The Characteristics of Risks of Major Disasters

The Characteristics of Risks of Major DisastersAuthor(s): C. F. ClementSource: Proceedings of the Royal Society of London. Series A, Mathematical and PhysicalSciences, Vol. 424, No. 1867 (Aug. 8, 1989), pp. 439-459Published by: The Royal SocietyStable URL: http://www.jstor.org/stable/2398381 .

Accessed: 12/06/2014 16:54

Your use of the JSTOR archive indicates your acceptance of the Terms & Conditions of Use, available at .http://www.jstor.org/page/info/about/policies/terms.jsp

.JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide range ofcontent in a trusted digital archive. We use information technology and tools to increase productivity and facilitate new formsof scholarship. For more information about JSTOR, please contact [email protected].

.

The Royal Society is collaborating with JSTOR to digitize, preserve and extend access to Proceedings of theRoyal Society of London. Series A, Mathematical and Physical Sciences.

http://www.jstor.org

This content downloaded from 185.2.32.141 on Thu, 12 Jun 2014 16:54:37 PMAll use subject to JSTOR Terms and Conditions

http://www.jstor.org/action/showPublisher?publisherCode=rsl

http://www.jstor.org/stable/2398381?origin=JSTOR-pdf

http://www.jstor.org/page/info/about/policies/terms.jsp


Proc. R. Soc. Lond. A 424, 439-459 (1989) Printed in Great Britain

The characteristics of risks of major disasters

BY C. F. CLEMENT

Environmental and Medical Sciences Division, Harwell Laboratory, United Kingdom Atomic Energy Authority, Oxfordshire OX 1I ORA, U,K.

(Communicated by R. Bullough, F.R.S. - Received 30 December 1988)

The quantification of risk requires measures of consequences and of frequency. Serious personal consequences are expressed as a 'disaster profile' giving the numbers of early deaths, late deaths, serious incapacity, forced permanent evacuation and serious birth defects. Profiles from the disasters at Bhopal and Chernobyl are quite different. In addition, there is a financial measure of harm that can include the personal measure if a value is assigned to a human life or adverse health effect.

Timescales of disasters from earthquakes to long-term pollution are discussed; if they are long enough, the risk can be transferred from one of death or injury to one of evacuation and cost. This applies to most nuclear risks, which are better quantified by cost measures rather than by the unobservable hypothetical number of late cancer deaths. Measured by evacuation or cost, nuclear risks increase more than linearly with the size of the radioactive source term.

Factors leading to risks are examined, and that of knowledge and its transmission is emphasized. The causes of only a few disasters, e.g. hurricanes, are wholly stochastic in nature; for others, their frequency can be reduced, possibly at some expense. Statistics is inferior to probabilistic safety analysis as a predictor of risk where knowledge is involved. Several recent disasters are listed, together with some others that have a high probability of occurrence in the near future. Those from long-term large-scale pollution, e.g. climatic change induced by the greenhouse effect, may pose the largest risk.

1. INTRODUCTION

The topic of disasters is a growing subject of study about which there is already an excellent book (Whittow i980). By a disaster I mean an event or series of events in which many people are adversely affected by a single cause. For example, it was reported in the Swiss Reinsurance annual report of 1987 that in 1986, 12000 people died and 2.2 million were made homeless by 215 major accidents or disasters. The homeless figure is a fraction 4 x 10-4 of the world population of about 5000 million, which is therefore small compared with the individual risk of death in a year. A considerable literature (see the journal Risk Analysis from 1981 onwards; Royal Society I98I, I983; Science, Wash. I987) has appeared on the subject of risk analysis, particularly on risks of death, and yet several aspects of the fundamental basis of the subject still require examination. In this paper I discuss the application of risk analysis to disasters.

[ 439 ] i6-2



440 C. F. Clement

Because I am dealing with disasters, I am mainly interested in 'societal risk' (as defined in ?2b) rather than individual risk. The exact definitions of these terms, together with 'hazard', have recently been discussed by a United Kingdom Atomic Energy Authority Working Group (UKAEA I988) and I give their adopted definitions in Appendix A. Where they do not quite cover the circumstances in which I want to apply them, I shall describe any discrepancies that arise.

I consider that the aims of risk analysis are twofold. First, the aim is to give society or the individual a means of making rational choices about different courses of action. The choices involve benefits as well as risks, but there is no way of living without risks (British Medical Association (BMA) 1987). The popularity of risky sports, such as motor racing and skiing, testifies'to the fact that many people are prepared to face high individual risks for high enjoyment. The second aim is to identify factors giving rise to the risk; this will often enable the risk to be reduced. The first aim raises the question of comparability between different types of harm. It is clear that simply using immediate death as a measure of detriment or damage is not sufficient. In ?2 I describe some types of measures which could be used and how they apply to some disasters. These measures include cost, covered in ? 2 b, as well as personal risks, various categories of which are illustrated in a graphical form in ?2a.

Nuclear risks, which I discuss in particular, mainly arise from pollution, and I go on to discuss the general problems associated with measuring such risks. This is one area where assumptions that are currently made in risk analysis could be completely wrong. Disasters involving pollution are different from sudden disasters and the question of the timescales involved and society's response is examined in ?2c.

In ?3 a I describe some important factors which give rise to risks. Possibly the factor least noticed hitherto is the recognition that a risk exists. This particularly applies to disasters; these are usually very infrequent events so that people do not learn to recognize the warning signs. It is customary to assume that, for estimating risks, disasters are stochastic events that occur at random. Of course, from a scientific point of view this is not the case for most of the events considered. Various natural events can now be predicted, which brings me to the old dichotomy between 'man-made' and 'natural' disasters. I concur with the argument (Wijkman & Timberlake I985) that this has become false. Man now has the capability to predict and avoid at least many of the consequences of 'natural' disasters, and their risks should therefore be put alongside purely man-made risks, such as those arising in the chemical and nuclear industries, which also bring benefits, when measures of risk reduction are being considered. Conversely, natural triggers have to be considered, for example earthquakes and floods, in conjunction with industrial risks.

