Annex – Revised Guidelines for Formal Safety Assessment (FSA) For Use in the IMO Rule-Making Process

1 INTRODUCTION

1.1 Purpose of FSA

1.1.1 Formal Safety Assessment (FSA) is a structured and systematic methodology, aimed at enhancing maritime safety, including protection of life, health, the marine environment and property, by using risk analysis and cost-benefit assessment.

1.1.2 FSA can be used as a tool to help in the evaluation of new regulations for maritime safety and protection of the marine environment or in making a comparison between existing and possibly improved regulations, with a view to achieving a balance between the various technical and operational issues, including the human element, and between maritime safety or protection of the marine environment and costs.

1.1.3 FSA is consistent with the current IMO decision-making process and provides a basis for making decisions in accordance with resolutions A.500(XII) on Objectives of the Organization in the 1980s, A.777(18) on Work methods and organization of work in committees and their subsidiary bodies and A.900(21) on Objectives of the Organization in the 2000s.

1.1.4 The decision makers at IMO, through FSA, will be able to appreciate the effect of proposed regulatory changes in terms of benefits (e.g. expected reduction of lives lost or of pollution) and related costs incurred for the industry as a whole and for individual parties affected by the decision. FSA should facilitate the development of regulatory changes equitable to the various parties thus aiding the achievement of consensus.

1.2 Scope of the Guidelines

These guidelines are intended to outline the FSA methodology as a tool, which may be used in the IMO rule-making process. In order that FSA can be consistently applied by different parties, it is important that the process is clearly documented and formally recorded in a uniform and systematic manner. This will ensure that the FSA process is transparent and can be understood by all parties irrespective of their experience in the application of risk analysis and cost-benefit assessment and related techniques.

1.3 Application

1.3.1 The FSA methodology can be applied by:

• .1 a Member State or an organization in consultative status with IMO, when proposing amendments to maritime safety, pollution prevention and response-related IMO instruments in order to analyse the implications of such proposals; or

• .2 a Committee, or an instructed subsidiary body, to provide a balanced view of a framework of regulations, so as to identify priorities and areas of concern and to analyse the benefits and implications of proposed changes.

1.3.2 It is not intended that FSA should be applied in all circumstances, but its application would be particularly relevant to proposals which may have far-reaching implications in terms of either costs (to society or the maritime industry), or the legislative and administrative burdens which may result. FSA may also be useful in those situations where there is a need for risk reduction but the required decisions regarding what to do are unclear, regardless of the scope of the project. In these circumstances, FSA will enable the benefits of proposed changes to be properly established, so as to give Member States a clearer perception of the scope of the proposals and an improved basis on which they take decisions.

2 BASIC TERMINOLOGY

The following definitions apply in the context of these guidelines:

3 METHODOLOGY

3.1 Process

3.1.1 Steps

3.1.1.1 FSA should comprise the following steps:

• .1 identification of hazards;

• .2 risk analysis;

• .3 risk control options;

• .4 cost-benefit assessment; and

• .5 recommendations for decision-making.

3.1.1.2 Figure 1 is a flow chart of the FSA methodology. The process begins with the decision makers defining the problem to be assessed along with any relevant boundary conditions or constraints. These are presented to the group who will carry out the FSA and provide results to the decision makers for use in their resolutions. In cases where decision makers require additional work to be conducted, they would revise the problem statement or boundary conditions or constraints, and resubmit this to the group and repeat the process as necessary. Within the FSA methodology, step 5 interacts with each of the other steps in arriving at decision-making recommendations. The group carrying out the FSA process should comprise suitably qualified and experienced people to reflect the range of influences and the nature of the "event" being addressed.

3.1.2 Screening approach

3.1.2.1 The depth or extent of application of the methodology should be commensurate with the nature and significance of the problem; however, experience indicates that very broad FSA studies can be harder to manage. To enable the FSA to focus on those areas that deserve more detailed analysis, a preliminary coarse qualitative analysis is suggested for the relevant ship type or hazard category, in order to include all aspects of the problem under consideration. Whenever there are uncertainties, e.g. in respect of data or expert judgement, the significance of these uncertainties should be assessed.

3.1.2.2 Characterization of hazards and risks should be both qualitative and quantitative, and both descriptive and mathematical, consistent with the available data, and should be broad enough to include a comprehensive range of options to reduce risks.

