Journal of Loss Prevention in the Process Industries 38 (2015) 163e168

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

Calibration of risk matrices for process safety

Paul Baybutt
Primatech Inc., Columbus, OH, USA

a r t i c l e i n f o a b s t r a c t

Article history: Risk matrices are used to rate and rank risks of hazardous events for processes. They provide for the
Received 31 May 2015 lookup of the risk level for an event using its severity and likelihood levels which are estimated sub-
Received in revised form jectively. Risk levels are associated with requirements for risk reduction to achieve tolerable risk. Often,
3 August 2015
risk matrices are defined using numerical values for event severity and likelihood levels. Therefore, the
Accepted 16 September 2015
resulting risk levels denote numerical values of risk. Consequently, such risk matrices must be calibrated
Available online 21 September 2015
with reference to appropriate numerical risk tolerance criteria, or process safety target levels, to define
appropriate risk reduction requirements. Calibration poses several pitfalls for the unwary. Many prac-
Keywords:
Risk matrix
titioners are unaware of these pitfalls and use risk matrices that are calibrated improperly producing
Risk rating incorrect risk reduction requirements. This paper describes how these pitfalls can be avoided and pro-
Risk ranking vides calibration procedures. Use of these procedures will help to avoid incorrect decisions on risk
Process hazard analysis reduction for processes.
Risk analysis © 2015 Elsevier Ltd. All rights reserved.
Process safety
Risk tolerance criteria
Process safety target levels

1. Introduction However, it is not possible to assign a risk tolerance criterion for a

Risk matrices are used widely in process safety to rate and rank
risks posed by processes to help with decision making on risk
reduction. For example, commonly they are used in process hazard
analysis (PHA) to rate the risks of hazard scenarios and determine
the need for risk reduction measures (CCPS, 2008; Baybutt, 2013).
When the severity and likelihood levels of a risk matrix are
defined in numerical terms, risk levels with numerical definitions
necessarily result. Risk levels are associated with requirements for
risk reduction to achieve tolerable risk. Therefore, the numerical
risks that are tolerated are clearly evident in the risk matrix and a
valid basis must be used when assigning risk reductions required
by the matrix. Consequently, such risk matrices must be calibrated
by using appropriate numerical risk tolerance criteria as a reference
point. The process of calibration entails deciding on a tolerable risk
value and defining required risk reductions in the risk matrix to
achieve it.
Risk matrices are used with events for which a severity and
likelihood can be assigned. In the case of their application in PHA,
the event is a hazard scenario. In this case, the risk tolerance criteria
built into risk matrices must be for single hazard scenarios.
E-mail address: paulb@primatech.com.
hazard scenario arbitrarily. Such criteria can only be assigned with
reference to overall facility risk tolerance criteria which are the only
meaningful risk tolerance criteria that can be specified empirically
(Baybutt, 2014b). Note that it is erroneous to use overall facility risk
tolerance criteria for individual hazard scenarios which would
result in tolerating far more risk than intended. The overall facility
criteria must be allocated to the contributing scenarios. In such
cases, allocation must be part of the calibration process. Also, many
overall facility criteria are intended to include risk from all sources
of all hazards in a facility, not just process safety hazards. Thus, such
criteria must be offset for contributions made by non-process-
safety hazards when used in process safety studies.
Calibration is susceptible to various pitfalls. They relate to the
nature of risk tolerance criteria and the nature of the events to
which they are applied. The pitfalls are described and guidance is
provided to help ensure calibration is performed correctly. The
guidance was derived by applying key concepts in the field of risk
tolerance criteria to risk matrices and their use in process safety.
Calibration is described for hazard scenarios but the discussion
applies equally to other types of events.
Section 2 of the paper addresses the history of risk matrices in
process safety. The process of allocation and calibration of risk
matrices is described in Section 3. Procedures for the calibration of
risk matrices for individual and group risk to people are described

