key: cord-024088-020rgz5t
authors: Radandt, Siegfried; Rantanen, Jorma; Renn, Ortwin
title: Governance of Occupational Safety and Health and Environmental Risks
date: 2008
journal: Risks in Modern Society
DOI: 10.1007/978-1-4020-8289-4_4
sha: 
doc_id: 24088
cord_uid: 020rgz5t

Occupational safety and health (OSH) activities were started in the industrialized countries already 150 years ago. Separated and specific actions were directed at accident prevention, and the diagnosis, treatment and prevention of occupational diseases. As industrialization has advanced, the complexity of safety and health problems and challenges has substantially grown, calling for more comprehensive approaches. Such development has expanded the scope, as well as blurred the borders between specific activities. In the modern world of work, occupational safety and health are part of a complex system that involves innumerable interdependencies and interactions. These are, for instance, safety, health, well-being, aspects of the occupational and general environment, corporate policies and social responsibility, community policies and services, community social environment, workers’ families, their civil life, lifestyles and social networks, cultural and religious environments, and political and media environments.

A well-functioning and economically stable company generates resources to the workers and to the community, which consequently is able to maintain a positive cycle in development. A high standard of safety and health brings benefits for everyone: the company, the workers and the whole community.

These few above-mentioned interactions elucidate the need for an integrated approach, and the modelling of the complex entity. If we picture OSH as a house, this integrated approach could be the roof, but in order to build a stable house, it is also necessary to construct a solid basement as a foundation to the house. These basement "stones" are connected to each other, and are described in more detail in Sections 4.1-4.3.

Section 4.1 focuses on the existing hazards, while Section 4.2 mainly considers the exposure of workers to health hazards. Health, due to its complexity, however, is not only influenced and impaired by work-related hazards, but also by hazards arising from the environment. These two sub-chapters are thus linked to Section 4.3.

In addition, the safety levels of companies may affect the environment. The strategies and measures needed for effective risk management, as described in Section 4.1, therefore also contribute to reducing the risks to the environment.

In the case of work that is done outdoors, the hazards arising from the environment understandably have to be given special attention. Here, the methods applied to tackle the usual hazards at workplaces are less effective. It is necessary to develop protective measures to avoid or minimize hazards present in the environment. Namely, agriculture, forestry and construction involve these types of hazards, and affect high numbers of workers on a global scale.

Finally, hazards in the environment or in leisure-time activities can lead to strain and injuries which -combined with hazards at work -may result in more severe health consequences. As an example one can mention the hazardous substances in the air causing allergies or other illnesses. Another example is the strain on the musculoskeletal system from sports and leisuretime activities causing low back pain and other musculoskeletal disorders.

Depending on the type of hazard, the three topics, namely, safety, health and the environment, may share the common trait that the proper handling of risks, i.e., how to reduce probabilities and/or consequences of unwanted events is not always possible within a risk management system. This is true when one moves into the realm of uncertainty, i.e., when there is uncertain, insufficient or no knowledge of the consequences and/or probabilities (see Chapter 5).

1. Integrated multi-sectorial bodies for policy design and planning (National Safety and Health Committee). 2. Comprehensive approach in OSH activities. 3. Multi-disciplinary expert resources in inspection and services. 4. Multi-professional participation of employers' and workers' representatives. 5. Joint training in integrated activities. 6. Information support facilitating multi-professional collaboration.

International Labour Office (ILO) (2003) International Labour Conference, 91st Session, Report VI, ILO Standards-Related Activities in the Area of Occupational Safety and Health: An In-Depth Study for Discussion with a View to the Elaboration of a Plan of Action for Such Activities. Sixth Item on the Agenda. International Labour Office, Geneva.

What are the main challenges arising from the major societal changes for business/companies and workers/employees? How can these challenges be met in order to succeed in the growing international competition? What is the role of occupational safety and health (OSH) in this context? The above-mentioned changes create new possibilities, new tasks and new risks to businesses in particular, and to the workers as well. In order to optimize the relation between the possibilities and the risks (maximize possibilities -minimize risks) there is a growing need for risk management.

Risk management includes all measures required for the target-oriented structuring of the risk situation and safety situation of a company. It is the systematic application of management strategies for the detection, assessment, evaluation, mastering and monitoring of risks.

Risk management was first considered exclusively from the point of view of providing insurance coverage for entrepreneurial risks. Gradually the demands of jurisdiction grew, and the expectations of users and consumers increased with regard to the quality and safety of products. Furthermore, the ever more complex problems of modern technology and ultimately the socioeconomic conditions have led to the development of risk management into an independent interdisciplinary field of work.

Risks can be regarded as potential failures, which may decrease trust in realizing a company's goals. The aim of risk management is to identify these potential failures qualitatively and quantitatively, and to reduce them to the level of a non-hazardous and acceptable residual risk potential.

The development and formulation of a company's risk policy is regarded as the basis of effective risk management. This includes, first and foremost, the management's target concept with respect to the organization of work, distribution of labour, and competence of the departments and persons in charge of risk management.

Risk issues are important as far as acceptance of technology is concerned. It is not enough to reduce the problem to the question of which risks are tolerable or acceptable. It appears more and more that, although the risks themselves are not accepted, the measures or technologies causing them are.

Value aspects have an important role in this consideration. A positive or negative view of measures and technologies is thus influenced strongly by value expectations that are new, contradictory and even disputed.

Comparing risks and benefits has become a current topic of discussion. The relation between risks and benefits remains an unanswered question. The general public has a far broader understanding of the risks and benefits of a given technology than the normal understanding professed by engineering sciences which is limited to probability x harm. The damage or catastrophe potential, qualitative attributes such as voluntary nature and controllability also play an important role in the risk assessment of a technology. A normative setting for a certain, universally accepted risk definition according to engineering science is therefore hardly capable of consensus at the moment.

The balanced management of risks and possibilities (benefits) is capable of increasing the value of a company. It may by far surpass the extent of legal obligations: for example, in Germany, there is a law on the control and transparency for companies (KonTraG) . The respective parameters may be defined accurately as follows:

• Strategic decisions aim to offer opportunities for acquiring benefit, taking into consideration risks. • Risks that can have negative consequences to the technological capacities, the profitability potential, the asset values and the reputation of a company, as well as the confidence of shareholders are identified and measured.

• The management focuses on important possibilities and risks, and addresses them adequately or reduces them to a tolerable level. The aim is not to avoid risks altogether, but to create opportunities for promoting proactive treatment of all important risks.

The traditional occupational health hazards, such as physical, chemical and biological risks, as well as accidents, will not totally disappear as a consequence of change, nor will heavy physical work. About 30-50% of workers are still exposed to such hazards. There is thus need to still develop risk assessment, prevention and control methods and programmes for these often well-known hazards. In many industrialized countries, prevention and control programmes have had a positive impact by reducing the trends of occupational diseases and accidents, particularly in big industries. Some developing countries, however, show an increase in traditional hazards. International comparisons, however, are difficult to make because of poor coverage, underreporting, and poor harmonization of concepts, definitions and registration criteria.

Statistics on occupational accidents are difficult to compare, and therefore data on their total numbers in Europe should be viewed with caution. The majority of countries, however, have shown declining trends in accident rates irrespective of the absolute numbers of accidents. Some exceptions to this general trend have nevertheless been seen. The accident risk also seems to shift somewhat as regards location, so that instead of risks related to machines and tools, particularly the risks in internal transportation and traffic within the workplace grow in relative importance. This trend may increase in future, particularly as the work place, as well as the speed and volume of material flows are increasing. A threat is caused by lengthened working hours, which tend to affect the vigilance of workers and increase the risk of errors. Small-scale enterprises and micro-enterprises are known to have a lower capacity for occupational health and safety than larger ones. In fact, a higher accident risk has been noted in medium-sized companies, and a lower risk in very small and very large enterprises. We can conclude that this is due to the higher mechanization level and energy use in small and medium-sized enterprises (SME) compared with micro-enterprises, which usually produce services. On the other hand, the better capacity of very large enterprises in safety management is demonstrated by their low accident rates.

The production of chemicals in the world is growing steadily. The average growth has been between 2-5% a year during the past 2-3 decades. The total value of European chemical production in 1998 was about USD 500 billion, i.e. 32% of the world's total chemical production, and it has increased 35% in the 10-year period of 1985-1995. The European Union (EU) is the largest chemical producer in the world, the USA the second, and Japan the third. There are some 100,000 different chemical entities in industrial use, but only about 2,500 are so-called high-production volume (HPV) chemicals produced (and consumed) in amounts exceeding 1,000 tons a year. The number of chemicals produced in amounts of 10-1,000 tons a year is about 25,000. But volume is not necessarily the most important aspect in chemical safety at work. Reactivity, toxicological properties, and how the chemicals are used, are more important. The European chemical companies number some 39,000, and in addition there are 36,000 plants producing plastics and rubber. Surprisingly, as many as 96% of these are SMEs employing fewer than 50 workers, and 70% are micro-enterprises employing fewer than 10 workers. Thus, the common belief that the chemical industry constitutes only large firms is not true. Small enterprises and self-employed people have much less competence to deal with chemical risk assessment and management than the large companies. Guidance and support in chemical safety is therefore crucial for them.

The number of workers dealing with chemicals in the European work life is difficult to estimate. The chemical industry alone employs some 1.7 million workers in Europe, i.e. about 7% of the workforce of manufacturing industries. About 30%, i.e. over 500,000 work in chemical SMEs. But a much higher number of workers are exposed in other sectors of the economy. There is a distinct trend showing that the use of chemicals is spreading to all sectors, and thus exposures are found in all types of activities: agriculture, forestry, manufacturing, services and even in high-tech production.

The national and European surveys on chemical exposures in the work environment give very similar results. While about 25% of the EU work-ers were exposed to hazardous chemicals, the corresponding figure in Central and Eastern European countries may be much higher. The workers are exposed simultaneously to traditional industrial chemicals, such as heavy metals, solvents and pyrolytic products, and to "new exposures", such as plastics monomers and oligomers, highly reactive additives, cross-linkers and hardeners, as well as to, for example, fungal spores or volatile compounds in contaminated buildings. This implies that some 40 million people in the EU15 are exposed at work, and usually the level of exposure is one to three orders of magnitude higher than in any other environment. About the same proportion (25% of the workforce, i.e. 500,000) of the Finnish workers in the national survey reported exposure. The chemicals to which the largest numbers of workers are exposed occur typically in SMEs; they are e.g. detergents and other cleaning chemicals, carbon monoxide, solvents, environmental tobacco smoke, and vegetable dusts.

European Directives on occupational health and safety require a high level of protection in terms of chemical safety in all workplaces and for all workers. Risk assessment and risk management are key elements in achieving these requirements. The risk assessment of chemicals takes place at two levels: a) Systems-level risk assessment, providing a dose-response relationship for a particular chemical, and serving as a basis for standard setting.

Risk assessment at the systems level is carried out in the pre-marketing stage through testing. This consequently leads to actions stipulated in the regulations concerning standards and exposure limits, labelling and marking of hazardous chemicals, limitations in marketing, trade and use. In this respect, the level of safety aimed at remains to be decided. Is it the reasonably achievable level or, for example, the level achieved by the best available technology? The impact is expected to be system-wide, covering all enterprises and all workers in the country. This type of risk assessment is an interactive practice between the scientific community and the politically controlled decision making. A high level of competence in toxicology, occupational hygiene and epidemiology is needed in the scientific community. And the decision makers must have the ability to put the risk in concern into perspective. In most countries the social partners also take part in the political decision making regarding occupational risks.

b) Workplace risk assessment directed at identifying the hazards at an individual workplace and utilizing standards as a guide for making decisions on risk management.

Risk assessment at workplace level leads to practical actions in the company and usually ensures compliance with regulations and standards. Risk assessment is done by looking at the local exposure levels and comparing these with standards produced in the type a) risk assessment. Risk management is done through preventive and control actions by selecting the safest chemicals, by controlling emissions at their source, by general and local ventilation, and by introducing safe working practices. If none of the above is effective, personal protective devices must be taken into use.

Noise is a nearly universal problem. The products of technology, which have freed us from the day-to-day survival struggle, have been accompanied by noise as the price of progress. However, noise can no longer be regarded as an inevitable by-product of today's society. Not only is noise an undesirable contaminant of our living environment, but high levels of noise are frequently present in a variety of work situations. Many problems arise from noise: annoyance, interference with conversation, leisure or sleep, effects on work efficiency, and potentially harmful effects, particularly on hearing. In short, noise may affect health, productivity, and well-being. The selection of appropriate noise criteria for the industry depends on knowledge of the effects of noise on people, as well as on the activities in which they are engaged. Many of the effects are dependent on the level, and the magnitude of the effects varies with this level.

Hearing damage is not the only criterion for assessing excessive noise. It is also important to consider the ability and ease of people to communicate with each other. Criteria have therefore been developed to relate the existing noise environment to the ability of the typical individual to communicate in areas that are likely to be noisy.

The effects of noise on job performance are difficult to evaluate. In general, one can say that sudden, intermittent, high-intensity noise impedes efficient work more than low-intensity and steady-state noise. The complexity of the task with which noise interferes plays a major role in determining how much noise actually degrades performance.

Two common ways in which noise can interfere with sleep are: delaying the onset of sleep, and shifting sleep stages.

One effect of noise that does not seem to depend strongly on its level is annoyance. Under some circumstances, a dripping water faucet can be as annoying as a jackhammer. There are no generally accepted criteria for noise levels associated with annoyance. If the noise consists of pure tones, or if it is impulsive in nature, serious complaints may arise.

New information and communication technologies (ICT) are being rapidly implemented in modern work life. About 65% of workers have computers at work, and about 35% are e-mail and Internet users. There are three main problem areas in the use of new ICT at work. These are: 1) the visual sensory system, 2) the cognitive processes, and 3) the psychomotoric responses needed for employing hand-arm systems. All three have been found to present special occupational health and even safety problems, which are not yet fully solved. The design of new more user-friendly technology is highly desirable, and the criteria for such technology need to be generated by experts in neurophysiology, cognitive psychology and ergonomics. It is important to note that the productivity and quality of information-intensive work requiring the use of ICT depends crucially on the user-friendliness of the new technology interface, both the hardware and software. Communication and information technologies will change job contents, organization of work, working methods and competence demands substantially in all sectors of the economy in all countries. A number of new occupational health and safety hazards have already arisen or are foreseen, including problems with the ergonomics of video display units, and musculoskeletal disorders in shoulder-neck and arm-hand systems, information overload, psychological stress, and pressure to learn new skills. The challenge to occupational health and safety people is to provide health-based criteria for new technologies and new types of work organization. It is also important to contribute to the establishment of healthy and safe work environments for people.

In the approved and draft standards of the International Standardization Organization, ISO, there are altogether about 50 different targets dealing with the standardization of eyesight-related aspects. Vision is the most important channel of information in information-intensive work. From the point of view of seeing and eye fatigue, the commonly used visual display units (VDU) are not the most optimal solutions. Stability of the image, poor lighting conditions, reflections and glare, as well as invisible flicker, are frequent problems affecting vision. The displays have, however, developed enormously in the 1990s, and there is evidence that the so-called flat displays have gradually gained ground.

Information-intensive work may increasingly load the vision and sense of hearing, particularly of older workers. Even relatively minor limitations in vision or hearing associated with ageing have a negative effect on receiving and comprehending messages. This affects the working capacity in information-intensive work. The growing haste in information-intensive work causes concern among workers and occupational health professionals. Particularly older workers experience stress, learning difficulties and threat of exclusion. Corrective measures are needed to adjust the technology to the worker.

The most important extension of the man-technology interface has taken place in the interaction of two information-processing elements: the central nervous system and the microprocessor. The contact is transmitted visually and by the hands, but also by the software which has been developed during the 1990s even more than the technology itself. Many problems are still associated with the immaturity of the software, even though its user-friendliness has recently greatly improved. The logic and structure of the software and the user systems, visual ergonomics, information ergonomics, the speed needed, and the forgiving characteristics of programs, as well as the possibility to correct the commands at any stage of processing are the most important features of such improvements.

Also the user's skills and knowledge of information technology and the software have a direct effect on how the work is managed and how it causes workload. The user-friendliness and ergonomics of the technology, the disturbing factors in the environment, haste and time pressure, the work climate, and the age and professional skills of the individual user, even his or her physical fitness, all have an impact on the cognitive capacity of a person. This capacity can to a certain extent be improved by training, exercise and regulating the working conditions, as well as with expert support provided for the users when difficulties do occur.

The use of new technologies has been found to be associated with high information overload and psychological stress. The problem is not only typical for older workers or those with less training, but also for the super-experts in ICT who have shown an elevated risk of psychological exhaustion.

There are four main types of ergonomic work loads: heavy dynamic work that may overload both the musculoskeletal and cardiovascular system; re-petitive tasks which may cause strain injuries; static work that may result in muscular pain; and lifting and moving heavy loads, which may result in overexertion, low back injury, or accidental injuries.

Visual ergonomics is gaining in importance in modern work life. The overload of the visual sensory system and unsatisfactory working conditions may strain the eye musculature, but can also cause muscle tension in the upper part of the body. This effect is aggravated if the worker is subjected to psychological stress or time pressure.

In addition to being a biological threat, the risk of infections causes psychological stress to workers. The improved communication between health services and international organizations provides help in the early detection and control of previously unknown hazards. Nevertheless, for example, the danger related to drug abusers continues to grow and present a serious risk to workers in, for example, health services and the police force. Some new viral or re-emerging bacterial infections also affect health care staff in their work. The increase in the cases of drug-resistant tuberculosis is an example of such a hazard.

The goal of preventive approaches is to exert control on the cause of unwelcome events, the course of such negative events or their outcome. In this context, one has to decide whether the harmful process is acute (an accident) or dependent on impact duration and stimulus (short-, medium-, and long-term). Naturally, the prevention approaches depend on the phases of the harmful process, i.e. whether the harm is reversible, or whether it is possible only to maintain its status, or to slow down the process.

It is assumed here that a stressful factor generates an inter-individual or intra-individual strain. Thus the effects and consequences of stress are dependent on the situation, individual characteristics, capabilities, skills and the regulation of actions, and other factors.

The overall consideration is related to work systems characterized by work contents, working conditions, activities, and actions. System performance is expected of this work system, and this system performance is characterized by a performance structure and its conditions and requirements (Figure 4 .2).

The performance of the biopsychosocial unit, i.e. the human being, plays an important role within the human performance structure (see Figures 4.2 and 4.3). The human being is characterized by external and internal features, which are closely related to stress compatibility, and thus to strain. In this respect, preventive measures serve to optimize and ensure performance, on the one hand, and to control stress and strain, on the other. Preventive measures aim to prevent bionegative effects and to facilitate and promote biopositive responses.

• The internal factors affecting performance are described by performance capacity and performance readiness. • Performance capacity is determined by the individual's physiological and psychological capacity. • Performance readiness is characterized by physiological fitness and psychological willingness. • The external factors affecting performance are described by organizational preconditions/requirements and technical preconditions/requirements. • Regarding the organizational requirements, the organizational structure and organizational dynamics are of significance. • In the case of technical requirements, the difficulties of the task, characterized by machines, the entire plant and its constructions, task content, task design, technical and situation-related factors, such as work layout, anthropometrics, and quality of the environment, are decisive (Table 4 .1).

Mental stress plays an increasing role in the routine activities of enterprises. Through interactive models of mental stress and strain, it is possible to represent the development of mental strain and its impairing effects (e.g. tension, fatigue, monotony, lack of mental satisfaction). It is important to distinguish the above-mentioned impairing effects from each other, since they can arise from different origins and can be prevented or eliminated by different means. Activities that strain optimally enhance health and promote safe execution of work tasks. Stress essentially results from the design parameters of the work system or workplace. These design parameters are characterized by, e.g.:

• technology, such as work processes, work equipment, work materials, work objects; • anthropometric design; • work techniques, working hours, sharing of work, cycle dependence, job rotation; • physiological design that causes strain, fatigue; • psychological design that either motivates or frustrates;

• information technology, e.g. information processing, cognitive ergonomic design; • sociological conditions; and • environmental conditions, e.g. noise, dust, heat, cold.

The stress structure is very complex, and we therefore need to look at the individual parameters carefully, taking into account the interactions and links between the parameters at the conceptual level. The design parameters impact people as stress factors. As a result, they also turn into conditions affecting performance. Such conditions can basically be classified into two types: a person's internal conditions, characterized in particular by predisposition and personality traits, and a person's external conditions, determined mainly by the design parameters.

When we look at performance as resulting from regulated or reactive action, we find three essential approaches for prevention:

• The first approach identifies strain. It is related to anatomical, biochemical, histological, physiological characteristic values, typical curves of organ systems, the degree of utilization of skills through stress, and thus the degree of utilization of the dynamics of physiological variables in the course of stress. • The second approach is related to the control of strain. The aim is to identify performance limits, the limits of training and practice, and to put them into positive use. Adaptation and fatigue are the central elements here. • The third approach for prevention is related to reducing strain. The aim is to avoid harm, using known limits as guidelines (e.g. maximum workplace concentration limit values for harmful substances, maximum organspecific concentration values, biological tolerance values for substances, limit values for noise and physical loads). However, the use of guideline values can only be an auxiliary approach, because the stress-strain concept is characterized by highly complex connections between the exogenous stress and the resulting strain. An objectively identical stress will not always cause the same level of strain in an individual. Due to action regulation and individual characteristic values and curves of the organ systems (properties and capabilities), differences in strain may occur. Seemingly identical stress can cause differing strain due to the superposition of partial stress. Combinations of partial stress can lead to compensatory differences (e.g. physiological stress can compensate for psychological stress) or accumulation effects. Partial stress is determined by the intensity and duration of the stress, and can therefore appear in differing dimensions and have varying effects. In assessing overall stress, the composition of the partial stress according to type, intensity, course and time is decisive. Partial stress can occur simultaneously and successively. In our considerations, the principle of homeostasis plays an important role.

However, optimizing performance is only a means to an end in a prevention programme. The actual purpose is to avoid harm, and thus to control strain. Harm is a bionegative effect of stress. The causative stress is part of complex conditions in a causal connection. Causal relationships can act as dose-effect relationships or without any relation to the dose. In this respect, the causative stress condition can form a chain with a fixed or variable sequence; it can add up, multiply, intensify or have an effect in only specific combinations, and generate different effects (e.g. diseases). We are thus dealing with a multicausal model or a multi-factor genesis. Low back pain is an example of a complex phenomenon. The incidence of musculoskeletal disorders, especially low back pain, is rapidly increasing. Several occupational factors have been found to increase the risk for low back pain. Some studies indicate that psychosocial and work-related conditions are far more accurate in the prognosis of disability than are physical conditions. Chronic low back pain is perceived as a phenomenon which encompasses biological, social and psychological variables. According to the model of adaptation, the goal of reducing risks is to increase a person's physical abilities (i.e. flexibility, strength, endurance), the use of body mechanics, techniques to protect the back (following the rules of biomechanics), to improve positive coping skills and emotional control.

The following unfavourable factors leading to back pain have been identified at workplaces:

• The lifting of too heavy loads.

• Working in a twisted or bent-down position.

• Work causing whole-body vibration.

• Working predominantly in a sitting position.

• Carrying heavy loads on the shoulders.