3.1.2.3 A hierarchical screening approach may be utilized. This would ensure that excessive analysis is not performed by utilizing relatively simple tools to perform initial analyses, the results of which can be used to either support decision-making (if the degree of support is adequate) or to scope/frame more detailed analyses (if not). The initial analyses would therefore be primarily qualitative in nature, with a recognition that increasing degrees of detail and quantification will come in subsequent analyses as necessary.

3.1.2.4 A review of historical data may also be useful as a preparation for a detailed study. For this purpose a loss matrix may be useful. An example can be found in figure 2.

3.2 Information and data

3.2.1 The availability of suitable data necessary for each step of the FSA process is very important. When data are not available, expert judgment, physical models, simulations and analytical models may be used to achieve valuable results. Consideration should be given to those data which are already available at IMO (e.g. casualty and deficiency statistics) and to potential improvements in those data in anticipation of an FSA implementation (e.g. a better specification for recording relevant data including the primary causes, underlying factors and latent factors associated with a casualty).

3.2.2 Data concerning incident reports, near misses and operational failures may be very important for the purpose of making more balanced, proactive and cost-effective legislation, as required in paragraph 4.2 of appendix 8. Such data must be reviewed objectively and their reliability, uncertainty and validity assessed and reported. The assumptions and limitations of these data must also be reported.

3.2.3 However, one of the most beneficial qualities of FSA is the proactive nature. The proactive approach is reached through the probabilistic modelling of failures and development of accident scenarios. Analytical modelling has to be used to evaluate rare events where there is inadequate historical data. A rare event is decomposed into more frequent events for which there is more experience available (e.g. evaluate system failure based on component failure data).

3.2.4 Equally, consideration should also be given to cases where the introduction of recent changes may have affected the validity of historic data for assessing current risk.

3.3 Expert judgment

3.3.1 The use of expert judgment is considered to be an important element within the FSA methodology. It not only contributes to the proactive nature of the methodology, but is also essential in cases where there is a lack of historical data. Further historical data may be evaluated by the use of expert judgment by which the quality of the historical data may be improved.

3.3.2 In applying expert judgment, different experts may be involved in a particular FSA study. It is unlikely that the experts' opinions will always be in agreement. It might even be the case that the experts have strong disagreements on specific issues. Preferably, a good level of agreement should be reached. It is highly recommended to report the level of agreement between the experts in the results of an FSA study. It is important to know the level of agreement, and this may be established by the use of a concordance matrix or by any other methodology. For example, appendix 9 describes the use of a concordance matrix.

3.4 Incorporation of the human element

3.4.1 The human element is one of the most important contributory aspects to the causation and avoidance of accidents. Human element issues throughout the integrated system shown in figure 3 should be systematically treated within the FSA framework, associating them directly with the occurrence of accidents, underlying causes or influences. Appropriate techniques for incorporating human factors should be used.

3.4.2 The human element can be incorporated into the FSA process by using human reliability analysis (HRA). Guidance for the use of HRA within FSA is given in appendix 1 and diagrammatically in figure 4. To allow easy referencing, the numbering system in appendix 1 is consistent with that of the rest of the FSA Guidelines.

3.5 Evaluating regulatory influence

It is important to identify the network of influences linking the regulatory regime to the occurrence of the event. Construction of Influence Diagrams may assist (see appendix 3).

4 PROBLEM DEFINITION

4.1 Preparation for the study

The purpose of problem definition is to carefully define the problem under analysis in relation to the regulations under review or to be developed. The definition of the problem should be consistent with operational experience and current requirements by taking into account all relevant aspects. Those which may be considered relevant when addressing ships (not necessarily in order of importance) are:

• .1 ship category (e.g. type, length or gross tonnage range, new or existing, type of cargo);

• .2 ship systems or functions (e.g. layout, subdivision, type of propulsion);

• .3 ship operation (e.g. operations in port and/or during navigation);

• .4 external influences on the ship (e.g. Vessel Traffic System, weather forecasts, reporting, routeing);

• .5 accident category (e.g. collision, explosion, fire); and

• .6 risks associated with consequences such as injuries and/or fatalities to passengers and crew, environmental impact, damage to the ship or port facilities, or commercial impact.

