Event tree

Event trees begin with an initiating event and work toward a final result. This approach is inductive. The method provides information on how a failure can occur and the probability of occurrence. 

When an accident occurs in a plant, various safety systems come into play to prevent the accident from propagating. These safety systems either fail or succeed. The event tree approach includes the effects of an event initiation followed by the impact of the safety systems. 

The typical steps in an event tree analysis are3 

identify the safety functions designed to deal with the initiating event, 

If appropriate data are available, the procedure is used to assign numerical values to the various events. This is used effectively to determine the probability of a certain sequence of events and to decide what improvements are required. 

Initiating events create the hazard scenario (assuming aU the safety systems have been compromised, which will be studied in the event trees) and have a probability of occurrence attached to them. Remember that an initiating event itself is not always negative it is the consequences of the initiating event that are hazardous. 

The hazard analysis controls column is very useful in identifying the kinds of barriers that exist to prevent the hazard or mitigate the results. This part of the analysis is also one of the most difficult. The probability of breaching the barrier must be estimated. If one of the barriers is proper operation of relief valve, then you need to determine the probability that the relief valve will not operate. Various failure probabilities could be tied to this one barrier. Obviously, you should choose the most likely failure probability. 

The event tree also illustrates each scenario s final damage states. The typical damage states are as follows I = catastrophic, II = critical. III = minor, and IV = negligible. Of course, you will need to define what those terms really mean. Catastrophic could mean that people are killed or over 100 lb of ammonia is discharged to the environment or even the plane flies with only one engine. The hazard risk indices used in Chapter 5 are good damage state denominations. 

System Safety Engineering and Risk Assessment A Practical Approach 

This particular initiating event has three barriers to prevent a hazardous outcome. The first barrier is just the normal operation of the system. In other words, the system operating normally can handle this initiating event with a particular kind of outcome or consequence. Whether barriers 2 and 3 are in the system and whether they function or not determines the different severities of consequences. 

The probabilistic analysis of a plant is usually performed by the construction of event trees, for any single group of similar initiating events, and of fault trees, for any single system or component whose fault probability is important for the study of the various accident sequences. 

Event trees are branched graphs which, starting from the initiating event considered, show (in their most 

An event tree, therefore, gives the picture of the various final plant situations, each one with the pertinent overall probability. 

---

Methods for performing hazard analysis and risk assessment include safety review, checkhsts, Dow Fire and Explosion Index, what-if analysis, hazard and operabihty analysis (HAZOP), failure modes and effects analysis (FMEA), fault tree analysis, and event tree analysis. Other methods are also available, but those given are used most often. 

Event Trees. Event trees use an inductive logic approach to consider the effects of safety systems on an initiating event. The initiating event is propagated through the various safety functions. Branching is dependent upon the success or failure of the safety function. 

It is not coincidental that the top event of the fault tree is the initiating event for the event tree. The fault tree shows how an event is decomposed into basic events whereas an event tree demonstrates the effect of the various safety functions. The disadvantage of event trees is that the outcomes are difficult to predict. Thus the outcome of interest might not arise from the analysis. 

Layer of protection analysis (LOPA) is a simplified form of event tree analysis. Instead of analyzing all accident scenarios, LOPA selects a few specific scenarios as representative, or boundary, cases. LOPA uses order-of-magnitLide estimates, rather than specific data, for the frequency of initiating events and for the probability the various layers of protection will fail on demand. In many cases, the simplified results of a LOPA provide sufficient input for deciding whether additional protection is necessary to reduce the likelihood of a given accident type. LOPAs typically require only a small fraction of the effort required for detailed event tree or fault tree analysis. 

FIGURE 10. Simplified example of event tree model. 

Frequency Phase 3 Use Branch Point Estimates to Develop a Ere-quency Estimate for the Accident Scenarios. The analysis team may choose to assign frequency values for initiating events and probability values for the branch points of the event trees without drawing fault tree models. These estimates are based on discussions with operating personnel, review of industrial equipment failure databases, and review of human reliability studies. This allows the team to provide initial estimates of scenario frequency and avoids the effort of the detailed analysis (Frequency Phase 4). In many cases, characterizing a few dominant accident scenarios in a layer of protection analysis will provide adequate frequency information. 

A simplified form of event tree analysis using selected accident scenarios and order-of-magnitude estimates to determine whether additional protection is needed... 

Recognized systematic approaches include hazard operability study (HAZOP) event tree analysis fault tree analysis. 

A significant development of the study was the use of event trees to link the system fault trees to (lie accident initiators and the core damage states as described in Chapter 3. This was a response to the ditficulties encountered in performing the in-plant analysis by fault trees alone. Nathan Villalva and Winston Little proposed the application of decision trees, which was recognized by Saul Levine a.s providing the structure needed to link accident sequences to equipment failure. 

Originated the event tree for linking initiators, systems, and consequences, and introduced the laiill tree to a large audience ... 

Despite its shortcomings, WASH-1400 provides at this time (1978) the most complete single picture of accident probabilities associated with nuclear reactors. The fault tree/event tree approach coupled with an adequate database is the best method available to quantify these probahililies. 

It is conceptually impossible to be complete in a mathematical sense in the constmctioii oi event trees and fault trees. What matters is the approach to completeness and the abihiy lo demonstrate with reasonable assurance that only small contributions are omitted. This inherent limitation means that any calculation using this methodology is always subject to revision and to doubt as to its completeness. 