The prevention of acute back pain and the prevention of work disability must entail several features. One important element is work safety, which can be maximized by screening a worker's physical and intellectual capacities, by ensuring ergonomic performance of the work procedures, and by increasing awareness of proper working techniques that do not strain the back.

The use of adaptation programmes makes it possible to attain a higher performance level and to be able to withstand more strain (Figure 4.4) . Research-based methods of training optimize and improve performance. They are a means for controlling stress and strain with the aim of preventing bionegative effects and facilitating and promoting biopositive responses.

The stress (load) and strain model and human performance can be described as follows:

• Causative stress generates an inter-individual or intra-individual strain. • The effects and consequences depend on a person's properties, capabilities, skills and the regulation of actions, individual characteristics of the organ systems, and similar factors. • Within the performance structure, the performance of the biopsychosocial unit, i.e. the human being, plays an important role. The human being is characterized by external and internal factors, which in turn are closely related to stress compatibility and thus to strain. The connection between stress and harm plays a significant role in the research on occupational health hazards. How should this connection be explored? Different hypotheses exist in replying to this question, but none of them have been definitively proven. The three most common hypotheses today are: 

Stress occurring in connection with a person's life events. The number and extent of such events is decisive.

Problem-coping behaviour and/or social conditions are variables explaining the connection between stress and harm. 3. The additive stress hypothesis.

The ability to cope with problems and the social conditions has an effect on harm which is independent of the stress resulting from life events.

When we refer to the complexity of risks in this context of occupational safety our focus shall be on the enterprise. There are different kinds of risks to be found in enterprises. Many of them are of general importance, i.e. they are in principle rather independent of an enterprise's size or its type of activity. How to deal with such risks shall be outlined to some extent here. In order to treat those risks at work successfully resources are needed whose availability often depends on the enterprise's situation.

The situation in enterprises usually is a determining indicator for available resources to control and develop safety and health and thus performance of the enterprise and its workers and employees through appropriate preventive measures. This situation has been described to some extent in Chapter 2.

Big companies usually have well-developed safety and health resources, and they often transfer appropriate policies and practices to the less developed areas where they operate. Even in big enterprises, however, there is fragmentation of local workplaces into ever smaller units. Many of the formerly in-built activities of enterprises are outsourced. New types of work organizations are introduced, such as flat and lean organizations, increase of telework and call centres, many kinds of mobile jobs and network organizations. Former in-company occupational health services are frequently transferred to service providers.

This leads to the establishment of high numbers of micro-enterprises, small scale enterprises (SSEs), small and medium-sized enterprises (SMEs) and self-employed people. SSEs and SMEs are thus becoming the most important employers in the future.

From a number of studies there is evidence that at least among a part of SSEs and SMEs awareness of OSH risks is low. Both managers and workers often do not see the need to improve occupational safety and health or ergonomic issues and their possibilities and benefits by reducing or eliminating risks at work.

As these types of enterprises, even more the self-employed, do not have sufficient resources or expertise for implementing preventive measures, the need for external advisory support, services and incentives is evident and growing.

Interpersonal relations in SSEs and SMEs being generally very good provides a strong chance for effectively supporting them.

Other special features in the structure of small and medium-sized enterprises to be considered are:

• direct participation of the management in the daily activities;

• the management structure is designed to meet the requirements of the manager; • less formal and standardized work processes, organizational structures and decision processes; • no clear-cut division of work:

-wide range of tasks; and -less specialization of the employees;

• unsystematic ways of obtaining and processing information;

• great importance of direct personal communication;

• less interest in external cooperation and advice; • small range of internal, especially long-term and strategic planning; and • stronger inclination of individual staff members to represent their own interests.

The role of occupational health services (OHS) in SMEs is an interdisciplinary task, consisting of:

• Risk assessment:

-investigation of occupational health problems according to type of technology, organization, work environment, working conditions, social relationships.

• Surveillance of employees' health:

-medical examinations to assess employees' state of health; and -offering advice, information, training.

• Advice, information, training:

-measures to optimize safety and health protection; and -safe behaviour, safe working procedures, first aid preparedness.

Different kinds of risks are found in enterprises (see Table 4 .2). These different types of risks need to be handled by an interlinked system to control the risks and to find compromises between the solutions. Figure 4 .7 illustrates these linkages.

The promotion of safety and health is linked to several areas and activities. All of these areas influence the risk management process. The results of risk treatment not only solve occupational health and safety problems, but they also give added value to the linked fields.

Specific risk management methods are needed to reach the set goal. One needs to know what a risk is. The definition of risk is essential: a risk is a combination of a probability -not frequency -of occurrence, and the associated unwelcome outcome or impact of a risk element (consequence).

Risk management is recognized as an integral part of good management practice. It is a recurring process consisting of steps which, when carried out in a sequence, allow decision making to be improved continuously.

Risk management is a logical and systematic method of identifying, analyzing, evaluating, treating, monitoring and communicating risks arising during any activity, function, or process in a manner enabling the organization to minimize losses and maximize productive opportunities.

Different methods are available for analyzing problems. Each method is especially suited to respond to certain questions and less suited for others. A complex "thinking scheme" is necessary for arranging the different analyses correctly within the system review. Such a scheme includes the following steps:

1. Defining the unit under review:

The actual tasks and boundaries of the system (a fictitious or a real system) must be specified: time, space and state. 2. Problem analysis:

All problems existing in the defined system, including problems which do not originate from the system itself, are detected and described. 3. Causes of problems:

All possible or probable causes of the problems are identified and listed. 4. Identifying interaction:

The dependencies of the effect mechanisms are described, and the links between the causes are determined. 5. Establishing priorities and formulating targets:

To carry out this step, it is necessary to evaluate the effects of the causes. 6. Solutions to the problems:

All measures needed for solving the individual problems are listed. The known lists usually include technical as well as non-technical measures.

Since several measures are often appropriate for solving one problem, a pre-selection of measures has to be done already at this stage. However, this can only be an approach to the solution; the actual selection of measures has to be completed in steps 7 and 8. 7. Clarifying inconsistencies and setting priorities:

As the measures required for solving individual problems may be inconsistent in part, or may even have to be excluded as a whole, any inconsist-encies need to be clarified. A decision should then be made in favour or against a measure, or a compromise may be sought. 8. Determining measures for the unit under review:

The measures applicable to the defined overall system are now selected from the measures for the individual problems. 9. List of questions regarding solutions selected for the overall system:

Checking whether the selected measures are implementable and applicable for solving the problems of the overall system. 10. Controlling for possible new problems:

This step consists of checking whether new problems are created by the selected solution.

The close link between cause and effect demands that the processes and sub-processes must be evaluated uniformly, and risks must be dealt with according to a coordinated procedure.

The analysis is started by orientation to the problem. This is done in the following steps:

1. Recognizing and analyzing the problem according to its causes and extent, by means of a diagnosis and prediction, and comparison with the goals aimed at. 2. Description and division of the overall problem into individual problem areas, and specifying their dependencies. 3. Defining the problem and structuring it according to the objectives, time relation, degree of difficulty, and relevance to the goal. 4. Detailed analysis of the causes, and classification in accordance to the possible solution.

The analysis of the problem should be integrated into the overall analytical process in accordance with the thinking schemes described earlier. The relevance and priorities related to the process determine the starting point for the remaining steps of the analysis. Analyses are divided into quantitative and qualitative ones. Quantitative analyses include risk analyses, that is, theoretical safety-related analysis methods and safety analyses, e.g. classical accident analyses. Qualitative analyses include failure mode and effect analyses, hazard analyses, failure hazard analyses, operating hazard analyses, human error code and effect analyses, information error and effect analyses. The theoretical safety-related analysis methods include inductive and deductive analyses based on Boolean models. Inductive analyses are, e.g. fault process analyses. Deductive analyses are fault tree analyses, analytical processes and simulation methods. Theoretical safety-related analysis methods which are not based on Boolean models are stochastic processes, such as Markow's model, risk analyses and accident analyses which, as a rule, are statistical or probability-related analyses.

A possible scheme to begin with is shown in Figure 4 .9.

Since absolute safety, entailing freedom from all risks, does not exist in any sphere of life, the task of those dealing with safety issues is to avert hazards and to achieve a sustainable reduction of the residual risk, so that it does not exceed a tolerable limit. The extent of this rationally acceptable risk is also influenced by the level of risk which society intuitively considers as being acceptable.

Those who propose definitions of safety are neither authorized nor capable of evaluating the general benefit of technical products, processes and services. Risk assessment is therefore focused at the potential harm caused by the use or non-use of the technology.

The guidelines given in "A new approach to technical harmonization and standards" by the Council Resolution of 7 May 1985 are valid in the European Union. The legal system of a state describes the protective goals, such as protection of life, health, etc., in its constitution, as well as in individual laws and regulations. As a rule, these do not provide an exact limit as to what is still a tolerable risk. This limit can only be established indirectly and unclearly on the basis of the goals and conceptions set down by the authorities and laws of a state. In the European Union, the limits are expressed primarily in the "Basic safety and health requirements". These requirements are then put into more concrete terms in the safety-related definitions issued by the bodies responsible for preparing industrial standards. Compliance with the standards is voluntary, but it is presumed that the basic requirements of the directives are met.

The term which is opposite to "safety" is "hazard". Both safe and hazardous situations are founded on the intended use of the technical products, processes and services. Unintended use is taken into account only to the extent that it can be reasonably foreseen.

The risks present in certain events are, in a more narrow sense, unwelcome and unwanted outcomes with negative effects (which exceed the range of acceptance).

Unwelcome events are

• source conditions of processes and states;

• processes and states themselves; and

• effects of processes and states which can result in harm to persons or property.

An unwelcome event can be defined as a single event or an event within a sequence of events. Possible unwelcome events are identified for a unit under review. The causes may be inherent in the unit itself, or outside of it.

In order to determine the risks involved in unwelcome events, it is necessary to identify probabilities and consequences. The question arises: Are the extent and probability of the risk known? Information is needed to answer this question.

Defining risk requires information concerning the probability of occurrence and the extent of the harm of the consequences. Uncertainty is given if the effects are known but the probability is unknown. Ignorance is given if both the effects and the probability are unknown. Figure 4 .10 shows the risk analysis procedure according to the type of information available.

Since risk analyses are not possible without practical, usable information, it is necessary to consider the nature of the information. The information is characterized by its content, truth and objectivity, degree of confirmation, the possibility of being tested, and the age of the information.

The factors determining the content of the information are generality, precision and conditionality. The higher the conditionality, the smaller is the generality, and thus the smaller the information content of the statement. Truth is understood as conformity of the statement with the real state of affairs. The closer that the information is to reality, the higher is its information content, and the smaller its logical margin. The degree of controllability is directly dependent on the information content: the bigger the logical margin, the smaller the information content, and thus the higher the probability that the information content will prove its worth.

In this respect, probability plays a role in the information content: the greatest significance is attributed to the logical hypothetical probability and statistical probability of an event. Objectivity and age are additional criteria for any information. The age and time relation of information play a particularly important role, because consideration of the time period is an important feature of analysis. As a rule, information and thus the data input in the risk analysis consist of figures and facts based on experience, materials, technical design, the organization and the environment. In this regard, most figures are based on statistics on incidents and their occurrences.

Factual information reveals something about the actual state of affairs. It consists of statements related to past conditions, incidents, etc. Forecast-type predictions are related to real future conditions, foretelling that certain events will occur in the future.

Explanatory information replies to questions about the causes of phenomena, and provides explanations and reasons. It establishes links between different states based on presumed cause-effect relationships.

Subjunctive information expresses possibilities, implying that certain situations might occur at present or in the future, thus giving information about conceivable conditions, events and relationships.

Normative information expresses goals, standards, evaluations and similar matters; it formulates what is desirable or necessary.

The main problem with risk analyses is incomplete information, in particular regarding the area of "uncertainty". In the EU Commission's view, recourse to the so-called precautionary principle presupposes that potentially dangerous effects deriving from a phenomenon, product or process have been identified via objective scientific evaluation, and that scientific evaluation does not allow the risk to be determined with sufficient certainty. Recourse to the precautionary principle thus takes place in the framework of general risk management that is concretely connected to the decision-making process.

If application of the precautionary principle results in the decision that action is the appropriate response to a risk, and that further scientific information is not needed, it is still necessary to decide how to proceed. Apart from adopting legal provisions which are subject to judicial control, a whole range of actions is available to the decision-makers (e.g. funding research, or deciding to inform the public about the possible adverse effects of a product or procedure). However, the measures may not be selected arbitrarily. In conclusion, the assessment of various risks and risk types which may be related to different types of hazards requires a variety of specific risk assessment methods.

If one has dependable information about the probability and consequences of a serious risk or risky event, one should use the risk assessment procedure shown in Figure 4 .11.

• major industrial accidents; • damage caused by dangerous substances; • nuclear accidents;

• major accidents at sea; • disasters due to forces of nature; and • acts of terrorism.

• dangerous substances discharged (fire, explosion); • injury to people and damage to property;

• immediate damage to the environment; • permanent or long-term damage to terrestrial habitats, to fresh water, to marine habitats, to aquifers or underground water supplies; and • cross-border damage.

• technical failure: devices, mountings, containers, flanges, mechanical damage, corrosion of pipes, etc.;

• human failure: operating error, organizational failure, during repair work;

• chemical reaction;

• physical reaction; and • environmental cause.

System analysis is the basis of all hazard analyses, and thus needs to be done with special care. System analysis includes the examination of the system functions, particularly the performance goals and admissible deviations in the ambient conditions not influenced by the system, the auxiliary sources of the system (e.g. energy supply), the components of the system, and the organization and behaviour of the system. Geographical arrangements, block diagrams, material flow charts, information flow charts, energy flow charts, etc. are used to depict technical systems. The objective is to ensure the safe behaviour of the technical systems by design methods, at least during the required service life and during intended use. Qualitative analyses are particularly important in practice. As a rule, they are form sheet analyses and include failure mode and effect analyses, which examine and determine failure modes and their effects on systems. The preliminary hazard analysis looks for the hazard potentials of a system. The failure hazard analysis examines the causes of failures and their effects. The operating hazard analysis determines the hazards which may occur during operation, maintenance, repair, etc. The human error mode and effect analysis examines error modes and their effects which occur because of wrong behaviour of humans. The information error mode and effect analysis examines operating, maintenance and repair errors, fault elimination errors and the effects caused by errors in instructions and faulty information.

Theoretical analysis methods include the fault tree analysis, which is a deductive analysis. An unwelcome incident is provided to the system under review. Then all logical links and/or failure combinations of components or partial system failures which might lead to this unwelcome incident are assembled, forming the fault tree. The fault tree analysis is suited for simple as well as for complex systems. The objective is to identify failures which might lead to an unwelcome incident. The prerequisite is exact knowledge about the functioning of the system under review. The process, the functioning of the components and partial systems therefore need to be present. It is possible to focus on the flow of force, of energy, of materials and of signals.

The fault process analysis has a structure similar to that of the fault tree analysis. In this case, however, we are looking for all unwelcome incidents as well as their combinations which have the same fault trigger. Analysis of the functioning of the system under review is also necessary for this.

Analyses can also be used to identify possible, probable and actual risk components. The phases of the analysis are the phases of design, including the preparation of a concept, project and construction, and the phases of use which are production, operation and maintenance.

In order to identify the fault potential as completely as possible, different types of analyses are usually combined. Documentation of the sufficient safety of a system can be achieved at a reasonable cost only for a small system. In the case of complex systems, it is therefore recommended to document individual unwelcome incidents. If solutions are sought and found for individual unwelcome incidents, care should be taken to ensure that no target conflicts arise with regard to other detail solutions.

With the help of the fault tree, it is possible to analyse the causes of an unwelcome incident and the probability of its occurrence. Decisions on whether and which redundancies are necessary can in most cases be reached by simple estimates. Four results can be expected by using a fault tree:

1. the failure combination of inputs leading to the unwelcome event; 2. the probability of their occurrence; 3. the probability of occurrence of the unwelcome event; and 4. the critical path that this incident took from the failure combination through the fault tree.

A systematic evaluation of the fault tree model can be done by an analytical evaluation (calculation) or by simulation of the model (Monte-Carlo method). A graphic analysis of the failure process is especially suited to prove the safety risk of previously defined failure combinations in the system.

The failure mode and effect analysis and the preliminary hazard analysis

As mentioned previously, no method can disclose all potential faults in a system with any degree of certainty. However, if one starts with the preliminary hazard analysis, then at least the essential components with hazard potential will be defined. The essential components are always similar, namely, kinetic energy, potential energy, source of thermal energy, radioactive material, biological material, chemically reactive substance.

With the fault tree method, any possible failure combinations (causes), leading to an unwelcome outcome, can then be identified additionally. Re-160 are especially suited for identifying failures in a system which pose a risk. liability parameters can be determined in the process, e.g. the frequency of occurrence of failure combinations, the frequency of occurrence of unwelcome events, non-availability of the system upon requests, etc.

The failure effect analysis is a supplementary method. It is able to depict the effects of mistakes made by the operating personnel, e.g. when a task is not performed, or is performed according to inappropriate instructions, or performed too early, too late, unintentionally or with errors. It can pinpoint also effects resulting from operating conditions and errors in the functional process or its elements.

An important aspect of all hazard analyses is that they are only valid for the respective case under review. Every change in a parameter basically requires new analyses. This applies to changes in the personnel structure and the qualification of persons, as well as to technical specifications. For this reason, it is necessary to document the parameters on which each analysis is based. The results of the hazard analyses form the basis for the selection of protective measures and measures to combat the hazards. If the system is modified, the hazards inherent in the system may change, and the measures to combat the hazards may have to be changed as well.

This may also mean that the protective measures or equipment which existed at time X for the system or partial system in certain operating conditions (e.g. normal operation, set-up operation, and maintenance phase) may no longer be compatible. Different protective measures, equipment or strategies may then be needed.

However, hazard analyses do not merely serve to detect and solve potential failures. They form the basis for the selection of protective measures and protective equipment, and they can also test the success of the safety strategies specified.

A selection of methods used for hazard analysis is given in Annex 2 to Section 4.1.

Risk assessment is a series of logical steps enabling the systematic examination of the hazards associated with machinery. Risk assessment is followed, whenever necessary, by actions to reduce the existing risks and by implementing safety measures. When this process is repeated, it eliminates hazards as far as possible.

Risk assessment includes:

• Risk analysis:

-determining the limits of machinery; -identifying hazards; and -estimating risks.

• Risk evaluation.

Risk analysis provides the information required for evaluating risks, and this in turn allows judgements to be made on the safety of e.g. the machinery or plant under review. Risk assessment relies on decisions based on judgement. These decisions are to be supported by qualitative methods, complemented, as far as possible, by quantitative methods. Quantitative methods are particularly appropriate when the foreseeable harm is very severe or extensive. Quantitative methods are useful for assessing alternative safety measures and for determining which measure gives best protection. The application of quantitative methods is restricted to the amount of useful data which is available, and in many cases only qualitative risk assessment will be possible.

Risk assessment should be conducted so that it is possible to document the used procedure and the results that have been achieved.

Risk assessment shall take into account:

• The life cycle of machinery or the life span of the plant.

• The limitations of the machinery or plant, including the intended use (correct use and operation of the machinery or plant, as well as the consequences of reasonably foreseeable misuse or malfunction). • The full range of foreseeable uses of the machinery (e.g. industrial, nonindustrial and domestic) by persons identified by sex, age, dominant hand usage, or limiting physical abilities (e.g. visual or hearing impairment, stature, strength). • The anticipated level of training, experience or ability of the anticipated users, such as:

-operators including maintenance personnel or technicians; -trainees and juniors; and -general public.

• Exposure of other persons to the machine hazards, whenever they can be reasonably foreseen.

Having identified the various hazards that can originate from the machine (permanent hazards and ones that can appear unexpectedly), the machine designer shall estimate the risk for each hazard, as far as possible, on the basis of quantifiable factors. He must finally decide, based on the risk evaluation, whether risk reduction is required. For this purpose, the designer has to take into account the different operating modes and intervention procedures, as well as human interaction during the entire life cycle of the machine. The following aspects in particular must be considered:

• construction; transport;

• assembly, installation, commissioning;

• adjusting settings, programming or process changeover; • instructions for users;

• operating, cleaning, maintenance, servicing; and • checking for faults, de-commissioning, dismantling and safe disposal.

Malfunctioning of the machine due to, e.g.

• variation in a characteristic or dimension of the processed material or workpiece; • failure of a part or function; • external disturbance (e.g. shock, vibration, electromagnetic interference); • design error or deficiency (e.g. software errors); • disturbance in power supply; and • flaw in surrounding conditions (e.g. damaged floor surface).

Unintentional behaviour of the operator or foreseeable misuse of the machine, e.g.:

• loss of control of the machine by the operator (especially in the case of hand-held devices or moving parts); • automatic (reflexive) behaviour of a person in case of a machine malfunction or failure during operation; • the operator's carelessness or lack of concentration; • the operator taking the "line of least resistance" in carrying out a task; • behaviour resulting from pressure to keep the machine running in all circumstances; and • unexpected behaviour of certain persons (e.g. children, disabled persons).

When carrying out a risk assessment, the risk of the most severe harm that is likely to occur from each identified hazard must be considered, but the greatest foreseeable severity must also be taken into account, even if the probability of such an occurrence is not high.

This objective may be met by eliminating the hazards, or by reducing, separately or simultaneously, each of the two elements which determine the risk, i.e. the severity of the harm from the hazard in question, and the probability of occurrence of that harm.

All protective measures intended to reach this goal shall be applied according to the following steps:

This stage is the only one at which hazards can be eliminated, thus avoiding the need for additional protective measures, such as safeguarding machines or implementing complementary protective measures.

3. Information about the residual risk.

Information for use on the residual risk is not to be a substitute for inherently safe design, or for safeguarding or complementary protective measures.

Risk estimation and evaluation must be carried out after each of the above three steps of risk reduction.

Adequate protective measures associated with each of the operating modes and intervention procedures prevent operators from being prone to use hazardous intervention techniques in case of technical difficulties.

The aim is to achieve the lowest possible level of risk. The design process is an iterative cycle, and several successive applications may be necessary to reduce the risk, making the best use of available technology. Four aspects should be considered, preferably in the following order:

1. the safety of the machine during all the phases of its life cycle; 2. the ability of the machine to perform its function; 3. the usability of the machine; and 4. the costs of manufacturing, operating and dismantling the machine.

The following principles apply to technical design: Service life, safe machine life, fail-safe and tamper-proof design. A design which ensures the safety of service life has to be chosen when neither the technical system nor any of its safety-relevant partial functions can be allowed to fail during the service life envisaged. This means that the components of the partial functions need to be exchanged at previously defined time intervals (preventive maintenance).

In the case of a fail-safe design, the technical system or its partial functions allow for faults, but none of these faults, alone or in combination, may lead to a hazardous state. It is necessary to specify just which faults in one or several partial systems can be allowed to occur simultaneously without the overall system being transferred into a hazardous state (maximum admissible number of simultaneous faults). A failure or a reduction in the performance of the technical system is accepted in this case.

Tamper-proof means that it is impossible to intentionally induce a hazardous state of the system. This is often required of technical systems with a high hazard potential. Strategies involving secrecy play a special role in this regard. In the safety principles described here, redundant design should also be mentioned. The probability of occurrence and the consequences of damage are reduced by multiple arrangements, allowing both for subsystems or elements to be arranged in a row or in parallel.

