Safety and risk

Safety is the first rule of the code of ethics, and it is where engineers make the biggest difference. The choices made on a drawing board, in a specification or in a control system decide whether workers can do their jobs without being hurt and whether the public can trust what has been built. A guardrail designed in costs a few hundred dollars; a fall from a platform without one can cost a life.

This chapter introduces the language and tools of safety engineering: the difference between hazard and risk, risk assessment with a risk matrix, the hierarchy of controls, workers' rights and employers' duties under occupational health and safety law, factors of safety and design codes, reliability and redundancy, and systematic methods such as FMEA and HAZOP.

Hazard and risk

Two words are often confused:

• A hazard is anything with the potential to cause harm: a moving machine part, a pressurized vessel, a toxic gas, a work height, electricity, fatigue.
• Risk combines how likely harm is and how bad it would be. A hazard that people are never exposed to carries little risk; a modest hazard encountered every day can carry a lot.

A simple model is

Engineers cannot remove all hazards. High-voltage lines, pressure vessels and moving vehicles are inherently hazardous. The job is to reduce the risk they pose to a level that is acceptable, and to keep it there over the whole life of the system.

Risk assessment

A risk matrix is the most common tool for quick risk assessment. Likelihood and consequence are each rated on a scale, typically 1 to 5, and their product places the risk in a band that tells you how urgently it must be reduced.

Typical actions: extreme risks must be reduced before work proceeds; high risks need prompt action and senior approval; medium risks need specific controls and monitoring; low risks are managed through routine procedures.

Risk matrices are simple and quick but coarse: they depend on judgment, and two people can score the same hazard differently. For major hazards, engineers use quantitative risk assessment, estimating actual frequencies (events per year) and consequences (for example, expected fatalities or costs) from data and models.

The hierarchy of controls

Once a risk is identified, the question is how to control it. Not all controls are equally effective. The hierarchy of controls ranks them:

• Elimination: remove the hazard entirely (design out the need to work at height; locate equipment at ground level).
• Substitution: replace it with something less hazardous (a water-based solvent instead of a flammable one).
• Engineering controls: physically separate people from the hazard (guards, interlocks, ventilation, enclosures, relief valves, guardrails).
• Administrative controls: change how people work (procedures, training, permits, signs, job rotation).
• Personal protective equipment (PPE): hard hats, gloves, safety glasses, hearing protection, harnesses.

Engineers have most influence at the top of the hierarchy, especially during design, when changes are cheap. This idea is called prevention through design. PPE is the last line of defense, not the first, because it only works if it is worn correctly every time and it does nothing to the hazard itself.

Occupational health and safety law

In the United States, workplace safety is governed by the Occupational Safety and Health Act of 1970, enforced by OSHA (the Occupational Safety and Health Administration). About half the states run their own OSHA-approved state plans, which must be at least as effective as the federal program; California's Cal/OSHA is the largest. Mines are covered separately by the Mine Safety and Health Administration.

Workers have core rights under the OSH Act:

• The right to know about hazards, including chemical hazards through the Hazard Communication standard and safety data sheets, and to receive training in a language they understand.
• The right to report hazards and file a confidential complaint with OSHA, and to be protected from retaliation for doing so (Section 11(c)).
• A limited right to refuse work that presents an imminent danger of death or serious injury, when they have asked the employer to fix it, a reasonable person would agree the danger is real, and there is no time to get an OSHA inspection.

Employers have the main duty: the General Duty Clause requires them to keep the workplace free of recognized hazards likely to cause death or serious physical harm, and specific OSHA standards set rules for hazards such as falls, trenching, confined spaces, machine guarding and lockout. Employers must identify and control hazards, train and supervise workers, provide protective equipment and record serious injuries. Workers must follow safety rules and use required equipment. Engineers who design equipment, structures or processes must make sure their designs can be built, operated and maintained safely, since OSHA standards apply to the people who will do that work.

Remember also Lesson 3: willful violations of OSHA standards that cause a worker's death can be prosecuted as crimes, and executives and engineers who direct work share responsibility for safety.

Designing for safety

Codes, standards and factors of safety

Much safety knowledge is captured in codes and standards: the International Building Code (adopted, often with amendments, by states and cities), ASCE 7 for structural loads, the National Electrical Code (NFPA 70), the ASME Boiler and Pressure Vessel Code, pipeline safety rules from PHMSA, and many others. Codes encode lessons learned, often from failures, and set minimum requirements. Following them is a legal obligation, but codes cannot anticipate every situation, and meeting the code does not relieve an engineer of judgment.

Lesson 1 introduced factors of safety and limit states design. Their purpose is to cover uncertainty in loads, materials, workmanship and models. The right margin depends on how well the loads and materials are known and how severe a failure would be: lifting equipment and pressure systems use larger margins than, say, a garden shed.

Reliability and redundancy

The reliability of a component is the probability that it works as intended over a stated period. Systems are built from many components, and how they are connected matters.

In series, every component must work: the reliabilities multiply. In parallel (redundancy), the system works if any one component works: the system fails only if all fail.

Redundancy only helps if failures are independent. Two pumps fed by the same power supply, or two sensors that can be fooled by the same blockage, can fail together. Engineers look for these common-cause failures and use diversity (different types of equipment) where it matters.

Systematic hazard analysis

For complex systems, engineers use structured methods to find hazards that intuition misses:

• Failure modes and effects analysis (FMEA) lists every way each component can fail, the effect on the system, and how it would be detected. Each failure mode is rated for severity (S), occurrence (O) and detection (D), often on 1 to 10 scales, and their product, the risk priority number RPN \(= S \times O \times D\), ranks where to act.
• Hazard and operability study (HAZOP) is used in process plants. A team goes through the piping and instrumentation diagrams line by line, applying guide words such as "no flow", "more pressure" or "reverse flow" to find deviations, their causes and consequences.
• Fault tree analysis works backward from an undesired event to the combinations of failures that could cause it.

Accidents are rarely one failure

Investigations nearly always find that a major accident needed several things to go wrong at once: a design weakness, a maintenance lapse, an alarm that was ignored, a procedure that was not followed, schedule pressure. James Reason's "Swiss cheese" model pictures each safeguard as a slice with holes; an accident happens when the holes line up. Good safety engineering adds independent layers of protection and keeps the holes small and few, and good safety culture means reporting near misses so the holes are found before they line up. Management of change, the formal review of every modification to equipment, procedures or organization, prevents new holes from being introduced, as the Hyatt Regency walkway change did.