8 Safety Factors and Exposure Limits

Sven Ove Hansson

8.1 Numerical Decision Tools

Numerical decision tools are abundantly employed in safety engineering. Two of the most commonly used tools are safety factors and exposure limits. A safety factor is the ratio of the maximal burden on a system not believed to cause damage to the highest allowed burden. An exposure limit is the highest allowed level of some potentially damaging exposure.

8.2 Safety Factors

Humans have made use of safety reserves since prehistoric times. Builders and tool-makers have added extra strength to their constructions to be on the safe side. Nevertheless, the explicit use of safety factors in calculations seems to be of much later origin, probably the latter half of the nineteenth century. In the 1860s, the German railroad engineer A. Wohler recommended a factor of 2 for tension. In the early 1880s, the term “factor of safety” was in use, hence Rankine’s A Manual of Civil Engineering defined it as the ratio of the breaking load to the working load, and recommended different factors of safety for different materials (Randall, 1976). In structural engineering, the use of safety factors is now well established, and design criteria employing safety factors can be found in many engineering norms and standards. Most commonly, a safety factor is defined as the ratio of a measure of the maximum load not inducing failure to a corresponding measure of the load that is actually applied. In order to cover all the major integrity-threatening mechanisms that can occur, several safety factors may be needed. For instance, one safety factor may be required for resistance to plastic deformation and another for fatigue resistance. The other major application area for safety factors is toxicology. Here, the use of explicit safety factors is more recent. Apart from some precursors, it dates from the middle of the twentieth century (Dourson and Stara, 1983). The first proposal 114 S.O. Hansson for a safety factor for toxicity was Lehman’s and Fitzhugh's proposal in 1954 that an ADI (Acceptable Daily Intake) be calculated for a food additive by dividing the chronic animal NEL (maximum No Effect Level) in mg/kg of diet by 100. They thus defined a safety factor as the ratio of an experimentally determined dose to a dose to be accepted in humans in a particular regulatory context. If the NEL is 0.5 mg/kg body weight, the application of a safety factor of 100 will then result in a maximum allowed dose of 0.005 mg/kg body weight. This definition is still in use. Their value of 100 is also still widely used, but higher factors such as 1 000, 2 000, and even 5 000 are employed in the regulation of substances believed to induce severe toxic effects in humans. Compare with Figure 8.1. Toxicological safety factors are often based on products of subfactors, each of which relates to a particular “extrapolation.” The factor 100, for example, is described as composed of two factors of 10, one for the extrapolation from animals to humans and the other for the extrapolation from the average human to the most sensitive members of the human population (Weil, 1972). For ecotoxicity, factors below 100, such as 10, 20, and 50, are widely in use. Lower factors are, of course, associated with a higher degree of risk-taking.

Figure 8.1. Japanese factory workers inspect packages of processed foods containing roasted peanuts imported from China at a confectionary factory in Niigata city, Japan, March 28, 2008. Following news reports of lethal chemicals found in imported Chinese food products, Japanese companies are facing tighter scrutiny from consumers and health ministry inspectors to insure the quality of their food products. (Photo: Everett Kennedy Brown/EPA/Scanpix)