It is possible to reduce the fault potential of a technical system by the diversification of principles: several different principles are used in redundant arrangements. The spatial distribution of the function carriers allows the possibilities to influence faults to be reduced to one function. In the redundant arrangements, important functions, e.g. information transmission, are therefore designed in a redundant manner at different locations.

The measures to eliminate or avoid hazards have to meet the following basic requirements: their effect must be reliable and compulsory, and they cannot be circumvented.

Reliable effect means that the effect principle and construction design of the planned measure guarantee an unambiguous effect, that the components have been designed according to regulations, that production and assembly are performed in a controlled manner, and that the measure has been tested.

Compulsory effect includes the demand for a protective effect which is active at the start of a hazardous state and during it, and which is deactivated only when the hazardous state is no longer present, or stops when the protective effect is not active.

Technical systems are planned as determined systems. Only predictable and intended system behaviour is taken into account when the system is designed. Experience has shown, however, that technical systems also display stochastic behaviour. That is, external influences and/or internal modifications not taken into consideration in the design result in unintended changes in the system's behaviour and properties. The period of time until the unintended changes in behaviour and/or in properties occur, cannot be accurately determined; it is a random variable.

We have to presume that there will be a fault in every technical system. We simply do not know in advance when it will take place. The same is true for repairs. We know that it is generally possible in systems requiring re-pair to complete a repair operation successfully, but we cannot determine the exact time in advance. Using statistical evaluations, we can establish a timedependent probability at which a "fault event" or "completion of a repair operation" occurs. The frequency of these events determines the availability of the system requiring repair.

Technical systems are intended to perform numerous functions and, at the same time, to be safe. The influence of human action on safety has to be taken into account in safety considerations as well (i.e. human factor). A system is safe when there are no functions or action sequences resulting in hazardous effects for people and/or property.

Risks of unwelcome events (in the following called "risk of an event") are determined on the basis of the experience (e.g. catalogue of measures) with technical systems. In addition to this, safety analyses are used (e.g. failure mode and effect analysis, hazard analysis, failure hazard analysis, operating hazard analysis, information error analysis), as well as mathematical models (e.g. worst-case analysis, Monte-Carlo procedure, Markow's models).

Unwelcome events are examined for their effects. This is followed by considerations about which design modifications or additional protective measures might provide sufficient safety against these unwelcome events. The explanations below present the basic procedure for developing safety-relevant arrangements and solutions, i.e. the thinking and decision-making processes, as well as selecting criteria that are significant for the identification of unwelcome events, the risk of an event, the acceptance limits and the adoption of measures.

Before preparing the final documentation, it is essential to verify that the limit risk has not been exceeded, and that no new unwelcome events have occurred.

The sequence scheme describes the procedure for developing safety arrangements and for finding solutions aiming to avoid the occurrence of unwelcome events which exceed the acceptance limits, by selecting suitable measures. In this context, it is assumed that:

• An unwelcome event is initially identified as a single event within a comprehensive event sequence (e.g. start-up of a plant), and the risk of an event and limit risk are determined. • The selection of technical and/or non-technical measures is subject to a review of the content and the system, and the decision regarding a solution is then made.

• The number of applicable measures is limited, and therefore it may not be possible to immediately find a measure with an acceptable risk for a preliminary determination of the unwelcome event. • Implementation of the selected solution can result in the occurrence of a new unwelcome event. • In the above cases, a more concrete, new determination of the unwelcome event and/or the unit under review, or the state of the unit under review, and another attempt at deciding upon measures may lead to the desired result, although this may have to be repeated several times before it is successful.

In the case of complex event sequences, several unwelcome events may become apparent which have to be tackled by the respective set of measures.

In accordance with the sequence scheme, the unit under review and its state have to be determined first. This determination includes information on, e.g.,

• product type, dimension, product parts/elements distinguished according to functional or construction aspects, if applicable; • intended use;

• work system or field of application; • target group; • supply energy, transformed in the product, transmitted, distributed, output; • other parameters essential to safety assessment according to type and size of the product; • known or assumed effects on the product or its parts (e.g. due to transport, assembly, conditions at the assembly site, operation, maintenance); • weight, centre of gravity; • materials, consumables; • operating states (e.g. start-up, standstill, test run, normal operation); • condition (new, condition after a period in storage/shutdown, after repair, in case of modified operating conditions and/or other significant changes); and • known or suspected effects on humans. The next step is the identification of unwelcome events. They are source conditions of processes and states, or processes and states themselves. They can be the effects of processes and states which can cause harm to people or property. An unwelcome event can be a single event or part of a sequence of events.

One should look for unwelcome events in sequences of processes and functions, in work activities and organizational procedures, or in the work environment.

Care has to be taken that the respective interfaces are included in the considerations. Deviations and time-dependent changes in regard to the planned sequences and conditions have to be taken into account as well.

The risk of an unwanted event results from the probability statement which takes into account both

• the expected frequency of occurrence of the event; and • the anticipated extent of harm of the event.

The expected frequency of occurrence of an event leading to harm is determined by, e.g.,

• the probability of the occurrence itself;

• the duration and frequency of exposure of people (or of objects) in the danger zone, e.g.

-extremely seldom (e.g. during repair), -seldom (e.g. during installation, maintenance and inspection), -frequently, and -very frequently (e.g. constant intervention during every work cycle);

• the influence of users or third parties on the risk of an event.

The extent of harm is determined by, e.g.,

• the type of harm (harm to people and/or property);

• the severity of the harm (slight/severe/fatal injury of persons, or corresponding damage to property); and • number of people or objects affected.

In principle, the safety requirements depend on the ratio of the risk of an event to the limit risk. Criteria for determining the limit risk are, e.g.,

• personal and social acceptance of hazards;

• people possibly affected (e.g. layman, trained person, specialized worker); • participation of those affected in the process; and • possibilities of averting hazards.

The safety of various technical equipment with comparable risk can, for instance, be achieved

• primarily by technical measures, in some cases; and • mainly by non-technical measures, in other cases. This means that several acceptable solutions with varying proportions of technical and non-technical measures may be found for a specific risk. In this context, the responsibility of those involved should be taken into consideration.

Technical measures are developed on the basis of e.g. the following principles:

• avoiding hazardous interfaces (e.g. risk of crushing, shearing); hazard sources (e.g. radiation sources, flying parts, hazardous states and actions as well as inappropriate processes); • limiting hazardous energy (e.g. by rupture disks, temperature controllers, safety valves, rated break points); • using suitable construction and other materials (e.g. solid, sufficiently resistant against corrosion and ageing, glare-free, break-proof, non-toxic, non-inflammable, non-combustible, non-sliding); • designing equipment in accordance with its function, material, load, and ergonomics principles; • using fail-safe control devices employing technical means;

• employing technical means of informing (e.g. danger signal); • protective equipment for separating, attaching, rejecting, catching, etc.;

• suction equipment, exhaust hoods, when needed; • protection and emergency rooms; and • couplings or locks.

Technical measures refer to, e.g.,

• physical, chemical or biological processes;

• energy, material and information flow in connection with the applied processes; • properties of materials and changes in the properties; and • function and design of technical products, parts and connections.

The iterative (repeated) risk reduction process can be concluded after achieving adequate risk reduction and, if applicable, a favourable outcome of risk comparison.

Adequate risk reduction can be considered to have been achieved when one is able to answer each of the following questions positively:

• Have all operating conditions and all intervention procedures been taken into account?

• Have hazards been eliminated or their risks been reduced to the lowest practicable level? • Is it certain that the measures undertaken do not generate new hazards?

• Are the users sufficiently informed and warned about the residual risks?

• Is it certain that the operator's working conditions are not jeopardized by the protective measures taken? • Are the protective measures compatible with each other? • Has sufficient consideration been given to the consequences that can arise from the use of a machine designed for professional/industrial use when it is used in a non-professional/non-industrial context? • Is it certain that the measures undertaken do not excessively reduce the ability of the machine to perform its intended function?

There are still many potential risks connected with hazardous substances about which more information is needed. Because the knowledge about the relation between their dose and mode of action is not sufficient for controlling such risks, more research is needed. The following list highlights the themes of the numerous questions related to such risks:

• potentially harmful organisms; • toxicants, carcinogens;

• pesticides, pollutants, poisonous substances; • genetically engineered substances;

• relation between chemical and structural properties and toxicity;

• chemical structure and chemical properties and the relation to reactivity and reaction possibilities of organic compounds to metabolic reaction and living systems; • modes of action, genotoxicity, carcinogenicity, effects on humans/animals; • potentially harmful organisms in feedstuffs and animal faeces; • viruses and pathogens; • bacteria in feedstuffs and faeces; • parasites in feedstuffs and animal faeces;

• pests in stored feedstuffs;

• probiotics as feed additives; and • preservatives in feedstuffs. 

Violent actions damaging society, property or people have increased, and they seem to spread both internationally as well as within countries. These new risks are difficult to predict and manage, as the very strategy of the actors is to create unexpected chaotic events. Certain possibilities to predict the potential types of hazards do exist, and comprehensive predictive analyses have been done (Meyerson, Reaser 2002) . New methodologies are needed to predict the risk of terrorist actions, and also the strategies for risk management need to be developed. Due to the numerous background factors, the preparedness of societies against these risks needs to be strengthened. Table 4 .3 lists important societal systems which are vulnerable to acts of terrorism.

The situation in the developing countries needs to be tackled with specific methods. One has to answer the following questions:

• What specific examples of prevention instruments can be offered?

• What are the prerequisites for success?

• How can industrialized countries assist the developing countries in carrying out preventive actions? • How should priorities be set according to the available resources?

One possibility is to start a first-step programme, the goal of which is higher productivity and better workplaces. It can be carried out by improving

• Storage and handling of materials:

-provide storage racks for tools, materials, etc.; -put stores, racks etc. on wheels, whenever possible; -use carts, conveyers or other aids when moving heavy loads; -use jigs, clamps or other fixtures to hold items in place.

• Work sites:

-keep the working area clear of everything that is not in frequent use.

• Machine safety:

-install proper guards to dangerous tools/machines; -use safety devices; -maintain machines properly.

• Control of hazardous substances:

-substitute hazardous chemicals with less hazardous substances; -make sure that all organic solvents, paints, glues, etc., are kept in covered containers; -install or improve local exhaust ventilation; -provide adequate protective goggles, face shields, earplugs, safety footwear, gloves, etc.; -instruct and train workers; -make sure that workers wash their hands before eating and drinking, and change their clothes before going home.

• Lighting:

-make sure that lighting is adequate.

• Social and sanitary facilities:

-provide a supply of cool, safe drinking water; -have the sanitary facilities cleaned regularly; -provide a hygienic place for meals; -provide storage for clothing or other belongings; -provide first aid equipment and train a qualified first-aider.

• Premises:

-increase natural ventilation by having more roof and wall openings, windows or open doorways; -move sources of heat, noise, fumes, arc welding, etc., out of the workshop, or install exhaust ventilation, noise barriers, or other solutions; -provide fire extinguishers and train the workers to use them; -clear passageways, provide signs and markings.

• Work organization:

-keep the workers alert and reduce fatigue through frequent changes in tasks, opportunities to change work postures, short breaks, etc.; -have buffer stocks of materials to keep work flow constant; -use quality circles to improve productivity and quality.

Risk Combination of the probability of an event and its consequences.

The term "risk" is generally used only when there is at least a possibility of negative consequences.

In some situation, risk arises from the possibility of deviation from the expected outcome or event.

Outcome of an event or a situation, expressed in quality and in quantity. It may result in a loss or in an injury or may be linked to it. The result can be a disadvantage or a gain. In this case the event or the situation is the source.

In connection with every analysis it has to be checked whether the cause is given empirically, or follows a set pattern, and whether there is scientific agreement regarding these circumstances.

Note 1 There can be more than one consequence from one event.

Note 2 Consequences can range from positive to negative.

The consequences are always negative from the viewpoint of safety.

Extent to which an event is likely to occur.

Note 1 ISO 3534-1:1993 gives the mathematical definition of probability as "a real number in the interval 0 to 1 attached to a random event. It can be related to a long-run relative frequency of occurrence or to a degree of belief that an event will occur. For a high degree of belief the probability is near 1".

Note 2 Frequency rather than probability may be used in describing risk.

Degrees of belief about probability can be chosen as classes or ranks such as: rare/unlikely/moderate/likely/almost certain, or incredible/improbable/ remote/occasional/probable/frequent.

Remark: Informal language often confuses frequency and probability. This can lead to wrong conclusions in safety technology.

Probability is the degree of coincidence of the time frequency of coincidental realization of a fact from a certain possibility.

Coincidence is an event which basically can happen, may be cause-related, but does not occur necessarily or following a set pattern. It may also not occur (yes-or-no-alternative).

Data for probability of occurring with specific kinds of occurrence and weight of consequences can be:

in a statistical sense: empirical, retrospective, real in a prognostic sense: speculative, prospective, probabilistic

Occurrence of a particular set of circumstances regarding place and time. An event can be the source of certain consequences (empirically to be expected with certain regularity).

The event can be certain or uncertain.

The event can be a single occurrence or a series of occurrences.

The probability associated with the event can be estimated for a given period of time.

Task range by which the significance of risk is assessed.

Note 1 Risk criteria can include associated costs and benefits, legal and statutory requirements, socio-economic and environmental aspects, the concerns of stakeholders, priorities and other inputs to the assessment.

The way in which a stakeholder views a risk based on a set of values or concerns.

Note 1 Risk perception depends on the stakeholder's needs, issues and knowledge.

Note 2 Risk perception can differ from objective data.

Exchange or sharing of information about risk between the decision-makers and other stakeholders.

Overall process of risk analysis and risk evaluation.

Systematic use of information to identify sources and to estimate the risk.

Note 1 Risk analysis provides a basis for risk evaluation, risk treatment, and risk acceptance.

Note 2 Information can include historical data, theoretical analyses, informal opinions, and the concerns of stakeholders.

Process used to assign figures, values to the probability and consequences of a risk.

Note 1 Risk estimation can consider cost, benefits, the concerns of stakeholders, and other variables, as appropriate for risk evaluation.

Process of comparing the estimated risk against given risk criteria to determine the significance of a risk.

Process of selection and implementation of measures to modify risk.

Note 1 Risk treatment measures can include avoiding, optimizing, transferring or retaining risk.

Actions implementing risk management decisions.

Note 1 Risk control may involve monitoring, re-evaluation, and compliance with decisions.

Process, related to a risk, to minimize the negative and to maximize the positive consequences (and their respective probabilities).

Actions taken to lessen the probability, negative consequences or both, associated with a risk.

Limitation of any negative consequences of a particular event.

Decision not to become involved in, or action to withdraw from, a risk situation.

Sharing with another party the burden of loss or benefit of gain, for a risk.

Note 1 Legal or statutory requirements can limit, prohibit or mandate the transfer of a certain risk. Note 2 Risk transfer can be carried out through insurance or other agreements. Note 3

Risk transfer can create new risks or modify existing ones.

Note 4 Relocation of the source is not risk transfer.

Acceptance of the burden of loss, or benefit of gain, from a particular risk.

Note 1 Risk retention includes the acceptance of risks that have not been identified. Note 2

Risk retention does not include means involving insurance, or transfer in other ways.

This includes risk assessment, risk treatment, risk acceptance and risk communication.

Risk assessment is risk analysis, with identification of sources and risk estimation, and risk evaluation.

Risk treatment includes avoiding, optimizing, transferring and retaining risk.

→ Risk acceptance → Risk communication

Harm Physical injury or damage to the health of people or damage to property or the environment [ISO/IEC Guide 51].

Note 1 Harm includes any disadvantage which is causally related to the infringement of the object of legal protection brought about by the harmful event. Note 2

In the individual safety-relevant definitions, harm to people, property and the environment may be included separately, in combination, or it may be excluded. This has to be stated in the respective scope.

Potential source of harm [ISO/IEC Guide 51].

The term "hazard" can be supplemented to define its origin or the nature of the possible harm, e.g., hazard of electric shock, crushing, cutting, dangerous substances, fire, drowning.

In every-day informal language, there is insufficient differentiation between source of harm, hazardous situation, hazardous event and risk.

Circumstance in which people, property or the environment are exposed to one or more hazards [ISO/IEC Guide 51].

Note 1 Circumstance can last for a shorter or longer period of time.

Event that can cause harm [DIN EN 1050] . 1

The hazardous event can be preceded by a latent hazardous situation or by a critical event.

Combination of the probability of occurrence of harm and the severity of that harm [ISO/IEC Guide 51].

Note 1 In many cases, only a uniform extent of harm (e.g. leading to death) is taken into account, or the occurrence of harm may be independent of the extent of harm, as in a lottery game. In these cases, it is easier to make a probability statement; risk assessment by risk comparison [DIN EN 1050] thus becomes much simpler.

Note 2 Risks can be grouped in relation to different variables, e.g. to all people or only those affected by the incident, to different periods of time, or to performance.

The probabilistic expectation value of the extent of harm is suitable for combining the two probability variables.

Note 4 Risks which arise as a consequence of continuous emission, e.g. noise, vibration, pollutants, are affected by the duration and level of exposure of those affected.

Risk which is accepted in a given context based on the current values of society [ISO/IEC Guide 51].

The acceptable risk has to be taken into account in this context, too. Note 2 Safety-relevant definitions are oriented to the maximum tolerable risk. This is also referred to as limit risk. Note 3

Tolerability is also based on the assumption that the intended use in addition to a reasonably predictable misuse of the products, processes and services, is complied with.

Freedom from unacceptable risk [ISO/IEC Guide 51].

Note 1 Safety is indivisible. It cannot be split into classes or levels.

Note 2 Safety is achieved by risk reduction, so that the residual risk in no case exceeds the maximum tolerable risk.

Existence of an unacceptable risk.

Note 1 Safety and danger exclude one another -a technical product, process or service cannot be safe and dangerous at the same time.

Means used to reduce risk [ISO/IEC Guide 51].

Note 1 Protective measures at the product level have priority over protective measures at the workplace level.

Preventive measure Means assumed, but not proven, to reduce risk.

Risk remaining after safety measures have been taken [DIN EN 1050] .

Note 1 Residual risk may be related to the use of technical products, processes and services.

Systematic use of available information to identify hazards and to estimate their risks [ISO/IEC Guide 51].

Determination of connected risk elements of all hazards as a basis for risk assessment.

Decision based on the analysis of whether the tolerable risk has been exceeded [ISO/IEC Guide 51].

Overall process of risk analysis and risk evaluation [ISO/IEC Guide 51].

Use of a product, process or service in accordance with information provided by the supplier [ISO/IEC Guide 51].

Note 1 Information provided by the supplier also includes descriptions issued for advertising purposes.

Use of a product, process or service in a way not intended by the supplier, but which may result from readily predictable human behaviour [ISO/IEC Guide 51].

Safety-related formulation of contents of a normative document in the form of a declaration, instructions, recommendations or requirements [compare EN 45020, safety related].

The information set down in technical rules is normally restricted to certain technical relations and situations; in this context, it is presumed that the general safety-relevant principles are followed.

A procedure with the aim to reduce risk of a (technical) product, process or service according to the following steps serves to reach the safety goals in the design stage:

• safety-related layout;

• protective measures;

• safety-related information for users.

Function inevitable to maintain safety.

A function which, in case of failure, allows the tolerable risk to be immediately exceeded.

Depending on the situation, it is possible to use one method or a combination of several methods.

Intuitive hazard detection Spontaneous, uncritical listing of possible hazards as a result of brainstorming by experts. Group work which is as creative as possible. Writing ideas down (on a flip chart) first, then evaluating them.

Technical documentation (instructions, requirements) is available for many industrial plant and work processes, describing the hazards and safety measures. This documentation has to be obtained before continuing with the risk analysis.

The deviations between the set point and the actual situation of individual components are examined. Information on the probability of failure of these elements may be found in technical literature.

Examining the safety aspects in unusual situations (emergency, repair, starting and stopping) when plans are made to modify the plant or processes.

A systematic check of the processes and plant parts for effects in normal operation and in case of set point deviations, using selected question words (and -or -not -too much -too little?). This is used in particular for measurement, control units, programming of computer controls, robots.

All possible causes and combinations of causes are identified for an unwanted operating state or an event, and represented in the graphic format of a tree. The probability of occurrence of an event can be estimated from the context. The fault tree analysis can also be used retrospectively to clarify the causes of events.

Additional methods may be:

Human reliability analysis A frequency analysis technique which deals with the behaviour of human beings affecting the performance of the system, and estimates the influence of human error on reliability.

A hazard identification and frequency analysis technique which can be used at an early stage in the design phase to identify and critically evaluate hazards.

Operating safety block program A frequency analysis technique which utilizes a model of the system and its redundancies to evaluate the operating safety of the entire system.

Classifying risks into categories, to establish the main risk groups.

All typical hazardous substances and/or possible accident sources which have to be taken into account are listed. The checklist may be used to evaluate the conformity with codes and standards.

This method is used to estimate whether coincidental failures of an entire series of different parts or modules within a system are possible and what the probable effects would be.

Estimate the influence of an event on humans, property or the environment. Simplified analytical approaches, as well as complex computer models can be used.

A large circle of experts is questioned in several steps; the result of the previous step together with additional information is communicated to all participants. During the third or fourth step the anonymous questioning concentrates on aspects on which no agreement is reached so far. Basically this technique is used for making predictions, but is also used for the development of new ideas. This method is particularly efficient due to its limitation to experts.

A hazard identification and evaluation technique used to establish a ranking of the different system options and to identify the less hazardous options.

A frequency analysis technique in which a model of the system is used to evaluate variations of the input conditions and assumptions.

A means to estimate and list risk groups; reviews risk pairs and evaluates only one risk pair at a time.

Overview of data from the past A technique used to identify possible problem areas; can also be used for frequency analysis, based on accident and operation safety data, etc.

A method to identify latent risks which can cause unforeseeable incidents.

CSSR differs from the other methods in that it is not conducted by a team, and can be conducted by a single person. The overview points out essential safety and health requirements related to a machine and simultaneously to all relevant (national, European, international) standards. This information ensures that the design of the machine complies with the issued "state of the art" for that particular type of machine.

The "what-if" method is an inductive procedure. The design and operation of the machine in question are examined for fairly simple applications. At every step "what-if" questions are asked and answered to evaluate the effect of a failure of the machine elements or of process faults in view of the hazards caused by the machine. For more complex applications, the "what-if" method is most useful with the aid of a "checklist" and the corresponding work division to allocate specific features of the process to persons who have the greatest experience and practice in evaluating the respective feature. The operator's behaviour and professional knowledge are assessed. The suitability of the equipment and design of the machine, its control unit and protective devices are evaluated. The influence of the materials processed is examined, and the operating and maintenance records are checked. The checklist evaluation of the machine generally precedes the more detailed methods described below.

FMEA is an inductive method for evaluating the frequency and consequences of component failure. When operating procedures or operator errors are investigated, then other methods may be more suitable. FMEA can be more time-consuming than the fault tree analysis, because every mode of failure is considered for every component. Some failures have a very low probability of occurrence. If these failures are not analyzed in depth this decision should be recorded in the documentation. The method is specified in IEC 812 "Analysis techniques for system reliability -Procedure for failure mode and effects analysis (FMEA)".

