Event Tree Example

ETA has proved to be a useful tool for major accident risk assessments. Such an analysis can be effectively integrated into the hazard identification and estimation phases of a safety assessment programme. However, an event tree grows in width exponentially and as a result it can only be applied effectively to small sets of components. 

---

FIGURE 10. Simplified example of event tree model. 

In constructing the event tree, the analyst considers the functions that are required to prevent damage states, health consequences considering the relationships between safety functions. For example, if RCS inventory is not maintained, the heat-removal functions are depicted as failed state.s that may lead to core melt. 

Function event trees include primarily the engineered safety features of the plant, but other systems provide necessary support functions. For example, electric power system failure amid reduce the effectiveness of the RCS heat-removal function after a transient or small UJ( A. Therefore, EP should be included among the systems that perform this safety function. Siipfiort systems such as component-cooling water and electric power do not perform safety functions directly. However, they significantly contribute to the unavailability of a system or group of systems that perform safety functions. It is necessary, therefore, to identify support systems for each frontline ssstcm and include them in the system analysis. 

Functional and hardware relationships between systems are considered in selecting the order of event tree headings. Systems that depend on the operation of other systems in order to perform their function should be listed after the other systems. For example, the decay-heat removal system... 

LESF (Figure 3.4.5-5), exemplified for the large LOCA, is compared with SELF. Event tree headings are the refueling water storage tank (RWST) a passive component, an engineered safety system (SA-1) and four elements of the containment system. Other examples of the LESF method show human error in the event tree while the criteria for system success is usually in the tan It tree analysis. 

Practitioners of SELF explicitly include the dependencies either in the event trees or in the fault trees. Examples of the LESF method that have been examined, treat major dependencies by the definition of degraded states and reevaluate the systems and event trees for the assumed degraded state as well as for the probability of being in that state. Mathematically this is very effective but the dependency coupling is not as pictorial as the SELF method. 

The development of the HRA event tree is one of the most critical parts of the quantification of human error probabilities. If the task analysis lists the possible human error events in the order of ihcir potential occurrence, the transfer of this information to the HRA event tree is fadlitutcd. Each potential eiTor and success is represented as a binary branch on the HRA event tiec. with subsequent errors and successes following directly from the immediately preceding ones. Cure should be taken not to omit the errors that are not included in the task analysis table but might affect the probabilities listed in the table. For example, administrative control errors that affect a task being performed may not appear in the task analysis table but must be included in the HRA event tree. 

Determining which accident sequences lead to which states requires a thorough knowledge of plant and process operations, and previous safety analyses of the plant such as, for nuclear plants, in Chapter 15 of their FSAR. These states do not form a continuum but cluster about specific situations, each with characteristic releases. The maximum number of damage states for a two-branch event trees is 2 where S is the number of systems along the top of the event tree. For example, if there are 10 systems there are 2 = 1,024 end-states. This is true for an "unpruned" event tree, but. in reality, simpler trees result from nodes being bypassed for physical reasons. An additional simplification results... 

Accident progression scenarios are developed and modeled as event trees for each of these accident classes. System fault trees are developed to the component level for each branch point, and the plant response to the failure is identified. Generic subtrees are linked to the system fault trees. An example is "loss of clcciric power" which is analyzed in a Markov model that considers the frequencies of lo,sing normal power, the probabilities of failure of emergency power, and the mean times to repair parts of the electric power supply. 

Its unique design suggests several accident scenarios that could not occur at other reactors. For example, failure to supply ECC to 1/16 of the core due to the failure of an ECC inlet valve. On the other hand, some phenomena of concern to other types of reactors seem impossible (e.g., core-concrete interactions). The list of phenomena for consideration came from previous studies, comments of an external review group and from literature review. From this, came the issues selected for the accident progression event tree (APET) according to uncertainty and point estimates. 

If the results of the qualitative analysis are to be used as a starting-point for quantification, they need to be represented in an appropriate form. The form of representation can be a fault tree, as shown in Figure 5.2, or an event tree (see Bellamy et al., 1986). The event tree has traditionally been used to model simple tasks at the level of individual task steps, for example in the THERP (Technique for Human Error Rate Prediction) method for human reliability... 

Figures 17.7.1 and 17.7.2 present a sample event tree analysis and an example of an event tree for a dmiii rupture.

In a more quantitative sense, cause-consequence analysis may be viewed as a blend of fault tree end event tree analysis (discussed in tlie two preceding cliapters) for evaluating potential accidents. A major strengtli of cause-consequence analysis is its use as a communication tool. For example, a cause-consequence diagram displays the interrelationships between tlie accident outcomes (consequences) and Uieir basic causes. The method can be used to quantify the expected frequency of occurrence of the consequences if the appropriate chita are available. 

