Quantitative Risk

Assessment
 Hazard analysis: What is it?

Hazard: Potentially dangerous condition, which is triggered by

an event, called the cause of the hazard.

Risk: hazard that is associated with a severity and a probability

of occurrence.
 Hazard analysis: What is it?

Hazard analysis: Identify all possible hazards potentially

created by a product, process or application.

Risk assessment: It is the next step after the collection of

potential hazards. Risk in this context is the probability
and severity of the hazard becoming reality.
 Hazard analysis: What is it?

When performed:
Before the design begins.

Information used:
· Literature,
· Scenarios,
· Expert opinions,
· Personal experience.
 Hazard analysis: What is it?

E s ta b li s h A n a lys is P a r a m e te rs

Id e n tify H a z a r d s These parameters can be limits of

the machine or design, limits on
A s s e s s R is ks
uses, limits on the scope of the
D e riv e R i s k R a tin g analysis, or other limits.
R e d u ce R i s ks

V e rify E ffe c tiv e n e ss

D o c u m e n t R e s u lts
 Hazard analysis: What is it?

E s ta b li s h A n a lys is P a r a m e te rs

Id e n tify H a z a r d s The nature of this step lends

itself to a team approach such
A s s e s s R is ks
as brainstorming.
D e riv e R i s k R a tin g

R e d u ce R i s ks

V e rify E ffe c tiv e n e ss

D o c u m e n t R e s u lts
 Hazard analysis: What is it?

E s ta b li s h A n a lys is P a r a m e te rs
Risk matrix:
Id e n tify H a z a r d s Severity Category
Probability Level Catastrophic Critical Marginal Negligible
A s s e s s R is ks Frequent High High Serious Serious
Probable High High Serious Low
D e riv e R i s k R a tin g Occasional High Serious Low Low
Remote Serious Low Low Low
R e d u ce R i s ks Improbable Serious Low Low Low

If the risk is determined to not be acceptable, it is necessary to reduce

V e rify E ffe c tiv e n e ss
that risk by implementing protective measures.

D o c u m e n t R e s u lts
 Hazard analysis: What is it?

E s ta b li s h A n a lys is P a r a m e te rs
Remedy actions are taken to reduce risks
Id e n tify H a z a r d s following the hazard hierarchy:

A s s e s s R is ks
• Eliminate hazards through the design
D e riv e R i s k R a tin g · Protect
· Warn the user
R e d u ce R i s ks · Train the user(s)
· Personal protective equipment
V e rify E ffe c tiv e n e ss

D o c u m e n t R e s u lts
 Hazard analysis: What is it?

E s ta b li s h A n a lys is P a r a m e te rs

Id e n tify H a z a r d s This assessment verifies that the

remedy actions have reduced the
A s s e s s R is ks
risks to an acceptable level.
D e riv e R i s k R a tin g

R e d u ce R i s ks

V e rify E ffe c tiv e n e ss

D o c u m e n t R e s u lts
 Hazard analysis: What is it?

When to stop:

There is no zero risk, always some residual risk

remains.

If the residual risk is acceptable, then the risk

assessment process is completed.
 Hazard analysis: What is it?

Caution:
Any hazard, which is not identified, will not be addressed
by safety measures and will not be detecting during testing.

Hazard not identified during this analysis can create

substantial risk to users of the design.
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e

Concept Definitions

Hazard – An intrinsic chemical, physical, societal, economic or political

condition that has the potential for causing damage to a risk
receptor (people, property or the environment).

A hazardous event requires an initiating event or failure and then either failure of
or lack of safeguards to prevent the realisation of the hazardous event.

Examples of intrinsic hazards:

• Toxicity and flammability – H2S in sour natural gas
• High pressure and temperature – steam drum
• Potential energy – walking a tight rope
12
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e

Concept Definitions

Risk – A measure of human injury, environmental damage or

economic loss in terms of both the frequency and the
magnitude of the loss or injury.