http://dx.doi.org/10.1016/j.jlp.2015.09.010
0950-4230/© 2015 Elsevier Ltd. All rights reserved.
164 P. Baybutt / Journal of Loss Prevention in the Process Industries 38 (2015) 163e168
in Sections 4 and 5, respectively. Calibration for group risk for other
types of receptors is addressed in Section 6. Examples of risk
matrices are discussed in Section 7 and conclusions are drawn in
Section 8.
2. Risk matrices in process safety
Most PHA studies performed today include risk ranking of
hazard scenarios using risk matrices. However, historically, risk
ranking of hazard scenarios was not part of PHA studies performed
within the process industries using methods such as the Hazard
and Operability (HAZOP) study and What-If analysis. Instead, de-
cisions on the need for risk reduction originally were made using
engineering judgment. Other PHA methods that were developed in
the system safety field, such as Failure Modes and Effects Analysis
(FMEA) (MIL-STD-1629A, 1980), used a criticality ranking and the
concept of risk ranking was introduced into the HAZOP and What-If
methods beginning in the late 1980's when commercial PHA soft-
ware was first released. For example, the product suite HAZOP-PC,
WHAT-IF PC, PHA-PC, and FMEA-PC provided the ability to risk rank
hazard scenarios (Baybutt and Marshall, 1992). This was found
useful when PHA began to be practiced more widely and its prac-
titioners realized that a more objective basis than engineering
judgment was needed for decision making on risk reduction
measures.
Furthermore, the U.S. Occupational Safety and Health Admin-
istration's (OSHA's) process safety management (PSM) regulation,
which became effective in 1992, contains a regulatory requirement
in paragraph 1910.119(e) (3) (vii) which states, “The process hazard
analysis shall address a qualitative evaluation of a range of the
possible safety and health effects of failure of controls on em-
ployees in the workplace” (CFR). The preamble to the standard
notes that this evaluation of the failure of engineering and
administrative controls is for the purpose of guiding decisions and
priorities in planning for prevention and control, mitigation, and
emergency response. Risk ranking of hazard scenarios provided the
means to do so. Subsequently, OSHA clarified that the use of risk
matrices is one way in which this requirement can be met (OSHA,
2005).
Little attention has been paid in the literature to the develop-
ment and use of risk matrices in process safety. Guidelines for
hazard evaluation procedures from the Center for Chemical Process
Safety (CCPS) provide two examples of risk matrices and briefly
describe their use in PHA studies (CCPS, 2008). However, the CCPS
guidelines do not address the construction or use of risk matrices.
Use of risk matrices finds favor because they appear to be simple
to understand, do not require specialized expertise, and are
graphically appealing. However, there are no industry or govern-
ment standards for risk matrices for process safety. Consequently,
risk matrices are constructed intuitively but arbitrarily. Companies
develop and use their own risk matrices. Unfortunately, risk
matrices often are flawed in various ways, possibly because their
development appears to be deceptively simple but is actually more
complicated than it seems. Poorly designed risk matrices make the
process of risk ranking difficult and produce risk estimates ill-
suited for decision making. In particular, there are pitfalls in the
allocation and calibration process for risk matrices that often are
unrecognized.
3. Allocation and calibration for risk matrices
Allocation involves estimating the number of hazard scenarios
possible and dividing an appropriate overall facility risk tolerance
criterion by that number. The result is an allocation of the overall
facility tolerable risk to individual scenarios such that, if the
criterion is not exceeded by any scenario, the overall facility risk
tolerance criterion will not be exceeded.
The estimation of the number of hazard scenarios depends on
the level of detail used to define scenarios; the nature, scale, and
complexity of the process; and the range of hazards addressed
(CCPS, 2009). These factors can be highly variable from one situa-
tion to another. Also, many process facilities contain multiple
processes and the overall facility risk tolerance criteria must be
allocated using the total number of scenarios for the facility, not any
one individual process. Consequently, the allocation process is
challenging (Baybutt, 2014b).
There are various types and forms of risk measures (CCPS, 2000,
2009) and they influence calibration and allocation. In particular,
both risk to individual receptors and groups of receptors can be
important. For example, both individual and group risk are
important for people (HSE, 2001). Individual risk is the frequency at
which an individual may experience a given level of harm as a
result of exposure to one or more hazards. Group risk is the rela-
tionship between frequency and the number of people in a given
population experiencing a specified level of harm from exposure to
one or more hazards.
Individual and group risk tolerance criteria specify limits for the
