Risk and Heuristics

The perception of risk affects how people behave. People tend to simplify the world; to use simple heuristics to help them understand risk and how they should behave in the face of risks. These simple rules affect how much insurance they buy, where they live, how dangerous they believe modern life is. Quoting facts and figures may do little to alter people’s behaviour or the hold of these heuristics. Studying the types of heuristics people have about risk has been a fruitful are of research since the 1970s when Tversky and Kahneman undertook their early studies (e.g. 1974, Judgment under uncertainty, Science, 185, 1124-1131). Amongst the numerous heuristics that have been researched I want to consider just three in this blog – representativeness, availability and anchoring – in the light of environmental risk.

Representativeness refers to people’s ability or tendency to view risk in one area as comparable to risk in another if the two areas, at least to them, resemble each other. Crime, whatever, its complexion may provide a convenient category for people to fear even if the causes of terrorism are different from bag snatching. The classing of both as crimes may connect the different activities as comparable in people’s minds. A previous blog discussed the media hype behind the BP oil spill. Media reports kept comparing the spill to the Exxon Valdez, forming a comparability connection in people’s minds. Both are oil spills, so they must be comparable. A closer examination of the causes and characteristics of each casts some doubt on their comparability. One was tanker spill, the other a massive, destructive blowout; one occurred in a confined water body, the other a dynamic ocean; one was associate with stark images and immediate of dying wildlife, the other with less obvious and visually striking losses of livelihoods. Yet, calling each an oil spill implies similarities in nature and similarities in response. Pointing out differences may do little to make people think that the things are different.

The ongoing floods in Pakistan are another example. Third world floods, again, may be the immediate response of some readers and viewers. The same sort of floods seems to happen every year, somewhere over there, surely by now they should know what to do? Classifying the event as a flood brings with it the risk of comparison with other events in the same class. By comparison the death toll seems small, by comparison the event seems slow, by comparison it happens a long way away. Such comparisons can become a convenient short-hand to explaining or justifying a lack of action or the vigorousness of a response. Classing an event may help to understand it but there is also a danger that we assume that as it is a member of that sort of event, we understand what it should do and how we should behave towards it. At the crudest level, for example, how many people should be dead to make it an important flood, rather than looking at the individuality of each event. Floods are different in causes, consequences and solutions; one size fitting all is as inappropriate for environmental hazards as it is for understanding most things.

The flood example is also an illustration of availability bias. Availability bias refers to the tendency for people to respond to risks more vigorously when examples of that type of risk are readily available to them. Availability may be from individual or community memory, from the media, from their beliefs about the world and any number of other sources. The Pakistan floods are compared to the impact of other floods we call to mind most readily whatever their cause. Similarly, the BP oil spill is contrasted in the media with the Exxon Valdez, as the latter is viewed as a key environmental event and so a sort of benchmark for other events, however inappropriate or appropriate the comparison might be.

On a more personal level, the fact that you may have experience a flood of your home in the last two or three years, may make you more wary of the flood risk and so more likely to purchase insurance or to try to at least as insurance companies using the same bias may raise premiums to match the increased perception of risk in your local area. Statistically, the local flood may not alter the probability of future flooding by much, if at all, but does it feel like that to you as you wade through your sodden possessions?

Anchoring refers to an individual’s or community’s starting point for assessing risk. Usually people start from a particular value that they belie is associated with a particular type of risk or event and then adjust their estimation of the risk (or its seriousness) in the light of further information. The adjustment will, however, always be in relation to that initial starting value. In other words, for the same physical risk or event, two individuals, one with a low initial estimate, the other with a high one, will interpret any further information about the risk or event in the light of their initial starting values. After the event, it is likely that both will have moved from their initial estimates but the person with the initial low value will still have a lower estimation of the risk than the person with the initial high estimation.

Once again the two recent disasters of the BP oil spill and the floods in Pakistan can be interpreted as examples of anchoring. How do you judge the impact of the BP oil spill? Initial estimates by the company and environmental groups varied. BP trying to downplay the incident, some environmental groups proclaiming nightmarish scenarios for the future of the Gulf. As the event has unfolded how have each side changed its rhetoric? BP has slowly admitted the spill was worst than initial thought, at least in terms of the amount of oil released into the ocean. Images of environmental annihilation of the Gulf have not emerged. So do you adjust your assessment of the damage wrought by the oil spill up or down as evidence and opinion have increased? Does it depend on where you started – as a committed environmentalist or as a company supporter? Does it really matter where you start, doesn’t the evidence speak for itself? Evidence is always interpreted so these heuristics are important.

