External events analysis

RISKMAN is an integrated Microsoft Windows , personal computer software system for [H. i forming quantitative risk analysis. Used for PSAs for aerospace, nuclear power, and chemical [iroccsses, it has five main modules Data Analysis, Systems Analysis, External Events Analysis, Event Tree Analysis, and Important Sequences. There are also modules for software system maintenance, backup, restoration, software updates, printer font, and page control. PEG has also integrated the fault tree programs CAFTA, SETS, NRCCUT, and IRRAS into RISKMAN. 

In 1988, an internal events PRA was published (Johnson, 1988) this was followed by an external events analysis. The results were reported by Johnson (1991), and Flanagan (1990). The basic approach to risk is that of Kaplan (1981) that asks the questions "What can happen, and How likciy is it and what are the consequences " These are organized as triplets to characterize the risk... 

Brandyberry, M. D. and H. E. Wingo, 1990, External Events Analysis for the Savannah River Site K Reactor, ANS Topical Meeting, The Safety, Status and Future of Non Commercial Reactors and Irradiation Facilities, Boise ID, Sept. 31 - October 4, 1990... 

K Building Disassembly Basin External Events Analysis, Revision 0," N-CLC-K-... 

All of these techniques rely on past experience to a certain extent. Fault and event trees are the most common frequency modeling techniques for complex situations that require tracking of chains of events. Human reliability analysis and external events analysis can be considered essentially as components of fault and event tree analysis, with the information generated from their application to he fed into the fault and event trees. 

External Events Analysis. This component of frequency analysis considers the impact of external events (sueh as earthquakes, tornadoes, floods, aircraft crashes, terrorism, and vandalism) as initiating events to undesirable event scenarios. Quantitative frequency information is then used in fault and event trees. 

External events The purpose of external events analysis is to focus attention on... 

External events are accident initiators that do not fit well into the central PSA structure used for "internal events." Some "external events" such as fire due to ignition of electrical wires, or flood from a ruptured service water pipe occur inside the plant. Others, such as earthquakes and tornados, occur outside of the plant. Either may cause failures in a plant like internal events. External initiators may cause multiple failures of independent equipment thereby preventing action of presumably redundant protection systems. For example, severe offsite flooding may fli 1 the pump room and disable cooling systems. An earthquake may impede evacuation of the nearby populace. These multiple effects must be considered in the analysis of the effects of external events. 

The analysis methods are similar for all external events probability of the external event, probability of failures, effects of failures on safety systems, and estimating the effects of failures for the workers, public and environment. 

It is more common for a complete PSA to take 16 to 24 months with several rnuiilhs tor preparation, review, and revision of the final report. The final report for a level 3 nuclear plant PSA, includes an analysis of external events, in several large volumes. Completeness and consistency in such a large document requires several months of team leadership and selected analysts. Given these resources, it may be possible to complete the technical analyses for a Level 1 PSA in a year or less, but the final report will take several more months to prepare. 

A Level 1 PSA is a core-melt analysis that may or may not include external events a Level 2 PSA encompasses Level 1 and extends to the physical processes of the accident and their effect on containment a Level 3 PSA encompasses Levels 1 and 2 and extends to public risk. 

Analysis of External Events uses the models developed in the plant system analysis with considerations for seismic, fire, flood, high winds and missiles on the plant. Additional c cm trees or their equivalent may be needed for the external events. 

This section reflects on the limitations of the PSA process and draws extensively from NUREG-1050. These subjects are discussed as plant modeling and evaluation, data, human errors, accident processes, containment, fission product transport, consequence analysis, external events, and a perspective on the meaning of risk. 

Failure sequence modeling techniques such as fault tree analysis or event tree analysis are used to estimate tlie likelihood of incidents in facilities where historical data is unai ailable, or is inadequate to accurately estimate tlie likelihood of the liazardous incidents of concern. Otlier modeling tecluiiques may be required to consider tlie impact of external events (eartliquakes, floods, etc.), common cause failures, and human factors and hmnan reliability. 

