Introduction
The
Current Marine Safety Regime
Safety
in ships is to a large extent achieved by following rules, regulations or
guidelines governing their design and operation. The rules most directly concerned with human safety and
protection of the environment are in general agreed internationally through the
IMO. Rules for the structural strength,
systems and equipment required to make the ship “fit for purpose” are mainly
established by independent Classification Societies. On safety-critical structural issues, the International
Association of Classification Societies (IACS) provides common international
standards. These rules have been
developed incrementally over many decades, responding to accident experience,
and represent a massive accumulation of expertise in how to allow designers as
much freedom as possible while still achieving a good common level of safety.
While
safety levels at sea have in general improved in recent years, accidents still
occur, and some problems have become apparent with the current marine safety regime.
The system of international rule making is to a large extent reactive, responding to accidents rather
than proactively preventing them. It is vulnerable to rapid changes in ship
designs, which may introduce hazards not anticipated in the rules. The rules,
even when comprehensive, are not sufficiently transparent, and the purpose and relevance of individual rules is
often unclear. The process of developing the rules was insufficiently systematic, with no method of
prioritising on the areas where the greatest benefit could be achieved.
The
Origins of FSA
Several
major shipping accidents (notably the Herald
of Free Enterprise in 1987 and the Exxon
Valdez in 1989) prompted a re-evaluation of the marine safety regime. It
was contrasted unfavourably with that used in other industries, based on more
scientific safety management approaches such as risk analysis and safety cases
[2].
“Safety
Cases” identify the hazards faced by an individual ship and explain the safety
management measures adopted, in order to convince regulators, the workforce or
the public that the individual ship is safe. This approach is suitable for some
types of vessels, particularly those with unusual hazards, operating within
specific regions [3]. However, the varying ability to follow modern safety
management principles among shipping companies and maritime administrations is
widely believed to make Safety Cases inappropriate for internationally trading
ships.
Instead
of a safety case for each individual ship, the UK proposed that “formal safety
assessment” (FSA) should be used to provide a more systematic and proactive
basis for the IMO rule-making process. FSA included techniques of safety
assessment, such as hazard identification, risk analysis and cost-benefit
analysis, which were already being adopted by organisations in the marine
field, and this helped the approach gain international acceptance. In 1997, IMO
adopted guidelines for applying FSA [1] and has since been evaluating trial
applications of the technique.
DNV’s
Adoption of FSA
Det
Norske Veritas has been at the forefront of applying scientific approaches to
developing its classification rules, and was an early supporter of the FSA
initiative [4]. DNV recognises that FSA has the potential to improve the
transparency of its rules, and to help focus on the essential factors
protecting safety, property and the environment.
In
1998, building on previous initiatives, DNV initiated a dedicated research
project to develop a transparent and sound scientific basis for its Ship Classification
Rules and Procedures, and decided to use the FSA approach, consistent as far as
possible with the approach adopted by IMO.
Objectives
of This Paper
This
paper gives an overview of DNV’s FSA-based ship rule development project.
Section 2 explains the philosophy underlying the work and the general approach
adopted. Section 3 gives an example to illustrate how it will work in practice.
Section 4 discusses some of the lessons learned to date and the road ahead.
Section 5 makes conclusions about the impact of FSA on the rule-making process.
DNV’s
ApprOAch to FSA
FSA
at IMO
IMO
(1997) defined FSA as a 5-step process, consisting of:
1. Hazard identification
2. Risk assessment
3. Risk control options
4. Cost-benefit assessment
Recommendations
for decision-making
The
purposes of the FSA are to identify areas of concern in the existing
regulations, to set priorities for new regulations, or to analyse the
implications of proposed amendments. The FSA is applied to generic ships or
systems, characteristic of the type affected by the regulations under
consideration. Step 1 involves identifying relevant hazards, and Step 2
requires a quantitative estimation of the resulting risks for people, property
and the environment. Step 3 considers various options for managing the risks
(i.e. through new regulations), and estimates their benefits in reducing the
risks. Step 4 compares these benefits with the costs of implementing the option
for all stakeholders. Step 5 recommends to decision-makers which regulatory
options should be adopted to make the risks as low as reasonably practicable.