Risk = Consequence x Frequency

13
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e

Concept Definitions

Risk

Intrinsic Undesirable Consequence

Hazards Event s
Likelihood Likelihood of
of Event Consequences

Example Loss of life/

Storage property,
tank with Spill and Environmental
flammabl Fire damage,
e Damage to
material reputation of
facility 14
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e

Concept Definitions

Risk

Intrinsic Undesirable Consequence

Hazards Event s
Cause
s Likelihood Likelihood of
of Event Consequences

15
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e

Concept Definitions Layers of Protection are used to

enhance the safe operation. Their
Risk Layers of Layers of primary purpose is to determine if
Protection Protection there are sufficient layers of
protection against an accident
scenario – Can the risk of this
scenario be tolerated?
Intrinsic Undesirable Consequence
Hazards Event s
Cause
s Likelihood Likelihood of
of Event Consequences

Preparedness,
Prevention Mitigation,
Land Use Planning,
Response, Recovery

16
Japan’s Nuclear Crisis: 11 March,
2011
Bangladesh
• Electricity consumption (2003) 16,196 GW·h
Fukushima I (Daiichi) Nuclear Power Plant
• Annual generation 29,891 GW·h
Fukushima I NPP, 2004

Source: Digital Globe, First Watch, Imagery Report, Japan Earthquake/Tsunami, March 2011
18
March 14

19
 What Happened?
 The earthquake caused all operating reactors to
automatically shut down (control rods are
inserted, which stop the nuclear fission reaction
by absorbing neutrons)
 Emergency diesel generators, which started to run
the cooling system after the electrical power grid
failed, shut down about an hour after the
earthquake
 When cooling fails in a fully operational reactor or
shortly after shutdown, the water quickly boils off
creating increasing steam pressure in the core
containment vessel and exposing the dry fuel
assembly to increasing temperatures and
radiation. The zirconium metal assembly reacts
with the steam to give hydrogen and oxygen, an
explosive mix
 Responses to the Threat

 First, the plant’s operators attempted to pump cold sea

water directly into the reactors to replace the boiled-off
coolant water. (Sea water is very corrosive and will
undoubtedly damage the metal parts of the reactor, and
its complex mixture of contents will also complicate the
cleanup. This means to never running it again without a
complete replacement of its hardware. As an added
precaution, the seawater was spiked with a boron
compound in order increase the absorption of neutrons
within the reactor).
 Next, the bleeding off of some pressure from the reactor
vessel in order to lower the risk of a catastrophic failure.
(This was also an unappealing option, given that the Seawater pump
steam would necessarily contain some radioactivity.
Still, it was considered a better option than allowing the
container to burst)
 Design Errors
 The electrical rooms at these plants are
at the basements
 Although the plant was ready for an
extreme event, it clearly wasn’t
designed with a tsunami in mind—it is
simply impossible to plan for every
eventuality. However, this seems to be a
major omission given the plant’s
location. It also appears that the fuel
storage areas weren’t nearly as robustly
designed as the reactors
Design Errors (cont’d)

 However it is human nature for the less immediate

backup systems to be not well designed or maintained as
the primary backups, one example is the temporary
holding ponds. temporary storage pool for reactor #4 to
which the fuel had been transferred while maintenance is
performed is a much smaller one near the top the
reactor. Unlike the 15-metre deep permanent storage
pools
 Another example is that the backup portable generators –
planned for when the batteries were exhausted – which is
the 3rd (or 4th ) backup for power generation – had the
wrong connectors and so could not be used
Case History 1: ( Washington DC, Manufacturing
Chemists’ association)

 Static Electricity :Tank car loading explosion

 Two plant operators were filling a tank car with vinyl
acetate. After few seconds the contents of the tank
exploded, one operator died from fractured skull and
body burns
 Caused by a static spark jumped from the steel nozzle to
the tank car
Case History 2: ( Washington DC, Manufacturing
Chemists’ association)

 Chemical Reactivity
 Bottle of isopropyl ether; A chemist twisted
the cap of a bottle of isopropyl ether to open
it. As the cap broke loose, the bottle exploded.
The man died due to massive internal
hemorrhage.
 Caused by rapid decomposition of peroxides,
which formed in the ether while the bottle sat
in storage.
Case History 3: ( Washington DC, Manufacturing
Chemists’ association)
 System Design
 Ethylene oxide explosion: A process storage tank
contained 6500 gal of ethylene oxide. It was
accidentally contaminated with ammonia. The tank
ruptured and dispersed ethylene oxide into the air. A
vapor cloud was formed and immediately exploded.
One person was killed and nine were injured;
property losses $16.5 million
 Lack of design protection to prevent back up of
ammonia into the storage tank.
Case History 4: ( Washington DC, Manufacturing
Chemists’ association)

