Failures event trees

FIGURE 14.6 Flapper valve failure event tree. 

Methods for performing hazard analysis and risk assessment include safety review, checkhsts, Dow Fire and Explosion Index, what-if analysis, hazard and operabihty analysis (HAZOP), failure modes and effects analysis (FMEA), fault tree analysis, and event tree analysis. Other methods are also available, but those given are used most often. 

Event Trees. Event trees use an inductive logic approach to consider the effects of safety systems on an initiating event. The initiating event is propagated through the various safety functions. Branching is dependent upon the success or failure of the safety function. 

Frequency Phase 3 Use Branch Point Estimates to Develop a Ere-quency Estimate for the Accident Scenarios. The analysis team may choose to assign frequency values for initiating events and probability values for the branch points of the event trees without drawing fault tree models. These estimates are based on discussions with operating personnel, review of industrial equipment failure databases, and review of human reliability studies. This allows the team to provide initial estimates of scenario frequency and avoids the effort of the detailed analysis (Frequency Phase 4). In many cases, characterizing a few dominant accident scenarios in a layer of protection analysis will provide adequate frequency information. 

A significant development of the study was the use of event trees to link the system fault trees to (lie accident initiators and the core damage states as described in Chapter 3. This was a response to the ditficulties encountered in performing the in-plant analysis by fault trees alone. Nathan Villalva and Winston Little proposed the application of decision trees, which was recognized by Saul Levine a.s providing the structure needed to link accident sequences to equipment failure. 

It is necessary to check units to be sure they make sense. Fault trees are often associated with event trees in which only the initiator has the units of frequency and the fault trees are dimensionless probability. This dimensionless is achieved by failure rates being paired with a mis.sion time. 

Two types of initiators are internal and external. Internal initiators result from failures within a plant or the plant s support utilities. Thus, vessel rupture, human error, cooling failure, and loss of offsite power are internal events. All others are external events earthquakes, tornados, fires (external or internal), and floods (external or internal). Event trees can be used to analyze either type of initiator. 

The event" list, across the top of the event tree, specifies events for which the probability of failure (or success) must be specified to obtain the branching probabilities of the event tree. Events that are the failure of a complex system may require fault tree or equivalent methods to calculate the branching probability using component probabilities. In some cases, the branching probability may be obtained directly from failure rate data suitably conditioned for applicability, environment and system interactions. 

LOCA, is presented in Table 3.4.5-1. In preparing the event tree, reference to the reactor s design determines the effect of the failure of the various systems. Following the pipe break, the system should scram (Figure 3.4.5-2, node 1). If scram is successful, the line following the node goes up. Successful initial steam condensation (node 2 up) protects the containment from initial overpressure. Continuing success in these events traverses the upper line of the event tree to state 1 core cooled. Any failures cause a traversal of other paths in the evL-nl tree. 

Function event trees include primarily the engineered safety features of the plant, but other systems provide necessary support functions. For example, electric power system failure amid reduce the effectiveness of the RCS heat-removal function after a transient or small UJ( A. Therefore, EP should be included among the systems that perform this safety function. Siipfiort systems such as component-cooling water and electric power do not perform safety functions directly. However, they significantly contribute to the unavailability of a system or group of systems that perform safety functions. It is necessary, therefore, to identify support systems for each frontline ssstcm and include them in the system analysis. 

In any given situation, there may be different levels of dependence between an operator s performance on one task and on another because of the characteristics of the tasks theraseb e.s. or because of the manner in which the operator was cued to perform the tasks. Dependence levels between the performances of two (or more) operators also may differ. The analyses should account for dependency in human-error probabilities. In addition, each sequence may have a set of human recovery actions that if successfully performed will terminate or reduce the consequences of the sequence. This information, coupled with a knowledge of the system success criteria leads to the development of human success and failure probabilities which are input to the quantification of the fault iices or event trees. With this last step, the HRA is integrated into the PSA, and Pl. ise 4 is complete. 

Event trees used to identify complete and partial failure combinations,... 