In addition to safety factors, the closely related concept of a safety margin is used in many applications. The essential difference is that, whereas safety factors are multiplicative, safety margins are additive. Airplanes are kept apart in the air; a Safety Factors and Exposure Limits 115 safety margin in the form of a minimum distance is required. Surgeons removing a tumor also remove the tissue closest to the tumor. Their safety margin (surgical margin) is defined as the distance between the tumor and the lesion. Typical values are 1–2 cm (Kawaguchi, 1995). The notion of a safety margin is also sometimes used in structural engineering, and it is then defined as capacity minus load. Independently of the area of application, safety factors and safety margins can be divided into three categories (Clausen et al., 2006): 1. Explicitly chosen safety factors and margins. Safety factors in this category are used, e.g., by the engineer who multiplies the foreseen load on a structure by a standard value of, say, 3 and uses this larger value in his or her construction work. Similarly, the regulatory toxicologist applies an explicitly chosen safety factor when she divides the dose believed to be harmless in animals by a previously decided factor such as 100, and uses the obtained value as a regulatory limit. Explicitly chosen safety factors are also used in, e.g., geotechnical engineering, ecotoxicology, and fusion research (for plasma containment). As already mentioned, explicitly chosen safety margins are used in air traffic and in surgery. They are also used in radiotherapy to cope with set-up errors and internal organ motion. 2. Implicit safety reserves. These are safety factors or margins that have not been specifically chosen, but can, after the fact, be described as such. They have their origin in human choice, but in choices that are not made in terms of safety factors or margins. As one example of this, occupational toxicology differs from food toxicology in that allowable doses are usually determined in a case-by-case negotiation-like process that does not involve the use of generalized (fixed) safety factors. However, it is possible to infer implicit safety factors; in other words, a regulatory decision can be shown to be the same as if certain safety factors had been used (Hansson, 1998). Another example can be found in traffic safety research. The behavior of drivers can be described as if they applied a certain safety margin to the distance between their car and the car nearest ahead. This margin is often measured as the time headway, i.e., the distance divided by the speed (Hulst et al., 1999). 3. Naturally occurring safety reserves. These are the safety reserves with regard to natural phenomena that can be calculated by comparing a structural or physiological capacity to the actually occurring load. These safety reserves have not been chosen by human beings, but are our way of describing properties that have developed through evolution. As in the case of implicit safety reserves, naturally occurring safety reserves can often be described in terms of safety factors or margins. Structural safety factors have been calculated for mammalian bones, crab claws, shells of limpets, and tree stems. Physiological safety factors have been calculated, e.g., for intestinal capacities such as glucose transport and lactose uptake, for hypoxia tolerance in insects, and for human speech recognition under conditions of speech distortion (Clausen et al., 2006).

The reason why safety factors can be applied in descriptions of natural phenomena is that when we calculate loads – whether of natural or artificial origin – we do not 116 S.O. Hansson consider unusual loads. Resistance to unusual, unforeseen loads is as important for the survival of an organism as it is for the continued structural integrity of a man- made artifact. For example, the extra strength of tree stems enables them to withstand storms even if they have been damaged by insects. On the other hand, there is a limit to the evolutionary advantage of excessive safety reserves. Trees with large safety reserves are better able to resist storms but, in the competition for light reception, they may lose out to tender and high trees with smaller safety reserves. In general, the costs associated with excessive capacities result in their elimination by natural selection. There are at least two important lessons to learn from nature here. First, resistance to unusual loads that are sometimes difficult to foresee is essential for survival. Secondly, a balance must nevertheless always be struck between the danger of having too little reserve capacity and the cost of having a reserve capacity that is never or rarely used.

8.3 What Do Safety Factors Protect Against?

In characterizing the sources of failure against which safety factors provide protection we need to consider the decision-theoretical distinction between risk and uncertainty. A decision is said to be made under risk if the probabilities of the relevant outcomes are known or are assumed to be known. Otherwise, it is made under uncertainty. Uncertainty comes in different forms. Sometimes it is due to a lack of reasonable probability estimates for identified outcomes. On other occasions, there may also be a considerable uncertainty about what outcomes are in fact possible (Hansson, 1996). In structural engineering, safety factors are intended to compensate for five major sources of failure: (1) higher loads than those foreseen, (2) worse properties of the material than foreseen, (3) imperfect theory of the failure mechanism in question, (4) possible unknown failure mechanisms, and (5) human error (e.g., in design) (Moses, 1997). The first two of these can possibly be described in terms of probabilities, whereas the last three concern uncertainty rather than risk (Hansson, 2007a). In toxicology, safety factors are typically presented as compensations for (1) various extrapolations such as that from animals to humans, (2) intraspecies variability, (3) lack of data, and (4) imperfection in the models used for interpreting the data (Gaylor and Kodell, 2002). At least the last two of these refer primarily to uncertainty rather than to risk in the probabilistic sense. In structural engineering, in particular, it has often been proposed that safety factors should be replaced by specifications expressed in terms of probabilities. This means that instead of building a bridge with a specified safety factor it should be constructed in a way that conforms with a specified maximum probability of failure. However, it has turned out to be difficult to replace safety factors by probabilities. The major obstacle is that safety factors are intended to protect not only against risk (in the probabilistic sense) but also against uncertainties for which no meaningful probabilities are available (Clausen et al., 2006). Safety Factors and Exposure Limits 117