 System Procedure
 Man working in a Vessel: two maintenance
workers were replacing part of a ribbon in a
large ribbon mixer. The main switch was left
energized, the mixer was stopped with one of
three start-stop buttons. The operator by
mistake pushed one of the start stop button ,
the mixer started and the mechanic inside
was killed.
 Example of Disaster: Bhopal, India (December
3, 1984)
 Plant Location: Madhya Pradesh,
central India; nearest inhabitants
were 1.5 miles away, but a shanty
town grew nearby.
 Produced Pesticides; owned by
Union Carbide and partially owned
locally
 Intermediate compound methyl iso-
cyanate (MIC): reactive, toxic,
volatile, flammable and vapor
heavier than air. Union Carbide Corporation
 MIC unit was not operating because
of labor dispute
Bhopal Disaster PLANT VIEW
Toxic Materials in Soil and Water
Victims
 Bhopal Disaster

MIC STORAGE TANK

Picture shows the tank as it is today.
Gas Vent Scrubber Gas Vent Scrubber Stack
 Bhopal Disaster

PLANT VIEW
Picture shows the plant as it is today.
Example of Disaster cont’d

 Accident:
 Storage tank containing large amount of MIC became contaminated
by water, heated by reaction; vapor traveled through pressure relief
system into a scrubber and flare system that was not operating
 25 tons toxic MIC vapor released, spread to the adjacent town
killing over 2000 civilians and injuring 20,000 more. No plant
workers were killed.
 Recommendation:
 Alternative reaction scheme or redesigning of the process with
reduced inventory of MIC (less than 20 pounds)
CO2 Stripper Failure of UFFL- 1991
(Ghorashal)
 CO2 stripper contains carbamate solution,CO2 and
ammonia and runs under high pressure
 Stripper column exploded and split into two halves
in middle section during trial run
 11 deaths including the project director
CO2 Stripper Failure of UFFL- 1991
(Ghorashal)
 Accident due to fabrication defect-crack in welding joint.
Safety valve did not blow and the pressure was within
permissible limit
 Field test was not done, vendors carried out the test
 Power generation system tripped, no emergency light,
rescue team arrived after more than an hour,
colleagues in nearby residence did not come out
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e

Data can be used to calculate the frequency of

initiating events, hazard outcomes and the severity of
the consequence.

Analysis Techniques
1. Frequency modelling techniquesUsed to estimate
2. Common-cause failure analysis frequencies or probabilities
3. Human reliability analysis from basic data. Typically
used when detailed
4. External events analysis
• Used

historical data is not

available.

i. EVENT TREES
ii. FAULT TREES 38
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e

Data can be used to calculate the frequency of

initiating events, hazard outcomes and the severity of
the consequence.

Analysis Techniques
1. Frequency modelling techniques
2. Common-cause failure analysis Used to identify and analyse
single events which can
3. Human reliability analysis lead to failure of multiple
4. External events analysis
• Used components within a
system.

39
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e

Data can be used to calculate the frequency of

initiating events, hazard outcomes and the severity of
the consequence.

Analysis Techniques
1. Frequency modelling techniques
2. Common-cause failure analysis Used to provide quantitative
3. Human reliability analysis estimates of human error
4. External events analysis frequencies for use in fault
tree analysis.
• Used

40
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e

Data can be used to calculate the frequency of

initiating events, hazard outcomes and the severity of
the consequence.

Analysis Techniques
1. Frequency modelling techniques
2. Common-cause failure analysis
3. Human reliability analysis Used to identify and assess
4. External events analysis external events (i.e. plane
crash, terrorist activities,
• Used

earthquakes) which can

initiate potential incidents.

41
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e

Data can be used to calculate the frequency of

initiating events, hazard outcomes and the severity of
the consequence.

Analysis Techniques
1. Frequency modelling techniques Used to estimate
2. Common-cause failure analysis frequencies or probabilities
3. Human reliability analysis from basic data. Typically
used when detailed
4. External events analysis
• Used

historical data is not

available.

i. EVENT
We will focus on event and fault trees as frequency TREES
modelling
techniques. ii. FAULT TREES 42
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees
• Fault trees are logic diagrams.
• They are a deductive method to identify which hazards can lead
to a system failure.
• The analysis starts with a well-defined accident and works
backwards towards the scenarios that can cause the accident.