The electrochemical detector must be zeroed after each analysis just before the next sample injection. This procedure is necessary owing to the drifting baseline associated with the electrochemical detector. The detector is equipped with this baseline zero capability, and the adjustment can be activated through an external event output signal sent from an autosampler. 

Bedaux and Kooijman 1994 Kooijman 1996 Newman and McCloskey 1996, 2000 Zhao and Newman 2007). This is not just an academic discussion the 2 theories lead to different time courses of mortality at constant exposure (Kooijman 1996) (see Figure 2.10) and have very different consequences for sequential exposure (Newman and McCloskey 2000 Zhao and Newman 2007). In reality, both sensitivity difference and stochasticity are likely to play a role in mortality. Individuals also differ in sensitivity, especially in field populations, but there is clearly a substantial stochastic component involved in mortality that cannot be ignored. The method to deal with stochastic events in time is survival analysis or time-to-event analysis (see Bedaux and Kooijman 1994 Newman and McCloskey 1996). For industrial practices, this method has a long history as failure time analysis (see, e.g., Muenchow 1986). Bedaux and Kooijman (1994) link survival analysis to a TK model to describe survival as a function of time (i.e., the hazard rate is taken proportional to the concentration above a threshold value). Newman and McCloskey (1996) take an empirical relationship between external concentration and hazard rate. 

A quantitative risk assessment (QRA) is an integrated, quantitative analysis (including uncertainty) of accident scenarios, their likelihood, and possible consequences. Current QRAs examine human actions as well as systems failures, external events as well as internal failures, and worker risk as well as public risk. A salient feature of a QRA is that it is integrated, in that it ... 

The word accident should not be used during the incident investigation process because the word implies surprise and lack of controllability. There is nothing anyone can do about accidents. The whole point of an incident investigation and analysis program is that all aspects of an operation are under control of management. Only unpredictable external events such as an airplane crash alluded to above are true accidents. 

It is necessary, therefore, to conduct specific studies to ensure that systems are adequately protected against all foreseeable external events, and the FAA (FAR25.1309), EASA (CS25.1309) and SAE (ARP4761) refer to this study as a Particular Risk Analysis (PRA). 

In general terms, the objective of safety analysis (SA) is to demonstrate that the plant design and its operating procedures (together with well-trained personnel) ensure a high level of protection of the population and workers in case of malfunctions, human errors or assumed external events. 

A formal hazard analysis of the anticipated operations was conducted using Preliminary Hazard Assessment (PHA) and Failure Modes and Effects Analysis (FMEA) techniques to evaluate potential hazards associated with processing operations, waste handling and storage, quality control activities, and maintenance. This process included the identification of various features to control or mitigate the identified hazards. Based on the hazard analysis, a more limited set of accident scenarios was selected for quantitative evaiuation, which bound the risks to the public. These scenarios included radioactive material spills and fires and considered the effects of equipment failure, human error, and the potential effects of natural phenomena and other external events. The hazard analysis process led to the selection of eight design basis accidents (DBA s), which are summarized in Table E.4-1. 

DOE Order 5480.23, Chg. I, Nuclear Safety Analysis Reports, paragraphs 8.b.(3)(e) and 8.b.(3)(k), as amplified in Attachment 1 to the Order, paragraphs 4.f.(3)(d)5 (Topics 5 and 11), require the analysis of both hazards and the facility classification, along with the assessment of operational, natural phenomena, and external events postulated to occur at the facility (DOE 1994a). 

This appendix presents the potential external events that are considered in the hazard analysis of the Hot Cell Facility (HCF) and its associated radioactive material storage facilities. From this list of events, a screening assessment was performed to eliminate from further consideration any of e events that posed little or no hazard to the HCF and associated radioactive material storage facilities or their contents. Events that were not eliminated in this screening process were to be analyzed more closely as part of the qualitative analyses contained in Appendix 3C or 3D (and are summarized in Section 3.3.2, Hazard Analysis Results ). 

