Safety Case Approach and Risk Summation

Why This Topic Matters for the CSP Exam

The BCSP Certified Safety Professional (CSP) blueprint places Safety Case Approach and Risk Summation within the Program Management and Risk Management domains. These concepts test whether you can move beyond single-hazard thinking and demonstrate, in a structured and defensible way, that an entire facility, process, or system is acceptably safe. Regulators and courts increasingly expect this kind of demonstration. The safety case model emerged from catastrophic failures such as Flixborough (1974), Seveso (1976), and especially the Piper Alpha offshore disaster (1988), after which the Cullen Report recommended that operators prove safety rather than simply comply with prescriptive rules. Today, safety cases are required or encouraged in offshore oil and gas, nuclear power, rail, aviation, defense, chemical processing (UK COMAH, EU Seveso III), and increasingly in autonomous systems and medical devices.

For the exam, the topic is important for three reasons:
1. It integrates many other CSP concepts (hazard analysis, risk assessment, ALARP, management systems, performance standards, audits) into one framework.
2. It includes quantitative skills, specifically adding risks from multiple scenarios and comparing the total to tolerability criteria.
3. It distinguishes a goal-based (performance-based) regulatory philosophy from a prescriptive one, a recurring exam theme.

What Is a Safety Case?

A safety case is a structured, documented argument, supported by a body of evidence, that a system is acceptably safe for a specific application in a specific operating environment. It is not merely a collection of documents; it is a reasoned argument. The classic structure is often described as Claims, Arguments, and Evidence (CAE):
- Claim (or Goal): the top-level statement, e.g., 'The facility can be operated without unacceptable risk to workers, the public, and the environment.'
- Argument: the logical reasoning that breaks the claim into sub-claims (hazards are identified, risks are assessed, controls are adequate, controls are maintained, emergencies can be managed).
- Evidence: the data that supports each sub-claim (HAZOP reports, QRA results, test records, inspection data, audit findings, competency records).

Goal Structuring Notation (GSN) is a common graphical method for laying out this hierarchy of goals, strategies, solutions (evidence), context, and assumptions.

Key Elements Typically Found in a Safety Case

1. Facility or system description, including boundaries, operating modes, and interfaces.
2. Hazard identification using HAZID, HAZOP, FMEA, What-If, checklists, and historical incident review.
3. Risk assessment, qualitative, semi-quantitative, or fully quantitative (QRA), producing individual risk, societal risk, and asset or environmental risk estimates.
4. Risk control measures, often shown with bow-tie diagrams linking threats, preventive barriers, the top event, mitigative barriers, and consequences.
5. Safety Critical Elements (SCEs) and their performance standards (functionality, availability, reliability, survivability, interactions), with a verification scheme, often involving an Independent Competent Person.
6. ALARP demonstration, showing that risk has been reduced As Low As Reasonably Practicable by evaluating further measures and rejecting only those where cost is grossly disproportionate to the benefit.
7. Safety Management System (SMS) description, covering leadership, competence, management of change, permit to work, contractor control, audit, and continuous improvement.
8. Emergency response and escape, evacuation, and rescue analysis, including temporary refuge integrity.
9. Living document provisions, such as periodic review (often every five years or upon major modification) and revision after incidents or changes.

Prescriptive vs. Goal-Setting Regimes

A frequent exam point: a prescriptive regime tells the operator exactly what to do (e.g., OSHA specifying guardrail heights). A goal-setting or performance-based regime, which underpins the safety case approach, tells the operator what outcome must be achieved and requires the operator to demonstrate how it is achieved. The burden of proof shifts to the duty holder. Advantages include flexibility, ownership, and adaptation to novel technology; disadvantages include the need for high competence, potential inconsistency, and the risk of a safety case becoming a 'paper exercise' disconnected from operations (a criticism raised after Deepwater Horizon and in the Nimrod Review by Haddon-Cave).

What Is Risk Summation?

Risk summation (also called risk aggregation or cumulative risk assessment) is the process of combining the risk contributions from all identified hazard scenarios to estimate the total risk to a receptor, such as a worker, a member of the public, or a population. It answers the question: 'Even if each individual hazard looks tolerable, is the total risk still acceptable?'

This matters because a risk matrix evaluates scenarios one at a time. A worker exposed to twenty 'tolerable' scenarios may face an intolerable aggregate risk. Safety cases, QRAs, and regulators therefore require summation.

Core Risk Metrics Used in Summation

- Individual Risk Per Annum (IRPA): the probability that a specific individual is killed in a year. Calculated as the sum over all scenarios of (event frequency) multiplied by (probability of fatality given the event) multiplied by (fraction of time the individual is exposed).
- Location-Specific Individual Risk (LSIR): risk to a hypothetical person present at a location 100 percent of the time; used for risk contours.
- Potential Loss of Life (PLL): expected number of fatalities per year across the whole population; the sum over all scenarios of (frequency) multiplied by (expected number of fatalities).
- Societal Risk: displayed on F-N curves, where F is the cumulative frequency of events causing N or more fatalities; compared with criterion lines on log-log plots.
- Fatal Accident Rate (FAR): fatalities per 100 million (10 to the 8th) exposed hours; often used to compare industries.