8.4 Exposure Limits

An exposure limit is a restriction on the allowed exposure to some agent having undesired effects. Exposure limits are usually expressed in terms of some physical or chemical measurement, such as dB for noise, Sievert (Sv) for ionising radiation, and mg/m3 for the inhalation of chemical pollutants. The most well-developed systems of exposure limits are those for occupational chemical exposure. (Exposure limits or limit values are also dealt with in Chapter 7.) The first occupational exposure limits were proposed by individual researchers in the 1880s. In the 1920s and 1930s, several lists were published in both Europe and the USA, and in 1930 the USSR Ministry of Labor issued what was probably the first official list. However, by far the most influential occupational exposure limits are the threshold limit values (TLVs) issued by the American Conference of Governmental Industrial Hygienists (ACGIH). In spite of its name, the ACGIH is a voluntary organization with no formal ties to government or state authorities in the USA or elsewhere. In 1946, the ACGIH adopted a list of exposure limits, covering approximately 140 chemical substances. The list has since then been gradually extended and revised, a new edition being published annually (Cook, 1985). In the 1940s and 1950s, the ACGIH and the American Standards Association (ASA) competed for the position of leading setter of occupational health standards. The values of the ASA and those of the ACGIH did not differ greatly in numerical terms, but the ASA values were ceiling values below which all workplace concentrations should fluctuate, whereas the ACGIH values were (and still are, with few exceptions) upper limits for the average during a whole working-day. The ASA standards thus provided greater protection to exposed workers. The ACGIH won the struggle and became in the early 1960s virtually the only source of exposure limits that practitioners looked to for guidance. In 1969, the federal US government adopted the 1968 TLVs as an official standard. Subsequently, the Occupational Safety and Health Administration (OSHA) and state authorities have developed exposure limits of their own. In most other countries, the TLVs have similarly been the starting-point for national standards on occupational chemical exposure. This applies for instance in Argentina, Australia, Austria, Belgium, Brazil, Canada, Chile, Denmark, Germany, Holland, India, Indonesia, Ireland, Israel, Japan, Malaysia, Mexico, the Philippines, Portugal, South Africa, Spain, Sweden, Switzerland, Thailand, the United Kingdom, Venezuela, the former Yugoslavia, and probably many other countries as well. In most of these countries, however, independent national exposure limits have gradually been developed after the initial adoption of the TLVs (Hansson, 1998).

8.5 Dose–response Relationships

Exposure limits are based on the estimated dose–response relationships for toxic effects, i.e., the relationship showing how the frequency of the toxic effect in a population is related to the dose or exposure. Dose–response relationships are graphically represented by dose–response curves. 118 S.O. Hansson

100

50

0 0 200 400 600 800 1000 exposure level (mg/m3)