43
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – Typical Steps

STEP 1 – Start with a major hazardous event (release of toxic/flammable
material, vessel failure). This is called a TOP
EVENT.
STEP 2 – Identify the necessary and sufficient causes for the top event
to occur.
How can the top event happen?
What are the causes of this event?
STEP 3 – Continue working backwards and follow the series of events
that would lead to the top event. Go backwards until a
basic event with a known frequency is reached (pump
failure, human error). 44
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – Simple Example

Car Flat Tire
(TOP EVENT)

Driving over Tire failure

debris on the
road

Defecti Worn
ve Tire Tire
This is not an exhaustive list of failures.
Failures could also include software, human and environmental 45
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – Simple Example

Car Flat Tire
(TOP EVENT)

Driving over Tire INTERMEDIAT

debris on the failure E EVENT
road

Defecti Worn
ve Tire Tire

46
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – Simple Example

Car Flat Tire
(TOP EVENT)

Driving over Tire failure

debris on the
road

BASIC Defectiv Worn

EVENTS e Tire Tire

Let’s now format this tree as a fault tree logic diagram.

47
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – Simple Example, Logic Diagram

TOP EVENT Car Flat Tire

OR

Tire failure

Driving OR
over
debris on
the road Defecti Worn
ve Tire Tire
48
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Tree Logic Transfer Components

BASIC EVENT
AND GATE This is fault event with a known
Output event requires frequency and needs no further
simultaneous occurrence of all definition.
input events
INTERMEDIATE EVENT
An event that results from the
OR GATE interaction of other events.
Output event requires the
occurrence of any individual
UNDEVELOPED EVENT
input event.
An event that cannot be
developed further due to lack of
INHIBIT EVENT information.
Inhibit Output event will not occur
EXTERNAL EVENT
Condition if the input and the inhibit An event that is a boundary
condition occur
condition to the fault tree. 49
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – BEFORE YOU START DRAWING THE TREE, Preliminary Steps

STEP 1 – Precisely define the top event.

High reactor temperature
Liquid level too high

Reactor explosion
TOO VAGUE
Fire in process line

Leak in valve TOO SPECIFIC

50
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – BEFORE YOU START DRAWING THE TREE, Preliminary Steps

STEP 2 – Define pre-cursor events.

What conditions will be present when the top event
occurs?
STEP 3 – Define unlikely events.
What events are unlikely to occur and are not being
considered? Wiring failures, lightning, tornadoes,
hurricanes.

STEP 4 – Define physical bounds of the process.

What components are considered in the fault tree? 51
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – BEFORE YOU START DRAWING THE TREE, Preliminary Steps

STEP 5 – Define the equipment configuration.

What valves are open or closed?
What are liquid levels in tanks?
Is there a normal operation state?
STEP 6 – Define the level of resolution.
Will the analysis consider only a valve or is it necessary
to consider all valve components?

52
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – DRAWING THE TREE

STEP 1 – Draw the top event at the top of the page.
STEP 2 – Determine the major events (intermediate, basic, undeveloped
or external events) that contribute to the top event.
STEP 3 – Define if these events using logic functions.
a. AND gate – all events must occur in order for the top event to
occur
b. OR gate – any events can occur for the top event to occur
c. Unsure? If the events are not related with the OR or AND gate, the
event likely needs to be defined more precisely.
STEP 4 – Repeat step 3 for all intermediate events and then all subsequent
basic, undeveloped or external events. Continue until all 53
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – Chemical Reactor Shutdown Example

A chemical reactor is fitted with a

high pressure alarm to alert the
operator in the event of dangerous
reactor pressures. An reactor also
has an automatic high-pressure
shutoff system.
The high pressure shutoff system
also closes the reactor feed line
through a solenoid valve.
The alarm and feed shutdown
systems are linked in parallel.
54
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Fault Trees – Chemical Reactor Shutdown Example

Define the Problem
TOP EVENT = Damage to the reactor by overpressure
EXISTING EVENT = High process pressure
UNALLOWED EVENTS = Failure of mixer, electrical failures,
wiring failures, tornadoes, hurricanes, electrical storms
PHYSICAL BOUNDS = Process flow diagram (on left)
EQUIPMENT CONFIG = Reactor feed flowing when solenoid
valve open
RESOLUTION = Equipment shown in process flow diagram

55
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

TOP EVENT Reactor Overpressure

1. Start by writing out the top

event on the top of the page in the
middle.