In ? 3 b I discuss recent and future disasters in relation to those factors. The mere fact that many disasters have been predicted, though risk estimates are not often available, means that, in principle, their worst effects are avoidable. In deciding whether any action is taken, the determining factor appears to be the possibility of the action and its cost in relation to public opinion. Scientists and practitioners



Risk characteristics 441

of probabilistic safety analysis (PSA) can aid the process, particularly with regard to public knowledge, if their predictions are correct and come to be accepted by society.

This brings me finally to the topic of predictability discussed in ?3c. I examine it from the point of view of the characteristics of possible disasters, and whether their origin is really stochastic in nature. The use of statistics alone and PSA, which has additional input, is contrasted, particularly for earthquakes and nuclear disasters. The possibilities of risk reduction in these and other disasters is also examined, and possible consequences are suggested for one of the largest possible disasters: man-induced climatic change.

In the conclusions I summarize the findings of this paper as partial answers to simple questions regarding the nature and reduceability of risk from disasters.

2. MEASURES OF HARM

I now need to specify the kinds of undesirable consequences or harm arising from the undesired event. If these consequences can be quantified, and the frequency is known or calculated, society has a measure of the risk of the event. In the past, most individual and societal risks have been expressed as the probability of immediate death or the number of early deaths. This consequence is manifestly inadequate to describe the risk of a major nuclear accident where very few, if any, people would die. Nobody outside a nuclear site has died from an acute dose of radiation from the nuclear industry. In addition, other consequences must be considered, and I divide then into two types, personal and societal. I point out how some societal risks other than personal ones, could be expressed in financial terms.

(a) Personal risks Risks that directly affect individuals may be termed 'personal risks'. For

serious consequences to individuals, I introduce the idea of a 'risk profile' of a disaster to characterize the numbers of people who would be affected in different ways by a disaster. That for Chernobyl is shown in figure 1 and is characterized by the five headings: early death, late death, serious incapacity, forced permanent evacuation and serious birth defects. The first four of these represent risks to living individuals and the final one is a risk to future individuals. Serious incapacities include loss of limb, blindness and inability to work, but the boundary with minor injury might not be always easy to draw. Also, the categories of late death and serious incapacity are not mutually exclusive, as appears to be the case for some victims of the chemical disaster at Bhopal whose lungs were damaged. Such cases should appear in both categories, although I do not include the late death category in the profile shown in figure 2 through lack of data, which have considerable uncertainties for Bhopal (Shrivastava I987). Many may not have returned from the hundreds of thousands who are reported to have fled the area immediately after the disaster. For the delayed cancer death in the nuclear case the victim is not incapacitated during the latent period.

The sources of the data for Chernobyl are shown in table 1. I have made a distinction between the actual numbers for some categories, and the hypothetical



442 C. F. Clement

actual 135 000

numbers of people affected

uncertainty range

ypothetical

15000 actual actual

31 13 X no evidence

early serious late permanent serious deaths incapacity deaths or birth

from cancer long-term defects evacuation

FIGURE 1. Disaster profile for Chernobyl. See table 1 in text for data.

actual 10 000

uncertainty numbers of people affected range

ae al ~~~~~~none 3 (JO definitely

reported

w1 1F1 r' ? ? I 3possibly

early deaths permanent delayed permanent serious severe deaths or long-term birth

disability evacuation defects

FIGURE 2. Disaster profile for the chemical accident at Bhopal.




TABLE 1. DATA FOR DISASTER PROFILE FOR CHERNOBYL

number of deaths Soviet reporta number of people seriously Soviet first anniversary news incapacitated conference 1987

number of cancer deaths collective dose 0.5 million man-Sv; proportions: 0.18 E. and W. Europe, 0.32 Soviet Union (Gittus et al. I988)

risk factor 3 x 10-2 per man sievert (NRPB I987).

number of people evacuated Soviet reporta number of birth defects none recorded, Soviet first

anniversary news conference 1987 a The Chernobyl nuclear power station accident: one year afterwards. IAEA conference on nuclear

power performance and safety, 29 Sept.-2 Oct. 1987, Vienna. JAEA-CN-48/63 (see also Gittus et al. I988).

number of cancer deaths, which is subject to a large uncertainty. I return to this topic in ?2.3, but the number given of 15000 is based on the risk factor of 3 x 10-2 Sv-wt recently recommended by the National Radiological Protection Board (NRPB I987). This factor shows an increase on that of the previous factor of 1 x 10-2 arising from recent analyses of data from Hiroshima. However, the increased factor has not yet been adopted by the International Committee on Radiological Protection (ICRP), although it is approximately consistent with the recommendations of the United Nations Scientific Coinmittee on the Effects of Radiation (UNSCEAR) in 1988 whose recommended factors depend on the dose level. The uncertainty range in figure 1 arises from the application of these risk factors to small doses (see also ?2c).

For each category, a societal risk can also be obtained in terms of the number of people affected, consistent with the definition in Appendix A. I call the sums Ni, where i = 1, ..., 5. These sums and the risks they represent are quite different for different major accidents. For a major chemical and a major nuclear accident the differences are listed inp figures 1 and 2. These differences are characteristic of two different types of disaster such as Bhopal and the slowly developing consequences of a disaster such as Chernobyl. They are also bound up with the human response to disasters, as we discuss further in ?2c.

There is no necessity to construct an overall society risk to individuals by summing over the different categories. However, it is worthwhile noting attempts in this direction. The simplest comparison could be made by constructing the sum:

5

N aiNi, (1) i=l

where the ai are weighting factors to compare the risk with that of early death, al= 1.

At one extreme, I could use just the total number of people affected and take = 1, but allow for double counting in categories 2 and 3. However, this does not

t The sievert is the unit of dose equivalent and is the absorbed dose in tissue in grays multiplied by the quality factor.



444 C. F. Clement

allow for society's views on the seriousness of the consequences. When given the choice, people nearly always choose evacuation rather than risk death or incapacity. This is the basis of hurricane warnings on the coast of the U.S.A. which save many lives, and why many were saved by the evacuation warning given before the Mt St Helens eruption.

