F-N Curve and Societal Risk: Drawing the Line on Safety

How safe is safe enough? Every safety engineer who works on a major hazard meets that question. Physics alone cannot answer it. Engineers can always add more redundancy, more distance, or more checks. So the real question is whether the next slice of safety is worth its cost. It also asks whether today’s level of societal risk is one the public will accept. The F-N curve turns that judgement into a chart. ALARP turns it into a rule.

What an F-N curve actually plots

An F-N curve plots the cumulative frequency F of accidents that kill N or more people. The axes are log-log. If f(n) is the annual chance of an accident that kills exactly n people, then:

$F(N) = P(\text{fatalities} \ge N) = \sum_{n=N}^{\infty} f(n) \quad \text{per year}$

So F(N) is the complementary cumulative distribution of yearly deaths. The “or more” rule matters. First, it removes binning artefacts. Second, it forces the curve to slope down. The shape first appeared for nuclear reactors in the 1975 WASH-1400 study. For the underlying frequency math, see our companion event tree vs fault tree post.

Collapsing societal risk to one number: PLL and FAR

Integrate the F-N curve and you get expected fatalities per year. We call this the Potential Loss of Life (PLL):

$\text{PLL} = E[N] = \int_{0}^{\infty} F(N)\, dN$

PLL is the area under the F-N curve on linear axes. However, it shrinks the whole picture to one scalar. So it cannot tell a single 1,000-fatality disaster from a thousand single-fatality crashes. The offshore world prefers the Fatal Accident Rate (FAR). FAR just rescales PLL per 10⁸ exposure hours — about a thousand working lives. For example, IOGP reports a 2019 upstream FAR of 0.82, down from 1.01 the year before. Both numbers compress the societal risk picture.

Slope α: the societal risk aversion knob

Most regulatory criteria are themselves straight lines on log-log paper:

$F(N) \le \frac{C}{N^{\alpha}}$

Take logs:

$\log F = \log C - \alpha \log N$

So α is the slope. Two values matter:

• α = 1 (risk-neutral). A tenfold larger crash must occur tenfold less often. The line keeps expected fatalities flat.
• α = 2 (risk-averse). A tenfold larger crash must occur a hundredfold less often. Society penalises catastrophes harder than expected value alone would.

The Dutch policy uses α = 2 (Bottelberghs, 2000). In contrast, UK HSE uses α = 1 in its COMAH guidance. So the same plant can pass in Britain yet fail across the North Sea. The debate over whether α > 1 is fair has run for thirty years. A slope steeper than −1 says one crash with 10 deaths is worse than 10 crashes with one death each.

The ALARP carpet

Now plot two parallel lines with the same slope –α. Mark the upper one intolerable. Mark the lower one broadly acceptable. The strip between them is the ALARP region — the carpet. Inside it, risks pass only if the operator has cut them as low as reasonably practicable. The same picture appears as the classic “carrot” or triangle in HSE’s Reducing Risks, Protecting People (R2P2).

The HSE’s individual-risk anchors are now textbook:

• 1 in 1,000 per year — intolerable for a worker.
• 1 in 10,000 per year — intolerable for a member of the public.
• 1 in 1,000,000 per year — broadly acceptable for any individual.

For societal risk, R2P2 gives one anchor. An event killing 50 or more at frequency above 1 in 5,000 per year falls in the intolerable zone. From that point, HSE’s COMAH guidance extends a slope-1 line through F = 10⁻²/yr at N = 10. Every major-hazard regulator reuses the same ALARP geometry. Only the constants change.

A short history of the F-N curve

Three milestones bracket the modern framework. First, in 1967, F. R. Farmer drew a near-inverse line in probability–consequence space at the IAEA Vienna symposium. People sometimes still call the F-N curve a Farmer diagram. Next, in 1975, WASH-1400 redrew Farmer’s idea on log-log axes. It also compared reactors to dams, fires, and aircraft crashes. Then, in 1978–81, the Canvey Island studies ran the first full QRA on a non-nuclear plant cluster. Finally, in 1992, HSE’s Tolerability of Risk from Nuclear Power Stations gave the framework its modern form. R2P2 generalised it to all work activities in 2001.