56
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

TOP EVENT Reactor Overpressure

AND A

Tire failure Tire failure

2. The AND gate notes that two events must

occur in parallel. These two events are
intermediate events.
57
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

TOP EVENT Reactor Overpressure

3. The OR gates
define one of two AND A
events can occur.
Alarm Indicator Emergency Shutdown
Failure Failure
OR B OR C

Pressure Pressure Pressure Solenoid

Switch 1 Indicator Switch 2 Valve
Failure Light Failure Failure Failure
58
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

TOP EVENT Reactor Overpressure

4. We’ll give a
number to each of AND A
the basic events.
Alarm Indicator Emergency Shutdown
Failure Failure
OR B OR C

Pressure Pressure Pressure Solenoid

Switch 1 Indicator Switch 2 Valve
Failure Light Failure Failure Failure
1 2 3 4
59
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Chemical Reactor Shutdown Example – Determining Minimal Cuts

After drawing a fault tree, we can determine the various set of events that
could lead to the top event. This is called the minimal cut sets.
Each minimal cut set will be associated with a probability of occurring –
human interaction is more likely to fail that hardware.
It is of interest to understand sets that are more likely to fail using failure
probability. Additional safety systems can be installed at these points in the
system.

60
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Chemical Reactor Shutdown Example – Determining Minimal Cuts

1. Write drop the first logic gate below the
top event.

2. AND gates increase the number of

events in the cut set. Gate A has two
inputs: B and C. The AND gate is replaced
by its two inputs.

AB C
61
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Chemical Reactor Shutdown Example – Determining Minimal Cuts

3. OR gates increase the number of sets.
Gate B has inputs from events 1 and 2. Gate B
is replaced by one input and another row is
added with the second input.

AB1 C
2 C
4. Gate C has inputs from basic events 3 and 4.
Replace gate C with its first input and additional
rows are added with the second input.

62
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Chemical Reactor Shutdown Example – Determining Minimal Cuts

4. Gate C has inputs from basic events 3 and 4.
Replace gate C with its first input and additional
rows are added with the second input. The
second input from gate C are matched with
gate B.

AB1 C 3
2 C 3
1 4
2 4
63
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Chemical Reactor Shutdown Example – Determining Minimal Cuts

5. The top event can occur following
one of these cut sets:

Events 1 and 3
Events 2 and 3
Events 1 and 4
Events 2 and 4

64
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Quantifying the Probability of the Top Event

Process equipment failures occur following interactions of individual
components in a system. The type of component interaction dictates the
over probability of failure.
A component in a system, on average, will fail after a certain time. This is
called the average failure rate (µ, units: faults/time).
Using the failure rate of a component, we can determine its reliability and
probability of Failure
failure.Rate Probability Reliability

µ P(t) ∫ 𝑓 ( 𝑡 ) 𝑑𝑡 R(t) 1-p(t)

0

Time, t Time, t Time, 65

 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Quantifying the Probability of the Top Event

Failure Probability (unreliability)
Failure Rate Reliability

µ R(t) 1-p(t) P(t) ∫ 𝑓 ( 𝑡 ) 𝑑𝑡

0

Time, t Time, t Time,

t
R(t) = P(t) = 1- R(t)
−𝜇 𝑡
¿ 1 −𝑒

66
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie
Quantifying the Probability
of the Top Event
Failure data for typical
process components can
be obtained from
published texts.

67
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Quantifying the Probability of the Top Event

Component Failure Rate, µ (faults/year) R(t) P(t)
The failure probability Control Valve 0.60 0.55 0.45
and reliability of a Flow Measurement
Fluids 1.14 0.32 0.68
component can be Solids 3.75 0.02 0.98

calculated from its known Flow Switch 1.12 0.33 0.67

failure rate. Hand Valve

Indicator Lamp
0.13
0.044
0.88
0.96
0.12
0.04
Level Measurement
Liquids 1.70 0.18 0.82
Solids 6.86 0.001 0.999

pH Meter 5.88 0.003 0.997

Pressure Measurement 1.41 0.24 0.76
Pressure Relief Valve 0.022 0.98 0.02
Pressure Switch 0.14 0.87 0.13
Solenoid Valve 0.42 0.66 0.34
Temperature Measurement
Thermocouple 0.52 0.59 0.41
Thermometer 0.027 0.97 0.03
68
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Quantifying the Probability of the Top Event

We’ve discussed the failure probability of individual components. Failures in
chemical plants, however, result following the interaction of multiple
components. We need to calculate the overall failure probability and
reliability of these component interactions.

