Epistemic Uncertainty and the Limits of Objective Safety
Total Page:16
File Type:pdf, Size:1020Kb
Safety and Security Engineering 63 Analysing safety: epistemic uncertainty and the limits of objective safety N. Möller Philosophy Unit, Royal Institute of Technology, Sweden Abstract Much research has been devoted to studies of safety, but the concept of safety is in itself under-theorised. Often, safety is indirectly defined through processes and classifications vital for practical safety engineering. However, without a substantial understanding of the concept, the subject matter of risk and safety research remains fuzzy. The aim of this paper is to provide a framework for such a substantial understanding, capturing what experts in risk and safety research as well as ordinary laypersons should include in the concept of safety. When safety is directly defined, it is traditionally defined as the inverse of risk: the lower the risk, the higher the safety. I argue that such a definition of safety is inadequate, since it leaves out the crucial aspect of deficiencies in knowledge. In socio- technical contexts, every evaluation of risk is an estimation, and therefore involves a certain amount of epistemic uncertainty. An analysis of safety must consider that complication. Epistemic uncertainty points to the epistemic primacy of safety. It is concluded that, strictly speaking, an objective safety concept is not attainable. Instead, an epistemic, intersubjective concept is proposed that brings us as close as possible to the ideal of an objective concept. Keywords: conceptual analysis, safety, risk, uncertainty, objectivity, intersubjectivity. 1 Introduction Even though much research has been devoted to studies of safety, the concept itself is under-theorised. The actual meaning of ‘safety’ is often entirely taken for granted or is very loosely defined. A typical example comes from the context of nuclear power, where safety is defined in the following way: “Safety is what provides protection, averts danger, fosters confidence.” ([1], ch. 1, p. 6). Such a WIT Transactions on The Built Environment, Vol 82, © 2005 WIT Press www.witpress.com, ISSN 1743-3509 (on-line) 64 Safety and Security Engineering vague characterisation may be sufficient for some contexts, especially if used only as a preamble for a deeper discussion. However, even in technical manuals there exists no such direct deepening of the notion. Instead, reference is made to standards and processes only. My aim in this paper is to provide a conceptual analysis of safety. Three points will be stressed. First, I argue for the importance of a substantial notion of safety. Second, I argue for a more complete understanding of safety than as the inverse of risk, an understanding according to which safety is analysed in the three dimensions of harm, probability and epistemic uncertainty. Third, I argue for an intersubjective notion of safety instead of the unattainable goal of an objective concept. 2 Substantial and procedural definitions Normally, discussions of safety only indirectly determine the meaning of the concept. From what is brought up for discussion and from the treatment of different themes, there emerges an understanding of the subject matter. However, no direct determination is provided. One way of capturing this difference is by invoking the distinction between procedural and substantial definitions. A procedural definition of safety uses no independent criterion, but states that something is safe when a correct procedure is (successfully) applied. In contrast, a substantial definition of safety supplies an independent criterion for when something is safe. Consider an analogue with two definitions of ‘warm’ to determine whether the shower of the two subjects Eva and Niklas is sufficiently heated: Wp: The water in the shower is warm if and only if neither Niklas nor Eva has any complaints regarding the temperature when entering the shower. Ws: The water in the shower is warm if and only if the water temperature is above 30 degrees Celsius. In the first definition, we test whether the shower is warm or not by applying the procedure of having Niklas and Eva enter the shower and observe if they complain about the temperature or not. Since they could also complain about the water being too cold (or hot rather than warm), this procedural definition is imperfect in any case; but the important point is that there is no independent criterion to use but a procedure to follow in order to judge whether the shower is warm or not. In the second definition, the independent criterion for ‘warm’ is given in terms of a temperature range (>30 ºC). It is thus a substantial definition. In the context of safety engineering, there is ambivalence between substantial and procedural notions of safety. On the one hand, safety is conceived as something substantial, something having to do with not being harmed. On the other, the primary focus of safety work is procedural. For the most part, no substantial notion of safety is referred to. Instead, reference is normally made to different types of procedures to follow for acceptable safety. The checklist used WIT Transactions on The Built Environment, Vol 82, © 2005 WIT Press www.witpress.com, ISSN 1743-3509 (on-line) Safety and Security Engineering 65 by the flight captains before takeoff is a paradigm case of such a procedural usage of the safety concept. Naturally, in safety engineering as with other areas concerned with safety, procedures for reaching a high level of safety is paramount. However, without a substantial grounding of the concept of safety, the subject matter of risk and safety research remains fuzzy. The general idea may be understood using only such vague substantial definitions to guide safety engineering as exemplified above: the aim of providing protection, averting danger and foster confidence. However, they are in the local context insufficient for making nuanced choices between different alternatives for bringing about safety, and are in the overall context insufficient for decision-making. This is especially true in cases of limited resources and/or time frames. If there is no clear overall notion of, say, traffic safety, how is the aim of reaching it to be carried out? If we have no clear concept of what safety means, how are we to judge whether the level of driver safety attained by one safety belt is higher than for another, when one is better at preventing damage to most part of the body than another, but more prone to cause whiplash damage? And how are we, when trying to improve the overall safety of a car, to prioritise among the improvements of different parts if we have only a partial understanding of the goal at hand? Considering that safety is an overall aim, not something that can be dealt with only eclectically, a substantial concept of safety must be developed. The upshot of this paper is an outline of a framework for such a concept. 3 Objective and subjective safety What type of claim are we making in analyses of safety? An important distinction is that between an objective and a subjective notion of safety. The concept of objectivity tries to capture the intuition that safety is something independent of our opinion or awareness. A full account of the notion of objectivity is a large and controversial matter outside the scope of this paper (for different perspectives, see [2,3]). For our purposes, however, a sufficiently precise criterion of objectivity is the existence of a criterion independent of individual beliefs and feelings. That my height is 178 cm and that the snow outside my window is white are examples of propositions whose truth and falsehood usually are said to be a matter of objective fact fitting with such a criterion. Whether I am aware of it or not, these propositions are either true or false depending (in the relevant sense) only on the external world. In contrast, on a subjective interpretation, “X is safe,” means that S believes that X is safe, where S is a subject from whose viewpoint the safety of X is assessed. This is a different distinction from the one between procedural and substantial definitions. However, in this case the above definitions Ws and Wp may serve also as an example of the distinction between the objective and the subjective: Ws defines ‘warm’ in terms of an independent property (i.e. temperature) whereas Wp refers to the experiences of Eva and Niklas. Obviously, in the case of safety engineering the primary interest is in the objective safety concept. If we only use the subjective safety concept we will not WIT Transactions on The Built Environment, Vol 82, © 2005 WIT Press www.witpress.com, ISSN 1743-3509 (on-line) 66 Safety and Security Engineering have a language fit for dealing with the dangers of the real world. The airplane is not safe just because the pilots (and, say, the technicians) believe that it is working properly; rather, the degree of safety is dependent on whether their belief is justified by how it in fact is: the status of all functional systems of the airplane is what is really important. The objective safety concept constitutes a terminological ideal that may be difficult to realise. If we do not have objective knowledge about all the determinants of safety, it may be impossible to construct a fully objective concept of safety. We will return to this issue after having introduced the three necessary dimensions of the safety concept, extracting the first two from the standard notion of safety in the next section and supplementing this notion with the additional aspect of epistemic uncertainty in Section 5. Before going into the analysis of a substantial concept of safety, I will, to avoid confusion, point out one further distinction: the distinction between an absolute and a relative concept of safety. According to an absolute concept, safety against a certain harm implies that the risk of that harm has been eliminated.