Event tree analysis limitations

Other examples of inductive tools that have limited application in incident investigation include failure mode and effects analysis (FMEA), hazard and operability study (HAZOP), and event tree analysis (ETA). These are detailed in the CCPS book, Guidelines for Hazard Evaluation Procedures... 

Extrapolation of historical data to larger scale operations may overlook hazards introduced by scale up to larger equipment Limitation of fault tree tlieory requires system simplification Incompleteness in fault and event tree analysis Uncertainties in data -... 

Three hazard analysis techniques are currently used widely Fault Tree Analysis, Event Tree Analysis, and HAZOP. Variants that combine aspects of these three techniques, such as Cause-Consequence Analysis (combining top-down fault trees and forward analysis Event Trees) and Bowtie Analysis (combining forward and backward chaining techniques) are also sometimes used. Safeware and other basic textbooks contain more information about these techniques for those unfamiliar with them. FMEA (Failure Modes and Effects Analysis) is sometimes used as a hazard analysis technique, but it is a bottom-up reliability analysis technique and has very limited applicability for safety analysis. 

In all of these scenario variations, the fire suppression system composed of a wet pipe sprinkler system could limit fire progression and possibly the extent of the release. As the sensor that starts the sprinkler water flow is passive and located near the high ceiling level, The sprinkler system may not start promptly to suppress the fire. In that case it will be more of a mitigation feature than a prevention feature so it was not included in the event tree analysis of radioactive material release. 

There are hoth advantages and limitation of event tree analysis ... 

Extrapolation of historical data iwQr overlordc hazards fiom scale-up. Limitation of Mlt tree theory requires m simplificatioa ItKompleteness in ult and event tree analysis. 

The assembly process (Figure 10-1) brings together all of the assessment tasks to provide the risk, its significance, how it was found, its sensitivity to uncertainties, confidence limits, and how it may be reduced by system improvements. Not all PSAs use fault trees and event trees. This is especially true of chemical PSAs that may rely on HAZOP or FMEA/FMECAs. Nevertheless the objectives are the same accident identification, analysis and evaluation. Figure 10-1 assumes fault tree and event tree techniques which should be replaced by the equivalent methods that are used. 

The use of event trees is sometimes limiting for liazard analysis because it may lack die capability of quantifying die potendal of die event occurring. Tlie analysis may also be incomplete if all inidal occurrences are not identified. Its use is beneficial in examining, rather dian evaluating, die possibilities and consequences of a failure. For this reason, a fault tree analysis (FTA) should supplement diis, to establish die probabilities of die event tree branches. Tliis topic was introduced in a subsection of Cliapter 16. 

Figure 21.7.2 demonstrates die preliminary steps for a fault tree analysis (FTA) in addition, die TOP event, bounds, configurations, and unallowed events are specified, and die level of resolution is shown. Once all die limits have been detennined, die fault tree is constructed (Figure 21.7.3). Note tliat every branch of die fault tree ends in a basic fault or cause leading to die TOP event.

Fault tree analysis is a complete procedure. If consistently applied it generates all event combinations leading to failure. Limitations do not derive from the procedure but from the knowledge and scrupulousness of the analyst. It goes without saying that phenomena not known at the time of analysis cannot be identified. 

The approach used for the estimation of loss of life in floods shows considerable resemblance to the approach that is used in the Dutch major hazards policy. In both cases, the probability of a critical event (loss of containment or flood) is estimated using fault tree analysis, after which the physical effects associated with that critical event are considered (using e.g. dispersion or flood propagation models) and related to mortality estimates (using dose-response functions or flood mortality functions). But while the potential for evacuation is often limited when it comes to explosions or toxic releases, it could be significant when it comes to floods. 

Fault tree analysis is used primarily as a tool for conducting system or subsystem hazard analyses, even though qualitative or top-level (that is, limited number of tiers or detail) analyses may be used in performing preliminary hazard analyses. Generally, FTA is used to analyze failure of critical items (as determined by a failure mode and effects analysis or other hazard analysis) and other undesirable events capable of producing catastrophic (or otherwise unacceptable) losses. 

The first step in performing a fault tree analysis is to collect the appropriate project description documents, existing hazard analyses, and guidance documents and carefully review them to determine the limits, scope, and ground rules for the FTA.This review includes defining the system to be analyzed, the depth or indenture levels to be included in the effort, and, of course, the nature of the undesired event or failure to be studied. 

Analysis of a fault tree can be no better than the events identified for it. A major limitation of fault tree analysis is failure to identify all the events that may lead to a top event. Failure to include an event may simply be oversight. However, it may also be a lack of experience and knowledge of the system and its behavior or potential behavior. Early in the design and development of a system it is difficult to anticipate failures and undesired events. Team members may not have insight into the possible failures in the future. Team members may have limited knowledge and experience with materials and components that make up a system. 

Fault tree analysis is highly effective in determining how combinations of events and failmes can cause specific system failures, however, the technique has three main limitations ... 

The most important Boolean models are Event Trees and Fault Trees (classics/dynamics). Event Trees (Papazoglou 1998) are graphical models that can be discretized according to their possible effects or distinction in a series of simple events. In the same time Event Trees are adapted for modeling and assessment of the events sequences for non-reparable systems such as safety or protection systems. Instead, the reparable systems or instrumentation and control systems can not be modeled by Event Trees. Fault Trees are built according to an undesired event that is decomposed into basic events till this decomposition becomes impossible or judged useless (Dutuit Rauzy 2005). These models are efficient for c r-based analysis but have limitations for sequence-hd.ssd analysis because of the static point of view they consider. 

Mahboob Straub (2011). This may be a serious limitation for civil engineering applications. In principle event trees can deal with such dependencies however this requires great care during an analysis as observed by Faber Stewart (2003). Moreover both methods suffer from the difficulty in updating based on new information. Petri Nets provide a powerful platform, but the evaluation often takes basis in Monte Carlo simulations requiring considerable computational demands, Nishijima et al. (2009). These drawbacks can be overcome by the use of Bayesian probabilistic networks with discrete nodes supplemented by decision and utility nodes, Nielsen Jensen (2007). 

Fault Tree Analysis employs an analytical tree to display the results of an analysis (Suokas and Rouhiainen, 1993). It starts with the top event (injury or damage). The analysis proceeds backwards in order to identify all events and conditions that have caused the injury or damage. Logical relations (necessary and/or sufficient conditions) are estabhshed. Fault-tree analysis is not an accident model per se and gives limited support in the identification of causal factors. 

---