How Risk Summation Works Step by Step

Step 1: Define the receptor and boundary. Decide whose risk is being summed (e.g., a control room operator, the most exposed worker group, the nearest residential area).

Step 2: List all credible scenarios. Draw from the hazard register: fires, explosions, toxic releases, dropped objects, structural failure, transportation incidents, occupational hazards (falls, electrical, confined space). Note that occupational risks are often summed separately from major accident risks but may be combined for total IRPA.

Step 3: Convert to common units. All frequencies must be in the same unit (typically per year) and all consequences in the same measure (probability of fatality, or expected fatalities). Convert per-hour or per-demand frequencies as needed. A protective system with a Probability of Failure on Demand (PFD) reduces the mitigated frequency: mitigated frequency equals initiating event frequency multiplied by PFD of each independent protection layer, as in Layer of Protection Analysis (LOPA).

Step 4: Calculate each scenario's contribution. Multiply frequency by conditional probability of fatality by exposure fraction.

Step 5: Sum the contributions. For independent and mutually exclusive or rare events, risks add arithmetically. Strictly, the probability of A or B equals P(A) plus P(B) minus P(A and B); when events are rare (probabilities much less than 1), the cross term is negligible and the rare event approximation allows simple addition. Frequencies (expected events per year) always add directly.

Step 6: Compare to tolerability criteria. The widely cited UK HSE framework (Reducing Risks, Protecting People, often called R2P2) uses:
- Intolerable above 1 in 1,000 per year (1 times 10 to the minus 3) for workers and 1 in 10,000 per year (1 times 10 to the minus 4) for the public.
- Broadly acceptable below 1 in 1,000,000 per year (1 times 10 to the minus 6).
- The region between is the ALARP region, where risk is tolerable only if further reduction is not reasonably practicable.

Step 7: Rank contributors and drive ALARP. Identify dominant scenarios (often a handful of scenarios contribute most of the total, a Pareto pattern). Apply the hierarchy of controls to the largest contributors first. Use cost-benefit analysis with a Value of a Prevented Fatality (VPF) and a gross disproportion factor (commonly 3 to 10 depending on risk level) to justify rejecting measures.

Step 8: Document uncertainty and assumptions. Sensitivity analysis shows how the total changes if key inputs vary. State failure-rate data sources (e.g., OREDA, generic databases) and model limitations.

Worked Example

A worker is exposed to three major accident scenarios while on site 25 percent of the year (exposure fraction 0.25). Also included is an occupational risk already calculated as 2 times 10 to the minus 5 per year.
- Scenario A (jet fire): frequency 2 times 10 to the minus 4 per year, probability of fatality if present 0.5.
- Scenario B (vapor cloud explosion): frequency 1 times 10 to the minus 5 per year, probability of fatality 1.0.
- Scenario C (toxic release): frequency 8 times 10 to the minus 5 per year, probability of fatality 0.25.

Contribution A equals 2 times 10 to the minus 4 times 0.5 times 0.25, which equals 2.5 times 10 to the minus 5.
Contribution B equals 1 times 10 to the minus 5 times 1.0 times 0.25, which equals 2.5 times 10 to the minus 6.
Contribution C equals 8 times 10 to the minus 5 times 0.25 times 0.25, which equals 5.0 times 10 to the minus 6.
Major accident IRPA equals 2.5 times 10 to the minus 5 plus 2.5 times 10 to the minus 6 plus 5.0 times 10 to the minus 6, which equals 3.25 times 10 to the minus 5.
Total IRPA including occupational risk equals 3.25 times 10 to the minus 5 plus 2.0 times 10 to the minus 5, which equals 5.25 times 10 to the minus 5 per year.

Interpretation: the total lies between 10 to the minus 6 and 10 to the minus 3, so it falls in the ALARP region for a worker. It is tolerable only if the safety case demonstrates that further risk reduction is not reasonably practicable. Scenario A dominates (about 77 percent of the major accident risk), so risk reduction effort should focus there, for example through inventory reduction, improved isolation, or fire protection.

Common Pitfalls in Risk Summation

- Mixing units (per hour with per year, or probabilities with frequencies).
- Double counting scenarios that are actually the same event described twice.
- Ignoring common cause failures and dependencies, which make 'independent' barriers less effective and understate total risk.
- Forgetting exposure fraction, which inflates individual risk for part-time occupants.
- Treating a risk matrix score as additive; matrix cells are ordinal categories and cannot be meaningfully summed. Only quantitative frequencies and probabilities add.
- Assuming that meeting a numerical criterion ends the obligation; ALARP still requires considering further measures.