In this inductive method, the test procedures are based on two criteria: technology and complexity of the control system. Mainly, the following methods are applicable:

• Practical tests of the actual circuit and fault simulation on certain components, particularly in suspected areas of performance identified during the theoretical check and analysis. • Simulation of control behaviour (e.g. by means of hardware and/or software models).

Whenever complex safety-related parts of control systems are tested, it may be necessary to divide the system into several functional sub-systems, and to exclusively submit the interface to fault simulation tests. This technique can also be applied to other parts of machinery.

MOSAR is a complete approach in 10 steps. The system to be analyzed (machinery, process, installation, etc.) is examined as a number of sub-systems which interact. A table is used to identify hazards and hazardous situations and events. The adequacy of the safety measures is studied with a second table, and a third table is used to look at their interdependency.

A study, using known tools (e.g. FMEA) underlines the possible dangerous failures. This leads to the elaboration of accident scenarios. By consensus, the scenarios are sorted in a severity table. A further table, again by consensus, links the severity with the targets of the safety measures, and specifies the performance levels of the technical and organizational measures.

The safety measures are then incorporated into the logic trees and the residual risks are analyzed via an acceptability table defined by consensus. ILO (1987) 1994, 1995, 1996, 1997, 1998, 1999 

The risks to health at work are numerous and originate from several sources. Their origins vary greatly and they cause vast numbers of diseases, injuries and other adverse conditions, such as symptoms of overexertion or overload. Traditional occupational health risk factors and their approximate numbers are given in Table 4 .4.

The exposure of workers to hazards or other adverse conditions of work may lead to health problems, manifested in the workers' physical health, psysical workload, psychological disturbances or social aspects of life.

Workers may be exposed to various factors alone or in different types of combinations, which may or may not show interaction. The assessment of interacting risk factors is complex and may lead to substantial differences in the final risk estimates when compared with estimates of solitary factors.

Examples of interaction between different risk factors in the work environment are given in Table 4 .5. 

The WHO estimate of the total number of occupational diseases among the 3 billion workers of the world is 160 million a year. This is likely to be an under-estimate due to the lack of diagnostic services, limited legislative coverage of both workers and diseases, and variation in diagnostic criteria between different parts of the world. The mortality from occupational diseases is substantial, comparable with other major diseases of the world population such as malaria or tuberculosis. The recent ILO estimate discloses 2.4 million deaths a year from work-related causes in the world including deaths from accidents, dangerous substances, and occupational diseases. Eightyfive percent (85%) of these deaths take place in developing countries, where the diagnostic services, social security to families and compensation to workers are less developed. Although the risk is decreasing in the industrialized world, the trend is increasing in the rapidly industrializing and transitory countries. A single hazard alone, such as asbestos exposure, is calculated to cause 100,000 cancers a year with a fatal outcome in less than two years after diagnosis (Takala 2005).

The incidence rates of occupational diseases in well registered industrialized countries are at the level of 3-5 cases/10,000 active employees/year, i.e., the incidence levels are comparable with major public health problems, such as cardiovascular diseases, respiratory disorders, etc. In the industrialized countries, the rate of morbidity from traditional occupational diseases, such as chemical poisonings, is declining, while musculoskeletal and allergic diseases are on the increase. About 200 biological factors that are hazardous to workers' health have been identified in various work environments. Some of the new diseases recognized are blood-borne infections, such as hepatitis C and HIV, and exotic bacterial or viral infections transmitted by increasing mobility, international travelling and migration of working people. Also some hospital infections and, e.g., drug-resistant tuberculosis, are being contracted increasingly by health care personnel. In the developing countries the morbidity picture of occupational diseases is much less clear for several reasons: low recognition rates, rotation and turnover of workers, shorter life expectancy which hides morbidity with a long latency period, and the work-relatedness of several common epidemic diseases, such as malaria and HIV/AIDS (Rantanen 2003).

The estimation of so-called work-related diseases is even more difficult than that of occupational diseases. They may be about 10-fold more prevalent than the definite occupational diseases. Several studies suggest that Siegfried Radandt, Jorma Rantanen and Ortwin Renn work-related allergies, musculoskeletal disorders and stress disorders are showing a growing trend at the moment. The prevention of work-related diseases is important in view of maintaining work ability and reducing economic loss from absenteeism and premature retirement. The proportion of work-relatedness out of the total morbidity figures has been estimated and found surprisingly high (Nurminen and Karjalainen 2001 , WHO 2002 ) (see Table 4 .6).

The public health impact of work-related diseases is great, due to their high prevalence in the population. Musculoskeletal disorders are among the three most common chronic diseases in every country, which implies that the attribution of work is very high. Similarly, cardiovascular diseases in most industrialized countries contribute to 50% of the total mortality. Even a small attributable fraction of work-relatedness implies high rates of morbidity and mortality related to work.

The concept of disease is in general not a simple one. When discussing morbidity one has to recognize three different concepts:

1. Illness = an individual's perception of a health problem resulting from either external or internal causes. 2. Disease = an adverse health condition diagnosed by a doctor or other health professional. 3. Sickness = a socially recognized disease which is related to, for example, social security actions or prescription of sick leave, etc.

When dealing with occupational and work-related morbidity, one may need to consider any of the above three aspects of morbidity. A recognized occupational disease, however, belongs to Group 3, i.e. it is a sickness defined by legal criteria. Medical evidence is required to show that the condition meets the criteria of an occupational disease before recognition can be made. There are dozens of definitions for occupational disease. The content of the concept varies, depending on the context: a) The medical concept of occupational disease is based on a biomedical or other health-related etiological relationship between work and health, and is used in occupational health practice and clinical occupational medicine. b) The legal concept of occupational disease defines the disease or conditions which are legally recognized as conditions caused by work, and which lead to liabilities for recognition, compensation and often also prevention. The legal concept of occupational disease has a different background in different countries, often declared in the form of an official list of occupational diseases.

There is universal discrepancy between the legal and medical concept, so that in nearly all countries the official list of recognized occupational diseases is shorter than the medically established list. This automatically implies that a substantial proportion of medically established occupational diseases remain unrecognized, unregistered, and consequently also uncompensated. The definition of occupational disease, as used in this chapter, summarizes various statements generated during the history of occupational medicine:

An occupational disease is any disease contracted as a result of exposures at work or other conditions of work.

The general criteria for the diagnosis and recognition of an occupational disease are derived from the core statements of various definitions:

1. Evidence on exposure(s) or condition(s) in work or the work environment, which on the basis of scientific knowledge is (are) able to generate disease or some other adverse health condition. 2. Evidence of symptoms and clinical findings which on the basis of scientific knowledge can be associated with the exposure(s) or condition(s) in concern. 3. Exclusion of non-occupational factors or conditions as a main cause of the disease or adverse health condition.

Point 3 often creates problems, as several occupationally generated clinical conditions can be caused also by non-occupational factors. On the other hand, several factors from different sources and environments are involved in virtually every disease. Therefore the wordings "main cause" or "principal cause" are used. The practical solution in many countries is that the attribution of work needs to be more than 50%. Usually the necessary generalizeable scientific evidence is obtained from epidemiological studies, but also other types of evidence, e.g. well documented clinical experience combined with information on working conditions may be acceptable.

In some countries, like Finland, any disease of the worker which meets the above criteria can be recognized as an occupational disease. In most other countries, however, there are official lists of occupational diseases which determine the conditions and criteria on which the disease is considered to be of occupational origin.

In 1985 WHO launched a new concept: Work-related disease (WHO 1985) . The concept is wider than that of an occupational disease. It includes: a) Diseases in which the work or working conditions constitute the principal causal factor. b) Diseases for which the occupational factor may be one of several causal agents, or the occupational factor may trigger, aggravate or worsen the disease. c) Diseases for which the risk may be increased by work or work-determined lifestyles.

The diseases in category (a) are typically recognized as legally determined occupational diseases. Categories (b) and (c) are important regarding the morbidity of working populations, and they are often considered as important targets for prevention. In general, categories (b) and (c) cover greater numbers of people, as the diseases in question are often common noncommunicable diseases of the population, such as cardiovascular diseases, musculoskeletal disorders, and allergies and, to a growing extent, stressrelated disorders (see Table 4 .6).

The concept of work-related disease is very important from the viewpoint of occupational health risk assessment and the use of its results for preventive purposes and for promoting health and safety at work. This is because preventive actions in occupational health practice cannot be limited only to legally recognized morbidity.

The lists of occupational diseases contain great numbers of agents that show evidence on occupational morbidity. According to the ILO Recommendation R194 (2002): List of Occupational Diseases, the occupational diseases are divided into four main categories:

1. Diseases resulting from single causes following the categories listed in Table 4 .4. The most common categories are physical factors, chemical agents, biological factors and physical work, including repetitive tasks, poor ergonomic conditions, and static and dynamic work. 2. Diseases of the various organs: respiratory system, nervous system, sensory organs, internal organs, particularly liver and kidneys, musculoskeletal system, and the skin. 3. Occupational cancers. 4. Diseases caused by other conditions of work.

Research on risk perception shows differences in how different types of risks are viewed. Instant, visible, dramatic risk events, particularly ones that cause numerous fatalities or severe visible injuries in a single event generally arouse much attention, and are given high priority. On the other hand, even great numbers of smaller events, such as fatal accidents of single workers, arouse less attention in both the media and among regulators, even though the total number of single fatal accidents in a year may exceed the number of fatalities in major events by several orders of magnitude. Occupational diseases, with the exception of a few acute cases, are silent, develop slowly, and concern only one or a few individuals at a time. Furthermore, the diseases take months or years to develop, in extreme cases even decades, after the exposure or as a consequence of accumulation of exposure during several years. As occupational health problems are difficult to detect and seriously under-diagnosed and under-reported, they tend to be given less priority than accidents. The perception of occupational disease risk remains low in spite of their severity and relatively high incidence. Particularly in industrialized countries, the extent of occupational health problems is substantially greater than that of occupational accidents. On a global scale, the estimated number of fatalities due to occupational accidents is 375,000 and the respective estimate for fatalities due to work-related diseases is 1.8 million a year, giving a fatal accident/fatal disease ratio of 1 to 5. The corresponding ratio in the EU-15 is 1 to 20 (Takala 2005).

The risk distribution of ODs is principally determined by the nature of the work in question and the characteristics of the work environment. There is great variation in the risk of ODs between the lowest and highest risk occupations. In the Finnish workforce, the risk between the highest risk and the lowest risk occupations varies by a factor of 30. The highest risk occupations carry a risk which is 4-10 times higher than the average for all occupations.

The risk of an occupational disease can be estimated on the basis of epidemiological studies, if they do exist in the case of the condition in question. On the other hand, various types of economic activity, work and occupations carry different types of risks, and each activity may have its own risk profile. By examining the available epidemiological evidence, we can recognize high-risk occupations and characterize the typical risks connected with them ( Figure 4 .12, Table 4.7).

As an example, the risk of occupational asthma, dermatosis or musculoskeletal disorders is common in several occupations, but not in all. There may be huge differences in risks between different occupations. The 10 occupations carrying the highest risk for occupational asthma, occupational skin diseases and work-related tenosynovitis, in 1986-1991, are shown in Table 4 .8. Assessment of the risk of occupational diseases has an impact on research priorities. Table 4 .9 shows the priorities for research in four countries. The similarity of the priorities is striking, revealing that the problems related to the risks of occupational diseases are universal. 

The diagnosis of occupational diseases is important for the treatment of the disease, and for prevention, registration and compensation. The diagnosis is based on information obtained from: a) Data on the work and the work environment usually provided by the employer, occupational health services, occupational safety committee, or expert bodies carrying out hygienic and other services for the workplace. b) Information on the health examination of individual workers. The authorities in many countries have stipulated legal obligations for high-risk sectors to follow up the workers' health and promote early detection of changes in their health. Occupational health services keep records on examinations. c) Workers with special symptoms (for example, asthmatic reactions) are taken into the diagnostic process as early as possible.

Epidemiological evidence is a critical prerequisite for recognizing causal relationship between work and disease. Epidemiology is dependent on three basic sources of information on work and the work environment: (a) exposure assessment that helps to define the "dose" of risk factor at work, (b) the outcome assumed to occur as a biological (or psychological) response to the exposures involved, and (c) time, which has a complex role in various aspects of epidemiology. All these sources are affected by the current dynamics of work life which has major impact on epidemiological research and its results. 

Exposure assessment is the critical initial step in risk assessment. As discussed in this chapter, accurate exposure assessment will become more difficult and cumbersome than before in spite of remarkable achievements in measurement, analysis and monitoring methods in occupational hygiene, toxicology and ergonomics. Great variations in working hours and individu-alization of exposures, growing fragmentation and mobility increase the uncertainties, which are multiplied. Structural uncertainty, measurement uncertainty, modelling uncertainty, input data uncertainty and natural uncertainty amplify each other. As a rule, variation in any direction in exposure assessment tends to lead to underestimation of risk, and this has severe consequences to health. Personal monitoring of exposures, considering variations in individual doses, and monitoring internal doses using biological monitoring methods help in the control of such variation.

A monofactorial exposure situation in the past was ideal in the assessment because of its manageability. It also occurs usually as a constant determinant for long periods of time and can be regularly and continuously measured and monitored. This is very seldom the case today, and exposure assessment in modern work life is affected by discontinuities of the enterprise, of technologies and production methods, and turnover of the workforce, as well as the growing mobility and internationalization of both work and workers. Company files that were earlier an important source of exposure and health data no longer necessarily fulfil that function. In addition, the standard 8-h time-weighted average for exposure assessment can no longer be taken as a standard, as working hours are becoming extremely heterogeneous.

Assessment of accurate exposure is thus more and more complex and cumbersome, and new strategies and methods for the quantification of exposure are needed. Three challenges in particular can be recognized:

a) The challenge arising from numerous discontinuities, fragmentation and changes in the company, employment and technology. Although in the past company data were collected from all sources that were available, collective workroom measurements were the most valuable source of data. Due to the high mobility of workers and variation in the work tasks, personal exposure monitoring is needed that follows the worker wherever he or she works. Special smart cards for recording all personal exposures over years have been proposed, but so far no system-wide action has been possible. In radiation protection, however, such a personal monitoring system has long been a routine procedure. b) The complex nature of exposures where dozens of different factors may be involved (such as those in indoor air problems) and acting in combinations. Table 4 .4 gives a list of exposing factors in modern work life, many of which are difficult to monitor. c) New, rapidly spreading and often unexpected exposures that are not well characterized. Often their mechanisms of action are not known, or the fast spread of problems calls for urgent action, as in the case of Bovine Spongiform Encephalopathy (BSE) in the 1990s, SARS outbreak in 2003, and in the new epidemics of psychological stress or musculoskeletal disorders in modern manufacturing.

The causes of occupational diseases are grouped into several categories by the type of factor (see Table 4 .4). A typical grouping is the one used in ILO Recommendation No. 194 . The lists of occupational diseases contain diseases caused by one single factor only, but also diseases which may have been caused by multifactorial exposures.

Exposure assessment is a crucial step in the overall risk assessment. The growing complexity of exposure situations has led to the development of new methods for assessing such complex exposure situations. These methods are based on construction of model matrices for jobs which have been studied thoroughly for their typical exposures.

The exposure profiles are illustrated in Job Exposure Matrices (JEM) which are available for dozens of occupations (Heikkilä et al. 2005 , Guo 2005 . Several factors can cause occupational diseases. The JEM is a tool used to convert information on job titles into information on occupational risk factors. JEM-based analysis is economical, systematic, and often the only reasonable choice in large retrospective studies in which exposure assessment at the individual level is not feasible. But the matrices can also be used in the practical work for getting information on typical exposure profiles of various jobs.

The Finnish national job-exposure matrix (FINJEM) is the first and so far the only general JEM that is able to give a quantitative estimation of cumulative exposure. For example, FINJEM estimates were used for exposure profiling on 43 chemical exposures and several other cancer-risk factors for 393 occupational categories. The JEM analysis has been further developed into Task Specific Exposure matrices charting the exposure panorama of various tasks (Benke et al. 2000 (Benke et al. , 2001 .

As the previous mono-causal, mono-mechanism, mono-outcome setting has shifted in the direction of multicausality, multiple mechanisms and multioutcomes, the assessment of risks has become more complex. Some outcomes, as mentioned above, are difficult to define and measure with objective methods and some of them may be difficult to recognize by exposed groups themselves, or even by experts and researchers.

For example, the objective measurement of stress reactions is still imprecise in spite of improvements in the analysis of some indicator hormones, such as adrenalin, noradrenalin, cortisol, prolactin, or in physical measurements, such as galvanic skin resistance and heart rate variability. Questionnaires monitoring perceived stress symptoms are still the most common method for measuring stress outcomes.

Thanks to well organized registries, particularly in Germany and the Nordic countries, data on many of the relevant outcomes of exposure, such as cancer, pneumoconiosis, reproductive health disturbances and cardiovascular diseases can be accumulated, and long-term follow-up of outcomes at the group level is therefore possible. On the other hand, several common diseases, such as cardiovascular diseases, may have a work-related aetiology, but it may be difficult to show at individual level. The long-term data show that due to changes in the structure of economies, types of employment, occupational structures and conditions of work, many of the traditional occupational diseases, such as pneumoconiosis and acute intoxications have almost disappeared.

Several new outcomes have appeared, however, such as symptoms of physical or psychological overload, psychological stress, problems of adapting to a high pace of work, and uncertainty related to rapid organizational changes and risk of unemployment. In addition, age-related and work-related diseases among the ageing workforce are on the increase (Kivimäki et al. 2006 , Ilmarinen 2006 .

These new outcomes may have a somatic, psychosomatic or psychosocial phenotype, and they often appear in the form of symptoms or groups of symptoms instead of well-defined diagnoses. Practising physicians or clinics are not able to set an ICD (International statistical classification of diseases and health-related conditions)-coded diagnosis for them. In spite of their diffuse nature, they are still problems for both the worker and the enterprise, and their consequences may be seen as sickness absenteeism, premature retirement, loss of job satisfaction, or lowered productivity. Thus, they may have even a greater impact on the quality of work life and the economy than on clinical health.

Many such outcomes have been investigated by using questionnaire surveys among either representative samples of the whole workforce or by focusing the survey on a specific sector or occupational group. The combination of data from the surveys of "exposing factors", such as organizational changes, with questionnaire surveys of "outcomes", such as sickness absenteeism, provides epidemiological information on the association between the new exposures and the new outcomes. There are, however, major problems in both the accurate measurement of the exposures and outcomes, and also, the information available on the mechanisms of action is very scarce.

Epidemiology has expanded the focus of our observations from crosssectional descriptions to longitudinal perspectives, by focussing attention on the occurrence of diseases and finding associations between exposure and morbidity. Such an extension of vision is both horizontal and vertical, looking at the causes of diseases.

Time is not only a temporal parameter in epidemiology, but has also been used for the quantification of exposure, measurement of latencies, and the detection of acceleration or slowing of the course of biological processes. As the time dimension in epidemiology is very important, the changes in temporal parameters of the new work life also affect the methods of epidemiological research. The time dimension is affected in several ways. First, the fragmentation and discontinuities of employment contracts, as described above, break the accumulation of exposure time into smaller fragments, and continuities are thus difficult to maintain. Collecting data on cumulative exposures over time becomes more difficult.

The time needed for exposure factors to cause an effect becomes more complex, as the discontinuities typical to modern work life allow time for biological repair and elimination processes, thus diluting the risk which would get manifested from continuous exposure. The dosage patterns become more pulse-type, rather than being continuous, stable level exposures. This may affect the multi-staged mechanisms of action in several biological processes. The breaking up of time also increases the likelihood of memory bias of respondents in questionnaire studies among exposed workers, and thus affects the estimation of total exposures.

Probably the most intensive effect, however, will be seen as a consequence of the variation in working hours. For example, instead of regular work of 8 hours per day, 40 hours per week and 11 months per year, new time schedules and total time budgets are introduced for the majority of workers in the industrial society. The present distribution of weekly working hours in Finland is less than 30 hours per week for one third of workers, regular 35-40 hours per week for one third, and 45-80 hours per week for the remaining third. Thus the real exposure times may vary substantially even among workers in the same jobs and same occupations, depending on the working hours and the employment contract (temporary, seasonal, part-time, full-time) (Härmä 2000 , Piirainen et al. 2003 .

Such variation in time distribution in "new work life" has numerous consequences for epidemiological studies, which in the past "industrial society" effectively utilized the constant time patterns at work for the assessment of exposures and outcomes and their interdependencies.

The time dimension also has new structural aspects. As biological processes are highly deterministic in terms of time, the rapid changes in work life cannot wait for the maturation of results in longitudinal follow-up studies. The data are needed rapidly in order to be useful in the management of working conditions. This calls for the development of rapid epidemiological methods which enable rapid collection of the data and the making of analyses in a very short time, in order to provide information on the effects of potential causal factors before the emergence of a new change. Often these methods imply the compromising of accuracy and reliability for the benefit of timeliness and actuality. As occupational epidemiology is not only interested in acute and short-term events, but looks at the health of workers over a 30-40-year perspective, the introduction of such new quick methods should not jeopardize the interest and efforts to carry out long-term studies.

Epidemiology has traditionally been a key tool in making a reliable risk assessment of the likelihood of the adverse outcomes from certain levels of exposure. The new developments in work life bring numerous new challenges to risk assessment. As discussed above, the new developments in work life have eliminated a number of possibilities for risk assessment which prevailed in the stable industrial society. On the other hand, several new methods and new information technologies provide new opportunities for collection and analysis of data.

Traditionally, the relationship between exposure and outcome has been judged on the basis of the classical criteria set by Hill (1965) . Höfler (2005) crystallizes the criteria with their explanations as the following:

1. Strength of association: A strong association is more likely to have a causal component than is a modest association. 2. Consistency: A relationship is observed repeatedly. 3. Specificity: A factor influences specifically a particular outcome or population. 4. Temporality: The factor must precede the outcome it is assumed to affect.

ing dose of exposure or according to a function predicted by a substantive theory. 6. Plausibility: The observed association can be plausibly explained by substantive matter (e.g. biological) explanations. 7. Coherence: A causal conclusion should not fundamentally contradict present substantive knowledge. 8. Experiment: Causation is more likely if evidence is based on randomized experiments. 9. Analogy: For analogous exposures and outcomes an effect has already been shown.

The Hill criteria have been subjected to scrutiny, and Sven Hernberg has analyzed them in detail from the viewpoint of occupational health epidemiology.

Virtually all the Hill criteria are affected by the changes in the new work life, and therefore methodological development is now needed. A few comments on causal inference are made here in view of the critiques by Rothman (1988), Hernberg (1992) and Höfler (2005) :

The strength of association will be more difficult to demonstrate due to the growing fragmentation that tends to diminish the sample sizes. The structural change that removes workers from high-level exposures to lower and shorterterm exposures may dilute the strength of effect, which may still prevail, but at a lower level.

Consistency of evidence may also be affected by the higher variation in conditions of work, study groups, multicultural and multiethnic composition of the workforce, etc. Similarly, in the multifactorial, multi-mechanism, multi-outcome setting, the specificity criterion is not always relevant.

The temporal dimension has already been discussed. In rapidly changing work life the follow-up times before the next change and before turnover in the workforce may be too short. The outcomes may also be defined by the exposures that have taken place long ago but have not been considered in the study design because historical data are not available.