DNV’s
Philosophy for FSA
Using
FSA for improving classification rules is fundamentally no different to using
it for IMO regulations. Class Societies are able to make decisions rather more
swiftly than IMO, but is still constrained by the need to reach agreement with
IACS in many areas, and by the essential need to retain the support of
shipowners. For DNV this provides an incentive to align itself closely with the
international approach to FSA, and to contribute positively to developments at
IMO and IACS.
Being a
single organisation, DNV may take advantage of a more consistent approach to
FSA than is realistically possible among the many governments and organisations
that contribute to IMO. This is why DNV decided to develop a common foundation
for all its FSA work, which will allow different units to apply FSA to
different rule topics while making consistent assumptions about overall risk
levels.
The
scope of services from classification societies is wider than IMO’s remit,
since class rules are intended to ensure that the ship is fit for purpose, as
well as safe. This provides some degree of protection against interruptions of
the owner’s business, and is in general provided by rules for voluntary class
notations. This makes it important for DNV’s FSA to distinguish clearly between
rules that are required to achieve safety of life and the environment, and
those that help protect the owner’s assets and optimise business efficiency,
which should be optional provided that fundamental safety goals are met.
DNV’s
Foundation for FSA-Based Rule Development
A
comprehensive FSA of all class rules is a massive undertaking. The rules have
evolved over many years, incorporating immense practical experience, but there
is little documented evidence on which hazards they address and how effective
they are. Most rule sections can apply to any type of ship, so that their costs
and benefits will differ in different applications. Underlying the formal rulebook
are various survey schemes, customary interpretations and supplementary
guidance, so that rules can not always be interpreted in isolation. The rules
are intended to function as a coherent whole, and cannot always be readily
broken down into independent units for analysis.
While
an FSA of class rules could be done in an informal qualitative way, giving
rules that are loosely “risk-based”, establishing a fully transparent risk
basis for the rules requires a more rigorous approach. DNV therefore decided to
quantify the costs and benefits of its rules, as far as possible, consistent
with the 5-step FSA methodology. Completing this will take many years and
involve contributions from each of various discipline units involved in rule
development. To achieve consistency within such an undertaking, a firm
supporting foundation is required.
DNV’s
foundation for FSA based ship rule
development will include:
Outline
risk estimates for all major generic ship types.
Detailed
FSAs of key generic ship types (tanker, bulk carrier, container ship etc)
A
“rule map” showing the purpose of each section of the DNV Rules
Acceptance
criteria defining whether particular aspects of ships satisfy the Rules
Pilot
Rule FSAs of selected rule topics, identifying cost-effective rule amendments
An
FSA guideline, explaining how FSA will be used in the rule development process
The
combination of generic ship FSAs and the rule map will form an “FSA Platform”,
supplying the essential information needed for an FSA of any given rule topic.
The actual FSAs of rule topics will be an ongoing part of rule development, but
the current project will illustrate how this will work by means of a few pilot
rule FSAs. Our long-term vision is that a full set of rule FSAs for each rule
topic area will complete the FSA of the DNV Rules (Figure 1).
Development
of the foundation provides many benefits for DNV and its customers, in addition
to establishing the platform for efficient rule FSAs:
The
FSAs of generic ships provide the basis for prioritising
future rule development. By showing the sources of risk, they allow rational
top-down allocation of resources for rule development, instead of the current
rather arbitrary competition for resources between rule development projects.
The
rule map is a valuable contribution to achieving transparency in the rules. By using a simple qualitative review
technique, based on risk principles, the motivation behind each rule can be
documented, revealing its relevance to particular ship types.