Aid for the floods in Pakistan may have suffered from an anchoring effect. The areal extent of the disaster is huge and the impact and suffering caused by the floods is both massive and real, but the initial death toll seemed minor in comparison to other disasters in recent memory, such as the Haitian earthquake or the Boxing Day tsunami. It may be simplistic but impact and death toll may be related in people’s mind and a low death toll anchors the flood disaster relatively low down in a mental pecking order or recent disasters. Subsequent media coverage, celebrity appeals and governmental and UN urging for aid may be interpreted in the light of this initial anchor point.

As an additional thought, what is your individual anchor point in the ongoing ‘discussions’ about the need to reduce expenditure on public spending to clear public deficits? The debate seems to have moved beyond do we need to? The debate only seems to be how severely do we need to? Accepting the need is as much an anchor as setting an amount. I may be overly cynical but if leaks suggest a 40% cut in the spending of a government department and a review finally recommends only 30%, then you can’t help but feel a little relieved it is lower than you expected. Anchoring is a very strong tool in setting agendas both for environmental issues and for politics in general.

BP Oil Spill: Content of the Accident Investigation Report

In my previous blog I looked at the context of the report, in this blog I want to look at the content of the report (report available at http://www.bp.com/sectiongenericarticle.do?categoryId=9034902&contentId=7064891). The investigation identified eight key causes that combined to produce the incident. The eight are:

• The annulus cement barrier did not isolate the hydrocarbons
• The shoe track barriers did not isolate the hydrocarbons
• The negative-pressure test was accepted although well integrity had not been established
• Influx was not recognised until hydrocarbons were in the riser
• Well control response actions failed to regain control of the well
• Diversion to the mud gas separator resulted in gas venting onto the rig
• The fire and gas system did not prevent hydrocarbon ignition
• The blowout preventer (BOP) emergency mode did not seal the well

For each of these causes some articles assign blame to BP and its contractors (e.g. BBC report - http://www.bbc.co.uk/news/world-us-canada-11230757, Guardian article - http://www.guardian.co.uk/environment/blog/2010/sep/08/bp-oil-spill-report-deepwater-horizon-blame-game). But how did the team investigate the cause within their TOR?

Appendix I of the report outlines the method used: fault tree analysis. Fault tree analysis (FTA) is a standard method of analysing technical failures of systems using Boolean logic to combine a series of lower level or previous events. Originally developed in 1962 to analyse ICBM launch control systems (http://en.wikipedia.org/wiki/Fault_tree_analysis), the analysis starts with the undesired event as the top of the tree and then breaks the possible causes down into subsystems and assesses how these prior causes or initiators could arise. The analysis relies upon experts being able to identify how subsystems and their components fail and how these failures can build up to produce the top event, the undesired event (Figure 1). Once identified, each subsystem can be analysed to assess if it was likely to be the source of failure in the cascade that results in the top event. Failure of lower subsystem can be prevented from producing a cascade of failures to the top event if some intervening subsystem does not fail. The number of possible ways failure can occur increases as the number of subsystems increases. As the number of subsystems reduces as the top event is approached, providing fail-safe systems becomes increasingly important as there are fewer and fewer pathways to failure. The process of creating and analysing a fault tree is systematic and logical and, where information is available, probabilities can even be assigned to specific events within the branches of the tree so a likelihood of an incident can be calculated.

Figure 1 Illustratin of Fault Tree Analysis

Within Appendix I there are four fault trees outlined based on the four critical factors identified by the investigation team; well integrity, hydrocarbons entering well undetected and loss of well control, hydrocarbons igniting on Deepwater Horizon and blowout preventer not sealing the well. These four fault trees are focus of investigation and are the context in which all evidence is collected and evaluated. The team assigned each box as a possible contributing factor to be investigated, designating, where possible, if the box represented a ‘possible immediate cause’ or a ‘possible system cause’. Simplistically, ‘possible immediate cause’ can be equated to mechanical or technical failure, whilst ‘possible system cause’ can be equated with failure of communication, human mistakes of interpretation and procedures. In addition, within each box there was either a reference to a specific section of the report for further discussion, a statement that evidence ruled out that cause or a statement that the evidence was inconclusive for that cause.

Figure 2 Illustration of branches of fault tree associated with well intregity

Figure 2 illustrates a subsection of the fault tree for well integrity. This subsection of the FTA shows that more details are available in the appropriate section of the full report, but for this branch of the fault tree, all the possible causes can be ruled out based on the evidence collected. Figure 3 shows the end branches for a section of the fault tree and in this case the interaction between ‘immediate possible cause’ and ‘possible system causes’ illustrates that it is not a simple answer of either mechanical or system failure but more likely to be a complicated combination of both as you analyse the branches. Both these figures are not chosen to point to the most important cause but rather to illustrate the reasoning behind the conclusions and recommendations of the investigation team.

