for scenarios within a range of casualty numbers when ranges are used rather
M
than individual values of N.
D

In the latter case, the maximum number of scenarios that produces any of the
TE

values of N within the defined range for a severity level must be used in the allocation

process with the risk criterion for the highest N value within the range which is the most
EP

stringent criterion. The resulting tolerable risk criterion must be applied to all scenarios

with values of N within the range. Of course, this approach produces conservative
C

results for those scenarios with N values for which there are fewer scenarios than the
AC

maximum number within the range.

3. Use this criterion as an anchor value to determine the required risk reduction for

fatality scenarios with other likelihoods.

The risk of fatality scenarios with frequencies at or below the criterion is

13
 ACCEPTED MANUSCRIPT

tolerable, while, as the frequency of a fatality scenario increases, the amount of risk

reduction required increases (see Figure 2). Usually, risk matrices employ likelihood

levels with frequencies that differ by an order of magnitude. Consequently, required risk

reductions change by an order of magnitude as the frequency level changes for a

PT
particular severity level.

RI
A risk matrix for group fatality risk contains only fatalities and no other types of

casualties (see Figure 2). If group risk were to be used for other types of casualties,

SC
separate risk matrices would be needed. Group risk tolerance criteria may need to be

scaled across and within facilities [4]. Also, group risk tolerance criteria can be

U
partitioned between different categories of people, for example, facility personnel and

members of the public.

AN
M
6.0 Calibration Procedure for Group Risk for Other Types of Receptors
D

For hazard scenarios that produce impacts on other types of receptors, such as
TE

property or the environment, their severity often is judged in terms of financial impacts.

An F-N limit line and corresponding f-N curve for increasing financial impacts can be
EP

utilized. It is calibrated and allocated in a similar way to group risk for people.

Calibration of risk matrices for both individual and group risk can incorporate the
C

As Low As Reasonably Practicable (ALARP) principle using de manifestus and de

AC

minimis criteria [13, 14]. When risk criteria are allocated to other types of events, such

as hazardous events, the estimated number of those events must be used when

calibrating risk matrices.

14
 ACCEPTED MANUSCRIPT

7.0 Discussion of Risk Matrix Examples

Figure 1 shows an example of a risk matrix for individual risk. It uses four

severity levels ranging from first-aid cases to fatalities. Five likelihood levels are used

ranging from five occurrences every 10 years to 5 occurrence every 100,000 years. The

PT
matrix has been calibrated using a maximum tolerable individual fatality risk of 1 x 10 -4

RI
per year and assuming 20 hazard scenarios contribute to the fatality risk of the

maximally exposed person.

SC
The matrix is used to rank scenarios that involve one or more of each casualty

type. Thus, the same criterion is applied to events that involve fatalities of a single

U
individual as for multiple individuals, hospitalizations of a single individual as for multiple
AN
individuals, etc., and there is only one ranking for each type and level of casualty
M
regardless of the number of people involved. For example, a scenario that involves a

single fatality (severity level 4) and that occurs with a likelihood level of 2 requires risk
D

reduction by a factor of 10. Similarly, a scenario that involves multiple fatalities (also,
TE

severity level 4) and that occurs with a likelihood level of 2 requires risk reduction by a

factor of 10. Each type of casualty is treated separately.

EP

Figure 1 shows that as the frequency of a scenario increases above the tolerable

risk for the casualty type of the scenario, the required risk reduction increases.
C

Similarly, as the frequency of a scenario decreases below the tolerable risk for the
AC

casualty type of the scenario, no reduction is needed and the risk is tolerable.

Figure 2 shows an example of a risk matrix for group risk. Group risk matrices

use a single casualty type, usually fatalities, for all severity levels. The example uses

four severity levels ranging from a single fatality to 1,000 fatalities. Seven likelihood

15
 ACCEPTED MANUSCRIPT

levels are used ranging from one occurrence every 100 years to one occurrence every

100 million years. The matrix has been calibrated using the limit line (50, 2 x 10-4, -1)

and assuming 1,000 scenarios may produce a single fatality, and the number of

scenarios producing higher numbers of fatalities decreases by an order of magnitude

PT
as the number of fatalities increases by an order of magnitude.