risks to which individuals and groups of people are exposed. Indi-
vidual risk criteria protect any single individual from bearing too
large a share of the risk. Group risk criteria protect populations of
people from bearing undue risk. The distinction between individual
and group risk is less important for other types of receptors, such as
equipment and property, where the concern is not necessarily with
the risk to an individual piece of equipment or property but rather
the cumulative, or group, risk for equipment or property. The
different nature of individual and group risk mandates that sepa-
rate risk matrices are needed for each type.
The tolerable risk for each facility and process may vary and the
number of hazard scenarios will vary for each facility and process.
Consequently, risk matrices must be calibrated for each facility and
process for which they will be used. Thus, each facility and process
needs its own customized risk matrices.
4. Calibration procedure for individual risk to people
Risk matrices can be calibrated and individual risk to people
allocated using the following procedure which applies key concepts
from the field of risk tolerance criteria to risk matrices.
4.1. Select a reference risk tolerance criterion for the type of
casualty of interest
Casualty types may be, for example, a fatality, a hospitalization,
a lost-time injury, or a first-aid case. A reference risk tolerance
criterion for individual risk is a single number, although often
different values are used for different categories of people, such as
facility employees and members of the public. For example, the
maximum tolerable individual fatality risk for facility employees
from process safety hazards at a facility could be specified as
1
104 per year.
4.2. Make a conservative estimate of the maximum number of
hazard scenarios that contribute to the risk of casualty for any
particular exposed person
A particular person may experience casualty by themselves or
with other people. Thus, both single and multiple casualty sce-
narios must be counted. For example, it may be estimated that
there are 20 hazard scenarios that contribute to the fatality risk of
the maximally exposed person. Conservative estimates favor high
 P. Baybutt / Journal of Loss Prevention in the Process Industries 38 (2015) 163e168
values for this number. Note that this number is not the same as the
number of scenarios that could cause the casualty of any exposed
person which may be much higher.
It is challenging for practitioners to estimate the maximum
number of scenarios that may cause the single casualty of one
particular person. It is even more challenging to estimate the
number of multiple-casualty scenarios that could cause the casu-
alty of the same person, especially as such scenarios often will
originate not just within the process in which the individual works
but also within other processes at the facility. Unfortunately, the
numbers are largely guesstimates which may result in under-
specifying or over-specifying the scenario risk tolerance criterion.
4.3. Allocate the overall facility individual casualty risk tolerance
criterion to hazard scenarios
The overall facility individual casualty risk tolerance criterion is
divided by the maximum number of scenarios that could result in
the casualty of any one particular person. For example, 1
104 per
year divided by 20 produces a tolerable individual fatality risk per
hazard scenario of 5
106 per year. In constraining the risk of
fatality scenarios to this value, the sum of all the frequencies of any
20 fatality scenarios will not exceed the overall facility individual
fatality risk tolerance criterion, thus ensuring that the individual
fatality risk tolerance criterion for the facility is not exceeded for
any person since no person is exposed to more than 20 scenarios.
In some cases, there will be fewer scenarios that could result in
the individual casualty of particular people than for the maximally
exposed person. Thus, the risk to such people will be less than the
individual risk tolerance criterion. Therefore, the scenario risk
tolerance criterion produced by the allocation process results in
some people being exposed to a level of risk that may be below the
criterion. This is true particularly when the maximally exposed
person is exposed to many more scenarios than other people.
Note that the criterion must be applied not only to all single ca-
sualty hazard scenarios but also to all multiple casualty scenarios
because they also contribute to individual risk. Therefore, in dealing
with individual risk, there can be only one severity level for each type
of casualty. Thus, for example, all scenarios involving fatalities use
the same criterion regardless of the number of fatalities involved. It is
not correct to have multiple severity levels for different numbers of
the same type of casualty when using individual risk.
4.4. Use this criterion as an anchor value to determine the required
risk reduction for casualty scenarios with other likelihoods
The risk of casualty scenarios with frequencies at or below the
criterion is tolerable, while, as the frequency of a casualty scenario
increases, the amount of risk reduction required increases (see