In parallel, the Netherlands wrote the cleanest legal version. So VROM’s policy now applies one rule to roughly 4,000 hazardous sites: F(N)·N² must stay below 10⁻³ per year. The same rule has since shaped flood-defence policy, so one line now bounds dyke, plant, and tunnel risk inside one frame.

Offshore: Piper Alpha to NORSOK Z-013

On 6 July 1988, a gas leak from a condensate pump on the Piper Alpha platform killed 167 of 226 people on board. The disaster shifted offshore safety regulation in the UK from the Department of Energy to HSE in 1991. It also produced the Offshore Installations (Safety Case) Regulations. Lord Cullen pushed regulators away from prescriptive checklists and toward goal-setting risk work.

Today every UK duty-holder must produce a quantitative risk assessment that shows three things. First, individual risk per annum sits in the ALARP region, typically below 10⁻³/yr. Second, societal F-N curves stay clear of HSE’s intolerable line. Third, the operator strikes an ALARP balance through cost–benefit analysis with a gross-disproportion factor.

Norway runs a parallel regime under NORSOK Z-013. Z-013 deliberately leaves the numerical risk acceptance criteria to the operator. However, the de facto industry numbers have converged. For instance, third-party societal risk plots against an F-N criterion line through F = 10⁻⁴/yr at N = 10. Engineers comparing the two frameworks against a QRA bow-tie will spot the same slope-1 logic with different anchor constants.

Nuclear: QHOs, CDF, LERF, and the Dutch line

The IAEA frames everything with its Fundamental Safety Principles (SF-1, 2006). The US NRC turned those principles into hard numbers in 1986. Specifically, the Quantitative Health Objectives say the prompt-fatality risk to an average person within ~1 mile of a plant must stay below 0.1% of all-cause prompt accident risk — about 5 × 10⁻⁷ per reactor-year. Because Level-3 PRA costs a lot, the NRC also defines two surrogate sub-goals at plant level. Core Damage Frequency must stay below 10⁻⁴/yr. Large Early Release Frequency must stay below 10⁻⁵/yr. For new builds, both regulators now expect CDF below 10⁻⁵/yr.

The UK ONR uses the same logic with different vocabulary. Its Safety Assessment Principles define Basic Safety Levels as the intolerable boundary. Basic Safety Objectives mark the level below which extra cuts are normally not required. Meanwhile, the Dutch turned the F-N curve into law. An event killing 10 or more must occur at less than 10⁻⁵/yr. Killing 100 or more must occur at less than 10⁻⁷/yr. Killing 1,000 or more must occur at less than 10⁻⁹/yr. Chernobyl in 1986 and Fukushima in 2011 each forced revisions. For example, post-Fukushima reviews tightened design-basis rules for natural hazards and pushed the IAEA toward “practical elimination” of large-release scenarios.

Rail: GAMAB, MEM, and CSM-RA

EU railways operate under the Common Safety Method for Risk Evaluation and Assessment. CSM-RA does not impose pan-European numerical criteria. Instead it harmonises the process and lets proposers pick one of three principles. Those are: compliance with codes of practice, comparison with reference systems (the GAMAB route), or explicit risk estimation against numerical criteria.

GAMAB — Globalement Au Moins Aussi Bon, “globally at least as good” — requires any new system to match the safety of the one it replaces. Its strength is that it skips absolute societal risk numbers. However, its weakness is that it can lock in legacy risk levels.

MEM — Minimum Endogenous Mortality — anchors railway SIL allocation in CENELEC EN 50126. The anchor is the natural mortality of a 15-year-old, around 2 × 10⁻⁴/yr. People face many technical systems at once (the standard takes “many” as 20). So each system gets at most:

$\text{IRF}_{\text{system}} \le \frac{1}{20} \cdot 2 \times 10^{-4} = 1 \times 10^{-5} \text{ per person per year}$

Engineers widely quote this figure in railway SIL work. The UK rail world runs on the same ALARP rule as the rest of British safety law. RSSB sets the consensus reference in Taking Safe Decisions. Tunnel safety cases plot full F-N curves against national criteria. Then teams iterate ventilation, detection, and egress until the curve sits inside the ALARP carpet.