A probabilistic statement of the likelihood of human-error events presents each error in the task analysis as the right limb in a binary branch of the HRA event tree. These binary branches form the chronological limbs of the HRA event tree, with the first potential error siai ting from the highest point on the tree. (Figure 4.5-4). Any given [ask appears as a two-limb branch the left limb represents the probability of success the right limb represents the probability of failure. 

Each binary fork is attached to a branch of the preceding fork and is conditioned by the success or failure represented by that branch. Thus, evei7 fork, represents conditional probability. Each limb of the HRA event tree is described or labeled, in shorthand. Capital letters (A) represent I ailure lower case letters (a) represent success. The same convention applies to Greek letters, which represent non-human error events, such as equipment failures. The letters S and F are exceptions to this rule in that they represent system success and failure respectively, in practice, the limbs may be labeled with a short description of the error lo eliminate the need for a legend. The labeling format is unimportant the critical task in developing HRA event trees is the definition of the events themselves and their translation to the trees. 

Greater likelihood of multiple failures. U s.itei v sy.stems requiring a more detailed event-tree development, and... 

Notice that one event has units of per-demand and the others have a per-unit-time dimension. From elementary considerations, the top event can only have dimensions of per-demand (pure probability) or per-unit-time dimensions. Which dimensions they have depends on the application. If the fault tree provides a nodal probability in an event tree, it must have per-demand dimensions, if the fault tree stands alone, to give a system reliability, it must have per-unit-time dimensions. Per-unit-time dimensions can be converted to probability using the exponential model (Section 2.5.2.6). This is done by multiplying the failure rate and the "mission time" to give the argument of the exponential which if small may be... 

Use of event trees to identify mitigating systems and their failure modes of interest ... 

Linking event tree and fault tree models to generate sequences of failure events using Hnntean logic and... 

Accident progression scenarios are developed and modeled as event trees for each of these accident classes. System fault trees are developed to the component level for each branch point, and the plant response to the failure is identified. Generic subtrees are linked to the system fault trees. An example is "loss of clcciric power" which is analyzed in a Markov model that considers the frequencies of lo,sing normal power, the probabilities of failure of emergency power, and the mean times to repair parts of the electric power supply. 

The accident sequence frequencies are quantified by linking the system fault tree models together as indicated by the event trees for the accident sequence and quantified with plant-specific data to estimate initiator frequencies and component/human failure rates. The SETS code solves the fault trees for their minimal cutsets the TEMAC code quantitatively evaluates ihe cm sols and provides best estimates of component/event probabilities and frequencies. 

Its unique design suggests several accident scenarios that could not occur at other reactors. For example, failure to supply ECC to 1/16 of the core due to the failure of an ECC inlet valve. On the other hand, some phenomena of concern to other types of reactors seem impossible (e.g., core-concrete interactions). The list of phenomena for consideration came from previous studies, comments of an external review group and from literature review. From this, came the issues selected for the accident progression event tree (APET) according to uncertainty and point estimates. 

The OWR protective systems were modeled with event tree diagrams for the time sequence following an initiating event to fuel damage or safe shutdown. Fault trees were used to find the probability of failure of each protective system in a particular event tree. 

ANSPIPE Calculates pipe break probability using the Thomas Model BETA Calculates and draws event trees using word processor and other input BNLDATA Failure rate data... 

Put a branch in the containment event tree for the success or failure of the off-gas syst id... 

FIGURE 4.4. Event Tree for a Gas Leak from a Furnace (S=Success F=Failure). 

The decomposition approach is used, it is necessary to represent the way in which the various task elements and other possible failures are combined to give the failure probability of the task as a whole. Generally, the most common form of representation is the event tree (see Section 5.7). This is the basis for THERP, which will be described in the next section. Fault trees are only used when discrete human error probabilities are combined with hardware failure probabiliHes in applications such as CPQRA (see Figure 5.2). 

During the final stage of the decomposition approach, the task element probabilities in the event tree are combined together using the rules described in Section 5.3.3 to give the overall task failure probability. At this stage, various corrections for dependencies among task elements may be applied. 

---