Complex accidents

However, in the case of a root cause analysis system, a much more comprehensive evaluation of the structure of the accident is required. This is necessary to unravel the often complex chain of events and contributing causes that led to the accident occurring. A number of techniques are available to describe complex accidents. Some of these, such as STEP (Sequential Timed Event Plotting) involve the use of charting methods to track the ways in which process and human events combine to give rise to accidents. CCPS (1992d) describes many of these techniques. A case study involving a hydrocarbon leak is used to illustrate the STEP technique in Chapter 7 of this book. The STEP method and related techniques will be described in Section 6.8.3. 

Phillips Petroleum Company, A Report on the Houston Chemical Complex Accident, Phillips Petroleum Company, Bartlesville, OK, 1990. 

We found and analyzed 28 safety investigation reports, see PSA (2008). The reports are mainly based on a sequential, complex accident model - an epistemological model looking at man, technology and organization. Root causes and description of the causal chain has been described in the reports. The structure of the analyzing of the reports has been ... 

In this study, qualitative aspects of ATHEANA were applied for the definition of complex accident scenarios involving human actions. The purpose of identifying deviations in accident sequences through a structured process is to verify whether the procedures are still appropriate even under these conditions. The findings, for the human failure event selected from the Human Reliability Analysis (HRA) in the previously performed Probabilistic Risk Analysis (PRA), were not related to EOPs. Thus, it was found that the major contributors to failure were rather related to the human-system interface and some crew characteristics. 

Phillips Petroleum Company. A report on the houston chemical complex accident Bartlesville, OK Phillips Petroleum Company 1990. 

Continuing training also contains some classroom elements but is typically mostly simulator based. In the simulator the operator should be exposed to aU procedures in the EOF set approximately every two years. Emphasis should be placed on exercising procedures dealing with the most probable and complex accident. In the case of PWRs this might be an SG tube rupture. The SG tube rupture recovery procedure might be practised up to three times more often than less probable procedures. 

Complex accidents may have many sites. For example, the root cause of a road traffic accident may have occurred in a design office (for the car or for the road) many years before, and many miles away from, the fatal crash. 

The amoxmt of information required to describe effectively a complex accident is likely to be beyond tiie scope of succinct narrative summary so that some t) e of formal collation technique is to be preferred. A number of such techniques are available but Events and Causal Factors Analysis (ECFA) is the most straightforward and most generally useful. 

The production of effective recommendations for the prevention of recurrence is unlikely to be straightforward in these complex accidents and incidents so that techniques such as Fault Tree Analysis (FTA) may be required to analyse the causal sequences. In addition, creative thinking techniques such as brainstorming and systems thinking may be required to generate a suitable range of recommendations. 

One of the best ways to think about root cause analysis is to consider the question, To when would I have to travel back in a time machine to prevent this accident happening In complex accident sequences (such as the Whatcom Park accident described in Chapter 12) there may be more than one answer to this question. 

Control of severe plant conditions, including prevention and mitigation of the consequences of severe accidents. Increase reliability of systems to control complex accident sequences decrease severe core damage frequency by at least one order of magnitude, and even more for urban-sited facilities. 

Registrations and coding of accident type and injury agency are based on physical evidence from the accident site and on interviews with witnesses. Such registration is reliable, provided that it is based on facts. There may, however, be a certain arbitrariness involved in the coding of accident type and injury agency in case of complex accident scenarios. 

In a real situation with a complex accident sequence, the danger escalates in a series of steps, where there are many opportunities to bring the situation back under control. In an analysis of an accident, the loop is gone through several times in order to identify the different opportunities, either of bringing the situation back under control or of limiting the losses, that were not utilised. 

In Chapter 6, we discussed problems that the investigator faces when applying a complex accident causal model in the collection of data on accidents. A careful balance has to be made between the amount of information required, the quality of the information, and the time needed for the investigation. This balance is problematic, since the benefits of detailed information of a high quality are usually experienced by another part of the organisation than those responsible for the collection of the data. They have first-hand experience anyway. 

Engineers have developed a range of tools that can be used to represent and reason about the causes of major accidents (Leveson (1995)). For example, time-lines and fault trees have been recommended as analysis tools by a range of government and regulatory bodies. Unfortunately, these well-established techniques suffer fh)m a number of limitations (Johnson (1998)). In particular, they cannot easily be used to represent and reason about the ways in which human errors and system failures interact during complex accidents (HoUimgel (1993)). 