Potential external events were identified by reviewing previous Safety Analysis Reports of similar DOE facilities (Restrepo 1995) and the recommended list of external events used to evaluate commercial nuclear power plant risks (NRC 1983). In addition, an attempt was made to identify any other potential external-initiating event unique to the site that had not been considered in previous studies. It is important to note that operational accidents (e.g., criticality, internal fires) occurring inside the HCF and assodated radioactive material storage facilities are not considered in this screening process. These types of "internal initiating events are identified separately using preliminary hazard checklists (see Appendix 3A). 

All of the events listed in Table 3B-1 were eliminated from further consideration by using this screening process. (Some events were eliminated based on multiple criteria.) This does not mean they are all eliminated from all further consideration in the HCF SAR. Some external events are considered in Appendix 3C, Preliminary Hazard Analysis," or Appendix 3D, Failure Modes and Effects Analysis," as potential initiators to internal hazard events. 

Transportation accidents could occur outeide of the Technical Area-V complex, which encloses the HCF and associated radioactive material storage areas. This external transportation occurs in Department of Transportation (DOT) approved containers used for transport of radioactive materials for long distances by public carrier. Thus, the DOT approved container transport of radioactive material has been excluded for the HCF safety analysis. Transfer of radioactive materials between buildings within Technical Area V is not considered an external event and is considered under internal events. (See Appendices 3A and 3C). 

Each HERA analysis consists of a single risksignif-icant operating event. Eiach event is broken down into a detailed timeline based on information in the LER or AIT and any additional related reports (e.g. inspection reports) that are publicly available in the United States. The timeline is composed of sub-events a single sub-event covers either the activation/malfunction of a single piece of equipment or system, or each suc-cessful/unsuccessM hiunan action, or external events and plant states. Table 1 contains a portion of an event timeline from HERA analysis 341-2003-002-01, with each table row representing a new sub-event. 

Analysis of external events impact to energy system starts with determination of external event rate, the maximinn possible damage of the event to energy system is defined. 

The representation formalism chosen compared to the task analysis method structured of the Multilevel Hazop condensate the deviations into the category of events without breaking them down according to the source (whether they are results of human errors, plant and equipments malfunctions or external events)... 

The answers to the questionnaire indicate that in regulatory requirements there is a general trend towards full-scope PSA, including external events. But even though some standards and guides on external events PSA are available, the analysis of harsh weather conditions carmot be considered a well established practice internationally. In a few countries external events PSAs with a fairly wide spectrum of initiating events are underway. But mostly the analysis is limited to specific weather conditions which are well known to be hazardous due to the regional conditions. 

Structures, systems and components important to safety shonld not be shared between two or more nuclear power reactors. However, if this is done, it should be demonstrated by test, experiments or engineering analysis that aU safety requirements can be met for all reactors in all states. In the event of accident conditions involving one of the reactors, an orderly shutdown and decay heat removal of the other reactors should be achievable. Special consideration should be given to external events which could cause accidents in more than one plant. Common support systems should be able to cope with all the affected reactors. 

The human induced external events which are credible at a given site should be included in the set of PEs for safety analysis. This should include aircraft crashes, effects of nearby industrial plant and transportation system explosions. 

The PSA should set out to identify aU the fault sequences which contribute to risk determine if there are weaknesses in the design or operation of the plant and assess the need for changes to reduce the safety significance of such weaknesses. If the analysis does not address aU the contributions to risk (for example, if it omits external events or shutdown states) then conclusions made about the level of risk from the plant, the balance of the safety systems provided and the need for changes to be made to the design or operation to reduce the risk may be incorrect. 

Zonal Analysis A relatively new system safety analysis technique concerned with evaluating the geographic arrangement of installed systems, and its interconnections, as well as the influence of external events on those systems. 

---