Fig. 1). Often, risk matrices employ likelihood levels with fre-
quencies that differ by an order of magnitude. Consequently,
required risk reductions change by an order of magnitude as the
frequency level changes for a particular severity level.
This procedure must be repeated for all casualty types of in-
terest. However, reference values for tolerable risk for casualty
types other than fatalities are not readily available. Consequently,
an approach used by some practitioners is to base them on fatality
risk criteria using multiplicative adjustment factors. Values can be
chosen by equating a certain number of lesser human impacts, such
as hospitalizations, with a fatality. The use of factors of 10 is useful
in that it corresponds to the reductions in scenario frequencies that
typically are used. Of course, this practice is highly subjective and
involves a value judgment that will vary for different people.
However, there is no need to set non-fatality risk tolerance criteria
in this way if empirical data are obtained in a similar way to how
165
fatality criteria were developed (HSE, 1988). The calibration of risk
matrices and the allocation of criteria do not depend on the source
or values of the criteria used.
An implicit assumption is made when using fatality risk as a
reference point for other types of casualty. The maximum number
of scenarios that can produce one of the lesser casualties effectively
is assumed to be the same as the maximum number of scenarios
that can produce a fatality. However, this is not likely to be the case.
Conventional wisdom suggests that there will be more scenarios
that result in a lesser casualty for an individual. Thus, higher risk
than appropriate may be tolerated for lesser casualty scenarios if
such criteria are used. Of course, multiplicative factors could be
used to set tolerable risk criteria for calibration purposes and es-
timates of the number of scenarios that cause lesser casualties used
for allocation.
Often, different individual risk tolerance criteria are applied to
people in different categories, such as facility personnel and
members of the public, who may be exposed to process safety risks.
Furthermore, the number of scenarios that impacts the maximally
exposed individual in each category likely will differ. Consequently,
separate risk matrices are needed for individual risk for different
categories of people with their own calibrations and allocations.
5. Calibration procedure for group risk to people
Risk matrices can be calibrated and group risk to people allo-
cated using the following procedure which applies key concepts
from the field of risk tolerance criteria to risk matrices.
5.1. Select a reference risk tolerance criterion for the type of
casualty of interest
Typically, group risk is expressed as a FeN curve which displays
the cumulative frequencies of N or more casualties summed for all
events that lead to N or more casualties (CCPS, 2000, 2009). FeN
curves are referred to as limit lines when they are used to express a
group risk tolerance criterion (Cox and Baybutt, 1982). Usually,
group risk is not addressed for non-fatality casualties. Setting such
criteria using fatality criteria as a reference point suffers from
similar problems as for individual risk tolerance criteria.
5.2. Allocate group risk tolerance criterion to hazard scenarios
Allocation of limit lines to hazard scenarios must be performed
for all values of N. Limit lines may be expressed for ranges of values
of N in a form similar to a histogram. In such cases, allocation is
performed for each set of values of N within each range.
Allocation of risk tolerance criteria directly from FeN limit lines
to individual hazard scenarios is problematic. FeN limit lines con-
structed for fatalities display the tolerable frequency for one or
more fatalities, two or more fatalities, etc. Thus, reference points
taken from FeN limit lines represent cumulative risks summed
over multiple different values of N. Allocation using an FeN limit
line would take the value for each cumulative number of fatalities
read from the limit line as a reference criterion for allocation to all
scenarios that result in that number or more fatalities by dividing
its value by the estimated number of such scenarios. Thus, sce-
narios involving multiple fatalities would be subject to multiple
criteria as they would have to meet the allocated criteria for one or
more fatalities, two or more fatalities, etc. Also, the number of
scenarios for each cumulative number of fatalities will vary, further
complicating the process.
An alternative approach is to use reference points for specific
values of N rather than for cumulative values of N by converting
FeN limit lines to f-N form which display the frequencies of all
166 P. Baybutt / Journal of Loss Prevention in the Process Industries 38 (2015) 163e168
Severity Meaning
level
1 First-aid case
2 Lost-time injury
3 Hospitalization
4 Fatality
Severity 1 2 3 4
level
Likelihood
level
5 1 2 3
4 TR 1 2
3 TR TR 1 2
2 TR TR TR
1 TR TR TR
Fig. 1. Example of a risk matrix for individual risk.
events that result in N fatalities (CCPS, 2000, 2009). Thus, group
fatality risk in f-N form denotes the tolerable frequencies for which