Computer software programs, fault trees and event trees are other diagrams that provide useful information. 

It is necessary to check units to be sure they make sense. Fault trees are often associated with event trees in which only the initiator has the units of frequency and the fault trees are dimensionless probability. This dimensionless is achieved by failure rates being paired with a mis.sion time. 

A fault tree may either stand alone or be coupled to an event tree to quantif" bability. The top event in either case is the abjective of performing the analysis. If tht is the reliability of a system under specific conditions - then that is the top event. If it is to qua iify a node of an event tree the top event title is that of that particular node subject to the condi ons imposed by the preceding modes. 

Human errors may be dependent on the specific accident sequence displayed in the event tree, and, for that reason, may be included in the event tree. This requires the human-factors specialist to consider the context of the error in terms of stress, operator training in response to the accident, di.tgnosiic paiierns, environmental, and other performance-shaping factors. 

An event tree is a model of the process response to an accident initiator. The initiators are... 

Fig. 3.4.5- Event Tree Scenario Depiction The left side connects to the initiator, the right side to process damage states, the top bar gives the systems in the order that they enter the scenario. The nodes...

Two types of initiators are internal and external. Internal initiators result from failures within a plant or the plant s support utilities. Thus, vessel rupture, human error, cooling failure, and loss of offsite power are internal events. All others are external events earthquakes, tornados, fires (external or internal), and floods (external or internal). Event trees can be used to analyze either type of initiator. 

The event" list, across the top of the event tree, specifies events for which the probability of failure (or success) must be specified to obtain the branching probabilities of the event tree. Events that are the failure of a complex system may require fault tree or equivalent methods to calculate the branching probability using component probabilities. In some cases, the branching probability may be obtained directly from failure rate data suitably conditioned for applicability, environment and system interactions. 

The success of some systems depends on other systems. An event tree is constructed by placing support systems before the supported systems. This may require iterating the event tree construction to get appropriate ordering. If the system dependency is in the fault trees, it is not reflected in the event tree and only becomes apparent when the PSA is calculated. 

Chapter 12 discusses the distribution software BETA for preparing event tree analysis from a work processor table. BETA allows the use of binary conditionals so the nodal probabilities in a vertical line are not necessarily equal but depend on preceding events. 

Event trees and fault trees work together to model plant accidents, but the demarcation be tween them is the choice of the analysts. This has resulted in two styles 1) small event tree-large fault tree (SELF), and 2) large event tree-small fault tree (LESF). SELF is the style used in WASH-1400, in NRC sponsored PSAs, and in several utility PSAs. LESF was introduced by PL G in the Oyster Creek PSA and used subsequently by PL G and several utilities,... 

SELF is a two-stage process going from functional event trees, to system fault trees events pertinent to the accident progression. 

S.4 Small Event Tree-Large Fault Tree SELF Functional Event Trees... 

Function event trees are concerned with depicting functions that must happen to mitigate an initiating event. The headings of the function event tree are statements of safety functions that are required but that may fail in an accident sequence. 

Function event trees are developed to represent the plant s response to each initiator. The function event tree is not an end product it is an intermediate step that provides a baseline of information and permits a stepwise approach to sorting out the complex relationships between potential initiating events and the response of the mitigating features. They structure plant respoases to accident conditions - possibly as time sequences. The transition labels of function event trees (usually along the top of the event tree) are analyzed to provide the probability of that function occurring or not occurring. 

In constructing the event tree, the analyst considers the functions that are required to prevent damage states, health consequences considering the relationships between safety functions. For example, if RCS inventory is not maintained, the heat-removal functions are depicted as failed state.s that may lead to core melt. 

LOCA, is presented in Table 3.4.5-1. In preparing the event tree, reference to the reactor s design determines the effect of the failure of the various systems. Following the pipe break, the system should scram (Figure 3.4.5-2, node 1). If scram is successful, the line following the node goes up. Successful initial steam condensation (node 2 up) protects the containment from initial overpressure. Continuing success in these events traverses the upper line of the event tree to state 1 core cooled. Any failures cause a traversal of other paths in the evL-nl tree. 

Function event trees include primarily the engineered safety features of the plant, but other systems provide necessary support functions. For example, electric power system failure amid reduce the effectiveness of the RCS heat-removal function after a transient or small UJ( A. Therefore, EP should be included among the systems that perform this safety function. Siipfiort systems such as component-cooling water and electric power do not perform safety functions directly. However, they significantly contribute to the unavailability of a system or group of systems that perform safety functions. It is necessary, therefore, to identify support systems for each frontline ssstcm and include them in the system analysis. 

The problem with function event trees is that some functions are quite complex and must be analyzed. If a function event tree models the plant s response to an accident initiator, modeling system responses in a fault tree will not clearly exhibit the functional criteria. 

A system event tree provides this display and uses the Tech Spec ciiicna (n specify the func tion. Figure 3.4.5-4 shows a system event tree developed from the function event tree presented as Figure 3.4.5-2, It should be noted that the functions RS, COl, C02 and ECR are accomplished by systems and are thus unchanged ongoing from a function to system event tree. ECI is quiic complex and may be performed by various system combinations such as 2 or 1 core spray (CS) loops, or various combinations of low pressure in jection (LPCI),... 

System event trees use the information on the effects of loss of various safety functions identified in the function event trees. However, the sequences in the system event trees are likely to differ somewhat from the function event trees because system faults may fail multiple functions. 

---