Some methods proposed to choose some of the ai are shown in table 2. There is quite a strong logic that the comparison between early and delayed death could be made on the basis of a loss of life expectancy; this comparison has been advocated for the nuclear risk of delayed cancer deaths by Marshall et al. (I983). As they have emphasized, this method can take into account the possibility of intervening death from another cause, and also enables a comparison to be made to the risk of smoking.

TABLE 2. POSSIBLE QUANTIFIED RELATIONS OF OTHER SERIOUS CONSEQUENCES

OF A DISASTER TO EARLY DEATH

consequence relation to early death specifies delayed death loss of life expectancy a2 serious incapacity QALY a3

serious birth defect floss of life expectancy a5 + QALY

The quality-adjusted life-year (QALY) is a concept first proposed in the U.S., which has been developed by Professor Alan Williams and his colleagues at Y6rk University (Williams i985; Kind et al. I982) as an analytic criterion for the development of potentially beneficial health-care procedures or, with associated costs, as a measure of 'value for money' in health care. Each year of life is multiplied by a fraction expressing the impairment of the quality of life experienced by survivors. The practical difficulties in developing a set of quality adjustment fractions are formidable, and the concept has been criticized as presenting a political issue as a technical issue (Smith I987). It is clear, however, that the concept could also be used in risk analysis to determine a3. Also, for serious birth defects, QALY could be combined with loss life expectancy to give a5. The strong emotional aversion factor to serious birth defects, which shows itself in the large cost awards of compensation to victims of proved medical negligence or harm from a drug, suggests that society would assign a large value, possibly unity, to a5.

These possible techniques to determine a2, a3 and a5 will not give numbers significantly less than the value of unity for immediate death, and it remains questionable whether we should demand such numerical accuracy in such an uncertain area as risk analysis. Although we have no way of determining a4 at present, we can argue that it is this number that has the best case for being chosen to be significantly less than unity. When faced with a potential disaster, most, but not all, people choose evacuation rather than risk death or incapacity. As I discuss in more detail later, evacuation is one of society's major means of avoiding personal disasters. If it is found necessary to given an overall value of N from equation (1), I would therefore favour a value of 0.1 for a4.




Accidents and disasters lead to other unpleasant 'minor' consequences to individuals such as temporary evacuation (this is very common), disruption (e.g. the need to take iodate tablets), and psychological trauma. Although it might be possible to quantify some of these consequences, for many it would be very difficult. They could be totally ignored as contributing to a measure of societal risk, but would at least partly be included in the financial measures to be considered next.

(b) Financial and societal risks A societal risk is meant to represent the risk to society as a whole of the

realization of a specified hazard. So far I have considered it to be measured using a sum of individuals affected, in the spirit of the definition of Appendix A. An obvious example, Three Mile Island, suffices to show that this measure is insufficient. In this accident the number of people affected, as measured by equation (1), is practically zero, yet no-one would deny that Three Mile Island was a major accident. There was considerable psychological trauma from the temporary evacuation and other factors, but this is difficult to quantify. In financial terms, however, it assumes its true proportion: the cost of dismantling and cleaning up the plant alone has been put at about $1000 M. This and the cost of the temporary evacuation and the loss of electricity are costs that have ultimately to be met by society.

A Soviet estimate of the costs of Chernobyl is given in table 3. These costs are real and often immediate, as opposed to the hypothetical number of cancers induced, but which may be lost in the enormous background of cancer incidence. However, it is this very fear of iukduced cancer that leads to about half the costs, i.e. those from lost agricultural output and evacuation. In Western Europe the costs of Chernobyl, which may reach $100 M, mainly arise from its effects on agriculture. I consider this further in the next section.

The nuclear industry is not unique in being exposed to such cost risks; the Seveso incident involving dioxin is an example of one which has affected the

TABLE 3. SOVIET ESTIMATES OF THE COSTS OF CHERNOBYLa

cost detriment $ million

loss of reactor 1040 clean up operation 350-690 health care (present and future) 280-560 lost agricultural output 970-1940 relocationb and miscellaneous 70 administrative costs

lost export earnings (hard currency - 220-660 extra oil diverted from exports)

lost industrial output not given total 2930-4950

a Economic consequences of the accident at the Chernobyl nuclear plant. Plan Econ Reports, issue 20 quoted in Financial Times energy report (216/19-20, 13 June 1986).

b The main omission from this table would seem to be the cost of rehousing the 135000 people evacuated. At about $10000 per head, this wold be at least $1000 million.



446 C. F. Clement

chemical industry. It has also had other costs indirectly through the European Community's 'Seveso Directive', which requires tighter controls.

The total cost, C, of overt societal measures, such as given in table 3, could be used to specify another measure of societal risk. For large nuclear accidents, or other major accidents that lead to extensive and prolonged contamination of the environment, it is at least as important to consider this financial measure of risk as risk measured by the number of real or hypothetical deaths. The financial measure incorporates evacuation costs that give some measure of the dominant disruption to individuals.

To compare to the other personal risks, a total cost could be defined as

T=C+bN, (2)

where b is a value assigned to a human life for making risk analyses. Such an assignment is controversial, but values of b are currently used to obtain

guidelines as to the necessity of taking regulatory or preventative action against hazards. For example, in the U.K. the Department of Transport currently has plans to raise the notional cost of road death from ?283 000 to ?500000 for making cost-benefit analyses of road building projects (Anon I988b). They are com- missioning major research on the costing of ?14000 for serious injuries. If this category were to be equated with our one of serious incapacity, it would give a2 = 0.05. However, judging by insurance claims for those incapacitated as a result of an accident, brain damaged or confined to a wheelchair for example, the costing of serious incapacity should be close to that of death rather than that of a recoverable serious injury. In general, legal requirements would be a source of values for the ai and b.

In the U.S. an analysis (Travis et al. I987) of decisions by federal authorities, particularly the Environmental Protection Agency, shows that regulatory guidelines for environmental carcinogens are consistent with action to reduce risk if the cost is below $2 M per life saved. Allowing for the exchange rate and difference in wealth of the society, this is about twice the British value.