The biological gradient may be possible to demonstrate in a relatively simple exposure-outcome relationship. However, the more complex and multifactorial the setting becomes, the more difficult it may be to show the doseresponse relationship. The dose-response relationship may also be difficult to demonstrate in the cases of relatively ill-defined outcomes which are difficult to measure, but which can be detected as qualitative changes.

Biological plausibility is an important criterion which in a multimechanism setting may at least in part be difficult to demonstrate. On the other hand, the mechanisms of numerous psychological and psychosocial outcomes lack explanations, even though they undoubtedly are work-related. The missing knowledge of the mechanism of action did not prevent the establishment of causality between asbestos and cancer in a pleural sack or a lung.

As many of the new outcomes may be context-dependent, the coherence criterion may be irrelevant. Similarly, many of the psychosocial outcomes are difficult to put into an experimental setting, and it can be difficult to make inferences based on analogy.

All of the foregoing implies that the new dynamic trends in work life challenge epidemiology in a new way, particularly in the establishment of causality. Knowledge of causality is required for the prevention and management of problems. The Hill criteria nevertheless need to be supplemented with new ones to meet the conditions of the new work life. Similarly, more definitive and specific criteria and indicators need to be developed for the new exposures and outcomes.

Many of the challenges faced in the struggle to improve health and safety in modern work life can only be solved with the help of research. Research on occupational health in the rapidly changing work life is needed more than ever. Epidemiology is, and will remain, a key producer of information needed for prevention policies and for ensuring healthy and safe working conditions. The role of epidemiology is, however, expanding from the analysis of the occurrence of well-defined clinical diseases to studies on the occurrence of several other types of exposure and outcome, and their increasingly complex associations.

As the baseline in modern work life is shifting in a more dynamic direction, and many parameters in work and the workers' situation are becoming more fragmented, incontinuous and complex, new approaches are needed to tackle the uncertainties in exposure assessment. The rapid pace of change in work life calls for the development of assessment methods to provide up-todate data quickly, so that they can be used to manage these changes and their consequences.

Many new outcomes which are not possible to register as clinical ICD diagnoses constitute problems for today's work life. This is particularly true in the case of psychological, psychosocial and many musculoskeletal outcomes which need to be managed by occupational health physicians. Methods for the identification and measurement of such outcomes need to be improved.

The traditional Hill criteria for causal inference are not always met even in cases where true association does exist. New criteria suitable for a new situation should be established without jeopardizing the original objective of ascertaining the true association. Developing the Bayesian inference further through utilization of a priori knowledge and a holistic approach may provide responses to new challenges. New neural network softwares may help in the management of the growing complexity.

The glory of science does not lie in the perfection of a scientific method but rather in the recognition of its limitations. We must keep in mind the old saying: "Absence of evidence is not evidence of absence". Instead, it is merely a consequence of our ignorance that should be reduced through further efforts in systematic research, and particularly through epidemiology. And secondly, the ultimate value of occupational health research will be determined on the basis of its impact on practice in the improvement of the working conditions, safety and health of working people.

Changing conditions of work, new technologies, new substances, new work organizations and working practices are associated with new morbidity patterns and even with new occupational and work-related diseases.

The new risk factors, such as rapidly transforming microbials and certain social and behavioural "exposures" may follow totally new dynamics when compared with the traditional industrial exposures (self-replicating nature of microbials and spreading of certain behaviours, such as terrorism) (Smolinski et al. 2003 , Loza 2007 .

Several social conditions, such as massive rural-urban migration, increased international mobility of working people, new work organizations and mobile work may cause totally new types of morbidity. Examples of such development are, among others, the following:

• Mobile transboundary transportation work leading to the spread of HIV/AIDS. • Increased risk of metabolic syndrome, diabetes and cardiovascular diseases aggravated by unconventional working hours. • Increased risk of psychological burnout in jobs with a high level of longterm stress. • Virtually a global epidemic of musculoskeletal disorders among VDU workers with high work load, psychological stress and poor ergonomics.

The incidences of occupational diseases may not decline in the future, but the type of morbidity may change. The direction of trend in industrialized countries is the prominence of work-related morbidity and new diseases, while the traditional occupational diseases such as noise injury, pneumoconiosis, repetitive strain and chemical intoxications may continue to be prevalent in developing countries for long periods in the future.

The new ergonomics problems are related to light physical work with a considerable proportion of static and repetitive workload. Recent research points to an interesting interaction between unergonomic working conditions and psychological stress, leading to a combined risk of musculoskeletal disorders of the neck, shoulders and upper arms, including carpal tunnel syndrome in the wrist. The muscle tension in static work is amplified by the uncontrolled muscular tension caused by psychological stress. Furthermore, there seems to be wide inter-individual variation in the tendency to respond with spasm, particularly in the trapezius muscle of neck, under psychological stress. About 40% of the health complaints of working-aged people are related to musculoskeletal disorders, of which a substantial part is work-related. The epidemics have been resistant against preventive measures. New regulatory and management strategies may be needed for effective prevention and control measures (Westgaard et al. 2006, Paoli and Merllié 2001) .

The 21st century will be the era of the brain at work and consequently of psychological stress. Between 35% and 50% of EU workers in certain occupations report psychological stress due to high time pressure at work (Parent-Thirion et al. 2007 ). The occurrence of work-related stress is most prevalent in occupations with tight deadlines, pressure from clients, or the high level of responsibility for productivity and quality given to the workers. Undoubtedly, the threat of unemployment increases the perception of stress as well. As a consequence, for example, in Finland some 40% of workers report symptoms of psychological overload and about 7% show clinical signs of burn out. These are not the problems of low-paid manual workers only, but also, for example, highly educated and well-paid computer super-experts have an elevated risk of burnout as a consequence of often self-committed workload (Kalimo and Toppinen 1997) .

Unconventional and ever longer working hours are causing similar problems. For example, one third of Finns work over 45 hours a week, and of these 25% work over 50 hours, and 8% often work 65-80 hours per week. It is important to have flexibility in the work time schedules, but it is counterproductive if the biologically determined physiological time rhythms of the worker are seriously offended. Over 40% have a sleep deficit of at least one hour each day, and 22% are tired and somnolent at work (Härmä et al. 2000) .

The toughening global competition, growing productivity demands and continuous changes of work, together with job insecurity, are associated with increased stress. Up to 30-50% of workers in different countries and different sectors of the economy report high time pressure and tight deadlines. This prevents them from doing their job as well as they would like to, and causes psychological stress. Psychological stress is particularly likely to occur if the high demands are associated with a low degree of self-regulation by the workers (Houtman 2005) . Stress, if continuous, has been found to be detrimental to physical health (cardiovascular diseases), mental health (psychological burnout), safety (accident risks), and musculoskeletal disorders (particularly hand-arm and shoulder-neck disorders). It also has a negative impact on productivity, sickness absenteeism, and the quality of products and services. The resulting economic losses due to sickness absenteeism, work disability and lower quality of products and services are substantial.

The prevention of stress consists not only of actions targeted at the individual worker. There is also a need for measures directed at the work organization, moderation of the total workload, competence building and collaboration within the workplace (Theorell 1997). The support from foremen and supervisors is of crucial importance in stress management programmes.

Another type of psychological burden is the stress arising from the threat of physical violence or aggressive behaviour from the part of clients. In Finland some 4% of workers have been subjected to insults or the threat of physical violence, 13% have experienced sexual harassment, and 10% mental violence or bullying at work. The risk is substantially higher for female workers than for men. Stress has been found to be associated with somatic health, cardiovascular diseases, mental disorders and depression.

One of the new and partly re-emerging challenges of occupational health services is associated with the new trends in microbial hazards. There are several reasons for these developments, for instance, the generation of new microbial strains, structural changes in human habitations with high population densities, growing international travel, and changes possibly in our microbiological environment as a consequence of global warming. Of the 10 to 100 million species in the world, about 3 million are microbes. The vast majority of them are not pathogenic to man, and we live in harmony and symbiosis with many of them. We also use bacteria in numerous ways to produce food, medicines, proteins, etc.

The pathogenic bacteria have been well controlled in the 20th century; this control had an enormous positive impact on human health, including occupational health. But now the microbial world is challenging us in many ways. New or re-emerging biological hazards are possible due to the transformation of viruses, the increased resistance of some microbial strains (e.g. tuberculosis and some other bacterial agents) and the rapid spread of contaminants through extensive overseas travelling (Smolinski et al. 2003) .

The scenarios of health hazards from the use of genetically manipulated organisms have not been realized, but biotechnological products have brought along new risks of allergies. A major indoor air problem is caused by fungi, moulds and chemical emissions from contaminated construction materials. New allergies are encountered as a consequence of the increasingly allergic constitution of the population and of the introduction of new allergens into the work environment.

Health care personnel are increasingly exposed to new microbial hazards due to the growing mobility of people. Evidence of high rates of hepatitis B antigen positivity has been shown among health care workers who are in contact with migrants from endemic areas. Along with the growing international interactions and mobility, a number of viral and re-emerging bacterial infections also affect the health of people engaged in health care and the care of the elderly, as well as personnel in migrant and refugee services, in social services and other public services.

This section applies the general framework for risk governance (Chapter 3) to the area of environmental risks. Why should we include this topic in a book that is dominantly dealing with occupational health risks and safety issues? There are two major reasons for this decision:

1. Most risks that impact health and safety of human beings are also affecting the natural environment. It is therefore necessary for risk managers to reflect the consequences of risk-taking activities with respect to workers, the public and the environment. These risk consequences are all interconnected. Our approach to foster an integral approach to risk and risk management requires the integration of all risk consequences. 2. Environmental risks are characterized by many features and properties that highlight exemplary issues for many generic risk assessment and management questions and challenges. For example, the question of how to balance benefits and risks becomes more accentuated, if not human life, but damage to environmental quality is at stake. While most people agree that saving human lives takes priority over economic benefits, it remains an open question of how much environmental change and potential damage one is willing to trade off against certain economic benefits.

This section is divided into two major parts. Part 1 will introduce the essentials of environmental ethics and the application of ethical principles to judging the acceptability of human interventions into the environment. Part 2 addresses the procedures for an analytic-deliberative process of decision making when using the risk governance framework developed in Chapter 3. It should be noted that this section draws from material that the author has compiled for the German Scientific Council for Global Environmental Change and that has been partially published in German in a special report of the Council (WBGU 1999). The last section on decision making has borrowed material from an unpublished background document on decision making and risk management that Dr. Warner North and the author had prepared for the US National Academy of Sciences.

Should people be allowed to do everything that they are capable of doing? This question is posed in connection with new technologies, such as nanotubes, or with human interventions in nature, such as the clearance of primaeval forests so that the land can be used for agriculture. Intuitively everyone answers this question with a definitive "No": no way should people be allowed to everything that they are capable of doing. This also applies to everyday actions. Many options in daily life, from lying to minor deception, from breaking a promise up to going behind a friend's back, are obviously actions that are seen by all well-intentioned observers as unacceptable. However, it is much more difficult to assess those actions where the valuation is not so obvious. Is it justified to break a promise when keeping the promise could harm many other people?

Actions where there are conflicts between positive and negative consequences or where a judgement could be made one way or the other with equally good justification are especially common in risk management. There is hardly anyone who wilfully and without reason pollutes the environment, releases toxic pollutants or damages the health of individuals. People who pursue their own selfish goals on the cost and risk of others are obviously acting wrongly and every legislator will sanction this behaviour with the threat of punishment or a penalty. But there is a need for clarification where people bring about a benefit to society with the best intentions and for plausible reasons and, in the process, risk negative impacts on others. In ethics we talk about "conflicting values" here.

Most decisions involving risks to oneself or others are made for some reason: the actors who make such interventions want to secure goods or services to consumers, for example, to ensure long-term jobs and adequate incomes, to use natural resources for products and services or to use nature for recycling waste materials from production and consumption that are no longer needed. None of this is done for reasons of brotherly love, but to maintain social interests. Even improving one's own financial resource is not immoral mere for this reason. The list of human activities that pose risks onto others perpetrated for existential or economic reasons could be carried on into infinity. Human existence is bound to taking opportunities and risks.

Here are just a few figures: around 12,000 years ago about 5 million people lived on the earth. Under the production conditions those days (hunter-gatherer culture) this population level was the limit for the human species within the framework of an economic form that only interfered slightly with man's natural environment. The neolithic revolution brought a dramatic change: the carrying capacity of the world for human beings increased by a factor of 10 and more. This agrarian pre-industrial cultural form was characterized by tightly limited carrying capacity, in around 1750 the earth was capable of feeding approx. 750 million people. Today the world supports 6 billion people -and this figure is rising. The carrying capacity in comparison to the Neolithic age has thus increased thousand-fold and continues to grow in parallel to new changes in production conditions (Fritsch 1993; Kesselring 1994; Mohr 1995) . The five "Promethean innovations" are behind this tremendous achievement of human culture: mastering fire, using the natural environment for agriculture, transforming fossil fuels into thermal and mechanical energy, industrial production and substituting material with information (Renn 1996) .

With today's settlement densities and the predominantly industrial way of life, the human race is therefore dependent on the technical remodelling of nature. Without doubt, it needs this for survival, especially for the well-being of the innumerable people, goods and services that reduce the stock of natural resources. With regard to the question of the responsibility of human interventions in nature, the question cannot be about "whether" but -even better -about "how much", because it is an anthropological necessity to adapt and shape existing nature to human needs. For example, the philosopher Klaus Michael Meyer-Abich sees the situation as follows: ". . . we humans are not there to leave the world as though we had never been there. As with all other life forms, it is also part of our nature and our lives to bring about changes in the world. Of course, this does not legitimise the destructive ways of life that we have fallen into. But only when we basically approve of the changes in the world can we turn to the decisive question of which changes are appropriate for human existence and which are not" (Meyer-Abich 1997).

Therefore, to be able to make a sensible judgement of the balance between necessary interventions into the environment and the risks posed by these interventions to human health and environmental quality, the range of products and services created by the consumption of nature has to be considered in relation to the losses that are inflicted on the environment and nature. With this comparison, it can be seen that even serious interventions in nature and the environment did not occur without reflection, but to provide the growing number of people with goods and services; these people need them to survive or as a prerequisite for a "good" life. However, at the same time it must be kept in mind that these interventions often inflict irreversible damage on the environment and destroy possible future usage potentials for future generations. Above and beyond this, for the human race, nature is a cradle of social, cultural, aesthetic and religious values, the infringement of which, in turn, has a major influence on people's well-being. On both sides of the equation, there are therefore important goods that have to be appreciated when interventions in nature occur. But what form should such an appreciation take?

If the pros and cons of the intervention in nature have to be weighed against each other, criteria are needed that can be used as yardsticks. Who can and may draw up such criteria, according to which standards should the interventions be assessed and how can the various evaluative options for action be compared with each other for each criterion?

Taking risks always involves two major components: an assessment of what we can expect from an intervention into the environment (be it the use of resources or the use of environments as a sink for our waste). This is the risk and benefit assessment side of the risk analysis. Secondly, we need to decide whether the assessed consequences are desirable. Whereas the estimate of consequences broadly falls in the domain of scientific research and expertise, with uncertainties and ambiguities in particular having to be taken into account (IRGC 2005, Klinke and Renn 2002) , the question about the foundations for evaluating various options for action and about drawing up standards guiding action is a central function of ethics (Taylor 1986) . Ethics can provide an answer to the question posed in the beginning ("Should people be allowed to do everything that they are capable of doing?") in a consistent and transparent manner.

In Section 4.3.2, environmental ethics will be briefly introduced. This review is inspired by the need for a pragmatic and policy-oriented approach. It is not a replacement for a comprehensive and theoretically driven compendium of environmental ethics. Environmental ethics will then be applied to evaluate environmental assets. In this process, a simple distinction is made between categorical principles -that must under no circumstances be exceeded or violated -and compensatory principles, where compensation with other competing principles is allowed. This distinction consequently leads to a classification of environmental values, which, in turn, can be broken down into criteria to appreciate options for designing environmental policies.

In Section 4.3.3, these ideas of valuation will be taken up and used to translate the value categories into risk handling guidelines. At the heart of the considerations here is the issue of how the aims of ethically founded considerations can be used to support and implement risk-based balancing of costs and benefits. For this purpose, we will develop an integrative risk governance framework. The concept of risk governance comprises a broad picture of risk: not only does it include what has been termed "risk management" or "risk analysis", it also looks at how risk-related decision making unfolds when a range of actors is involved, requiring co-ordination and possibly reconciliation between a profusion of roles, perspectives, goals and activities. Indeed, the problem-solving capacities of individual actors, be they government, the scientific community, business players, NGOs or civil society as a whole, are limited and often unequal to the major challenges facing society today.

Then the ideas of the operational implementation of normative and factual valuations are continued and a procedure is described that is capable of integrating ethical, risk-based and work-related criteria into a proposed procedural orientation. This procedure is heavily inspired by decision analysis.

Answering the question about the right action is the field of practical philosophy, ethics. Following the usual view in philosophy, ethics describes the theory of the justification of normative statements, i.e. those that guide action (Gethmann 1991 , Mittelstraß 1992 , Nida-Rümelin 1996a , Revermann 1998 .

A system of normative statements is called "morals". Ethical judgements therefore refer to the justifiability of moral instructions for action that may vary from individual to individual and from culture to culture (Ott 1999) . Basically, humans are purpose-oriented and self-determined beings who act not only instinctively, but also with foresight, and are subject to the moral standards to carry out only those actions that they can classify as good and justifiable (Honnefelder 1993) . Obviously, not all people act according to the standards that they themselves see as necessary, but they are capable of doing so. In this context, it is possible for people to act morally because, on the one hand, they are capable of distinguishing between moral and immoral action and, on the other, are largely free to choose between different options for action.

Whether pursuing a particular instruction for action should be considered as moral or immoral is based on whether the action concerned can be felt and justified to be "reasonable" in a particular situation. Standards that cross over situations and that demand universal applicability are referred to as principles here. Conflicts may arise between competing standards (in a specific situation), as well as between competing principles, the solution of which, in turn, needs justification (Szejnwald-Brown et al. 1993) . Providing yardsticks for such justification or examining moral systems with respect to their justifiability is one of the key tasks of practical ethics (Gethmann 1998) .

In ethics a distinction is made between descriptive (experienced morality) and prescriptive approaches, i.e. justifiable principles of individual and collective behaviour (Frankena 1963 , Hansen 1995 . All descriptive approaches are, generally speaking, a "stock-taking" of actually experienced standards. Initially, it is irrelevant whether these standards are justified or not. They gain their normative force solely from the fact that they exist and instigate human action (normative force of actual action). Most ethicists agree that no conclusions about general validity can be drawn from the actual existence of standards. This would be a naturalistic fallacy (Akademie der Wissenschaften 1992, Ott 1999) . Nevertheless, experienced morality can be an important indicator of different, equally justifiable moral systems, especially where guidance for cross-cultural behaviour is concerned. This means that the actual behaviour of many people with regard to their natural environment reveals which elements of this environment they value in particular and which they do not. However, in this case, too, the validity of the standards is not derived from their factuality, but merely used as a heurism in order to find an adequate (possibly culture-immanent) justification.

But given the variety of cultures and beliefs, how can standards be justified inter-subjectively, i.e. in a way that is equally valid to all? Is it not the case that science can only prove or disprove factual statements (and this only to a certain extent), but not normative statements? A brief discourse on the various approaches in ethics is needed to answer this question.

First of all, ethics is concerned with two different target aspects: on the one hand, it is concerned with the question of the "success" of one's own "good life", i.e. with the standards and principles that enable a person to have a happy and fulfilled life. This is called eudemonistic ethics. On the other hand, it is concerned with the standards and principles of living together, i.e. with binding regulations that create the conditions for a happy life: the common good. This is called normative ethics (Galert 1998 , Ott 1999 .

Within normative ethics a distinction is made between deontological and teleological approaches when justifying normative statements (Höffe 1987) . Deontological approaches are principles and standards of behaviour that apply to the behaviour itself on the basis of an external valuation criterion. It is not the consequences of an action that are the yardstick of the valuation; rather, it is adhering to inherent yardsticks that can be used against the action itself. Such external yardsticks of valuation are derived from religion, nature, intuition or common sense, depending on the basic philosophical direction.

Thus, protection of the biosphere can be seen as a divine order to protect creation (Rock 1980 , Schmitz 1985 , as an innate tendency for the emotional attachment of people to an environment with biodiversity (Wilson 1984) , as a directly understandable source of inspiration and joy (Ehrenfeld 1993) or as an educational means of practising responsibility and maintaining social stability (Gowdy 1997) .

By contrast, teleological approaches refer to the consequences of action. Here, too, external standards of valuation are needed since the ethical quality of the consequences of action also have to be evaluated against a yardstick of some kind. With the most utilitarian approaches (a subset of the teleological approaches) this yardstick is defined as an increase in individual or social benefit. In other schools of ethics, intuition (can the consequence still be desirable?) or the aspect of reciprocity (the so-called "Golden Rule": "do as you would be done by") play a key role.

In the approaches based on logical reasoning (especially in Kant), the yardstick is derived from the logic of the ability to generalize or universalize. Kant himself is in the tradition of deontological approaches ("Good will is not good as a result of what it does or achieves, but just as a result of the intention"). According to Kant, every principle that, if followed generally, makes it impossible for a happy life to be conducted is ethically impermissible. In this connection, it is not the desirability of the consequences that captures Kant's mind, but the logical inconsistency that results from the fact that the conditions of the actions of individuals would be undermined if everyone were to act according to the same maxims (Höffe 1992) .

A number of contemporary ethicists have taken up Kant's generalization formula, but do not judge the maxims according to their internal contradictions; rather, they judge them according to the desirability of the consequences to be feared from the generalization (Jonas 1979 or Zimmerli 1993 should be mentioned here). These approaches can be defined as a middle course between deontological and teleological forms of justification.

In addition to deontological and teleological approaches, there is also the simple solution of consensual ethics, which, however, comprises more than just actually experienced morality. Consensual ethics presupposes the explicit agreement of the people involved in an action. Everything is allowed provided that all affected (for whatever reason) voluntarily agree. In sexual ethics at the moment a change from deontological ethics to a consensual moral code can be seen.

The three forms of normative ethics are shown in Figure 4 .13. The comparison of the basic justification paths for normative moral systems already clearly shows that professional ethicists cannot create any standards or des- ignate any as clearly right, even if they play a role in people's actual lives. Much rather it is the prime task of ethics to ensure on the basis of generally recognized principles (for example, human rights) that all associated standards and behaviour regulations do not contradict each other or a higher order principle.

Above and beyond this, ethics can identify possible solutions that may occur with a conflict between standards and principles of equal standing. Ethics may also reveal interconnections of justification that have proved themselves as examination criteria for moral action in the course of their disciplinary history. Finally, many ethicists see their task as providing methods and procedures primarily of an intellectual nature by means of which the compatibility or incompatibility of standards within the framework of one or more moral systems can be completed.

Unlike the law, the wealth of standards of ethics is not bound to codified rules that can be used as a basis for such compatibility examinations. Every normative discussion therefore starts with the general issues that are needed in order to allow individuals a "good life" and, at the same time, to give validity to the principles required to regulate the community life built on common good. But how can generally binding and inter-subjectively valid criteria be made for the valuation of "the common good"?