RI
The matrix is used to rank scenarios that involve scenarios with the same

number of fatalities. For example, any scenario that involves a single fatality (severity

SC
level 1) and that occurs with a likelihood level of 6 requires risk reduction by a factor of

100. Similarly, any scenario that involves 100 fatalities (severity level 3) and that occurs

U
with a likelihood level of 6 requires risk reduction by a factor of 10,000.
AN
Figure 2 shows that as the frequency of a scenario increases above the tolerable

risk for a particular number of fatalities, the required risk reduction increases. Similarly,
M
as the frequency of a scenario decreases below the tolerable risk for a particular
D

number of fatalities, no reduction is needed and the risk is tolerable.

TE

Often, stricter risk tolerance criteria are established for members of the public

than for facility employees. Furthermore, the number of scenarios affecting different
EP

categories of people will vary. Thus, separate calibrations and risk matrices are needed

in such cases for both individual and group risk. The same is true for different
C

processes and different facilities. Even though the same risk tolerance criteria may be
AC

used, the number of scenarios used in the calibration process may well differ.

Note that individual risk and group risk cannot be addressed using the same risk

matrix. Two different risk matrices are needed for each category of people addressed.

Thus, four matrices are needed if facility employees and members of the public are

16
 ACCEPTED MANUSCRIPT

considered separately.

8.0 Conclusions

Risk matrices that utilize numerical severities and frequencies must be calibrated

PT
with reference to appropriate numerical risk tolerance criteria or process safety target

RI
levels for facilities. Many practitioners are unaware of pitfalls involved in the calibration

process and use risk matrices that are calibrated improperly producing incorrect risk

SC
decisions. Pitfalls that largely are unrecognized were identified and calibration

procedures that avoid them were provided.

U
Separate calibrations and risk matrices are needed for individual and group risk
AN
for different categories of people such as facility personnel and members of the public.
M
Risk matrices must be calibrated for each facility and process and each consequence

and casualty type of concern. When risk matrices are used to judge the tolerability of
D

events such as hazard scenarios, calibration must also include the allocation of overall
TE

facility risk tolerance criteria to individual events. Current practices usually do not

address all of these issues. However, use of the calibration procedures provided in this
EP

paper addresses the issues and will help to avoid incorrect decisions on risk reduction

for processes.
C

Companies should develop risk matrices that produce consistent risk ratings
AC

across all their processes and facilities to encourage consistent decisions on risk

reduction.

References

17
 ACCEPTED MANUSCRIPT

1. Guidelines for Hazard Evaluation Procedures, 3rd Edition, Center for Chemical
Process Safety / American Institute of Chemical Engineers, New York, NY, 2008.

2. P. Baybutt, Analytical Methods in Process Safety Management and System

Safety Engineering B Process Hazards Analysis, in Handbook of Loss Prevention
Engineering, J. M. Haight (ed), Wiley-VCH, Weinheim, Germany, 2013.

PT
3. P. Baybutt, Allocation of risk tolerance criteria, Process Safety Progress, 33 (3),
pages 227B230, September 2014.

RI
4. MIL-STD-1629A, Military Standard, Procedures for Performing a Failure Mode,
Effects and Criticality Analysis, Department of Defense, Washington, DC,1980.

SC
5. P. Baybutt and T. Marshall, "Software Tools for Hazard Analysis", Spring AIChE
National Meeting, New Orleans, Louisiana, March, 1992.

6. Process safety management of highly hazardous chemicals, 29 CFR 1910.119.

U
7. AN
OSHA letter to Mr. R. Harmon, Industrial Consultants, February 1, 2005,
www.osha.gov.

8. Guidelines for Developing Quantitative Safety Risk Criteria, Center for Chemical
M
Process Safety / American Institute of Chemical Engineers, New York, NY, 2009.

9. Guidelines for Chemical Process Quantitative Risk Analysis, 2nd Edition, Center
D

for Chemical Process Safety / American Institute of Chemical Engineers, New

York, NY 2000.
TE

10. Reducing Risks, Protecting People, United Kingdom Health and Safety
Executive, HSE Books, Sudbury, UK, 2001.
EP

11. The Tolerability of Risk from Nuclear Power Stations. UK Health and Safety
Executive, HMSO, London, UK, 1988, Revised 1992.

12. D. C. Cox and P. Baybutt, Limit Lines for Risk, Nuclear Technology, Vol. 57,
C

pages 320 - 330, June 1982.

AC

13. P. Baybutt, The ALARP Principle in Process Safety, Process Safety Progress,
Vol. 33, Issue 1, Pages: 36B40, March 2014.

14. P. Baybutt, Setting multinational risk tolerance criteria, Process Safety Progress,
DOI: 10.1002/prs.11708.

18
TE
D
M
AN
U
TE
D
M
AN
U