Figure 8.2. The dose–response curve of a hypothetical substance

Figures 8.2 and 8.3 are the dose–response curves for two (hypothetical) substances that both induce an all-or-nothing effect in humans. The comparatively steep curve in Figure 8.2 admits of a fairly accurate prediction of the effect in most individual cases. A person who inhales 300 mg/m3 is sure not to be injured, whereas an exposure in excess of 600 mg/m3 will almost certainly lead to injury. Only when the dose is between these two values is the outcome uncertain. Figure 8.3 has much less predictive power for individual cases. Over a wide range of doses, all that can be predicted for an individual exposure is a probability. Unfortunately, for many toxic effects of chemicals, the shape of the dose–response curve is closer to that of Figure 8.3 than to that of Figure 8.2. The non-deterministic nature of a dose response relationship is well-known from the most important environmental source of cancer: tobacco. Smokers run a drastically increased risk of lung cancer (and many other diseases). This risk is higher the more a person smokes, but there is no way to know in advance whether or not a particular smoker will have cancer. Some very heavy smokers will not contract the disease, whereas others who smoke much less become victims. If the highest dose level with zero frequency of a particular effect is above zero, then it is called a threshold. Figures 8.2 and 8.3 represent dose–response relationships with thresholds, whereas Figure 8.4 represents one without a threshold. The existence of a threshold has an obvious regulatory relevance. If there are thresholds for all toxic effects of a substance, and if these thresholds can all be determined, then a regulation can eliminate adverse effects without altogether prohibiting exposure to the substance. On the other hand, when there is no threshold for a toxic effect, then no exposure limit above zero offers complete protection against that effect. In other words, any such limit represents a compromise between health protection and other interests, such as economic and technological demands. Safety Factors and Exposure Limits 119

100

50

0 0 200 400 600 800 1000 exposure level (mg/m3)

Figure 8.3. The dose–response curve of a hypothetical substance

There are biological reasons for believing that many toxic effects do have thresholds. Many biochemical processes are so structured that small perturbations give rise to compensating mechanisms that repair damage and restore normal physiological conditions. However, in other cases a relationship such as that shown in Figure 8.4 may exist. This is generally believed to be true of mutagenic substances and of those carcinogens that act through damage to the genetic code.

100

50

0 0 200 400 600 800 1000 exposure level (mg/m3)

Figure 8.4. The dose–response curve of a hypothetical substance 120 S.O. Hansson

8.6 Collective Dose Limits

Exposure limits for ionizing radiation differ in important ways from those for chemical exposure. Although radiation protection is regulated in national legislation, just like protection against chemical exposure, radiological exposure limits are in practice subject to international harmonization through the recommendations of the International Commission on Radiological Protection (ICRP). Compare with Figure 8.5. Furthermore, whereas chemical exposure limits refer only to the exposure of an individual person, radiological protection employs a combination of individual and collective dose limits (as exposure limits are called in this context). The reason for this is that the risk of cancer due to radiological exposure is assumed to be proportional to the dose (as in Figure 8.4). This means, for instance, that exposing five persons to 1 mSv each will, presumably, lead to the same statistically expected number of cancer cases as exposing one person to 5 mSv. In radiological work, although individual doses can often be reduced by distributing the work task among a larger number of persons, such a “dilution” of doses is associated with an increase in the expected number of radiation-induced cancer cases, because a larger number of workers are involved. In order to prevent this from happening, radiation protectors keep track of both individual and collective doses (Hansson, 2007b). The same argument is applicable to some chemical carcinogens (primarily mutagenic carcinogens), but in practice collective doses are seldom used in the regulation of chemical risks.

8.7 Remaining Uncertainties

Unfortunately, we do not in practice have the knowledge required to set non-zero exposure limits that offer complete protection against negative health effects. Most substances have not been subjected to extensive toxicological investigations, and even for those that have, uncertainties remain as to the nature of their health effects and about the dose–response relationships. Even after fairly thorough investigations, the possibility remains that a substance may have negative effects that have not yet been detected. In addition, surprisingly large effects can be undetectable for statistical reasons. For a simple example of statistical undetectability, suppose that a certain exposure increases the frequency of a disease from 0 % to 3 %. Furthermore, suppose that a study is made of ten exposed individuals. Obviously, we cannot then be at all sure of seeing a case of the disease. (To be more precise, the probability that we will see a case is only 0.26.) Next, suppose instead that the frequency of the disease is 20 %, and that exposure leads to an increase of that frequency to 23 %. It is of course impossible to distinguish, in a sample consisting of ten persons, between a frequency of 20 % and one of 23 %. In other words, the increase caused by the exposure is statistically undetectable. Safety Factors and Exposure Limits 121