In modern pluralistic societies, it is increasingly difficult for individuals and groups of society to draw up or recognize collectively binding principles that are perceived by all equally as justifiable and as self-obliging (Hartwich and Wewer 1991, Zilleßen 1993) . The variety of lifestyle options and subjectiernization. With increasing technical and organizational means of shaping the future, the range of behaviour options available to people also expands. With the increasing plurality of lifestyles, group-specific rationalities emerge that create their own worldviews and moral standards, which demand a binding nature and validity only within a social group or subculture. The fewer cross-society guiding principles or behaviour orientations are available, the more difficult is the process of agreement on collectively binding orientations for action. However, these are vital for the maintenance of economic cooperation, for the protection of the natural foundations of life and for the maintenance of cohesion in a society. No society can exist without the binding specification of minimum canons of principles and standards.

But how can agreement be reached on such collectively binding principles and standards? What criteria can be used to judge standards? The answers to this question depend on whether the primary principles, in other words, the starting point of all moral systems, or secondary principles or standards, i.e. follow-on standards that can be derived from the primary principles, are subjected to an ethical examination. Primary principles can be categorical or compensatory (capable of being compensated). Categorical principles are those that must not be infringed under any circumstances, even if other prin-219 fication of meaning (individualization) are accompanying features of mod-ciples would be infringed as a result. The human right to the integrity of life could be named here as an example. Compensatory principles are those where temporary or partial infringement is acceptable, provided that as a result the infringement of a principle of equal or higher ranking is avoided or can be avoided. In this way certain freedom rights can be restricted in times of emergency. In the literature on ethical rules, one can find more complex and sophisticated classifications of normative rules. For our purpose to provide a simple and pragmatic framework, the distinction in four categories (principles and standards; categorical and compensatory) may suffice. This distinction has been developed from a decision-analytical perspective.

But how can primary principles be justified as equally valid for all people? Although many philosophers have made proposals here, there is a broad consensus today that neither philosophy nor any other human facility is capable of stating binding metacriteria without any doubt and for all people, according to which such primary principles should be derived or examined (Mittelstraß 1984) . A final justification of normative judgements cannot be achieved by logical means either, since all attempts of this kind automatically end either in a logical circle, in an unending regression (vicious cycle) or in a termination of the procedure and none of these alternatives is a satisfactory solution for final justification (Albert 1991).

The problem of not being able to derive finally valid principles definitively, however, seems to be less serious than would appear at first glance. Because, regardless of whether the basic axioms of moral rules are taken from intuition, observations of nature, religion, tradition reasoning or common sense, they have broadly similar contents. Thus, there is broad consensus that each human individual has a right to life, that human freedom is a high-value good and that social justice should be aimed at. But there are obviously many different opinions about what these principles mean in detail and how they should be implemented. In spite of this plurality, however, discerning and well-intentioned observers can usually quickly agree, whether one of the basic principles has clearly been infringed. It is more difficult to decide whether they have clearly been fulfilled or whether the behaviour to be judged should clearly be assigned to one or several principles. Since there is no finally binding body in a secular society that can specify primary principles or standards ex cathedra, in this case consensus among equally defendable standards or principles can be used (or pragmatically under certain conditions also majority decisions). Ethical considerations are still useful in this case as they allow the test of generalization and the enhancement of awareness raising capabilities. In particular, they help to reveal the implications of such primary principles and standards.

Provided that primary principles are not concerned (such as human rights), the ethical discussion largely consists of examining the compatibility of each of the available standards and options for action with the primary principles. In this connection, the main concerns are a lack of contradictions (consistency), logical consistency (deductive validity), coherence (agreement with other principles that have been recognized as correct) and other, broadly logical criteria (Gethmann 1998) . As the result of such an examination it is entirely possible to reach completely different conclusions that all correspond to the laws of logic and thus justify new plurality.

In order to reach binding statements or valuations here the evaluator can either conduct a discussion in his "mind" and let the arguments for various standards compete with each other (rather like a platonic dialogue) or conduct a real discussion with the people affected by the action. In both cases the main concern is to use the consensually agreed primary principles to derive secondary principles of general action and standards of specific action that should be preferred over alternatives that can be equally justified. A plurality of solutions should be expected especially because most of the concrete options for action comprise only a gradual fulfilment and infringement of primary principles and therefore also include conflicting values. For value conflicts at the same level of abstraction there are, by definition, no clear rules for solution. There are therefore frequently conflicts between conserving life through economic development and destroying life through environmental damage. Since the principle of conserving life can be used for both options a conflict is unavoidable in this case. To solve the conflicts, ethical considerations, such as the avoidance of extremes, staggering priorities over time or the search for third solutions can help without, however, being able to convincingly solve this conflict in principle to the same degree for all (Szejnwald-Brown et al. 1993) .

These considerations lead to some important conclusions for the matter of the application of ethical principles to the issue of human action with regard to the natural environment. First of all, it contradicts the way ethics sees itself to develop ethics of its own for different action contexts. Just as there can be no different rules for the logic of deduction and induction in nomological science, depending on which object is concerned, it does not make any sense to postulate an independent set of ethics for the environment (Galert 1998) . Justifications for principles and moral systems have to satisfy universal validity (Nida-Rümelin 1996b).

Furthermore, it is not very helpful to call for a special moral system for the environment since this -like every other moral system -has to be traceable to primary principles. Instead, it makes sense to specify the generally valid principles that are also relevant with regard to the issue of how to deal with the natural environment. At the same time standards should be specified that are appropriate to environmental goods and that reflect those principles that are valid beyond their application to the environment.

As implied above, it does not make much sense to talk about an independent set of environmental ethics. Much rather, general ethics should be transferred to issues relating to the use of the environment (Hargrove 1989) . Three areas are usually dealt with within the context of environmental ethics (Galert 1998 ):

• Environmental protection, i.e. the avoidance or alleviation of direct or indirect, current or future damage and pollution resulting from anthropogenic emissions, waste or changes to the landscape, including land use, as well as the long-term securing of the natural foundations of life for people and other living creatures (Birnbacher 1991a ). • Animal protection, i.e. the search for reasonable and enforceable standards to avoid or reduce pain and suffering in sentient beings (Krebs 1997 , Vischer 1999 ). • Nature conservation, i.e. the protection of nature against the transforming intervention of human use, especially all measures to conserve, care for, promote and recreate components of nature deemed to be valuable, including species of flora and fauna, biotic communities, landscapes and the foundations of life required there (Birnbacher 1991a) .

Regardless which of these three areas are addressed we need to explore which primary principles be applied to them. When dealing with the environment, the traditional basic and human rights, as well as the civil rights that have been derived from them, should be just as much a foundation of the consideration as other areas of application in ethics. However, with regard to the primary principles there is a special transfer problem when addressing human interventions into nature and the environment: does the basic postulate of conservation of life apply only to human beings, to all other creatures or to all elements of nature, too? This question does not lead to a new primary principle, as one may suspect at first glance. Much rather, it is concerned with the delineation of the universally recognized principle of the conservation of life that has already been specified in the basic rights canon. Are only people included in this principle (this is the codified version valid in most legal constitutions today) or other living creatures, too? And if yes, which ones? Should non-living elements be included as well? When answering this question, two at first sight contradictory positions can be derived: anthropocentrism and physiocentrism (Taylor 1986 , Ott 1993 , Galert 1998 . The anthropocentric view places humans and their needs at the fore. Nature's own original demands are alien to this view. Interventions in nature are allowed if they are useful to human society. A duty to make provisions for the future and to conserve nature exists in the anthropocentric world only to the extent that natural systems are classed as valuable to people today and subsequent generations and that nature can be classed as a means and guarantor of human life and survival (Norton 1987 , Birnbacher 1991b .

In the physiocentric concept, which forms an opposite pole to the anthropocentric view, the needs of human beings are not placed above those of nature. Here, every living creature, whether humans, animals or plants, have intrinsic rights with regard to the chance to develop their own lives within the framework of a natural order. Merit for protection is justified in the physiocentric view by an inner value that is unique to each living creature or the environment in general. Nature has a value of its own that does not depend on the functions that it fulfils today or may fulfil later from a human society's point of view (Devall and Sessions 1984 , Callicott 1989 , Rolston 1994 , Meyer-Abich 1996 .

Each of these prevailing understandings of the human-nature relationship has implications that are decisive for the form and extent of nature use by humans (Elliot 1995 , Krebs 1997 . Strictly speaking, it could be concluded from the physiocentric idea that all human interventions in nature have to be stopped so that the rights of other creatures are not endangered. Yet, not even extreme representatives of a physiocentric view would go so far as to reject all human interventions in nature because animals, too, change the environment by their ways of life (e.g. the elephant prevents the greening of the savannah). The central postulate of a physiocentric view is the gradual minimization of the depth of interventions in human use of nature. The only interventions that are permitted are those that contribute to directly securing human existence and do not change the fundamental composition of the surrounding natural environment.

If these two criteria were taken to the extreme, neither population development beyond the boundaries of biological carrying capacity nor a transformation of natural land into pure agricultural land would be allowed. Such a strict interpretation of physiocentrism would lead to a radical reversal of human history so far and is not compatible with the values and expectations of most people.

The same is true for the unlimited transfer of anthropocentrism to dealings with nature. In this view, the use of natural services is subjected solely to the individual cost-benefit calculation. This can lead to unscrupulous exploitation of nature by humans with the aim of expanding human civilization. Both extremes quickly lead to counter-intuitive implications.

When the issue of environmental design and policy is concerned, anthropocentric and physiocentric approaches in their pure form are found only rarely, much rather they occur in different mixtures and slants. The transitions between the concepts are fluid. Moderate approaches certainly take on elements from the opposite position. It can thus be in line with a fundamentally physiocentric perspective if the priority of human interests is not questioned in the use of natural resources. It is also true that the conclusions of a moderate form of anthropocentrism can approach the implications of the physiocentric view. Table 4 .10 provides an overview of various types of anthropocentric and physiocentric perspectives.

If we look at the behaviour patterns of people in different cultures, physiocentric or anthropocentric basic positions are rarely maintained consistently (Bargatzky and Kuschel 1994 ; on the convergence theory: Birnbacher 1996) . In the strongly anthropocentric countries in the West, people spend more money on the welfare and health of their own pets than on saving human lives in other countries. In the countries of the Far East that are characterized by physiocentrism, nature is frequently exploited even more radically than in the industrialized countries of the West. This inconsistent action is not a justification for one view or the other, it is just a warning for caution when laying down further rules for use so that no extreme -and thus untenable -demands be made.

Also from an ethical point of view, radical anthropocentrism should be rejected just as much as radical physiocentrism. If, to take up just one argument, the right to human integrity is largely justified by the fact that causing pain by others should be seen as something to avoid, this consideration without a doubt has to be applied to other creatures that are also capable of feeling pain (referred to as: pathocentrism). Here, therefore, pure anthropocentrism cannot convince. In turn, with a purely physiocentric approach the primary principles of freedom, equality and human dignity could not be maintained at all if every part of living nature were equally entitled to use the natural environment. Under these circumstances people would have to do without agriculture, the conversion of natural land into agricultural land and breeding farm animals and pets in line with human needs. As soon Table 4 .10 Different perspectives on nature. Adapted from Renn and Goble (1996: 4). as physiocentrism is related to species and not to individuals as is done in some biocentric perspectives human priority is automatically implied; because where human beings are concerned, nearly all schools of ethics share the fundamental moral principle of an individual right to life from birth. If this right is not granted to individual animals or plants, a superiority of the human race is implicitly assumed. Moderate versions of physiocentrism acknowledge a gradual de-escalation with respect to the claim of individual Table 4 .10 Different perspectives on nature (continued). Adapted from Renn and Goble (1996: 4). life protection. The extreme forms of both physiocentrism and anthropocentrism are therefore not very convincing and are hardly capable of achieving a global consensus. This means that only moderate anthropocentrism or moderate biocentrism should be considered.

The image of nature that is used as a basis for the considerations in this section emphasizes the uniqueness of human beings vis-à-vis physiocentric views, but does not imply carte blanche for wasteful and careless dealings with nature. This moderate concept derives society's duty to conserve nature -also for future generations -from the life-preserving and life-enhancing meaning of nature for society. This is not just concerned with the instrumental value of nature as a "store of resources", it is also a matter of the function of nature as a provider of inspiration, spiritual experience, beauty and peace (Birnbacher and Schicha 1996) . In this context it is important that human beings -as the addressees of the moral standard -do not regard nature merely as material and as a way towards their own self-realization, but can also assume responsibility for conservation of their cultural and so-cial function, as well as their existential value above and beyond the objective and technically available benefits (Honnefelder 1993) .

One of the first people to express this responsibility of human stewardship of nature in an almost poetic way was the American ecologist Aldo Leopold, who pointed out people's special responsibility for the existence of nature and land as early as the 1930s with the essay "The Conservation Ethics". His most well-known work "A Sand County Almanac" is sustained by the attempt to observe and assess human activities from the viewpoint of the land (a mountain or an animal). This perspective was clearly physiocentric and revealed fundamental insights about the relationship between humans and nature on the basis of empathy and shifting perspectives. His point of view had a strong influence on American environmental ethics and the stance of conservationists. Although this physiocentric perspective raises many concerns, the idea of stewardship has been one of the guiding ideas for the arguments used in this section (Pickett et al. 1997) . We are morally required to exercise a sort of stewardship over living nature, because nature cannot claim any rights for itself, but nevertheless has exceptional value that is important to man above and beyond its economic utility value (Hösle 1991) .

Since contemporary society and the generations to come certainly use, or will use, more natural resources than would be compatible with a lifestyle in harmony with the given natural conditions, the conversion of natural land into anthropogenically determined agricultural land cannot be avoided (Mohr 1995) . Many people criticized human interventions into natural cycles as infringements of the applicable moral standards of nature conservation (for example, fastened onto the postulate of sustainability). But we should avoid premature conclusions here, as can be seen with the example of species protection. For example, where natural objects or phenomena are concerned that turn out to be a risk to human or non-human living creatures, the general call for nature conservation is already thrown into doubt (Gale and Cordray 1994) .

Not many people would call the eradication of cholera bacteria, HIV viruses and other pathogens morally bad (Mittelstraß 1995) if remaining samples were kept under lock and key in laboratories. Also, combating highly evolved creatures, such as cockroaches or rats meets with broad support if we ignore the call for the complete eradication of these species for the time being. An environmental initiative to save cockroaches would not be likely to gain supporters. If we look at the situation carefully, the valuation of human behaviour in these examples results from a conflict. Because the conservation of the species competes with the objective of maintaining human health or the objective of a hygienic place to live, two principles, possibly of equal ranking, come face to face. In this case the options for action, which may all involve a gradual infringement of one or more principles, would have to be weighed up against each other. A general ban on eradicating a species can thus not be justified ethically, in the sense of a categorical principle, unless the maintenance of human health were to be given lower priority than the conservation of a species.

With regard to the issue of species conservation, therefore, different goods have to be weighed up against each other. Nature itself cannot show society what it is essential to conserve and how much nature can be traded for valuable commodities. Humans alone are responsible for a decision and the resulting conflicts between competing objectives. Appreciation and negotiation processes are therefore the core of the considerations about the ethical justification of rules for interventions.

But this does not mean that there is no room for categorical judgements along the lines of "this or that absolutely must be prohibited" in the matter of human interventions into the natural environment. It follows on from the basic principle of conserving human life that all human interventions that threaten the ability of the human race as a whole, or a significant number of individuals alive today or in the future, to exist should be categorically prohibited. This refers to intervention threats to the systemic functions of the biosphere. Such threats are one of the guiding principles that must not be exceeded under any circumstances, even if this excess were to be associated with high benefits. In the language of ethics this is a categorical principle, in the language of economics a good that is not capable of being traded. The "club" of categorical prohibitions should, however, be used very sparingly because plausible trade-offs can be thought up for most principles, the partial exceeding of which appears intuitively. In the case of threats to existence, however, the categorical rejection of the behaviour that leads to this is obvious.

But what does the adoption of categorical principles specifically mean for the political moulding of environmental protection? In the past, a number of authors have tried to specify the minimum requirements for an ethically responsible moral system with respect to biosphere use. These so-called "safe minimum standards" specify thresholds for the open-ended measurement scale of the consequences of human interventions that may not be ex-ceeded even if there is a prospect of great benefits (Randall 1988, Randall and Farmer 1995) . In order to be able to specify these thresholds in more detail the breakdown into three levels proposed by the German Scientific Council for Global Environmental Change is helpful (WBGU 2000) . These levels are:

• the global bio-geochemical cycles in which the biosphere is involved as one of the causes, modulator or "beneficiary"; • the diversity of ecosystems and landscapes that have key functions as bearers of diversity in the biosphere; and • the genetic diversity and the species diversity that are both "the modelling clay of evolution" and basic elements of ecosystem functions and dynamics.

Where the first level is concerned, in which the functioning of the global ecosystem is at stake, categorical principles are obviously necessary and sensible, provided that no one wants to shake the primary principle of the permanent preservation of the human race. Accordingly, all interventions in which important substance or energy cycles are significantly influenced at a global level and where globally effective negative impacts are to be expected are categorically prohibited. Usually no stringently causal evidence of the harmful nature of globally relevant information is needed; justified suspicion of such harmfulness should suffice. Later in this chapter we will make a proposal for risk valuation and management how the problem of uncertainty in the event of possible catastrophic damage potential should be dealt with (risk type Cassandra). On the second level, the protection of ecosystems and landscapes, it is much more difficult to draw up categorical rules. Initially, it is obvious that all interventions in landscapes in which the global functions mentioned on the first level are endangered must be avoided. Above and beyond this, it is wise from a precautionary point of view to maintain as much ecosystem diversity as possible in order to keep the degree of vulnerability to the unforeseen or even unforeseeable consequences of anthropogenic and nonanthropogenic interventions as low as possible. Even though it is difficult to derive findings for human behaviour from observations of evolution, the empirically proven statement "he who places everything on one card, always loses in the long run" seems to demonstrate a universally valid insight into the functioning of systemically organized interactions. For this reason, the conservation of the natural diversity of ecosystems and landscape forms is a categorical principle, whereas the depth of intervention allowed should be specified on the basis of principles and standards capable of compensation.

The same can be said for the third level, genetic and species protection. Here too, initially the causal chain should be laid down: species conservation, landscape conservation, maintaining global functions. Wherever this chain is unbroken, a categorical order of conservation should apply. These species could be termed primary key species. This includes such species that are not only essential for the specific landscape type in which they occur, but also for the global cycles above and beyond this specific landscape type thanks to their special position in the ecosystem. Probably, it will not be possible to organize all species under this functional contribution to the surrounding ecosystem, but we could also think of groups of species, for example, humus-forming bacteria. In second place there are the species that characterize certain ecosystems or landscapes. Here they are referred to as secondary key species. They, too, are under special protection that is not necessarily under categorical reservations. Their function value, however, is worthy of special attention. Below these two types of species there are the remaining species that perform ecosystem functions to a greater or lesser extent. What this means for the worthiness for protection of these species and the point at which the precise limit for permitted intervention should be drawn, is a question that can no longer be solved with categorical principles and standards, but with the help of compensatory principles and standards. Generally, here, too, as with the issue of ecosystem and landscape protection, the conservation of diversity as a strategy of "reinsurance" against ignorance, global risks and unforeseeable surprises is recommended.

It remains to be said that from a systemic point of view, a categorical ban has to apply to all human interventions where global closed loops are demonstrably at risk. Above and beyond this, it makes sense to recognize the conservation of landscape variety (also of ecosystem diversity within landscapes) and of genetic variety and species diversity as basic principles, without being able to make categorical judgements about individual landscape or species types as a result.

In order to evaluate partial infringements of compensatory principles or standards, which are referred to in the issue of environmental protection, we need rules for decision making that facilitate the balancing process necessary to resolve compensatory conflicts. In the current debate about rules for using the environment and nature, it is mainly teleological valuation methods that are proposed (Hubig 1993 , Ott 1993 .

These methods are aimed at:

• estimating the possible consequences of various options for action at all dimensions relevant to potentially affected people; • recording the infringements or fulfilments of these expected consequences in the light of the guiding standards and principles; and • then weighing them according to an internal key so that they can be weighed up in a balanced way.

On the positive side of the equation, there are the economic benefits of an intervention and the cultural values created by use, for example, in the form of income, subsistence (self-sufficiency) or an aesthetically attractive landscape (parks, ornamental gardens, etc.); on the negative side, there are the destruction of current or future usage potentials, the loss of unknown natural resources that may be needed in the future and the violation of aesthetic, cultural or religious attributes associated with the environment and nature.

There are therefore related categories on both sides of the equation: current uses vs. possible uses in the future, development potentials of current uses vs. option values for future use, shaping the environment by use vs. impairments to the environment as a result of alternative use, etc. With the same or similar categories on the credit and debit side of the balance sheet the decision is easy when there is one option that performs better or worse than all the other options for all categories. Although such a dominant (the best for all categories) or sub-dominant option (the worst for all categories) is rare in reality, there are examples of dominant or sub-dominant solutions. Thus, for example, the overfelling of the forests of Kalimantan on the island of Borneo in Indonesia can be classed as a sub-dominant option since the short-term benefit, even with extremely high discount rates, is in no proportion to the long-term losses of benefits associated with a barren area covered in Imperata grass. The recultivation of a barren area of this kind requires sums many times the income from the sale of the wood, including interest. Apparently there are no cultural, aesthetic or religious reasons for conversion of primary or secondary woodland into grassland. This means that the option of deforestation should be classed as of less value than alternative options for all criteria, including economic and social criteria.

At best, we can talk about a habit of leaving rainforests, as a "biotope not worthy of conservation", to short-term use. But habit is not a sound reason for the choice of any sub-optimum option. As mentioned at the start of this chapter, habit as experienced morality, does not have any normative force, especially when this is based on the illusion of the marginality of one's own behaviour or ignorance about sustainable usage forms.

But if we disregard the dominant or sub-dominant solutions, an appreciation between options that violate or fulfil compensatory standards and principles depends on two preconditions: best possible knowledge of the consequences (what happens if I choose option A instead of option B?) and a transparent, consistent rationale for weighing up these consequences as part of a legitimate political decision process (are the foreseeable consequences of option A more desirable or bearable than the consequences of option B?) (Akademie der Wissenschaften 1992).

Adequate knowledge of the consequences is needed in order to reveal the systemic connections between resource use, ecosystem reactions to human interventions and socio-cultural condition factors (Wolters 1995) . This requires interdisciplinary research and cooperation. The task of applied ecological research, for example, is to show the consequences of human intervention in the natural environment and how ecosystems are burdened by different interventions and practices. The economic approach provides a benefit-oriented valuation of natural and artificial resources within the context of production and consumption, as well as a valuation of transformation processes according to the criterion of efficiency. Cultural and social sciences examine the feedback effects between use, social development and cultural self-perception. They illustrate the dynamic interactions between usage forms, socio-cultural lifestyles and control forms.

Interdisciplinary, problem-oriented and system-related research contribute to forming a basic stock of findings and insights about functional links in the relationship between human interventions and the environment and also in developing constructive proposals as to how the basic question of an ethically justified use of the natural environment can be answered in agreement with the actors concerned (WBGU 2000) .