If equation (2) is to be used to calculate T, the overt costs of evacuation should not be included in ba4N4 as well as in C. Rather, ba4 could be viewed as the cost of the hardship and loss of personal possessions imposed on an individual by permanent forced evacuation.

There is no necessity to have a single measure, such as N or T, for the quantification of the harm of a disaster. However, if a society wishes to express all its values in monetary terms, values of T give a means of comparing widely different events.

(c) Timescales, pollution and nuclear risks Pollution can be the result of a disaster such as Chernobyl and we have

suggested two types of measures of risk that can be applied, personal and financial. The differences between the risks from pollution and a sudden disaster, such as an unexpected volcanic eruption, is that, for the former, society has time to respond to lower the personal risk. The most drastic action is to order evacuation, one of the most common measures to deal with disasters. Secondly, other measures can be taken to interdict foodstuffs, stop the use of agricultural land and not to use




some water supplies. All such measures carry a cost and in effect do two things to our measures of harm.

(i) Society reduces the harm from a disaster by transferring the personal risk from one of death or injury to one of evacuation.

(ii) Society reduces the personal risk by various means which may have the effect of increasing the overt cost C of the disaster.

In advanced countries, such as the U.S.A., the policy of evacuation is well developed to deal with potential disasters such as hurricanes and the recent volcanic eruption at Mt St Helens. In the latter case, some individuals refused to move in spite of warnings of imminent disaster, and lost their lives. In Bangladesh, on the other hand, there is a regular periodic loss of life in floods showing that a poor country cannot easily afford the type of evacuation service which would save lives. Unfortunately, it is not possible to divorce the cost of a life from the economic resources of a country.

To be consistent, I ought to be able to show that the actions (i) and (ii) reduce T, the total cost. This will be true if the criteria under which they are taken refer to a specified value of b. At present, such criteria are not applied to different types of disaster or pollution, and gross anomalies exist between the treatment of some disasters and types of pollution and others. This is partly because of the factors discussed in ?3.

To elaborate upon the above remarks, I now discuss risks from large nuclear accidents in detail. As already implied, their dominant measures of detriment are the number of delayed cancer deaths, N2, the number of people permanently evacuated, N4, and the cost, C. Very large costs can be incurred, as at Three Mile Island, even if there is practically no release of radioactive material. On this basis alone, it repays the world's nuclear industries to adopt reactor designs and safety measures to ensure that they do not happen. The containment at Three Mile Island prevented harm to the public, but not cost to the industry.

The hypothetical cancer deaths are calculated to arise from the release of radioactive material, and the evacuation measures and additional costs arise from society's response to the hazard posed by the release. The nature of the hazard depends on the type of radioactivity released and its half-life, but, for the relatively long-lived volatile caesium species which could dominate the release, there is always time to take countermeasures. For species as long-lived as the caesium isotopes, the effect of a sudden release is likely to be indistinguishable from a slow build up. What is important is the level of caesium on the ground and environmental pathways, rather than the timescale of the release. This makes the effect of a large nuclear accident similar to that of any other hazardous large-scale pollution from a risk point of view. The hazard presented must be balanced against the cost of preventive measures (i) and (ii).

To understand the behaviour of measures of risk of nuclear accidents, I show in figure 3 plots of calculated values (Kelly & Clarke I982) of N1,N2 and various economic measures of the severity of hypothetical accidents at Sizewell 'B' power station as functions of the amount of radioactivity released. N1 is zero unless the release is extremely large and N2 has the approximate linear dependence on the release R expected on the basis of the linear hypothesis between dose and cancer



448 C. F. Clement

induction. On the other hand, the economic consequences and numbers of people evacuated increase much faster than linearly with R. The flattening of the graphs of land area and cattle interdicted for R > 1018 Bq is an artifice of the calculation which cut off consequences outside a specified area.

The results of figure 3 show clearly that the risk of a nuclear accident, as measured by the cost C, is proportionately greater for larger releases, R. This is because countertmeasures such as land interdiction and evacuation have thresholds at which they are implemented. These are usually set to prevent individual doses to the public exceeding specified amounts. The collective dose, which leads to N2 via the linear hypothesis, has no threshold. Values of N2 and their indication of the severity of the accident may be very misleading, as we now discuss.

o o early deaths a 106 x x late cancer deaths *

4-*-o initial land area / interdicted (kM2) /

e--e initial livestock interdicted

* -e people a evacuated /

//

/ /4

102 ./0

/~~~RB

FIGURE 3. Expected numbers, N, of Sizewell ' B' accident coiisequences, averaged over weather conditions (Kelly & Clarkie I982) for various releases parametrized by the 131I1 equivalent release.

The difficulties of extrapolating the effects of doses of carcinogenic substances down to low levels are described by Ames et al. (I987). As shown in figure 4, this affects radiation doses in a particularly strong fashion because of natural background radiation and its large variation from place to place and person to person. Weinberg (I987) has emphasized that science simply cannot say whether