any one person, any two people, etc. may suffer fatality. For
example, the tolerable group risk of a single fatality in a facility
using the limit line (50, 2
104, 1)1 would be 5
103 per year.
Note that this value is the tolerable frequency of all single fatalities
that can occur in a facility. In other words, a group risk tolerance
criterion is being set for groups of one. This criterion is not the same
as an individual fatality risk tolerance criterion which is the
maximum tolerable frequency with which any one particular per-
son may suffer fatality.
Next, the number of scenarios that can cause any single fatality
must be estimated. The overall facility single fatality group risk
tolerance criterion is divided by this number to produce a value for
the tolerable group risk for a single fatality for a scenario. While
there may be, say, 20 scenarios that could cause the fatality of one
particular person, generally, there will be many more scenarios that
could result in the fatality of any single person in a facility, say 1000.
Using this number and the reference criterion specified above, the
tolerable group risk for a single fatality for a scenario is 5
106 per
year. In constraining the frequency of all single fatality scenarios to
this value, the sum of all their frequencies will not exceed the
overall facility group risk tolerance criterion for a single fatality.
The same calculation is repeated using reference points taken
from the f-N curve for other values of N and estimating the number
of contributing scenarios for those values (see Fig. 2). Note that the
number of scenarios is specific to and likely different for each value
of N. Generally, as the value of N increases, it can be expected that
the number of scenarios decreases. In Fig. 2, the numbers of sce-
narios for higher N values have been reduced by an order of
magnitude for each increase in the value of N by an order of
magnitude. Of course, the actual numbers of scenarios will vary for
each facility. Unfortunately, generally the values of tolerable risk
produced will not differ by simple factors of 10. Consequently, in
such cases, risk matrices cannot be displayed as cleanly as in Fig. 2.
Even this risk matrix uses an approximation to designate severity
level 1 and likelihood level 4 as tolerable to maintain symmetry.
Group criteria obtained by allocation from f-N limit lines are
1
The notation represents a FeN limit line for which F ¼ 2
104 at N ¼ 50 with
slope 1.
Likelihood Meaning
level (Frequency per year)
1 5 x 10-5
2 5 x 10-4
3 5 x 10-3
4 5 x 10-2
5 5 x 10-1
TR = Tolerable risk
Numerical values in the risk
4 matrix denote required risk
3 reductions as negative
exponents of powers of 10.
Thus, 3 equates to a required
1 risk reduction of 1 x 10-3.
TR
applied to scenarios based on their consequence severities (values
of N) with the advantage that a single criterion is applied to each
scenario. Only scenarios with the same number of fatalities
contribute to the group risk for each severity level. The need to
allocate risk tolerance criteria across scenarios with different
numbers of casualties that is necessary for individual risk does not
arise in the case of group risk allocated using f-N limit lines except
for scenarios within a range of casualty numbers when ranges are
used rather than individual values of N.
In the latter case, the maximum number of scenarios that pro-
duces any of the values of N within the defined range for a severity
level must be used in the allocation process with the risk criterion
for the highest N value within the range which is the most stringent
criterion. The resulting tolerable risk criterion must be applied to all
scenarios with values of N within the range. Of course, this
approach produces conservative results for those scenarios with N
values for which there are fewer scenarios than the maximum
number within the range.
5.3. Use this criterion as an anchor value to determine the required
risk reduction for fatality scenarios with other likelihoods
The risk of fatality scenarios with frequencies at or below the
criterion is tolerable, while, as the frequency of a fatality scenario
increases, the amount of risk reduction required increases (see
Fig. 2). Usually, risk matrices employ likelihood levels with fre-
quencies that differ by an order of magnitude. Consequently,
required risk reductions change by an order of magnitude as the
frequency level changes for a particular severity level.
A risk matrix for group fatality risk contains only fatalities and
no other types of casualties (see Fig. 2). If group risk were to be used
for other types of casualties, separate risk matrices would be
needed. Group risk tolerance criteria may need to be scaled across
and within facilities (Baybutt, 2014b). Also, group risk tolerance
criteria can be partitioned between different categories of people,
for example, facility personnel and members of the public.
6. Calibration procedure for group risk for other types of
receptors
For hazard scenarios that produce impacts on other types of
receptors, such as property or the environment, their severity often
 P. Baybutt / Journal of Loss Prevention in the Process Industries 38 (2015) 163e168 167