4.2 Generic model

4.2.1 In general, the problem under consideration should be characterized by a number of functions. Where the problem relates for instance to a type of ship, these functions include carriage of payload, communication, emergency response, manoeuvrability, etc. Alternatively, where the problem relates to a type of hazard, for instance fire, the functions include prevention, detection, alarm, containment, escape, suppression, etc.

4.2.2 For application of FSA, a generic model should therefore be defined to describe the functions, features, characteristics and attributes which are common to all ships or areas relevant to the problem in question.

4.2.3 The generic model should not be viewed as an individual ship in isolation, but rather as a collection of systems, including organizational, management, operational, human, electronic and hardware aspects which fulfil the defined functions. The functions and systems should be broken down to an appropriate level of detail. Aspects of the interaction of functions and systems and the extent of their variability should be addressed.

4.2.4 A comprehensive view, such as the one shown in figure 3, should be taken, recognizing that the ship's technical and engineering system, which is governed by physical laws, is in the centre of an integrated system. The technical and engineering system is integrally related to the passengers and crew which are a function of human behaviour. The passengers and crew interact with the organizational and management infrastructure and those personnel involved in ship and fleet operations, maintenance and management. These systems are related to the outer environmental context, which is governed by pressures and influences of all parties interested in shipping and the public. Each of these systems is dynamically affected by the others.

4.3 Results

The output of the problem definition comprises:

• .1 problem definition and setting of boundaries; and

• .2 development of a generic model.

5 FSA STEP 1 – IDENTIFICATION OF HAZARDS

5.1 Scope

The purpose of step 1 is to identify a list of hazards and associated scenarios prioritized by risk level specific to the problem under review. This purpose is achieved by the use of standard techniques to identify hazards which can contribute to accidents, and by screening these hazards using a combination of available data and judgement. The hazard identification exercise should be undertaken in the context of the functions and systems generic to the ship type or problem being considered, which were established in paragraph 4.2 by reviewing the generic model.

5.2 Methods

5.2.1 Identification of possible hazards

5.2.1.1 The approach used for hazard identification generally comprises a combination of both creative and analytical techniques, the aim being to identify all relevant hazards. The creative element is to ensure that the process is proactive and not confined only to hazards that have materialized in the past. It typically consists of structured group reviews aiming at identifying the causes and effects of accidents and relevant hazards. Consideration of functional failure may assist in this process. The group carrying out such structured reviews should include experts in the various appropriate aspects, such as ship design, operations and management and specialists to assist in the hazard identification process and incorporation of the human element. A structured group review session may last over a number of days. The analytical element ensures that previous experience is properly taken into account, and typically makes use of background information (for example applicable regulations and codes, available statistical data on accident categories and lists of hazards to personnel, hazardous substances, ignition sources, etc.). Examples of hazards relevant to shipboard operations are shown in appendix 2.

5.2.1.2 A coarse analysis of possible causes and initiating events and outcome of each accident scenario should be carried out. The analysis may be conducted by using established techniques (examples are described in appendix 3), to be chosen according to the problem in question, whenever possible and in line with the scope of the FSA.

5.2.2 Ranking

The identified hazards and their associated scenarios relevant to the problem under consideration should be ranked to prioritize them and to discard scenarios judged to be of minor significance. The frequency and consequence of the scenario outcome requires assessment. Ranking is undertaken using available data, supported by judgement, on the scenarios. A generic risk matrix is shown in figure 5. The frequency and consequence categories used in the risk matrix have to be clearly defined. The combination of a frequency and a consequence category represents a risk level. Appendix 4 provides an example of one way of defining frequency and consequence categories, as well as possible ways of establishing risk levels for ranking purposes.

5.3 Results

The output from step 1 comprises:

• .1 a list of hazards and their associated scenarios (including initiating events); and

• .2 an assessment of accident scenarios (prioritized by risk level).

6 FSA STEP 2 – RISK ANALYSIS

6.1 Scope

6.1.1 The purpose of the risk analysis in step 2 is a detailed investigation of the causes and initiating events and consequences of the more important accident scenarios identified in step 1. This can be achieved by the use of suitable techniques that model the risk. This allows attention to be focused upon high-risk areas and to identify and evaluate the factors which influence the level of risk.

