Accident sequence models

Accident Sequence Modeling using a logic model for the facility was developed. The model included all initiators of potential accidents and the response of the installation to these initiators. Specific accident sequences are defined in event trees consisting of an initiating... 

Note Up to this level, the goal-based safety criteria (either via regulations such as CS/FAR25.1309, or flowed down from the System Level 5 accident sequence models, refer Chapter 11) is the most appropriate method to evaluate an acceptable level of safety. 

One can use accident theories and accident sequence models presented earlier in this chapter to help formulate accident prevention strategies. For example, one can apply Haddon s energy theory to prevent accidents and reduce their consequences or one can apply the 4 Ms model to help think through the elements that may lead to accidents in particular situations. 

Accident Sequence Model (Ramsey, 1978, quoted in Sanders and McCormick, 1987, and Ramsey, 1985)... 

Figure 12-7 Domino accident sequence model. Cox. Sue. Tom Cox. Safety Systems and People, Figure 3.1 (adapted from Heinrich. 1931). p. 51. Butterworth-Heinemann. 1996. Modified with permission.

Figure 5,10 Accident sequence model showing failures in the various human information-processing stages leading to an accident.

Development of accident sequence models for SLP PSA requires a close co-operation between plant personnel who are familiar with an outage and PSA analysts to assure that the all possible scenarios are appropriately modelled. Available accident mitigation measures may be much broader that for the power PSAs. The systems and the plant features which have been credited in power PSA may not be available for shutdown mode (as an example, heat removal using steam generators). The development of sequences should be an iterative process to adequately model sequences which represent actual plant configuration. 

Accident/health and safety criteria (refer to the Health and Safety at Work Act), which considers the risk (i.e. probability and severity) of a potential accident. These criteria are derived from the risk-based approach discussed in Chapter 4, which is based on an accident sequence model," a simple example is illustrated by Fig. B.2. 

For the variety of systems and operational conditions within the MOD S remit, DEF STAN 00-56 Part 1 Para 7.3.2 categorises accident severity in accordance with the impact on personnel as defined in Table B.7. The DEF STAN 00-56 approach assumes an accident sequence model similar to that shown in Fig. B.3. The hazard is that state of the system being considered which causes/permits/exacerbates the risk of the accident arising. The probability of the accident is dependent on the probability of the system hazard and the probability of the intermediate events (considered to be external to the system, but are necessary conditions for the accident to occur). In accordance with DEF STAN 00-56 Part 1 para 7.3.2(d) the accident probability of occurrence shall be categorised during risk estimation in accordance with the definitions in Table B.8. 

The models you use to portray failures that lead to accidents, and the models you use to propagate their effects, are attempts to approximate reality. Models of accident sequences (although mathematically rigorous) cannot be demonstrated to be exact because you can never precisely identify all of the factors that contribute to an accident of interest. Likewise, most consequence models are at best correlations derived from limited experimental evidence. Even if the models are validated through field experiments for some specific situations, you can never validate them for all possibilities, and the question of model appropriateness will always exist. 

A logic model that graphically portrays the range of outcomes from the combinations of events and circumstances in an accident sequence. For example, a flammable vapor release may result in a fire, an explosion, or in no consequence depending on meteorological conditions, the degree of confinement, the presence of ignition sources, etc. These trees are often shown with the probability of each outcome at each branch of the pathway... 

Step 2 - Construct a global digraph model for each accident sequence. 

Step 3 - Partition digraph models into independent subdigraphs and find singleton and doubleton minimum cutsets of accident sequences. 

Since this text is not solely devoted to HRA, the above process is by necessity simplified. A more defined interaction is shown in Figure 4.5-2. Here HRA interacts with the development of the system models and feeds into not only the accident sequences but also the physical analysis of the inplant and explant accident progress,... 

The accident sequence frequencies are quantified by linking the system fault tree models together as indicated by the event trees for the accident sequence and quantified with plant-specific data to estimate initiator frequencies and component/human failure rates. The SETS code solves the fault trees for their minimal cutsets the TEMAC code quantitatively evaluates ihe cm sols and provides best estimates of component/event probabilities and frequencies. 

Accident Sequence Quantification estimates the IE frequency. Specifically, the plant model built in the Step 2 is quantified by data from Step 3 according to Boolean algebra. Quantification may be a point-value calculation in which all parameters are delermimsiic, or as uncertain values known by their distribution function. 

Embrey, D. E. (1985). Modelling and Assisting the Operator s Diagnostic Strategies in Accident Sequences. 

Event Trees (ET) - A mathematical logic model that mathematically and graphically portrays the combination of events and circumstances in an accident sequence, expressed in an annual estimation. 

As shown in Table 1 and Figure 7, a causation sequence model of asphyxiation poisoning accidents is proposed according to Heinrich s and Adams accident causation sequence theories (JIAO Xia 2007, SUI Pengcheng et al. 2005). Such model is targeted to blasting-fume asphyxiation poisoning accidents. 

Figure 7. The sequence model of asphyxiation poisoning accidents based on Adams accident causation sequence theory.

An initiating event is an event that triggers an accident sequence—e.g., a wave that exceeds the jacket s capacity that, in turn, triggers a blowout that causes failures of the foundation. As initiating events, they are mutually exclusive only one of them starts the accident sequence. A catastrophic platform failure can start by failure of the foundation, failure of the jacket, or failure of the deck. These initiating failures are also (by definition) mutually exclusive and constitute the basic events of the [probabilistic risk assessment] model in its simplest form. [152, p. 121]... 

The emphasis given in his accident causation model, called the accident sequence, to the faults of persons and to ancestry and environment, which identified the traits of individuals as the principal causative elements (Citation 7)... 

Improved models of the accident sequence would be helpful in understanding the dynamics of accidents and would be a basis for data collection. No fuUy satisfactory model has yet been developed, but many are promising and useful [p. 85]. 

The effects of these cases were considered as initiating events, contributors to initiating events, or as post-initiator human actions in accident sequences, which were to be modelled in event tree level as a header using the appropriate probability value for the required postaccident human action. 

The treatment of accident sequences usually implies a chain of model calculations for different phenomena, for example occurrence of a leak discharge pool formation evaporation - atmospheric dispersion health effects . This is already expressed in Fig. 10.1. 

Despite the large number of possible sequences, as suggested by Fig. 10.1, modelling a limited number of phenomena is sufficient. In order to assess accident consequences the models are used with different initial and boundary conditions and combined differently. This enables one to simulate a large variety of accident sequences. 

Fig. 10.1 Possible accident sequences in process plants and phenomena to be modelled [1]...

---