Accordingly, in order to ensure sufficient environmental protection, scientific research, but especially transdisciplinary system research at the interface between natural sciences and social sciences is essential. Bringing together the results of interdisciplinary research, the policy-relevant choice of knowledge banks and balanced interpretation in an environment of uncertainty and ambivalence are difficult tasks that primarily have to be performed by the science system itself. How this can happen in a way that is methodslogically sound, receptive to all reasonable aspects of interpretation and yet subjectively valid will be the subject of Section 4.3.3.

But knowledge alone does not suffice. In order to be able to act effectively and efficiently while observing ethical principles, it is necessary to shape the appreciation process between the various options for action according to rational criteria (Gethmann 1998) . To do this it is, first of all, necessary to identify the dimensions that should be used for a valuation. The discussion about the value dimensions to be used as a basis for valuation is one of the most popular subjects within environmental ethics. To apply these criteria in risk evaluation and to combine the knowledge aspects about expected consequences of different behavioural options with the ethical principles is the task of what we have called risk governance.

What contribution do ethics make towards clarifying the prospects and limits of human interventions into the natural environment? The use of environmental resources is an anthropological necessity. Human consciousness works reflexively and humans have developed a causal recognition capacity that enables them to record cause and effect anticipatively and to productively incorporate assessed consequences in their own action. This knowledge is the motivating force behind the cultural evolution and the development of technologies, agriculture and urbanization. With power over an ever-increasing potential of design and intervention in nature and social affairs over the course of human history, the potential for abuse and exploitation has also grown. Whereas this potential was reflected in philosophical considerations and legal standards at a very early stage with regard to moral standards between people, the issue of human responsibility towards nature and the environment has only become the subject of intensive considerations in recent times. Ethical considerations are paramount in this respect. On the one hand, they offer concrete standards for human conduct on the bases of criteria that can be generalized, and, on the other hand, they provide procedural advice about a rational and decision-and policy-making process.

A simple breakdown into categorical rules and prohibitions that are capable of being compensated can assist decision makers for the justification of principles and standards on environmental protection. As soon as human activities exceed the guidelines of the categorical principles, there is an urgent need for action. How can we detect whether such an excess has happened and how it can be prevented from the very outset that these inviolable standards and principles be exceeded? Here are three strategies of environmental protection to be helpful for the implementation of categor-ical guidelines. The first strategy is that of complete protection with severe restrictions of all use by humans (protection priority). The second strategy provides for a balanced relationship between protection and use, where extensive resource use should go hand in hand with the conservation of the ecosystems concerned (equal weight). The third strategy is based on optimum use involving assurance of continuous reproduction. The guiding principle here would be an intensive and, at the same time, sustainable, i.e. with a view to the long term, use of natural resources (use priority).

The following section will present a framework for applying these principles into environmental decision making under risk. The main line of argument is that risk management requires an analytic-deliberative approach for dealing effectively and prudently with environmental risks.

Assessing potential consequences of human interventions and evaluating their desirability on the basis of subsequent knowledge and transparent valuation criteria are two of the central tasks of a risk governance process. However, the plural values of a heterogeneous public and people's preferences have to be incorporated in this process. But how can this be done given the wealth of competing values and preferences? Should we simply accept the results of opinion polls as the basis for making political decisions? Can we rely on risk perception results to judge the seriousness of pending risks? Or should we place all our faith in professional risk management? If we turn to professional help to deal with plural value input, economic theory might provide us an answer to this problem. If environmental goods are made individual and suitable for the market by means of property rights, the price that forms on the market ensures an appropriate valuation of the environmental good. Every user of this good can then weigh up whether he is willing to pay the price or would rather not use the good. With many environmental goods, however, this valuation has to be made by collective action, because the environmental good concerned is a collective or open access good. In this case a process is needed that safeguards the valuation and justifies it to the collective. However, this valuation cannot be determined with the help of survey results. Although surveys are needed to be able to estimate 234

the breadth of preferences and people's willingness to pay, they are insufficient for a derivation of concrete decision-making criteria and yardsticks for evaluating the tolerability of risks to human health and the environment.

• Firstly, the individual values are so widely scattered that there is little sense in finding an average value here. • Secondly, the preferences expressed in surveys change much within a short time, whereas ethical valuations have to be valid for a long time. • Thirdly, as outlined in the subsection on risk perception, preferences are frequently based on flawed knowledge or ad hoc assumptions both of which should not be decisive according to rational considerations.

What is needed, therefore, is a gradual process of assigning trade-offs in which existing empirical values are put into a coherent and logically consistent form.

In political science and sociological literature reference is mostly made to three strategies of incorporating social values and preferences in rational decision-making processes (Renn 1997) . Firstly, a reference to social preferences is viewed solely as a question of legitimate procedure (Luhmann 1983 , Vollmer 1996 . The decision is made on the basis of formal decision-making process (such as majority voting). If all the rules have been kept, a decision is binding, regardless of whether the subject matter of the decision can be justified or whether the people affected by the decision can understand the justification. In this version, social consensus has to be found only about the structure of the procedures; the only people who are then involved in the decisions are those who are explicitly legitimated to do so within the framework of the procedure decided upon.

The second strategy is to rely on the minimum consensuses that have developed in the political opinion-forming process (muddling through) (Lindbloom 1959 (Lindbloom , 1965 . In this process, only those decisions that cause the least resistance in society are considered to be legitimate. In this version of social pluralism groups in society have an influence on the process of the formation of will and decision making to the extent that they provide proposals capable of being absorbed, i.e. adapted to the processing style of the political system, and that they mobilize public pressure. The proposal that then establishes itself in politics is the one that stands up best in the competition of proposals, i.e. the one that entails the fewest losses of support for political decision makers by interest groups.

The third strategy is based on the discussion between the groups involved (Habermas 1971 , Renn 2004 ). In the communicative exchange among the people involved in the discussion a form of communicative rationality that everyone can understand evolves that can serve as a justification for collectively binding decisions. At the same time, discursive methods claim to more appropriately reflect the holistic nature of human beings and also to provide fair access to designing and selecting solutions to problems. In principle, the justification of standards relevant to decisions is linked to two conditions: the agreement of all involved and substantial justification of the statements made in the discussion (Habermas 1981) .

All three strategies of political control are represented in modern societies to a different extent. Legitimation conflicts mostly arise when the three versions are realized in their pure form. Merely formally adhering to decisionmaking procedures without a justification of content encounters a lack of understanding and rejection among the groups affected especially when they have to endure negative side effects or risks. Then acceptance is refused. If, however, we pursue the opposite path of least resistance and base ourselves on the route of muddling through we may be certain of the support of the influential groups, but, as in the first case, the disadvantaged groups will gradually withdraw their acceptance because of insufficient justification of the decision. At the same time, antipathy to politics without a line or guidance is growing, even the affected population. The consequence is political apathy.

The third strategy of discursive control faces problems, too. Although in an ideal situation it is suitable for providing transparent justifications for the decision-making methods and the decision itself, in real cases the conditions of ideal discourse can rarely be adhered to (Wellmer 1992) . Frequently, discussions among strategically operating players lead to a paralysis of practical politics by forcing endless marathon meetings with vast quantities of points of order and peripheral contributions to the discussion. The "dictatorship of patience" (Weinrich 1972) ultimately determines which justifications are accepted by the participants. The public becomes uncertain and disappointed by such discussions that begin with major claims and end with trivial findings.

In brief: none of the three ways out of the control dilemma can convince on its own; as so often in politics, everything depends on the right mixture. What should a mixture of the three elements (due process, pluralistic muddling through and discourse) look like so that a maximum degree of rationality can come about on the basis of social value priorities?

A report by the American Academy of Sciences on the subject of "Understanding environmental risks" (National Research Council 1996) comes to the conclusion that scientifically valid and ethically justified procedure for the collective valuation of options for risk handling can only be realized within the context of -what the authors coin -an analytic-deliberative process. Analytic means that the best scientific findings about the possible consequences and conditions of collective action are incorporated in the negotiations; deliberative means that rationally and ethically transparent criteria for making trade-offs are used and documented externally. Moreover, the authors consider that fair participation by all groups concerned is necessary to ensure that the different moral systems that can legitimately exist alongside each other should also be incorporated in the process.

To illustrate the concept of analytic-deliberative decision making consider a set of alternative options or choices, from which follow consequences (see basic overview in Dodgson et al. 2000) . The relationship between the choice made, and the consequences that follow from this choice, may be straightforward or complex. The science supporting environmental policy is often complicated, across many disciplines of science and engineering, and also involving human institutions and economic interactions. Because of limitations in scientific understanding and predictive capabilities, the consequences following a choice are normally uncertain. Finally, different individuals and groups within society may not agree on how to evaluate the consequences -which may involve a detailed characterization of what happens in ecological, economic, and human health terms. We shall describe consequences as ambiguous when there is this difficulty in getting agreement on how to interpret and evaluate them. This distinction has been further explained in Chapter 3 (see also Klinke and Renn 2002) .

Environmental assessment and environmental decision making inherently involve these difficulties of complexity, uncertainty, and ambiguity (Klinke and Renn 2002) . In some situations where there is lots of experience, these difficulties may be minimal. But in other situations these difficulties may constitute major impediments to the decision-making process. To understand how analysis and deliberation interact in an iterative process following the National Research Council (NRC) 1996 report, one must consider how these three areas of potential difficulty can be addressed. It is useful to separate questions of evidence with respect to the likelihood, magnitude of consequences and related characteristics (which can involve complexity and uncertainty) from valuation of the consequences (i.e. ambiguity). For each of the three areas there are analytical tools that can be helpful in identifying, characterizing and quantifying cause-effect relationships. Some of these tools have been described in Chapter 3. The integration of these tools of risk governance into a consistent procedure will be discussed in the next subsections.

The possibility to reach closure on evaluating risks to human health or the environment rests on two conditions: first, all participants need to achieve closure on the underlying goal (often legally prescribed, such as prevention of health detriments or guarantee of an undisturbed environmental quality, for example, purity laws for drinking water); secondly, they need to agree with the implications derived from the present state of knowledge (whether and to what degree the identified hazard impacts the desired goal). Dissent can result from conflicting values as well as conflicting evidence. It is crucial in environmental risk management to investigate both sides of the coin: the values that govern the selection of the goal and the evidence that governs the selection of cause-effect claims.

Strong differences in both areas can be expected in most environmental decision-making contexts but also in occupational health and safety and public health risks. So for all risk areas it is necessary to explore why people disagree about what to do -that is, which decision alternative should be selected. As pointed out before, differences of opinion may be focused on the evidence of what is at stake or which option has what kind of consequences. For example: What is the evidence that an environmental management initiative will lead to an improvement, such as reducing losses of agricultural crops to insect pests -and what is the evidence that the management initiative could lead to ecological damage -loss of insects we value, such as bees or butterflies, damage to birds and other predators that feed on insects -and health impacts from the level of pesticides and important nutrients in the food crops we eat?

Other differences of opinion may be about values -value of food crops that contain less pesticide residue compared to those that contain more, value of having more bees or butterflies, value of maintaining indigenous species of bees or butterflies compared to other varieties not native to the local ecosystem, value ascribed to good health and nutrition, and maybe, value ascribed to having food in what is perceived to be a "natural" state as opposed to containing manufactured chemical pesticides or altered genetic material.

Separating the science issues of what will happen from the value issues of how to make appropriate trade-offs between ecological, economic, and human health goals can become very difficult. The separation of facts and values in decision making is difficult to accomplish in practical decision situations, since what is regarded as facts includes a preference dependent process of cognitive framing (Tversky and Kahneman 1981) and what is regarded as value includes a prior knowledge about the factual implica-tions of different value preferences (Fischhoff 1975) . Furthermore, there are serious objections against a clear-cut division from a sociological view on science and knowledge generation (Jasanoff 1996) . Particularly when calculating risk estimates, value-based conventions may enter the assessment process. For example, conservative assumptions may be built into the assessment process, so that some adverse effects (such as human cancer from pesticide exposure) are much less likely to be underestimated than overestimated (National Research Council 1983) . At the same time, ignoring major sources of uncertainty can evoke a sense of security and overconfidence that is not justified from the quality or extent of the data base (Einhorn and Hogarth 1978) . Perceptions and world views may be very important, and difficult to sort out from matters of science, especially with large uncertainties about the causes of environmental damage.

A combination of analytic and deliberative processes can help explore these differences of opinions relating to complexity, uncertainty, and ambiguity in order to examine the appropriate basis for a decision before the decision is made. Most environmental agencies go through an environmental assessment process and provide opportunities for public review and comment. Many controversial environmental decisions become the focus of large analytical efforts, in which mathematical models are used to predict the environmental, economic, and health consequences of environmental management alternatives. Analysis should be seen as an indispensable complement to deliberative processes, regardless whether this analysis is sophisticated or not. Even simple questions need analytic input for making prudent decisions, especially in situations where there is controversy arising from complexity, uncertainty, and ambiguity.

In many policy arenas in which problems of structuring human decisions are relevant, the tools of normative decision analysis (DA) have been applied. Especially in economics, sociology, philosophical ethics, and also many branches of engineering and science, these methods have been extended and refined during the past several decades. (Edwards 1954 , Howard 1966 , North 1968 , Howard et al. 1972 , North and Merkhofer 1976 , Behn and Vaupel 1982 , Pinkau and Renn 1998 , van Asselt 2000 , Jaeger et al. 2001 . DA is a process for decomposing a decision problem into pieces, starting with the simple structure of alternatives, information, and prefer-ences. It provides a formal framework for quantitative evaluation of alternative choices in terms of what is known about the consequences and how the consequences are valued (Hammond et al. 1999 , Skinner 1999 .

The procedures and analytical tools of DA provide a number of possibilities to improve the precision and transparency of the decision procedure. However, they are subject to a number of limitations. The opportunities refer to:

• Different action alternatives can be quantitatively evaluated to allow selection of a best choice. Such evaluation relies both on a description of uncertain consequences for each action alternative, with uncertainty in the consequences described using probabilities, and a description of the values and preferences assigned to consequences. (Explicit characterization of uncertainty and values of consequences) • The opportunity to assure transparency, in that (1) models and data summarizing complexity (e.g., applicable and available scientific evidence) (2) probabilities characterizing judgement about uncertainty, and (3) values (utilities) on the consequences are made explicit and available. So the evaluation of risk handling alternatives can be viewed and checked for accuracy by outside observers. (Outside audit enabled of basis for decision) • A complex decision situation can be decomposed into smaller pieces in a formal analytical framework. The level of such composition can range from a decision tree of action alternatives and ensuing consequences that fits on a single piece of paper, to extremely large and complex computerimplemented models used in calculating environmental consequences and ascribing probabilities and values of the consequences. A more complex analysis is more expensive and is less transparent to observers. In principle, with sufficient effort any formal analytical framework can be checked to assure that calculations are made in the way that is intended.

(Decomposition possible to include extensive detail)

On the other hand, there are important limitations:

• Placing value judgements (utilities) on consequences may be difficult, especially in a political context where loss of life, impairment of health, ecological damage, or similar social consequences are involved. Utility theory is essentially an extension of cost-benefit methods from economics to include attitude toward risk. The basic trade-off judgements needed for cost-benefit analysis remain difficult and controversial, and often, inherently subjective. (Difficulties in valuing consequences) • Assessing uncertainty in the form of a numerical probability also poses difficulties, especially in situations when there is not a statistical data base on an agreed-on model as the basis for the assessment. (Difficulty in quantifying uncertainty, assigning probabilities) • The analytical framework may not be complete. Holistic or overarching considerations or important details may have been omitted. (Analytical framework incomplete) • DA is built upon an axiomatic structure, both for dealing with uncertainty (i.e., the axiomatic foundation of probability theory), and for valuing consequences (i.e., the axiomatic basis for von Neumann-Morgenstern utility theory). Especially when the decision is to be made by a group rather than an individual decision maker, rational preferences for the group consistent with the axioms may not exist (the "Impossibility" Theorem of Arrow, 1951) . So in cases of strong disagreements on objectives or unwillingness to use a rational process, decision analysis methods may not be helpful.

Decision analytical methods should not be regarded as inherently "mechanical" or "algorithmic", in which analysts obtain a set of "inputs" about uncertainty and valuing consequences, then feed these into a mathematical procedure (possibly implemented in a computer) that produces an "output" of the "best" decision. DA can only offer coherent conclusions from the information which the decision maker provides by his/her preferences among consequences and his/her state of information on the occurrence of these consequences. Where there is disagreement about the preferences or about the information, DA may be used to implore the implications of such disagreement. So in application, there is often a great deal of iteration (sensitivity analysis) to explore how differences in judgement should affect the selection of the best action alternative. DA thus merely offers a formal framework that can be effective in helping participants in a decision process to better understand the implications of differing information and judgement about complex and uncertain consequences from the choice among the available action alternatives. Insight about which factors are most important in selecting among the alternatives is often the most important output of the process, and it is obtained through extensive and iterative exchange between analysts and the decision makers and stakeholders. The main advantage of the framework is that it is based on logic that is both explicit and checkable -usually facilitated by the use of mathematical models and probability calculations. Research on human judgement supports the superiority of such procedures for decomposing complex decision problems and using logic to integrate the pieces, rather than relying on holistic judgement on which of the alternatives is best (this is not only true for individual decisions, see Heap et al. 1992 : 36ff., Jungermann 1986 ; but also for collective decisions, see Heap et al. 1992 : 197ff., Pettit 1991 . One should keep in mind, however, that "superior" is measured in accordance with indicator of instrumental rationality, i.e. measuring means-ends effectiveness. If this rationality is appropriate, the sequence suggested by DA is intrinsically plausible and obvious. Even at the level of qualitative discussion and debate, groups often explore the rationale for different action alternatives. Decision analysis simply uses formal quantitative methods for this traditional and common-sense process of exploring the rationale -using models to describe complexity, probability to describe uncertainty, and to deal with ambiguity, explicit valuation of consequences via utility theory and other balancing procedures, such as cost-benefit or cost-effectiveness analyses. By decomposing the problem in logical steps, the analysis permits better understanding of differences in the participants' perspective on evidence and values. DA offers methods to overcome these differences, such as resolving questions about underlying science through data collection and research, and encouraging tradeoffs, compromise, and rethinking of values.

Based on this review of opportunities and shortcomings we conclude that decision analysis provides a suitable structure for guiding discussion and problem formulation, and offers a set of quantitative analytical tools that can be useful for environmental decisions, especially in conjunction with deliberative processes. DA can assist decision makers and others involved in, and potentially affected by, the decision (i.e., participants, stakeholders) to deal with complexity and many components of uncertainty, and to address issues of remaining uncertainties and ambiguities. Using these methods promises consistency from one decision situation to another, assurance of an appropriate use of evidence from scientific studies related to the environment, and explicit accountability and transparency with respect to those institutionally responsible for the value judgements that drive the evaluation of the alternative choices. Collectively the analytical tools provide a framework for a systematic process of exploring and evaluating the decision alternatives -assembling and validating the applicable scientific evidence relevant to what will happen as the result of each possible choice, and valuing how bad or how good these consequences are based on an agreement of common objectives. Yet, it does not replace the need for additional methods and processes for including other objectives, such as finding common goals, defining preferences, revisiting assumptions, sharing visions and exploring common grounds for values and normative positions.

The value judgements motivating decisions are made explicit and can then be criticized by those who were not involved in the process. To the extent that uncertainty becomes important, it will be helpful to deal with uncertainty in an orderly and consistent way (Morgan and Henrion 1990). Those aspects of uncertainty that can be modelled by using probability theory (inter-target variation, systematic and random errors in applying inferential statistics, model and data uncertainties) will be spelled out and those that remain in forms of indeterminacies, system boundaries or plain ignorance will become visible and can then be fed into the deliberation process (van Asselt 2000, Klinke and Renn 2002) .

The term deliberation refers to the style and procedure of decision making without specifying which participants are invited to deliberate (National Research Council (NRC) 1996, Rossi 1997) . For a discussion to be called deliberative it is essential that it relies on mutual exchange of arguments and reflections rather than decision making based on the status of the participants, sublime strategies of persuasion, or social-political pressure. Deliberative processes should include a debate about the relative weight of each argument and a transparent procedure for balancing pros and cons (Tuler and Webler 1999) . In addition, deliberative processes should be governed by the established rules of a rational discourse. In the theory of communicative action developed by the German philosopher Jürgen Habermas, the term discourse denotes a special form of a dialogue, in which all affected parties have equal rights and duties to present claims and test their validity in a context free of social or political domination (Habermas 1970 (Habermas , 1987b . A discourse is called rational if it meets the following specific requirements (see McCarthy 1975 , Habermas 1987a , Kemp 1985 , Webler 1995 . All participants are obliged:

• to seek a consensus on the procedure that they want to employ in order to derive the final decision or compromise, such as voting, sorting of positions, consensual decision making or the involvement of a mediator or arbitrator; • to articulate and criticize factual claims on the basis of the "state of the art" of scientific knowledge and other forms of problem-adequate knowledge; (in the case of dissent all relevant camps have the right to be represented); • to interpret factual evidence in accordance with the laws of formal logic and analytical reasoning; • to disclose their relevant values and preferences, thus avoiding hidden agendas and strategic game playing; and

• to process data, arguments and evaluations in a structured format (for example a decision-analytic procedure) so that norms of procedural rationality are met and transparency can be created.

The rules of deliberation do not necessarily include the demand for stakeholder or public involvement. Deliberation can be organized in closed circles (such as conferences of Catholic bishops, where the term has indeed been used since the Council of Nicosia), as well as in public forums. It may be wise to use the term "deliberative democracy" when one refers to the combination of deliberation and public or stakeholder involvement (see also Cohen 1997 , Rossi 1997 . What needs to be deliberated? Firstly, deliberative processes are needed to define the role and relevance of systematic and anecdotal knowledge for making far-reaching choices. Secondly, deliberation is needed to find the most appropriate way to deal with uncertainty in environmental decision making and to set efficient and fair trade-offs between potential over-and under-protection. Thirdly, deliberation needs to address the wider concerns of the affected groups and the public at large.

Why can one expect that deliberative processes are better suited to deal with environmental challenges than using expert judgement, political majority votes or relying on public survey data?

• Deliberation can produce common understanding of the issues or the problems based on the joint learning experience of the participants with respect to systematic and anecdotal knowledge (Webler and Renn 1995 , Pidgeon 1997 ). • Deliberation can produce a common understanding of each party's position and argumentation and thus assist in a mental reconstruction of each actor's argumentation (Warren 1993 , Tuler 1996 . The main driver for gaining mutual understanding is empathy. The theory of communicative action provides further insights in how to mobilize empathy and how to use the mechanisms of empathy and normative reasoning to explore and generate common moral grounds (Webler 1995). • Deliberation can produce new options and novel solutions to a problem.