Figure 8.5. An Italian soldier checking radiation levels on a truck carrying refuse to a garbage dump in Savignano, near Naples June 16, 2008. Italian troops, who are controlling the entry to the dump, earlier blocked a truck containing traces of radioactive material thought to be medical waste. (Photo: Stefano Renna/Reuters/Scanpix)

The chance of detecting harmful effects increases when larger groups are used, but unfortunately the chance does not increase as much as one might have wished. Quite large disease frequencies may go undetected in all studies of feasible size. As a rough rule of thumb, epidemiological studies can only reliably detect excess relative risks that are about 10 % or greater. The more common diseases in a population tend to have frequencies up to about 10 %. Therefore, even in the most sensitive studies, lifetime risks smaller than 1 % cannot be observed. In other words, if an exposure increases the frequency of a disease such as myocardial infarction from 10 % to 11 %, we will not be able to discover this increase in any (epidemiological) study of the exposed population (Hansson, 1999). In many cases, health effects that cannot be detected in studies on humans can be discovered in animal experiments. In this way, uncertainty about health risks can be reduced, but it cannot be eliminated. The problem of statistical undetectability is also present in animal experiments. In addition, the extrapolation from animal models to human health is associated with considerable uncertainty. In summary, the scientific basis for regulatory toxicology is fraught with uncertainties: Although it can often be proved beyond reasonable doubt that a substance has a particular adverse effect, it can seldom be proved beyond reasonable doubt that it does not have a particular adverse effect, and in practice it is never possible to prove that it has no adverse effect at all. Furthermore, 122 S.O. Hansson surprisingly large effects, such as an increase in the frequency of a serious disease from 10 % to 11 %, can be statistically undetectable. Is this problem solvable? Is there a way to achieve safety with exposure limits? Absolute safety cannot be achieved by these or any other means. On the other hand, risks can be substantially reduced if we systematically combine exposure limits with the other numerical decision tool that we have discussed in this chapter, namely the safety factor. The consistent use of explicit safety factors has been successful in other areas of regulatory toxicology. Its introduction in the determination of occupational exposure limits could provide sufficient compensation for the unavoidable uncertainty in our knowledge of the toxic effects of chemical pollutants.

References

Clausen J, Hansson SO, Nilsson F (2006) Generalizing the safety factor approach. Reliability Engineering and System Safety 91:964–973 Cook WA (1985) History of ACGIH TLVs. Annals of the American Conference of Governmental Industrial Hygienists 12:3–9 Dourson ML, Stara JF (1983) Regulatory history and experimental support of uncertainty (safety) factors. Regulatory Toxicology and Pharmacology 3:24–238 Gaylor DW, Kodell RL (2002) A procedure for developing risk-based reference doses. Regulatory Toxicology and Pharmacology 35:137–141 Hansson SO (1996) Decision-making under great uncertainty. Philosophy of the Social Sciences 26:369–386 Hansson SO (1998) Setting the limit – occupational health standards and the limits of science. Oxford University Press, Oxford Hansson SO (1999) The moral significance of indetectable effects. Risk 10:101–108 Hansson SO (2007a) Safe design. Techne 10:43–49 Hansson SO (2007b) Ethics and radiation protection. Journal of Radiological Protection 27:147–156 Hulst MVD, Meijman T, Rothengatter T (1999) Anticipation and the adaptive control of safety margins in driving. Ergonomics 42:336–345 Kawaguchi N (1995) New method of evaluating the surgical margin and safety margin for musculoskeletal sarcoma, analysed on the basis of 457 surgical cases. Journal of Cancer Research and Clinical Oncology 121:555–563 Moses F (1997) Problems and prospects of reliability-based optimisation. Engineering Structures 19:293–301 Randall FA (1976) The safety factor of structures in history.Professional Safety (January):12–28 Weil CS (1972) Statistics vs safety factors and scientific judgment in the evaluation of safety for man. Toxicology and Applied Pharmacology 21:454–463