The
hazard identification element in the FSAs encapsulates the proactive aspect of rule development under the FSA approach.
Through the use of systematic, team-based techniques, it enables hazards to be
identified and risk control options proposed, before they result in accidents.
DNV’s
internal FSA guideline will help solve the problem of achieving consistency in the use of FSA within a
large organisation.
Acceptance
Criteria for FSA-Based Ship Rules
DNV’s
corporate objective is to safeguard life, property and the environment. Therefore,
the fundamental objective of DNV’s rules is ensuring that ships have an
acceptable level of safety in respect of life, property and the environment.
What is meant by “acceptable level of safety” is defined by risk acceptance
criteria.
Risk
acceptance criteria are the standards that define whether the risks estimated
to arise on the ship are acceptable. In other words, they answer questions such
as “How safe is safe enough?” or “What is a reasonably practicable risk control
option?” In deciding what is acceptable (and to whom) DNV takes account of not
only of the interests of ship owners, but also of its wider social role in
protecting the public and the environment.
DNV
is in the process of developing risk acceptance criteria for its ship rules,
and the following should be regarded as proposals that need further evaluation
and may be revised in due course. Such acceptance criteria need to be discussed
within the industry and over time need to form the basis for a set of common
criteria widely accepted by regulators in the maritime area.
DNV’s
main mandatory class notation is +1A1,
intended to ensure that all ships meet a basic common standard of safety. DNV
consider an acceptable level of safety for +1A1
Class will require that:
Individual
risks of death for crew, passenger and members of the public shall meet defined
acceptance criteria (Table 1). For example, the individual risk to crew members
shall not exceed 10-3 per year, i.e. a 1 in 1000 chance per year of
death in an accident on the ship. These are based on acceptance criteria that
are widely used in several industries [5].
In
addition, risks shall be made “as low as reasonably practicable” (ALARP) by
adopting cost-effective measures protecting life, third-party property and the
environment. This includes any measures that give a positive net benefit in
reducing costs of damage, if risk to life is excluded. Alternatively, it
includes any measures whose implied cost per averted fatality (ICAF) is less
than US $3 million. These are based on values used for decision-making in a
recent trial application of FSA at IMO [6].
Table
1 Individual Risk Acceptance Criteria
|
Maximum
tolerable risk for crew members |
10-3
per person year |
|
Maximum
tolerable risk for passengers |
10-4
per person year |
|
Maximum
tolerable risk for public ashore |
10-4
per person year |
|
Negligible
risk |
10-6
per person year |
These
acceptance criteria for +1A1 Class
do not take account of any benefit that rules may have in protecting the ship
itself, except where this also helps protect life or prevent environmental
damage. Rules that protect the ship itself from damage or delay will be covered
by different acceptance criteria for voluntary class notations. Voluntary class
notations are assigned to vessels with specific operational or trade characteristics
and may give more exacting standards of human safety and environmental
protection, suitable for owners who wish to demonstrate performance in these
areas considerably above the world-wide minimum.
Example
Results
Generic
Ship FSAs
The first
requirement in applying the above approach is to establish the baseline risks
on different types of ship, and show whether they meet the individual risk
acceptance criteria. Figure 2 shows the results of DNV’s analysis of individual
risks for crew on selected generic ship types, expressed in terms of the annual risk of death for average crew
members. It shows that all types meet the proposed criteria, and lie in the
ALARP range. This important conclusion helps justify the surprising lack of
emphasis on risk acceptance criteria in the IMO guideline, because it shows
that the cost-benefit evaluation of risk control options is the most important
factor determining the overall acceptability of risks.
In
order to show the benefits of risk reduction options, it is necessary to
establish the breakdown of the observed risks, and to convert them into
monetary units. Figure 3 shows the results of DNV’s analysis of the total risks
on oil tankers, expressed in terms of the average
annual cost of accidents. This figure includes costs of accident to the
ship, as well as to people, other property and the environment, but these
components can readily be separated for the cost-benefit analysis of individual
rules.