The subsequent step is to identify the various scenarios which could cause loss of control of the hazard and result in an accident. This is perhaps the most difficult step in the procedure. Many accidents have been the result of improper characterization of the accident scenarios. For a reasonably complex chemical process, there might exist dozens, or even hundreds, of scenarios for each hazard. The essential part of the analysis is to select the scenarios which are deemed credible and worst case. 

A technique called probabiUstic safety assessment (PSA) has been developed to analy2e complex systems and to aid in assuring safe nuclear power plant operation. PSA, which had its origin in a project sponsored by the U.S. Atomic Energy Commission, is a formali2ed identification of potential events and consequences lea ding to an estimate of risk of accident. Discovery of weaknesses in the plant allows for corrective action. 

For many years the usual procedure in plant design was to identify the hazards, by one of the systematic techniques described later or by waiting until an accident occurred, and then add on protec tive equipment to control future accidents or protect people from their consequences. This protective equipment is often complex and expensive and requires regular testing and maintenance. It often interferes with the smooth operation of the plant and is sometimes bypassed. Gradually the industry came to resize that, whenever possible, one should design user-friendly plants which can withstand human error and equipment failure without serious effects on safety (and output and emciency). When we handle flammable, explosive, toxic, or corrosive materials we can tolerate only very low failure rates, of people and equipment—rates which it may be impossible or impracticable to achieve consistently for long periods of time. 

Avoid the temptation to overreact after an accident and install an excessive amount of protective equipment or complex procedures which are unhkely to be followed after a few years have elapsed. Sometimes an accident occurs because the protective equipment available was not used nevertheless, the report recommends installation of more protective equipment or an accident occurs because complex procedures were not followed and the report recommends extra procedures. It would be better to find out why the original equipment was not used or the original procedures were not followed. 

There are a variety of ways to express absolute QRA results. Absolute frequency results are estimates of the statistical likelihood of an accident occurring. Table 3 contains examples of typical statements of absolute frequency estimates. These estimates for complex system failures are usually synthesized using basic equipment failure and operator error data. Depending upon the availability, specificity, and quality of failure data, the estimates may have considerable statistical uncertainty (e.g., factors of 10 or more because of uncertainties in the input data alone). When reporting single-point estimates or best estimates of the expected frequency of rare events (i.e., events not expected to occur within the operating life of a plant), analysts sometimes provide a measure of the sensitivity of the results arising from data uncertainties. 

Selection of a PrHA methodology requires consideration of many factors including the availability of process information such as experience with the process, changes that have taken place, reliability, aging, maintenance, etc. If it is a new process, less reliance can be placed on experience and greater reliance must be placed on the analysis of possible accidents and accidents in similar or related processes. Size, complexity and hazard severity influences the dunce ot ihe most appropriate PrHA methodology. 

This section describes how both hypothetical and real accidents are analyzed. These methods varying greatly in complexity and resource requirements, and multiple methods may be used in an analysis. A simple method is used for screening and prioritization followed by a more complex method for significant accident scenarios. Some methods give qualitative results more complex methods give quantitative results in the form of estimated frequencies of accident scenarios. The process systems in Figures 3.3.1-1 and 3.3.1-2 are used in the examples. 

Function event trees are developed to represent the plant s response to each initiator. The function event tree is not an end product it is an intermediate step that provides a baseline of information and permits a stepwise approach to sorting out the complex relationships between potential initiating events and the response of the mitigating features. They structure plant respoases to accident conditions - possibly as time sequences. The transition labels of function event trees (usually along the top of the event tree) are analyzed to provide the probability of that function occurring or not occurring. 

The problem with function event trees is that some functions are quite complex and must be analyzed. If a function event tree models the plant s response to an accident initiator, modeling system responses in a fault tree will not clearly exhibit the functional criteria. 

The chemical and physical phenomena involved in chemical process accidents is very complex. The preceding provides the elements of some of the simpler analytic methods, but a PSA analyst should only have to know general principles and use the work of experts contained in computer codes. There are four types of phenomenology of concern 1) release of dispersible toxic material, 21 dispersion of the material, 3) fires, and 4) explosions. A general reference to such codes is not in the open literature, although some codes are mentioned in CCPS (1989) they are not generally available to the public. 

---