104 103 chance of

-l immediate death good statistical evidence of induced cancer

103 1 102

approximate lower limit of evidence of

102 general harm from radiation 102 _ 101_.'' -o

NRPB recommended limit for radiation

15 workers -'natural lo1' io S 101 - |

~~~~~~~~background _100

o I1 7t average background in U.K.X

Ca 100 10-1

* Chernobyl: average first

, year doses in 10-| W. Europe 10-2

NRPB 1 in 106 risk T 0.03 _ __ .__-___- - -_-_- _ _______ _

Chernobyl: | subsequent

10-2 I years 10-3

proposed De Minimus doses

10-3' 10-4 FIGURE 4. Radiation doses, D, with their effects on various

logarithmic scales. (a 1 rem = 10-2 Sv.)

doses corresponding to those received from Chernobyl in Western Europe are deleterious to man. These dose levels also apply to most of those received in Eastern Europe and the Soviet Union, particularly after the first year. This is the main reason why a very large error bar has been put on the projected delayed deaths from cancer in figure 1. It is unscientific to characterize a disaster, or indeed anything else, by a theoretical quantity which is inherently not observable. The measure of cost, C, however, isvery real for a big nuclear accident which is a good reason to prefer this measure, and, on a personal level, N4, as giving truer representations of its magnitude as a disaster. Only for the most severe conceivable accidents would N1 give a comparable measure.



450 C. F. Clement

3. THE CALCULATION AND REDUCTION OF RISKS

The calculation of a risk requires a measure of the consequences, which has been discussed above, and a frequency. For disasters that have occurred often enough in the past and which are unaffected by a changing world a frequency can be obtained from historic data, even for relatively infrequent events. For example, it is now known (Francis i 983) that there have been 10 eruptions from giant volcanic caldera in the past million years, giving a frequency of 10-5 a-1. Because 1000 km3 of material is emitted in a typical eruption, and three eruptions left about half the U.S.A. covered in ash centimetres deep (Francis I983), they present a major risk to the human race.

I am more concerned here with more immediate risks, and the fact that man's activities are affecting the world by changes in timescales of the order of a lifetime. These activities are leading to new risks and changes to existing risks. It is a challenge to be able to calculate and reduce the risks of ensuing disasters, because otherwise future generations can justly accuse us of exposing them to unacceptable and unavoidable risks. In this chapter I consider some of the factors that enter into such calculations together with some examples.

(a) Constituent factors in risks In table 4 are shown some major factors, and constituents, which enter into the

calculation and reduction of risks. Detailed analyses of the course of events during man-made disasters (Turner I978) shows the importance of the recognition of risk and its human elements. In new situations we have to learn what constitutes a risk, just as a child has to learn to recognize the risks of crossing a road.

TABLE 4. MAJOR FACTORS IN THE REDUCTIONS OF RISKS

major factor constituent factors recognition of risk human knowledge

transmission of knowledge safety regulations human failings

judgement of magnitude quantitative measures of risk probabilistic safety analysis (PSA)

ease of avoidance possible alternative actions additional safety measures enforcement of regulations cost

Apparently innocuous courses of action, such as the release of relatively small quantities of inert chlorofluorocarbons (CFCs) into the atmosphere, can lead to disasters in the long term. The recent discovery of the ozone hole in Antarctica may mean that it has been recognized in time, as the third factor in table 4, ease of avoidance, is not unfavourable. Alternatives to CFCs are available and are being developed.

The CFCs are an exception in that most of the waste products of society can probably be put into the environment without threatening future disasters.




However, with the exception of radioactive species whose movements are easy to track, there are currently large areas of ignorance in knowledge of the movements of materials in the environment. Of major cause for concern is the report by Nriagu & Pacyna (I988) that man has now overtaken natural processes as contributing more to the global biogeochemical recycling of trace metals. The authors say that 'the annual total toxicity of all the metals mobilized exceeds the combined total toxicity of all the radioactive and organic wastes generated each year, as measured by the quantity of water needed to dilute such waste to drinking water standard'.

The magnitude of the risk posed by sources of pollution can be calculated as for a point in time source as Chernobyl. The consequences are similar - increased personal risks of cancer or other disease, interdiction of land or food produced - and can be given an economic cost. For consequences that are linearly proportional to the pollution, the risk per year is the harm done per year. If, as is more likely, there is a threshold, the risk viewed over a long timescale can be defined as

risk measure of consequences of reaching threshold number of years to reach threshold

Pollution events will happen at this frequency unless action is taken to avoid them. The only difference with 'sudden' events is the timescale and the lack of time to take action in them. Yet, with improved techniques to give adequate warnings, the consequences and hence the risks of 'sudden' disasters such as eartnquakes, floods and accidents at industrial plants can also be reduced.

A procedure therefore exists to obtain quantitative measures of risks for disasters ranging from long-term pollution build-up to earthquakes and even meteoric impacts. The term 'probabilistic safety analysis' (PSA), however, to describe risk analysis in the area, is partly a misnomer because there is often only a small element that is truly stochastic in nature that is really involved. For example, hurricane formation, which arises from physical instabilities, may be regarded as stochastic, but earthquakes are not, as we discuss in ?3c. The human causes of accidents are mostly also not stochastic and can be reduced by greater awareness and safety regulations. Some other initiators of accidents may be stochastic events, but the response of the system to the initiator, including the human response, will have many non-stochastic elements.

Finally, the ease of avoidance factor is extremely important. Once a risk is recognized, it can often easily be reduced to zero if alternative courses of action are available at low cost. Cheap safety devices are always worthwhile, but cost will often be a major factor in avoiding disasters.

(b) Recent and future disasters Disasters are distressingly frequent events as is shown by the list of recent large