Components in Parallel P- AND gates R

P Probability
Failure P R
Reliability R
P 2 R2
n is the total number of components n is the total number of
Pi is the failure probability of each component components
Ri is the reliability of each
component
Components in Series – OR gates
Failure Probability P ReliabilityR
P P R R
P2 R2 69
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Quantifying the Probability of the Top Event

Calculations for failure probability can be simplified for systems comprised
of two components, A and B, in series.
P
Can be expanded to:
P

70
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Quantifying the Probability of the Top Event

Two methods are available:
1. The failure probability of all basic, external and undeveloped events are
written on the fault tree diagram.
2. The minimum cut sets can be used. As only the basic events are being
evaluated in this case, the computed probabilities are all events will be
larger than the actual probability.

71
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Reactor Example – Quantifying the Probability of the Top Event

Fault Tree Diagram Method
We must first compiled the
reliability and failure probabilities
of each basic event from tables.

Component Reliability, R Failure Probability, P

Pressure Switch 1 0.87 0.13
Alarm Indicator 0.96 0.04
Pressure Switch 2 0.87 0.13
Solenoid Valve 0.66 0.34

Remember P = 1-
R
72
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Reactor Example – Quantifying the Probability of the Top Event

Fault Tree Diagram Method AND gate
PA R
= (0.165)(0.426) = 1 – 0.0702
P = 0.0702 = 0.930
OR gate
B
R P OR gate C
= (0.87)(0.96) = 1 – 0.835
R =(0.87)
= 0.835 = 0.165 (0.66)=0.574
P = 1-0.574 = 0.426

The total
failure
probability is
P= P= P= P= 0.0702.
0.13 0.04 0.13 0.34
R= R= R= R= 73
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Reactor Example – Quantifying the Probability of the Top Event

Minimum Cut Set
Method
Events 1 and 3 P(1 and 3) = (0.13)(0.13) =
0.0169
Events 2 and 3 P(2 and 3) = (0.04)(0.13) =
0.0052
Events 1 and 4 P(1 and 4) = (0.13)(0.34) =
0.0442
Note that the failure probability calculated
Events 2 andminimum
using 4 P(2
cut and
sets 4) = (0.04)(0.34)
is greater than =
0.0136 using the actual fault tree. 74
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Words of Caution with Fault Trees

• Fault trees can be very larger if the process is complicated. A real-
world system can include thousands of gates and intermediate
events.

• Care must be taken when estimating failure modes – best to get

advice from experienced engineers when developing complicated
fault trees. It is important to remember that fault trees are
inexact and will differ between engineers.

• Failures in fault trees are HARD – a failure will or will not failure,
there cannot be a partial failure.

75
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Moving from Control Measures to Consequences

• We can move from thinking about the basic events that will
initiate a top event to the consequence that can follow the top
event. This can be done using Event Trees.

• TOP EVENT (Fault Tree) = INITIATING EVENT (Event Tree)

76
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees
Possible Event A Safety System Impact 1

Initiating
Possible Event B Safety System Impact 2
Event

Possible Event C Safety System Impact 3

When an accident occurs, safety systems can fail or succeed.

Event trees provide information on how a failure can occur.

77
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Typical Steps

1. Identify an initiating event
2. Identify the safety functions designed to deal with the initiating
event
3. Construct the event tree
4. Describe the resulting sequence of accident events.
The procedure can be used to determine probability
of certain event sequences. This can be use to
decide if improvement to the system should be
made.
78
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Chemical Reactor Example

What happens if
there is an
accident due to a
loss of coolant?

High Temperature
Alarm
79
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Chemical Reactor Example

Safety operations following the loss

of coolant (the initiating event)
High temp alarm alerts operator
0.01 failures/demand
Operator acknowledges alarm
0.25 failures/demand
Operator restarts cooling system
0.25 failures/demand
Operator shuts down reactor
0.1 failures/demand
High Temperature
Alarm
80
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Chemical Reactor Example

Safety operations following the loss

of coolant (the initiating event)
High temp alarm alerts operator
0.01 failures/demand
We can note
the Operator acknowledges alarm
frequency of 0.25 failures/demand
each safety
function Operator restarts cooling system
0.25 failures/demand
Operator shuts down reactor
0.1 failures/demand
High Temperature
Alarm
81
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Chemical Reactor Example

Safety operations following the loss

of coolant (the initiating event)
High temp alarm alerts operator [B]
0.01 failures/demand
And assign
an ID to Operator acknowledges alarm [C]
each 0.25 failures/demand
operation
Operator restarts cooling system [D]
0.25 failures/demand
Operator shuts down reactor [E]
0.1 failures/demand
High Temperature
Alarm
82
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Chemical Reactor Example

1. Start by writing out the

initiating event on the left side of
the page, in the middle.