Tlie following simplified example, constructed by Hendershot, will facilitate tlie transition to tlie case studies. Suppose tliat a risk assessment is being conducted at a chemical plant to detenuine the consequences of two incidents (tlie initiating events of die event tree shown in Fig. 21.1.1) defined as... 

If a safety function does not apply, the horizontal line is continued through the safety function without branching. For this example, the upper branch continues through the second function, where the operator notices the high temperature. If the high-temperature alarm operates properly, the operator will already be aware of the high-temperature condition. The sequence description and consequences are indicated on the extreme right-hand side of the event tree. The open circles indicate safe conditions, and the circles with the crosses represent unsafe conditions. 

The lettering notation in the sequence description column is useful for identifying the particular event. The letters indicate the sequence of failures of the safety systems. The initiating event is always included as the first letter in the notation. An event tree for a different initiating event in this study would use a different letter. For the example here, the lettering sequence ADE represents initiating event A followed by failure of safety functions D and E. 

The event tree can be used quantitatively if data are available on the failure rates of the safety functions and the occurrence rate of the initiation event. For this example assume that a loss-of-cooling event occurs once a year. Let us also assume that the hardware safety functions fail 1% of the time they are placed in demand. This is a failure rate of 0.01 failure/demand. Also assume that the operator will notice the high reactor temperature 3 out of 4 times and that 3 out of 4 times the operator will be successful at reestablishing the coolant flow. Both of these cases represent a failure rate of 1 time out of 4, or 0.25 failure/demand. Finally, it is estimated that the operator successfully shuts down the system 9 out of 10 times. This is a failure rate of 0.10 failure/demand. 

The net frequency associated with the event tree shown in Figure 11-9 is the sum of the frequencies of the unsafe states (the states with the circles and x s). For this example the net frequency is estimated at 0.025 failure per year (sum of failures ADE, ABDE, and ABCDE). 

Process hazard analysis (PHA) Any of a number of techniques for understanding and managing the risk of a chemical process or plant. Examples of PHA techniques include HAZOP, checklists, what-if methods, fault tree analysis, event tree analysis, and others. 

Sometimes it is easiest to prepare a general flowchart that identifies events which may occur at a facility during an incident. This flowchart can identify possible avenues the event may lead to and the protection measures available to mitigate and protect the facility. It will also highlight deficiencies. The use of a flowchart helps the understanding of events by personal unfamiliar with petroleum risk and safety measures. It portrays a step by step scenarios that is easy to follow or explain. Preparation of in-depth risk probability analysis can also use the flowchart as the basis of the event trees or failure modes and effects. Figure 3 provides a generic example of a typical hydrocarbon process facility Safety Flowchart. API Recommended Practice RP 14C provides an example of a Safety Flowchart for an offshore production facility. 

Fault tree analysis (FTA) and event tree analysis (ETA) are the methods most commonly applied quantitatively. Since they only address the likelihood of undesired events, these methods are often combined with consequence severity calculations in a quantitative risk analysis, as described by CCPS (1999b). Layer of protection analysis (LOPA) uses a semiquantitative, order-of-magnitude approach. It is documented with worked examples in CCPS (2001b). 

The PHA procedure can be conducted using various methodologies. For example, the checklist analysis discussed earlier is an effective methodology. In addition, Pareto analysis, relative ranking, pre-removal risk assessment (PRRA), change analysis, failure mode and effects analysis (FMEA), fault tree analysis, event tree analysis, event and CF charting, PrHA, what-if analysis, and HAZOP can be used in conducting the PHA. 

Other examples of inductive tools that have limited application in incident investigation include failure mode and effects analysis (FMEA), hazard and operability study (HAZOP), and event tree analysis (ETA). These are detailed in the CCPS book, Guidelines for Hazard Evaluation Procedures... 

Chapter 3 contains an example of an event tree in Figure 3-1 on page... 

A systems hazards analysis (SHA) is a systematic and comprehensive search for and evaluation of all significant failure modes of facility systems components that can be identified by an experienced team. The hazards assessment often includes failure modes and effects analysis, fault tree analysis, event tree analysis, and hazards and operability studies. Generally, the SHA does not include external factors (e.g., natural disasters) or an integrated assessment of systems interactions. However, the tools of SHA are valuable for examining the causes and the effects of chemical events. They provide the basis for the integrated analysis known as quantitative risk assessment. For an example SHA see the TOCDF Functional Analysis Workbook (U.S. Army, 1993-1995). 

---