Figure 3 Illustration of end branches of fault tree showing possible immediate and possible system causes

The investigation team used the Swiss-cheese model to illustrate how the four critical factors and eight causes were related (Figure 4). The barriers are the defensive physical and operational barriers that were meant to prevent an incident. Although the figure makes the key relationships easier to understand it does not show the intricate web of relations that tied all the actants, physical and human, together in the complex system that produced the event. The figure does not show the web behind the barriers nor how the barriers are defined and set up in the first place. As I said in an earlier blog, experience tends to influence what is seen as important for operation and for prevention; a new incident can alter this perception and so alter what is regarded as important for different barriers and may even identify new barriers to consider in new environments or contexts. Many of the recommendations made are aimed at improving the links and flow of information between the human actants in the system to ensure that information derived about the physical actants, such as well pressure, is interpreted in a consistent and appropriate manner and that it is clear what actions should be taken and when. Likewise, the investigation highlighted the need for information flows about the state of these actants needs to be improved, such as the condition of critical components in the yellow and blue control pods for the BOP, are maintained at the standard required for them to operate correctly.

Figure 4 Illustration of Swiss cheese model of hazards analysis based on Deepwater Horizon report

Official publications associated with the disaster are:




The US Fish and Wildlfie Service have produced this publication:




Whilst other books that explore the spill and its legacy and legal aspects include:

BP Oil Spill: Accident Investigation Report

BP released the report of its internal investigation team on the Deepwater Horizon accident on 8th September 2010 (http://www.bp.com/sectiongenericarticle.do?categoryId=9034902&contentId=7064891). Media coverage of the report has made much of the alleged attempts to divert blame for the accident onto other companies; contractors involved in the operation and maintenance of the oil rig (e.g. Who’s blamed by BP for the Deepwater horizon oil spill - http://www.bbc.co.uk/news/world-us-canada-11230757, BP oil spill report: the Deepwater horizon blame game- http://www.guardian.co.uk/environment/blog/2010/sep/08/bp-oil-spill-report-deepwater-horizon-blame-game, BP oil spill: US reaction to the BP report - http://www.telegraph.co.uk/finance/newsbysector/energy/oilandgas/7990442/BP-oil-spill-US-reaction-to-the-BP-report.html). Robert Preston, the BBC’s business editor even dubbing BP as standing for ‘Blame Placing’ (http://www.bbc.co.uk/blogs/thereporters/robertpeston/2010/09/bp_stands_for_blame_placing.html). This blog looks at the report in context; a second blog will deal with the findings themselves.

The report itself is at pains to point out that it is own limitation. The second paragraph of the executive summary, for example, states:
“In preparing this report, the investigation team did not evaluate evidence against legal standards, including but not limited to standards regarding causation, liability, intent and the admissibility of evidence in court or other proceedings.”
Deepwater Horizon Accident Investigation Report: Executive Summary, 2010, p.2.

The report notes it had to work with the information available to it and draw interpretations from sometimes contradictory, unclear and uncorroborated evidence that used the ‘best judgement’ of the team, but from which others might draw different conclusions. The report even finishes with a section on what the team could not analyse. So is the report a PR exercise, an attempt to deflect blame or a genuine attempt to provide some rapid, informative answers to the questions about what caused a major environmental disaster.

The report needs to be considered in the light of how industries operate in the contemporary economic environment. I am not concerned with legal definitions of responsibility nor intend to discuss these or get into such a debate as I am sure that such heated deliberations will ensue once money comes to the fore. Robert Preston’s blog is useful in illustrating the ‘hollowing out’ aspect of modern large companies such as BP. Companies no longer do everything; contracting out aspect of their industry that they are either not good at or that other companies can do better or more cheaply has become a common practice. BP may be an oil company but it does not undertake every aspect of the oil industry in house.

Robert Preston’s blog provides a good analogy of a dodgy chicken tikka masala bought from a supermarket. If you are ill after eating the meal do you blame the supermarket or its contracted manufacturers? He states that most people would hold the supermarket accountable although the contracted company may have had the sloppy hygiene standards that produce the dodgy meal. In his blog he does point out that BP were the named party on the relevant oil lease and so assumed to exercise sufficient oversight.