6.1.2 Different types of risk (i.e. risks to people, the environment or property) should be addressed as appropriate to the problem under consideration. Measures of risk are discussed in appendix 5.

6.2 Methods

6.2.1 There are several methods/tools that can be used to perform a risk analysis. The scope of the FSA, types of hazards identified in step 1, and the level of failure data available will all influence which method/tool works best for each specific application. Examples of the different types of risk analysis methods/tools are outlined in appendix 3.

6.2.2 Quantification makes use of accident and failure data and other sources of information as appropriate to the level of analysis. Where data is unavailable, calculation, simulation or the use of established techniques for expert judgement may be used.

6.2.3 Sensitivity analysis and uncertainty analysis should be considered in the quantified and/or qualified risk and risk models and the results should be reported together with the quantitative data and explanation of models used. Methodologies of sensitivity analysis and uncertainty analysis would depend on the method of risk analysis and/or risk models used.

6.3 Results

The output from step 2 comprises:

• .1 the identification of the high-risk areas which need to be addressed; and

• .2 the explanation of risk models.

7 FSA STEP 3 – RISK CONTROL OPTIONS

7.1 Scope

7.1.1 The purpose of step 3 is to first identify Risk Control Measures (RCMs) and then to group them into a limited number of Risk Control Options (RCOs) for use as practical regulatory options. Step 3 comprises the following four stages:

• .1 focusing on risk areas needing control;

• .2 identifying potential RCMs;

• .3 evaluating the effectiveness of the RCMs in reducing risk by re-evaluating step 2; and

• .4 grouping RCMs into practical regulatory options.

7.1.2 Step 3 aims at creating risk control options that address both existing risks and risks introduced by new technology or new methods of operation and management. Both historical risks and newly identified risks (from steps 1 and 2) should be considered, producing a wide range of risk control measures. Techniques designed to address both specific risks and underlying causes should be used.

7.2 Methods

7.2.1 Determination of areas needing control

The purpose of focusing risks is to screen the output of step 2 so that the effort is focused on the areas most needing risk control. The main aspects to making this assessment are to review:

• .1 risk levels, by considering frequency of occurrence together with the severity of outcomes. Accidents with an unacceptable risk level become the primary focus;

• .2 probability, by identifying the areas of the risk model that have the highest probability of occurrence. These should be addressed irrespective of the severity of the outcome;

• .3 severity, by identifying the areas of the risk model that contribute to highest severity outcomes. These should be addressed irrespective of their probability; and

• .4 confidence, by identifying areas where the risk model has considerable uncertainty either in risk, severity or probability. These uncertain areas should be addressed.

7.2.2 Identification of potential RCMs

7.2.2.1 Structured review techniques are typically used to identify new RCMs for risks that are not sufficiently controlled by existing measures. These techniques may encourage the development of appropriate measures and include risk attributes and causal chains. Risk attributes relate to how a measure might control a risk, and causal chains relate to where, in the "initiating event to fatality" sequence, risk control can be introduced.

7.2.2.2 RCMs (and subsequently RCOs) have a range of attributes. These attributes may be categorized according to the examples given in appendix 6.

7.2.2.3 The prime purpose of assigning attributes is to facilitate a structured thought process to understand how an RCM works, how it is applied and how it would operate. Attributes can also be considered to provide guidance on the different types of risk control that could be applied. Many risks will be the result of complex chains of events and a diversity of causes. For such risks the identification of RCMs can be assisted by developing causal chains which might be expressed as follows:

• causal factors → failure → circumstance → accident → consequences

7.2.2.4 RCMs should in general be aimed at one or more of the following:

• .1 reducing the frequency of failures through better design, procedures, organizational polices, training, etc.;

• .2 mitigating the effect of failures, in order to prevent accidents;

• .3 alleviating the circumstances in which failures may occur; and

• .4 mitigating the consequences of accidents.

7.2.2.5 RCMs should be evaluated regarding their risk reduction effectiveness by using step 2 methodology, including consideration of any potential side effects of the introduction of the RCM.