How to Answer Exam Questions on This Topic

CSP questions in this area appear in several forms:

1. Definitional and conceptual questions. Expect items asking what a safety case is, who bears the burden of proof, what ALARP means, or which disaster drove adoption (Piper Alpha and the Cullen Report). Look for distractors that describe a safety case as a compliance checklist or an audit report; the correct answer emphasizes a structured argument supported by evidence.

2. Component identification questions. You may be asked which element belongs in a safety case or which is an SCE performance standard criterion. Remember the typical SCE performance standard attributes: functionality, availability or reliability, survivability, and interaction or dependency.

3. Regulatory philosophy questions. Distinguish goal-setting (performance-based, operator demonstrates safety) from prescriptive (regulator specifies controls). Know advantages and disadvantages of each.

4. Calculation questions. These typically give several scenarios with frequencies and consequence probabilities and ask for total individual risk, PLL, or whether the result is tolerable. Follow the step-by-step method: convert units, multiply each scenario's frequency by its conditional fatality probability and exposure fraction, add, and compare to criteria. Watch for scientific notation traps; 2.5 times 10 to the minus 5 plus 5 times 10 to the minus 6 equals 3.0 times 10 to the minus 5, not 7.5 times 10 to the minus 5.

5. Interpretation questions. After computing a total, you may be asked the appropriate action. If the result is in the ALARP region, the answer involves demonstrating ALARP through evaluation of further measures and cost-benefit analysis, not simply accepting the risk and not necessarily shutting down. If above the intolerable line, risk must be reduced regardless of cost or the activity must cease.

6. Scenario or best-practice questions. These describe a facility and ask the most appropriate next step or the weakness in a safety case. Common correct answers involve focusing on dominant contributors, verifying barriers through independent review, updating the safety case after management of change, or linking the document to operational reality so it does not become a paper exercise.

Exam Tips: Answering Questions on Safety Case Approach and Risk Summation

- Memorize the tolerability framework. 10 to the minus 3 per year for workers and 10 to the minus 4 for the public as upper limits, 10 to the minus 6 as broadly acceptable, with ALARP in between. Many questions hinge on placing a number in the right band.
- Remember that frequencies add, matrix scores do not. If a question asks you to add risk rankings from a 5 by 5 matrix, be suspicious; the correct answer usually points out that qualitative scores cannot be summed.
- Always check units first. Convert hours to years (8,760 hours per year) and per-demand values using demand rates before summing.
- Apply the exposure fraction. Individual risk to a specific person includes time present; LSIR does not. Read which one is being asked.
- Use the rare event approximation. For small probabilities, simply add. Only subtract the joint term if probabilities are large (above roughly 0.1) and the question clearly wants exact union probability.
- Look for the dominant contributor. If asked where to focus risk reduction, choose the scenario with the largest product of frequency and consequence, not the one with the highest frequency alone or highest consequence alone.
- Know the ALARP vocabulary. Reasonably practicable, gross disproportion, value of a prevented fatality, cost-benefit analysis, and sacrifice versus risk reduction. Edwards v. National Coal Board (1949) is the legal origin of the gross disproportion test.
- Link to the hierarchy of controls. ALARP demonstrations prefer elimination and inherently safer design (minimize, substitute, moderate, simplify) over administrative controls and PPE.
- Recognize the living document principle. Answers involving periodic review, revision after modification, and revision after incidents are usually correct; answers implying a one-time submission are usually wrong.
- Associate names and events. Piper Alpha and Lord Cullen (offshore safety cases), Seveso Directive and COMAH (onshore major hazard safety reports), Nimrod Review by Haddon-Cave (criticism of safety cases that became bureaucratic), Deepwater Horizon (prompted US adoption of SEMS, a performance-based management system).
- Eliminate distractors systematically. In multiple choice, options that describe compliance, inspection checklists, or regulator-written procedures are rarely the definition of a safety case. Options that emphasize argument, evidence, demonstration, and acceptability of total risk usually are.
- Show your reasoning on calculations. Write each scenario's contribution before adding; most wrong answers on the exam come from an arithmetic slip in scientific notation rather than misunderstanding the concept.
- Manage time. Conceptual questions should take under a minute; calculation questions may take two to three. If a calculation stalls, estimate the order of magnitude, eliminate options in the wrong band, and move on.

Summary

The safety case approach asks the duty holder to prove, through a structured argument backed by evidence, that a system is acceptably safe and that risk is ALARP. Risk summation is the quantitative engine inside that argument, combining all scenario contributions into total individual and societal risk for comparison against tolerability criteria. For the CSP exam, master the definitions, the tolerability bands, the step-by-step summation method with consistent units and exposure fractions, the ALARP decision logic, and the historical context. With these tools you can answer conceptual, calculation, and scenario-based questions with confidence.