Hazard Tree

The purpose of a hazard tree is to identify potential hazards, define the conditions necessary for each hazard, and identify the source for each condition. Thus, a chain of events can be established that forms a necessary series of required steps that results in the identified hazard. This is called a hazard tree. If any of the events leading to the hazard can be eliminated with absolute certainty, the hazard itself can be avoided. 

A hazard tree is constructed by first identifying potential hazards. Starting with the hazard itself, it is possible to determine the conditions necessary for this hazard to exist. For these conditions to exist, a source that creates that condition must exist and so forth. Using this reasoning, a hierarchy of events can be drawn, which becomes the hazard tree. In a hazard analysis an attempt is made, starting at the lowest level in the tree, to see if it is possible to break the chain leading to the hazard by elimi- 

This process is perhaps best illustrated by a simple example. Fi 14-1. shows a hazard tree developed for the hazard of injury  

It is obvious that it is impossible to be absolutely certain that the hazard tree can be broken. It is, however, possible to set standards for c design, lighting, door construction, etc., that will result in acceptabl quencies of collision, tripping, etc., given the severity of the exp injurv Irom the condition. That is, we could conclude that the probability of building failure should be lower than the probability of tripping becau.se of the. severity of injury that may bet 1 with building failure. 

It should be obvious from this discussion that the technique of creating a hazard tree is somewhat subjective. Different evaluators will likely classify conditions and sources differently and may carry the analysis lo further levels of sources. However, the conclusions reached concerning building design, maintenance, layout of traffic patterns, lighting, ok., should be the same. The purpose of developing the hazard tree is to l ocus attention and help the evaluator identify all aspects that must be considered in reviewing overall levels of safety. 

---

Safety analysis concepts are discussed in this chapter by first describing a generalized hazard tree for a production facility. From this analysis, decisions can be made regarding devices that could be installed to monitor process upset conditions and to keep them from creating hazards. 

Figure 14-1. Hazard tree for injury suffered while walking in a hallway.

Figure 14-2. Hazard tree for production facility. (Source API RP14.j...

The starred items in the hazard tree are changes in process conditions that could develop into sources and lead to hazards. These items are identified in Table 14-1 in the order of their severity. 

The hazard tree also helps identify protection devices to include in equipment design that may minimize the possibility that a source will develop into a condition. Examples would be flame arrestors and stack arrestors on fire tubes to prevent flash back and exhaust sparks, gas detectors to sense the presence of a fuel in a confined space, and fire... 

Methods for performing hazard analysis and risk assessment include safety review, checkhsts, Dow Fire and Explosion Index, what-if analysis, hazard and operabihty analysis (HAZOP), failure modes and effects analysis (FMEA), fault tree analysis, and event tree analysis. Other methods are also available, but those given are used most often. 

Process Hazards Analysis. Analysis of processes for unrecogni2ed or inadequately controUed ha2ards (see Hazard analysis and risk assessment) is required by OSHA (36). The principal methods of analysis, in an approximate ascending order of intensity, are what-if checklist failure modes and effects ha2ard and operabiHty (HAZOP) and fault-tree analysis. Other complementary methods include human error prediction and cost/benefit analysis. The HAZOP method is the most popular as of 1995 because it can be used to identify ha2ards, pinpoint their causes and consequences, and disclose the need for protective systems. Fault-tree analysis is the method to be used if a quantitative evaluation of operational safety is needed to justify the implementation of process improvements. 

Fault Tree Analysis Faiilt tree analysis permits the hazardous incident (called the top event) frequency to be estimated from a logic model of the failure mechanisms of a system. The top event is traced downward to more basic failures using logic gates to determine its causes and hkelihood. The model is based on the combinations of fail-... 

System designers often think dampers bloek airflow and are suitable to prevent baek drafts in idle towers. This is not the ease. Airfoil dampers simply hamper fan housing efficiency- they do not block airflow. Air Inlet Screens are always part of blow through, counterflow towers to protect people from rotating equipment. Some designs can be a hazard when accessible from the underside and require the specifier to call out additional screening. They can be a worthwhile accessory when there are nearby trees even when not required for safety reasons. Air inlet screens should be eliminated on towers utilizing inlet ductwork. Inlet ductwork may also make it necessary to block extraneous air entry such as from the underside when towers are elevated. 