7.2.3 Composition of RCOs

7.2.3.1 The purpose of this stage is to group the RCMs into a limited number of well thought out Risk Control Options (RCOs). There is a range of possible approaches to grouping individual measures into options. The following two approaches, related to likelihood and escalation, can be considered:

• .1 "general approach" which provides risk control by controlling the likelihood of initiation of accidents and may be effective in preventing several different accident sequences; and

• .2 "distributed approach" which provides control of escalation of accidents, together with the possibility of influencing the later stages of escalation of other, perhaps unrelated, accidents.

7.2.3.2 In generating the RCOs, the interested entities, who may be affected by the combinations of measures proposed, should be identified.

7.2.3.3 Some RCMs/RCOs may introduce new or additional hazards, in which case steps 1, 2 and 3 should be reviewed and revised as appropriate.

7.2.3.4 Before adopting a combination of RCOs for which a quantitative assessment of the combined effects was not performed, a qualitative evaluation of RCO interdependencies should be performed. Such an evaluation could take the form of a matrix as illustrated in the following table:

The above matrix table lists the RCOs both vertically and horizontally. Reading horizontally, the table indicates in the first row any dependencies between RCO 1 and each of the other proposed RCOs (2 to 4). For example, in this case the table states that if RCO 1 is implemented, RCO 2, being strongly dependent on RCO 1, needs to be re-evaluated before adopting it in conjunction with RCO 1. On the other hand, RCO 3 is not dependent on RCO 1, and therefore its cost-effectiveness is not altered by the adoption of RCO 1. RCO 4 is weakly dependent on RCO 1, so re-evaluation may not be necessary. In principle, one dependency table could be given for cost, benefits and risk reduction. The interdependencies in the above matrix may or may not be symmetric.

7.2.3.5 Where more than one RCOs are proposed to be implemented at the same time, the effectiveness of such combination in reducing the risk should be assessed.

7.2.3.6 Sensitivity analysis and uncertainty analysis should be considered in the analysis of effectiveness of RCMs and RCOs, and the results of sensitivity analysis and uncertainty analysis should be reported.

7.3 Results

The output from step 3 comprises:

• .1 a list of RCOs with their effectiveness in reducing risk, including the method of analysis;

• .2 a list of interested entities affected by the identified RCOs;

• .3 a table stating the interdependencies between the identified RCOs; and

• .4 results of analysis of side effects of RCOs.

8 FSA STEP 4 – COST-BENEFIT ASSESSMENT

8.1 Scope

8.1.1 The purpose of step 4 is to identify and compare benefits and costs associated with the implementation of each RCO identified and defined in step 3. A cost-benefit assessment may consist of the following stages:

• .1 consider the risks assessed in step 2, both in terms of frequency and consequence, in order to define the base case in terms of risk levels of the situation under consideration;

• .2 arrange the RCOs, defined in step 3, in a way to facilitate understanding of the costs and benefits resulting from the adoption of an RCO;

• .3 estimate the pertinent costs and benefits for all RCOs;

• .4 estimate and compare the cost-effectiveness of each option, in terms of the cost per unit risk reduction by dividing the net cost by the risk reduction achieved as a result of implementing the option; and

• .5 rank the RCOs from a cost-benefit perspective in order to facilitate the decision-making recommendations in step 5 (e.g. to screen those which are not cost-effective or impractical).

8.1.2 Costs should be expressed in terms of life cycle costs and may include initial, operating, training, inspection, certification, decommission, etc. Benefits may include reductions in fatalities, injuries, casualties, environmental damage and clean-up, indemnity of third party liabilities, etc. and an increase in the average life of ships.

8.2 Methods

8.2.1 Definition of interested entities

8.2.1.1 The evaluation of the above costs and benefits can be carried out by using various methods and techniques. Such a process should be conducted for the overall situation and then for those interested entities which are the most influenced by the problem in question.

8.2.1.2 In general, an interested entity can be defined as the person, organization, company, coastal State, flag State, etc., who is directly or indirectly affected by an accident or by the cost-effectiveness of the proposed new regulation. Different interested entities with similar interests can be grouped together for the purpose of applying the FSA methodology and identifying decision-making recommendations.

8.2.2 Calculation indices for cost-effectiveness

There are several indices which express cost-effectiveness in relation to safety of life such as Gross Cost of Averting a Fatality (Gross CAF) and Net Cost of Averting a Fatality (Net CAF) as described in appendix 7. Other indices based on damage to and effect on property and environment may be used for a cost-benefit assessment relating to such matters. Comparisons of cost-effectiveness for RCOs may be made by calculating such indices.