My view is that the example is a little too simplistic to grasp the complexity of relationships that define a modern business enterprise. Imagine instead that you want to get to work every day to do what you are good at. You are not good at driving nor want the expense of owning a car, so you contract out both hiring a driver and leasing a car. You specify that you need a driver who can take orders and a car that is a reasonable car for your status. You tell the driver you leave a 08:10 and must be at work at 08:30. Everything seems to run smoothly, the driver is well turned out, the car is comfortable and you get to work on time. One day there is an accident as the car overturns taking a corner – who is to blame? It may seem simple, the driver is to blame, he was driving – he is the person immediately, obviously involved in the accident, its cause. BUT you specified the time; he has to drive to ensure you get there on time. Is it the pressure you put him under that caused the accident? Furhter investigation points to some mechanical problems with the brakes. Not enough on its own to cause the accident but a possible contriubting cause. The car is maintained by the leasing company, who are good at leasing but not at maintenance so contract that out. But you specified only a standard maintenance contract,you didn't specify that there would be undue wear on the brakes as you don't drive so don't know how different driving styles affect brake wear. The subcontractor states it is nothing to do with them as they maintained it to the standard specified. Where does the cause lie? With mechanical problems, with your communciation with your contractors, with your ability to specify exactly what you require or with your understanding of the context?

I hope you can start to see the problem. Such a complex web of relationships requires careful and thoughtful planning and overseeing. Relations and specifications need to be established carefully and maintained. Importantly, you may not realise there is a problem with the relations or specification until there is a problem. The problem itself highlights the errors, by which time it is too late. This does not absolve you of blame it just shows how difficult it is to pin down exactly who or what is the cause. Causation and blame may be different things entirely.

It is within this context of devolved tasks that the investigation team undertook the report. Central to this report, in fact any report, are the terms of reference, TOR, found in Appendix A of the report. The scope of the report is defined as finding facts surrounding the uncontrolled release of hydrocarbons and efforts to contain that release aboard the Transocean drillship Deepwater Horizon. More specifically, the team will determine the actual physical conditions, controls and operational regime related to the incident to understand a) the sequence of events, b) the reasons for initial release, c) the reasons for fire, d) efforts to control flow at the initial event. As well as a timeline for the event itself, the team were also tasked to described the event and identify critical factors, both immediate causes and system causes. As with any TOR, the terms are narrower than you might want to try to understand the event in totality and, as is common with such an event, the key focus is on the technical and procedural. The team are not tasked to apportion blame within their TOR, they are merely seen as reporting ‘the facts’. Clearly, ‘the facts’, as in people’s actions and recollections, depend on what they are told and upon who tells them, what hidden agendas each person might have. Instruments and equipment, where available, tell another set of stories which may at first seem more objective but once different experts begin to interpret the information may become almost as ambiguous as the recollections of fallible humans.

The focus on the initial release and the events leading up to the explosion of necessity spotlights the actions of individuals in the decision making at that time. Despite this, a number of issues concerning equipment, maintenance and instructions are highlighted as requiring improvement suggesting that systemic factors may be more important. In other words, the communication and relations between companies is as much at the heart of the event as the faulty decisions made at the time.

Interestingly, the investigation team had 5 specific terms of reference associated with administration, including the sanctioning of all activities by a team leader, the requirement of a BP person at each interview and on questions or tasks to BP contractors without BP approval. The impact of such administrative arrangements on the nature or scope of the questions asked is not discussed. How are these administrative requirements to be interpreted? As a standard implementation of policy in such investigations, as a check on the team adhering to the TOR or ensuring the TOR were clarified to the team when required? Your interpretation may depend on the degree of belief or trust in have in the internal report in the first place.

The complexity of the task of assigning causation and blame is highlighted by the team in the Executive Summary:
'The team did not identify any single action or inaction that caused this accident. Rather, a complex and interlinked series of mechanical failures, human judgments, engineering design, operational implementation and team interfaces came together to allow the initiation and escalation of the accident. Multiple companies, work teams and circumstances were involved over time.'
Deepwater Horizon Accident Investigation Report: Executive Summary, 2010, p.5.

But why produce and release the internal report to the public now? There are other reports in the pipeline, not the least the official report into the incident that will presumably form the basis for blame, responsibility and one would assume compensation claims. BP may be trying to show themselves as a responsible company, but there is also the possibility that they are putting the report out there as a marker, an anchor for further reports. Whatever the status of the BP internal report, it is now known and available, it provides information and interpretations that any other report will be compared to. BP have provided an anchor or a starting point for expectations. Other reports will need to refer to it, to agree or disagree with it, to confirm or reject its findings and assertions. BP might not have defined the agenda for the debate over responsibility that will develop but they have defined the starting points and details that all other reports will have to cover; so not a bad start to agenda setting.