disasters in table 5. In none of them were the consequences outside some control by man, and they illustrate graphically the factors given in table 4. Many people live in areas where the risk of disaster is high, but this has not been evaluated or communicated to them. However, the people of Bangladesh, who suffered from



452 C. F. Clement

TABLE 5. RECENT LARGE DISASTERS

main personal disaster consequence human factors involved

drought: > 100 000 died deforestation - agricuiltural Ethiopia 1984 practices, lack of aid

floods: 10000 died lack of warning and evacuation Bangladesh 1985 facilities

Volcano: 25000 died in mud flow warnings not heeded by local Nevado del Ruiz, authoritiesa 1985 Columbia

earthquakes: 10000 died unstable buildings: failure to Mexico City 1985 enforce building regulationsb Tangshan 1976 250-750000 deaths coal mining under cityc

dam breaks: 15000 deaths Gujarati 1979

chemical plant: 12000 died or severely lack of control, housing Bhopal 1984 disabled adjacent to plant

nuclear reactor: 135000 long term design failures, failures to follow Chernobyl 1986 evacuations and enforce safety regulationsd a Anon. (I986); b BBC (I986); CUnconfirmed report in Gribbin (I984); d Gittus et al.

(i988).

floods again in 1988, have no easy way of avoiding disasters. Without international help, the costs of avoiding them are too great.

On the basis of present knowledge, it is possible to predict some future disasters which have a high probability of occurrence, see table 6. By now, there is a large literature on the greenhouse effect and its possible consequences. The importance of changes in precipitation, particularly as affecting the Sahel region of Africa, is brought out by Bradley et al. (I987). Schneider (I987) discusses climate modelling and predictions that the greenhouse effect will lead to a 'dry zone' in the North American grain belt, an effect which occurred in 1988 and was associated with the greenhouse effect by Hansen (I988). Even modest changes in sea level (Henderson- Sellers & McGuffie I986) could have a drastic effect on Bangladesh, for which 70 % of the existing land area is not more than about 2 m above sea level.

The other potential disasters referred to illustrate the lack of awareness in allowing large developments in areas prone to natural events. In southern California, the probability of a magnitude 8 earthquake in the next 30 years is assigned to be 50% (Wesson & Wallace I985). I now go on to discuss the predictability of disasters in general.

(c) Predictions of disasters To obtain a risk for a potential disaster we require predictions both of the

magnitude of the consequences and of the frequency or timescale in which it could occur. All the factors in table 4 are involved, and the process of calculating a risk can often lead to its reduction. The results of a PSA by the Health and Safety Executive of risks from industrial installations in the Canvey Island and Thurrock areas of Essex (Her Majesty's Stationery Office (HMSO) I 978) led to improvements in safety and substantial reductions (factors of 20 typically) in risk (HMSO I98I).




TABLE 6. DISASTERS WITH A HIGH PROBABILITY OF OCCURRENCE DURING THE

NEXT 100 YEARS

number of disaster people at risk factors

present agricultural areas turned 108 lack of knowledge of consequences into deserts from climatic of adding CO2 and methane to changes induced by"greenhouse the atmosphere. Lack of effecta alternatives to burning coal

loss of life and destruction by flooding in: coast of Bangladesh 107 lack of safer environment for

inhabitants. Rise in sea level from greenhouse effect

Tampa Bay, Florida 65000 lack of awareness of danger of development in area liable to destruction by hurricanec

destruction of part of Juneau, 102-103 lack of awareness of risk in Alaska by an avalanched allowing development

loss of life and destruction from 2 x 105 difficulties in predicting the event collapse of Colima Volcano in and in avoiding destruction Mexicoe

loss of life and destruction in a 106_107 development in earthquake zones. major earthquake in Southern Prediction difficulties California' a See text and Bradley (I987), Schneider (I987), Hansen (I988); bHenderson-Sellers &

McGuffie (I986); C Frank (I980); d Cupp (i982); e Anon. (I988a); fWesson & Wallace (I985).

Whatever the detailed causes of a type of disaster, the simplest method of obtaining the risk is from historic data. For large disasters, as opposed to common events, this is not always easy to do as their frequency is small. The best actual data are probably for earthquakes, and in figure 5 we show some frequency distributions of multiple fatalities. That for Europe and the Mediterranean is based on the 37 earthquakes in which deaths occurred reported by Whittow (i 980: figure 17, p. 60-61). That for Iran was deduced from the data for 78 earthquakes in 1903-77 given by Seaman (I984: figure 1, p. 11) which was originally reported by Berberian (I978). The worldwide frequency is based on the data of table 7. There is enough data here to obtain reliable estimates of risk. For example, the risk of major earthquake killing more than 100000 people is about 10-2 a-1 in the Mediterranean region, and is substantially larger worldwide.

By contrast we also show in figure 5 Dutch risk criteria of multiple fatalities. The discrepancy between the curves is such that we can conclude that levels of safety being demanded against one type of event are many orders of magnitude greater than that for other events. Although The Netherlands are not in an earthquake zone, realistic estimates of the frequencies of multiple deaths from North Sea floods would be well above the risk criterion. The risk from the 'man- made' greenhouse effect would be unacceptable.

A purely statistical estimate of risk is only really valid if the events concerned are stochastic in nature, and no risk avoidance measures are possible. For

17 Vol. 424. A



454 C. F. Clement

~~ I ~~Iran earthquakes World

Mediterranean c

a10-3 -

e unapeptable

\reduction\ \esired\

lo5- 0 risk criteria

,acceptnabe 100 102 104 106

N

FIGURE 5. Frequencies, f, of twentieth century multiple fatality (N) earthquakes in Europe and the Mediterranean (Whittow I980), Iran (Seaman I984) and forN > 100000 worldwide (see table 7). By comparison, the provisional Dutch safety criteria for multiple early deaths from an industrial plant are also shown (Versteeg & Visser I987).

TABLE 7. DEATHS FROM MAJOR EARTHQUAKES IN THE 20TH CENTURY

date location deaths N)

1908 Messina (Italy) 160000 1920 China 180000 1923 Tokyo (Kwanto) 156000 1927 China 200000 1976 Tangshan (China) 250000-750000a

a Widely differing numbers of deaths are reported for this earthquake.

example, if earthquake warnings are possible, the nature of the risk posed becomes more financial than personal. The present understanding of earthquakes is such that reliable warnings are on the verge of possibility (Wesson & Wallace I985).

In table 8 I try to summarize the nature of the risk for a range of possible disasters and whether it could be reduced. In column 2 I state whether the event is the result of random fluctuations. This is certainly true of hurricanes that form through physical instabilities over tropical oceans. Their formation only demands a threshold temperature for the ocean surface. Volcanic eruptions and earthquakes