Severity Meaning Severity 1 2 3 4

level
level
Likelihood
1 One fatality level
2 Ten fatalities 7 3 4 5 6

6 2 3 4 5
3 100 fatalities
5 1 2 3 4
4 1,000 fatalities
4 TR 1 2 3

3 TR TR 1 2
Likelihood Meaning (Frequency
level per year) 2 TR TR TR 1

1 TR TR TR TR
1 1 x 10-8
2 1 x 10-7 TR = Tolerable risk
3 1 x 10-6 Numerical values in the risk
4 1 x 10-5 matrix denote required risk
5 1 x 10-4 reductions as negative
exponents of powers of 10.
6 1 x 10-3
Thus, 3 equates to a required
7 1 x 10-2 risk reduction of 1 x 10-3.

Fig. 2. Example of a risk matrix for group risk.

is judged in terms of financial impacts. An FeN limit line and cor-
responding f-N curve for increasing financial impacts can be uti-
lized. It is calibrated and allocated in a similar way to group risk for
people.
Calibration of risk matrices for both individual and group risk
can incorporate the As Low As Reasonably Practicable (ALARP)
principle using de manifestus and de minimis criteria (Baybutt,
Baybutt, 2014a). When risk criteria are allocated to other types of
events, such as hazardous events, the estimated number of those
events must be used when calibrating risk matrices.
7. Discussion of risk matrix examples
Fig. 1 shows an example of a risk matrix for individual risk. It
uses four severity levels ranging from first-aid cases to fatalities.
Five likelihood levels are used ranging from five occurrences every
10 years to 5 occurrence every 100,000 years. The matrix has been
calibrated using a maximum tolerable individual fatality risk of
1
104 per year and assuming 20 hazard scenarios contribute to
the fatality risk of the maximally exposed person.
The matrix is used to rank scenarios that involve one or more of
each casualty type. Thus, the same criterion is applied to events
that involve fatalities of a single individual as for multiple in-
dividuals, hospitalizations of a single individual as for multiple
individuals, etc., and there is only one ranking for each type and
level of casualty regardless of the number of people involved. For
example, a scenario that involves a single fatality (severity level 4)
and that occurs with a likelihood level of 2 requires risk reduction
by a factor of 10. Similarly, a scenario that involves multiple fatal-
ities (also, severity level 4) and that occurs with a likelihood level of
2 requires risk reduction by a factor of 10. Each type of casualty is
treated separately.
Fig. 1 shows that as the frequency of a scenario increases above
the tolerable risk for the casualty type of the scenario, the required
risk reduction increases. Similarly, as the frequency of a scenario
decreases below the tolerable risk for the casualty type of the
scenario, no reduction is needed and the risk is tolerable.
Fig. 2 shows an example of a risk matrix for group risk. Group
risk matrices use a single casualty type, usually fatalities, for all
severity levels. The example uses four severity levels ranging from a
single fatality to 1000 fatalities. Seven likelihood levels are used
ranging from one occurrence every 100 years to one occurrence
every 100 million years. The matrix has been calibrated using the
limit line (50, 2
104, 1) and assuming 1000 scenarios may
produce a single fatality, and the number of scenarios producing
higher numbers of fatalities decreases by an order of magnitude as
the number of fatalities increases by an order of magnitude.
The matrix is used to rank scenarios that involve scenarios with
the same number of fatalities. For example, any scenario that in-
volves a single fatality (severity level 1) and that occurs with a
likelihood level of 6 requires risk reduction by a factor of 100.
Similarly, any scenario that involves 100 fatalities (severity level 3)
and that occurs with a likelihood level of 6 requires risk reduction
by a factor of 10,000.
Fig. 2 shows that as the frequency of a scenario increases above
the tolerable risk for a particular number of fatalities, the required
risk reduction increases. Similarly, as the frequency of a scenario
decreases below the tolerable risk for a particular number of fa-