8.2.3 For evaluation of RCOs focusing on prevention of oil spill from ships, environmental risk evaluation criteria as described in appendix 7 can be used.

8.2.4 Sensitivity analysis and uncertainty analysis should be considered in the cost-benefit analysis and cost-effectiveness, and the results should be reported.

8.3 Results

The output from step 4 comprises:

• .1 costs and benefits for each RCO identified in step 3 from an overview perspective;

• .2 costs and benefits for those interested entities which are the most influenced by the problem in question; and

• .3 cost-effectiveness expressed in terms of suitable indices.

9 FSA STEP 5 – RECOMMENDATIONS FOR DECISION-MAKING

9.1 Scope

9.1.1 The purpose of step 5 is to define recommendations which should be presented to the relevant decision makers in an auditable and traceable manner. The recommendations would be based upon the comparison and ranking of all hazards and their underlying causes; the comparison and ranking of risk control options as a function of associated costs and benefits; and the identification of those risk control options which keep risks as low as reasonably practicable.

9.1.2 The basis on which these comparisons are made should take into account that, in ideal terms, all those entities that are significantly influenced in the area of concern should be equitably affected by the introduction of the proposed new regulation. However, taking into consideration the difficulties of this type of assessment, the approach should be, at least in the earliest stages, as simple and practical as possible.

9.2 Methods

9.2.1 Scrutiny of results

Recommendations should be presented in a form that can be understood by all parties irrespective of their experience in the application of risk and cost-benefit assessment and related techniques. Those submitting the results of an FSA process should provide timely and open access to relevant supporting documents and a reasonable opportunity for and a mechanism to incorporate comments.

9.2.2 Risk evaluation criteria

There are several standards for risk acceptance criteria, none as yet universally accepted. While it is desirable for the Organization and Member States which propose new regulations or modifications to existing regulations to determine agreed risk evaluation criteria after wide and deep consideration, those used within an FSA should be explicit.

9.3 Results

The output from step 5 comprises:

• .1 an objective comparison of alternative options, based on the potential reduction of risks and cost-effectiveness, in areas where legislation or rules should be reviewed or developed;

• .2 feedback information to review the results generated in the previous steps; and

• .3 recommended RCO(s) submitted in SMART (specific, measurable, achievable, realistic, time-bound) terms and accompanied with the application of the RCO(s), e.g. application of ship type(s) and construction date and/or systems to be fitted on board.

10 PRESENTATION OF FSA RESULTS

10.1 To facilitate the common understanding and use of FSA at IMO in the rule-making process, each report of an FSA process should:

• .1 provide a clear statement of the final recommendations, ranked and justified in an auditable and traceable manner;

• .2 list the principal hazards, risks, costs and benefits identified during the assessment;

• .3 explain and reference the basis for significant assumptions, limitations, uncertainties, data models, methodologies and inferences used or relied upon in the assessment or recommendations, results of hazard identifications and risk analysis, risk control options and results of cost-benefit analysis to be considered in the decision-making process;

• .4 describe the sources, extent and magnitude of significant uncertainties associated with the assessment or recommendations;

• .5 describe the composition and expertise of groups that performed each step of the FSA process by providing a short curriculum vitae of each expert and describing the basis of selection of the experts; and

• .6 describe the method of decision-making in the group(s) that performed the FSA process (see paragraph 3.3).

10.2 The standard format for reporting the FSA process is shown in appendix 8.

11 APPLICATION AND REVIEW PROCESS OF FSA

The Guidance for practical application and review process of FSA is contained in appendix 10.

 FIGURE 1

FLOW CHART OF THE FSA METHODOLOGY

 FIGURE 2

EXAMPLE OF LOSS MATRIX

 FIGURE 3

COMPONENTS OF THE INTEGRATED SYSTEM

 FIGURE 4

INCORPORATION OF HUMAN RELIABILITY ANALYSIS (HRA) INTO THE FSA PROCESS

 FIGURE 5

RISK MATRIX

 FIGURE 6

EXAMPLE OF A RISK CONTRIBUTION TREE^footnote