Where the societal risk lines actually sit

A simplified league table of headline anchor points, all per year:

Sector / regulator	Individual risk — intolerable	Broadly acceptable	Societal F-N anchor (intolerable)	α
UK HSE / R2P2 — public	10⁻⁴	10⁻⁶	F = 2 × 10⁻⁴ at N = 50	1
Netherlands (VROM)	10⁻⁶ (hard limit)	n/a	F = 10⁻³ / N²	2
US NRC (QHO)	5 × 10⁻⁷ prompt	n/a	CDF < 10⁻⁴ existing; 10⁻⁵ new; LERF < 10⁻⁵	n/a
UK ONR (BSL/BSO)	BSL 10⁻⁴; BSO 10⁻⁶	10⁻⁶	SAPs Targets 4–9	~1
Norway / NORSOK Z-013	10⁻³ IRPA personnel	~10⁻⁵	F = 10⁻⁴ at N = 10	1
EU rail / MEM	~10⁻⁵ per system	n/a	derived from MEM allocation	varies

A few patterns stand out. First, the broadly acceptable individual-risk anchor of 10⁻⁶/yr holds steady across sectors and continents. Second, catastrophe aversion is a policy choice, not a physical fact. The Dutch enshrine it (α = 2). UK COMAH does not (α = 1). Third, the same machinery — a hard individual limit, a societal risk F-N criterion, and an ALARP carpet — runs every modern major-hazard regulator. As Jonkman, van Gelder and Vrijling (2003) catalogued, some 25 different formal risk measures all reduce to projections of the F-N surface. Practitioners who already think in event-tree consequence chains will spot the same scaffolding here.

Critiques of the societal risk approach

Three serious objections recur. First, statistical lives versus identified lives. PLL adds fatalities together. So 100 deaths in 100 separate accidents match one accident killing 100. F-N criteria with α > 1 try to encode the public’s contrary instinct. However, CCPS guidelines note that “if preventing rare, high-consequence events requires disproportionate risk reduction efforts, such efforts run counter to the concept that a fatality is a fatality.”

Second, the agglomeration problem. An F-N curve for one site cannot match one for an entire industry, since the volume of activity differs. So the Dutch apply the criterion per site. The UK ACDS port study split risk budgets across berths. Rail under CSM-RA delegates the choice to the proposer.

Third, uncertainty in the tail. Power-law tails of accident severity are notoriously hard to fit, and the catastrophic tail is exactly where regulatory criteria bite hardest. For instance, later analysts judged WASH-1400’s tail too narrow. Likewise, post-Fukushima reviews of seismic and tsunami margins forced repeated reassessment. Public perception adds a fourth layer: societal risk lines sit inside a value judgement, never above it.

The honest answer hidden in the math

The F-N curve is a powerful artefact. In one picture it captures frequency, consequence, and aversion in a way regulators, designers, and the public can argue about. The math is simple. A complementary cumulative distribution, plotted log-log, sits between two power-law lines. Their slope encodes how harshly society treats rare catastrophes versus frequent small accidents.

But the positions of those lines do not come from physics. Piper Alpha shaped the North Sea anchor. Three Mile Island and Fukushima shaped the NRC’s Quantitative Health Objectives. Ladbroke Grove shaped RSSB’s Taking Safe Decisions. The Enschede fireworks disaster shaped the Dutch α = 2 slope. They are political artefacts in engineering clothing.

That is not a criticism — it is the point. “How safe is safe enough” is a question every society must answer for itself. So the F-N curve remains the most honest format anyone has yet drawn for showing the chosen answer. A regulator who draws the line makes a value judgement transparent. It then becomes something engineers can inspect, contest, and improve. Practising fire and process-safety engineers should follow Lord Cullen’s lesson: do the QRA, draw the curve, name the anchor, and then defend the line in public. The math is the easy part.

Cite this article

Dinh, D. C. (2026, May 8). F-N Curve and Societal Risk: Drawing the Line on Safety. PyroRisk. https://pyrorisk.net/blog/f-n-curve-and-societal-risk/

Get citation →

---