Rule
FSA for Flap Rudders
DNV’s
first pilot application of the FSA approach to rule development was for flap
rudders. At present there are no rules that explicitly address flap rudders,
and class rules are based on conventional rudders without flaps.
Figure 1
A
hazard identification exercise (FSA Step 1) was carried out to identify
potential failure in flap rudders and recommend possible risk control measures.
The exercise used a multi-disciplinary team and followed a modified HAZOP
(hazard and operability study) methodology. A gap analysis was then used to
compare the recommendations with DNV’s existing rules, regulations and survey
procedures, and hence to develop practical risk control options (RCOs) as shown
in Table 2 (FSA Step 3).
Table
2 Risk Control Options for Flap Rudders
|
1. |
Use
similar material requirements for flap components as for conventional rudders |
|
2. |
Develop
procedure for design approval of flap rudders |
|
3. |
Monitoring/indication
of flap rudder angle |
|
4. |
Measuring
of clearances at each bottom survey |
|
5. |
Regular
inspection of pivot link and upper hinge |
|
6. |
Planned
maintenance of bearings/hinges/pivot |
|
7. |
Develop
specific survey guidance for flap rudders |
The risk
analysis of the flap rudder (FSA Step 2) was based on the generic oil tanker
FSA, and used the results in Figure 3 to show that the average annual cost of
failures of conventional rudders on oil tankers was $820 per ship year. This
was dominated by delays and repair costs, since the costs to people and the
environment resulting from groundings consequent on rudder failures were only
$20 per ship year. These are based on theoretical predictions using an event
tree technique, since no such events had occurred in the period selected for
analysis. Based on DNV’s failure data, the risks for flap rudders were
estimated to be 3 times higher than for conventional rudders, giving a total
cost of rudder failures of $2500 per ship year for a tanker with a flap rudder.
This is the maximum possible benefit of any additional risk control option, and
places a useful upper limit on the cost impact of further rules.
A
cost-benefit analysis was carried out for the 7 risk control options for flap
rudders (FSA Step 4). The costs
included costs to DNV in developing, administering and implementing the
proposed rules, and additional costs to the owner in manufacturing, maintaining
and inspecting the rudder. The benefits, in terms of reductions to the risks
from rudder failures, were estimated mainly by expert judgement based on
available failure data.
If
only costs of human, environmental and third-party property damage were included,
none of the Risk Control options(RCOs) would have positive net benefits, and
all would have an implied cost of annual fatalities (ICAFs) in excess of $200
million. In other words, none of the RCOs could be justified as part of +1A1 Class. However, if damage costs to
the ship were included, 4 out of the 7 RCOs have a positive net benefit, and
hence are considered suitable for implementation as part of a voluntary class
notation.
These
conclusions are now being considered as part of DNV’s rule making process. It
must be noted that there are major uncertainties in the FSA work, particular in
estimating the benefits of the risk control options. In addition, the criteria
that in effect limit this type of measure to voluntary class notations are
tentative, and not necessarily consistent with other motivations. For these
reasons, DNV regard FSA as an input
to a decision-making process, rather than the definitive conclusion on it. The
rule development process must also consider issues such as market acceptability,
data quality and future trends, which at present the FSA cannot model.
Discussion
Lessons
Learned
Some
lessons from the work to date include:
FSA
is complex and challenging. Obtaining robust marine risk estimates is
difficult, but can be achieved by suitable combinations of historical data,
theoretical modelling and expert judgement.
Ship
rules are inter-dependent and often their purpose is unclear. Quantifying the
benefit of existing ship rules is therefore particularly challenging. FSA is
more readily applied to new rules.
Marine
accident data sources are incomplete and sometimes difficult to access. While
better data would always help the work, it must be acknowledged that much more
could be done with the data sources that are available.