Loss of coolant
(initiating
event)

83
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Chemical Reactor Example

1. Start by writing out the

initiating event on the left side
of the page.
2. Note the frequency of this
event (occurrences per year)

Loss of coolant
(initiating event)
1 occurrence/year

84
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Chemical Reactor Example

ID B (High Temp Alarm Alerts 3. We’ll call the initiating event A and also
Operator) note the occurrence per year.
0.01 failures/demand
4. Draw a line from the initiating event to
the first safety function (ID B) – a straight
Success line up indicates the results for a success
of Safety in the safety function and a failure is
A Function B represented by a line drawn down.

1 5. We can assume the high temp alarm

Failure will fail to alert the operator 1% of the
Loss of coolant time when in demand OR 0.01
(initiating event) of Safety failure/demand.
Function
1 occurrence/year
B
85
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Chemical Reactor Example

Safety Function
7. Consider Safety Function B (operator
ID B (High Temp Alarm Alerts Operator) alerted by temperature safety alarm).
0.01 failures/demand There are 0.01 failures/demand of this
function.
Success 0.99
of Safety
Function B
A Success of Safety Function B
= (1- 0.01)* 1 occurrence/year
1 = 0.99 occurrence/year
Failure
Loss of coolant of Safety
(initiating event) Function B Failure of Safety Function B
1 occurrence/year = 0.01 * 1 occurrence/year
0.01 = 0.01 occurrence/year
86
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

ID C (Operator Acknowledges
Alarm)
0.25 failures/demand
ID B 8. If the safety function does not apply for
the scenario, the horizontal line continues
through the function.
Success
0.99

A Success of Safety Function C

Success = (1- 0.25 failures/demand)* 0.01
1 occurrence/year
0.007
Loss of coolant Failure 5 = 0.0075 occurrence/year
(initiating event) 0.01 Failure of Safety Function C
Failure = 0.25 failures/demand *0.0 1
1 occurrence/year
0.0025 occurrence/year
= 0.0025 occurrence/year
87
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie
ID B ID C ID D (Cooling System
Restarted)
0.25 failures/demand
Success of Safety Function D
0.7425 = (1- 0.25 failures/demand)* 0.99
= 0.0075 occurrence/year
Success 0.2475
0.99 Failure of Safety Function D
= 0.25 failures/demand* 0.99
= 0.0075 occurrence/year
Loss of A 0.00562
coolant
5
(initiating 1 0.00187
event) 0.007 5
Failure 5 Similar calculation
1
occurrence/ for remaining
0.01 0.00187 scenarios.
year
5
0.0025 0.000625
88
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie
ID B ID C ID D ID E (System Shutdown)
0.1 failures/demand
Continue
0.7425 Operation
0.2475 0.2227
Success
0.99 0.02475

Continue
A 0.005625 Operation
0.001875 0.001688
1
0.0075 0.000187
Failure 5
0.01 Continue
0.001875
Operation
0.000567
0.0025 0.000625 5
0.000062
5 89
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie
ID B ID C ID D ID E

Continue Operation
0.7425

0.2475 0.2227 Shutdown

Success
0.99 0.02475
Runway

Continue Operation
A 0.005625

1 0.001875 0.001688 Shutdown

0.0075 0.000187
Failure 5 Runway
0.01 Continue Operation
0.001875
0.000567 Shutdown
0.0025 0.000625 5
0.000062
Runway 90
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie
ID B ID C ID D ID E
Sequence of Safety Function
Failures
Continue Operation
A
0.7425

0.2475 0.2227 Shutdown AD

Success
0.02475
0.99 Runway ADE

Continue AB
A 0.005625 Operation
0.001875 0.001688 Shutdown ABD
1
0.0075 0.000187
Failure 5 Runway ABDE