Haddon Matrix and Hazardous Events

Looking at hazards in different ways, through different conceptual frameworks is always useful as it tends to make you think about things, however slightly, in a different way. A framework often used in injury prevention, in road accident research and public health is the Haddon Matrix. This was devised by William Haddon back in the 1970s for use in road traffic accidents. The basic matrix is divided into 12 cells. The rows are defined by the temporal aspect of the event; pre, during and post, whilst the columns are defined as ‘host’ (you could rethink this as ‘the individual’), ‘equipment’ and two for environment; one for ‘physical’, one for ‘social’. The idea is to fill in each of the cells with key aspects that will influence or did the hazardous event. Effectively you are playing out different scenarios and filling in the cells depending on what factors you see as significant in each scenario. The framework forces you to deal systematically with the nature of the hazard and how it might play out in reality.


The example provided is for road traffic accidents but the basis can be translated to other types of hazard. In the crash, the condition of the individual before the crash may be important for the reasons in the matrix. Each individual will have different characteristics that could be important and each can be included as appropriate. Simiarly, different aspects of the equipment will be important depending on the nature of the crash and so these factors may not be clear until after the event. The environmental factors, seem to be more diffuse and provide a context, that for certain types of individual behaviour and certain equipment failings produce an environment conducive to a hazardous event. Importantly, despite the descirption and divsion of the event into these spearate cells, the contents of each cell depends upon the relationships between the host, equipment and environment. Fro eample, the scoial norms that permit DUI, would not be improtant had not the host not had a seatblet and been drinking. The poorly designed fuel tanks only become significant when the drunk driver crahse and so on.



This framework does have its limitations. The recognition of important factors can be so wide ranging as to be useless in planning if extreme scenarios, with infinitesimal probabilities of occurring are considered. On the other hand, it may not be until the event happens that it becomes clear what factors are important. The matrix will probably be of most use when similar hazardous events are being considered, as similar events would be expected to have roughly similar important factors. The matrix can also be used to identify where particular factors are not relevant. In a pile-up on a foggy motorway, for example, the detailed life history of the individual in the second car in the crash may not have any significance to their survival, it is the general physical conditions that are of over-riding significance. Equipment factors, such as airbag installation, age of car, may have an impact however. In other words, the matrix might be useful to explore the topographies of different hazards or disaster; in exploring the nature or shape of the hazard and what factors dominate that landscape and which are incidental ‘bumps’ on the terrain (please excuse the landscape metaphor, but I am a physical geographer!)

Something useful might be gained by overlaying the matrix with the Swiss cheese model of Reason outlined in an earlier blog. The matrix framework helps to identify the factors that might be important at each stage; the Swiss cheese identifies if a particular trajectory of factors lines up to produce a disaster. The matrix helps identify the possibles, the Swiss cheese, whether these possibles are important in combination. In the case of the BP oil spill, for example, the Haddon matrix could be used to identify key pre, during and post disaster factors, such as the alleged failure in safety procedures and lack of disaster planning. The trajectory arrow of the Swiss cheese model can then be used to assess if this one failure affects the next layer, if one failure or factor then lines up with another to produce the cascade of errors that result in a disater.

Some potentially useful books for assessment of hazards of injury are:

Injury Prevention in Children by David Stone (2011)



Injury Control: A Guide to Research and Program Evaluation by Rivara et al. (editors) (2009)




Injury Epidemology: Research and control strategies by Leon Robertson (2007)
 

CORRECTION: BP Oil Spill: Disaster, Media Hype or Fitting a Narrative?

CORRECTION: CORRECTION: CORRECTION

I have only just noticed that because of some sloppy cutting and pasting the original blog on BP Oil Spill: Disaster, Media Hype or Fitting a Narrative? must have lost sense to the reader about halfway through (anything before that was really written like that!) Sorry about this but it is a lesson to me to read blogs through properly again and again even when you think you have already done so.

The new, edited blog is now available. The original incorrect blog has been deleted.

BP Oil Spill and Swiss Cheese: Other Examples on Web

Some times it is nice to know that your view of something is shared by others and its seems that the Swiss cheese view of the BP oil spill is one of these views (maybe one day I will think of something new under the sun!). Tim Webb in the Observer on 18th July noted the BP executives used the ‘Swiss cheese’ analogy to explain how accidents occur. MasterResource, a free-market energy blog has some comments about the Swiss cheese model. BP’s "Leading from the top in BP" powerpoint makes reference to the Swiss cheese model of accidents. These are just a few examples from a quick search of the Web - I am sure there will be a lot more out there. So the concepts in model are clearly known about. How are they actually applied in practice if they are so well known?