Ships
are diverse. Even within a generic ship type, there are wide variations in
design and operation. Estimation of the risks for average generic ship types is
readily achieved using historical data, but the potential variation between
individual vessels is largely unknown at present.
Quantification
can be controversial. While the costs of damage to ships can be readily
quantified, quantification of other accident effects such as delays requires
more obscure economic calculations. The important impacts of accidents on
people and the environment are particularly difficult to represent in financial
terms, but cannot be adequately reflected in the analysis if this is not done.
FSA
results are uncertain. As a result of factors such as listed above, the results
of any FSA are inevitably uncertain. Independent analyses might obtain
numerical results differing by a factor of 10 or more, and some of the
conclusions may be sensitive to such uncertainties.
FSA
can deliver useful results. While uncertainty limits the reliance that can be
placed on the results of an FSA, we find that even uncertain results are more
useful than the previous absence of any risk information. Some conclusions are
robust against very large uncertainties in the risk estimates, particularly
those showing that capital-intensive measures are not effective against
specific unlikely accident sequences.
The
FSA process is a useful discipline. Even when the results are not yet credible,
the process of performing an FSA
often gives useful insights into the nature of the risks. The conventional rule
development process tends to create a focus on hazards and ways of preventing
them happening, while losing sight of the likelihood of accidents and the costs
of prevention. FSA has the potential to promote a more holistic view, which
will be to the benefit of classification societies, ship-owners and society as
a whole.
The
cost-effectiveness of FSA is not yet proven. Classification is a competitive
business, and for FSA to be adopted widely it must confer a competitive
advantage. FSA is resource intensive, and it is not yet clear how to gain the
maximum benefit without unnecessary complexity. DNV recognise that FSA will
increase the cost of rule developments in the short-term, but anticipate that
it will deliver a long-term saving to the industry by showing where rules are
not cost-effective and therefore not suitable for development.
The
Road Ahead
DNV
is continuing to develop the foundation for FSA-based ship rule development, by
carrying out further generic ship FSAs and pilot rule FSAs. We aim to have
completed detailed FSAs of the major generic ship types and pilot rule FSAs of
each major type of rule by the end of 2001. This will solve the major technical
challenges, and open the way to implement the FSA approach as a routine part of
all ship rule development activities.
Conclusion
The
adoption of FSA seems set to cause a radical change in the way DNV approaches
rule development. Justifying new rule proposals in terms of their costs and
benefits, explicitly quantified as far as possible, is both challenging and
invigorating for the DNV organisation. Early indications are that while it will
require a major commitment of resources, this investment will bring major
benefits in terms of the consistency and transparency of the rules. The
fundamental challenge is to realise the well-known potential of FSA as a
proactive, systematic, rational approach to marine safety, while also enhancing
the efficiency of safety regulation, to ensure that the investment quickly repays
itself and secures widespread acceptance in the marine industry.
References
[1] IMO (1997), “Interim Guidelines for
the Application of Formal Safety Assessment (FSA) to the IMO Rule-Making
Process”, MSC/Circ.829, International Maritime Organization, London.
[2] House
of Lords (1992), “Safety Aspects of Ship design and Technology”, Select
Committee on Science and Technology.
[3] Kuo, C., Pryke, N., Sodahl, B. &
Houison Craufurd, S (1998), “A Safety Case for Stena Line’s High Speed Ferry
HSS1500”, Transactions of the Royal Institution of Naval Architects.
[4] Mathiesen,
T-C. &
Skjong, R. (1996), “Towards a Rational Approach to Marine Safety and
Environment Protection Regulations”, Conference on Market Mechanisms for Safer
Shipping and Cleaner Oceans, Rotterdam.
[5] HSE (1999), “Reducing Risks,
Protecting People”, Discussion Document, Health & Safety Executive, London.
[6] Spouge, J.R. (1998), “Formal Safety Assessment of
Helicopter Landing Area on Passenger Ships as a Safety Measure - Additional
Information” DNV Report 98-2047.