Bob Lunn
08/13/97 02:33 PM


>> The formula is THREAT = RISK * HARM
>
> This is the most unscientific rubbish I have ever seen and
> bears no relationship to reality...

     While the application of formulae is not in itself
     'scientific' it is certainly 'empirical'.  Empiricism
     is at the heart of engineering.

     The formula given is an attempt to mirror the _reality_
     of how people actually evaluate threats.

     Walking down the street on a sunny day I evaluate the
     threat of being struck by lightning as low.  Small risk
     by large harm equals little threat.

     Walking around a golf course in a thunderstorm I evaluate
     the threat of being struck by lightning as high.  Large
     risk by large harm equals 'get out from under this tree!'.

     As an engineer designs products to be used by others they
     have an obligation to evaluate the threats posed by that
     product.  The product's users are justified in requiring
     the engineer to evaluate those threats on the same basis
     as they themselves would.  That is, by quantifying the
     probability of an event and the cost of that event.

     That the quantification of risk and harm (probability and
     cost) will often be difficult or imprecise, or be based
     on rules-of-thumb, or be derived from anecdotal experience,
     does not exempt us as engineers from doing our sums.

> Would you ever quote this formula to the parent of a child killed
> in a plane crash...

     Mike, of course I would!  If I'm to be able to look that
     parent in the eye and know in my heart that I did my job
     as best I could, then I must be continuously evaluating
     threats as I design.

     Note the distinction here!  I am not _only_ minimising
     RISK, I am trying to minimise THREAT.  I am doing this
     because it most properly mirrors what that parent would
     do in my place (note that I am not saying that our
     respective quantifications of risk and harm would be
     the same).

     To minimise _only_ risk, or _only_ harm, is to fail in
     our professional duty.  To state as a moral imperitive
     (as you seem to do, Mike) that we should focus on the
     minimisation of risk is, I believe, to miss the point
     both morally and practically.

___Bob