talities, no reduction is needed and the risk is tolerable.
Often, stricter risk tolerance criteria are established for mem-
bers of the public than for facility employees. Furthermore, the
number of scenarios affecting different categories of people will
vary. Thus, separate calibrations and risk matrices are needed in
such cases for both individual and group risk. The same is true for
different processes and different facilities. Even though the same
risk tolerance criteria may be used, the number of scenarios used in
the calibration process may well differ.
Note that individual risk and group risk cannot be addressed
using the same risk matrix. Two different risk matrices are needed
for each category of people addressed. Thus, four matrices are
needed if facility employees and members of the public are
considered separately.
8. Conclusions
Risk matrices that utilize numerical severities and frequencies
must be calibrated with reference to appropriate numerical risk
tolerance criteria or process safety target levels for facilities. Many
practitioners are unaware of pitfalls involved in the calibration
process and use risk matrices that are calibrated improperly pro-
ducing incorrect risk decisions. Pitfalls that largely are unrecog-
nized were identified and calibration procedures that avoid them
were provided.
Separate calibrations and risk matrices are needed for individual
168 P. Baybutt / Journal of Loss Prevention in the Process Industries 38 (2015) 163e168
and group risk for different categories of people such as facility
personnel and members of the public. Risk matrices must be cali-
brated for each facility and process and each consequence and ca-
sualty type of concern. When risk matrices are used to judge the
tolerability of events such as hazard scenarios, calibration must also
include the allocation of overall facility risk tolerance criteria to
individual events. Current practices usually do not address all of
these issues. However, use of the calibration procedures provided
in this paper addresses the issues and will help to avoid incorrect
decisions on risk reduction for processes.
Companies should develop risk matrices that produce consis-
tent risk ratings across all their processes and facilities to encourage
consistent decisions on risk reduction.
References
Baybutt P., Setting multinational risk tolerance criteria, Process Safety Progress,
http://dx.doi.org/10.1002/prs.11708.
Baybutt, P., 2013. Analytical methods in process safety management and system
safety engineering e process hazards analysis. In: Haight, J.M. (Ed.), Handbook
of Loss Prevention Engineering. Wiley-VCH, Weinheim, Germany.
Baybutt, P., Marshall, T., 1992. Software tools for hazard analysis. In: Spring AIChE
National Meeting, New Orleans, Louisiana.
Baybutt, P., 2014a. The ALARP principle in process safety. Process Saf. Prog. 33 (1),
36e40.
Baybutt, P., 2014b. Allocation of risk tolerance criteria. Process Saf. Prog. 33 (3),
227e230.
CCPS, 2000. Guidelines for Chemical Process Quantitative Risk Analysis, second ed.
Center for Chemical Process Safety/American Institute of Chemical Engineers,
New York, NY.
CCPS, 2008. Guidelines for Hazard Evaluation Procedures, third ed. Center for
Chemical Process Safety/American Institute of Chemical Engineers, New York,
NY.
CCPS, 2009. Guidelines for Developing Quantitative Safety Risk Criteria. Center for
Chemical Process Safety/American Institute of Chemical Engineers, New York,
NY.
CFR. Process safety management of highly hazardous chemicals, 29 CFR 1910.119.
Cox, D.C., Baybutt, P., 1982. Limit lines for risk. Nucl. Technol. 57, 320e330.
HSE, 2001. Reducing Risks, Protecting People. United Kingdom Health and Safety
Executive, HSE Books, Sudbury, UK.
HSE, 1988. The Tolerability of Risk from Nuclear Power Stations. UK Health and
Safety Executive, HMSO, London, UK. Revised 1992.
MIL-STD-1629A, 1980. Military Standard, Procedures for Performing a Failure Mode,
Effects and Criticality Analysis. Department of Defense, Washington, DC.
OSHA, 2005. OSHA letter to Mr. R. Harmon, Industrial Consultants, February 1, 2005.
www.osha.gov.