Recognized systematic approaches include hazard operability study (HAZOP) event tree analysis fault tree analysis. 

Eault tree analysis is used to assess the frequeney of an ineident. A fault tree is a diagram that shows how primary eauses produee events, whieh ean eontribute to a partieular hazard. There are several pathways in whieh a single primary eause ean eombine with other primary eauses or events. Therefore, a single eause may be found in more than one hazard and may oeeur at different loeations in the fault tree. 

The graphieal strueture of the fault tree enables the primary eauses and seeondary events that produee the hazards to be eombined. It is then possible to eompare the relative eontributions of the different events to the probability of the hazardous outeome by employing the probability of oeeurrenee of eauses and events on the fault tree. 

Hazardous Waste Compliance Fault Tree Analysis (FTA)... 

It is illustrated in Section 3.4.4 by tracing the paths for leaking engine compression and applied to fault tree construction for the FFTF reactor Fullwood and Erdmann, 1974). The method involves writing Boolean equations for all paths whereby hazardous material may be released. It is primarily useful for enumerating release paths, but not for what started the release It was used to enumerate the possible paths for stealing nuclear bomb material from a facility. 

Thermo-diffusion calculations analyze the migration of hazardous material from compartment to compartment to release in containment. These calculations use physico-chemical parameters to predict the retention of hazardous materials by filtration, deposition on cold surfaces and other retention processes in the operation. Containment event trees aid in determining the amount, duration and types of hazardous material that leaves the containment. 

The frequency of an initiating event is usually based on industrial experience. If the process is new or rare, it may be estimated by a system model of the process steps (e.g., a fault tree) and using data from similar experience to give the probability of failure of the steps. Either of these estimates should consider the possibility of mitigating actions to prevent the hazard from having detrimental effects. 

All of these factors determine the stress experienced by the workers and the extent to which operational errors will be recovered before disastrous consequences have ensued. In this context, hazard identification techniques, such as hazard and operability studies (HAZOP), failure modes and effects and criticality analysis (FMECA), fault trees, and others are useful in making the process environment more forgiving. 

Figure 4.4 gives an example of an OAET for events that might follow release of gas from a furnace. In this example a gas leak is the initiating event and an explosion is the final hazard. Each task in the sequence is represented by a node in the tree structure. The possible outcomes of the task are depicted as "success" or "failure" paths leading out of the node. This method of task representation does not consider how alternative actions (errors of commission) could give rise to other critical situations. To overcome such problems, separate OAETs must be constructed to model each particular error of commission. 

Inspection of the HRA event tree reveals that the dominant human error is Error A the operator failing to isolate the propane valves first. The other potential human errors are factors only if a propane isolation valve sticks open. Based on these qualitative results alone, a manager rrught decide to periodically train operators on the proper procedure for isolating a failed condenser and to ensure that operators are aware of the potential hazards. The manager might... 

Hazard assessment findings are similar to audits, in that they are periodic measures. Hazard assessments might include Hazard and Operability (HA-ZOP) studies, What-If/Checklists, Fault Tree Analyses, or other techniques. The results of these studies will indicate what types of hazards exist and whether or not these hazards are sufficiently controlled. 

In this study detailed fault trees with probability and failure rate calculations were generated for the events (1) Fatality due to Explosion, Fire, Toxic Release or Asphyxiation at the Process Development Unit (PDU) Coal Gasification Process and (2) Loss of Availability of the PDU. The fault trees for the PDU were synthesized by Design Sciences, Inc., and then subjected to multiple reviews by Combustion Engineering. The steps involved in hazard identification and evaluation, fault tree generation, probability assessment, and design alteration are presented in the main body of this report. The fault trees, cut sets, failure rate data and unavailability calculations are included as attachments to this report. Although both safety and reliability trees have been constructed for the PDU, the verification and analysis of these trees were not completed as a result of the curtailment of the demonstration plant project. Certain items not completed for the PDU risk and reliability assessment are listed. 

---