TABLE 8. PREDICTIONS AND REDUCTIONS OF RISKS

warning possible changes to disaster stochastic timescale frequency consequences

personal financial hurricane yes hours to days no NN4 C; (building

location) volcanic not in minutes to ? no iN4 no eruptions principle

earthquake not in none to ? no (?) no or N->N4 C; (building principle location, design)

floods yes minutes to yes N-> N4 C; (building hours location)

meteoric no ? no no no impact

dam breaks partly minutes to yes N-> N4 C; (building hours location)

severe accidents chemical partly minutes to yes N-> N4 C small unless plants hours (short explosions

term effects) involved nuclear partly mins to hours yes N1, N3->N4 Ct only at reactors (short term) expense of N

days to years N3 -> C (long term)

long-term pollution CFCs no years to tens yes N3-> C no

of years CO2 no tens-hun-dreds yes N1> N4, C no

years

occur through physical processes that are mainly deterministic so that there is a hope of calculating them in future. Meteorites continue on predestined courses; they need detection for these to be predicted. Only a few elements in severe accidents to man-made structures are truly stochastic, although some elements about which we have only empirical knowledge may be treated as such in PSA. Design, knowledge and the human factors listed in table 4 are generally much more important than stochastic elements and can enable frequencies to be reduced. Long-term pollution is of course not stochastic in nature.

The warning timescale is very important because it may be long enough for the frequency or course of the event to be altered. Except in the case of earthquakes and possibly for meteoric impacts, where there can be practically no warning, a well organized society can always reduce the personal risk of death by temporary evacuation. In the case of earthquakes this can be done from earthquake zones by permanent evacuation. Control measures to prevent flooding have been taken in many countries already. Financial risks can be reduced for destructive disasters by more appropriate design and location of buildings. However, for existing long- term pollution, which can include radioactivity from reactor accidents, costs can only be reduced at the expense of increasing personal risks. This is one reason why it is desirable to make the financial link between the risks given by equation (2).

17-2



456 C. F. Clement

On the other hand pollution rates can be reduced, which is the interpretation to be given to the possibility of frequency changes in table 8.

To calculate risks for actual events, an approach using PSA iS superior to a pure statistical approach. More knowledge can be incorporated into PSA and stochastic elements can be reduced to the points at which they actually apply, using, for example, branch point probabilities. Attempts (Islam & Lindgren I986; Hsu I987; Tat Chi Chow & Oliver I988) to base the calculation of the frequency of severe nuclear accidents purely on existing data are flawed because of the following.

(i) Reactors of different designs will have different frequencies. It would be absurd if the accident data on the crash at the Paris air show of the Russian supersonic plane, Concordski, which was subsequently abandoned, were used to calculate the frequency at which Concorde would crash.

(ii) The frequency of an accident to a reactor of a given, or similar, type is reduced following a previous accident by the installation of additional control or safety measures. The same process in aircraft operation and design has produced at least a tenfold increase in safety.

For U.S. light-water reactors, PSA analyses (United Stated Nuclear Regulatory Commission (USNRC) I987) are consistent with the existing accident data including the Three Mile Island incident in predicting core-melt frequencies between in the range 10-3 to 10-5 a-1. For a more modern design, Sizewell B in the U.K., the predicted frequency is about 106 a-1 (Gittus I983). However, the accident at Chernobyl points to the need to ensure that PSA analyses take possible human behaviour into account.

Long-term pollution can lead to disasters just as much as the other events listed in table 8. A recent conference on the environment held in Toronto (Changing Atmosphere Conference i988) came to the conclusion that, with present atmospheric emissions, 'humanity is conducting an enormous, unintended, globally pervasive experiment whose ultimate consequences could be second only to a global nuclear war.' To the author's knowledge, no comprehensive risk analysis has been done on the effect of CO2 and other gas emissions which could lead to a significant climatic change. There is enough literature, however, to attempt to give an idea of the possible consequences. In figure 6 I show a possible disaster profile for a major climatic change. Rises in sea level will mean catastrophic floods in unprotected areas like Bangladesh. Shifts in vegetation zones could lead to inadequate grain to protect vulnerable areas from starvation. In 1988, because of the North American drought, world grain stocks fell for the second year in succession (figures from the United Nations Food and Agriculture Organisation as reported in The Guardian 12 August 1988) and large areas such as the Sahel region of Africa are very vulnerable to drought. The largest effect, however, would be forced migration from areas where agriculture is no longer possible. That such areas will exist is inevitable from a climatic change that would take the world's climate outside its range of variability for the last 100000 years, although their exact whereabouts cannot be predicted at present. In a world population of 5000 million, the numbers shown in figure 6 may be underestimates. There are few countries able or willing to accept mass immigration and the danger also exists of conflicts induced by climatic change.




108

numbers of people affected

107 106

sudden delayed permanent deathsin deaths from induced floods starvation migration

FIGURE 6. Possible disaster profile for a major climatic change.

4. CONCLUSIONS The applications of risk analysis to disasters involving very many people and

societal risk is not a straightforward science. In this paper I have attem'pted to answer some simple questions.

What is the nature of the risk, i.e. the consequences of the disaster concerned? How could risks of disasters with different consequences be compared? What are the important factors that lead to disaster? How are predictions made and can the frequencies of disasters and the nature

of their consequences be reduced ? My conclusions are the following. 1. Consequences may be generally divided into personal and financial. I have

characterized the differing personal consequences by a 'disaster profile', which differs sharply, for example, between the accidents at Bhopal and Chernobyl.