0.01 Continue ABC

0.001875
Operation
0.000567 Shutdown ABCD
0.0025 0.000625 5
0.000062
5 Runway ABCDE 91
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie
Sequence ofOccurrences/year
Safety Function
Continue A Failures 0.7425
Operation
9. The initiating event is used to
Shutdown AD 0.2227 indicate by the first letter in the
sequence (ie. A).
Runway ADE 0.02475 10. The sequence ABE indicates an
the initiating event A followed by
Continue AB 0.005625 failures in safety functions B and E.
Operation
Shutdown ABD 0.001688 11. Using the data available
provided on the failure rates of the
Runway ABDE 0.0001875
safety functions, the overall runway
Continue ABC 0.001875 and shutdown occurrences per year
Operation can be calculated.
Shutdown ABCD 0.0005675

Runway ABCDE 0.0000625

92
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie
Sequence ofOccurrences/year
Safety Function
Continue A Failures 0.7425 Total Shutdown
Operation Occurrences per year
Shutdown AD 0.2227
= 0.2227 + 0.001688 + 0.0005675
= 0.225 occurrences/year
Runway ADE 0.02475
= Once every 4.4 years
Continue AB 0.005625
Operation
Shutdown ABD 0.001688
Total Runway
Runway ABDE 0.0001875 Occurrences per year

Continue ABC 0.001875 = 0.02475 + 0.001875 + 0.0000625

Operation = 0.025 occurrences/year
Shutdown ABCD 0.0005675 = Once every 40 years

Runway ABCDE 0.0000625

93
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Chemical Reactor Example

What happens if there is an

accident due to a loss of
coolant?
• A system shutdown will occur one
every 4.4 years.
• A runway will occur one every 40
years.

High Temperature
Alarm
94
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees – Chemical Reactor Example

What happens if there is an

accident due to a loss of
coolant?
• A system shutdown will occur one
every 4.4 years.
• A runway will occur one every 40
years.
A runway reaction once every 40 years is
considered to high! Installation of a high
temperature reactor shutdown function
High Temperature could decrease this occurrence rate.
Alarm
95
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Summary of Event Trees

• The objective is to identify important possible safety failures from
an initiating event that could have a bearing on risk assessment.

• Primary purpose is to modify the system design to improve safety.

• Real systems are complex which can result in large event trees.

• The risk analysis MUST know the order and magnitude of the
potential event outcome consequences before starting the event
tree.

• The lack of certainty that a consequence will result from a selected

failure is the major disadvantage of event trees. 96
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees and Fault Trees

Co ur es
ntr as
Eve o lM e
nt
1 eas er yM rre
u
nce
ure o v Occ
c ce
Re
Event s
2 ccurren
O6

Initiating Event 3 Fault Top Event 5

Occurrence 4

Tree Event Tree Occurrence 3 Consequenc

Events Event 4
Occur
rence
es
Event 5 Oc 2
cur
6 1 ren
nt ce
Eve

Working Backwards Working Forwards

Deduction Process Induction Process 97
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Fault Trees Event Trees Bow-Tie

Event Trees and Fault Trees = BOW-TIE

Co ur es
ntr as
Eve o lM e
nt
1 eas er yM rre
u
nce
ure o v Occ
c ce
Re
Event s
2 ccurren
O6

Initiating Event 3 Fault Top Event 5

Occurrence 4

Tree Event Tree Occurrence 3 Consequenc

Events Event 4
Occur
rence
es
Event 5 Oc 2
cur
6 1 ren
nt ce
Eve

Working Backwards Working Forwards

Deduction Process Induction Process 98
 Hazardous Modelling Quantitativ
Risk Final
Review Material e Frequency
Consequenc Source Hazard Effect Estimation Thoughts
Release Analysis
e
Problem 1: The storage tank system shown in Figure 11-18 is
used to store process feedstock. Overfilling of storage tanks is
a common problem in the process industries. To prevent
overfilling, the storage tank is equipped with a high-level
alarm and a high-level shutdown system. The high-level
shutdown system is connected to a solenoid valve that stops
the flow of input stock.
a). Develop an event tree for this system using the "failure of
level indicator" as the initiating event. Given that the level
indicator fails 4 times/yr, estimate the number of overflows
expected per year. Use the following data:
b)Develop a fault tree for the top event of "storage tank
overflows." Use the data in Table 11-1 to estimate the failure
probability of the top event and the expected number
of occurrences per year. Determine the minimal cut sets.
What are the most
likely failure modes? Should the design be improved?