This creative process can either be mobilized by finding win-win solutions or by discovering identical moral grounds on which new options can grow (Renn 1999) . • Deliberation has the potential to show and document the full scope of ambiguity associated with environmental problems. Deliberation helps to make a society aware of the options, interpretations, and potential actions that are connected with the issue under investigation (Wynne 1992, De Marchi and Ravetz 1999) . Each position within a deliberative discourse can only survive the crossfire of arguments and counter-arguments if it demonstrates internal consistency, compatibility with the legitimate range of knowledge claims and correspondence with the widely accepted norms and values of society. Deliberation clarifies the problem, makes people aware of framing effects, and determines the limits of what could be called reasonable within the plurality of interpretations (Skillington 1997) . • Deliberations can also produce agreements. The minimal agreement may be a consensus about dissent (Raiffa 1994) . If all arguments are exchanged, participants know why they disagree. They may not be convinced that the arguments of the other side are true or morally strong enough to change their own position; but they understand the reasons why the opponents came to their conclusion. In the end, the deliberative process produces several consistent and -in their own domain -optimized positions that can be offered as package options to legal decision makers or the public. Once these options have been subjected to public discourse and debate, political bodies, such as agencies or parliaments can make the final selection in accordance with the legitimate rules and institutional arrangements such as majority vote or executive order. Final selections could also be performed by popular vote or referendum. • Deliberation may result in consensus. Often deliberative processes are used synonymously with consensus-seeking activities (Coglianese 1997 ). This is a major misunderstanding. Consensus is a possible outcome of deliberation, but not a mandatory requirement. If all participants find a new option that they all value more than the one option that they preferred when entering the deliberation, a "true" consensus is reached (Renn 1999) . It is clear that finding such a consensus is the exception rather than the rule. Consensus is either based on a win-win solution or a solution that serves the "common good" and each participant's interests and values better than any other solution. Less stringent is the requirement of a tolerated consensus. Such a consensus rests on the recognition that the selected decision option might serve the "common good" best, but on the expense of some interest violations or additional costs. In a tolerated consensus some participants voluntarily accept personal or group-specific losses in exchange for providing benefits to all of society. Case studies have provided sufficient evidence that deliberation has produced a tolerated consensus solution, particularly in siting conflicts (one example in Schneider et al. 1998) . Consensus and tolerated consensus should be distinguished from compromise. A compromise is a product of bargaining where each side gradually reduces its claim to the opposing party until they reach an agreement (Raiffa 1994) . All parties involved would rather choose the option that they preferred before starting deliberations, but since they cannot find a win-win situation or a morally superior alternative they look for a solution that they can "live with" knowing that it is the second or third best solution for them. Compromising on an issue relies on full representation of all vested interests.

In summary, many desirable products and accomplishments are associated with deliberation (Chess et al. 1998) . Depending on the structure of the discourse and the underlying rationale deliberative processes can:

• enhance understanding;

• generate new options;

• decrease hostility and aggressive attitudes among the participants;

• explore new problem framing;

• enlighten legal policy-makers;

• produce competent, fair and optimized solution packages; and • facilitate consensus, tolerated consensus and compromise.

In a deliberative setting, participants exchange arguments, provide evidence for their claims and develop common criteria for balancing pros and cons. This task can be facilitated and often guided by using decision analytic tools (overview in Merkhofer 1984) . Decision theory provides a logical framework distinguishing action alternatives or options, consequences, likelihood of consequences, and value of consequences, where the valuation can be over multiple attributes that are weighted based on tradeoffs in multi-attribute utility analysis (Edwards 1977) . A sequence of decisions and consequences may be considered, and use of mathematical models for predicting the environmental consequences of options may or may not be part of the process (Humphreys 1977 , Bardach 1996 , Arvai et al. 2001 ):

a) The structuring potential of decision analysis has been used in many participatory processes. It helps the facilitator of such processes to focus on one element during the deliberation, to sort out the central from the peripheral elements, provide a consistent reference structure for ordering arguments and observations and to synthesize multiple impressions, observations and arguments into a coherent framework. The structuring power of decision analysis has often been used without expanding the analysis into quantitative modelling. b) The second potential, agenda setting and sequencing, is also frequently applied in participatory settings. It often makes sense to start with problem definition, then develop the criteria for evaluation, generate options, assess consequences of options, and so on. c) The third potential, quantifying consequences, probabilities and relative weights and calculating expected utilities, is more controversial than the other two. Whether the deliberative process should include a numerical analysis of utilities or engage the participants in a quantitative elicitation process is contested among participation practitioners . One side claims that quantifying helps participants to be more precise about their judgements and to be aware of the often painful trade-offs they are forced to make. In addition, quantification can make judgements more transparent to outside observers. The other side claims that quantification restricts the participants to the logic of numbers and reduces the complexity of argumentation into a mere trade-off game. Many philosophers argue that quantification supports the illusion that all values can be traded off against other values and that complex problems can be reduced to simple linear combinations of utilities. One possible compromise between the two camps may be to have participants go through the quantification exercise as a means to help them clarify their thoughts and preferences, but make the final decisions on the basis of holistic judgements (Renn 1986) . In this application of decision analytic procedures, the numerical results (i.e. for each option the sum over the utilities of each dimension multiplied by the weight of each dimension) of the decision process are not used as expression of the final judgement of the participant, but as a structuring aid to improve the participant's holistic, intuitive judgement. By pointing out potential discrepancies between the numerical model and the holistic judgements, the participants are forced to reflect upon their opinions and search for potential hidden motives or values that might explain the discrepancy.

In a situation of major value conflicts, the deliberation process may involve soliciting a diverse set of viewpoints, and judgements need to be made on what sources of information are viewed as responsible and reliable. Publication in scientific journals and peer review from scientists outside the government agency are the two most popular methods by which managers or organizers of deliberative processes try to limit what will be considered as acceptable evidence. Other methods are to reach a consensus among the participants up front which expertise should be included in the deliberation or to appoint representatives of opposing science camps to explain their differences in public. In many cases, participants have strong reasons for questioning scientific orthodoxy and would like to have different science camps represented. Many stakeholders in environmental decisions have access to expert scientists, and often such scientists will take leading roles in criticizing agency science. Such discussions need to be managed so that disagreements among the scientific experts can be evaluated in terms of the validity of the evidence presented and the importance to the decision. It is essential in these situations to have a process in place that distinguishes between those evidence claims that all parties agree on, those where the factual base is shared but not its meaning for some quality criterion (such as "healthy" environment), and those where even the factual base is contested (Foster 2002) .

In the course of practical risk management different conflicts arise in deliberative settings that have to be dealt with in different ways. The main conflicts occur at the process level (how should the negotiations be conducted?), on the cognitive level (what is factually correct?), the interest level (what benefits me?), the value level (what is needed for a "good" life?) and the normative level (what can I expect of all involved?). These different conflict levels are addressed in this subsection. First of all, negotiations begin by specifying the method that structures the dialogue and the rights and duties of all participants. It is the task of the chairman or organizer to present and justify the implicit rules of the talks and negotiations. Above and beyond this, the participants have to specify joint rules for decisions, the agenda, the role of the chairman, the order of hearings, etc. This should always be done according to the consensus principle. All partners in the negotiations have to be able to agree to the method. If no agreement is reached here the negotiations have to be interrupted or reorganized.

Once the negotiation method has been determined and, in a first stage, the values, standards and objectives needed for judgement have been agreed jointly, then follows the exchange of arguments and counter arguments. In accordance with decision theory, four stages of validation occur:

• In a first stage, the values and standards accepted by the participants are translated into criteria and then into indicators (measurement instructions). This translation needs the consensual agreement of all participants. Experts are asked to assess the available options with regard to each indicator according to the best of their knowledge (factual correctness). In this context it makes more sense to specify a joint methodological procedure or a consensus about the experts to be questioned than to give each group the freedom to have the indicators answered by their own experts. Often many potential consequences remain disputed as a result of this process, especially if they are uncertain. However, the bandwidth of possible opinions is more or less restricted depending on the level of certainty and clarity associated with the issue in question. Consensus on dissent is also of help here in separating contentious factual claims from undisputed ones and thus promotes further discussion. • In a second stage, all participating parties are required to interpret bandwidths of impacts to be expected for each criterion. Interpretation means linking factual statements with values and interests to form a balanced overall judgement (conflicts of interests and values). This judgement can and should be made separately for each indicator. In this way, each of the chains of causes for judgements can be understood better and criticized in the course of the negotiations. For example, the question of trustworthiness of the respective risk management agencies may play an important role in the interpretation of an expected risk value. Then it is the duty of the participating parties to scrutinize the previous performance of the authority concerned and propose institutional changes where appropriate. • Third stage: Even if there were a joint assessment and interpretation for every indicator, this would by no means signify that agreement is at hand. Much rather, the participants' different judgements about decisionmaking options may be a result of different value weightings for the indicators that are used as a basis for the values and standards. For example, a committed environmentalist may give much more weight to the indicator for conservation than to the indicator of efficiency. In the literature on game theory, this conflict is considered to be insoluble unless one of the participants can persuade the other to change his preference by means of compensation payments (for example, in the form of special benefits), transfer services (for example, in the form of a special service) or swap transactions (do, ut des). In reality, however, it can be seen that participants in negotiations are definitely open to the arguments of the other participants (i.e. they may renounce their first preference) if the loss of benefit is still tolerable for them and, at the same time, the proposed solution is considered to be "conducive to the common good", i.e. is seen as socially desirable in public perception. If no consensus is reached, a compromise solution can and should be reached, in which a 'fair' distribution of burdens and profits is accomplished. • Fourth stage: When weighing up options for action formal methods of balancing assessment can be used. Of these methods, the cost-benefit analysis and the multi-attribute or multi-criteria decision have proved their worth. The first method is largely based on the approach of revealed "preferences", i.e. on people's preferences shown in the past expressed in relative prices, the second on the approach of "expressed preferences", i.e. the explicit indication of relative weightings between the various cost and benefit dimensions (Fischhoff et al. 1982) . But both methods are only aids in weighing up and cannot replace an ethical reflection of the advantages and disadvantages.

Normative conflicts pose special problems because different evaluative criteria can always be classified as equally justifiable or unjustifiable as explained earlier. For this reason, most ethicists assume that different types and schools of ethical justification can claim parallel validity, it therefore remains up to the groups involved to choose the type of ethically legitimate justification that they want to use (Ropohl 1991 , Renn 1997 . Nevertheless, the limits of particular justifications are trespassed wherever primary principles accepted by all are infringed (such as human rights). Otherwise, standards should be classed as legitimate if they can be defended within the framework of ethical reasoning and if they do not contradict universal standards that are seen as binding for all. In this process conflicts can and will arise, e.g. that legitimate derivations of standards from the perspective of Group A contradict the equally legitimate derivations of Group B (Shrader-Frechette 1988). In order to reach a jointly supported selection of standards, either a portfolio of standards that can claim parallel validity should be drawn up or compensation solutions will have to be created in which one party compensates the other for giving up its legitimate options for action in favour of a common option. When choosing possible options for action or standards, options that infringe categorical principles, for example, to endangering the systematic ability of the natural environment to function for human use in the future and thus exceeding the limits of tolerability are not tolerable even if they imply major benefits to society. At the same time, all sub-dominant options have to be excluded. Frequently sub-dominant solutions, i.e. those that perform worse than all other options with regard to all criteria at least in the long term, are so attractive because they promise benefits in the short term although they entail losses in the long term, even if high interest rates are assumed. Often people or groups have no choice other than to choose the sub-dominant solution because all other options are closed to them due to a lack of resources. If large numbers of groups or many individuals act in this way, global risks become unmanageable (Beck 1996) . To avoid these risks intermediate financing or compensation by third parties should be considered.

The objective of this last section of Chapter 4 was to address and discuss the use of decision analytic tools and structuring aids for participatory processes in environmental management. Organizing and structuring discourses goes beyond the good intention to have all relevant stakeholders involved in decision making. The mere desire to initiate a two-way communication process and the willingness to listen to stakeholder concerns are not sufficient. Discursive processes need a structure that assures the integration of technical expertise, regulatory requirements, and public values. These different inputs should be combined in such a fashion that they contribute to the deliberation process the type of expertise and knowledge that can claim legitimacy within a rational decision-making procedure (von Schomberg 1995). It does not make sense to replace technical expertise with vague public perceptions, nor is it justified to have the experts insert their own value judgements into what ought to be a democratic process.

Decision analytic tools can be of great value for structuring participatory processes. They can provide assistance in problem structuring, in dealing with complex scientific issues and uncertainty, and in helping a diverse group to understand disagreements and ambiguity with respect to values and preferences. Decision analysis tools should be used with care. They do not provide an algorithm to reach an answer as to what is the best decision. Rather, decision analysis is a formal framework that can be used for environmental assessment and risk handling to explore difficult issues, to focus debate and further analysis on the factors most important to the decision, and to provide for increased transparency and more effective exchange of information and opinions among the process participants. The basic concepts are relatively simple and can be implemented with a minimum of mathematics (Hammond et al. 1999) . Many participation organizers have restricted the use of decision analytic tools to assist participants in structuring problems and ordering concerns and evaluations, and have refrained from going further into quantitative trade-off analysis. Others have advocated quantitative modelling as a clarification tool for making value conflicts more transparent to the participants.

The full power of decision analysis for complex environmental problem may require mathematical models and probability assessment. Experienced analysts may be needed to guide the implementation of these analytical tools for aiding decisions. Skilled communicators and facilitators may be needed to achieve effective interaction between analysts and participants in the deliberative process whose exposure to advanced analytical decision aids is much less, so that understanding of both process and substance, and therefore transparency and trust, can be achieved.

Many risk management agencies are already making use of decision analysis tools. We urge them to use these tools in the context of an iterative, deliberative process with broad participation by the interested and affected parties to the decision in the context of the risk governance framework. The analytical methods, the data and judgement, and the assumptions, as well as the analytical results should be readily available and understood by the participants. We believe that both the risk management agencies and the interested groups within the public that government agencies interact with on environmental decisions should all gain experience with these methods. Improper or premature use of sophisticated analytical methods may be more destructive to trust and understanding than helpful in resolving the difficulties of complexity, uncertainty, and ambiguity.

Bioterrorism, Preparedness, Attack and Response. Elsevier

Beyond the Job Exposure Matrix (JEM): The Task Exposure Matrix (TEM)

Chapter 4 Occupational Safety and Health and Environmental Risks

A Task Exposure Database for Use in the Alumina and Primary Aluminium Industry

Work-Related Neck and Upper Limb Musculoskeletal Disorders. European Agency for Safety and Health at Work

Finnish National Job-Exposure Matrix (FINJEM) in Register-Based Cancer Research. People and Work

Toimivat ja terveelliset työajat (Well-Functioning and Healthy Working Times). Finnish Institute of Occupational Health, Ministry of Social Affairs and Health and Ministry of Labour

Finnish Database of Occupational Exposure Measurements (FDOEM). Finnish Institute of Occupational Health, Finland. IOHA, Pilanesberg

Introduction to Occupational Epidemiology

The Environment and Disease: Association or Causation?

The Bradford Hill Considerations on Causality: A Counterfactual Perspective

Work-Related Stress. European Foundation for the Improvement of Living and Working Conditions

The Ageing Workforce -Challenges for Occupational Health

Recommendation Concerning the List of Occupational Diseases and the Recording and Notification of Occupational Accidents and Diseases: R 194. International Labour Conference. International Labour Office

Työuupumus Suomen työikäisellä väestöllä (Burn-Out among the Working-Aged Population in Finland). Finnish Institute of Occupational Health, Helsinki

Work-Related Disease Risk in Different Occupations. Työterveiset 3, Special Issue. Information Newsletter of the Finnish institute of Occupational Health

Ammattitaudit 2000 (Occupational Diseases 2000). Finnish Institute of Occupational Health

Work Is Related to a Substantial Portion of Adult-Onset Asthma Incidence in the Finnish Population

Work Stress in the Etiology of Coronary Heart Disease -A Meta-Analysis

Occupational Injury and Illness in the United States. Estimates of Costs, Morbidity, and Mortality

The Psychology of Extremism and Terrorism: A Middle-Eastern Perspective

Musculoskeletal Disorders and the Workplace: Low Back and Upper Extremities

Testing a Structured Decision Approach: Value Focused Thinking for Deliberative Risk Communication

The Eight-Step Path of Policy Analysis

The Invention of Nature

Ökologische Fragen im Bezugsrahmen fabrizierter Unsicherheiten

Quick Analysis for Busy Decision Makers

Grundzüge der ökologischen Ethik

Natur" als Maßstab menschlichen Handelns. Zeitschrift für Philosophische Forschung

Landschaftsschutz und Artenschutz. Wie weit tragen utilitaristische Begründungen? In: Nutzinger HG

Vorsorge statt Nachhaltigkeit -Ethische Grundlagen der Zukunftsverantwortung

On the Intrinsic Value of Nonhuman Species

Who Should Deliberate When?

Assessing Consensus; The Promise and Performance of Negotiated Rule Making

Procedure and Substance in Deliberative Democracy

Risk Management and Governance: A Post-Normal Science Approach

Deep Ecology: Living as if Nature Mattered

Multi-Criteria Analysis: A Manual. Department of the Environment, Transport and the Regions

The Theory of Decision Making

How to Use Multi-attribute Utility Measurement for Social Decision Making

Beginning Again: People and Nature in the New Millennium

Confidence in Judgment: Persistence of the Illusion of Validity

Environmental Ethics

Hindsight Versus Foresight: The Effect of Outcome Knowledge on Judgment under Uncertainty

The Experienced Utility of Expected Utility Approaches

The Role of Experts in Risk-Based Decision Making. HSE Risk Assessment Policy Unit. Web Manuscript. www.trustnetgovernance.com/library/pdf/doc2

Ökologie und Konsensfindung: Neue Chancen und Risiken

Making Sense of Sustainability: Nine Answers to "What Should Be Sustained?

Literaturreview und Bibliographie. Graue Reihe Nr. 12. Europäische Akademie zur Erforschung von Folgen wissenschaftlich-technischer Entwicklungen

Ethische Aspekte des Handelns unter Risiko

Rationale Technikfolgenbeurteilung

The Value of Biodiversity

Decision Aiding, Not Dispute Resolution: A New Perspective for Environmental Negotiation

Towards a Theory of Communicative Competence

Vorbereitende Bemerkungen zu einer Theorie der kommunikativen Kompetenz

Theorie des kommunikativen Handelns. Suhrkamp, Frankfurt/M

The Philosophical Discourse of Modernity

Smart Choices: A Practical Guide to Making Better Decisions

Marketing und soziale Verantwortung

Foundations of Environmental Ethics

Systemsteuerung und "Staatskunst": Theoretische Konzepte und empirische Befunde. Leske und Budrich

The Theory of Choice: A Practical Guide

Politische Gerechtigkeit. Grundlegung einer kritischen Philosophie von Recht und Staat. Suhrkamp, Frankfurt/M

Welche Natur sollen wir schützen? GAIA

Philosophie der ökologischen Krise

Decision Analysis: Applied Decision Theory

The Foundations of Decision Analysis

The Decision to Seed Hurricanes

Application of Multi-Attribute Utility Theory

Risk Governance: Towards an Integrative Appraoch. IRGC

Beyond Epistemology: Relativism and Engagement in the Politics of Science

Risk, Uncertainty and Rational Action

Das Prinzip Verantwortung. Versuch einer Ethik für die technologische Zivilisation

Judgment and Decision Making: An Interdisciplinary Reader

Planning, Political Hearings, and the Politics of Discourse

Ökologie Global: Die Auswirkungen von Wirtschaftswachstum, Bevölkerungswachstum und zunehmendem Nord-Süd-Gefälle auf die Umwelt

A New Approach to Risk Evaluation and Management: Risk-Based, Precaution-Based and Discourse-Based Management

Naturethik im Überblick

The Science of Muddling Through

The Intelligence of Democracy. Decision Making through Mutual Adjustment

Legitimation durch Verfahren. Suhrkamp, Frankfurt/M

Translator's Introduction

Comparative Analysis of Formal Decision-Making Approaches

Sustainable Development? Wie nicht nur die Menschen eine "dauerhafte" Entwicklung überdauern können

Ist biologisches Produzieren natürlich? Leitbilder einer naturgemäßen Technik

Methodische Philosophie

Umwelt. Bemerkungen eines Philosophen zum umweltverträglichen Wirtschaften

Committee on Institutional Means for Assessing Risk to Public Health (1983) Risk Assessment in the Federal Government: Managing the Process

Ethik des Risikos

Angewandte Ethik. Die Bereichsethiken und ihre theoretische Fundierung

A Tutorial Introduction to Decision Theory

A Methodology for Analyzing Emission Control Strategies

Why Preserve Natural Variety?

Ökologie und Ethik. Ein Versuch praktischer Philosophie. Ethik in den Wissenschaften

Zur ethischen Bewertung von Biodiversität. Externes Gutachten für den WBGU. Unveröffentlichtes Manuskript

Decision Theory and Folk Psychology

Towards a Comprehensive Conservation Theory

The Limits to Safety? Culture, Politics, Learning and Manmade Disasters

Environmental Standards. Scientific Foundations and Rational Procedures of Regulation with Emphasis on Radiological Risk Management

The Art and Science of Negotiation

What mainstream economists have to say about the value of biodiversity

Benefits, Costs, and the Safe Minimum Standard of Conservation

Decision Analytic Tools for Resolving Uncertainty in the Energy Debate

Ökologisch denken -sozial handeln: Die Realisierbarkeit einer nachhaltigen Entwicklung und die Rolle der Sozial-und Kulturwissenschaften

Ein diskursives Verfahren zur Bildung und Begründung kollektiv verbindlicher Bewertungskriterien

A Model for an Analytic-Deliberative Process in Risk Management

The Challenge of Integrating Deliberation and Expertise: Participation and Discourse in Risk Management

A Regional Concept of Qualitative Growth and Sustainability -Support for a Case Study in the German State of Baden-Württemberg

Was heißt hier Bioethik? TAB-Brief

Theologie der Natur und ihre anthriopologisch-ethischen Konsequenzen

Values in Nature and the Nature of Value

Ob man die Ambivalenzen des technischen Fortschritts mit einer neuen Ethik meistern kann?

Participation Run Amok: The Costs of Mass Participation for Deliberative Agency Decisionmaking

Ist die Schöpfung noch zu retten? Umweltkrise und christliche Verantwortung

Experiences from Germany: Application of a Structured Model of Public Participation in Waste Management Planning

Environmental Ethics

Politics and the Struggle to Define: A Discourse Analysis of the Framing Strategies of Competing Actors in a "New

Introduction to Decision Analysis

Corporate Environmentalism in a Global Economy

Respect for Nature. A Theory of Environmental Ethics

Meanings, Understandings, and Interpersonal Relationships in Environmental Policy Discourse. Doctoral Dissertation

Designing an Analytic Deliberative Process for Environmental Health Policy Making in the U.S. Nuclear Weapons Complex

The Framing of Decisions and the Psychology of Choice

Perspectives on Uncertainty and Risk

Akzeptanzbeschaffung: Verfahren und Verhandlungen

The Erosion of the Valuespheres. The Ways in Which Society Copes with Scientific, Moral and Ethical Uncertainty

Can Participatory Democracy Produce Better Selves? Psychological Dimensions of Habermas Discursive Model of Democracy

Welt im Wandel: Erhaltung und nachhaltige Nutzung der Biosphäre. Jahresgutachten 1999

Discourse in Citizen Participation. An Evaluative Yardstick

The Craft and Theory of Public Participation: A Dialectical Process

A Brief Primer on Participation: Philosophy and Practice

System, Diskurs, Didaktik und die Diktatur des Sitzfleisches

Konsens als Telos der sprachlichen Kommunikation? In: Giegel

Biophilia: The Human Bond with Other Species

Rio" oder die moralische Verpflichtung zum Erhalt der natürlichen Vielfalt

Risk and Social Learning: Reification to Engagement

Die Modernisierung der Demokratie im Zeichen der Umweltproblematik

Wandelt sich die Verantwortung mit technischem Wandel?