2. Risks for different consequences can be related by setting values on detriments, and, in particular, a monetary value for a human life. Although this is not always necessary, it plays an essential role when society judges whether it is 'worth' the cost of protecting against a disaster.

3. Timescales of disasters play a vital role in society's response which is, if time allows, to transfer risks of death or injury to those of evacuation and cost.

4. It may be preferable to regard risks from severe nuclear accidents as mainly a personal one of evacuation and as a financial risk. In these terms, the risk increases faster than linearly with the amount of radioactivity emitted. These risks are also observables, whereas the traditional method of counting delayed deaths from cancer is not scientifically observable when the doses concerned are of the order, or less than doses from background radiation.

5. Knowledge, and its transmission, plays a vital role in reducing both the consequences and frequency of disasters, and therefore the risk. When assessing the probability of an event, a crucial question to ask is: how much is known about the processes that could lead to it ?



458 C. F. Clement

6. Statistics alone can be used to deduce the frequency of some large disasters, such as earthquakes, but is inferior to PSA, which incorporates statistics with other information, as many disasters, including 'natural' ones, are not really stochastic in nature. The very process of PSA can lead to reductions in frequency by identifying risks and their causes, which can be avoided.

7. Disasters can ensue over a long timescale from pollution. Transfers of metals into the biosphere and gases into the atmosphere are the processes by which humanity may be causing the largest risks of future disasters.

I thank Dr A. R. Garlick, Dr M. R. Hayns, Professor L. E. J. Roberts, Mr P. A. H. Saunders and Mr A. R. Taig for many stimulating discussions on the topics covered in this paper.

APPENDIX A. FORMAL DEFINITIONS OF RISK

The definitions given below are slight adaptations of those developed by the Institution of Chemical Engineers (ICE I985).

Hazard. A physical situation with a potential for human injury, damage to property, damage to the environment or some combination of these.

Risk. The likelihood of specified undesired events occurring within a specified period or in specified circumstances arising from the realization of a specified hazard. It may be expressed as either a frequency (the expected number of specified events occurring in unit time) or a probability (the probability of a specified event following a prior event), depending on the circumstances.

Individual risk. The freqliency at which an individual may be expected to sustain a given level of harm from the realization of specified hazards.

Societal risk. The frequencies with which specified numbers of people in a given population, or the population as a whole, sustain a specified level of harm from the realization of specified hazards.

REFERENCES

Anon. I986 New Scient. 112, no. 1538, 19. Anon. I988a New Scient. 119, no. 1603, 24. Anon. i988b New Scient. 119, no. 1621, 31. Ames, B. N., Magaw, R. & Gold, L. S. I987 Science, Wash. 236, 271-280. BBC I986 Panorama programme on Mexico City earthquake. Berberian, M. I978 Disasters 2, 207-219. BMA I987 Living with risk, The British Medical Association guide. Chichester: John Wiley. Bradley, R. S., Diaz, H. F., Eisscheid, J. K., Jones, P. D., Kelly, P. M. & Goodess, C. M. I987

Science, Wash. 237, 171-175. Changing Atmosphere Conference I988 The changing atmosphere, implications for global

security, Toronto, Canada. Cupp, D. I982 Natn. Geographic 162, 290-305. Francis, P. I983 Scient. Am. 248, 46-56. Frank, N. I980 Quoted in Natn. Geographic 158, 374. Gittus, J. H. I983 CEGB proof of evidence to Sizewell 'B' public enquiry on: degraded core

analysis, CEGB P16 vols 1 and 2. Gittus, J. H. et al. I988 The Chernobyl accident and its consequences, 2nd edn, NOR 4200.

London: UKAEA.



Rissk characteristics 459

Gribbin, J. I984 Earthquakes and volcanoes. Greenwich, Connecticut: Bison Books. Hansen, J., Fung, I., Lacis, A., Rind, D., Lebedeff, S., Ruedy, R., Russell, G. & Stone, P. I988

J. geophys. Res. 93, 9341-9364. Henderson-Sellers, A. & McGuffie, K. I986 New Scient. 110, no. 1512, 24-25. HMSO I978 Canvey. An investigation of potential hazards from operations in the Canvey

Island/Thurrock Area. London: HMSO. HMSO I98I Canvey. A second report. London: HMSO. Hsu, K. I987 Nature, Lond. 328, 22. ICE I985 Nomenclature for hazard and risk assessment in the process industries. Rugby:

Institution of Chemical Engineers. Islam, S. & Lindgren, K. I986 Nature, Lond. 322, 691-692. Kelly, G. N. & Clarke, R. H. I982 An assessment of the radiological consequences of releases

from degraded core accidents for the Sizewell PWR. NRPB R137, Chilton, Oxfordshire: National Radiological Protection Board.

Kind, P., Rosser, R. & Williams, A. I982 The value of life and safety (ed. M. W. Jones-Lee), pp. 159-170. Amsterdam: North Holland.

Marshall, W., Billington, D. E., Cameron, R. F. & Curl, S. J. I983 Big nuclear accidents. Harwell report AERE-R10532.

NRPB I987 NRPB guidance on risk estimates and dose limits, NRPB-GS9. Chilton, Oxfordshire: National Radiological Protection Board.

Nriagu, J. 0. & Pacyna, J. M. I988 Nature, Lond. 333, 134-139. The Royal Society I98I The assessment and perception of risk. (206 pages.) London: The Royal

Society. The Royal Society I983 Risk assessment. A study group report. London: The Royal Society. Schneider, S. H. I987 Scient. Am. 256, 72-81. Science, Wash. I987 [Risk assessment issue with 6 articles and an editorial] 236, 241-300. Seaman, J. i984 Epidemiology of natural disasters, vol. 5. (Contributions to epidemiology and

biostatistics) (ed. M. A. Klingsberg). Basel: S. Karger. Shrivastava, P. I987 Bhopal: anatomy of a crisis. Cambridge, Massachusetts: Ballinger

Publishing Co. Smith, A. I987 Lancet, i, 1134-1136* Tat Chi Chow & Oliver, R. M. I988 J. Forecasting 7, 49-61. Travis, C. C., Richter, S. A., Crouch, E. A. C., Wilson, R. & Klema, E. D. I987 Chemtech. Aug.

478-483. Turner, B. A. I978 Man-made disasters. London: Wykeham. UKAEA I988 Social risk: a review of the technical basis for the management of risks to society from

potential major accidents. USNRC I987 Reactor risk reference document NUREG-1150, draft for comment. Washington,

D.C.: US Nuclear Regulatory Commission. Versteeg, M. F. & Visser, B. J. I987 A PRA guide for the Netherlands; a consequence of the Dutch

policy on the risk management applied to nuclear energy. Presented at probabilistic safety assessment and risk management conference, Zurich.

Weinberg, A. M. I987 Risk analysis 7, 281. Science, Wash. 237, 119. Wesson, R. L. & Wallace, R. E. I985 Scient. Am. 252, 23-31. Whittow, J. I980 Disasters. Harmondsworth: Penguin Books. Wijkman, A. & Timberlake, L. I985 Natural disasters: acts of God or acts of man? London:

Earthscan. Williams, A. I985 Br. med. J. 291, 326-329.



Documents

The Characteristics of Risks of Major Disasters